SmartHawk

2.8

中危

该样本未表现出任何异常！

重新分析

下载样本

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe

分析耗时

77s

最近分析

393天前

文件大小

291.1KB

静态报毒动态报毒 UNKNOWN

DACN 0.15

FACILE 1.00

IMCLNet 0.87

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.15	Unknown	0.06s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.06s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.87	Unknown	0.23s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

未检测暂无反病毒引擎检测结果

观察到命令行控制台输出 (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1727545281.813375 WriteConsoleW	console_handle: 0x0000000b buffer: 错误:	success	1	0
1727545281.813375 WriteConsoleW	console_handle: 0x0000000b buffer: 系统找不到指定的注册表项或值。	success	1	0

一个或多个进程崩溃 (50 out of 52 个事件)

Time & API	Arguments	Status
1727545280.42225 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 2939664 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 2764225 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545280.42225 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2764225 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545281.188125 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 2808736 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 2633142 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545281.188125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2633142 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545281.938125 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 6282144 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 6106550 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545281.938125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 6106550 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545282.016125 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 9034656 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 8859062 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545282.016125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8859062 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545286.76625 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 3070880 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 2895286 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545286.76625 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2895286 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545286.890625 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 8903584 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545286.890625 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545291.625 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 5036960 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 4861366 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545291.625 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 4861366 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545291.75025 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 3201952 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 3026358 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545291.75025 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 3026358 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545296.45275 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 2677664 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 2502070 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545296.45275 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2502070 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545296.609 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 6085536 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 5909942 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545296.609 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5909942 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545301.328125 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 5102496 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 4926902 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545301.328125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 4926902 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545301.5 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 8903584 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545301.5 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545306.188125 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 5757856 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 5582262 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545306.188125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5582262 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545306.359375 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 5888928 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 5713334 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545306.359375 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5713334 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545311.047125 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 9165728 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 8990134 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545311.047125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8990134 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545311.188125 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 5692320 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 5516726 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545311.188125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5516726 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545315.905875 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 3333024 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 3157430 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545315.905875 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 3157430 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545316.046875 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 6282144 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 6106550 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545316.046875 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 6106550 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545320.734 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 3201952 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 3026358 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545320.734 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 3026358 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545320.953125 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 8903584 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545320.953125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545325.594375 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 2939808 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 2764214 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545325.594375 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2764214 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545325.796875 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 9165728 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 8990134 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545325.796875 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8990134 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545330.484 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 5888928 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 5713334 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545330.484 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5713334 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545330.609 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 5168032 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 4992438 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545330.609 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 4992438 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545335.359 __exception__	exception.address: 0x4284c4 exception.instruction_r: 0f 3f 07 0b c7 45 fc ff ff ff ff c7 45 fc ff ff exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x284c4 exception.exception_code: 0xc000001d registers.eax: 1 registers.ecx: 0 registers.edx: 6216608 registers.ebx: 0 registers.esp: 1637804 registers.ebp: 1637844 registers.esi: 6041014 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1ab @ 0x42b1ab 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545335.359 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 6041014 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success

在文件系统上创建可执行文件 (2 个事件)

file	C:\Windows\System32\drivers\spools.exe
file	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe

将可执行文件投放到用户的 AppData 文件夹 (1 个事件)

file	C:\Users\Administrator\AppData\Local\cftmon.exe

搜索运行中的进程，可能用于识别沙箱规避、代码注入或内存转储的进程 (17 个事件)

Time & API	Arguments	Status	Return
1727545286.516125 Process32NextW	snapshot_handle: 0x000000ac process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 1964	success	1
1727545291.34425 Process32NextW	snapshot_handle: 0x000000ac process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 2460	success	1
1727545291.35925 Process32NextW	snapshot_handle: 0x000000ac process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 1928	success	1
1727545296.188 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 848	success	1
1727545296.203 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 1776	success	1
1727545301.04675 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 256	success	1
1727545301.06275 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 2836	success	1
1727545305.922125 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 2884	success	1
1727545305.938125 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 2604	success	1
1727545310.797125 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 2420	success	1
1727545310.813125 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 2352	success	1
1727545315.656125 Process32NextW	snapshot_handle: 0x000000ac process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 1864	success	1
1727545325.328 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 1592	success	1
1727545330.219375 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 1596	success	1
1727545330.234375 Process32NextW	snapshot_handle: 0x000000a8 process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 2476	success	1
1727545335.094 Process32NextW	snapshot_handle: 0x000000ac process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 1092	success	1
1727545335.109 Process32NextW	snapshot_handle: 0x000000ac process_name: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe process_identifier: 332	success	1

该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)

section

{'name': 'UPX1', 'virtual_address': '0x0002b000', 'virtual_size': '0x00004000', 'size_of_data': '0x00003400', 'entropy': 7.842022912472796}

entropy

7.842022912472796

description

发现高熵的节

entropy

0.9629629629629629

description

此PE文件的整体熵值较高

重复搜索未找到的进程，您可能希望在分析期间运行一个网络浏览器 (25 个事件)

Time & API	Arguments	Status
1727545280.95325 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545281.68825 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545281.734125 Process32NextW	snapshot_handle: 0x000000a4 process_name: process_identifier: 0	failed
1727545286.531125 Process32NextW	snapshot_handle: 0x000000ac process_name: process_identifier: 0	failed
1727545286.641125 Process32NextW	snapshot_handle: 0x000000a4 process_name: process_identifier: 0	failed
1727545291.37525 Process32NextW	snapshot_handle: 0x000000ac process_name: process_identifier: 0	failed
1727545291.530625 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545296.219 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545296.37525 Process32NextW	snapshot_handle: 0x000000ac process_name: process_identifier: 0	failed
1727545301.07775 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545301.234 Process32NextW	snapshot_handle: 0x000000a0 process_name: process_identifier: 0	failed
1727545305.953125 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545306.109 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545310.828125 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545310.953375 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545315.672125 Process32NextW	snapshot_handle: 0x000000ac process_name: process_identifier: 0	failed
1727545315.797125 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545320.499875 Process32NextW	snapshot_handle: 0x000000a4 process_name: process_identifier: 0	failed
1727545320.702875 Process32NextW	snapshot_handle: 0x000000a4 process_name: process_identifier: 0	failed
1727545325.359 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545325.547125 Process32NextW	snapshot_handle: 0x000000a0 process_name: process_identifier: 0	failed
1727545330.250375 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545330.374875 Process32NextW	snapshot_handle: 0x000000a8 process_name: process_identifier: 0	failed
1727545335.125 Process32NextW	snapshot_handle: 0x000000ac process_name: process_identifier: 0	failed
1727545335.297 Process32NextW	snapshot_handle: 0x000000a0 process_name: process_identifier: 0	failed

可执行文件使用UPX压缩 (3 个事件)

section	UPX0	description	节名称指示UPX
section	UPX1	description	节名称指示UPX
section	UPX2	description	节名称指示UPX

使用 Windows 工具进行基本 Windows 功能 (1 个事件)

cmdline

reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f

与未执行 DNS 查询的主机进行通信 (2 个事件)

host	114.114.114.114
host	8.8.8.8

在 Windows 启动时自我安装以实现自动运行 (7 个事件)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell	reg_value	Explorer.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit	reg_value	C:\Windows\system32\userinit.exe,
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ntuser	reg_value	C:\Windows\system32\drivers\spools.exe
reg_key	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\autoload	reg_value	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
reg_key	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Schedule\ImagePath	reg_value	C:\Windows\system32\drivers\spools.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser	reg_value	C:\Windows\system32\drivers\spools.exe
reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\autoload	reg_value	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe

对特定运行进程表示兴趣 (3 个事件)

进程：潜在的进程注入目标	wininit.exe
进程：潜在的进程注入目标	csrss.exe
进程：潜在的进程注入目标	winlogon.exe

通过 in 指令特性检测 VMWare (26 个事件)

Time & API	Arguments	Status
1727545280.42225 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2764225 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545281.188125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2633142 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545281.938125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 6106550 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545282.016125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8859062 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545286.76625 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2895286 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545286.890625 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545291.625 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 4861366 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545291.75025 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 3026358 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545296.45275 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2502070 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545296.609 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5909942 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545301.328125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 4926902 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545301.5 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545306.188125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5582262 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545306.359375 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5713334 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545311.047125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8990134 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545311.188125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5516726 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545315.905875 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 3157430 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545316.046875 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 6106550 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545320.734 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 3026358 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545320.953125 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8727990 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545325.594375 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 2764214 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545325.796875 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 8990134 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545330.484 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 5713334 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545330.609 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 4992438 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545335.359 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 6041014 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545335.530875 __exception__	exception.address: 0x42844e exception.instruction: in eax, dx exception.instruction_r: ed 89 5d e4 5b c7 45 fc ff ff ff ff eb 19 b8 01 exception.symbol: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2844e exception.exception_code: 0xc0000096 registers.eax: 1447909480 registers.ecx: 10 registers.edx: 22104 registers.ebx: 2256917605 registers.esp: 1637796 registers.ebp: 1637844 registers.esi: 3026358 registers.edi: 0 stacktrace: 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b1b7 @ 0x42b1b7 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb+0x2b94c @ 0x42b94c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x76ee33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2008-03-25 01:31:42

