1.5
低危

20d63f9160612efc95d5d29dbff029fb9abac0632460ea98294e76bca9abd1e8

20d63f9160612efc95d5d29dbff029fb9abac0632460ea98294e76bca9abd1e8.exe

分析耗时

195s

最近分析

367天前

文件大小

234.9KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN RANSOM LETHIC
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.92
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Gepys-E [Trj] 20200802 18.4.3895.0
Baidu Win32.Trojan.Agent.eq 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200803 2013.8.14.323
McAfee Generic-FAGO!55F14C428F5E 20200802 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0cc83 20200803 1.0.0.1
行为判定
动态指标
在 PE 资源中识别到外语 (2 个事件)
name RT_VERSION language LANG_RUSSIAN filetype None sublanguage SUBLANG_RUSSIAN offset 0x0003c0a0 size 0x00000188
name None language LANG_RUSSIAN filetype None sublanguage SUBLANG_RUSSIAN offset 0x0003c228 size 0x0000000b
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '.rdata', 'virtual_address': '0x0000c000', 'virtual_size': '0x0002b030', 'size_of_data': '0x0002b200', 'entropy': 7.431569607335777} entropy 7.431569607335777 description 发现高熵的节
entropy 0.7894736842105263 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意 (50 out of 63 个事件)
ALYac Trojan.Lethic.Gen.11
APEX Malicious
AVG Win32:Gepys-E [Trj]
Acronis suspicious
Ad-Aware Trojan.Lethic.Gen.11
AhnLab-V3 Trojan/Win32.Shipup.R61194
Antiy-AVL Trojan/Win32.ShipUp
Arcabit Trojan.Lethic.Gen.11
Avast Win32:Gepys-E [Trj]
Avira TR/Crypt.XPACK.Gen3
Baidu Win32.Trojan.Agent.eq
BitDefender Trojan.Lethic.Gen.11
BitDefenderTheta Gen:NN.ZexaF.34144.oG2@ayGSYwdc
Bkav W32.AIDetectVM.malware1
CAT-QuickHeal TrojanPWS.Zbot.Y
ClamAV Win.Trojan.Redirect-6055402-0
Comodo TrojWare.Win32.Kryptik.AYQE@4wlbfl
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.28f5e8
Cylance Unsafe
Cynet Malicious (score: 100)
Cyren W32/Zbot.JC.gen!Eldorado
DrWeb Trojan.Redirect.140
ESET-NOD32 a variant of Win32/Kryptik.AYMY
Emsisoft Trojan.Lethic.Gen.11 (B)
Endgame malicious (high confidence)
F-Prot W32/Zbot.JC.gen!Eldorado
F-Secure Trojan.TR/Crypt.XPACK.Gen3
FireEye Generic.mg.55f14c428f5e8d9e
Fortinet W32/Kryptik.AYUW!tr
GData Trojan.Lethic.Gen.11
Ikarus Trojan.Win32.ShipUp
Invincea heuristic
Jiangmin Trojan/Generic.avpsx
K7AntiVirus Trojan ( 004cf6b81 )
K7GW Trojan ( 004cf6b81 )
Kaspersky Trojan.Win32.ShipUp.deon
MAX malware (ai score=83)
Malwarebytes Trojan.Dropper
McAfee Generic-FAGO!55F14C428F5E
MicroWorld-eScan Trojan.Lethic.Gen.11
Microsoft TrojanDropper:Win32/Gepys.A
NANO-Antivirus Trojan.Win32.Redirect.brpspk
Panda Trj/Hexas.HEU
Qihoo-360 HEUR/QVM19.1.FC5B.Malware.Gen
Rising Dropper.Gepys!8.15D (TFE:dGZlOgU2Zo66a3X8iQ)
SUPERAntiSpyware Trojan.Agent/Gen-IRCBot
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/Gyepis-A
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-04-10 20:27:56

PE Imphash

021e88aa63bed63995eccbbbfe0f7cdf

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000bdf 0x00000c00 5.595788030652354
.text 0x00002000 0x00009c8c 0x00009e00 0.09802137657953752
.rdata 0x0000c000 0x0002b030 0x0002b200 7.431569607335777
.data 0x00038000 0x000000d8 0x00000200 1.6777393548929629
.rdata6 0x00039000 0x00000326 0x00000400 2.5663952748475447
.rdata3 0x0003a000 0x00000064 0x00000200 0.712453444966878
.rdata2 0x0003b000 0x00000064 0x00000200 0.712453444966878
.rsrc 0x0003c000 0x0001e238 0x00000400 2.1237746236942723

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0003c0a0 0x00000188 LANG_RUSSIAN SUBLANG_RUSSIAN None
None 0x0003c228 0x0000000b LANG_RUSSIAN SUBLANG_RUSSIAN None

Imports

Library KERNEL32.dll:
0x40c008 lstrcatA
0x40c00c VirtualAlloc
0x40c010 ReadFile
0x40c014 GetSystemDirectoryA
0x40c018 CreateFileA
Library USER32.dll:
0x40c020 RegisterClassExA
0x40c024 LoadIconA
0x40c028 RegisterClassExW
Library ADVAPI32.dll:
0x40c000 RegOpenKeyA
Library msvcrt.dll:
0x40c030 _XcptFilter
0x40c034 __getmainargs
0x40c038 __p__commode
0x40c03c __p__fmode
0x40c040 __set_app_type
0x40c044 __setusermatherr
0x40c048 _acmdln
0x40c04c _adjust_fdiv
0x40c050 _c_exit
0x40c054 _cexit
0x40c058 _controlfp
0x40c05c _except_handler3
0x40c060 _exit
0x40c064 _initterm
0x40c068 _wcsicmp
0x40c06c exit
0x40c070 mbstowcs
0x40c074 wcslen
0x40c078 wcsstr

