Sample details: 01b356e8622e6b76721ca7fca9c096e3 --

Hashes
MD5: 01b356e8622e6b76721ca7fca9c096e3
SHA1: 5d451a793fb69edf5455d4ccb6502291711ac1b8
SHA256: 10a6384aa1035291c71af0a76815cd26c8b84e8404e9ec2062ff1d8814658182
SSDEEP: 24576:mBN+VCa615TyDr/YupIgAbIvRuF2ushhrS/G:w0Cx1QDr/X2IW2usz
Details
File Type: PE32
Added: 2019-10-09 05:50:50
Yara Hits
YRP/IsPE32 | YRP/IsPacked | YRP/HasDebugData | YRP/IsBeyondImageSize | YRP/HasRichSignature | YRP/maldoc_find_kernel32_base_method_1 | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/System_Tools | YRP/Browsers | YRP/Dropper_Strings | YRP/Misc_Suspicious_Strings | YRP/Big_Numbers1 | YRP/MD5_Constants | YRP/BASE64_table | YRP/VC6_Random | YRP/suspicious_packer_section |
Source
http://sinastorage.com/yun2016/B32d.rar
Strings
		!This program cannot be run in DOS mode.
h.rdata
H.data
.reloc
Vhhcdmh@
Vhofifh
H4 _^[
xOSVW3
tPQQj`j
SSj@PV
PhLlruh#
hTskh+
WVVj j
t*9A<t%
t*9A<t%
Yhasdf
hasdfW
_VVj`j
_VVj`j
?SSj`j
SVWj@3
9X(t|h
9X,t_h
9X4tBhj
9X8t%jPYf
t>jdSW
tpj Yj
QQSVW3
D8	hj!
t&@WPS
u@hKsktj
u/hKsktj(W
SVhKtdi3
SVhKtdi3
SSSSVj
SSSSVj
SSSSVj
hKtdij\SP
PQSSSS
SSSSVj
phKtdij.SR
toSSSV
hKtdijFS
tgSSSV
thSSSV
SSSSj j
PSSVSS
v.9^0t)SP
PhTrtph
~bWhlY
QQSVW3
j XPWV
t?j0Xf
URPQQh
<ItO<ht?<lt
v	N+D$
UQPXY]Y[
Whpgsr
WhgaerSWWWh
Whgserh
hSBFVPV
hQDYSP
hQDYSP
hQDYSP
hQDYSP
tVVVj`j
1f;2u_f
v(Sj	W
vKSj	W
hQDYSP
^SSj`j
^SSj`j
=NB10u
=RSDSu2h 
hgCPAj0j
htslpj
u2VVj j
u2VVj j
hasdfW
hasdfW
HShpgerh
Shdgerh
Shcger
ShcgerWSSSh
ShcgerWSSSh
<uAWh`
hQDYSP
Phofifj
t\HtFHt0Ht!Ht
explorer.exe
Write File Error!
Read File Error!
ExAllocatePool failed
Open Destin File Error!
Open Source File Error!
%d.%d.%d.%d
255.0.
255.240.
255.255.
172.16.
192.168.
127.127.127.127
POST /
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html
Location: %s
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: %d
<html><frameset><frame src="%s"></frame></frameset></html>
HTTP/1.0 302 
HTTP/1.1 302 
HTTP/1.
103.55.25.63
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
[aaa]Write DisplayName failed, status:%08x
[aaa]Write ImagePath failed, status:%08x
[aaa]Write ErrCtrl failed, status:%08x
[aaa]ZwCreateKey failed, status:%08x
[aaa]ZwWriteFile failed, status:%08x
[aaa]ZwCreateFile failed, status:%08x
PowerChange
[aaa]b_filesize<=0||bfilemem==NULL
dYx1EnVxiIUedRN/eHU6HnEe1A==
fXhFdYx1Oh5xHtQ=
gHmDiHw6HnEe1A==
jHl6gHmDiHY6HnEe1A==
gHmDiHo6HnEe1A==
jHl6gHmDiDoecR7U
h3F6dzpM3t5CQzqHcXp31A==
hYR4cYhxQ946HnEe1A==
hYR4cYhxQ946hHyE1A==
hYR4cYhxOh5xHtQ=
hYR4cYhxOoR8hNQ=
get dns failed, host:%s
get dns sus, host:%s, ip:%s
enter GetNextHostAndIPByIdx, idx:%d
data.php
g_bSeverIpGot == TRUE
first insert is : %s
qwfzupdate.oss-cn-beijing.aliyuncs.com
127.0.0.1
8.8.8.8
114.114.114.114
https://
http://
+-END-+
+-START-+
HTTP/1.1 200 OK
GET /%s HTTP/1.1
Accept: */*
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Host: %s
Connection: Keep-Alive
return[
error [13]
error [16]
error [17]
error [18]
error [15]
error [14]
Content-Length:
error [12]
error [11]
error [10]
error [9]
error [8]
error [7]
error [6]
error [5]
error [4] destip:%s, port:%d
error [2]
error [1]
%s?t=%s&m=%s
%u.%u.%u.%u
TransportAddress
ConnectionContext
\Windows\
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutineEx
PsSetLoadImageNotifyRoutine
IoInitializeTimer
IoRegisterShutdownNotification
CmRegisterCallback
ZwQuerySystemInformation failed
\SystemRoot\system32\%s
ZwReadFile ImageSectionHeader faild
ExAllocatePool pVirtualAddress faild
ZwReadFile pImageSectionHeader faild
ExAllocatePool pImageSectionHeader faild
ZwReadFile ImageNtHeader faild
ZwReadFile ImageDosHeader faild
ZwCreateFile faild
[xyz]Del sysfile serviceName:%S
[xyz]DelReg serviceName:%S
VerifySignature
NdisAllocatePacket
NtSuspendThread
%08x%08x%08x%08x
wcslen_ex_End
wcscpy_ex_End
wcsstri_ex_End
System
EXPLORER.EXE
regedit.exe
ZwQuerySystemInformation failed!
