3.6
中危
61 个模型检测该样本为恶意！
重新分析
更多

07f09fcb891d4f51eddd75fadc89908587d1586b8eb2614c891c8bce56f4facd

07f09fcb891d4f51eddd75fadc89908587d1586b8eb2614c891c8bce56f4facd.exe

分析耗时

148s

最近分析

384天前

文件大小

391.3KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN WORM GENERICKDZ
鹰眼引擎
DACN 0.15
FACILE 1.00
IMCLNet 0.91
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Trojan-gen 20200217 18.4.3895.0
Baidu Win32.Trojan.Kryptik.bio 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200219 2013.8.14.323
McAfee Generic-FAHD!51D9F1492F24 20200217 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0cbe1 20200219 1.0.0.1
静态指标
检查进程是否被调试器调试 (1 个事件)
Time & API Arguments Status Return Repeated
1727545317.438602
IsDebuggerPresent
failed 0 0
检查系统中的内存量，这可以用于检测可用内存较少的虚拟机 (1 个事件)
Time & API Arguments Status Return Repeated
1727545318.921625
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
在文件系统上创建可执行文件 (4 个事件)
file C:\Program Files\Intel GPU\GfxUI.exe
file C:\Users\Administrator\AppData\Roaming\Microsoft\Search\SearchHelper.exe
file C:\Users\Administrator\AppData\Local\Temp\WER9mso.dir00\com3.exe
file C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe
解析免费托管域名，可能具有恶意性 (3 个事件)
domain supportservice.netai.net
domain supportbackup.esy.es
domain backupsupport.comxa.com
投放一个二进制文件并执行它 (1 个事件)
file C:\Users\Administrator\AppData\Roaming\Microsoft\Search\SearchHelper.exe
将可执行文件投放到用户的 AppData 文件夹 (2 个事件)
file C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe
file C:\Users\Administrator\AppData\Roaming\Microsoft\Search\SearchHelper.exe
对特定运行进程表示兴趣 (2 个事件)
进程 searchhelper.exe
进程 com3.exe
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
在 Windows 启动时自我安装以实现自动运行 (1 个事件)
file C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe
创建一个 Windows 钩子以监控键盘输入（键盘记录器） (1 个事件)
Time & API Arguments Status Return Repeated
1727545409.329602
SetWindowsHookExA
hook_identifier: 13 (WH_KEYBOARD_LL)
callback_function: 0x6308c348
module_address: 0x00400000
thread_identifier: 0
success 1704509 0
生成一些 ICMP 流量
连接到不再响应请求的 IP 地址（合法服务通常会保持运行） (1 个事件)
dead_host 153.92.0.100:80
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意 (50 out of 61 个事件)
ALYac Trojan.GenericKDZ.39201
APEX Malicious
AVG Win32:Trojan-gen
Acronis suspicious
Ad-Aware Trojan.GenericKDZ.39201
AhnLab-V3 Trojan/Win32.Generic.C1768482
Antiy-AVL Trojan/Win32.AGeneric
Arcabit Trojan.Generic.D9921
Avast Win32:Trojan-gen
Avira TR/Crypt.XPACK.Gen
Baidu Win32.Trojan.Kryptik.bio
BitDefender Trojan.GenericKDZ.39201
BitDefenderTheta Gen:NN.ZexaF.34090.yKX@aKFj5hmi
Bkav W32.AIDetectVM.malware2
CAT-QuickHeal Worm.Drolnux.S644909
Comodo Worm.Win32.Ibashade.D@6v10bm
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.92f24f
Cylance Unsafe
Cyren W32/Trojan.SOJB-8372
DrWeb Trojan.PackedENT.108
ESET-NOD32 Win32/Ibashade.C
Emsisoft Trojan.GenericKDZ.39201 (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.AMWS
F-Secure Trojan.TR/Crypt.XPACK.Gen
FireEye Generic.mg.51d9f1492f24f6fa
Fortinet W32/Kryptik.FOAD!tr
GData Trojan.GenericKDZ.39201
Ikarus Worm.Win32.Ibashade
Invincea heuristic
Jiangmin Trojan.Generic.arvem
K7AntiVirus Trojan ( 005048871 )
K7GW Trojan ( 005048871 )
Kaspersky HEUR:Worm.Win32.Generic
Lionic Trojan.Win32.Foreign.tnvv
MAX malware (ai score=81)
Malwarebytes Worm.Agent
MaxSecure Trojan.Malware.300983.susgen
McAfee Generic-FAHD!51D9F1492F24
McAfee-GW-Edition BehavesLike.Win32.Worm.fh
MicroWorld-eScan Trojan.GenericKDZ.39201
Microsoft Worm:Win32/Drolnux
NANO-Antivirus Trojan.Win32.Kryptik.eljjir
Qihoo-360 HEUR/QVM01.1.589D.Malware.Gen
Rising Malware.Heuristic!ET#100% (RDMK:cmRtazrYO5EcdKMfqOAzlUg/KtzO)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/Agent-AVXU
Symantec Trojan.Toraldrop
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1970-01-05 03:01:20

PE Imphash

a6083e536d6342c425a7dad4bdc72272

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00001484 0x00001600 5.736254363770924
.data 0x00003000 0x0005a010 0x0005a200 6.744751502356369
.rdata 0x0005e000 0x000001a0 0x00000200 4.1645328294959905
.eh_fram 0x0005f000 0x000003a0 0x00000400 0.0
.bss 0x00060000 0x00000064 0x00000000 0.0
.idata 0x00061000 0x00000474 0x00000600 4.479652026021018
.CRT 0x00062000 0x00000018 0x00000200 0.11836963125913882
.tls 0x00063000 0x00000020 0x00000200 0.2044881574398449
.rsrc 0x00064000 0x00003f30 0x00004000 4.89418902600576