L!This program cannot be run in DOS mode.
W*6D6D6D6)W6D?6D6E6Dd
6D6D6Dd
6DRich6D
`.text
.rdata
@.data
.rdata6
@.rdata3
@.rdata2
@.rsrc
]U]U@E
]U]UQE
]UQEPh
lUR\Ph
skRpP=
3_^[]U
etPocAdres
oadibrryEA
oadibrryEW
etMduljHancleA
Drea[eFikeA
cstrdatA
ndo0sDi
ect(ryA
@etMdulHanleW
ctPmcAdreq
SmadKgbrfryEo?
lcrnbl32dll
2qvc5t.d#l
grt_lAloc
nmaVieMfFle
grt_lP
capllod
lcrnjl32dll
@ctPUmceTqHe&p
w jguh din`#bb
mnJSjdb
8.fafafaaa48a
afa$`fa4`fa
W7qidDOkVh^d
o0,Hf|Hg
@~R,xCf]]Gl"W
o[r?_a]+t
9=tJ4q@BgP.O0
9kjl^E(9m
s1QW9Uq@O#r
3i9 Vh$
rq{{i{x
XurT`P
+QMN6-k)~
EcqriN1]ik*afq
dy0!`s
s1Qb>B{
R0LGVYX%z
@~$BDw
QQk@()I-j
rGjOU4X8D
pUvp@iM
3)Sx3WSnt
s)k`q`qVD
`R}':v
I|V{+V`A
@zW\NKcYc
foCucN|cF
aXl`P@z
a8||`0
a>{7?|Pc\cf
#F,d>0M7bzVm+8
pXtya;=9
q){9 E
gtYR;PR[PRDRA
<RAzj.i|YS
r6Ph'aD
S5r~t@
aRZPWx
xlo^xy3W;x
lFxx6xdW&x
@xFBB=
)/`NS7t~U
}d\d[N}D
$Sc2bwV+
)xQ(5Q
u+'WqF
)WRPQQj_T
WS@^*_n
s|^5Wu/b
q2?V3b
h@@R`Z
V3dxNP
P/5d`B
1b`\4G
uRtV~.Pbb
Ql0OvQ4
pT{fsa
_\@2Qn
@ijijih
jC}\%5
^^ERM=i
2^,N@tJ
3BaHj/
lL6}1;3V
Qlp6P@
cp@nxu++
0sC2W6#W
^#_l*V
3_H46S@zs
-0z\+({hHwoDr@YDC
_tqHXMC
lIfumRh^D
4\H|E3`A
av,;aV
e>h/6P
Q<@vZ;AASb&
b]DAp>{Mkf%3Rr
3K`@$bA
vz%?P
G'b7k8
s"b/y4V/
3ubV^p-q
yMSjcXt|Lb`Q
.TO@jyL
q@GL$b
aVYNtDz
)\tnN+NQ
w-PV?2
&@}GcjC
3]UphA
]U|U{u
OShx@*
.7G4~&
2wQucD
^E0q@}}
,<@/@jq2T*}9G
QRz%NS
6u{nRV
@Yt<vtF%
g.+mMW
QSvy`SjSK
@UiW {,
R`p }{
X<uFd]<uFd<uFd"
O=nuwFd
>=nuWFd
<.u7Fd
9d-^01d`
R?{^'>
&j{Il,4
MUnPPPA
,1f]!u*}
f:fY th
[3m%o68X
~2Ng9-F!>6
6#u 7k
FJr2wUO7S
Xk3"D
IYh0-Jr
VxK;:5t
7[^SVW
7D52a2z
{M-(,M
l+=r0]
]^t%t3
U?@06A,
D[YM1D
m;@FxMq?ex)
wB0x}/H
Ex(KF`
|1@O^*P)
w{e]vh
pnE`V>
7l`1Xa8^C
@*Gia9BYJCW
t*-w7@A-
YrNH)x
%}FE{)
@|G6o[|G6+>G
W$TDh+C
79Y?p)
mZZN<@5u@$
7S|EEu
@ctdn-M
]f;lSU
mir>87=
d1oE.H
G5_LDj
$?@r-7@%`
Vd`@[>l
0@g^o3
ojhwd9oh^suV4~
m%X;C"
d@&3d*
0G3}+r;|z|MD*
#dzT}+
Tkw8ti
;O|MFd
|@$V bZyyBID0y7
bHa)LK
<<ysy$%DH+yh3b
'@Cw,y,
fu"lHb|
wcp@Vw
pG)0Cd
-(CP3Po[X
u~I;D(Dv0~H-
(((u60
0+*~mcG
jCb2t-VrPp)1D
-/bzG]z\H
C>r`u"l
YY5sVp@
u(|E+^A
Z&C;SKbyz`8
l+z#*5
b:y=zBq;
eFDE8|
][5b]jK
\*FbdDvjpca
+r@dC|C
M07|-<
l|)-53<
0*$-{5{
5CR0'%_XQ?
A+'iytqM
GtTs"A
EBt7Tj
uuQv\o
304,'.J
MwLuzCffj}i
7hyX~rE\\dZ
()&Ori"bS)
YuUGf`
S[%={Xo~a
z]Y`-~|UrE*
vL\eTZVuS
V_||hsz?9lOB{Yb\DzU
.Z)qhQq-
7{z0YXgk
Ib}7?=\
zUbVyu}
yu(A__>
r(#.F?
NGiIJRAhB
bF]Asb~
rG]6AcJ~
JAd0\8^
Cu$l@?aI
pgbVPKtT}wk
PiI??????i?V?
*(sUb'Ur^p
AtTsr@
_B\%TW}v
iytLcOO
vY^H_|^S
[cio`-
*D,-({
+.f`XoK
)X_:\%TZV}xtD
#s4/;qu'W
moGWFws!a
xp[uuA#0mNEAl@6,m.
8XIkC!xy
H@E,oV\
:&ynlf
iOWcaOjK
RiBMV+aMVqRO
aOOWaOh^
k-{ d0y\>
F+{$hP3
gf[c^h
b(}7[H
h{/[ ^
v,xul-Cgs
^P gY*
gUb/{ER{'9kb
'0BzgwwtXdHdbltjp'w[tddT@
<7c(~l
}>uK)u{
ctnYf5
a:]t6a6*
`FB`>lv`6a
Y`\i_p`r
^;=mT
3G*OCP;PS
^OM'SC^
vD|HwH-W[
3TRUWt
|fJOs5
l4rZY2G
##4t.CC
XNXDxWG9X
`)h#4PXDW3q
n=ItZWC
AuW`h6
XB^11Dn
g\DUU;}
ROk4nVYjMXr
gV5uLoGg
9lZU^hg_TbTX
9l"[U.h
~#f#?m99
F1e?On
gRv`#SvPRv{@
Sv0SRv cRv
_#%_']^r+5^/-^3E^
_Q^Ph^QN
h^pQjGQhQCRXQhI
Q_@QP?8QP?QP
XS6QLhCO@hSO-KOi
X77O_0
AP_M&N
X:MW\BM
PobXq~F{N
t[t JY:
9\WaJNu/$
9\[aJ>u'
!TeI0jK
3@>]DJu4:\
;"8N0{
8]FRcT
YF F|EK57!\?
nEUb?C
,SEuK
<2kDV\W
=CPotr
\hBPB5A
B0BjH?HjC0G;5S
$2q(*=bd
V!][]5d
kVPPF[\YE
Pex/)&@G
PdRaBF)
#l+]@C
S?N???)
ylDkDq1s[bZP<
~{yKFZ<IL
`prFLWd
prGUad
s%bFV1nf`@mRsfqP5ddkmilfnqb
CxsFvh9tn7
'"d<%q
csul``y^prhd{ltr-z`y.`cnCsca7"qdsdx
ah{trc{d|m
zvb~Z/
7!dC%`?)
\K-X159=WadCe`?i\KmXgq4su0oyL[]Hwa$e
a|x]|yt
mId`EhdA\X=`\T5QX1UL-IP)M)D@%HD!<8
@<9405841,(-0,
av]zynurqfmjI^EbAV=ZTNPR<F8J)D>%@B!6
p21\&-X*
!#B"%'F&)+)-//1335779;z;=?.>AC"BEG&FIKIMOMQSQUWQYL]]@yADeEHaI<mM
d`\X0hU4tQ8pM,|I D@<
95-5111-%-))
a6,|P2?V:o860Y|Fv
JGC[0xGcGI`rC
H;B:sy
}[ZF6:OF#
n^nn^^..
k`TXJP:HZ@
JT(Jq_xph
CLct#kl:
GjMocneIne9meX
etIneTxe
OesFll$
cuW]RGsOp
iWagUax
@ ap'vc
@cOjkSft
Cc`;cl+c
='tP-]e
Aews}kTcAzglgmL
&tC\ne?PrVcs:d
qcagDig]tZwW_
gtS]nt+th
_tCgmaXLi
?RN+@32PXll^
"kadgriaW
Lo`AcWle|ctolmW
GeZ?es}cgeY
JnanhatCccher
nan_atEe4ag"
is7nc/]s
gamrvuW,
R>ksDvCHusAQ