ExAllocatePool failed!
Timer:%x, funAddr:%x!
KeUpdateSystemTime
<}rqty`HX
!u1nnpJ
*<cZ}>
@Hk#x=3
Unknown
127.127.127.127
127.7.7.7
61.163.70.228
58.213.140.96
1.194.187.4
222.89.68.50
101.201.172.229
www.chinaz.com
cn.bing.com
www.sogo.com
www.jd.com
www.taobao.com
www.360.cn
www.163.com
www.qq.com
www.sina.com.cn
www.baidu.com
TIR7dzpzf33U
(null)
`h````
xpxxpp
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
evbdx.sys
c813b5ea4e464f86eea9308448cd084b
aed162896df91d8eb6553fa867bad4da
028f72aebea4840356d3c6c87fbd401c
8de160c295aa9a56a2487833ad6eaecd
c7fe96a30a086f4a62059a01b13b6d2b
943a1d024c75e08dfa554f7e46a7f9d7
c02042d055690091b52578b23b7a7793
28b24d83436924985a1dfe807ea23adc
4f15269a5c41952f1b3b8030ccc2a1f9
b2a1be22afec4985a84f95844462a804
13a37ce690c836a4d3f7236fbcead92d
cc29a0f49d2dad9d8071a2d40e6b338b
7b56b7c90230cca0265ce6f6d1b9a1b7
8f20daf9879e057e4ad635d397a7abe6
9aacd9105133e4aeb5b0e0e5c779b8af
1195931833648ee8645c3564c6ac87f0
d4626eda3a81486c5233c39fe074d29c
a622a1ef440089b0601975dcc233b99b
c64e5ac7835e5388477a057887899ea1
0e7a57288a11db7c9f1a7443ad3d1156
29aeb3a87e88c932f2203bb4662abc2f
ee08b15ba537cf09f6dec29d6a7b0ea0
387da27c191182592af615b880b27a71
669db2a7c981e0e11bd7ed80a799142d
688e8d7a1cdffc3a8b587b2aaaa0ebe2
d53e9f4cc35b14a847fd7571a7b9b07a
ef2d5e8efe3c7a8e5834f806e1823cd5
5e902e5469caf9505620ebc528bc1f84
0390051d1f96f6ca8b22e9b5588968d5
cce0d0b2a1a59aa4810eb0c6be364456
819f9affcc43c274ac365f49bd6a4df7
9b4aa8d1d972d5d0ea147ad214f50aa0
c61cf6fb84247b5c37f13a164d14cf73
4bdf77428e61cd012a02d98f5ad41fb6
89f2cb0834f7cba34f7b522440ad6eec
c152c1b48340467339cd28e01502d429
e5494b08ad27ea24a92abd504be9f6ad
0bfd1f7ccad512ab6a923f509dbc761c
d1e14317a59a21be847ced268bfe7494
09a0b788d584a0c9b420fdf22de7ede6
089d79240640ef9ce83054fbe316a30c
03cc55f5aaaeb8f24f616738210ba4c7
fb4fd7ad884110bda89fc4a0c43a901a
3c14355ab91bc4a0959ec069424229ff
b7e206249ba7249f593794048627cab1
ee61766b53d8571310abedec37cc7261
e36dc618f7308a5c4018b1c2c989325f
8afe5c7655f6ed407ea1cec473acb8be
bddcef3566ef9e0bef66a098d845196b
b169e9428e23eb1e258e3031770bdd6d
31dd91ddc742e39e2fed3fb9302539f1
f06ab478d1cebc4fd5c7b083e69b0294
3817fc5b494b8ea146be857c8686275e
04b3c2ffe905f708819254205059d61a
71ca42060ee72b374934bb108211c531
a65a5927dbccb09e35d83a1628beab81
c71f3e3a6d8d05353a50b0766db4bd8f
15894048592af018733fd897fd0229c9
fIiIhEY/P3d/Ond1eneMeXqDiYM6c3991A==
fIiIhEY/P4ODOodxeoGFeH96dzpzf33U
fIiIhEY/P32JOkXed3V6d4x5ejpzf33U
fIiIhEY/P3t7Oolxf4GFeH96dzpzf33U
fIiIhEY/P4mFejpF3kF4HnmCdTpzf33U
fIiIhEY/P46OOnp5hYGFeH96dzpzf33U
fIiIhEY/P32JOkVBiXVxHoM6c3991A==
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Qihoo 360 Software (Beijing) C
Microsoft Windows
Atheros Communications Inc.
Wuhan Century Mengke Network T~
Hyunsolution Co.,Ltd
l<ANanjing xScaler Information TeHK
Xinyi Electronic Technology (Sa
NJiajie Yin
&Shenzhen Luyoudashi Technologyj
People search network Co., Ltd[
-^)P/7
Changsha Kaijin Network Techno
k{Zhuhai liancheng Technology Co
S!Xuanyi Electronic (Shanghai) C?
NJiajie Yin
Shenzhen Jinxian Technology Co0
LHandan City Congtai District LCw9S
Chongqing Shahai Information TN
Shenzhen yundian Technology Co<X
Beijing Kate Zhanhong Technolo
ShangHai YiWei network tec co.Ql
Fuqing Yuntan Network Tech Co.
innotek GmbH
Beijing Ruidongtiandi Info.Tec5
rBeijing Kylin Network Informat#
BEIJING XINDA HUANYU NETWORK SMSQJV$
]yPartner Tech(Shanghai)Co.,Ltd
AJiangsu innovation safety assej
Guangzhoushi Xunmeng Computer e
6Xi' an JingTech electronic TecZ
Zhang Bin
EVANGEL TECHNOLOGY (HK) LIMITE~
IXiaodong Wang
Shenzhen Hongjiakang Technolog
Shanghai Huaqianshu Informatio
Shanghai Huaqianshu Informatio0
EldoS Corporation
Guangzhoushi Xunmeng Computer 
XdChengdu Qiqiao Software Co., LP
:wShenzhen WangTengda Technology&
Kasherlab Technology Inc.