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x000677ac 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x000677ac 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x000677ac 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x00067c14 0x00000030 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_VERSION 0x00067c44 0x000002ec LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library KERNEL32.dll:
• 0x4610e8 ExitProcess
• 0x4610ec FreeLibrary
• 0x4610f0 GetLastError
• 0x4610f4 GetModuleHandleA
• 0x4610f8 GetProcAddress
• 0x4610fc GlobalAlloc
• 0x461100 GlobalFree
• 0x46110c LoadLibraryA
• 0x461114 TlsGetValue
• 0x461118 VirtualAlloc
• 0x46111c VirtualFree
• 0x461120 VirtualProtect
• 0x461124 VirtualQuery
• 0x461128 lstrcmpA
• 0x46112c lstrlenA
Library msvcrt.dll:
• 0x461134 __getmainargs
• 0x461138 __p__environ
• 0x46113c __p__fmode
• 0x461140 __set_app_type
• 0x461144 _cexit
• 0x461148 _iob
• 0x46114c _onexit
• 0x461150 _setmode
• 0x461154 abort
• 0x461158 atexit
• 0x46115c calloc
• 0x461160 free
• 0x461164 fwrite
• 0x461168 memcpy
• 0x46116c memset
• 0x461170 puts
• 0x461174 signal
• 0x461178 strchr
• 0x46117c vfprintf
L!This program cannot beryiocvkdteeUaiZC.
ryiocvkdteeU.text
P`.data
p.rdata
`@.eh_fram
0@.bss
0.idata
0.rsrc
(9u1[^
\$ C<D
UWVS,l$@\$DE<
9r@,[^_]
,1[^_]
UWVSLD$`f8MZt
1L[^_]
D$$uX4D$
$\$,D$
D$`t$`@<D
(U<$T$
C<t$<D$
D$$@(u
9t$ D$
9|$ wt&
D$ MD$!ZD$"D$#
\$Lt$P|$Tl$X\
D$0l$ l$
tD$ l$
\$ t$$|$(
\$ t$$|$(,
ffffffU
s#,;(%
\ZS(8
Z6_y6s_
^!%T!e!_!k
!^C%N%T
%[!%T_8<Wh9
%N%W!}
!2j!ha[!}%l
,XNX[!}
!f0%MYYx
/XN,N+!hYyYzY` %N-!YYx.Yb &j '%
!q/%(!
h!1!p!
!XP%[!}
\[!}%p
_p_t_x_|
X-[#!!
!.#t!-
|!_!i<^
\!p[!}
,#tW!GpYx!-![
!\#tn!X
_-#X#xG\!+#t!Gh#)
yj[__[!}s
X!iNYyYzbNbNYyb!,5L
5L!gY_%T1
!f!-@!
#-D#%<!UDD%5L!`#M<
%Mh#-D!
@!`#%<Y`v
!UD!_#
<?%5L!Z!Y#M@-<
[b#%@+4YY%,tT'#%<!M<%M-D!UDYav
!_!-@!`8#5@!nY^c[%4nYb#M8
86#M@!-@Yf!_!MD%MM8
!`!r#%D<-0#MH54%(
$_!#-,-D!!!
[!}##%
!Z Y !ZY !Z#
Y !Z Y !ZY !ZY !K!}#
_![!}#
_#%!"
#!t!!xi![V
#x!i%h
#V!wXF!`h
!l&#hYyfTV
#l!!&_
!&#l!!
&W%!p[!}%
\!p[!}%Us
\!p[!}
aF!lib
#h!"#l#
%t!"%t!
#h!!#`
R!~%v!
~#d%![Q!}%
aF!`h%#
B%Uxj#
!-|x%MxV
~!V!pj%5
!!%5dy_
%UzQ=!__
\!p[!}
fs! pFi
c!!_#M pFN!ck%
BQj!=_
!%|!-!
!%|!-!
#-#%|g!)
#M^#=#
Nk-p9t
!#%|[Ns%
#=%[!}
!!_XFN!fn%
#-#%m#
Nb%h9t
%[!}%5
yddfY!!nY~cn
yca!vYYf
Y~!p!ci[
{psq!b!fNa
~YyY!k!Z
zYi!br#
YxYY!hYzYYxiY!hYzih!
#!^Y!!^
w![!!_YY
#MX!n5XY%X!Y
~Y!c!YY
c!i5X#Y
!n5X!kYY
5XOwY!f!#Y~#
Yc!#a!#
b[!}##
##Y`!rYb
#7#7Y^Ya!b!gYY
z#*X/X
y)X!YY
#7Ya!b#
#*X/Xh!bYY
#7#7Y^Ya!b!gYY
z#*X/X
y)X!YY
#7Ya!b#
#*X/Xh!bYY
f##Y`Yb!
###!gY
OX_Yx!
zhYz!^
Y~!i^#
yfai!!!
0##!fi
ziYz!`
YhZYx!n`Y^O
Y~!YnY
yfYyY!!
!l!\#l
!#l#x#|
h %!P#
!T#X!p#T!t#`!
%p!#Pp#Lt
Y !YY
!hYY
)!P#%p!L!X#
!T#X!p#T!t#`!
h#P#Lpt%
!kY !kY !ZY !ZY !ZY
#T#X!Y x#
lY |_t y!YY {!hYY z_p }!hYY
\!p[!}%
$%5!%M
j%5!%Ms%
ajF!`h%
%My%53z!
%52y!!
!%M3z%5oy!
%UX!=y
aF%Myi%
y#-y-y
z%My!%5'|!
ajF!`Qh!
ysj!`!-y!%yp
Z!-y5y
%[PT!}O\_
a!_XFic
\TP[!}
^%!p[!}
i%!qF!`h%Xb
!n!_!n_
!<%M|X
a!Fi!!
,!C;%U|%M4JE#
,#L!o!o#
#,Xa[!}
-Xa[!}
_\_`!d_
_o%0!h_
!l_!x!p_t_
_o!|%P!
!^#<%[!}
qqasuq
qawup/XupupXa[!}
!p#a[!}
7Xa[XQ!}%L%<
(!oCQ!w_L
#<#L!k#@!k%![!}
a!}#!oFi
^!h[!}
,Z ha[!}
,Z ha[!}
\[!}%@
X!wQC_!w%H
!ZQX!w!(C!
!(!p#(!^!K
d!,%<q
XP[#a[Q
!}%UV2
D#<_!v!#
!Yq#s"
!Oo!|!|
Q%5\X#
,!t%[X!}
aF!!`h!
\!h[!}
!-\%-l!%X!!
%5VMp#Ux$#-tGn#/!!-T!
#/!dU#Uh!!
U#Uh!!
!-h!%d_
S#-|!!
rR#U|!!
\X[P$!}T\
!U${%U
!%M`}%U
%-f{%M
!w!-({p!_
`}%5|!
!p!%5|!
!p#-({%
5q#-({!_
q!%5Z|!
aF!w!b
E%5M{_
{%M9{!
({#-${-({
#% {%({
!#-,{_
({#% {!
#-${!_!
D{#M<{G_%
!!%,{!
#%,{%-`}_
#-({#%,{_
!}_Q%5o\X!wC#
XQ!wC#
%-XQ!o!-(iC!!!
%MkXQ!C_
aF%!`h[!}
!s#%h!!
Q%5\X!wC#
%M\%5#
(Q!wC#
,!tX!wQC#
aF%!`h[X!}##
\[X!}##
\[!}%5
XQ!wC_
XQ!wC#_
!!-|j#
X!_#-|
x%![!}
\!p[!}
\!p[!}#
X,Xa[!}
Xa,X[!}#
-X[XQ!}%
Os##!!t@!r%p_p_
-X%[!}
!4_H#a[!}%-
Xh!h#a[!}
_#a[!}%t
!^%[!}
9,! a[!}%
[XQ!}S,!w
_(C_!wU
aF!`h(`
_!s% p[!}
!s% p[!}##
[!}###
\[!}##
xYx!["
[!}##!`
N*!oNY
N*Yz/
NN*%-N
N*!oNY
N*Yz)
XQ!}!oR
|C!oQR
tC!oQR
lC!oQR
dC!oQR
\C!oQR
TC!oQR
LC!oQR
DC!oQR
<C!oQR
4C!oQR
,C!oQC!wQ
C%U|!_
Vh!!-l
_!-|%-{!
X!94H%[!}
_B_4!_
#aj!}#
{"3X "!vV
{Y"3X "!vV
{XY"3X "
{"3X
{"3X %r"%
Y{"+X
{!rYo"/X "
z"-X %
`%[!}%
_!_#_k!^_k#![_!-
_,=!4#8_0!%
![#8!E!P%[!}
%8QV!oC#
HVHQ=#!
wEx!5x_
qEwUqE#
qEwUqE#
#-x!Y![!
#!#!q#
#|!_x_|#tH
#!H!^!s!
!u!%[!}
%-xR%UR\!#C!oQC%UwQC!_
R!!w!,ZX
a#-lRFii!
!i!w!!
aX#-lRFi!
w!%5R!
a!wF!!ih%
xR!dY^
R%MxR!
%UWQ!C%
w!%UW_
W%UWi!
'"XQ!C%
!!-lRw#-lR!_
|j!-lR_,#-lR
'P%USXQ!-hRC%
X!_#-hR
!-hR_,#-hRc%![P
!}lQ%Mw\X%5!C#
X 9%5q%-sXQ
%Mm!wC!o%-oQC!oQC!_
iYGY%%o!%|aY!
!%5cs!wXQ
%Me!<!XQ
%Ui%Mq
%-aC%UkQ
k!%5wi!!
X_fUh!ZY% h[P
%-xR%UR\X#C!oQC%UwQC!_
R!!w!WQX
a#-lRFii!
!i!w!!
aX#-lRFi!
a!F!p!
R%5xR!f
xR%-R!
!-lR!n
%USVj!Y%5W<!w!`QC#
tR!i!!
lR!5hR!
#UhRSQ
hR!|s#
lR_,%5W
Q!%-S!wC!
]!w!!-dRX
tR!!wi!!
UlR'I#UdRXQC#
X!_&B!
W#5hR!
UlR7ZZ
'"XQ!C%
!!-lRl#-lR!_
qj!-lR_,#-lR
lR_,V%![P
Q%5w\!!wC#
b p!iF#
X!iF!`h#
%-xb%Ub\!#C!oQC%UgQC!_
b!!w!5JX
a#-lbFii!
!i!w!!
aX#-lbFi!
g!%5b!
a!wF!!ih%
xb!mI^
b%Mxb!
%Mtb!!
%UwXQC%
g!%Uw_
Uhb'D%UcXQC%
Uhb7Zh
!-hb!#-hb-lb
hb%-w!
!!-db!
lb=X5hb%7
Ulb'*#UdbXQC#
%[!}%5V
XQ!wC%U`QC%
%[!sus!}
\!p[!}
\!p[Pt!}ZV8Q\%U,#
aF%UXifQC#
<%5!^!
LX!wQC#
!`h[!}
\!`h[!}
&l%-|_
|!!-l^
XVX!&#-l
o!=%[PT!}
8\P%U`{!Y%5
=!w!`QC#
%M<y%5
"R%%y_
!%y~#%y!!
X!wQC#
y!tX!wQC#
#%[!}%5
!^XQ!wC#
!wC!_%Ml"
!kmvX%[P
Rs%MHW\_
WUXW!_
Qs%MHW\_
WUXW!_
!h[P!}N\
!M%UWV
u%5gXQ%Mo!wC_
!)XQC!
!w!6XQC%
j!~XQC%
z=!XQC%
p%5?XQ!wC_
%5gXQ%M?!wC_
|!%-oXQ!o!-x?C!
!#-x?_
!%-wXQ!o!-x?C!
!_#-x?_
XQ!o!-x?C!
!&#-x?_
! %-XQ!o!-x?C!
%-XQ!o!-x?C!
%5GXQ%MW!wC_
|!%UOB_
!BXQC%
\!`h[P
!}8H\_
%UkXQC#
%-XQ!oCN,!!
X!Z&a%5XQ!wC%
%5QX!wC!!
|k!%MwXQ%5!C%
%5QX!wC_
W%5QX!wC_
Mlk$#
bXQ!wC#
.XQC!_
%-QX!oC!
%-XQ!oC%
y8%UoXQC#
RQoX!wC!
XQ!wC#
,XQC!_F
a!wF!!
%M!o!-`kC%
QX#-`kC_
#(_e!!
V,__(!"Q;(XC!K_
aF!`h(%MQX!C_
%MXQ!C!
a#-pF!Xi
#-x!C%
_,!2~X
aF!`h(!SU#
%ZQK!}%U
\x[P_!} :V>Q;\%U
VQ<%UU4VQ
!ZG_u{!||Q1
[#(Njq%
%5S!`!w!
%PR%M!
v!\vov1%U
T.#,%M%5_!!-|jXQCQ!wC_
!!wl@_
XQ!wC_
_!w-|QXC_
{=XQ!wC_
XQ!wC_
%5XQ!wCV
%[!GIrP
!Y%-z=!o!`Q
C%5{XQ!wCV
XQ!wCV
XQ!wCV
RXQ!wC_Yo!ppQ1_
!%5{XQ!wCV
y%[!UDPFj!}
~up#~p
~#x1hh!lslqawup
~#x1hh!lslqawup
d!|upp
~#x1hh!lslqawup
d!|upp
~#x1hh!lslqawup
d!|upp
~#x1hh!pspqawup
^,^,_kO_
lo}_k_
_cd!}%
=%M%U(!_
}_%M@_#
!w=%M%U!
%M@XQ!wCQ!C_
lx%M@XQ!wCQ!C_
%M@XQ!wCQ!C_
%M@XQ!wCQ!C_
_p\Q=9(!
_b\_k9
|h;(%5XQ!wC!_
{[XQC!_
H[XQC!_
[XQC!_
!wP'!_
[XQC!_
[XQC!_
1!w'!_
|ZXQC!_
8!w'!_
IZXQC!_
@!w&!_
%t u!XQ
XR(XQ!oC!
_"_&DW09(!-|%[!x,s.