PE Imphash

08b656407b8d307979dc72c3fcc683a8

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
UPX0	0x00001000	0x0002a000	0x00000000	0.0
UPX1	0x0002b000	0x00004000	0x00003400	7.842022912472796
UPX2	0x0002f000	0x00001000	0x00000200	3.0150504883289093

Imports

Library KERNEL32.DLL:

• 0x42f078 LoadLibraryA

• 0x42f07c GetProcAddress

• 0x42f080 VirtualProtect

• 0x42f084 VirtualAlloc

• 0x42f088 VirtualFree

• 0x42f08c ExitProcess

Library MSVCRT.dll:

• 0x42f094 atoi

Library OLEAUT32.dll:

• 0x42f09c GetErrorInfo

Library USER32.dll:

• 0x42f0a4 wsprintfA

Library WS2_32.dll:

• 0x42f0ac WSACleanup

L!This program cannot be run in DOS mode.
En4Mu"
I/Qmlv%uwjbwdh%fdkkjq%g`%wpk%l
AJV%hja`+
!C!A@/
\!c`_%+#.
K>6Or9'Wlfm?
w`}nw+n
d[jw})t
u34v43
asw=((
:cd616rv7Z6
RVDV`k
i~`X`-j^}
]\\8[)EQ
WU\6hf5
k-K6/8
;Z;n9{UEe
31\Uirrq'
sZ"k=U*
x5y<{i
D_{SdF;N
|-v\nmHA
IR.&MY
f\)(L
p(4|M
UK7IxkZi 
~7pRkUgHi
^X-~`a
_\~95N`u
-4!J%Il%
5Y5f.nf7
5Ny5d>Y
&SY3+q;O+
}-]=]T Y
g*QQ!U[D#
<!65{+
1pqF:md1*\
PN8f<#z[$St>w
'@ERSV
9|Z[u=6-
/<DBPQ`huUdqm
Rwlq`Uwjf`v
V-`uFijv`pjMdka
__x5`Qm
FIdT@w
}TW$U+
HoipiX83D5Z9op\[{Zcalshd
Y^kNwhcGX]f
Mjjn@}3RajD
+gXe7A6&a
q@Z]j7
CM%ze-z]
<p\58@d
qM!iyt
]N@WK@IAII
HVSFWQ
a/IjdaIl
icftcrkpW10,fnn3igpin
ko]ERpmaCffpgO
oGltk
loglvTcpkc`ng/klGzga
Amr{Dk
MroIIg{C
j4rkn8--6]kicY_[vkqGcvmp,o-#oclceg
old_`_']
_w+`ewnlm-f{f
khw*a|
pbf%%8rzzZ3:\stop
flibul{
f~fsocks\a
]aminiavprra!#%vr
ABCDEFGHIJKLMNOPQ
TWXYZabcdefghvkmnqrAuvwxyz012345^89+/{%02X+n
n#seXn
r_7'ZKoetiu
ZFhbiqouZES
hrPc6oihZTwZ/ImPath
[QVGO^Awm
"%1" %*
~`oj{ncZmZeV
kbZW}Y%
\zn?ls,.php
vbsot#?
<Mrm mhoRqd=f
kX_^OXDK3^q{rgo7n+
gQGPRPM
NGFOl`bHPsmdp_Bss.
XH}keh$WwXEt
eX/wru
+x,vorp61s16
#~31324.t
/V{8"mK[>r~a{k
/dAo/n#{
POs HTTP/1.1
)}k4*[l
--url#ced90
#:jYR-,g
?8h-"f
VUCPG+qmd5
MHj6m[-aEx
Shefs#
Ev8VNUIcKu\
(P3CV%AW
C[]nu(+'
._PSt*C
 9819c52
5e_7e-00+:
_osidOe;155aZ
_mp;R?i
JAV_"r@@t
XH't_l*4&
1VjfXvX_#
;G+9(@
oPhmPQ
EJh= {?r
dIwMTURGl&6
w}fnQhS
Rsw;ue3
/X\BA'aQAgo
/8UJ>l9u
)}xhh,WB
jhhWd[]x
ebhXMVe
fXV][}
rRf[`Kb
Q;h00
r<h4(UZff
lmEPa8
t,xpVS
Z(s# dd
D*M _\/
_ds<@pM 
zM`_/  Od
h8xtYN
h8{ns+
h%8#l`
8MPT&|
-6 SH^E
*h&{!  V
h /Ylu30
uM*nH)
oa4t4UWl
jPb2 N0+B
t?]TjDjr$
\RXw7
,&}jdFS[gw.5Xc
\Ps"at<a
#DW\4DKN
n0sYx%
bHzdSdI9
6p[9AT9>
5]Xj,
cYt f0
0Cvd&&
!.YFEX
n^dxf4gE^7"_
B#/0Ms3
8#yut?
rXI'E!
HwQMCyhy
+ jU,?u
*80kfB/ HCa
l#q^pNF
vv\LW=)L
{ClF?0
%&k&/x&
PTg[H7
&OwB8r
FS{D{{QY'
hD|OP|
E }a^Xh
\4U [h
2c3'=G
lOsB|s
"k*8oxz
=v;psM
w`\rL$
7<J@t(=e
'_uXB.$S
@lHeD$
h,~nY08yB
~!u@hh
(//dlRpd
}t5.;P_Ah
v !d$0
{BhlSt{
JOh~K%b
~Dh{aF#p
,''8)HtsflK5
`F4C>h
f'.P /[I!
zB}P8}
\JL WDO @%AT*w
@0oe#91Kb
TtP`dhlpz
``t$:D50CQ
Fgh!a2FjPI<
v_/aNyx6?E
;tWP5l
0u>"u:F
+ v;XPVSSs
hk@Ae% O4
GetModm#buleFi
StartupIA@-Q
Hnl>Lo{l
Ti~[ckCountl$rcmpA
pynZKgiMDrive"6
{-!2y1F
atadLibr~
y:AddrVolu
rmg&1l
ep(kA7Clos
D(r;To
Snapsho
cfhEAt
bt~__p
??1t_UAE@XZ%cI+
fV(mak`X
Yf3F6lrsptf
ZsoiCc
B5pnhTr3
vmfwhtYp
@atr\0
1WpnhE
0k5Cxx
,T%Xg{
4owENo3@YAXP
Z;Ss,t&u'm<Q
wgF{GtIsCh4 p
4PYe{s
G#A.4S
GPGWHU|
XPTPSWXaD$j
KERNEL32.DLL
MSVCRT.dll
OLEAUT32.dll
USER32.dll
WS2_32.dll
LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess
wsprintfA
!GfIRdY
~]7NH*;(e
YWjL"Q\
N<m{8 #w
iTVXjn
leinMB%K
tG.ACxH
Wt;lne
bupdFt_sh90g
K~CNi-
,ml}^2B
9P5:DX
#&RO#n9)e
]/2:D N+tw~3k
5WK 0[
~b$#\{W-RHJ#V
!l9L$2*}\}/
7k}n3A"
,aYew'
L_r~3`[sZ
 DuJh~G
b8+`Q=fuOP@
h+Ly#9
EEe;o;
,_<$@
Yt}0L9
/M#[Z0
&/_$v=
?@={996
k$3F#<EM.
[miENa(zu}S
O%!Utw
%uQh?d'W
V:lz}h#
<j\ PHbznzdT:{
gJ-2KS~]
AsL$Y>9Ap
~|$t'^Kamx. Lk1
2KD/o15]OfoQ
|OwJ+-CW<&f
Rj!_(H<H
B[CNYKC:
)%UWf/! \
)b,{_;
`P]#/;
tzB@}G~
zx('T#5
QcF[GVWDk<
l;m]er=
qG".sI<~tB
mj|m^j&CS[66y2p2]8