]Hangzhou Hootian Network Techng
]Shenzhen Hechuangzhiyuan TechnO
Changsha Qiansheng Garden Land_%
Beijing Huxin Hutong Informati
]Beijing Longweishengda Technol
BEIJING WANXIANGBOZHONG SYSTEMw5
 Blueone Technology Co., Ltd
>=Putian Yaxiya Information Techr9{_;
sShenzhen Intech Indesign Techn
Suzhen Zhou
`Synhe Technology  Co., Ltd
Xi'an QinYi Technology Co., Lt
Shenzhen Hua
nan Xingfa ElecU+A
QShanghai easy kradar Informatie
YI ZENG
&Huiping Zhong
LaBaoji zhihengtaiye co.,ltd
Beijing Chunbai Technology Devj.3
Xi'an Xinli Software Technolog
kXi'an Xinli Software Technolog
IQ Technology Inc.
a[Guangxi Nanning Shengtai'an E-l
2Xtreaming Technology Inc.
SHANGMAO CHEN
HT Srl
Ba Zhaoxin
Bandisoft
Fan Li
.Hu Qinqin
Orbita LLC
Taizhou Union Networking Servi 
=Nanjing Zhixiao Information TeL
pC3RE LIMITED
fRandkne29 Limited
4oMw<.
_CHEZB LTD
wBopsoft
%Bopsoft
pHenan Pushitong Intelligent  T&
AC777 LTD
ZBeijing Baijianqi Touzi Guanlin
Zhou Donghang
Nanjing Anyue Technology Inc.
]TNetEase (Hangzhou) Network Co.9'
Xi' an JingTech electronic Tecdk.{&Y
jf-tec
JLOBY LIMITED
KASDAM LTD
+COURAGE MEDIA LTD
Wang Zhen
Bdzd[H
MATCHPEAK LTD
Bing Jin
}Cycology Ltd
tXiamen phantom domain network ]T	5
xwNantong Huicheng Tech CO.,LTD
@Peng Tong
Zhang Zhengqi
Binzhoushi Yongyu Feed Co.,LTdv
Lincangshi Guangxie Network Tem2
Beijing Founder Apabi Technolo
WMYuchengxian Feiwu service Co.,>
lCHENGDU YIWO Tech Development 	
ABeijing Founder Apabi Technolo
-Haining shengdun Network Infor/
l<ANanjing xScaler Information Ten
Wuhan Century Mengke Network T
't|Beijing JoinHope Image Technolo2
Shenyang Lingkai Technology De]$
Luca Marcone
vT@|:Oq`
Huo Zhang
Xiamen ChengChuang Technology 
Hubei Olympic Tour Information6
VBeijing Sages Education Consul*
LSHENZHEN LIRINUO S&T DEVELOPME
\Shanghai Denghan Jingmao Co., 
\Zhao Fei
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINIT.text
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINIT1
h.rdata
H.data
.pdata
HINITZ
!This program cannot be run in DOS mode.
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
h.rdata
H.data
.pdata
h.rdata
H.data
.data0
h.rdata
H.data
h.rdata
H.data
h.rdata
H.data
.data0
h.rdata
H.data
h.rdata
H.data
.data0
h.rdata
H.data
.rdata01
h.nbvk
H.cxzh
h.rdata
H.data
h.rdata
H.data
h.rdata
H.data
h.rdata
H.data
h.rdata
H.data
h.rdata
H.data
.reloc
h.rdata
H.data
h.rdata
H.data
h.rdata
H.data
.rdata
H.data
.reloc
h.rdata
H.data
b.reloc
h.rdata
H.data
.reloc
h.rdata
H.data
h.rdata
H.data
.edata
h.rdata
H.data
.edata
h.rdata
H.data
.reloc
h.rdata
H.data
b.reloc
h.rdata
H.data
.reloc
h.rdata
H.data
h.rdata
H.data
b.reloc
h.rdata
H.data
.reloc
h.rdata
H.data
h.rdata
H.data
`PAGED_CO
h.rdata
H.data
.edata
h.rdata
H.data
.edata
h.rdata
H.data
.edata
http://pki-crl.symauth.com/ca_219679623e6b4fa507d638cbeba72ecb/L
.rdata
/?a=1&t=4&s1=%u&s2=%d&s3=%d
.sedata1
http://pki-crl.symauth.com/ca_219679623e6b4fa507d638cbeba72ecb/L
http://pki-crl.symauth.com/ca_219679623e6b4fa507d638cbeba72ecb/L
SVWjiYje^jxf
Zjr_j.f
j Xj/f
u}j"Xf
j XjSf
jsZjif
ZjuXjrf
E-sZ'#l
[V+6,H
\-0BiLEfv
qhNNf$
E3heV&
'-e60y
X0kDiE
D$ 5dd]h,
&@k+taNmn
}hklKC
3)Yi4r
;zk'vI
ZgjEjs
m1o`]hf
3UHwtL.b
arCrq~]
CEXgv?
JDsri)
%WxQ|U
;zsK)3(m
])c!(v
@VE|k[`
`qjg#d^b
pF:eL@
*b$l85
4PdUhQv[
yX2sZb
G(d<$\(
Zypo\U
)=xonG
&Pkn??
R,'?OvB6"
L$<h\f
PwXyK/-rK
^$h}j&
[!Z\Iy
Ughs86Ek!