((@((<((8((4((0((,((((($(( ((
((((((((d((((((((!^
N N# !Y
#[p!%N
?s#-Lp!
%La_#!
##%!!!
Pkh%#YY_
!q#q%N
#vkx#h#!%
!M8 NXN
8,XNX!
\X[##-8#%<Ns!#%0%!58
8,XNX!
kxZ!!#
#vkx#h#!%
!M8 NaN
]##-8#%<N
s!#%0%!58
\NX[##
#-8!#%0%!58
%T!p!#
X-XNX#
#!"#!#_
\P[%N%W
_j(OP\!%T
_'%NPO!%T#
!X[(P[%
T!X[X[P[%
#.TSPkww!qkx!ir
\[PP(%
X[!%TP[%
%%!rYYh`
)!`Y[!`YY[%h[%
%,XaNX%XZ!X
7Y%a`Z
>#Yx% X
`!`ziibY!hYxh#
X%!!YY ##%
%!!iY #
#! (%L#
w!b1%N#
!# ##%
##<N!##0%
!pBv#
##<W!##0%
!K8 NXjN
8#_,Z^
j!%T##
X-XNX!Z
_##<N#+8!##0%
3!p,r#
uH(%L#aZ
#%!# ##%
#%!# ##%
#%!^##
#%!## ##%
#%!## #
%! ##%
!+$O!K
(%LP*!%T
!!RCBBBkx!!]%
%!kx!!
#!#+4#
#!#+4!
Yh!#<!
%TW%N#_
#!#!#!#!#!#!#!#!#!#!#!#
#!#!^!
x^%!K<`!
\[%LP!%T!
Pj(Pb(((((((((#
\X[P[(%L#
s !u!pY
P5(%L!
(_jP(h%N
(((((((((((((
\[!%T#j_
\P[%NPCP<(#
X[Pq%N
!%%kx%
!!YYzZ!YZ!#
Yxh#,8!
_##,8!
!f!qP#
1Z!ip#
##Y#`!
H#^!ik
##Pkx!
O!%Sk{!i%!k#%#%+O
NN!%!f
#!#!!m
kz!Yk#rk#%)N O
I!N!!!g!Yk
8#!Y!#
u`#!!!
E##ph!
!F#,8!
.j#T8h!
\$[!%T
#_!Y!Zg!
!p%!!k[!!ri
ge#!r!b!
##Pkx!m!%
h!!^!h%N
!f!Y^k
kx[!!q!`!c#
#NkY!!#
## !p_
!%%kx%
!Z!]YYz%!Y%!Yxh#
!%%kx%
!%%kx%
!%%kx%
!`YYxOXY!`z!`hihY!ZYzZi
_P6%NR%N!#
!P_%N#
%T#!!r!
B(%LP3%N!!f!#
#!b#!`q!q[YZ![#
!qYZ!!Y
8#!#!!
!f!qP#
h!!qk#
1\!cS#
%T#_e(_P0~#
_P~k##
!fs4!!
|%N!ZO
O!%Sk{!i%!k#%#%+O
NN!%!f!
kz!Yk#rk#%)N O
M!!N!^!Y#
k!k!^O
"~!f!o4#
!pl!f!o!ooy%n
!f!Y^#
D!f!o;!!
!!^!h(
!f!YkQ!rYY
{!_{!&y#
!iYyb#
9}!f!oA#
!f!o!f!o#
_P2v!#!_#
8!#!!!#
!PM|!r#
!!h#!!
Y##p`!
P(%LPu%N#
_Xj!v%NS[
[(%L#X
j,X[(%
#!#!#!#!f
#!P*%L%T#
XP[(P[%
#)\#Yz
P[(((((((((X
#L8#DD_
<#4<a#%!j^!^
OPh!Z%Oh
OXh OXh OXh OXh OXh OXh sOXh dOXh UOXh FOXh 7OXh (Xp
T0RPZR
%-vkxN
!k!qp#h%
N%L! !
!Z!Pkx#
X&,P!ikx
%5!# 0#
j%@^ !#4<#
WORPb 8_
(((((((((((((!]
%"_Q!!
#'TOP%/!!vk~#
N'Q Q'T#OTk
!p!7P!'T
!'T!P
_!h!kYxY{YY
\[PS"_b!%T#
#'TS%O
kz#/P%
N'Q #/TQik!q!'P%
!'TOVRZbO/T%!n#
k~!q#!'P%
%!N7Q #OTQk%
!k!/P!'T
O!kx[#
!7P%! #
N/Q #TQY
k!T!GP%
'OOZ#'TPY&
O7X#!pkx%P!#!P #
N/Q #/TQik%
h#!P%! #
N/Q #TQ!Y
k!T!/P(O
Y!'T!7PkzYk!'T!7P
OO^#'TPY&
O7\#!pkx%P!#!P #
N/Q #/TQik%
!p!7P!'T
h#!P%! #
N/Q #TQ!Y
k!T!/P%
%Tk{7PY!'T!7Pe%
#'TO7P!
MOXkxP
!'T!P'%
YZ!'T!/P%
YZ!'T!/P
(O\kxP!'T!P`%N%W!^
!O0!VTk{!6P
\[j!![
O_g%{!ok
q#!&P%
%!N6Q #VTQk%
!k!.P!&T#.8
Ome%!k}!q#!&P%
%!N6Q #FTQk%
!!VP!&T#
Ph`O%!kx#
!!FP!&T#
O!Zkz!i#
q!&P%!# ##%!
N&Q #.TQik%
WogOX%!_k
q#!&P%
%!N6Q #VTQk%
#.8![!
H!e!g%
i!&T!6P
(%LkzYk!&T!6P
(%LOkzk!&T!6P(%
!%Tk}i!&T!6P
(%Lkxi[!&T!6Ps(%L#!O+!kk{#%
%!N6Q #6Tp!Y%
\[(%L!^!h
N###!D
Y%%!eC!!#
O)!e!Y#
#%#/#WO+OSu
!&&|%%R!
O)!e!Y#
#%#/#WO+OSu
O/!e!Y
#%#/#WO+OSu
o`C%NN4
o`q%N#
!wOGw6@!
Z%-!iF%4
#.Z!!!iE(%
,%+ %K
!#P%#_
%+`!%Na
8[%N%W#
Y! T!@P
!wY! ##
!wo! #
%!!qiY #
N@Q! #PTQk%!!HP! TK%
##%!N0P Y@P
##%!O0P ##%!N0Q j_
T!(P[(((((((((((((#
kz#(P%
Q#(Tik!q! P%
@T[k{0P
! T!0P
##%!N0Q #PTa! Ps%
##%!N0Q j_
T!(P[%N%T
%-!%-!O-.#%#%%
!^!_XY~Y
CO-"#%%
!^!_XY~Y
XYY%hZY#
%-`%Ls
Y!Z-P!%T!-P#
O!kxZ#
!-P%!# #
#%!N-Q Q%T!k!Z!
!%T&BO
!-P%!# #
#%!N-Q #
TQYk%!!UP
O!k{%k#!!5P #
#%!N-Q #-TQik%!!UP!%Tj!
Q#MTk
%!p!5P!%T
!!x!!!~d#
O%P X_
Y!%TQX
XO!kx!Z#
-P%!-P!# #
#%!N-Q Q%T!k!Z!
T%!%T#
%O!!kx
#%!N-Q #
T!MP@O
!%T!-P'
!%T!-P'-%
Yh!%T!
N%Q 0X
SxSqSjScS\SUSNSGS@S9S2S+S$#
##(8#H<
!H8#H0
( # 4%(8,XNX[N)W
0,f(((((P
[(((((((((((((#
6%L%T#
#!_OpY
Z^!Yxp
!kN!rN!iN!
cN!!]N
\Yxp[Np%(
\Yzh[P!
(((((((((((((P#
!Y%!YY#
aYf!`!Y#
YY!{PY
iYzh[P#
!Y%!YY#
aYf!`!Y#
YY!{PY
iYzh[!e![
!p!zs(@
\[(%LP[%
!]N!ZY#U+YEN\Nj
!Z!]YYNNhN\#-+
U#!h!mYYNNZNn#
U#!Z!]YYNNhN\#-+
U#!h!mYYNNZNn#
U#!]!ZNYY#U+EN\Nj
!uNk!pY#-+Y
#!hNYN!hNnY#
!Z!^YYNNh#M-+Nl#-'
-!ZYNj
-(X[!q/(%
(((((((((((((#
(((((((((((((((
!^#!#!
#P!Zkz%!
!Y%%5!!
!`!p#%
:!q!kz
!#L<YhYzo%R!#T<kz
!qPokx
^!iSk{!r
Z%.NNO
!g!iPwkx
!r`bc!
_0(%L#!N
_kxZ!p
v#r!i%#!$
Y%j%5!4
#!ivq!`#
((((((((((((((!^
%T!o![
\![!%T_`(%L![!h
!o!^!c%
#!!L#j
_%hV%h
p!p[!%T%
v!VCsi#
!p[X[X[(%L#![N
P[(%LX
_!h[X[%
!pj!!R
\![(((((((((((((!Y#
%T%X%2hp
%X%2ap
\[%Nj#
PxN%NNk
\[%Nsw#
p!Z!`!cc
Pu%N#
X[(((((((((((((
QWcE#!
#!n>/Y!f*Y!`
\$[###V!+%!p!
!pVDWDL
E(%L!Y
%!# +
VJEWSE!Y
PW>E(!
]V0EW6E%
VEWE!Y
%!+^!p^
-%!+^^
!pQRmE
%!Y!!pO
V!DW1D%N!Y
DW D(%
VE%N!Y
VuD%N!Y
#S!%T%
=%!+^!p^
#!p!!@#
#K!Y!p#!+#
!pV|##
!pC|##
!p0{##
!pM{##
!pVFWF
!pTy##
!pAx##
!p.x##
!psx##
!p`x##
!pMx##
!p:w##
#%!+^^
%!# +
~7!!p!4#
}QRE!piiq%N#
!pWWE#
i%!+^^
J#5%LVD!%T!Y
%!+^!p^
!pFn#+(#
RX!pQRD
QRD!p2b#
RXQ!nW`E>
!#!p]QR]E!p^#
!pQRD!p9]~#
eM@GQRuE!p]neQRrE!p]Xe
eQRxE!p.\e#
!p!b!!!p#
!!pJ!pQRiEIZ#
!!p,c#
!pQRF!pZ^b#
#!p!f#
!!pa#
!!%!+ #z#
QR|E!pvU,^#
\[%N%W![
VG!o!e!Y
^ QG +
VTGW]G!Y
V^GWgG!Y
VhGWnG!Y
VoGWqG!Y
X%!+^^
VrGWzG!Y
V{GWG!Y
#VGWG!
p%!+^^
!c# !^
Y!!L!V
Y!!k!V
!q!~!V
\[UD!!Z
] RD 6
] RD 6
!!Z%L!`
;#UD!!`
QX@#q#
@%!+^^
VDH!e(%
^ QFH +
4%L!_!p#+
[Pk!%T!!_!p
!e!o![
~!kk{[
%!+!^!^
%!+^!#
Pj=%N#
%N%W!o![!f
%!+^!^
RXa%N#
Pju%N![
!o,Z!n!!Z
1%!+^^
\[(%L#
!]#%!!
k!D!Y
R!%!^!
!:!Y#(!
#!Y!>#!Y#
WZEQ>/Y!f*Y!b
_!Y9#!Y
!R!*9#!Y
!8#!Y:
!!_ad8(
!R!*8!Y
![7#!Y
!!R!7!J%
_!6#!Y5!
!^&N%5
cWfEQ!n>
R!7!^!
!'5!!R
vWfEQ!n>
IR!!^!2
aP!(6!YT#
!n%Q>/Y!f*Y!`
!1!Y!K
!Yu!M5!Yg#
!n%Q>/Y!f*Y!`
!1!Y!!
!R!1!Y
W`EQ!n>
WGHQ!n>
WJHQ!n>
!60!YB
!R!0!Y!
!R!/!Y
!e/!Yq
W`EQ!n>
:WGHQ!n>
WJHQ!n>
!R!P.!YJR
!!^N%&
!!R!.!
Z!!D_!YR
!^!!_!
X@!y!^
Z!!9!^x
!S,#!Y
!i!]!!R!+!
!!R!<+!^q
!(#!^`!%T!]
!1,!Y}(%
WZEQ>/Y!f*Y!b
!R!(!Y
!'!Y(%L_
!R!`&!Y#
!+%!YT#N_
!R!$!YKR
!!^N%&
_!{#!/~!!R!^#!N
~![!^#
WfEQ!n>
!^!!_#
Q!nWfE>
R!!^!s!_#
SWfEQ!n>
&R!q!^!
!c!!R
WfEQ!n>
R!!^!q!_#
;!px!!R!
!Y!!!Y#
!n%Q>/Y!f*Y!`
hQ!nWfE>
2R!r!^!
!n%Q>/Y!f*Y!`
!n%Q>/Y!f*Y!`
W`EQ!n>
%WGHQ!n>
WJHQ!n>
!_!!^#
!n%Q>/Y!f*Y!`
!n%Q>/Y!f*Y!`
Z!!_!YR
W`EQ!n!
bWGHQ!n>
WJHQ!n>
W`EQ!n>
WGHQ!n>
WJHQ!n>
!!^!^!_#
Z!![!_!"!^#
'(!am#
W`EQ!n>
QWGHQ!n>
WJHQ!n>
X!*!^!!!_!
W`EQ!n>
WGHQ!n>
WJHQ!n>
!}!^1!Y
!1k!!R!`
!!_!R!^#
!|!^!j!!R!
!YZ}N%5
!,!^!#!_!
!.i!!R!]
!{!^N%5
u!!^!!_!xn!l!^N%&
-!0!^l
!h!!R!
!^jN%&
!d!^U!V!^!M!_!D8!Xg!!R!
!"!8g!!R!g
!!^!!_!)!!^m!g!!R!
!{x>!of!!R!
X!Cf!!R!r
{!=#!^V
!^e!i_
!vE!d!!R!
!Y$z!#!^`
!YAw!%T!A!^#
PWfEQ!n>
#R!pt!^!p@!_#
!pl!!R
!n%Q>/Y!f*Y!`
`!!R!p@
k!^!p2!_#
W`EQ!n>
WGHQ!n>
WJHQ!n>
F%L!pa!^!pX!_!pOv(R
!p\p!^N%5
)!p ^!!R!pO
X!p^!!R!p
!_V(![
,Y!f,Y!b
Na%TH#
\[%N%a!p;
\[%Ns!S%L##!#!
!F%!p!
_!YR!p"
$Xo%!p!
_!YR!pF
[_!YR!p
I(%!p!
_!YR!pf!
_!YR!p6!
[_!YR!p
!p}Y#!R!p%!p!
!YR!pz!
#!p_!YR
Y!a%H!
j,X!!!
!h!YY`ih!YYy%AQ#!Q
!_,X!Y
a%N%T![
\!!p(!p!]#
#WDJQ#
!pP!!R
RJRCR<R5%
RVRORHRAN
ZXr!%T#
\!p[!![
s_!#![
!xL!q!R!![j(%L
qj!%!_#
?!.L!!R!]![ %!
\![!p[
!R!b!_#
!_m`%N
#!_NL!
X!] i!
%L%T![
;!p!o>
\[(%L#
D#-J%
HNj-XK(%Lj!p_!!R!p
R#!%T%
%N!p_!YR!p,
j!p_!YR!p
j(!pQ!^!p8
%Tj!pO_!YR!p
_!YR!pc
!p{_!YR!p
_!YR!p