Su4;q^_SM
UZAQ44
3;W<n)z01
|PP) !C
9A8Zfu7 
Cnt:k_
YI8-+06@dh
"|S,D(
YH"?BNF
;>t\hMB
siyE0xe
5Q)_1~JR*
fzW9"j-[4"-
_*Lk)0
'K`V`<0'JDaW[WXH'
=qYv.}_V$oK
3:>:FTq5)J
*yhf# Q8
j wdx@>
U/c5)Z
:82 nSE:qt(
+:E-7=
x7HFMJd
3+{CY^/#e3
@_bFVp,8:
Eet/zP^5A
UC{;fO7
co$ZG|
So`m8u
jZ2XC-o$
!N[Bou_R:
8Y!"d=
aWx}VkT4
FaBT>h
dD.oyoAR
"c)\@89=&
TR>i<$"$
1y%uL"uIm 
is&f9%>
sA:S'GJ
y}AKTr$+beeI
!e5H`LY
co:M7X
ZgJl:e0
lG725h1n3dq;[
4s~&iBq%x
bf >@t*2X7
pU]uJ/PPw
y[K'vWx0P
Ok.;$K
jkD|^+\W0
{MN1h7UxT,r
8p@#B6,
QCPG'Qu1r"m
c7G9v~
j?)w-A
`CxPx;
~@i_Lt
?-3a 1sW
uQe?sb:e,-a6
v"(=c2%
[zCNcCWZ,`M
d 06NJd[
tV3~wi,zks?CSp2X7-iE
a(!] JN
$.s8B_"
W-p5~6
dq!J<zX
bZ t9R7]}D8"yLo<
:P =Mq
~i\:moxF`
xVj.TQW&_fb)0`HDK
[|GQx_
YJ~x`o1@
|J?F;V
OiZ^Sn
xbA|r| *B
2D.i>I-fue
//63|9
(_q<X}YN,z
 ;.|15
}bmBJy%a
3{$ois>
+8kujO
PDyA3jM4
<TNU]GR
kxk#4;Sr
vsVa!#
VYg/BI
0J~.cBP,
wsd'pSE
z|Imiz
&bx)3=@_,
zv>8BA
ioV(zQPO
+\Oka+iH4
t::Q;Xc
k=Zx({Dh
sYASl|!F|
]?PO9?jdy4x1Dfc/#c>u`3PC
=TT-j'v
_Y@9&(
n_!_OA~N
'rETls@
(]L++xp4-@;
k=pP0B]
Hz4A|L
C6`Fc96XH'PRDv
M;<O(H!
.zU{bK;
viQxh!4,6=+3X
u Xt7FZ5\$t-\
Be<`dbW4M
DsVk_<G
U}E6sz
{qCGja
% SLb/1H
bFh02XT
(sc/zCNnco%-3\SDm1
hS+s^u#
Br<WUrPh
 )16\oZ(1i
DPQ8oPwW]c{k'j'Fx
BDi$?-$
5ztKP~~d
&omA@,%A`
Y I%dOTuRj
.ox*f`v
'drS.ILq?I
.[9ul8
d-JXLmv0
/K:qTGv
}9>@uFsn
295<Qao?{WV
1gLrVIFx
7jdtTp
+\}"{?
.BZ>O_!
R5PHE}
b^gk'K/
.":s]Z
Yg>M-Nn
W!]<f0wpa
l\?/}5ns|
1-C"{@)N
,qw2m{8#>yz
9^+%ui5
I)X<SQ3)
zcUP_t
.e)D~_
rlLaQY
ZADrj:V
f)tyj<2d,
r2+vW=
EmdhxMSn0Ba*
e=7C;q<c)C
ob`_awB0
4|hs86c
]hlC8R
TMAy4
aG2u}}EKt-n7,
"=P16
cx:v['YkO
P"sQ|,
$Xj{9}kxGlRE
].n%,k1
MW\pk?
+Q</d\{n0y
UjEOcIEOf/
g^jKHntLr2$A
i*u:h#<hF=
PG*J)]=8_xez
5r(Gmu
mI[Ilzg
I@K(vD7
q02M:P
M0+ovh
C]bg*Gx>@g?EB%
\ke!oaS
4c_pz+^Y
itN:F6
)^^Ft*
$}OyjY
7X}0>-J\
vMg )I
rU\@<k'tJ8n
Jf*!BqG
|B#)u!B
J Pp!0m=
DYvs10
yuTYc9L.u
^W[5I2[ )yte
c#HRv068R
%GN9Y3}4
V=+IH+c
@e~HB
Sv6K':
Z1_Dqg:X
5,_!%t+8_&gzU
o2Ckx.T8|.TSGn
q 8f`94
jjClyggutm^
E9#g4%
'Lfkny'
K<#r*Lh!
p>J"Q"q9
9ZDv]+N
-ZXtKtZZ
UH>Y0s
Fy_X5z@z
oTTSQ1Lq
/g+Ulwja6
[04T?^
TUMJV9
g{M<lW-~
"?}0qu
1`|\Gq
:mmP's|'
%dyk!lPdR{
U+#q2R
;pSv3'
^'*X}[c6V>\
1$h9n]c&-_
#7o8xf5
;<,,^" 0,/
R+!S1[b
vJ`BQy+I
 pE!?.
eg1m&8yP\
ed@FW)
+?8HOECKmK?'
x%9'?=UNu9I
(i%'dUW
\-P.Gxm/@6$!'
kJD6{H.
c_N[zT
,*cWzWbF3t|c
o~;!#5
,C9?j{3}u[[N3V+N&"
 Q~-y#F
S7moXeLek<
QQAZdHa
MXxp =|02J
M_8$\Jh
4A~;Y^NK|
8Ka`Rb
)Rdvbg
wB[9|'?
G;2hcc
BVf>xe
'1mkN^5
KXxwCh6a
HF@2@
[]Dn4{CNp0({T
T&1kB{/
kMjF#fPlj#
\?Sk__ukMRy\
$-7U(O~47<R7k"
gf;d/e%J
eX:sA
yK83>6XK9
(XxXuem&y
Cle9^p:
G7B#/uZR#ro
s]7WV1
=Hbs(eCSrGp
,Rj[anik'&
^fZ~A <nh#.Yer
#i"5uz;eR
>B#NawN
C[xM1;4
UQ0Kip!
_]v{&K
F]Kw3UxucRy+#c^4>H$.
pPRnIEdu$@V
(FY7Eym{e%s
E8$>WR$
9jKaLcVK %VftVB
YmO8wD|
Q{M&i[~
~$83UZ
Jc6Tbe
8`YP[`)#+S
kviV/:
%naL.c&n
ne6+PP
zx%3&f
hnK0Yf
R:=@Z7
Z"jee1*B
2zDP`{ay?;
XI(509M?Xghb%=f+@N (@
yD7^g7
v|(7<:1G
)x~7 2
`x}h]z
}Z0m\jO?i>
2vxF1u}Jm%*
1FPRBtNK
s]ft'{2k
.02*O-;I@`
Kz@L]g
>y<xX_wu
b_OY4MMiQtk
wL/c)R
1G_HJl !
c[k^i(VOrF
oJ^p(CX/
&B,ymkTyU@
Oy"sHH
wk11m(UP
RP$7M
mH &%9;R
?:rce*/
-7N<=t)}W
4YimTfPZ:h
;x8[x<
p]fGBA&T
@x6p1Dq
3?:pZ+
G=6)5bGt+
1UQQ=a
z?hn=V
6!ZC8%+V
E=m`X<?dqK
[wTbg
<#ua*)S
BT"L;B
QcHSeo[c{z5r
\CO6g5
\Ath/V
7Ac~(LR>
S&?}y\I
~zsGUA'i
THf')e
q\QEON
>]"L 9
zb,O.ob6r
-m~qkr5go\!)az
i3{X3#{*{O
.Nih**
L%gb*~
'!-$t|
DEgUH7\,
9`jL@s_n.,P"i,
9#(&n-spe*{
.4hxs7qb?kQ
+__AQ-\j_*
L'{S{}fW
vy#s'l
;:Dwk.r
ROJvc8s:
HA,02:
|C"_f7Hu
Z/6~`V
+(MSlH
`!W<o 
ZN,@N~
tCAApMKI
ci3]3O
ff95r`<%j}
F--*9LF`vH,r
WLhk6(
5S#n70+R)7
f*,0nbjT
]Sl,hE
{\Mi\WG0
gJ`LG
!BE0<Xt'
gD>]7s*B
h@i+9J
Qvi^\6_rdAiY
6*nZ+U
i/v4SA
W)CB=*w
DoqD\UgXmzk
#|^c> 
sF|QLV-S
[a \Cw8=
=3%Il%j~6!
t/*Dh/k
I^<dzdK
)P;wQU&j
_^b@QpX
:K'=*fiq
,VD+i"+
JPTR}c
vdM1]?