R>q|qtgP
]);1->hk~_
psvsr 
tUqZ<s
u[);fu
v_%*^*S
9CrynmJ
DWjwza
P?jF{+
8%x>P8e
FBupiP
	whY|OGd2q
7?ODM);
5yjk;Z
eN@o#z
)cV2kT
Hec%cX
f.3K'F
rgcG/zU
q7MEbS
<AAS^f&
=%x;AMRyQx
Nkv{h{
z@);kf
Gz[r}`Ci<
oO}C;d
$u;EKI
'=`_tK
+P7Wm	
*cyi>wl
UJs|[!
IGZ:P<u
i/W3\E
u_qTQ.
PMK7]B{V
bejYzW
~on;7|Y	
Cvsv]=
@yZel0
mhYhG9Qd^f
HJotcX
j0^kGv
m04{ry
 <iq7A
\t'Y:%aB
Av+PYuN
NojW~Y
$h:h{h
5WD}lXW
2%9RvFo
S7;?'z
OR6Be@w
#	Avsvur_b
.b5w\:
)RfT3|
&Rgr5[
%Mra^um
?zm~_V
);dE5:F
_X<A3/v
CGEZc~shO
k:Vw9`mI:
FBLY^u
`QvTkn
Sp6:PC=oW
2OtGxE
|$Lh B
@}\]v"X
wR{Jm~itA
M;|ip"^8uzqv]
AXuza>
+3pl2Z
Gvwn{n
(;rcn}Z{\(i
xNwPle
=FbkJ+8Tq`[fu
--r9vT
F	?iRi
'1WLv6
MAb0\(
eR6BXt,
iAFBLc/v
t$$RhZS
;Wr[ns
o	Y9^k
Zp$~3c
/MR:dY
ebmZud
vj0Fu`Kp
FU*\,b~K
t$8^^f
"6XW;lI
r1-t5Z
5[9Crk
EIZ_rC3
NShyxe
/_#q..
<k!|Lq
O27GE+
AC/M^u
vB4M8N
YybuV.h
#Opo2X
n&OkP8=O
9=~o:L[
Azahef
#QlgFkt
	QLszkhK'
	?z]R.
(N,X:u)
Xt[1 v
7$0T/|
dhL\<aj0
 DcjMfq
!9|knK
JoV4X]a
2`AzYf
!&^.BO
f_r]5l
8RSJGg>mI
+UncF{ff
%Sfsi/G
gzwp{d
3)~+C`=)
@>utN*
\{4L>wpw
[9|kpG
" Dk'~
[m~05W
)Z|).VP
nef0oN
0Lw6HH
mL@ E|-
hwT_Xy
AgbKkp
HI=OBu
D_{T8N
)E|b(^
a^yNgv-SS
o.6wx_
rg|g-p*
T0bIMd
DPMrerf
o`,mra
*X<q~e
,.^GpkL
N9j6P:
L,s3ma
S3Xuzi
\ZvS97
!q00{veF
1F3liD*
|$,h64
qI0vaqDT R
Z_+a>$
T$,hOe
?|Ul{py
m`]|Eva
q8{bkFs`
>qq,C/
nO^FbF,
[RxB{D
J9=c/O
t5~]Zw
zQvmv	`h4
oLu^U#
(8}jgZyF
WfsT{T
MuIB^_
uX6wWa
`},@yl
)Dnkxk)
deh_pc/
E-1rTa
>{^~D:
Q#9zNa
=KRmrA
T~[-nS
ZMV{W	
wH<A=%
N{lDFFe
s<AU``
qB-W;t
D$,!E	b
nW|f,`
1K	JFa
s:ZSAxkr
 ^.?iR
@Gl?~A
H@gB*h"
RmjW~[
%s9Q;fU
\enY)x
Ls^c|+Q
P!&^4}
Dw#WNt$
^K'gh{
-[-n6a
5[[w` 
:>{^~DH<v
:@wxkhW
gC	iy+
	IKj}j&{@
1/~qfU
^Il}l{
H\x$z\	
jD,H,PID
@svk+v
6%Iq%A
y3O`*J@<
vavo~UzV
s4HM?;
jzBG#9
GGAnF7
Eruvyjk
'xXTB~
D$(0!x
QNot{ton;9
Ot91/t
_%(Uj)
--]/[NSxT
ax5CORizuv
%(;y` 
?Md,wB
PBin&%
K9<fc	
-!7fM#7n
44T:y^
M'5lK"
g\yn}X~~
*P@o~_
TOjkF D]^}
gtcD:"w?
Jsl T]
HH[^uJ
KITkf[
&TDP\]=
bSvWj9
GxCU5c
$dCrk0
l$<Vh^_
QjqT}F
oC]#Op}
hirU`}&L
U~27?;H
K'a@}p
Q9b_~7
vdC}Zvc
Ng~ojO
X_|^$Zx/
^sfC.7
v[eB}U
1-M3cH
z>i/Exi
-[|YDa
!o8@b:
NC*Rcz;
!i~]N2XC~[
&+_A^c
Ov/T;;n
ytk.-o
bYhiFkG
';16Vh
{oS.ev
]yHqqR
Ktk<FBaXyH
"`.|ml
H]N.`A
W|1G0 
q-<^$d
2O2Yj#
0 HLe3
Kvsv_7I
0.ZO=C:
cR&lIy
VgX{2W3
tOCCGw2.NB^e
/_#kXW
3!`cD*X(
|).F>/
T5OeVeV
lSPLlc
@}\axY
+7jt::,
<8EKqn
T$8Sh1C
vqvu\>:$
T$,hz^
0So;7_
Gn{nqB
y&+I;@8@
s=~1WW
D$LPL=H
OzSpcv
n{dC/)
CMlw`4P
(^x)xYB
	UHwhK
joB:og-I
da^AR8
XOf}K9
jJ~N2D;
491+sr
j}puzir
pQjmq#
sF{.S/
}V{No>d
:C_^G\>sE
uA7'x1,
=YXl [
nOY}?~o
Gh*},>
$Ru:_bsJ
N@o~_V{2
`NS-}0
=UX^O|
1W5Q?rP
mG=uUF
E0<0K5
\?'tp6X*
v8W~3?`
!;<AAuz
}>VUA`[z
;=|m|o
xYYJw2
Mv]dq\
tq~el0
m/\qrZ
_VX]%y
MT[#i>
2"p7~Ujyj
3IE+;`
z/KP8o~b&
G'`,^Y
9aEEJS~N
/z\V<j:
Cx1I@X
B:{Vkzj
lap{dO
X5b+IX5
05Km^a
>6,s8^^
Cpog-Y1|A
-I~Qnih
0Zs3U`
y3Z}/4NO"
+9vwvojO
pej\(n
K'm*W#k
/U~SO|9
\$4h) D\
Jubwl{
=~]jeZ
&b&g:`
3W/p6`
7WHupq
cxQzK?`]zA
!Ov[fU
#i|e1z
Y%<#[rO
Erk><TKrq~o
 do/&`
Z \sT{@
jgbkf.