^Tlh>Oi#g
EgS&rf8
C]PfhP{hM
fMTg?p
e:pk@p[:s]
RQ,R2_[d
f]OgfKK;xv
']S Na7[EQ
ReEdo'Ie[
lUzrN[Wf
]Q\ry7duLxW?DPIv&dE
f;x6QH
]Indiaczex
Conea_Indan_
diadze^
diadzeScu
ol12.hl
YHEAP32
VSap6_tN\ou
GbOtfnuWdf0
]r"da3Rr0]s
]tDpr{nPr`ev
dh{^l}=xDttBfF=pe
_tClaEhe
>o-_em
@]S5cB#\^4o
dK&bg"K
[d[db]i
[]W\!e\Ui
L;n7no
eceXMt+bg]
Mel_nH[Cbt
&gt#di=rgcMegobdgnkn]
&lF@[TP[
CegtemjitYalMgct]n
Dn}]de]ingr
+Sl;llY
iSlEet[lu
PsShVawe
'bteOocXdI
greXnt^
}gtL8utKvo
&gt8ut+vo
gdCdrjfnS
!gaWte&e
Q:tyWtf0]a
)eC `t"
9ea|Cr
YcSeuZo
[EYU[aEUcU[^
-ad%[rHvW
&gsC9;af
.g[A*T
He@B=S
Nsb#YD
Zc[r`swBw
8eHRe(\oJ
0PrFcs:rF
5D;a5tr
?\tFgtX]W cC+r
Ee5tr*eTcW
nn_^on^^/.
G@G@G@G@G@tG@|G@dH@lH@TH@
a?M?I?E?
li-nm)Rq
OJ3.72;6
^^ $ N
d%]`!alkhgTSPO\
DC@?LKHG430
?gCgCgC
;CaUR\5|Q
/nF3SH_66,
'c <3:
>pz"(MU
js aM)V
dnujymHzN
Ncwp]`
Q+}<>j{?ATtg
D"sc6=
c^m[@RVo
AcmA*EedJ
~^cBq~Vw
3lTT?s
b?$ZE;J
VLP":\T`D
n-?_H#
kIn[X$Q }jKM
a3adl8sW
']5!(`}
h^,? B|t
5kcY!k
Kddn<_j
]hhDa%br7s4
?9vU@!
M25}n8b(
8DiRpb
XybQ$/
*j*FlL
")R}_E
qZ4!kv L
?A&2fx<t&W
Ua"F$Un
E17/TX
Mej>9/Wq:PYE6
uEbb};yzwFGX6T
MyB@fz
[O;Wm'BI
^ w3-A\)FO
`O4BCTh
ar+N2)`
C)0+;V
a7N56ez_
S}-}lT%u?d
|VmXY$;.xzJZ M+
,7*R;R*R3
s>NIx'W8(
z(dYa4l*W`rU
Dg:VU!H-m
mG@gqO
bS[e7.
+Kht+<#@2?3
t?@3 z+
`+^z=!$
y\ Fe]9TO -
T|sy$"k8}
>PX0Bx`8
;>Q;$k1
dc}z\
0wbe4x
.2)e`X
8"'\KN=
TQh~
pE,1yE
",0Z@'
=PW!~T?\*N
Qt/=\JA
(zZb;CKsA
,ICU,'9M
v2"XX=jW
PbYMEq+w}D
;"^W[n
pd'=sN
Yo`DizS
hDh"/!5dh
d&tM(q
q4snSlu|~!
5|Hlq&
4M6Af/
dS/3nE[
dSc|7(]`N)
H=[Fg3."
Qa@]^7<
wGgWK4s
#U@nEPpox
xH"n6ATnzX
JS=WP\.
C{FDk|
((/mKM
iBS1c*9j
uJx.n>
)4jeNXj
\H}V/9IK.[g
nm#AV}
/KW\i7V*]
5qsTH|
RRVN}s
Q^}]m4^
!e* 9<Ee5E
4m"d/-5
5&agf-' f
=|h'I+
qMV#9E}H
u_[F3;J5U
,+:thF]
/5kS"e_Un(&
w/t:q[=I-U
S^5(gICWvN
iu2X,]
*1SESN@R:_}P
i@M:gfi3^
kJ<'NB
%dhvNN
!e?'Usjh5`
m;wv..p
CxW\wBYu
>0#HH{
"+-2#5N47Q
,X0(Ns
'dAR$UlooH]
Fm12Z@
l?MqJA8v
b]}~)Z`
jNo[+
D%7n[a]ci}
T,}1C}*,`z^@<
[_*tKn
"}_7-`
_ v'5g1_
2 `4A24hU|S*%W8-!
&^'1!fz@Bu
DRjm3Y
Q>\X;s
g-NEnk
*VJ:2~
%QHw(xe'e(Ig
<m?w6W
2`^RaI
3E4VA/5
7yE`6H
<R^qiL3&Ej=
A+[4<n#
^;S*=ptUYpz
]SA,^;nU
gh'iIeP
*BrA)=L
=g).$+U
=L.3M.U
>]Q$H)VM
0Ev^Rz\
#b*wUx
E4{r)o,>n~K\M;_
A#(r`ag6
){gyuTd1
.Yo:J_.t!7
hrEOwI
y_&f["GGv4yPZ[@iC
A"-g&6
iHQ9rj
p0d:1Y
E@o69AZ
Q&tZ4wi.
s41xF.b
@)ZtIW
6"?tj:R
PN=NQ.[Kqx<}eh>
)>6.,r$
,(SsAfb
6LfxnLlkD
HLqV~S
EvwDJS8BbI
yt&==EV+y~yF0
FJ!-~v v_H%
dgxDRa
^V&]3|y7gh^
2-T9[$m7I+3j
:hH9H/g
3jxDGI
(^b.\]
i./]$e
vXt0G(+
d%rD,s
YzERq6
{R>&2F
c%hE]Xp<H?-Oa
3{]a#T58@s
k3eRA!8_<
iLin:=@oQWe
-bSwW;d6
I{{aoS_~-
Ht^z>~
M-uHo{V')X
C3j0e`5}y
C^c9?GCp3cx.+C
6uoIvt@HL1Y
|^@,*`']
. tds^
!0O1>#][
RI,p0}oU\ax
Z^(6v9+0jS>
C)8Sx}XdV
oUHw#7rh
t?(_[iP
9A;l2Q#
tCr14yD
s)[qGjn2t
>bkt`Ddi
NE=/_"'
tM/qaSVS
BL@(T@
L>;9"U
Mk)n4
1l]B?B]I?g
GwErig
l's#~,
u?MQQ%;I
{%q\OG)
GhFTB$
Q\+R\Ua?
{M-3g5I
>WK3xGQ
8)JH/{`
:F1!25ac
-OB*Tj
n9.ulo|pW
C!O'ZSSU
eo0'czqW
y\M/Adm\#
d@-Z@yw
mm~U3`\
|]yu> @q
LhdWZ=+y{PgDv
wm,m<}%"
tOTr!h_c+X
~Kh=i@U4.
@y2ZSK27>q
<Kz^4T<L
Hk-'*2-)|
{qzD:q5
=5&($L!B$ML7gA
N=^Nn]
o*08Wrl3p0
.Q6;dD3
P)H/bN'
FPt,V-D
v"ag9Tx
tk:;Oo'b<Cm[
;d:to8R
4Dj\nKlr4%
7|clPzIJ17\Qt
$b4".G
YWT@e42cbl/,
NIFJvQ
h[gY|r%h
[RJgf).
@NOK17"UK
>I:ahG]
D6'%ka4l
&kF)aI2
qOv7ka
i['#;
m@kP[m
SVL4E(BsY7_W
Yi'lECS5
23S9$)
Vc'_]e
R ("c/%6
W3rp5>
[EvT[#
Fm@3xAY&_
L^]aaGK
&LC%o~$0*
/oA(`Y,^SSFQ
x+d=k.jE
?rg'O]WKmx}2
oR7qY3@G
OsIdBaw{H&x
3ywB8k
Z0?.{
('&R4D_KTF
PhrX\O5Mh
5!@:1An/&p+}\i}
ldA8<+5~
]O(P{o
BPN3-g<
AGMh]Wa
!Xk'r7++|
s6Lf6rw,
:!3EWi27tF
z?OaOS>m
kG7xQ@F
{y?*|ZSB@)
Pw!GJM
E(9q9!
&G}DiBL
oj\WbrYhzP.
zaApS8R
?,'.O&Q>
QRB72h
tWS]pnp~eK3n<>N
WF\q"g
d~yYc-
,YRC3;57
1@eL`>
5*MQA(${[6
Su1c&rc
n(~[xJJ
w(E8^}\
-tW1IJGgy
B[*f\j4!T)z&I&*
t`[XXN
\S!![[
b7c{i|y
y!%*4^
^SoN1p2uE
&1KVz[X
N:@z+6|_
~][']\ _2
b9VFoB!i
^";;N#x
E)2=ukJ_KefAY+
i-Ww1.n6YKC/*Qs+l^eo&B/_
nY1EZ<
2WyU]3
]>i]Yn^pH(
Bx<Q2Y `y,~$%2;][c
q!'q<J
{/@}5=s3-
K i]FR
mp508ay)
jt J]
sL"NS>P]
nRSJ?7_q7*!
)SX9mt
wh<okM
PJ6:PE
@}N!<SBrv
b:157Z6:49iZ
rT5M#=(
24lKv)r:Ww
}w.<f.