91#G=n
J(PCb&
&sr\Y'n
/6\wJr@=
E%W4&\b
OGm-iZY-
sy&]Uf
_E'CA*tQ
00=;'Ow%,_
=5g0j4^
UP`pv6
8-15rT8eSC%b-O
zR?of}X
&8tZt|
p4t8x:;"t:O8
Twhg\9G;
~YW)+m3OFvjT
wE?MZN
AqSt)1WkQVz
\m:\cpL;iU
(vv[ASz
QYkLR}
(Kj@\~vsOc
MIbp;t$Kk{3Y
n-ZyJ@'
#Ot~o&@q#
B<?\[T
Vhl3}%
RTwl0_
.*xYh P$8tm
}Bk4l6x
WY'giAW
9.$d0WVG
V#]Q(|5
U-1eg<bPN
Nd+EG+.
U3Ku%+$]ZSd
^z~\c,2rM2
pS0X[&
aU[Igh
89LIe|^?G=^Z&w
[S@_)rR?k,
c!G"O}
<gHY&$
q6A&0l
(F.raTJY#5
I.-Czz+
0V;#FBd
6rm!3\Zl
X:ta2-T>+Ms
u](l48
b2xaGjR6v<e
x3[6T0l
>Nrix9rD0u
O0nTR"34SW=`p1
=7Y+xQ$
uK.EtIa
6X:fr7L
-Ph_?,H*Oy`hV@Q
 {PkOK
 ?`3@Q
R?OP8j
:f~_,L\
&*$7h$
8mJ=?h
:]iJ.x
J>%*Kz
-hB3vHc'
s@k><Q
.Ib{&}@X?p&Lyl7?
Hu~K}>(Z_8#<pfg}<
7WD8VW
IW>D$%
t@u>zol
&x@F'37Bi0<_
r?`!N'#k`
Vim3"*
 1S(v5
b'Ir(<mJ-
 _R&mkxg2(
Oo7 ?R
aT0mjRT%
qdO2S`
uy!SC?W(f
TGGWJH
;N&Md?9&g
?wnhe)
@}K'r=8
4^co<(H#be
Hy{l%t (@O
!LQr=.
|9d!pIL]Vx
{elsZ}
dsJ(K'q:~k
-Lv|]\
E:;>~}H_D2Z
_ X9[.k4 
~cU~8"LS71lplsAa
&l"B$a6
A#Yvqrt9).'
;C~a ]
S{2}X4''H2pb!g1YyR
R>i%IEOWsr
_2)qW0
;L\}`5{V
al"%_xe
8Z|2<.SEPkBo9*B
a,_g '<J
9QcWGB
B!;Q)$
3pdyB~e
x8~VNMCqt#M`rqRt>u
uKsZ5FO5
I#~{@|-
MLTeiwj+F
M/M@6%
LCn@CB
WJ4^Sb=u'q0~?z
fF0CMUbn
hPeq^j_
KeX.F?OUD{|
+@fY[Z9 Z#[.
.}m\dee`-fwy
RN9~A(0W1tGL
3nO2L3_L`Cn
qg^RF8|~]|
bgq!*# 
|;J*m$/)|t6(
s0_byS
&$^_dCX*J
yGi!F6Z
NW46f5
gIO0tz+V\7y2
)iw1:zoK':qV
4)2iCh
0cIo/N\SuQ2q
<~0_${g
oX2wBA_P\
]^@2AAS!2D8
?E6_S;#x~
vsD(*eoA
*4j,c+Jz**
R;h:9x
n|d|]O
f%Kmc,8fBz[Cwb
u7> C$z[d
e`_spO~iBC
0|w`&KsR
tzU)`=9N
ghs,MN
Sf%^<zVC_a
!_1(*VoD
b2^93b
dIq&C;o
'??uFi
5&l#!dl
TiuUuq
JwI[+=6K)aF3[:sebb4
n5RU8J\o7q
Pz{RQL%gt%2^r~
p-6{qxy
f%29SuJ
WK+3'mh0}mhx?kh(4
!yFjMzN]
:"}+reN
ZbfYn7
$SD'_0vje
Hf`zFxgT
 Dxj<Q
|@|v\\IEg$
_vms4+
WPphjdYj
s[]6U>v
%d@zN(~
Ag5-[U/D
Q7f(l#
o2C`^CZ%
<z0W|/}&
V2.\_!^ 
>PVwd+v\gmA
!#Zj[GhgCx@|uT
<5_$|
K:F~K3c
Us>ngb~
C]qNn9u\$
V/i:,;K
HGcy.+d[B
kqi`q7C&
L-tsRy
#@3C}e
thZnm.@
CaYNxRuq,
a1{hdN%:/E}8JGD
E#_;]c
zih,cs6
r8JFzt<R
_Fas7Tv
]6 f!V
Tv"5}K06GZ
L?tf0W7R
}A}XMi
e9< &*N=Y
{b{Ls9
X9(yuJ:r3%=>*
uKqrFX
1+RaGx1j#5]
bnu1z[
P$iB|8@ti;,
VB$cd2y <]*
,>2<Ql
En;pn(
~abmXP
Iz3@6jY
9M9xw|
P@+A8|
YsEIjT
^W|>"p
y8ceu}#
ON7KXRVS
wk0&{lr:>
F]QQEdk
AObh1p
i*m<]k.
6j}KA%
;xBsC=&Z~Ue
-3>A<9#
ArWuM<
xg,f8?*N~[
# R,Lt
A?D!!;HMUuUN?I
5Vt!B 9ct/
U< cc$
;'Q:Z('#C6ijGlI
{-Y[%b
cd93@!m97rvKTz=;d
Ihfq`<_
>3;iU$]
o}E}M<CM^
KvZP`jw
LrAL)]
m*uBrwPE
pK<2kg.\R
`X;.yMikW
2TqA1q
y5ihsKhP
=.>8AM[
Gp\p=Y
lo^ jmKa
o8DRo:
7H[LS^O
dpGqY|
[#2E-^
ar$"D
<tA<PR
%DR*Abrk2
pClz"U
E8|$U
`jpj'T"}R=#g
u'-{j
`]YTo)
)H=34_S;Ve
5\uocEf"4Q,
j;}?BF#=NWh&
oZnvMexh8Ly
fM^*lNeC^?L#
jTpc`*6
=+F`}w
z/2}F7r;p\Ey
}UV<;\
mykzm{~ dEg1U.'%qiK`
?:TdJNLoGul:{]gI*s
'nL|52
Hb)O&IA
igMl!X&[1
+$:]QV
ENC]NOZ?~
%!)ps'N
BStmppDY-
qwun@ms
hCM!V\eUU#"AQl
nbR9=X&Hh
?GviuI
[;F*]=0<Sk
(8[:W!
),D\<X%n
*B9l}z
A[9(\y^Qt
?Ser*NpOcU=EkZ,S
mmB:>iN
f:h3wVw
Kq]j_$`\eDyLE
C(+ <\!%sH
'!?wq8tH?&zOg/e
by.^wB
ib[+Kt
(Zg00ai>It
5^]`g*!m|
]l4Hy(k>"k`
42O6{9&fFzlEl
5@ 6Kh
7[ &ZT4> 
NH-wyu
A,%feq
]^Ly%-r
&#kH{9
ltLsxiBP
XdV=#{
[tGie3Ks
a<Hh*`]N
)+i"n_h
zOKcm-
,GV<*<^J
<@yPUB
apGU]Y&
{|z @3if
iRfGpl=ut
?,C9P):T|
p:WpJ8
f7YksBDo8Olao%IC
\d+}zT]'`f
N|<gf9S_WL7G%U
EVPGS?fD`
sp'b@qlDZpp
p<3^OzH|{A
{0}Md4 
]#u^;3
kvW}wehVS
cH0ox9*)
-Jqq5p
d{s$eV
_'XEh&<$`
$4t{5a
,?2!jn''
,LSD;9
?`guJ;
h^S!PCY
xeOgQ_2
KzT<E3XBye
Q ?X"Jr
*yV&dG
)lCcmsp
RshsO+`Xf 7
RS/wo,
omSxBC(U
JB[e(4
HH^KVY&
yp]Mk3KMP>
F!uI::g
J><xeF?j
797#vf>
GV/DHK|
@[_ET\sA}
"klRwN)`
BpH"Hh
DnL>WHv
n`6sOe'(n
#2n~t(E$
#Ss_o7q
{N}H[%
I MIYx=Q<b
[H7L4Ju
ckM9CZ
:6sd!y3
?Tc}M^V"B8]aG
^~pNBs
bAGiJaPXTi 2]9!@c
6(DO04
A;9Fu$C
:(FA=j
|`sGbo4,}
%N0>'!O,L(Tw
?~C@[,_s,
2M$zpRw
b$dEu(B
EmKg4\;nO2A
GJPwknm9
HJ,8B}[<P
D06XgD
_rp%DS5q
aLIe25Q
G?<$vwx?S
 |\5+h}JJ:
#6G]cR