Z>@sl5
Ite\_xC
y*.#:9L
}pihOd
,`Ej	Z
,"6wx_\
Shyxg%YZ
KAeq7O
 @k+~5
Da4['Sdm
vW=ra>:[
^[;zmvybU
HA'wh(
}5f~DH
1%o~?D_
P:wtylgX
}*/]O@
WWs`(ti
ipQ7:di4
eGL<>{
@JWdsk1UG
	QJwZ>
\(f}\$)S
|$Dh'Cu
eZJ.J]
wC3'P7
/-|O^_
6(udun
\"`.'(%
FDj[tyra
WvnKjDI9
gTmd6:
.J{_%_
)z@=r{j
EaZgv?
\$4[Vf
$C{A]fv<P
8h&n:P
Slu|sp}
y"fW|,
Qradmd
	'K\)6
k>MmlJ
\"'Sj6@
6AR:rw
?;|Ulu!
'Sd}M=
B#i%6R
	od]xQ
7f?G`7{
XPb~S7
.D }0V)
7!F-Ofw
'mBPSfq
%g<"}4H
|s|oqT
,FK%$b*ig
}:PYZwJ
^cFkR6
._O}XE
KcTgU+
Crq~Wfu
N{RuZ{
4Y@22kw)
r;YHsr
3[#,G/
szqviJ
l}^GlH
:C_x3B
Eaxkv$
;k!Lva-
t$@h2<
6NfWfn*
)5jG)R}
P(XIt9^
D$,$U$
22kBh;
TuXgpW^
&;By=B<P0
i|qvu`
DFspiP
FXfVvN
 D]^{>
wJqzmzL
$p5'v/
RBqx[d
><{`EjF
,2s\Mte
=I'T' X
4LDYQO.-
p6X*Kw
|Y3hM+
	mfC~_V
tgZOuS1
Ir}rqlI
2vvvu;S
"joOt_
IqjIrQ
epw^_vj0N
Rovwpjh
,$h~V1
$h}jHM-
UhyxqxaX
}TuXcxO
pPuNY~Z h 
y6VKe&;
kd(iR_
_F>X8f,J
7S3tJ_
FDqQ`S
i^qRg~c
wfvkzb?
rO"`,N
ine}CKI
fMb&I3=
Upaxkp
9Uzsni
EVY~Z j
b.}tkH
za`InA
"b*k5_
@:?;;N"
%k!K)Q
D$ 5ZO
)Qf}rg
2\OG\I
Z{DybU
dC+G+K
i{^sP;X(
il{pwt
YLF~m[p
SpcdkR
kPq|OFB
AICl 2
yJ6;=*C
]9vw`J
U7vypyh.m
?D<&xib,
?[ht:N
=CSP0!
^ut{hoL
[)	Avg
!4'6ty
\(jIEn
rEEh,{:
[~OEX'ho
aSX2ZMh
Zij]r_
Y9|khW
{JmzqzH
/CH.TY
\$ hL/d
><qEJD
r:dil|
YG';cd
`uRQv]
P2bCtk
|$0VhO
S=h=cc
'o<f2H
d|,YTJ
%7oxD,
C~]N"8
:_|^$Z
P6ZS;hlQ=
Ym3=]#.
~3]B{h
 j15pG
^crUzA)
3e1QG'U
zGiZoD
bAxa{-
'>%U|E
=KPqfU
'5l=bk
2B{bAg:
A|]vst
/8Tq`gN
"pI?bY
fgy!xQ`40
eypafO
o`sv_^
a`qD(6
BF(UI%
'r{16Bwf
RXW*K?Mh$
B{^kb]
L&H&LT
SPizub
($6wx]`
p8n_dod
.LQ#?xmze
He/v]*^
`o~Ybs%
g8uE&e
Dm@(:o
ZerWvU
H@aZ{B
{B}f(X3
;"M1vt
jilyDGe{
S-$U"	
p&XdI	{
\$>(N,bo
jCQR[#
SPh680
j0FujI
-o	U`,o-
p#kf6#
%3[Fuf
^<FSwj
C5nOpgT
iy `h0J
ZKtcnk
V"6wo^
%D`urg
Lw0V4NJ
=Esf"e
H76_p}h
nK=^ct
zCb"c^
ZC|oxeh[+ 
Nqf]vSz_
'UzQEfy
:RSdmT
bvS~mz
Zcn,Ra
sHytqn
r3r3Yi
"THT|`.
J]{AAtBc
.0si/G
t[fod.