:j!pS_!YR!p
_!YR!pY
!p_!YR!p8
f~_!YR!p
?~_!YR!p
~_!YR!p
D!p~_!YR!p
#!p~_!YR!p
!`8j!p_!YR
XT%N%W
\X[%L%![!
N`%N%!
N!n%L##
gQ!vWXB>/Y*X
8YYx}\%
G#U!U_U!i!U%U
-XNX!^
_!!!#%
%x%l!q_<^@_L_P%M<!
_X_\_T_`!
_h_l_p_t_x
#l#x_|G`%]YYx!x*\%e%
\!d!q%
R!5!p#`!
!`#<!#H^
j,X%[%
N!%TX|N
M%N!!%T#
DXH_X(((((((((((((
\[(%LP(((((((((
\!p[(#
\[%L%T
\NXp[(((9
\[s![%
#!]!_!^%
\[(PHWV~Sx%
(((((((((
\Z%N%T
!?(X[(((((((((((((#
[(((((((((((
(((((((((((((
!_|Y%N9l
_,Z%N%[S8
dCOd#X!
dNd U##
_ZA(((((((((
\[P!%T
\X[(%L_
\X[(%L#!!_
i!h#!x
\P[(9|
6!%T9|
3((((((
,XNX[%
X[(f%L%T#
\!v![(
\!p[(%LPN
\![!p[X
![(%LP
![(!n![!%Ts
XPp!p[%NX
\[%NX%N%W
![(((((
Na%XZ%
\!p[(#%f!%TW%U(%L!k
a!](%L
a!](%L
\[!%T#
\[!%T!}!_
#h!h!d_
##+<!lYZ
_`!hN%!i
z!wG.HZ!.<
<!r!lYh
8#l%p_
!q!Z!#!_#|!
_G+Hh!
_G+Hh!
a!w!%T
`!w!`!H(
sa!H0(%L
Pkxp[v
Pkxp[#
Pkxp^#
GHD!H,
vPkxp[f
[(((((((((((((Q
X /Q{!%TP
X /PT(N#
#!/@!#
\X[(Rkzm
_8_0X_,_
%LSX%N#
\P[%L#
X!/LNQ
%!q!!Z!#
SXSN!v
t##(\_8_0_
_L!% <^Si!% Di!% @i!% 8i!% 4i!% LPhi!X!
8A%N!o
uNa%L[(#
X^%N!pd
Rkzrn}(%
!J(N%%
n!pVN#
!!Z!p!
Rkzrn%L
Rkzro(
_[(!^!!p
iv!p`(%L
!!pYnn:%
`5XNX!^!p`,XNX!^!p
kx!^!p%
!p`!^!pGY!^!pj!p!n`!^!p1!^!pt`!^!pi`-XNX!^!pX`4XNX!^!pG`6XNX!^!p6`7XNX!^!p%
!h.O!h
\T[%L#
a!w(%L
a!w(%L
\T[%N%T!e![QX!w
\[(%L^
%T!n![
\[(!^!k
\xP[S%
%T!n![
q!%T#!#
Y^Y=I(
z#j(((((((((((((
#[(%L#
#Y!#[%N%W#
#[(%L#
%TX%N%W#
#[(%L#
#[(%LXQ
%T[(((((((((((((!}%%
|##*Q=!%T
a[(%LP##
#M%-@_
Q%U@Y^!p!
!!M!i!#
!d[%N!}%5%%U
!p#L!Z#H!!!i!#
!rb#L#H!
!d[!%T!}
%5#%%U
a[(%L%-
!p#L!Z#H!!W!i!#
\[(!}%5@%
%-!pE|
XRZ[(!e
T%5#5!
\[(%L%
!!!7!#
\[(((((((((((((
Na%t_%
\!p[(#%f!%TW%U(%L!k
a!](%L
a!](%L
!YNp!p!^#
\[(%L%!^
%!!P!W
!YN!E#!
#%!!(#%#
\[%N%T!_!k!
YN!5#!
!!^NX!
%!!Z!;%
\[%L![
%i#%##
r%L%i#-##
%!!Z!#
j!!Y!p
Ph)R-Z!]#
Y!r!^NX!
=!H(!W
!#(%L!)
0!p!!_#K#
f!!w![#
%T!ws<!
\!Z!pa
\[%N%T
\!p[%N_
YNXNp!!p%
%!!Z!p#
((((((((((((s
\[ (%L
\!p[!%T_
\!p[!%T%
!nh%-!
!%@Yz_
!!G.1%
[![(((((((((((PZ((((((((PZ((((((((
\qx[(((((
U!!%T!q#
qj!!.%.aX_
[(%LK_
X[(%L+_XV
\[_P(((((((((((((
_P%N%W
{_n_u((((((
%YCPg(((((((
(((((((((((((((((((((((((|((x((t((p((l((h((d((`((\((X((T((P((L((D((@((8((4((0((((($(( ((
((((((((((((((((((((((((((((((((((((((((|((x((t((p((d((`((!^!k
\[(P_!%TX|!`x(%L
PZ~!%T
!7!m!_D6m
RP"Z.(%L#
PZ!gc(((((((((((((
X,XNX&
!X[!%T#
x!X[(#
x!X[(((((((((((((
x!X[%L%T
\[(%L#
#Y!X[%L%T#
zh!X[(((((((((#
,XNXpZ(%
\!p[!!%T
_V![!_
!%T!k#n-X
sf!rsV9!
s#o(((((((((((((![
\!h[(%L%%u!
:j!h[j?#
\!p[!%Tsx_
[%V`QX!w=%
f(((((((((((((
n!]!_n!Z%
^ZX(%LP
j!Z(%LX%N%WP
^ZX(%LP
j!Z(%LX%N%W
XR7`Z%
!!%N!N
!!%N!O
a!'!f!w
jP7`h%
!!%N!N
\!Z%Nja
a! (%L!g!v%L
~!!Q(#
!~A!vU
zX^Z%L
xXa!Z%
zX^Z%L
X!Qy!P
jP7`h%N
QR6%L!f!
jP8`h#
\!pZ%N#
Z!%T!N
Z(%L!O
j!Z!%TO^%
Xq%N%W#
Z!%T!N
Z(%L!O
j!Z!%TO^%
Xq%N%W
\!Z(!v
!w(!fN
1!%TN#
EP7`=!w!
\!hZ(!w
!#,Yz(%
pP8`;s#
!i3!#6!!{#
P8`a!%T
\!hZ%N
!hZ%N!w
P7`A!!%
\!Z(%L!rj%
P8`l!%T!
!w!f'%N%T##
{!u(%L##
Z%N[%#
!Z!%T%
\!Z(N#
!SV%L!v
\!Z(!v
%P7`q#
\!Z!%T
\[X!(%LR
k!%Tj!R
\[%N#P7`
!]!Z*YYb
(((((((((((((
^*Z!o!Z!Yb#
"%XW!v!%T!w!
!]!Z*YYb
(((((((((((((
_!Z*YYi
XU!w!k%L!W
XU!h!!r.(%
!]!Z*YYb
(((((((((((((
^*Z!o!Z!Yb#
%XW!S!%T!w!
!]!Z*YYb
(((((((((((((
_!Z*YYi
XU!g!k}%L!W
XU!X!!r
aX!ZaP
^Z(%LXP
!!!%T!N
!a"(%L!g!v%L
!3I!!2!vU
4(((((((((((((
!!!%T!O
!a#(%L!g!v%L
!m1A!!.!vU
QR4%L!g!
\!pZ(%
\!pZ(%
%N%W##
Z!%T!vN
%N%W##
Z(%L!vO
j!Z!%TO[%
Xq%N%W
^d(%L#
^!^s!W
X!y'Y#
\!Z%L#
!c!,Z!%T#
2!u!9(((((((((((((##
{!u(%L
P7`Y%N#
j,X!cYZC(%
.P8`X(#
k%L!sW
_aP!QW
j,X!cYZ (W
(((((((((((((
XR7`Z#
\!Z##!
!Z/YYi
<(%LU^
XR8`Z#
\!Z##!
!Z/YYi
X!!%T!n!%T#
!nv!%TW
#%5#0#
##!h![_
X[%N%T
X(%L!i
\[%N!_
\[!%Tsm%N%W
##!0#^!
`%"Yx!!
,XNX[(#
\[X!%T
\[%NX%N%W
\[X!%T#
,_VEv#
_VEv!L
\X[!%T
\!p[%L
!X[%L%T#
X[%L%T#
X[%L%T
x!X[%L%T#
x!X[%L%T
x!X[%L%T#
\[%N%!
XJ(((((((((((((
\[%N%!
XJ(((((((((((((
#PV#,_
\![!%T#
\!p[%N
(((((((((((((
j!k!ZP`r!!
\[%LS!p
vYYb!h1
##!pYY!nvS!p!Y^%
v^o!!(!o![V
sdS]%N%W%
\!p[%N%T!o![%
r!jA!%T![!n
b(((((((((((((![
\!p[(!pa_
tE(S[!%T#
\[%L##!
\!p[%N#
\[j_HEv!
_HEv!I
\!pQ!%T%
!RG(%L
jh$%L%T
!f%L{#!_
!p!Z!p
_X[!%T#
P[!%T#
!X[(((((((#
X[%N%T#
x[(((((((((((((#
_X[(((!e!k
#!p1!gY`
\[%L%T#
[!%T9$
Xm%N%T
\[%N##!
_X[!%T#
_X[!%T#
%TX[%N%TP
u!^!o!%T
C!^!o-(%
X[%LP[%
[#\_WEvX_
__IRX!X%
\[!%T!L#
_PT%N%W![V
\![!%T_
!^g%N%W
\W![(!
W-X]W/%
!<!]!o
##L!m#
\[(!A!
%T!QA!
$%N%T#
(((((((
Pj!]!`j!Y!p!g![!p!
\[(%Lf
(S!!]k~!qk!kx!q!
k!kz!qkZ!h!!m![m
((((((%
[,(H((<((
((((((((((((
N[%!Y#
Yzre(%
jL((((((((((((!^!g!k
\[(((((((((((!_X!m
5N!!%!!!Z!h!^N%#
;(((!o!^
\X[(((((((
\[(%LX
\[((((
(((((((((((((((
Na%(?%
\!p[(#%f!%TW%U(%L!k
a!](%L
a!](%L
Wr((((((((((
\[([((((((((((((((!c
\[([((((((((((((((!c
=(((((!_
!LX!bV
((((((((((!^
\!p[%L
#!!%Y#!!`Q
kC__@_
(((((((((((((((!}!c%
#a[(!}!c
_a[(((!}!c
%!p[!^!q_
b((!}%
%Z!^_!q^!
_a[(((!}!c
%Z((!c
\[((_,=(((((!c
\[((_@
=B#!Y![9_
i![!BN((((((((((((((
T![(((!f
\Z%L##
\Z((((((((((
\Z(((((((((((!g
\XZ(((((((((((#
Z(((((((((((!}
%T#|##!
%x(((!}
!!t!x!
%XZ(%L
6(#l#p!t!g
%XZ(((!b!}
a%PZ((((((((((((!}!c%
!!#a[(!}!c%
!!#a[(((((PY[((((((((((PY[((((((((((PY[((((((((((PDY[((((((((((PY[((((((((((
\Z((((((((XZ(((((((((((X[(((((((((((((
\Z!%TX
\Z(%LP
\Z(((((
\[([((((((((((((((!c
\[((_h(((((
\[([((((((((((((((
\[([((((((((((((((
[((((((((((#
[(((((9
[((((((((((#
[(((((9
[((((((((((#
[(((((
\[((((((((((((
(((((((((((
(((((((((((
(((((((((((P
hz_,_h_
x!~((((((
\!h[(P
(((((((((
Gb((((((((((#
!X[(%L#|
#t!%LC(((((((((((
![b]!%
!%TXz((((((((((((
((((((((((((
Mq(((((((((
k((((((((((((((
\[!%T!
[((((((((
\[(((((((((((((s(((((((((((
Y_d((((((((((((
uv((((((((((((((
!lj!pB_!t_
!;((((((((((((((P
T(#$0#44_
kTBIP!
j!!q!Z!
!]j!p%!Z!p!!:N
!]j!pj%!Z!p!!
Pkxp]!r
aj!!%T
#,<}#T8!
!j(((((((((((((
\[(((((((((((((!}
a[((((
(((((((h'(
lWqp%B;^'/
HPMUkfK"t42v?CK|7.iG@[7?*
Nb6NWb$A
X\j;YieNmD
NKkJ]J2-&t
PwvwW@
D.!! \{\
\5s\\\
b^WC|cg-\'
+K_~e3)22"ppPPPxy[hhh
]0jlllW
.AcN1:ep
#h8+>7
\! !!hvjAx
2YgFNt
;'>H8`aa ##
O6Q|kvr
?7G{\
.700 n!z8AR
KEx~TpC@@e
y9+#)R
v2kQQwa4,
\83eQ
B311Y%
hZu<PvV
2GdOHH
Gx]N8y_y ek
oF+(66
<odwrr111
xni!|C
HxM}JPu
*55u]
:qVuxl`
N.L:QV
`eeY$cp
|bawU/=
v.NE|wt'Rbc
5Qn1?<BIT
8888#]|
HE-rLz
Jxg8|OHwMc.
#S\F|j^
~:::,+
PY&IvAAv
QoIIVP3E
D9"jjjf(
!C|hF`9N
gV$9L{gAH{ZdNBz[_
YuU)mGWJo#GjfIu",r`N
tKN]jvSa
%7*EKu+S;\U
,\:"p&ZZ.
%q~/z
yh=MVxQ
7!nEW`QUz6VV"4a
yZ>nvy
#638rQ(n
$Wg412
{^%G+Ut_
8]yL3wf
A(-]aG_(X=j
j0)sbw
mnn:RR2}}}e.&"\
{Vv0<gG:j\
n7UjO5G
c|blCz.
|:,?RdmC){%D,
f"<#W\
qOZ7)z
@jd@o#
^7V}(k^[4
,6V%;Vd
GZ!S{nE
>Vb(T+#
~Q_stBuM
y9hVd=D)%
7--2kf
#jtZ5T
6S$z/zr
_Vxv}T@
0C1P#Q
Y4hmdD,$
UbV4T6d<'
agqRwrT)WT/bg
veb<VGoo}SA?