&TV!>|_`
r\E<XM:
Jsb+'g
Bt!LUS
.&GlaWXf
m=H/T#v.o
.QXA9()]x8[gNq
y/Yv2}D
+1'>|E
Ygg;u
2+m!G`D"i*G4S\
=|tJ)*
H8|,j6
YBXvLWWyO5C-KC/}
D<]R;L'h?hF8
%A*r)F
6JkiG8
(&7JJF
[#^G9Y
a#!%}s2)
\x9Na-Nse0jJ5kf
wxRhfYRS.^
AAreyVm?V]
CXX&tQ
"eImqg
RI_\s8
:_l25QM
DYIj:~
`5)&{l-
5|Hgf*R
&X5;Pd
/XaR CO
IU32Fy
<Ltjls3
b.[meg/=
>}a<OHMN=q~
T3:Gh+}u@"
.<j2~VQx
\Q'G6&HO
x"TlJBax
Yp sApXbF
WQ6[PQ?:{
O@8)P!7
+-jVszt
S,/;Ng
rAl!7.L60
m+*q?^R
tQ2vif8}1o'a
s$iH<O$wY:9/W
x46.5O!}b
T2!Zzd
);y\ah]
QZmO&z:8{
V!XI'~ye
&`B}i;)m(zX)
7x]8=}
*]`|N+!I^}
*7W7aq
ZJionG
C>m*f r0n
C":JN*{7
+7k8bM
|m>6Pi
y~XqMA0}=
`;/Y],
cIm+x$k
tr1@#M
*(n9cE*
x?jY##E
bYJVA@
wB*V:9&{Ln5
>D@qJ8
FI4>,3s'6
f^ziA)N4m7
0J*hGFs<&Dd&
%eo PKS4va_td01e
-_"hALo{2I
\(--bOBp
>6ec :BLc3Td
~|oy,
42#YIA5
~"B2){LP, }jxO2kG
AK7Y>=
HboYs!
f5 !5EkgZ
gQUVy{y!,`
D63q[8L
s0CqsCi$}Rj
lqd0(pS:1ivN
C!^Hi\
CmXtsd
f_%9[mt
H6`F{1|%:ZzZ`-sjfjX
*#7"K/Iw4:Vg
CziEALa^iAB!'7XHX#
SF/Cz472
Xq|sszX
&j:@Bm<
YNwIfo2~
L:U*1G
O3`T7I
bd+!~
"Y3Z~8^
/EHzgd
fa-V<fb `
ZzEF\XB{Bzsy!
hg8JH/pb2k&:
W-dkkO
OjJ_SOhsj
gk|<LCJ,
'DTeT2~
@{m,<x~?8X
NR59q(&||
kK>O2#a7z
9#pLs%B|.
#]>]H@
i$d_|m&F?3
1bHnlG'H\K
<zwJ-xfoV
L1N $T&
zfk+N$t
=:N"Pku k
RC5&dP[
HZ>+v~^]_2~FL#Z
MMyX+TMy[ng
VquOqQ
(eV}`J9}~^%
2UB}<pc
_f~4N`BW
Njk_XES
L<&`*1Y"
(q,SQV'r
r8jP@^
u;jeq^[0|Afd4Gp
zqjqhw
j&[fMrYxWq!u
gruwY/au`x
hnh<fCa<6HgTp\Ff+
V7q[Hok
r")ss_o5=]LS
}d#x '.'w'~H-7i
f['UqO-HE_
TW,]J{C
)t.B!+cR/
4nq\AC
mT55|?.>e
=32j{@h&=YUfX
:^mkQn
k*uwb6!+Mf.re
_% ]v|l
vg:0'V;
uDu=XEc'[tJLq9
-weEwE*uD*
{iQ*/)
h9`VdfhR@.[V~
J(2@Cb%w$4
%c+l_C$aJlN
1?;i,P
5WXV{$
g]yiZNe
;T8\T4}
WGB?/(>
L+u0o{
]'$I.:4g^=V"4
/}j@v"
BChPim>3Z\
eu=^@7
l2oCME
P,9._5
K%rKtSujx@}
q;6V6_KbG`!
]8=&g;$
!VN})##~Z@b
3#=MKp&
YkD]2`
>]E5t=
>hwecLIl*S$<E&l
yEv/\9R
-Dd:hZ3=
~<6rFx
|m/Ab*
oQVGFJ-s
#o?8dZ}uf?=Q
m.X-wDbe
"<3/No
j&U31:V2OdO&
'6UKNo~
{]e5@L
A79&H
J%1AF-)0D
A@=a$+h&[
F(AjA[w=3}9
tGmW]b
2Cm~<F
H]vbvsJ*5E`
Y7aYw6XH/
"`]3+^DL;
v#g`73,v{
w5C'7UaY
&U13)@
bl;&z$[\_:
tSFid&3
z=7*%tb c{=Eh
3w?] L
d< d=1L
&F<$OO
d+"Pr1jUw@Sl
85tQIeuZW
q0,ppQ8
q{X!pw
%:]%+r|/
d]|[V7rV
yTGK$$
O4.U,LN
coJ8$'
d]'3np
Ti&Q2z
VWs1"M `
wb=]v]Cyeb2:
E z@PG
qi9%.8tF
dppth)S
J$p ]he
#e2P!)
s2m<!H6DH>.
#<>j_w`abS?{=
`P\{[2"J2
a7Sxf&X6
u2\QYRG{
)$$N(J
Q? I)~`CxNL
:uUFfePP
$[@=!OTd.
)Q0p*A
khS"K<L
;ARvAAG6mp
TqT I=}DD
.eR;Ee')\sh #
5G%~+>8
OD}Z'.\7b<$n
&D[ZX 
[.RTg@
b."Fw-<|LJ
 (jao@`
b#{E#Q1p-
I+'PNOSe6P
}5n<O_r
Tc\-LK7
F(..U@0
*GIZ96/
|fD5L3LXG
}Ydy1I
YM)6N4a
6W"+bc
#{Q2$ ,Eg'
601(vc
QkP|Z.
mw8ju
}d!o|}
*>5yV#h2 ,
;eR!)f
y<97M3
?.uR0I#1
s-2*.@{%
}h'N#6$ 
vpC(4#
NhzG93
j78-#U)
5JdFRa82II:
Ix&(O[|
n?22wy/)F
\s^\D
5S>fvo
[{puJ@P
$\CyFA2DnI?5
k9xZky
I3f>J"W"Bu
n9b<cJH
%iV3XI)f`0}[srx;
*):u2x#
-=r0$E2W-ggcXn!<6
DYfM<t`
PGk'6']G
8FIuH`^D
++e,A#F=;ET
a6-0S}"
3,GE3lA
G@W+X\W
Ggo[)FG?Q#
2k1_jV;
o%"U9QWa
W9BFO=
IYG@zA
4@)}Ic$1R
d@H2#GtxZ|4
i%hC'q
6r1w|h%
9n[aBj4BQp|k/a
p.&:>$eH
i:N? _<0H
h9-NiF:
M/?1(`
q$a0'5B$2,{
Ae'8%mquB9x{oe};dHh|;
AjL?~
Z!kE>23$
nHj8Q/]
_GQoAtBV;E4v(
|P8?r4
;.cYK_HI1uQ(@A
9M, ==
|$YO9tx_],Zp
p8$Y=4
c8.^"U
Rhmbg#o'+[%,T=
gl1~r_;^UvX
A2$P-%
y?(8{<#|
?*R5@*}oV@!u"%Q|
t$Yn`4m\}
q8L?q4
is&5'`m2|Uv
^b,o:#BUnu/-)
o\!XgJ%(
`K'Vf<31
w^&Cyf(SejQ
,r[]K]
H-h`_}e[-F8~9o
d`.,|z
EcIx,bd E2%"c8_P
4IGMwlY)
X=\Wi'~rBO
4/T@o;\H9
{L?fr'?m
[(jC9<@
RV!dX<<MS;B{\O/
`401]:ox
;w9^{Z:%[
hBk@YFQ6Z
MgLL^pz!:HJ2"
Q)X, o0
HHTIjXQ
k*r<X}$$+NE
otcAie;Z
Jl_%F7
dwSJ>\
?%{):&V
^WJd'.pcp0r
kcP)j;8#
"LdZmk_
bl(B/@
kfZH&K(+
=P6sq#
'C'1vL
FGWpxKJ1qD
$bA\ L/Z
O|qr]zR
lHxCV<
EUsL,!
XPz`j\S/
vI@o /B
S]GxG8&
M"eXHAM
QSZpRlI
]t]/^Z:
8%j3uo
^-PSC%_)EQb
C0+RM*
r;Wf=(#HKVv*nO#
v>Cfdwoa
AoRrEz|M
P2+2Y>s|P+E
*Pk?~M
zDumJw
k2vV@5%q
?GS?5z
tc+la6;
`x2[,2bLb6-[XBLn