Cb.PcrK
BqxJ&@a
rQ U!c;
{0fC~W
huV0kf
F}VwxaX
ebmR_	
,(TK7U
Hk~e/v
~CxcH(h
-Ivap{h
-[n?di
'I` j?tu
.H.3Gvty
Xkhk#|o
\0}rszg
.(X&2}
B>XGvu
"G.Jojr$
8R4u+^
Fsfv<8
|0e+[5
YZwbMGGA\
c)%N%^
 Z6e\{@
t{XgjW
1Mfy(N
P:uxaX
cXit[j3
|mfB6#
hY|U5p
<XuzY-
$oH	]z
]nizW$
+#5zsn
)%=Wq-"
Y%Kvk%
(<yng/[+
 Doz[by>
b>U_{Ful.
9XC+\U
V??hek
J.dAvg
6,onho
Xo`]bs
7;#0#2[
AlLpA{
3?DReK
l$P]Qf
Gtsn'Tu
C_hgZ{@
VkhK1]>
3Il{po`
)Exa`uTyZ
klypy\
CIAvot{h
lgHDhm
Hw4Y@0
Tkq6zg
hYleXS
<i?J'"ly
NaJ.\rB
8mZ2I?
h=z[buF
>H\xU9z8
?5_xmhU
.+kA7B
oHmPo|
)7%y.U
Uq\8cR.
;7|UlkP
RuZkfq
6XY7|m|
yJ6;;h
fQZiqC
$ZG-[??
Hk~i[#5
,fj(`&`*
6Yo$_L
@T _%YZ{
1iEJ.q
c<HM%+h
;@2L+A8
Zc#(Jc
 \@\q~o
 #kY%`T6
BHfWpy
6\Mfy]#]E
wzr8N<wNqr!/
8P>gD"
T">idY9j
%cxC#x
Ivo~Yb{:
sdcl[tK
VYm	Wb&
ly\y:}nyn}\]z
Sh{XK#`
khYEm!
:ZIp{EC
SKJt[Y^
Sr3Xa}B
So`,>	4{
$;zk\Y
?|_doN
hiX}Dwd
rwZgtC
A]jebmf
e5[)B^ylm
*:yp{l
* _x[Ao?
 RJ.RC
W^PU1Y
!e%fo]
YfW~Xy	
sg-Q|M
Krc}CIM
X9A=B@]DH
EOPmjQ
$"hqtm
y^&gg]
=~]dqZ@
q-qjp"
T.ZGtuti
JyZkfk
GX,1Kju>
a"]t:6*
@}l}Za
JJot]duD
YHLBF_
#Hr_zJ
4H&h&|
i<PE?6`y	
8B%KKgb
`/2]FC
lai$;R
	[wb b
\ihY|Y
49U-jk
orqEJ0m
`@n4Zu
W`w8HBe
&\QImV
d[v?9D=EI
{rszung
SoZsT{J
Qlm`4y
+|>!Q3
k1?BJ*
|k~klr8R
5Q?r?Gl
*0h4T\Mv1V
C;xs`}f
6dcLq`
=zWjyvwb
+BxsHm@
 r+9b_
|,L=~C
ejK/oS'K
S:b%^$
]dqT}Z
]@FK7I
}hyxqxaX
+7|mt}p
0@g(#+
,Lml;`<
e1Evwns~[R(bW^
u	OLudmT
A6*$;'
?P,pT({G
Snwvsvc/U
U9b_xC
N@HSniR
`)t`&VE
jM=vsfS
xUnera
Fy^wpq
YX*^KhkT
uR}Jk|
X6da\k
-!7vyl
dU|6;=
EI`mfi)
.\Kj}ns~_
GTF,n`
h}6g5`
D`qzkp
4$h}Ud 
QA`[~;
|mCH4u	
D$(RSh
N/CjG2O;
j_-a!s
XGvo~_J&
IZ&Nol
%A~YjO
?K\0:8
-Mjq4Y5
Vo!WH*:\
|?cscx?
]=	k82
n x2L'i
'W3Scub
Ahn4B*
^$^0022w[
fcjYzW
D$HPTf
dCrk6'
TC[Lyl
(6zS'5p
E|YfW~
&dI4y5
UqJwfO
4RVnR8
zN_>CE
v?L0	%
h}`m<*
70hWijF
])kKpSfs
\$4[[f
Ipu^b5
Mp}Viv=
_ryn}j
"!Kv_b
4$h*J?
iTkhEjs
a+D\{*
"'MvBH
?KTipI
%E8!E=s
Tsydt&
jJx>BN
3aq45R
28Uhlf
$Iz_S^
i	Bi*0
$Nqr}^Y
:Amd!Q
s`t4T}
D$<h(c
_vU[+)R
<ja5|ol
Gx_jc^w\
+NE[}RV
cQlG+YX
A|]^}J
MZsT4mN
Hy\kdu
LgD4^[
:TN	~G
2JkhEjF
J{0P\a
~+UW\2F_
o[{tdH
CK.Lkp5Z6
L-[UZ.i<
GM	2Ny
DqpZ ](y
QpeZ}Z
1Mvf,^
%9,g>%!