\JtjuD9\O\+$*
m !S}iuQr\3\
pHVH|wa!\S\zz#9'>]
w0P#S}6mm
{^TdP{
{i[7qu
{&T{C@3
{;H~tRc/
8CsTts$
O9QIuShw_
cXh rqG
rEX%!<Y
nqq0gD7a.^a$%V[
w4]g\<{
bKejC aR
b(LL>Vb
RE5dTf
)/^zI@*y
E% HK]
];jx/dbf=+x
&WsO8I:%Mee1$B*\
%@7QEqj
}1mQN0n
<uA:+$bD.
|$b^E0|$v;E
{$m<"1[
G"/g**%:TJ
+fdJ0Oe
(D%zh,[W#
HRsH\E
'qg|9?
$zr^"M+}
GaNrPI{)Mw}KE
$t#*7y
F|SbTXoh6{[wrjS$
;;n0LJ^
DYy)/i
2[%ghu
%*phl"e
,%wp1$YVo
{JCj@C
eDnkF<?8FB8V$4~C
_O>RRw1nrRaYu
mlZ1WymH=
Wb=3W/a?;R2*b
-.u1}r
g&1HwDs%<S4N
xojGI1r="~lK
sqJ?b6
2+I!+aKiL%ioWZ&
cR_0{_
p1OoOn'J+}
WS7hkaQc"gGv>g
Y!1^?04Msd1?
8cYJQj~
n^|Wg._u
wJEx_1GVfs9g7L
(gf4$Q
$aYY7Ww$y
&edBb4
VVV]Q@ X@xgQU
Vb5:e1bN
~~m_3h
$N 0QX3``
;{m2melp
(:$2&x
234we9,-
[BQl,^
u9`g'Gq
~>:ar`
uGq|zS16
=m`eYJ}c
c<46>>
={Ey\1$y\
y HO<=
}sha{wJj1
00O"e
^Dp]NYv
<XTVSK7wd
sdJ[~H
`>F&<&x
y{^_PD
|MKjf9We)|
BT*Iau
miL="^E
~uRwI|mw.a|
sdle96
<%};~5o`
78vK+O
gTARUFk
:z-t$:i(j&
q`uu.{}
be#849o
UE51yDITMb+60
;yT]'N
exUm~}$
oT&i9<
wqSv1?{WF'\Q0
@_>;<Nx\
B^fC<~
Y2fqnZy\A
9cdr_X6\
'\T6dI'b
sQ3Ruq4b>f%
! f77 [S
34WeJ%U,>P
\CkwtMSYgQCn
m<r@t&*N8
~M1fC$2tC
hnjlCx
\3dLU?
e4+.j]
oeBVIyhf
$HjKN][x=}$
sFi8go
]! m?)[
^?`lx&-JfE
;(/d;4p#
Jjw+L O
Jsp4@
x"lggpG
[VF;'_
(ao\`R_G\/
7IoVtNb
6~J6NsoV%iN$
VG)?a[|
$nMe@5a+T6
(c![t/+U
`:an(K
trv{a{0
Pvyrc $\.tC(^n7
bRDy@pe
UqIbHy
Gn0y@_o
o(O^4M
gg3HBU?"=!3
'"E5pOL
SjF(YfH
:mOXsF
e1zkvP%s
iDBULUpm
2ISP6q.Nit`3`
m)HQIFmA6@Y
`~[9*a*L
z+g&fP
X[Dt6L+r
Q=gA<_v
vf fQiwF
cfrk#5QVY
/t"TW
pm&gwnmS
w+IqGq
G=D+*f
o*2FL)?
,RAM<*A>2lu-<w
wQ3sUU
ff\b7\Zk$c
Vs&Ec-c#
Xwwfff
rMlOw9{
fw{#MU
.1!HxYrY]tQ
5_5yZ%
0#A!LV7
jk>znu
{~zxPP
\L@/V{
oDK][e
g7E:pnB!
]l\\>>H
iV8{.jk?
>Ve/]U
dUncfde=V
Aa%HMu2 9
uHWWW:O)y&KC
1WRJ%BLXfj5w
yb)yr~:L88c7&'!"zC
^2Llm\
B~F&&7!V
SAMdVV
3c#//N
Qm(Zozwc=;:@m
BCh<;#]
KKQP7j4\
qqq((w
^BWBcLLLU
]rP wc)YE)
+f'TTlhRA'rrrpntd
F;@#_Q,7'B?@
dN;?Ei)
D6QQ(h
9!nKYttnD
L7h__\s$C=M
;CQ[uE\
cllTz#ry
RL?MM:;MEe\SIM
MY%CEjx9V
a/kbI*lI!3^\l
:etRQMOO;
-./;4C
7QM?0D`-z
>/%rvx&sT
!@7${[V;b
daa=x;
prcoFu
E5D&pS
J}AFlSw
JAGtCA'
V(Fv""@~#ImmC+
KJJj600*((
Z\fDc!
u7O@lbL"Z2
g369#V
[eu5Sy^36uVuPM*4
~Od7ptUn
~{B)OfMT
MN\s5x
.](l1|
ei'Mfnr
cEOfk'~|T
gfKFw{z
eMo:1%E
`g;m)|
zriz|
bCGq#ju
!G3k!Y
PQuGA1>C&L*B
k:\@kY?4EW
_{$pJi%k^!
<ogcI]v
]SU43G
tHvqgkC\
(>ztIRY9
VVz|eg
-"9aY[!C
vTx<5Q
B!p`;DfGA!ae
R|[Tw
yF3<\7
jEbY9h
^j{zzl
+fQ#!$z
jl=q$$E
jUuX'&
g``(>y
?>"]j"21j
bl$U&Jjo*F
~xx54z13
RSfOoy\\
DVTxl>^
:EF5jW
EC7jNiS
ll;B$l&
h*y>jjh?[
{ lda.?u
FSfq?u
;c+fS4_Ns9
>];>s?so&|PPF_m#AG;]
)PZGginH6v27I6
>Rc%OI
gpp}/&
58bZ}W2cw_
qPHS(e]Gq
)]&tSOUs
<D[-qf
KJ(4x)
f=_hhw#
[/DXr*DDoV3%x|dK
03(16w_J#G\)cb
+RJ<-q0kjc
xi6u6&U!f
A|qRLB{
swFsnx]
y2=)@"u:
hk:QV0
^![0FY
Qkqrny5wHm
s/]R~H[
dwQCBm
6;INQAxh6*
mBDbBDbBDbB_=
n5Ib?7*
n.oe^0ox
32n{yVE6cr&@
'g[\v8
N%=g#N
oE~P8'7
X^.BTLc
*W Ev5c-=
[o_Y7$]RT]//9> s~1
DIPlG77g
&S5!>=c8.
7ySov#
cop"#@/oU7hB
U?5j5t(
#~_!WH
l7VbUi~)!}6/`
ELA">5\tz&N
OiA"z $
O:Y<DD"
?vC%^z4
8~~Sj)
P[tVC6*
bE5Dsbb\
KqG'87h'
b_RR6lx'
'im<Es
x:u|@x
W.]?YrL
yLy[=K
|gRo#oVH.!
G7J!9b{
ItD)\;q
qA`vif4
]k:lgJvl,
(i6\Q8@w
GJn,@7W
h)7Vb4>|u4
vL<G5b<t
+%M)s?m6&
7X8QCG
5]4qb#w
OTUVIei9'6[
Zg4%t$
9KQFC{|m
n5Qg%7
pH9[O92/
nH@C\m_NEQL5
@*6IMW3Q
S0u}hWu2
}dCzkQ~J
-CbZ@|KA
8p=,LIzLrZ
STUUgw
7JIIIYYY_"zzr
HKO_qq
zzz{{+
Q|KMMMg0?<>oA
l"##!Rc8hmm
&&& ttuw[
mw[[<)
gvvV%X}}
i:Nlfu
GONMzOV
"1AnrVW n&
TB`t\0IV
h&""ot
i|sckbL5d
PQQD6L
5I{^i9nF?p
u(9,nS
j`ff~0
q;CN-V*
1lF1GL
V`!I^)Iya
_}5-Z=
465_?~K
c9;+ZdbM-L
iu,I4_
j_lj&$z'{X@
Br1.[!q
\oo/00#RbD}
w?j>)JTD
IW!^'|h`VZM<
MT.y`j
'j>p=m?;
5?ia/W
7$y147Gw
^) 5U&U
GO|;B.
^scQ&|n
'{r.!0+rQ
3~(OqS
lnpcP_]miYw
{[VD~_JfTk
/[fT9cBK
yX*Vl3+cRJ
^vD~fJTij
i*[l.J0tU
}uV1o$5+ W=
.&D/ps8
{uh!&]LE7\HNQdp0-I
yhDTi0##b
J{i^T!\-
D~"{A`"gp~
]:2qI^ISC6|hdd~^jl&
D+fqhf2'ssIRE
f-Q3[kJ#
WI#jp*E
3[HjV1^wxQ
+*)+ %gk!T
FQ$gMN
d)eb)^m
:4GnzsiM z@"-
aiKb6)$
!RRRRy}
CKp/nM
iZ(F^,5T/
+j/(cH=>>;
9`-=fjo
{df&lWiW
@$I>P~|#W'
f}~ M~8(="b
K~R>SV&
^<3bBJM
Pke&Fa
,Y]5@vKf
;!`xKq
tg7WgM
~:AJ/^
XE|~^PPo
kF%z[2ip0@
3C9jYjoYsr
S0kf)epQ3e]
W[~Es+1J>
!=hl]E
@AF["=\3
oxaB7yzQ
){A:[<
}tU'TQ
n?Ut5LT^jO}l]
%lzc.\T|q?
WlwY7NN^S
grx8}\
iW~{bZNt
GTC#+py|?N}};}x
F_6GT3Ca!a"y
y-(U.I/LT:7\
yM1K4&6A
=NdIL_bj
?#2QG_\(
$$R Fu
PgJMAN'_{MN/{R
*-22nn\Y!!|
o1*66K
i{i5tTT
tbepq8<O
"[LvJJnEgO
MgX P@!}i;
:.Maiv
hT#2cfn!
W?\N:JJ=
R`OVc6jjj
uRe>eb
chp<i#)60qaQ8A/nNd
"|%-037c/W_r
PrU\rqK
''~a47+e[
%;hN%|0
1aFSFL@
NvvD_4C#nP
BS=aC/
_1ehn~3M
S@NjF`
VsM2Ci?
yd%QW:K
GsWG/GL?r
n%+7`{#
Dd.7<y[
oX2V1rC9+#0
|U>P('
sha=At1/
3)=ocel
m#e;2K
3/rn!)46mF~m3Dc
VpMVE}3IP!s{4AD
Y!ly<\4E"*
1vY;?<_
f5;`op8}M
3|fA}t
`ZGzr[,TH7+
nhd"E;QV<4
?'@AAyqk
]~P1an`?P7a)&KL.
}yUsd2y[\
:)6II!lz
tWZW'AIig^3
45wV4V
w5b|BWe
&orWJ3NV
8-=nNV#nE
drh6s{m
Wg3*pP
q#uttFVx
4W5?xAtYmg
cU8.g/
Wgdb;'$w8P3S
),LyDuP
u+F4FIL
C:##G#%\
e]%q9 (|{
`<T)CF
PZ57?SZ&d
Oh]hp4a
25]YS0
ue{dc)>t5g?
0-8:6O
5$GTC^Na
f:3%k$$dr5
^tvP_v<aw
{qGwc.^k
OI[@BG5er
k{:zz*PwuE
bUPPIIw
6`g6cMau5
(xxx((
=;-6 s<Pt
mx qj/NU
0JnaSs
wgntiCDq
o`hWML\K1-Rg=UP6P Jq^I
MN=|W7lP:a
&@.0yS
\^qHOPV#
k$lJfM
T;zSl=wo-p
lQ7|fv0aq0hHL@o_K
PNKW2zN2jI
g|5+FI6
wQV&VOm&H;nn
+i9\ZpwSiT>uMJr
VR]UJ*L
K?oZghM#6q
FvHZ34;
N3&j*Vm}Ot
iFtnqw
pFTA]6Sv
UU"ZRb+K>;LhR+oevWq
VL9&[w%
?_."q`SZi"cq{MD
~MoM0.
A3sH2cA
-{7$J?
v[J]rBF7d
)!8(T7R%
Z^s",S%
>ZqW]8S'?.f.%do#
8;n% /.)0ovAd_jy+co
ch;F)z7"d?TGyEhL
)hm8cd"
A0aM cF
po/~&]M=
8(F#iM*]u
\,?Zm.qTF@%O
}J<ZA)
87PF]|7vdn
Joc~yjdMd%
ox.G%N`
05?Kt.B}1op
ld"%S.)Shq8
?.=T')<"UxTc9%hvX~qUyTh?
IFP79d"
xo'&*aQ
K2`E:X%2
CYlo>{UR%
)vc*O=u002\G
nO$XSBz
xgIzq=
qRp!r{sT
v#7Kwju}tp
oAnNpl
Jm<hf8i
~kj],4\
_dZ-[:
kY-X@Gc7]'b^
ekXgQf.G)
(*+4>.C/-]
x,_T7gE
i2!%$y&
!M^ 2
8hzA/R@fB
<O=\89B
;5/V:h
LV?N!e
OseJIKI#H
oSRP4)QL"vT
xUrW0VTP#`BGM/'
Qo5L]"
oPWnup
O<6hg'
h7O%].78
*'@3@N(k9!
8O~PAw
N^H<; Hs
w@Rg>w*!P3
1Gox#bHNi}H
>M<yUY
TThw 'n6
2U>UpYW
y_eq*@VD
b<.AEd
+rIWn2^K$9
yfAC"~
lBf#^gA
[s>)AHd
'=6-;s
tP<xm/jq N
sSanDTp
tngCiqDv`o
WhLMK\gR-1PU=P6 ^qJI
!NM7W|=Pl
a:.@&y0
Y\Hq^O#VPQ
lJMf;T
lSzw=p-o<i\
qE rPh
KQlf|7vqa0Hh0_o@LK
2WKNNz
Ij2m5j
@|g+5F
6I+;j
&VOVH&mnn;9i+
pZ\wiS>TMuJprG
]RVJUL*K
Zo?Mhgq6#vF3ZH
IFN*j&3}mV
ATFvS6]Jg
MUUbRZ"K+
eo+vqWK
,LV[&9w
._`q"iZS
"{qcDMMF
&0gZq
k*FoM~0Mo
:$7{?J
r]JFB7
Zs^,"%S>
WqZ8]S.?'%.fdo
ybRS;8
%n)./vo0_dAyjc+
~~ch)F;"7z?dTEyGLh7
~ZWmh)
00AMaFc
/o&~=M]T
#F(*Miu]\Z?,q.mFTO%@4v
]8J}AZ<
)78|]FPv7ndg
T1JJ7C
cojy~dMdxo
%G.N%58
]0K?5B.t}
o-dl%".SS)8qh
|'T=<)U"
cTxh%9Xvq~TyU?h"
PFI97"d+
V@tcZ%
|x'oa*&
CY>olU{Rx
cO*0u=\20
TOnX$BS
|:6z| kC"
UPij_/
,c;%-eq
pRr!s{v
TwK7#ujt}o
pnAlpNmJ
h<i8fk~
j]\4,^r
:X-cG@b']7`a
gXkfQ)G.(
*+.>4/C-,x