Dm.d*ZearOM|:0
=DfBC1
ad+khJ\
-d]JP`
oBEU2=6@
c$`[Dm
;dM}89A(
L7dnpy
wMp:-Gs
a"yW*{
tf?n|E
MZsd|c
mj9*'f
G,zKx
DtM[LR
Kitqe(
Dn$r_\
ynj:Q
_X<dED
)~'~A"KqJ
c$orI+)q
@1*7x{p
8f(y1e
=r.Bkf\cv
N>WIEShHfY[I
fzf,O^
Dxw/8|d+H 6d/4TM`b7
B6Mo-Y[
ZyrWMre?
Fd3r#"K8-M*
z["nVY
:Pk(q6?
fe$g:Kz`@
0$wd6v9K.~T@#
noRkAnPy#C
bLrQR#d
bvB"0p|
$sj.^5X
Xqm/Us:n
)2$@yyNx
oec$SZv
PORN4{
*lw;"7>
Jk^Hd-
P_}BW[
Wzh+V\adQX
4bvZ`(
|r`-6d
2e60I~
su#;P6oGO5
{=^)cd$C
L,@$iY
zrdUkk.
U7MWRkm-\
w&o&+Ce\3
qN$LgUn
g y&ul3
7.=6Y,D}
6C9MxY
K->SeF*(W=
Cl[n#ytnY]C
aZ^}DC&
G{7_`pm?
^FWn90<5
`Ur8^X]
TT8jJEK
3+LUQob
"Od5E7
(D]s%|
H9uId8
7_!IyK86
;hA;T:u
94h2`6
9a\/o$
z_lM{e
^S`k~jsogR
m/55gZ
7Xo8+Cy
U;d[5)
Gl3I^)4
@)_OMK
xF2uupoV.z|t
Jf'm1rNSBks$[8
?{bH_.02P
!<$2iA._+
'Yqt(6
\kTxe4e(b
iM)s\\
a?j|n<`5j8QJQ:V0{
|9,C-?
OWTM)B
ns|g_e
"xMp8.
~]uqd
lhr(@K
Iz.McYTD
boW2G1
;>~z^2
C*I7rYe
1~/AGt
WiKx:v&7:
=JB>h Eqp
#d&cu
E8,)"@
N[hE@z
ezzq1lN
1d!)w(
ntz<gDF
B@*<):G{(
e+nj4(
(C>O*)R
Q`/gIW]!Ws0
i*HOZV,2:
i(X`3~w8S
R_(`7r#
#lUWKp
@L~n`-6
6hmeRrfzBjg
nwXAbK
Gs[":1
cIfvOp.~
)fMbJuMd
^d;Rp
{yU!>jMz)
MrkGBc
/sNs-n:
M/rmR
\pD?Q
fc%&J"#}8:
,k(Wp]?
S'(%Z,V|Z6b
0(w[t8
%Y\neb;P&,p{a
u9E%UD\K'kh
{d~'m>AAhh
dPJ#4p9M&dPy)^
4%rxXA
>,1pfF
:["Zc
OIl hLJs
Q}ka=
Td!HN
$Z2',9\
3o=x_Cg#
^C0{X]CidQp
"*!31iVrN
jK=y5sxP
WTl9v}qB5L
Tpn#XB
<.,~3>A
+u`@$kc
@ =TkWd
__!qVl
>-FZ#-
r"[YQ_i
e)~h) 9
KH.Ah
"mtcUj
X+[gx*Q=$_zp,
xpRn<V)tjzE1|
1oZ$UrS
X;x~dl
F"MbV%O
2e=R8
vN&'eT
6yV)uz
VRX 1M
^ezkny
'U9f#m
R6D(0HYh#B@$
tk"#&9%})y?Q
2T\YzxPH
[Q1pY "
v1cq;DlMJL>
?<OxST~Ab@
y\2Oi]
qd=4L)
i-<UVo
R*,xxTqiN
)A()Es1
k zQC+
Xi;Nl7N;}+{)
L(8d2?`
Lv[nKd33
iLj9a[
yobgj_,;=<
.G@V-T
?XJwO0=
XL?PV`m+
>AA;J\
hIV:3j
uJj`'3eW7
*}"PPc&F)xW
dSFmK2
4rVH&J4
o5gtNoUB
D/f:Bcf
_'&F>_
"`07X6.
NWzYT.
A/0rf6;=3WBb
MxsHTM$"h-J4
Zs6vWx
+F|?~!
]xpH%"
rz%,+x\wsC\:c
^o<XQV
7/hEz/^z:H
G_!Ivk
LSE'}@'b1\ld
PQX8H$6
m))Z7Yy
-DP{C{(
*VMZR'G $y
:RUCy8
I778%]cS
;<w6Fr<uKn2D7%
|7Br~pSF
n*kucL
qcv}rfY
,11/p?0/4tU<x
u|BmyOP
~XgS\>
;#CU7b
R:5uZZ P.1
?rX;yOy
)&t]dt'.s
3_S8PV
3|2FV]
$:HPJY
(-itez
Utm#nS4
NOm2->=0
@!uI~L
3UO>AB7z(Xh
~E}/@!v
Z/M^zh2aYIYINc8
,0'C[uGP=1
mgr]~I
Q 2Qn8.C%STt
tJIu('3s
jA=Rz+^ o@v
,{]z*)0n$1
XQbr5'
yjqO$
)"3l%lp
!A^=#
Oi[_>,0+4RC
,Pihu'l_
\e}Gs@%GXeN)5b~
1k4[Q.
>r!f8b
`xV39g
5(Ap)+T
*[?f|hS7
roD^?5@=V_
-DO4L7*r
-J=}!L%
eq#r2WGc{
vvw\_6c@|@(
tI?\Wgj
Z/<2_C
<(N|-,+
;B1BIR,
b7>/*4D
f7he"M h
q#Ydcw
75(H+ }
2E"&+IObR'9
YG,b@
$oHB/TH
OB)Kim"9
jn}&o8!q
Lo?R_DL
6Ka:wct_
fx0qq@I
a[\`l@2
a-Zt@0
IVY^o,@<(Vc20}
p`I15{
5w{$ !{w
@Wb%i_g;Xs
4`@S`@
hU^7T^
u*ft4;mU
[kSl|1Uj
5i1"`E6SpJW~m.l&
YwVc7$(
5e59 UI
:?Sc0p`h"a]_<
R0FG_=W*]e
t2ja=R~Z
C}'w4r9
+R8^NU][\
)~ 6gY:Mw/zQ6It9BFji+
M$Ia~_"
3o1|(y
P/P"H;m8
j`C-^$8T
E23Kba+ "k
Rqt1{y
4QfFi'"_io
JBe8?*&X%Mh
6mNb~rt
Dtw*%!}k
xJY+6He.5T
=n]+ -X
y,|S:&F
6+eB/>x
`"UO%z-Ui
o3Leb:7_NFuXf
.leBD]$bed
d[]4bm
.b%S}9
dk(`0Uxm$uD~
%YI}n[7/
mOxWnB%d$,
C-zri$y
Vl`X'Q1
Pk"*yFEr
A6>1&v
NCi!WIQ*
'IO}^F2s
L>7 \jO?
fVB{r}D
ZbV)b-
4ViOysv#
TkN9~(UR
X?Y!(
?u(gD2Dn"Tr
M_3~c(
H5/5IA
,,`]6lRD~
>?8c o
#R':i=
>J"mAv
v9uR@eZNR
i.o u=HT,\3[
UI`6Ci,
'coP47F
Hbg!,n
QY=*HZ^Q
fb{ih4S
jngNow29[0
^%n(,Q
[3G3xto
/2ONXn
mPCh[~Ko
.{Lm^b
dLUcF/=eD^na
KT6j\Vm6dSo
J |3(\-..8x
5OzwYN2+
0bb$R#
|%#fq0=
#"]96D
LbAe"7
ca9vY*}s
Wb*s&ay
omE`dCpP
EI_+jU2n
N"xyXX
%R^`2e|M
|d,sStGZ
<$Lu`6+K<.A
'AF:8$j
@7ue6fo$
Ki,WkdwOL5
>h0Gvx
w^B7/.Lt
CUF`dQRZ+b*
'5hq_g
K+JQ;rE6u
$Kv)P/s
ZhDyB<lj5
=%T'431
f("awQa
Vv_lZ[/9(
./y=G"
>+0s<\Ss
qF$vl_
L:w$i&k}lZ:
2uD0cG
0mC,Z8
fE8hf4
H<sV]5a
Xt{W!'7s
Iv8?@Sf#`3
W2<&U
Fj!(K}^
zGIY),A
X7WKPh}L/;
.2weXT6!Tj
vOI@)>
gr9?l@1+R,iD'
^j3y*h{
QUaM6U:p{
vxbjCOQd'JC
.+lSu\KtbQ
/ei:^t
`P|w=G@d&
&J!vAQe
!oW7A6
F;?/T*7%
A~y\H?mQ=:|
,@?o.F
x=_uTX
y{\mZ$`lSCe
j,zzc\H
.U}[~j[V
J^ce!\x7
B]kZyO$-S
f{6Vw(Jb
uoe"4Y
UpG=2nCns4
ihmx3.=DU/g~~)B2 g
<VYsW{`pqy@
:'+6~,d
5?/[-I.}Ns'
**JK)=#ua;b_o
H*t5cya
TgHhq(
uF^Za;
..uJK+
"Do#yG
!q>#=!
h*8) Q
loBJqQ
RtS(3=Qa4S
Fhl(N@
4@3&Ulu\
6U_lm+~/DN
''cx|l[
po9Fi|$
g6(kHBMf