kL>{hq
cDqb]~~
QniRoh
T[P)Sv
}X-.K;Y
*R}H35
]NmNGl
Hq~e~q|iv
t-3~m~
N:Tc!*E
G~Svk!iL:
?|oxqxk
S!;|}\
(nAQJw\
;6RMId
VECH,N
`qYDm7
Et}d2{ti
Lu`[fy:
8VItm_
rOlyty
X0bBp6F
`gmu7(
|9SHyl
\}0L<1]
bME`FR
D$DSTh
xG>{M*/M'
^;__@,W	
y?IgX{\
Jfmb,'=
Ou	qb_
D{pwp{h
Jsh(HyZez
Rn[rKt]X
*Loj=c
XXwvo~g]
wlu|]\}
@L>qb[
y^meaar
Mniu;C
DDI=SZ
x9WLmnI
7]Lg~H2
7p]CTX
7pF0DB1
7p|gIY
|x~k*s
7Vw] k
7pY-@j~
7p|xEO
7pUpMw"
N1	M]3
7paRFp
7p|rg:
7pil	,RU
7pK	/b%i
7pG/KX
7pj\L}DO
M_s+X_
7p=VRT
7p^}@p6
7pYbnI
.RXg3t
7pa/I<
7pR,`mm
7pKidzXd
7p\U2#
7p U3J
7pN\a'
7p]RGP
@zJ)=U
7pO;zkN]
7p"NI*~z
7ps*8H
7p#pTo
7pCV7h!sE
/:'fOP
7pnIz2CV
7plp1<*
7pU7,=
7pZDl}
7pBHvK
7pASNh
7pj%M3
Q3abz@4
g]\hYf0RS
+U~kx>C9
~o^6s40l
U+It_`
6Hkzsh]h
YhmXyV
YxY?*S[o!
h}ps|c
*53Opp"
!Wh&n\[
g|_X}XW
-En}jk
?ORihY
 #a+Oh
oE}sEYR
kdm#zZ
9%c>}nR,
?= V$_w
^E!=D5
Hsr{Vkr7C
##=xo~g
Y[(Y?r1
DFe'%<?
$j?twpmH
|mRkpG
Q,cPVref
puxo|]tA
{2bAxY
V6[n3X
RW7k2;
'Qn:P@
D$ $uW
p&nR-:a
}_X~D>
ctW?ls
t0.:A)
rUzO~M
<`@6#@J~
eW@C?f
,P}TlU
R8{nkN
kj}\w^.
y.>Zg:.
B{^kbk
Qtq`a~5
";cVTE
C&PmLqL
H6}Vij
!Y9^sl
Qh{pw`I
@LmveR
~1V_{P
`]|Y-K 5
k\q#|A
3Etew=9!e
*24H%z
*Hk|Jh
kzWjmN
k1[/r7]]
!k06kD&
D$ M]4/
|5KaR}
L	>k\w
.`"cl[
CrcHmv
1[Hqvux
L>utwpa`{<
/_NFol
7yc)[i
*b"cc[
xU9z`[
0Hqh?dm
ZgzwxknK
yZwtsxo-
=MBh";x
Gcf3fY
`kJk~k
H.2}pu
E)[7|[
"j{li~Ujq!!
H}Tq`u
KkZ$4l
^ta}Z*
MNsl_b
cjk+?[
so]d!R
pgbkZwZ
C	mq7?
D$DrfA
^? JnIE
x+iZmN`
 {D#!"
L,2w*P
!e:A6`l
Ij(tV}}
#TrFk(
%u	Oh}ju
nc'h4[
^m#d1[
D$(^^^f
E	0Gh)
yl j5-
!W"kv,
l,tPG0T
E;rW V
KP.D#noH
b]vl2Ba
bhL(v&
v<R0Gr 
xsxohS
6 	8NQ
o43]v:+
U~kr79!
^.\]L:
Gc`x$@
<H-Wx.J
Gx_p}`
}r+";c
E;qV:_'~
CC}Jv8
ZGtm])
qCk,!)
AInwr=
NsZ&t	
NgjK3YLkt
I@fhTU
D$(,d$
9%cDqf
->JkC=R
C3-~3[
hn4N@C
t$@WWU
WjkZwP
Qpyn}re
Wp_bs^
`cpizW
Hude<b,
g<aHFF
;!	Ui`
D$,Xh-C3
D$ k>jD
$ )z/`
 kaZt=
9Uhz@6
TyOZ|.
?xYNS}
Lh]}C7
QxUtYl
-])"p=
5e)k7I
ozunqB
whk~q`
0Dy\at
`{TWhi>
GG$NuJ
1Mta\}P
+b]=g`
*2hN|L
ZeXy6\/
zzaC_^(-G
*bAxgL
{*2}I+
t$ hBX
l_`WhY
'?rybU
}0p<HD
	aZ8^+
AodLQ5u
6DsbsJ
M{Otu`
qPkj,b
>@sl5Z6
hn%72V
Tode'WJ
MX_v;)
T{9>Bnf
]$)[7fY
i\uLohA
YnThg)
l(]@t,
MnQliT
2&h;#xa\
.`}' (
EnhiA%
5_"^ututu%
GCj*}8
ktb(\B
^$Z|B4c%
38>6my
R&8c^s%
BylHM#
Aruvk+|
Qm^2Gi=W
h{tofW
Gz[hk\
;|Whkw)
G9>Gxo
sVuBqn
/!GjH9
8Z[1r_b,
JllP8,
enkh<$g
KZ-pKj
%5~k|ov
GOd*uH
|B\Om~
'?0q8^1
]`QkUbx
l$4PPf
Kv_fk\
eH:Ni|_X
Pizg/z(h
|$ hff
QhNF)$
} u.I:
IeD<0v
KfAcquireSpinLock
B}Zkfe5
(X** X
/UUqPQ
i/WzT/
wC_ryj$
Zo^avM
/eLDe']
GtylmL
i^qT}X
.,dDr$
]A7=#!