%!$&y'g#
Azh8@R/BfC<
B:V/5M\
e!JesKIIH#So
Q)4Tv"LUx
PTB`#MG'/v
t5oQ]L
UxonWP
<Oh6g:
&`MJh
iuxLg'
9/7\z6
X7h%O7.]
j~OAPwiZ
QN<H^ ;
2() +L
@w>gR*wP!3
#xoGHbN}i
i&vNZ&
qhTT w
6U>UWYpEL
*qeDV@
+Ir2nWK^9$9
Af"C~S
!K\bnn
s[)>dHA
C>8>8>8>8>C>C>C>C>>>8>>>>>>>>>>>>>C>>>>>>>>>8>>>>>>C>>><>8>C>8>>><>C>C>>>8>8>8>8>8>>8>8>>8>C>C>>>>C>C>C>>>>8>8>@
@)@@@@@
GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
b,b,bbac
c__```l__YXlXxW]5\\E[[QZZ\Yd^d^d^Z^Z^Z^Z^Z^Z^Z^^^Z^Z^%]G^oV8UUSUQRQRRdQQyPfPPHUWTTATATTPO<NN<MM<LdL
O<KPJJGIb{3{
hX( X
((((((((((((((((((((((((((((((((((((((((((((((VVVVVVVVVVVVVVVVVIV(VVVVVVVVVVVVVVVVVVVVVVVVVVV8
V^VVVVVVVVdV=
VVVVVVVVVVVVVVVVVVVVVVVVVVVV
<O?OBOEOGOoGTEJOLOJOOORO[ORO^OaO`ElOoOrOtOwOyO|O
OOOOPPPPPPGHPPPPPPPPPPPWEDPPcEDPPPPDJPPPPPPPP
P%P(P*P-P1P4P7P:P=P@PBPEPHPKPMPPPTPWPZPKPJH]PfE`PbPePhPkPoPrPPPPPPPZEQQQQQQQ
UUUUUUUUUUUUUUUU
U'U'U,U,U:U:UCUCUUUUU[U[UjUjUoUUwU'UUUFFUUVVVVVVVVVVVV
,--,(,----H,8,,(,
<(H3iKB]8fg=nsYE,
+h;d8a.
'h;Q8a.@1?
<h9$8tla
'h;Q8a.8
h=nsY@1?
<h9$8tl@1?
<h9$8tlnriAXSv'E,
+h;d8a.
h6h8bK
J4H\<2FF
YAUD`C N0
gWh(Xq5}
wruEok'X
ogD0BAxlgfH
w @(gD0BAN\fGvB
hhU8af
;_tlT"kNX
h9$8a!M|f7
Yj66?q`(hU
?q`(hU
XNUG7[fWBj{}f$O
i{}f$O
&IyxchU8af
f#B;>XM^
?q`(hU
?q`(hU
yxchU8af
?q`(hU
h9$8a!xNW$hKB]yNW$hKB]
f$BM}L
(f/mB@t
h9$8a!
Go/\\\0-
IN:a.U-
/6QI^B
h=nsY$3h
+8Eg]>+.be
X+hG)BN
ShGQBN
5YhGQBN
PYhGQBN
OI|[gG
ShGQBN
i;*xxOogHGZe8K
g:vBQ,ufWB
8t6gTBD
h&XoX#F!
*-I]k76
]]]TnJX8XL|f7
=hU8af
<e UhU8af
qCH}tG<"
4L$))"r
_&7|k5&X
hO2B?|9Ky
` DMqK8HP
%BZAf@B
ZNGk"DWR:Q>
&"yGkNX
&H`<jN
&IzW7S3>I4
[4kH)jN
GSwq,}0/LQ8TGE@>3
&H`<jN
<jH}TdjN
D";(rFrd
I<!E50
NF/|2IuYc@+)RB/
uGbfR:)\B
6}9UZ'
eIzW7S3>
;Bf7H`<jN
S&%i7^%{6{KH
{,3w')w'h%
j(Uj+R
.%Ue+YhU8af
="G)?nR<Yk769eh6
_\N"O|f7
EovjDV
"PfB^G1;8mm
h'YXq5#S
zd9"iKB]R\
nAQy0\J
"`:Ek
F*C2f~}
LgZLnpq
h9$8a!
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@(=
WZ]f@=
ck{}f$O
K7~]PN^6
f$BM?q`(hU
h9$8a!Hy
f/XBgY
Y'DgLds
h9$8a!8
Sk#XNUxT
]]]TnJX8X^.j%8a
92iQ/4T
OgIHq,.5
Z\\\0-
Y\\\0-
[\\\0-
WZ]f@)=
WZ]f@d
wJ_i5XoA
5xld&RW#|fK
2#O1zQ@PDW$@!>v
tiJ%&=@B
7[fWB}
7[fWBn[h<
hD|XdR
7[fWB8
hD|XdR
09wiMC;
rPfAeA#G
5"JyjLD
C,mC-I<
2'1O15K
cS&9_QXMc
Sj/"7qvT
Td}Z\j
Wop2M:
E>mGuZj7W
E?LF;cL
}Z=.bj9OB}*M
EQ1oDczA7
f.WNh,8a#WNh,8a#xix
WNh,8a#WNh,8a#WNh,8a#WNh,8a#
{fWYydYjH
8a#WNh,8a#WNh,8a#WNh,8a#y
,SpSx-^L
@3{~P(h!FJn\z=I
x6hnT0
oLRP,:im
n:mjr=
UTWs9Rs#J`
G7i@$&;
,|iwmu
h^ww24
N]wY!v[
*&Y2BKF
E;ipZ IlTrIs
'T^uBo*<
12Y31u
\C!/&44C
=:.IB=^<
R^C8AKU>3pg--?H/+`?R
\wb"!f
# z*:]V
Tx.rCG
&!x!^M.
/V'sYr
?0B4}X!/U@v6
>k,1@]F|p
_}Bq-/R
5-(9nQG+T
e]Wt7e=K\&
V ?^z'VEQ"u]L3:B#,B
Xy^Dh9$8a!Hy^Dh9$8a!*[
oc5W+8
y^Dh9$8a!H4<iC8a
y^Dh9$8a!wX1l
mgKB]y^Dh9$8a!:
@lfH;G?
o(@iC8a
k"XNUR+jO
hO2B?VV
2h'vXq5
C|h(Xq5
C|h(Xq5VV
2h'vXq59
Wa0K)a
XNUhj!
g3TjtjC8a
y^Dh9$8a!
.YiCy8a
ii1~8a
ii1~8aDi%BU
}j$E8ZxTj$E8
8(mj%8a
}j$E8ZxTj$E8
;'j$E8
Di%BU
Di%BU
hKB];op
'y^Dh9$8a!
|h9$8a!krk6^\F_Vy^Dh9$8a!vXZ
0%W$,o7dzL
,dxXb'(
&::MTD
N7=i41XQ0BX_Gh
BAGipM2wsy7UP
uUj48X
0N?5yx0
xz`k'X
:uUj48X
O@/9HY-jLjT
g"=cD2
w4ce-"
xDi%BU
nvf81B2K
0Z`mQ\LUXX9Ag:B
@9@"wN
XxNW$hKB]x<}+jC8a^{%
BA_L(f:
t'8WPrfX
f#B;>j{V
&i"kNX
?f=G}d
'8)Cj(
0J\\\0-
j\\\0-
Y%`VeqA
J8ED\VRL
8,x8&icBhGHBN
Cui;;*
&YhAf/,Xx;
jNr8a-wP
?f=G}x>Kg:vBQ
?f=G}x7
h38a;PY%
h38a;P
C|h(Xq5
C|h(Xq5f
2h'vXq5
?f=G}g
2h'vXq5
g,@YrJ
h9mBPwS
Eh&>//
h38a;PH6k
ufWB.H
[Xh'Xq5*
ICjFj8a-mX
'I|/,/
?;zhAVBV+
h&XoX#?;zhAVBV+Xj
I\\\0-
i\\\0-
&YhAf/,"kNX
(jBxjN
X:ZNGk"*
X4+nf ;
tx_J&#
BPI]]]TnJX8XX
g#fB;>(
fhU8af
b1g BM
HH3OYiCy8a
IH3OYiCy8a
Ac xE5ijC8a
,F[Hj%8a
-Gks6
Sn1f]PM)ja
BAc77xOCAL`NZ
BAUPhG)BN
BAOx;@e92CN
ch!XNW\a
BA&A_9``ya
[+*}-?&
BAZ<&3
Yu&#RW
8a.B;h7
B:9x_Ck2h<8a.i
Nq:g6B:9
#i"x8a.DhABBV+R`
P:k5&X
9ZNGk"xhP
"EPF|Uy
&H`<jN
&H`<jN
&iIzW7S3>91YS
Px81@
&(jBxjN
&H`<jN
&H`<jN
&(jBxjN
&q3qA,H`<jN
&H`<jN
&H`<jN
&H`<jN
&H`<jN
:ZBTS@[-FT
"f4@(e
hIzW7S3>
&H`<jN
&H`<jN
%#gDz?
3c;^Y
XgX~p72
fj)'XwlJ
@mXhU8af
UiM2h'vXq5VV
2h'vXq5T
2vYjC8a
0*vYjC8a
8a48U;
8a48yui6
TiM2h'vXq5X
mi`8a.h
NhU8af
k2l)!}0
i&XQ02fs
i&XQ02ds
i&XQ02[:iN;
rF2iN9
mX8oAg-B
,F[Hj%8a
XHhzfB^G1;=
aj)'Xwl
aj)'Xwl8rm
hI,8a`WIhWBPwj
f*EMo_'
SY%Iy_h
.326 FH7
3R_*sguW
ViM2h'vXq5
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@(=
WZ]f@)=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@=
WZ]f@_5.
XZ^lYu
]"k5&X
>)(yJ!XUv0/
?$2%:Z
!wD|&SC
h)HhV/t.1B
`Ja'NI4B
ggf|Z8#P
#$bo{s%g5iP.s@rBGf:
zw;tSU
$Ie'r
'J_1>T{h6
XoYYwxi6
XoY$YB
9t&9,_]nh6
XoYf h6
]/}%4NK\\\0-
k\\\0-
H]]]TnJX8X^.j%8a
\Xh'Xq5\\\0-
XIzW7S3>
]]]TnJX8X3&k5&X
D{0iKB]x#
D{0iKB]+
O#NDkBm]
_KkKjaj/$|f7
G8yhRq/
G8yhRq/
hO2B?%
hO2B?%
S<A"z0&CT"\V
hD|XdRJ
hO3B?yv
}&i$;H
hD|XdR
$=^27R
;r7h'wXq5
;r7h'wXq5;
i(XdR!
i(XdR
i(XdR"
i(XdR
i(XdR#
i(XdR$
i(XdR&Rzo
:zFx;f,e
TP*(M6S
;W`Z@$
+U!47N08(
[^_]Hm
[]lWm~
6[]<Dr
[^]dNr
[^_]rJ
K[^_]Du
[^_]({
o[^_]HA
`[^]H7
[^_]ty
.[^_]X
[^_]X<
[^_]DS
[^_]|?
v[^_]0l
$[^_]`
[^_[^_
[^_][^_]
H! xj+
D]_^[[^_]
]_^[ZX
]_^[ZX
!]_^[ZX
]_^[ZXL
[^_]D4
.:L\j~
*2:DPXblv
&08BJR\dlt|
*2<FPZdnx
4FT`n
"2:BLTX
.:L\j~
*2:DPXblv
&08BJR\dlt|
*2<FPZdnx
4FT`n
"2:BLTj
$,DQ]dkv
/>L]w}
&2:FNZbnv
!-5AIU]iq}
n}#;Va
&/:AIW^ft{
4DW^jw
$+8?LSgs
+@HO`gt{
<LQt6w
9NXblv
$1>KXer
.nAQXel
#*;Bl{
0?Iov{
&-;BRev
!5EPWn
&-:ANUbiv}
*1>ERYfmz
&.6>FNV^fnv~
+YFMT)
BP{,2#L
&-7>X_ip
CHCHCHC
X{Lk<[
O{k\a
)>ESey
"6RX^gm
;EPVis
-9GN^y
&-4;BIPW^els
"*2:BJRZbjrz
"*2:BJRZbjrz
vV:Z}H
DMvuE1TTy
!*9B_x
&.6>F
)<Emu}
)9IYi@Z
$(,048<@DHLPTX\`dhlpt|
8$(,048<@DHLPTX
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLP
$(,048<@TX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@HLPTX\`dhlp
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
(,8<HLX\hlx|
(,8<HLX\hlx|
(,8<HLX\hlx|
(,8<HLX\hlx|
(4<HP\dpx
(0<DPXdlx
TX\X\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
$(,048<@DHLPTX\`dhlptx|
(,04<@DHPTX\dhlpx|
libgcj-13.dll
_Jv_RegisterClasses
[ * ] STARTING...
[ * ] ENDING...
Mingw runtime failure:
VirtualQuery failed for %d bytes at address %p
Unknown pseudo relocation protocol version %d.
Unknown pseudo relocation bit size %d.
GCC: (tdm-1) 4.9.2
GCC: (tdm-1) 4.9.2
GCC: (tdm-1) 4.9.2
GCC: (tdm-1) 4.9.2
|)|(|-|/||
www|SwwwMwwkw5Nww
wpowuw
wOw`vw w
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
SetUnhandledExceptionFilter
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
lstrcmpA
lstrlenA
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_onexit
_setmode
atexit
calloc
fwrite
memcpy
memset
signal
strchr
vfprintf
KERNEL32.dll
msvcrt.dll
"""&&&))*+++,,,,,,*+++++*))&&'%%&h+++

