The article points out that the phone-home domains this ransomware uses were generated by keyboard-mashing. Can we tell what keyboard layout was used?