HhAtBSVN+
|8Sv='
J?~.?OayPKDAU_
j5;8SKlXF@L
9bipbBp&N
4Fjd;PO~F
[A~9FG-n.
#go4LZ^[2"sN!^sja
Y_5XV1
vF5|<f;;<_
<SIlN_
OOBe1
JdP|vR
^>D34vyC
eoGtee J6:oU](
Pwk4Uza
N050*Ne$EJ&A%
ld~cJY(o
: m,FBj
KWj>H|
^4E5fe8H@22
jLan'"5Nx}Q
$dieMGr1{R6V
nOH-my
mh`1 u!l%DmU?85xh
\emv,q
K6U +\1a[U
/PPr&H
Um%Mmw
5/XyHx7\
BvGlY2?zj45Xq7
"<V7jh%R;A
g!fEOJ_w$
a39w*1%
5S?9zH"&
}p|po)lTT?"
g$Dx*3
v\?xsLb
P]W,q9Hh7[
12xm3@
{qfJ_|.
U?K3q>
~nlskYI,a8 '
<2InzvY
1d]Q<!n
XvXWTPL
7c(9L~edKv
yrvxG`VX.Q|
7K16&6H
O1BAI z
[1t0r,yt{
39q@OY
|eyk)Z
<Tbcy598pTU
Vq%>W
9(8[Y24Xm
lco"9'
'L.LnVh
T%%xcY7s*=N
C5*6%S4.
9=r,YtB
=~s%K
nW}f=r#r
8=;<#G$K~XBC
12U")0l0_NBA
qj?ep}
NagKAg
"2,Nekr
PP![=w}'MJCF
MY1M>k
hP)\n}s_ja~jSNHq[Z[;p?
c!muUV'E
5#hFn:>t
+5i,y>|R/?~
ooXl1+
S?e-~+
DrE/:aEB'qRcE
Xw77?F]5-dVe].
x$4$X6r/<b
3(,Q"1GQ1
H]R23\
2|o=6C
Z_IL!=P< y
f TS,G
$@im<OOga%T
| paJ+
;/ri`s<VUR
.x8?>7
{[u9<j
1Q8| DwwRU
,{do`n{ZC=
Y;|R(L
;y$g#>Xq_
z ()ki3
!;S&e0mR}M
~xsO8.0.
j02l0f
9m[H>IC 
|[*9.;
3iC9iDK|
}Y1Q{/=%e1
"j?*PC
6fct#-$^;'m.
06eRKpX
E!Jl[uu
"ltWMb_Tm
uhvyH{Od<_P
w(iKyhidOR E4T4\O
n p.zo
l*2?d/Fcj
7w1^.{)
D>1tyL
o\#0TB`
ub`cg:02{k
OkcK^cE[Mr?d"
5u,9@x%eh
[5Mv%I}~ks
G["`8s
#m):&O,
<gOAsaqI%w
'mdTFs
xZj(UI~$7
NlJT/)I
To8]M
C}8NR_GA.|
.[4l{a
%f:~A2v
-44?OSJl
DNZ$Ul]D
FNTavY6
9?@rFso
v`,iR0Pg!
d_-u%c
^m Lh\
>D9];gR}MfwK12
+Xt5h-b:V
D<a9iQn
a}YT`&f^
YD+gff
s&]!1>*$]T%Ebi
ts4Mm0<]
~aNmKNW$W
zY*H'Y
f9l`,\C"RaJ
WEJI^LRc=e (P
f!]h Y
1gD.}]d
<oIeimLJ
.!,9fKi0uR
}8^10h
fKwT\"
H &)ye
=e>p{%
w +3BK|
*;O}Q_J?iA|
Z3T;DZ.;
d0N#e]()
uZ|,AM]Xy
Bi|adK
x(>io;
WLT;.17
MrNnWU
iN) g`Bm~u
1-LJKK
BQU|"jp
}-'zHk
\z?pm+&
%d3C40
`~ls_U +
JGxwVc
4[WD^Ip
=#q%'B*AC
&[Q*j\7
:Djfw=j3
Qt5FH3
y.#/?
lRX<KR
XOQ+;vUNn
f#0`u\/
D,*,jaKCA
y#Ll!jEoJhd|
vgF6uw
+Vel75B*{:uDR{
+&{8}n
\Q)_"(
VuI3)"YS
Ul[v*[
W'%@'xG0&$
/xx{\?/
t`"Hk
@f?3Z^q=\Ww
k&EVEe
.v4<4b2
\dgr*j
T:z^'kz<aq
|\t'72@@
~q%Tp(Ee}0O0)#.
u$py8pQ
sS5e;(
+o$eyVN&
LF&Qs*Z
U;iE>IC
.'!t3|G
7l0t7/dm
_8vnf!*oq/<
lr0T1An
DOkeO.
oh$YNH[
GtPynwZ
#12BnVJdO
X&,53y+3iJ
5Z."pxGv&-+
<92f`'5vVeQ`p(
sVW`xm#_
#h>Us?
U@ZJx;
vdiAeKUMba`r
9J_wT7h
a;n+R(]
|`Ln[,
p?FX(n{
EjVf#v9
t<>xPg
+v3z8P]
8|YTgP
)EYWog$
ybg~boM>Z
2HO"!n
96wH8Uy
EH~1.
:5t.JUgz
Ox8LTXYlws
6'gM_@x5
U2Ta2xP
7O(62X\
2CfF,kPBx$k
=TX|w2-
k!7qJ4
;HqVcCw
uYU[A
^q6\DU
tN4:Y%
}l9'[h
>Jtx,|
$<TLVX'
}$b"<m
U3\~Q.`
EWJR6P
kW8ThrW
WsmIN+Vkku+`i^`e~K(
D&BgWQ
w.yPQ0PQ
Dz?[+%
wn?$6u
{G\u1Nw
&PZ~{}AJ]
{bIB~h
{onL$dZYC
3y!&Hh8
IG^\t.
Yh[>x[M
XC<f.JN
v`w<ST%n
O&HJ4v
"n9&1LomFA
lZ-`=v
o'EA.J~i
=[Q$S6
ZTOsfK
M_$pkgk
vnV~cx1fP
*P5p*G
;F$'AI^>!4:
g\4rz]
qG;dGV
}0?CuNk\
,LqZ@
ILws&!$u
7%w1+x
+@P3'|
KbhMr[
-Sk64n
H"l1PfE&
6<s5y{2
&$4C:w
dKKU2u:9B1
M$d@IrWs
}a[qX9
X&q*$_%f;E[gK@i[
d)voZI^3DSU
QuS4d@~%
bmmhc\)i WaLB
h(R@!3
oM3N1/a`
gx![F.
y%tO%mCqq\
.V=Ss
*2,3e1Z1%
CtX;_Z
&9f?a>S{`
yB:v5T
I};<Q/3
?/JHj>1<n
#9x72ak=QmWT
u+Ek_qYYTTz~
o_H\0C
vIj_{{
drqse>
mEtzyV
~"W%IH'x
=AOvWW6I)eF
9K}53/5JG[
h@Be=:LYA^FX:
)!;'Tp2
p[K&G,
Mqwip(
6B^9qm; w
4sZ"Y>
,,6\6sg
B;p0^o
z6g%*Ov
{NT'oN
;c48sH9
eEn17np
J`7j%`
/{`eM6
CKPp./
d&qN2`
0e`Cj=;
)L+!T69
",6TP9eTB
@Q)8"
r`}UXn0n
w!(,y1z
*r.AP"
M,$f &
FoQ]0HP
BPlu/DZ
o18,<g({I
j0'"Fs9D
@S21o0
/")bW"
~|9{p]M
"V#!a!
uHdn:[
*y,X}ibn
,\ZOYPp7
T3{&+v
Rx%]IW
FOTa? o
p3kiP`'k/r
4qu,Ey
y26*>_
YV#$t#
4)G-8%rXy#Tix1'6zN
W{NS95(?4Q0g
KK!sLD"}
eO*Uq4
PF&Q>c
#PC$-i8!
GVw-lu+7/SU9n3jUF
8/?jip$4
<\.uQwz$
bnj?J5 /0G
3kfn``|$aGu
:V`l?i
8M`&PX
CCd-Wm"
kn9)I)
m0pj r
RtRIN7tH
l+P*|6\
o!UKL=JP
U!Wny+q6VF$`r=F
E<^Y"sC
T{)[)%:`_
m~RfaNO4#Suotl
"#:c1Z3d'
k)i/YB
N1;~'+c-; 8d
s<MY:K^
)m[T?I_L-J
0g*n`4X
wKL?Oi
eX>)N1KW
!#k5)huE*^qX
xv6{aG^-r
mZ"vjbJC
mJ0c:E$
F-AfTe
$pF}3Y
TlFBl7tz
9u9<%5gb$W%6I~w"eZmYJ7{
Zu[:6i
=f!\6=
j4bRd4RYGkAV'sle
|KYN"y.
TY<A@%(l
mC}D\a
{#l5cF,<P
J8uuR?p
%n,TqEz^
ooA,L
Fcp7TW54z^,@XS
7e})3(JSY!
mq}-vH
,jg;M(|ye
-b*y35
EzI,6-
.UL}co>Yw-t"S
*r1b<!q
+Eft^g
ob(M4:
k OGw4<
1j\;Wk3eVzx0An<U
e@pUXH5<!
LJ&t&F]x8=
iUAuEANDM
]h_@:x-nX4Yf!H
3!&Z(3H
5L*7i5y
'8O@D{
[W$W1d=%[
<a}k'.H