 %%&*++122778::;::;555***'''N
NNN)))
!!!&&%*++---,,,100,--
<=<@@@uvvOOO222
IJJ0`aaLLL^^]^__
)))666112+,,!!!
$$#efff~
oopuuv;;<
GGHEDD899//0
(((223778555...'''***%%%&&&:::VVVCCC(((
|}}||}xyzeff%%&\\\PPO
***;;;777/0/**+
! !aabghh778333
X(\,U@(2+#
''(133889ABBFFF===--.
RRRKKLTTT
5{7k6sU4K;+)'#
(')779BAC???@@@...$%%''';;;DDE666555.333
KLmGiT>C;0"#!
%&&234;;;<<=999:;;677'''
MVbmsv
fMZL=:60
$$$444DDDLLLNNNJKK>??---
zhzeRQI=1.,
#$$455DDDPPPSTTRRS&&&
&|%z'z*{,{/~2
{frVlYGH@7***
"w"s#o$m%j'h)i,l5n6KUU
okrKnKkK~eGjNjjp
f]zS}bFWG850,
f_Z T!S!V)Z1vS-zX5gEjGqPwViL_K4bM7hL0Y:j@
qR8t\Hn]HmRajif\
QyN tP+_B#N7
X@*bM7[H2]I5[G4^>"O2
O;-w\wih\OdP:~dHxWa\XVS
W[fF6'
N<*H:*V9N/
O7 \E4
lcWqOa\SQNM
qG!pO7
Z^a[{NLK
:::(
yIuG Q"B(
dA#~U8
lJ~LM~JE
oA!~H zE
jG-puoFq1
L#O+R1X/e8
P(o`b$o)q*u(u'v%w#,'"
uH'f;nHxT|RyB
U.{rpN
X:$\;~T
\F2qVG
_6t[GK
{J%rC#
@@@ &)+
tMre[(
;;;!""')+
wK+wN}
;<<#"#(**
}tpXC4A+qYIbO?H6(T!i0
889$$$***
oAoDm
554&&&)))
LLL%111'''''&
VVW<,,,((($%$
\\\S(((***
vJ'Zdgda
eeeh$$$+++
!!#---
D-"RA5
445
'$"222
,)$221
.($011
lBBB%%%+**///22222321122234445444466666677788888899979989:;;;>>>>??=>>==@@@ACCBBBDBBBCCDDFFEFGEEGFFHIIIHGGHGGHHHIIIIIIFFFCCCDDCEDCBA?.--"##
eEEF!777%///*111-:::2???8555>333D777G:::M666R333V333Z778^>>?c889h778m;;<q==>v==={99::::?????@AAA@AACCCHHHHIIGGGHHIMMMOOOQQQQRRSTTYYY[[\^^^_``bbbdeeddd]]^IJJ,,,
$33333
tpppXXXDFF???DDF\\\|||
lll]^^]
__a``_+++
`bbcYZ[ddeRW[RW[MPTcccuuu333
***"""
)**)**)**)**)**)**)**)**344333LLL022
mml555333
O9!@1
'(*667++,
?t?{\9VC0,&
"'),/$%'%&&>>?JKKW6*
;FXksz
y^dR>;4,$#!
#$133VWW
r"l%`%`)g5t@SZ
zcwOtPgCvU~jUiYGZJ;=5-
zT*fI'Y?%jR:oW?p[D^I3V<"L1
^>$nVr^hI
Xe_rLoV=K=-'"
8-"A5&N4
sja|Uf
uV6Wq>}5
yE!}L,U)V2
V9lPn_@iGk#x+(,
~L*qE]|Og6
dqKtaWK
qI+sKf
~JwUuFE
xxx8[[[
jkkN[[[
dddc[[[
_``y[[[
aaa[[[
bbb[[[
ggg[[[
ccd[[[
_``[[[
UUU[[[%%%%%%""" 
eeexWWWWWWWWWWWWVVVWWWVVVVVVWWWVVVVVVWWWVVVVVVWWWWWWWWWXXXXXXXXXYYYYYYZZZ[[[[[[[[\\\\[[[WWWTTT
>```222###(()RRS
CEG#%%$).
322~}}wwv
.k(Y+fJ-=- %"$
+-1V\b
[lR5dQ<6+
",8)5g9
WN{B:%
CT^"'/9M
Q)k8H!
NOO===@@@=??::<766557888888:99999899::;;:::99221
VgnrUrkGSiJvUKbaWbSiVbeOndhydTKHdeZvisdelUnrrtAiKovavoOFtmnnVhirhbWggrTydjOhegdhddpKHdOZUeoKlKedgbSleejtbrbKdKMdhdlyUWgfkhSWmtUVpOMMsWGkqShiHihUlbToadrJnrgMkySlcVbZgWgdSWqdedblOHHGJVdOdribSWxknTthGHMfctbeHbantdihWCWdeiSpqHemedUrMiCrcnGdrhHVSloqgrTTsgdHlidSUdiVZbytxGjorcerikndedFiFtnFhoqsSbbMHrehfeSiqScJjAlTVeyhgdeaKrpZdAJFgnSnlpHrOlylCldVcdadWidkiOdrkZsnlaSxnHryAendJWdSnWdhAydtHhlliHbJdSbeSHSCpeJdqJGFybhCbndgMaSWebFtckhSSCFlWseklVyrdAeydbgebSCdxnUilsrebJHMxxUdyliebaeyiymGteWfdAiWepVvplneAvpZblveecrTlxOrWcilSiiWeWWhgrnVVhrqHbieVaTVThUdWildrFinJWcilserlirebeWKJkxgdntnUdabyedHibvhmSdfetdrncxtroZHrnpHnrrSnZHlKjpetddnyZVodFbSelhviehdJidZlpdoyAFehdldoJFerhGlehJKyeniGFdHtpebliphWydgoWTqbhCddtlboltTrvlraGlSifeehqUbmdMyHrdAdSdhelxlbWmilnVZmStCstdsredTmneHnilcnVmSrCOWaiSSenanbMdSTeSJyWeviehtSAcaSahrsmdFyrVhdidxkyfbyegFVjnqnhJdJjFGeoloWjptaneepdxhqWfSldkbntrtWjeUldrpoFWilmCirWpAJkiOgSbZeOkSyhdtyAFHUglftHhyhZddCyOolgUddVrJcasSdgWnSgKrSbrUHrggdCerhaieCrSTWTeSSogWOSfklddbebHbieHbdnHSellntHqgdqqWrdpZGfKfdqsheSnfUdSbddJFbKgHgnsOSCaignSxhKmchqhpnVTSdFHeiAodllmTqxqgSgipJWTalhdidknGnFjTKOiZSqgpbyVhkdCtdmiHSShhkSpitdWbedreieObGbWhAjWbsMCSbehndleSxZxeMddmZenrdVdSpvqlqnsyCxfjnbkihSZShydAlAnlnMcGOhAkjHdgdWafnJHibdddbgbWtWnseShtrSqVdVdSgHpAlOlcAsOvaSnxliegchOMdynxHGnrlHcbrsZSlJUpbteOKHndeHheFeCnFqhtdhqAyUylaZeeMceJlZeSyGlSFrxybtrlSqgeblppdlWqkghedhgJpWqSerSrmTpsSdnnqJrnveKllrybGGSedrihvbxvTsSHVHSradnHJidggJWeorsneWWhpebeeJSOgkxefkhdhqnxbTfelhifpZprpWlvesieWeKlirUrMVnlfitpnAgpVSjMdplhdlkiFdpdhnlFWkShroKmMfdphOvnKbdTOdWcdosSOHJlgVayUjHHdtcirbbKeAGWHrlllsbdaahKVdgbgnMnASofnlSlWrpxtOdprdKSJZbiAixeHnAnkgspSUelgWnohGdZySlTdlpSOZslexFmtnhkhUZdeyaexKvpxxShVetJhlZiGhTrdgilHdydFjjlisiOmrSZgVSrebtoidAnOioHGldhhhWrShekesgiJHSVejdbSFJletiGiptkbnbmTrhSrvoTZtnThAlJgrjZngdSgrHUejrGhSsAherApJrdlvhbyvmdhZgeJnCdAVqAodHpvSnabMrGSdnVidvgdpitOSMregeJZdnqdthFyZqSgVaidebdtpKitFbreelhafVlihadhslknHhHgoUShrhGpenSalWKrgenTiSnSladZnbnnnettSpSZxrSrWrrTaHilGhhrprdViTiisrsUSVUlpxipghchqdSbrpbfTiKJiVUneWegtlxnCeZSHarlqhdmdKKMgHedidFsjApeolroeKgSKpdbxebVolnpTMMrJdjcbgkMdHdhAioiZdWJeUofjcMyHimeoTfhrMgpChVSiynbdanlbimleinhlFtxxqFFGvqvlHtbjaJbCGdHgpherVnFSTegchrWbyednrisSnarrqrbHqshlVylSrlndtKSWgrCrpedpSditMiorhSMnSlsgtSHrngkJdrdGsiJHHTOdVMntZnrSvGJhfadFOTSdbgOicfUneallddJrcfOGyikdxvOelgsgqtSGhdSlhtgebpWhdFhHiygWeoanGatFtligFMkSeqrnodArZUHpmlrdHdlbtrdWiiaMidShtlTSKbVWritcdnekrhmtlbSenSpWgHnddtHigShrlUJtTgUWMhfrsfgOnhydnqFVgpbcnFbabAxhinlStTHHTihrSqoleKgnHOrjlxdrgdjqZdynJjxVgFbdyyAChdtynvTtyvrVoUGdbbiqSkjqxUdOrfFbHdjkMpltAoHdfxxhWiGAdqklSidrSbndKSKtdShiAWidjhWVbnnUVSbcheeHdphrolcJWlipxslnMleSpCpxnHagnHeqeCbkeUTldSifhqjdbdegeFpdayiCMbrdSSlnUrrrAHxOJSOKrndlHthbSSHllbeFdlWcbhdMtfdHHyktnAvajAddrryiocvkdteeUaiZCsHtgrTWHdnsCindybnpWgeleGrTnddtlrediKCiTrlbSHdttdSWggboKiTbCbdFdegeiUSilihFrnbJMGKdlOpthnyMyyGHxlsArnbnmreSdhAsHSSrtepdSrphtjihobnWTKFelFtTddgbHjddHGlHologloddKbniJidWZCnOrsJeHFrSliCtHdpqeclUUebShtiFndTeqkcfkexOdhrxopsjCKfolgddhdHZAqbbnmdTpOAbhSOnfmMshdigrSWGitKaohKicVZialietHVShhdfdKdUvdprrmfmOCbSgfldcpWOhiSinWhtVWnslZsdrKjedrqbMlhbWnlWnddJkfWlhoibbnnbidhgWnnixWSKfJnyeeSbngHSkcseqrZeqgebidGnAmbOrtcvhhUneSeHlUnVtdrpligstplVmaWseVdmFgOcTTZidinHdWlrnsgHZnKikCWbnnhltMipgpqkJngyndphTnnHSdKlkedhqlKrteebkZeiWelAirJipxmeehJWjdMiMnkyrjgbdpphbVmxSTddeKUxSritrOHoberSnbKioktkbektaeUlHkZjtWWhOtOtbpJFfbmiteShCUyhJdnvpOmfteTSbiglHnSdhdbnyiljSipASdnqWpWixlddoshbhgbrletdhdnkFhhbphqldgVeWJZWklHUSxknMAVlhdvvVrtHimAASbgkjrAgrqlnKdqqexeMiqCHJMMrgtdtCbbrpkSFpggknCTiyrHdeTMqhiedbbSddHUGkyfqJSrpWHedrhbanbStdqpWgGKeVqegMmUrncWZhUOorGvoddHpHgriClblStekcrGWdfdSWfvJmhdnSyFvsSSddliefdcHxhpqJVdieepJdyckjUldtddblWgdfgSiHFbreTbnlahpKVkpvihninkpJpnMeOrjATheAWqHrdghFWjvlkdpHlnyKdeiltnjrlyglGlrJadAcynUgbAFClddSdeihChdOMnkASaricndSeGsdZllheynselteeSeScMWiSsFvvAJSFhfpeiMHlirJZxnpafMqbelJrjqvayygUhdhTegVdShejielGWHreondpWpnHmrFSaiSrmTTKFededhsoirvMebdMnrgiWebpdGbhChhHbbdsWagdTbcJcUesgVpdOGvggernaMlvWMgxOpbdehdTqtiigHUxidleeOtHZCCiciShMjnlJnqtgtrdbgpdAnhHrjsrdhySTgggtKgsildhbbehipbimhihliSmoVqiqCyJyotWUdrGceVdKrHpnlVdbxCeSKHdHhplWbgbHdgASqvbvZdhbTdgOGvaTTnGbbnmSHefVdhbkGbdlbgJbhlUnrdbGddFinJHplbKgSjevcdttoiUbbdHgchOMnbrtMtnidkcerTMnWUmbbnMglZbGSnpAhWohiSofliZFHijCreSaiibnjiGCndGAexbVWlShhgftsWeTxcHdpxpddbeCghUWxlGndnivbitKneWaHArelCMalWnavStepFgelGtgbeWmedhVxeVrihrmCMlgsFxrnrehltnidJyWnqegiVqmbsgjnSHJZpdrhMhnHFKVeSqHFvFdWehtJipSWMSledKjMFnrCbiHecylttgFnhhiaOpCognWhddhmnWpCMriidgSat
MAINICON