CT$|Lw0
/8Tklmvs
L|/W\0F
l]pOGC
c-[rW(
6Foxsl
|q;@@-
ntoskrnl.exe
bi'hhZ
Hn_`;B
::"cfZ
Lhc-F3
(l13|qvutub
UqJwxY
Kp" %oH
ZazOdw
9#TEv)
hJO/yV_-r
5Iju,R%
B:{bAg:
&^.oWZ
x2	7Hq/
8 n9|[
wZ6{pw
JQp{lwxeP
_!;v-SD
4Z(iOZ
$lLqfm
\m`_xS
A3p0MZ
kb,mLZ
whclsz
NizPsX8yHZ
_\{c)e
ExAllocatePool
Evedip
r+9bw:$
k`c)~7
UAvojO
%Kv[Tz
(2k-]/
cn,FyX
MmProbeAndLockPages
<N8y8Z
]|U{E~
S#=dz,
_drZor
Rob_rr$
[hklyfM
GnuzaV{
-@y16:
Hs|[#i>wp 
9S1r4Z
T!:qpH
Hux[d{8
@!;|mTgvm	Q
 ^oh}df
Z(`U7v
[<8LQ%D
Gns~i'
CH*:eX
5f1K7$p
8qr8Fml
NtQuerySystemInformation
9~ovk%
C5KP8Z:h.F
a'Q)d$MwLg
ntoskrnl.exe
S|/5t?
EsHWvIin
N}t_`y@
uj5".l
XuTf/3
:NyY!\l
HAL.dll
C~[^uJ
wA~-R.
MmMapLockedPagesSpecifyCache
\&Q{FjGpun
Chy?v93
`y549G
IoFileObjectType
HalMakeBeep
"GPlW|?
\qLhYb
sc/]'Um
!Or_Pv
;S;6B(s
;yB6B?
GCGqNov
ZQEZW)aR
U5c)W9)
/]Dw\>
IoFreeMdl
>CE~IRK
Tb?r@1
vp5,1?
>/2oB'
^2}ps|qteT
T:>{dO
C11n(L
v$J,(5
Zm<4gy~
(ZW~P4B"l
_'Y=n,
C~[z;E
LPYi,o
;E(I\~D2
Eto~g|
5pOZNMR }J~2
$FY<	`
H>R_rA_
Gb5b;^
c:LQ-{
$Pmvyf
*"8s~Wfs
=K@iNu
hal.dll
[JfalO??
8TOjg@
I}U`UG
ExFreePool
4^KhsD
nNTc|V
;~[LqM
`&VyT@o~k~Yb
'Olg1A
Ks9O?b?
'_d(9|m\
B7K+/p
FDBl6x
IoAllocateMdl
6X0{vg'c
';xq~e
M5_NFW
1]^cnS~
vmxu`]
MmUnlockPages
1+_T:a
Vntoskrnl.exe
YdsDop
H#ZW~$>
1f6XEv*
/mFf,Hi
L<o!`_
]XVGzA
;+;5;I;S;Z;n;
121i1o1x1}1
262A2L2Z2_2m2{2
G1T1h1u1
1E2T2r2
62627A7F7N7&8G8L8n8a9
< <*<1<A<F<
1>2V2}2
4,4<4Q4
4k5p5u5
:J;U;b;o;
7+8?8M8K9
<.=^=s=
53516U8v8
;.<X<d<p<
?'?J?O?
,0=0D0t0
2"2(2-22272<2A2N2V2^2d2l2r2
7+8Q8e8
:*:H:O:k:p:
70C0V0
:4:=:g:y:
;$;J;p;w;
<%<-<7<B<J<T<_<g<q<|<
=#=3=;=K=S=c=k={=
>:?P?Z?a?
1!191B1G1\1c1
3#303@3]3u3~3
6%6T6`6i6x6
7,767Z7~7
7K8V8j8
;1;I;l;s;
<1<9<c<
=&=3=B=
070C0K0^0f0r0
1<1_1d1
2"222B2
&0>0d0
7(7:7S7r7|7
0!1-1o1
2/282Q2
8P8x8.;?<
3_3t3K4n4
;\=f=l=~=
222K2\2
4A427s7
94999#:*:
6e6l6{6
6!7[7m7z7
9"929:9@9p9
=S>]>|>
> ?f?{?
:.:C:J:P:e:k:
:F;j;r;
=M>]>o>z>
<0O1W1i1w1
1B2T2\2
3!3,3e4q4
5B6 7s7
5-8 9$9(9,9094989<9a9m9y:9;d;
<*<E<"?
0@4D4H4L4P4T4X4\4L6'7|7
=6>J>8?
0$131F1O1
1c2w2o3
>,>A>M>r>
>$?9?V?
0e0w0}0
1*1S1X1n1
5/6X6m6
9B9b9r9
>!>/>u>}>
?Y?g?m?
0+070E0d0p0~0
1<1D1d1
3'4/4:4[4j4u4
5%5F5Q5\5
6%636B6e6
8'8/878>8i8
:":):4:;:F:M:X:_:j:q:|:
00<0F0f0
1-393c3n3
324E4N4s4
91:?:h:
:	? ?7?N?|?
313E3S3
51575Z5d5j5{5
6B7P7\7g7O9
<)=}=%>
1$1*191>1M1U1_1y1
2'2]2|2	3
1:1F1W1e1n1t1y1
4&707I7g7
7*858M8R8
=E>U>b>
?\?l?y?
0D0R0o0
6P7g7~7
9!909T9
>->F>_>x>
2$3/3B3
384>4M4_4u4
5'6-6>6E6L6S6Z6
:):U:y:
=&=f=v=
212Z2g2z2
:#:/:6:B:I:
? ?<?@?\?`?|?
0 0<0@0\0`0|0
1 1<1@1
:P;`;p;
< <$<(<,<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=
?$?-?4?
0Q0u1}4'<|<
4C8j9|;
0y3;4@5
:$?.?]?
8(979k;
3.4d4 5T6
'7r<7>
7Z8}:p?
6q8^9!;
3	5R8}8
<5<s<(>(?
7H8^8&;
G0j0z0
:G;S<o<2=
3 7o::<N<
1^3c4l5
4E8I<7=
<q=->_>
9<9%<V<
9h9[;;<
8o:.<K=
/7M8s;
+0Y1o2
'2b2}3