[1xdGbK
"2,5o-Q
Wu[yb$C8; p,
f>}EwfC
9@^dF*
+D6D,'
t8L.PB
Gh&!X8
wc`K*I4
fCH'V#z
b?i[ 1N
d+g{lIXJ~5HmJ`$
1JK`]w$
RL[, !HuA+.[B9y
Z0_GY4
H 0??GAT6:v*Sb%
toMcdD
lEh].?S&1;
[!mU0L`<E
!p #D`
'AAy/Q
5|+<vKwub
ka&s{!+F9Uq
y%T_~1
"WWK[G$o6Tuj|=
TOK{\-
/'JyMM
!KSgnQ
(j%T8
P6tD0PB
_</~zV$S<,wGz:~a
Q]11J[ougH#0huf
BBvG'Sib,s#
QVB9tC[
L0{rNm{Xn/d*eF
0j{bZ;
}D!@",
t[naV;M0g6g
Ev.zJpk
~I}K['{C
~2Go,R
(=XWKl
FF]w'F-0*`Z
8&Z&{4@D
;i7/xw
2MD#)G{
fi'2eB
7rZ*&s~O
U2&NsN
reIE ii
>b=C4*
)8npx.h3>!
{O'g4bo`VLa)70
OTVa'2%`6#0
]OS#/wSIxE
[t+f]1wsF<;:NVH
[E`;sT`rI=v
BJI;`PG
}pe"wR
k8 0_'KPH2
w6n^Z.'
nn~^~|
kh7ih7ih
o7NeRqXxR|:JM
s5[4eD}
CmIr?YQZ3XPd ZX
*v%m[(s
S83wR>i%}
<mGZ_b
2m :mc+\R\+)m
QM+5+6MN?6
6r VKrK
X $Z-8$&
XutRaXBT
t2AX9k1X|taX
w:twU<U<
w=w~==
\?UA\/Qy
e}b\|\^
h-kBj7Q,S
Q@\X]^ZuWoWkWmX
&.@&9.1
,&8sRf
QTwQT>
a41W'm`
y)RloOOU
n}(}{two
!f*?wbG
G4we)d
_'nRHV4
jV~RO_CK0|
hR`k'p'
](4,9GX
cb&c*&c
.GvM/GVaM
BF61Mxq
M(uqEa
FVSQM
EAE1HvG
SH6rCHrT
6qswwrwo
&qsws|
up6|_!
o?2?tO
|f}f}g
taWBB<ii
ipi.PaE
sRhuBuzT
"e/t]4uU
uM^uE;u=s5s
NFh>G"
p&h`XP2
yhxGry"jy
ttsYs6sz
AzsxWs
zPsWHs@s
8s0s(s
srrr>`W><f.
aw_fM;
IA6>229
nx_DeZ\
oo,]!]
^^babU0
Mu;^Pk
kZuPxr]
7 g7 ZwX
"1^))`/
j]P]F
g\z`Z^Xv
pX^kX}_cXVtxZ
t+X^#q
U`V^ptW3q
XqFTYqW8>mggg
{\[tryovV
vqujoTjrX
!&vh\1
WSXR[lrlq
SXlUJYmVCYbS<ZZq8p:l>m0k
MUNT=TRpVbcc,
8W?V.U
n2^K^Z.\.P
g"$n/y
'^(xPH@}8
*C};YmYmY]YY
Y YX59Y
{5K-K7
F:G:G:G:E@
g;>hY?`Y?XY?P
HW@W8"J0@(? ?
HepLLL
YUYUMUPUoNUoNUkFU(>9
/2bMlUH4RUH4ZUUTTe
sP2:T1fN2fN)N!N)N!N)Nk
c=X5X=X
$FF2$FFY+q$7~`>B\:>q
t16{@> $
ODh/`iXYPtdHrb@xQ8
W[2N<6JNM
d9hJMMM1NoMMMyMLQ
QM-RM-:MhoMyYRMkNM5V5UoTmTU%G&I#"` Z(ZXBi
}$6 ZY><
n8@IiD
*X\PKH
28-0y9(2 >
_0J0<JN
J{_]JLJJ?c
9JE/0JB+;J82Jv4
JIIIsIj
%?Fctn6
~\LFH8vQ|rNrMiZPO
8@I;ww%e%e
`fXAPhSH~M@b8d0e(
KKu999G
H&F)aF
<VFRVFNBF5d0FA);FL62Fx3
F|= F>\ FKgE
FP>E5EF5EQEK%FC%F~
FF5EHzK^
PVGSoLWzKXtRl_QObNTEaId%28zScfNcfNSfNSfN
X0P0HY@P
8p[0j)(l/
0ZBo0RB|Z2BX,B`$B.NB4PB-ACBAA
:A1=A,:A!8!9,>(DWn.d
7KLD`}U\_$Y.c8+? :
bi2y7v2
l@[8d'0`+(. c6
>>2?'D9?,?/?w1?
!?J$?I'?K>sp
#{o=g=*^>~\ >+Y>2=X>lx1KE,B
e'bNdPf@
%GFbw55$
~`|BztK
^6=`9X&
S8;>?;>?;m
;Q.:M*:I&:%b:!^:
W:6S:*O:N{:Di:l
)]*B)1c&>!M
IY%gU!CQ
4J48F0LB,@>(Dz?-s
^EndmB~l^hl
@z>>QBIMQUYZ[Q
c6.37GD7
7Z6\6Z6V6Z6]U6NR6QX6K\6V]6P!6#%6k6
0h1r1]2N+^,Z-.&7
8"9mZ>(Kc,L',^d.+`.
>B#PHvr}
T $)A(
(3=s\J
7*5A<#*
(,KC,q+
+'/+(|1+** +
<.8K#!h>MZYB55uun/:
P?j0T(kT 4
N'\h;`
=\C\xs\ps\h
`-('~'#/o
/'14'0
~')&~'4.3.|)y+
$q$ExVd8:3
iwR\R\B\xB\pkbh]`xaXzP
`02\(2\
$)%~$: y$<#p$=NX$NS$LZ$qQR$rV5$s;5$e84$f=7$@#*#W
$W#W#a# _#Q#j
'E|nKKKKW.]$(*@*;=+BH,K,
6-q1-xT.
%\GG%s!
x"p#hD`MXxOP~MHR@78409(f r
~MM;N 3N ;N
6 (! W W W a .
~lKO K? K? K
?%8GAO
AFz8*0**XBCY%K
<<<<Yf
|2: ***.
`e((5U~
{^nfks-U%U=U`rx'
,4,,X,$#
lO|~~~1~N.^^kr
-C?^f^
nn^^.'
4p^xCxCxxCpxChC`oeX`P
&p$V*\(f
nIJd`pj
`>B]soBU&
h4AmD\i.h.`.XSPdH$
840,(t 1
MMMx;p
'X1P5H0@D8H0<(E Y
7==bFw~h9P+`+`+
6>442:0nl
2,fEkGQI
h2i2iLS2"#
h/=kCAHN
gd/nn^^nn^^..
jNpHfR;
ExUpfhg`XXPPYHQ@Q8O0M(
&;!kA?HM~\NC68BODB?Q<Q>g\@MR=HE3BG1<Q
#^||tt!
UHN@H8J0T(V jQ
ox>eptdh{a`
c\QZ1h
. (m.s,y2w0U64Y:'J;8IO
np;eh{Y`
P"H+@08e0{(p Y
\?UEWCDU
``\a[]\
ws_}MpJ^LTNZPXRPZD^IaLfd]K)
XNtpVd^{bwwjRWP]N[Da_e
jF"gH$1<05RNug
2C6C33}#}X
2^^zsvxRMx@pBhL`GX
H?@A8;06(
Y;UHfF
]6H1-O+AFGh
oakmG9C
-X<PKHr@
?:L=8A3f
@[^80( ]
Mvy\]c4+]oxseGQ
.7DirW
PPNUSP=b)0&e$2nX.%a#gSqHf6G+D5\
vh[:Cx,ph
`X%PKUL
//A\Xg
[l=>((
VzPuJutT_N)N"9$1
8>+^7HfH^
FEEEEKdHrBZPN
%47afo'
GxQp;h|`~XPH
('H?@G\
H]j>I#JE,IJ{1}P
>!;DHCHI;xJw;
P4;3B-D+*p"1:
nn^*B2
%HE#BEH&%Hx&%H7?%I*B*B+Cb[25nh
UM;HH4
MIJQQ@
VYZ75rT
wY/sr
LqLT}w
VSOsROwY
>~~>^>^
4Wy<Y|GS{
O{~`{~`P}Qb_]f_a
Vq)k-m0|vMx7r9:C<D
~3:*.=@ar
j2IhIh!
_T$^7$<Z
Q:eHcr}H6
\4X}H\
lA*`QAd
a~'+|Z
Qejxx^$yqz_
Y;w5,
afPHjc~x\x}sd
;<P`5}`
aJhA1`
Jqd`U?3v
brm t0[m
gqq"=`
WN?hgwd<ae
afZNQ]
Zdf]SbZ
0z8z0q\
zy.y9y
q49NyYy9
qJ1s>1srNvYJ
b:1s1sv9J
4B1suy
Us%Low
r6 <pv
wZ1Z;1R8Q<
Zw1:t1a
.r}-sm-
-s~M-sv-s^
V-s>-s6-s>-s
^-s_-pu
<U;5;w
vnE;E;U;p
owu5wnw4