Process Tree

07f09fcb891d4f51eddd75fadc89908587d1586b8eb2614c891c8bce56f4facd.exe, PID: 2224, Parent PID: 1932

default registry file network process services synchronisation iexplore office pdf

SearchHelper.exe, PID: 2228, Parent PID: 2224

default registry file network process services synchronisation iexplore office pdf

com3.exe, PID: 2492, Parent PID: 2224

default registry file network process services synchronisation iexplore office pdf

07f09fcb891d4f51eddd75fadc89908587d1586b8eb2614c891c8bce56f4facd.exe, PID: 2056, Parent PID: 2224

default registry file network process services synchronisation iexplore office pdf

SearchHelper.exe, PID: 2636, Parent PID: 2056

default registry file network process services synchronisation iexplore office pdf

com3.exe, PID: 2124, Parent PID: 2056

default registry file network process services synchronisation iexplore office pdf

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53
192.168.56.101 57665 114.114.114.114 53
192.168.56.101 57665 8.8.8.8 53
192.168.56.101 51758 114.114.114.114 53
192.168.56.101 51758 8.8.8.8 53
192.168.56.101 52215 8.8.8.8 53
192.168.56.101 62361 114.114.114.114 53
192.168.56.101 52215 114.114.114.114 53
192.168.56.101 58985 8.8.8.8 53
192.168.56.101 62361 8.8.8.8 53
192.168.56.101 58985 114.114.114.114 53
192.168.56.101 50075 8.8.8.8 53
192.168.56.101 58624 8.8.8.8 53
192.168.56.101 62044 8.8.8.8 53
192.168.56.101 50075 114.114.114.114 53
192.168.56.101 58624 114.114.114.114 53
192.168.56.101 62044 114.114.114.114 53
192.168.56.101 62515 8.8.8.8 53
192.168.56.101 60330 8.8.8.8 53
192.168.56.101 62515 114.114.114.114 53
192.168.56.101 60330 114.114.114.114 53
192.168.56.101 61322 8.8.8.8 53
192.168.56.101 62306 8.8.8.8 53
192.168.56.101 62306 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

Source Destination ICMP Type Data
192.168.56.101 8.8.8.8 3
192.168.56.101 8.8.8.8 3
192.168.56.101 114.114.114.114 3

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name e332ff2ab652696e_shareit service.exe
Filepath C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe
Size 393.3KB
Processes 2228 (SearchHelper.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 fbfcc7b0532ecd65d501212c2a55c56e
SHA1 2581ae16f2a2b3dcdce1541dc5111597bee3a1e3
SHA256 e332ff2ab652696e8b35b4c00bcfa4875c892eb25c754a6416611e158d4347b6
CRC32 C1A0F027
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 7520434eac131f38_gfxui.exe
Filepath C:\Program Files\Intel GPU\GfxUI.exe
Size 80.0KB
Processes 2492 (com3.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 fe665454375b9735ea08b882543a8df8
SHA1 0c2e2565b187eecf8cbaa8e95f6d96c2cf93c117
SHA256 6c65f33e8719ae9f6b758df42507089e2c81b9241e9c79f2dd3c0c045218e9ff
CRC32 70CB797F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name 6e993cbae1db8a12_searchhelper.exe
Filepath C:\Users\Administrator\AppData\Roaming\Microsoft\Search\SearchHelper.exe
Size 392.1KB
Processes 2224 (07f09fcb891d4f51eddd75fadc89908587d1586b8eb2614c891c8bce56f4facd.exe)
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 9c64e315bfae0021c4a25a5a6a3b9d49
SHA1 5cec73c97093ae7525e4a6c7f42c2f7f5da02e8e
SHA256 6e993cbae1db8a127c4bd52ee25f35b3ecc741f7b183306ed4f0de7319a399d1
CRC32 29D780F3
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name d1c1e77fb1c72cfa_persist.dat
Filepath C:\Users\Administrator\AppData\Roaming\Microsoft\persist.dat
Size 10.0B
Processes 2224 (07f09fcb891d4f51eddd75fadc89908587d1586b8eb2614c891c8bce56f4facd.exe)
Type ASCII text, with no line terminators
MD5 7a00491017e4afa4b76e37d3b713229e
SHA1 6aa9f254fdcb824c311b71a7f9d4e6f1e5fa8358
SHA256 d1c1e77fb1c72cfafdcb7639baced4c49073b5249a73f65af8bd5c05738ff6eb
CRC32 4EB5B0CB
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.