C)y&:|>
rkri.bzq
B"P<8\>\W
?T.V.OU, 
\`^'4j.
Ii>?;X$X
akXw17
7j#sw*12g
cde+tx:nyr7
Vq{G{Y 
xjbnO9@
`~X$3S
I&V`Ed(
$?B|)0K\:
n>3QG.$wf
*q]l84gP
F^QKb)M
Otq_EKiid#<
.@XSmPa+I
DfBE2B$2Pa
K,_lka
,(2gD:h&k.
)"2Y]AW>4!
!DwQz:2
;ys[v\|\5C,+Xz)9,
Q1tLDgJ
5`h|<V
h8v:tY
Mz=s}-Dni
{?n't)i4spdO~c]
E%^av\z
lDaVu5^DbZt3|6=
$x3llX_!v
9F|Rq(P7p?
m=p3r]'
;s<ku7zi{)he:9
`]nrWT
4c2!&3
DBp3f]
hCX p{
gT~Ak%`
8b)k_$o87*
Lnf1j>
 "vQ-!]
Zo?>yP=Q Y`
2u\%lX
8Hb,T^]X
%Z{xNU
36rH2Co{=I
$c#s<br
OS5A7X
@Ua&@U
CBS(;M
l!1R5Wli
CTk/$$&]|Yg
"kHXP3x
Ft:-^=f|b(
$3Z`U6M\=7:
,b`Jht
8UW7.a2>\'
i_A"gNZl
RP\qtt
?{*F6@1
:sxo@C/TXghT
0+u$d?
T>*z9p
oXu:aHZ{
A.Fnk H#.
V@.\Ua
:<}La|gYpIe
z18aE)@
Y\9vX_
e}t4.'
Y7ew`1
g1pEeE
8M0qL>
q65O2{ATJ>2=A@V
oK(`5>
6'm'(R
*,>KZ2e!kX
U->>9F2gb}b6FY
}#2cFQ
eLnd^
y~TpqNvf%&u
(7)sN2wBlMeef
ZcM}uB
g86v+^E
iuQUb?W
Kj=,rZk
RAc$g,31
`j2PrQ_
m*%O}U
W"Sk#y
.P,_ZGl8\6U-X
1Y'3=|$J
~A`.e!5jf^`l3K8
h[".8>,{8Y7/
AblEIu
T"|vQtXi3
o|l]d+RA
@I:vX-l=$(q+yR1[?
@!\t 5hy1v
9scnSZLq{
~-gJ^9}ZNA]M
}=<R\oGR
g!O=[k
zcOGO?:)t/
]MQ=yb
`daj)h
s=tZYF
=dzR3i
~DA<~H~M
l5PWYq]
AMz|H9<
uj2&9FY
.%WLC3 #
9 ))^GP
[zQNvQ-0F
D`9=_fUqT
AZ9yA<s
#Nn/BEd
4P+7+r`+#\\.
rY`KkFfe;
8z`f&Z2
n+Q}\6f+
F/TjGsDsg?
OV4@"#
*\L2tU
qWRmm_R
uO@bn!c!
W22I$GU~"Ez X`_I00~5<wV&Tv!6
/$TH$*:
+Z'Xqbw+L
'zD~SGs5c8U2
TA&#[[
M+@Z{U9ll
epZBWha+=RV!kh^L
pJQoGmip$mS
H0vRV?A~
^L(PLXF
83*p0c>b
y]z_@_&,@h
 p9z|(
2J^%Ew/
BRvK5PQ#\5PF@2JV"/M
Kw7/^9>N`
CA>;aAh
RTA^Can
SdvRd7W
}~%Mb~
w1e/f-I
L7(ry_;J
3wY#KZJ
z!{N",lb5,w
csAJ7OxX
AgzV\A
F|IX?lF9?,)3
"DG'+a>;
E`O}B=bI
fu[_@=+N
g?nKIO*\8&now
~THOB4
l[FB<,
(B:{;^3
laCDNF,;O03R
"!}Q$G:u/@a
fK&;|DR?
jn3{D
W,4,h"@
nAiHi-
S#?N6/
gX'2T7o<a+]Sb
xfHxRK`sI
o=u_X8{p
H[S'5gq57d_Q
F0yb}3r
80(&V&[9\ (UOc&uUOZ)\g
}[nJiM
y\n!&f"
76Z;hPV
J,o=kjE
89O+SZLd#(cyZ
Uj?Tr,kP5^y
>g0>6z
xud(R]
5H'#R26C
|ZVF0Pj%/#
 >.KFnM
!#rXau
S?%_PcTX
w't{nC
7+1/F6T:1k\
H_2'Tj
Av$@#})}
bU(v 9
1BW!Y>
mz-.?l?V_
G9/0R=<6bq"@GTU
xBX]c 
\Md!Z<
>p?jG0w#GW3
N3Z41QO
eGCXhG|
-^VC?^
G]T^1i8~
l;5DJ
H`\W-+ObTWw
%Toey#eV%
b-20sg\GXc
3]M*(aK|8QX%
m+(z/u
&=C!R<qa
` *Jsr]H=
Y2wT&at=
"iamxdq^
`%O=8R
(w!dj^58"<}?
x^=KAnk
||lHiX
DX^jpK\
-~4q|&I8'3(
ZE?C`Veh
3wR}gk
[pK6s]AV
ZCY6UVsO/
S3t<=1
]?yz\"G+
9HN-45*/;
pDGDAp]
^a))CnH53
5^)CATVO?0</_[j2H&<
}U=m3}&k*rF
t#--A4
gHEVd`4#E}
)R oS4%
b;qw]:l-
366>Um
%@"s6p}
Mvr3>I;0
6;pUXH'8Af`<}
bwe*mp9.iy$r
GA^BVN6
BvvVLW5s/UhcG
#kj$w9UNv.A
riT%DY
IHXlc-jA~
"9 CZL
,k]/9kT^
1WJ*skDMZ5:
hL?7!Uo
DIdH UT
ps>CSQ/
$&<xJKu
-0<Yu/"A
(RTYI7D
zyvds|C
-AEf{t,e
~ru (8
?v#Q~>!vGnK
lVhyu'Hw
c^*[Jl*
DV`_wzg
*w`0N}D
iSv%g9
51Yvh]|w
Fo[x'(
xFuWu'
jLNz!K
LTU086.1
$cJc9DQD
=/l}'2
q|.tv<
a:qd[K{@|W
rkK|s><
JP23!&
/9]I0ld
&6TAlOp
;_S!~~9
_Iih\qKhr<A}Rnjy
vCCfQOf
S_*V.3
yc~<qnP
|1~tC|2
"{K=c`3QF
ezQ8=W4E
i|/UMP
nPbB k7
S$.}nD
Wpwz(9@
=rt+"(|=yxRc)U1_\x
)]Y?$F
G+d\$'
o#0ef,yO
j`(lo&%!lLQ{5=[]
f9A78-
pbFO$N6&
?o[d3c
`h]%z*
g/7!e ^/
vd;pUu
Bfbht;SH
G/GA7:
=kg\;xvgw6y
k^mchb^
`4dW-h
\r&&>{
m%R$pZ9vEao
z[m:)IgS[7
k.HR1F
\fRIsT"D%
TP"a/u+~H
Wd:>Vop
kBlcj#'
RN@>M{
uBUG(|e
&Qs0NL=UN/L*
Mn]H=<
Q(NkJAb
UkZn4X+"qi
%_1+H4
mp!E"C?Nnx%
4OK\d,u
qp'k~e8/
mag|&Q
yGgT:t`iN
5FV@E]2m{gjER
w.6co-
W9O#2f
i8!&6X_Q[Rm(
;H`t,\so=#\zY~
DZj[R(Xr{`Q}
E<Dmu:kn9@Aig
kNxSJ6
Ct_>8g0R
,>!Ddw
?@j/{wYX46&
mAyy8B+$-
{<Rj!A
/YB$6*6FWP
9W<z;eR
6]:HBV
E:%?~<w
a[<'~c3)=!I
4{dByK[Z;
d&dwtbq
;dk4;C
>410SSa{^.,
!\H%v/
arh\!tBo4^
564vd h^9
3z0zgcK^
#$W@_#:;[
92Z<Mqp{cO|}
&"<1N3
M$T}nWk&'
acena`qvZt
M1y-A]
G$~ Z0B
w|dx,WLOL|Ly
H`*v}#@K
Pfen^M[[
 98pFltk|:?F
=}}!7SeS[F
U)'B9Wk1l=
hje!chbh
q[NWx2r
z5V0q;B
P,#feP;o
dWd$Yvikj
Xbfi2*/
pF_[71T
M6_62:Bi}
5^$$C8l0B
9!F@Z%+EB8
ohNs% 
3_mHo@P
v}Ex$'
N9ylR)1D?<
GB("Jy$rQ
]e{&TS[51
+8 d|1`\
~p3ss<9}J;9 D#
BjN@),tM