op%54nw5
"|R|R|
|<bw,bw
fs6sFuvvfsvs
n,vGo^RfTmHP<70$
n&N,gVGH>$F
lg/HK%
v0oOPg
WSmOiKG#}9v%j!^sMRoIF9-
Kvx;tHtIw
sXsHvIv
#,/IV*5$?
ooy%"GO
y<oZore8wJoZo2eX+y
N0( e"
uAhWNq$
e(}@y(u
"WWWWm
djWxrWpjWhRW`
yXPH@lx8rW0jW(
9oL888
L"gA`{`sp[Fe
`H`@l+F
L1eD)ev
u-b*b"R*R"
"YA-q.p
nY^c^anTn:^
(&I^C;
0M.X.N%P
24 gRy(T
jX_b_Zc>
%<Ic_>.
f(U$CG
pcYrnj
:w[#U'e'(
b8DI#)6T&T_
u"^db9Q4
~XeP[H[@V
wGDNeUQa
_Z_2iLk
%HK7L?
}FL D(Z
%O<INJtym
i_U;Q%E
Ixxp(+0+ +
iHIOYbdL@&
XJrPHn@n8t]0'X
l{dsl{f
@^@^krdSl;d3
%G<Iib
}=h6s6s}
sIrnR=9
CIt9I
1Kiwiiiiii%@D>O
%@KzM}y}Y}
}}}}}}}[}9W},B}Q
%GHr<Fp
rikcUO@LHD@ID9G2>D13I,(F(DB
)`CXFPbHN
hiiiiiiiii%C>D
wMkFbZ
%De`y`
zR]yly`y\yUyM
ySyYySyDy
1R[h\Wuy
H?I,}z
hiYiviiiiiii
CNJRvBv;i/xu}vyvuv{nvjvfevTWv/9vvuc
SuzuzuZ
SO.n2r
]!aUYMAX5L9P
9J4OXk
!qyp*5
62jEGa
>JxNp9Qh&Q`
EH'A@8|0Q
iWiiiiiii
54Pnrcr:
BhrhN`r^Jsr}VZr|RUr^Tr]]r\$r'VPr=yf
!I$]e<H
7EahBlb>l}:k~5n@1mD+mSmInCmNnknmxw$jl
ONh}Yp%"
3YYYYYA5K
D(E7>LHTO[Wcxgpcho`Vr]KPOH\@^8Z0#f(
I!+F#7eB/p*n"nEn=n.njnzOn@[nVW
nDc~nlynhpntcnN?mFn
D.`i1-
2 !C$B.g1
YYYYYYYY
^^nn^^
>NYVG5"
YYYYYYYwYx
ZY\YDYYYzYYYYYYYYuYTY2
g\fGf^f
"TP,G-zl*
UWrWn"%
a_xOpOh?`?XP
YYkYYYYYYYYYY.1QN
cWcWcwclcpcqcuco}cl|cllcZ^cE#cYb
K<KUlFe"d#j*jehgcag!Sj0Ld
{x#oKPd5beXs5Z5bJE
er:=!.b.
Kk9iYa`^xHpGhF`MXTPGH^@q8h0Ll(
_N_H&`[z
_K__AK__AKO_1KO_Tn
*VmkY_dXNIXA:SHLRbIRU:UdUfxTizoS
ll">3@uW!O)
giiiiii#A
?JY\?JQ\/J9\Sn
\ua[sd[RG[QJ[HM[nO[]R[l5[j8[i;[[[03[
[[[&$[h
[NZ[NR[N:[N2[N:[6:[
O3p3h3`3=N$W
SpW{XRMEMwNvN
*Z`uuo QtzDzY}`jeuua\n.n^^ggg!A
8@0?(
XloXloXl_Xl_X-W*
7Wf(W36WWXW`W`|W
UTYES~MxMsLjLgfH
dcWeho
07,T\e{
ph~z`wOXwOPwOHN@q8
>f`gggggggA
U36UGTUT]|T`}T[mT]lT^]T`[TZYT\OT{V5TuX3Tp!T=
TS@!T@
T@S@S@SSH&T
WSVS6S
xGbxGbXFbXFbXFbAI
#6@]9K2QXFcW8]V*iYrfY-jY-lX5aO8M
+~+/W:VxBWpdh8`9X-P*H.@18-0i^(}m ]
444L#Q
WP5Q\5PT5P|6Pt6PjP%Z
#|2Oe%P}J,PA P2
PQ\ODWOOPO
xHSHRUxUaHTiL_F^"ng
&c9e+/gzQn
sLmSD]S]S~T\'
@Amw+ 0
WWWWWWWWWW%A
M<LTPL:NLHeL.LQ2Lr3LbGLLL@LALL'<L
cL6L8L:YLELLAK?}K6lLlQLlYLlQLl9Ll1Ll9Ll1L
CEcATsJTsBTW[T[^U^TnT
Gww:s.v>y'N
n^^nn^^WWW!A
3x5p>h@`:XlP
F|BHT5H|6Ht6zH1vHa
\Hb]H]hH
]*(y6z?=G
S0N3<P-:781E:5G43>!8'=B-?<+IV
\Et[nc
Ap7h=`CXIP?HE@80(g X
XWWWWWWWWWWWWWWWA
6uE+uE\vEZ`E[oEhbE--E+/E4VE:@EHJEKDAD7D<>EBD0E%E*EEy
E^DPDRD%E
<9D\O,fL
@LYLh]Ke"
61{8+ER
bhIe`k
dvsywmkZa.
xwp/h;_`6bXc'Pp,Hi5@:8A0(
ZATAVAXA&A
AD`@"*@
y12y9%p<RU
WQ)D@&CE
ypf$b$bNcM
c((''''''''''''''Ap
>TQ=\Q=He=!,=
/=!>a|
>K=&C= ==*?=$A=&C@=(EF=3=
=.=<'='=<<P<N<@<B<
//WUrGYtQ`yK
B`!]n/n^^nn^^..
d2FFFF!8Ba
Jk9Di9Fg9He9
#RM9=y9=q9=Y9=Q9^89C9ys8
x<r2m-X4R*T0W+!(
JYH<?SMmep
JA!tdd4
Ztv|~u?!m[PpVHX@R8U0P(dB l
b))))))))))))]A
@c6@[6%f62
5^-6616=.66563065
6-5'5)5"5B_5<a5/Z51\5
Q5.K51L5+F5%H5(EF5;~=5
'[OlG3_2He
7#6*F0}R0H5)!d*1`
Oh9/`:\
X>XPYH
b@o85k0i(n p
zELPZRTSR
)D2$F2'A2)CG2D~:2n
iH1!1G&1
h1g1g1
1//x"q"g!j,c,m&$tRrIL>q@O
~vToc,z{
cxPZTjBSTJ{\ZWRYOxp<,L
>8f@),BY.*/?.A.J.dG
.^I.VR.O.tU.vRz.ySr.tIz.eLs.kL[.lKh.cL`.eKS._I;.xT2.[S:.]Q5.O
-?Q-$C5
d4b4Z32~2Oc1=P1
>9v|#c
]B:sG;Q=BF
GANPLVxWpTh
Pt)Hf#@n/8r'0(O L
+WT*P"**
*zw_*XGY*XG1*WH)*QJ *B=
b4Z3.~\.O
J-=W-:T(C''24i2:g12s,rP
AR>.C-P8-Y(^(O',2-2IrX
r407(:.
J#$Z&<
mKfwXwPiH
QjN'QjN'@j>'Tq'B;0'd?
'W&zX&KJ&=O&6P&?%&'&(&4
&6&.3&w&
i?X@ku&PA&yyR&
Pk?LdjE
EGBDOG_GBHoEoE^FR^$4;
FVVo_o_V/&V/F&
h:VOK)
u5s0lLjgL^2))
Mti}hdI>qdf)
djsKO]l$smNj=xmnrZh{O`sPhcNjox,cP5aP)v
OhfroVKsjiAO<"o
N9orqoIgf
uO5sddmq,mamoa
^Zs^1
dLnDD<tpi|dId|<Hf^
7k4d0Q4]4V
VWC-LB9DC 5W1
3C-B9C W1
CMBECVW4CMBECT
2^01s0,~0
-/1+`1
23#23-23-$4-648E48W48l48z4G8484M84?8
75k+V6
.7_95888
#wUXwmW
S2;p3Q2f3`:
8,8VcA87[*8
S"8L8=8L<8U,<9
515o6wx6Ca6QX6/6
}7\_p7
8;z27<!2U<
2p<%2{<1<1<1<:3<43
8=7x>6>6>6
?5+?6m?5?+6?-
.W0+1+G2*2G*2j*2AS4I^@
PqXQP7%
~1?nKn
8V<w?m|
:_:_:O|;bN`;->F;E>
T/T/i[30T
15050;40I4b1 1
1-;-h.
?4=25=T5=5>5>
6x26/6&1L7I1|707)8l)8f)8x)8
9+!9y+59+C9+\9f+9
<5E<(V<
{stkAkb
xC'p3Lh
<6s=<=
/H3@383q7u47I4
P4Iw5B
2;}3<g8=8d,f9-
):R):R):
;);n~
<(S<J2{<1<1<1
=J3#=2c=2."
12&3222
;CKtSt[tctkT
(D0L0L
]RyQY.cyq0
wEy;k3
LwMDwE
DwE-g:$Q7
"C5;5S5
,0?C4;43Rw#y>
33RwJO:PzB3
3S5uce
4UTJ:L
bC4;4S4
TBC4;4S4
NRPsTE
jPM3P*K
`BD?D)
jTDBPM
OUcOaC
K6<DwM-V<U
UMEG46T
AsDEPNOlBQQ
MTlB+>4
@S2S9M=
HVW]2Q,?
MTMsMDWL6~
KEUDL;sO
ReadFile
CreateFileA
GetSystemDirectoryA
lstrcatA
VirtualAlloc
KERNEL32.dll
LoadIconA
RegisterClassExA
RegisterClassExW
USER32.dll
RegOpenKeyA
ADVAPI32.dll
_XcptFilter
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_c_exit
_cexit
_controlfp
_except_handler3
_initterm
_wcsicmp
mbstowcs
wcslen
wcsstr
msvcrt.dll
FFFTWARE\FFasses
yysid\{0afaced1-e828-11d1-9187-b532f1e9575d}\inprocserver32
\55222
121212+22p
??W??H??1?
00D0j00
001$2x3
33T323w364W45
5j565G5]535z5454545{6
66#66166O66g66{6
76&76)76:765N75e75{7
67575757575757575
8x8*898\8e8l8
9888888
9o719N7H9
A&b-b3
7??93K{\
R|2KeUx
5]=o#`k>
]k)KZs
=A4]!p
dqWX>g
7OO.[n)B
-MGjrpe=
&l;e>%MK
B/#>j!D("ZIP.Y@PD0o@M
MhK/d4
21a"+
kW>VoT}J(
`2fKST
'F)MX}IW
)XAGaS
(xtXt}s%j
>:*uw5>
:1fcq!
oL7FD|
:IOr2JF^hEe(S
)h;GZU;
i}Z.@*:8m(ai
[ \4AkTcqJ
_jf5j3HQ
0\kj)S
]yv9Hnmj
)XdAB3
=P lIA(
Y5v.#l
~;.zM6
I/1[^7;3,a
3J<Jen
t8k9$s{
p\CzRsgs
,cfopF?m
<W*.JKn'5P
\|x'L$f
EYeks1.-kG=g8
zAfF5-XY&B
_,9O,'
-mX09E)
gU3<+(v[
?]{}SGAq
9>6ZwL
9ndguUu C
_=xQ:[lH
wsTo}%\
dSDc+pwN5<XP
IDIAWh"
#RKiDx
~H[?K]
?~wI\A9Fd~=u%HiF
{pHcDr+
?Q/[Ml~t>
"8y^V8
V~.teyT
_!9dUD]UU&Jzi
zir3)>
}8@ZJpu
?Gl&SV
N)Lr(\
B@" nGe1J
*>ib<j
sd7;;!i
Y6h_B2U%|
?a"WUt`(A`"Z
oM\-Y} L
tv2=CA0+
*@r|'8j
m99612fl@
7>UG;m
^N[JZp.
L+}/ NoTzy'
!LOZVtd
.GbX`/S
t:A]Bd3'4$
Yyw3p`
ABPBpMww
:eqk$q
eHC4<E
MB:4)<.%]\d
Q|RJz\E
fT2C\#Wi_?r@ ?
<ykF]_*h
?+>`?Ju
aed?ag
~oJY?:
eXL,V"
~vy{8B
qE82q|W-ff
4pM <,1
cqv9N9tdA
_i;d^fXt
E7LSR$
r:"9/a&~ <m~*c2[,(Y'
0z,!ax2
.MZ:z<
!2Sh)+K
W*v=eUM
t'b|l%_w
JFziH!VU{
.1^`SxfW
5(?+mr?
AeKv$N
<M4wy<\&N7mo[7Zf*A@r&iFc
2]"J!"Wq-
xF81iT>PpI2
/paY=4k
{)4QE,Y#
(dxt6TZJ
0m+lE^I
v&*Q84j
tal+XjKB
8C7"zA\g^?
q7]4y<
TD2tq+?
LPP(PT`Tt5u[(_mBLL/
]J5^H#Ae9^Ce
h&fAaY
8jP+x*7x
x7Ys`k nzql
VQo"*}n?&q[q7@B
L3snBN
:,q}+V
?().9;z3
O6S\X|UB."
0_<UqN
ENJ\jRYf:78
m;vT#o^
uAQ/\4\
AyB-_vy>q
ru>1Ac|
U_6i9M3%
$hCntI
F"Vu-k
Vn/Ep*
5'>,6,
qxpJ\BB
@6c~jn2
^2mPX9{|
o 0BfE&:|M
RX@g~8,_#,)j1L
DD#ckM
g!h;Kk
ba AvO6J.
~z_tWS
tClz65w
\-5Kf>3
e?TXDEB~y*,Ti
)<h_c63-%a
9kEMa2bbQeB
467Z2W:
QD0B9a6p1_
)4ne(1 3R
i_90oWN
yJo^e/
Ua1>(OI8
/&SgV"
Uf"{N;
;V~9[B%;g,:r
j35@`Vi
0p^nmC
Wzih+R
UW?W;QA
sVmItLF;-
YzO;tW
MLXJ!vB
|-Y^JA
*@{gla
pBdZrk
$S>,Eoo[ul8K>N
Q:psWO/~
ogj5#0}Vq
yXwjf{
)In/;e]k
@j+|+~8=
c]zZH63
k6(c-LZDjB)k
O)qd92
O5wgl`92%A
1}ceF2lI
x~Qs9G1X
N{7d8;U/:iN^a
%F[YR#'
4-0!F+)@[p
7{[EX)
+ow 32h:[dz3
\$Hcv\
6wMCvgU?
*u46W*|R!4
bk; ]l?C
595AZf
=9n-v,
)AQD&fk};
$Ax8q~xoI
ro`vl]|M<j8
s^D|"BfN?d
&juzuP
i<lc%9
vP)Xbe%'cGiQ"
-6Y&YJ/[>
&N(7V6UEm/P
^$h~`kGs
.+RT56%tqey%`yUB56b
@c<9)s#P
/bsF8#
y*/XL<gk
?EZL<|
NE}jpq~yS.*
+lQ'}'UDOX
)E}pk=<
;D6*pK,.
Tl#gb(2c
%U'Q:hR
C=<*LJ
TAupDw
:XI<|Aj
Bl%RT3U4
NK]!-A
{=DyFIi}3i}
iF|)s{Bp
Ud$gwZ
=N<^@\0
9uEG#.
RH!oi
PPu`Zi
(?&S{K}m
!Y(EIf
5dn~h;
tgt,go?
=LWNC!l
?Fx9M]r
M\:OM'C%6
|hvx=RN
GtSJ #f#VDOC6
%lcsGw`\{y{
IBV/a`olW
&v~.W:`
=04;kbm+Sn]
2#Ia_n
tiA#n{b
cH\9}GD
!sT8q'c+
dsC02Gw\KU
C.)p?$E
:Xmz%KDB-
gj'j2.8(i
AF_NN{)~
'lX$D\cb
zx=Xa>W
.~ib&T
]wK08k@t<_f
xR/Z w
H34Rr$1
9Y:hR&'i2
1=sH<W.
CdQ8PIFKD
nkh/4ym
't$e`w26i
n?~*%g2J0l
/(;f}[
b4Q]+ `
tF{_6I
hz?K5^D.
g576}1
SJ{Mz>
Icu#$5
Sn&T 3 )lbuNPFHZxUYz%#kB
Lv\M^~
1u-1PPN
6y(.N^ys[7
|&D2]So
E|)Y"RWtsIz&
aART*qQe{/4
n)S)V$3
2ebjKU
.+9_u`m
$1Q$r}X'*
CG<P{=5z
)UDaV[-zegl"g0D%a }^?z~
9Fn9J,
E$hi`AXt>dy
fF{'<G`!x>L
y-'%0N
XN.T63E
3pI,I!O=Z%v)_
:t#P #-i
gsx/qg
[KI.&
%WkE^1/im(uf
el3-%^<
'+Z]+P)A0vN
>z6A@k
&q(kz
1s-FA:1
J]e# %aT
tLwL@vD-Q%
wJdJ@&`e86
w^UI:rX
vq%Z8N
?A!IEp#7sA
tmNy1u,
lssms
uqmUqhm
kEkdr-olm@o`
@@@@@@@@@
HemememeQ
jYcVwD)
)((((((
=}}}}}}
vvTUUR
Q_P^LIWU
$BZdbS9
)=MZUH6!
Cmfpmf{
!QqgT='
,Ym`H/
Cggggggggggggggggg
VS_VERSION_INFO
StringFileInfo
041904B0
CompanyName
FileDescription
VarFileInfo
Translation

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.