)NGSg??t
e ]\fU.7
2E/5cxKG
Q=]W9n
9scnSZLq{
~-gJ^9}ZNA]M
}=<R\oGR
g!O=[k
zcOGO?:)t/
]MQ=yb
`daj)h
s=tZYF
=dzR3i
~DA<~H~M
l5PWYq]
AMz|H9<
uj2&9FY
.%WLC3 #
9 ))^GP
[zQNvQ-0F
D`9=_fUqT
AZ9yA<s
#Nn/BEd
4P+7+r`+#\\.
rY`KkFfe;
8z`f&Z2
n+Q}\6f+
F/TjGsDsg?
OV4@"#
*\L2tU
qWRmm_R
uO@bn!c!
W22I$GU~"Ez X`_I00~5<wV&Tv!6
/$TH$*:
+Z'Xqbw+L
'zD~SGs5c8U2
TA&#[[
M+@Z{U9ll
epZBWha+=RV!kh^L
pJQoGmip$mS
H0vRV?A~
^L(PLXF
83*p0c>b
y]z_@_&,@h
 p9z|(
2J^%Ew/
BRvK5PQ#\5PF@2JV"/M
Kw7/^9>N`
CA>;aAh
RTA^Can
SdvRd7W
}~%Mb~
w1e/f-I
L7(ry_;J
3wY#KZJ
z!{N",lb5,w
csAJ7OxX
AgzV\A
F|IX?lF9?,)3
"DG'+a>;
E`O}B=bI
fu[_@=+N
g?nKIO*\8&now
~THOB4
l[FB<,
(B:{;^3
laCDNF,;O03R
"!}Q$G:u/@a
fK&;|DR?
jn3{D
W,4,h"@
nAiHi-
S#?N6/
gX'2T7o<a+]Sb
xfHxRK`sI
o=u_X8{p
H[S'5gq57d_Q
F0yb}3r
80(&V&[9\ (UOc&uUOZ)\g
}[nJiM
y\n!&f"
76Z;hPV
J,o=kjE
89O+SZLd#(cyZ
Uj?Tr,kP5^y
>g0>6z
xud(R]
5H'#R26C
|ZVF0Pj%/#
 >.KFnM
!#rXau
S?%_PcTX
w't{nC
7+1/F6T:1k\
H_2'Tj
Av$@#})}
bU(v 9
1BW!Y>
mz-.?l?V_
G9/0R=<6bq"@GTU
xBX]c 
\Md!Z<
>p?jG0w#GW3
N3Z41QO
eGCXhG|
-^VC?^
G]T^1i8~
l;5DJ
H`\W-+ObTWw
%Toey#eV%
b-20sg\GXc
3]M*(aK|8QX%
m+(z/u
&=C!R<qa
` *Jsr]H=
Y2wT&at=
"iamxdq^
`%O=8R
(w!dj^58"<}?
x^=KAnk
||lHiX
DX^jpK\
-~4q|&I8'3(
ZE?C`Veh
3wR}gk
[pK6s]AV
ZCY6UVsO/
S3t<=1
]?yz\"G+
9HN-45*/;
pDGDAp]
^a))CnH53
5^)CATVO?0</_[j2H&<
}U=m3}&k*rF
t#--A4
gHEVd`4#E}
)R oS4%
b;qw]:l-
366>Um
%@"s6p}
Mvr3>I;0
6;pUXH'8Af`<}
bwe*mp9.iy$r
GA^BVN6
BvvVLW5s/UhcG
#kj$w9UNv.A
riT%DY
IHXlc-jA~
"9 CZL
,k]/9kT^
1WJ*skDMZ5:
hL?7!Uo
DIdH UT
ps>CSQ/
$&<xJKu
-0<Yu/"A
(RTYI7D
zyvds|C
-AEf{t,e
~ru (8
?v#Q~>!vGnK
lVhyu'Hw
c^*[Jl*
DV`_wzg
*w`0N}D
iSv%g9
51Yvh]|w
Fo[x'(
xFuWu'
jLNz!K
LTU086.1
$cJc9DQD
=/l}'2
q|.tv<
a:qd[K{@|W
rkK|s><
JP23!&
/9]I0ld
&6TAlOp
;_S!~~9
_Iih\qKhr<A}Rnjy
vCCfQOf
S_*V.3
yc~<qnP
|1~tC|2
"{K=c`3QF
ezQ8=W4E
i|/UMP
nPbB k7
S$.}nD
Wpwz(9@
=rt+"(|=yxRc)U1_\x
)]Y?$F
G+d\$'
o#0ef,yO
j`(lo&%!lLQ{5=[]
f9A78-
pbFO$N6&
?o[d3c
`h]%z*
g/7!e ^/
vd;pUu
Bfbht;SH
G/GA7:
=kg\;xvgw6y
k^mchb^
`4dW-h
\r&&>{
m%R$pZ9vEao
z[m:)IgS[7
k.HR1F
\fRIsT"D%
TP"a/u+~H
Wd:>Vop
kBlcj#'
RN@>M{
uBUG(|e
&Qs0NL=UN/L*
Mn]H=<
Q(NkJAb
UkZn4X+"qi
%_1+H4
mp!E"C?Nnx%
4OK\d,u
qp'k~e8/
mag|&Q
yGgT:t`iN
5FV@E]2m{gjER
w.6co-
W9O#2f
i8!&6X_Q[Rm(
;H`t,\so=#\zY~
DZj[R(Xr{`Q}
E<Dmu:kn9@Aig
]c0Pp3%c
BI<Lv~
V*t%Q(
nT$c{[X>%o
hf90?[8hp
9}$S?e3
.d15^E0$J;
Iro;z5,jG
[K"X|%?
;C44%R
IG:DR>j7x 
[lvwKe
=,c0xI
nMol&F
@JMRMknNh
<&6RQ)kq4k
EKbMS%WgjjU
rdi_G8F
V[ge8@`jHt
}'#(8`
 V6=6E:]
T$4&4 L
p5opcN
0+kZt>ovx)2
EPvw1(
]-]5I;abH;
v68rzwYW[ 
0]!tg"X.uR&
h0*Zi"&-JSN!
*+f{cT)J)KS
%4k{AmFcF
G<s0vU`,dZ
(:wI$}%ROd
^]UY^.
g,pf_e[gKJH-|K(
?k[6?@o#!c
}[@]{XjE
^Cp;U0
C6:<KP
SZ+rr7W4p
50L[9gzm8Gx
k(:>Pu"[+A6
{dPZ,6t
pSvld3
1Hp7bsmunl
)MQ8g,h
JfQW~~%X%6
20lZ{9
t`]ZNLW
pb5?5$
P0#R#F]V
7P({,;pW\
)?O)v~eza#2C:<e}V
N9`|_{P:/m9;
$Yd%{~5l<
");U,$R)
ov[_VP^
EySJj)(-|{i&K@
YQEC|r!Q>C:f1
z>'t>%
9IIR=P]-
b2[u({b9e
?<PoR(
6^a?\H
)lfB](o{J#9
+"1M2w9[
mt2Vd_
E9U.BB
I#=4'2\
Ywryll
-!j>[c
Mh#OL0|_iO|a:~nF
Kriu)5,C
68UOr(8@>
4"v!NoJRs
~eBkls
96Ara_Hh:'>'s
(*?Hrt
@!ABVcs
rc_xu.8H8e
Z>7ypt;
#<T#D)Hl
//0ir,gN5M
,m11JQ
LZs<FT
>7'.>~+\k
`Dv?K6
}'f)@S
Dt88I}=
D3"q\/
<!,`(s
[^qQ}Sp
~utELPB
?JGTN7**@HCM<%y#O
I2.Q=J
"y[~Ql
{-9x?4
3\Vz.^C cfF
OS9XVTlE4y
re;v!hQ;D
M>^qC!
_(t`9X
JYLL}6)w
Q`)ZhN
YpXzBt8
^tTX!VXSUdp
9kcPtl
u6]O)A
~J29[?
Bhq"r|e
2B-u_<f-
QGSTg
f1y{8Y
M4^\q/0
E<:JqB
V;f<n:CDiE
]{X-d4yDzi+2+x6NF=
D/4[r%A
$01#ApPTW KrvJ
1i6|Yn[XVx7~aAbP5O
CQGD.c=n
WbcsNb^%7&< DR8HJ
)2=)<D
/iLJ!!)iR* >q
hn=Xt.O8;^J
OG7l1d
u}!9=PVEz
B|0f4x
P]{L2Z3
R {6P}
|+^h7Gq
dNB\Rh!xp
}r*XZ6
"$njl4p
}OaQ?RG
7H_yHse3Yn]Y_2s
^oTXtm2odd-
2A,|][
q0dE!$U
Gr$PZcFJ
d\Gx0MwJ
i)rf@6ePHs|RXC-
\%P/4"
H'ObU]~
`[;^=m
3yYK7 R[ 
p+w_n@M
5nZ\W&
VNnmA<
|>gUf1
JckXes
pFQ"\_
>;Tf]I*(;-a
_bUgz*U?{n!6=z7
j#F<oWw
;:ab6/?,
][2wbd,&
(+\FS[
7oq0oa[N
meOuChh
^Om]|{Jc
**^8]&Hm
dUHymZA.~&]e
L8<2}rZ@Y
{q=_)?
ax?'q^
FFA{DA.<VN
Td9_NlT3
dm"]1Gj
554>J
qC+)l{29
dJYou.|
5N|}1z%iHv<Ap
!rqrB{6^X
I^#GGq
{MZA5"n&o#lQ,7W
%kY5W<8v
a>wC%
i`w=9w=
9KWNF|
2{q$eG3
3QFhkQ
?W\N9)K
2x[VUoG?
dXHFi)v<
+\,X.r
`dKmdx:5
\m}k4g
;%fB<"?
Lr(~"%
Yb8zj,Pt|y
QbkNgPpm
oO37 s;
{p,:pC
d-^bzu}g
^_>U&H8
+UI$eV0h^
L'GT*e7Q
eDi:$[
D"Q,ar
r&QsHA
V;i0vL6%*
c@(2LCR
Weka}v
hqB:j_a{
`G)]<ps
$sO%bPE
V'">Q.r
fpKUr{}>a+G
5m)obD
UJRoE5+
*jzS\xux9i
&Y;DmF
%tg'z'
4Az&78,ZO7PD+>Cec09SztaEnB<IN
z{b+|9
KrbM8~ H!
g'+4+f_G-
d^d7AlJ%?B$}pddW
z1ATtoT
G9R`i1H)
Ghi*xn
C8MLP'
-v[HP%
(lO]x.Xo3xt
^u5Q+S
a<%6r#
g04!IrC_#+?uz;
q4\xb"J
Z1k wz.
sYT}LVst
e2P:='
1K}}C6sz"yp/|qK`>
^,Ex*{X>;q
Ikb-D3;~/
@0 :ccPS,Yk
TspC?Q
U\lTBl
m{;6w{(.Bx|88X],'c
#E%(o@c5
L8"1[":O
Ln$V|mB  
%24=B_&a-K
\O..%O}
nXF3_S
RWz#U9<
oihAzI
Q"K?V7<)
k#kc;Jx
7rW>Q(J.h
2elV>(
.n1Fn5.#
]_8^~sa&
/';KA*|
!<BcxU7u
\<PV63~KQ
R6ui^\)
8e-HDur|Xa+
ZJ2d:yxu
*`ZHd#
H!$ JIK
RE}gm@/.
}S6-s`
O1*7jz$`x,-M.
UBX80+HWS\0~A9wrZ`
x<=F*1
9m`#eXUp"9
dS@rHF{Y@vl
]D>y>O8gfcO
aio;_
DY'Sl)
0&$,a.#
`;}-uEmCGm<
gKj;[KjbFm>7
e_>@7
$WAU7Ei^_
gNCBwW
=,26CKs))
mVF<lUK;:)`
Ga%Fe'/N{5 X"7
Gb/i='@xHOS2*.Z
'!]*H'
V<bvH1S+K
;I1CVFPn
J)T~ro
g!KI-D
SqQbZBf
KA|P_FVO,98f[=v;
x1H(]'0$
@.]z2m
TVlvY&)o
?tE)V'}^jR
2QNO1f
-BKjjb
@.zjLWr|
ecPEv=]
7Z!73O?
2$zlZ&
b[t>{0u*-#V$;n
u"(&m09&NS\
Nozl,Uye"lG
HFGb^cU
Dhejw,Fk):[
QTwN|jq
<VhF}-Dy
h0f=vd?gT
=R|Bi<,vw
nTY*->m1+K
%%\j@s)Y7lhau>9K
TXq?AkS
NCNy\u
dGR[/Q1_
f\bZ^@w
N#h>g1cBT%*s
R`P&v{DAmM*
hv1waf}b-AK++
`eCU8JLu%T:
\Ml#jMDF[6
)2tFVM$p `*
l/l%Db7ru
67igo"
[9q&6G
?d{{:)p
}kRaOGi
V%r*[Lu<
)>yMo91(S;
u3s6*Tg9,u
zkG(xID'?@
L IEWg]
AUfGr=J&Pk
~?ehXfZ0:e
c'-WY&fc
t$ld6T3
s.S]Za
&p"wCStl
h[,xb6
vKt6y^
]EFFN1e5Brh
D&\y9@
`LXXg1+
UMuAa.E)wt
%A#{u$J>/U
w:JV\6%;D7iD~
(DquTw
RsQQW]hJ;~)G
~\f>DuXL<-Nc'
8Bg7@E
k/ h=x.
3j\1w*7n
a-\3sWl3
c7W((o
l/jY^i
Sye@t$
a09s0]g
%6E5?qqSR
8E+9)ei
y=11qld
vNLI~l,$
)ysM%le"{\j\
V~cY`>mW
JuEMr4Ah
*V:^,
h}7U@i2c?
y%fg`HHJ5
(_S/vYF
Q&#HW-_:
4VACuf%6
N<$qbAGwmH:l
=q36nnX
:y`y$9`
Iso5S!ph
(|Pbr$X
OhgqO->Ut
^2RQ)4PK
[ZJ0k)yQ.
'H^)<=
jjfkv(U;-vY
swHL5k
;QoBqvR6[-4
^`W)/*:@#
{U7U>Ee'pGTu
A&/-aL
<z-EG\z
q=Z'5v>
;[KVQ9VY
R2~y/cX
3c=rLq;=6
~)PlJ|(F"QD
'A=nB
tgbfv^t
pk6hxo6
3N[|c|l`
0f'hYqOHjM$o
nJf$T]
t+08Nx
G~PI_sgZg#n
aN-QdHE
+qB[|$hc
x3L4pG&
#-)ZG p
dH$@kt
[f6G!bWCp
]GgDfym,9@eQD}
{#u^?Uh {
k9FHZ;K
R!$p 9
pP+A}Ht4E
I+Y!*5
b@~:78H8E
<k-.Lph1GS K!V)a.^(?tu
U\^9`5.r
s'YOpQxdYe]J
2_BKD2U
;]mi.HgHwf
 XpnF/6<q
0+bDTQ
JgDAVQg/~Ca]
Tn$F?U
u5!fLB
bz50W@
H#(Qxj459A
%J<MLOV3
"u=au4
ZZPs|Mz{X3z?X@\
oF g4H"lv
iVG= tn
]}5mai'
%W4_6w
?1`mxu
cz?un|r
u$qQvj
#<;N}?4@
x:#q6=xpAr@
91be(x
;K.v}8
Sc**nM{
-Mv Ep
fQ`ZPO2
$.3%}.Vx
R"oBE' R
mlH)\+=
0vl~!v
Dp#r""+&7RHz'Z
r)2a7fAd2
GS?iMz
 [6P24
:t>@)5cz\?3YJ3r&Y
6K'gWbM
>'/$5jqrmz5
bcoQ3%6
#3~OFykj;N46*Nm[O-V
VV(0,1y5G
pQ4FT,UJl(%vi
S9wol`tV
8/x8Lcd+ [!g|
P<AlxZPXy
~}'?\Gdd 
@X@\-)+
KBWt";w
Slu5(/L
Sw(Rzw5N]
Tft;/L
b1b!|8$,U},1+
*k]u]V
tgQU>qQ
mc+Ptncx0
#jY1"s
<'5O_a
BWi&B!g
M4p\lY+h
(Gz2O@Y
LT%F723g4v^Vmq4<;
qk$?ZL
X!*iA^b*
B"R'7({W]ox+
/~b9mC/
c>nd?)
n}f:+j
(Z!-KU
+ps]4Hd
kmc%sH*
fWoLzo}*
X<5{a^
=w0J~*
bjG}i89yS
Nm$#q4
5T5SPV
H9(LN*6u
&{5k.HW
D?`|A/,
L6nZo5
Nei%^/>f*
ooN`xV
aOnnH#``tQ8n
|h[jsL7rg7{Q_C
]hxGRi]RA.#ZM
Gy,1ol
T9 w!a}l<@&*G
?E4/)U5e`
h,n,Og
7|$4m@
TS \}BN`>T
m289I,0XyM2
CbE3UZy
]@P|C5\K
dTK}#_
'C3i7*lkpp{<
,9rQ$\L.
JGIq}/
?7).8%
e[pW5F-8E
B~o(6a"u
xi:tS"V#D`N>~9
RrZ*KcQy-
<Wm;yJ>
xQzJlK
!N:qF$]W9n
9scnSZLq{
~-gJ^9}ZNA]M
}=<R\oGR
g!O=[k
zcOGO?:)t/
]MQ=yb
`daj)h
s=tZYF
=dzR3i
~DA<~H~M
l5PWYq]
AMz|H9<
uj2&9FY
.%WLC3 #
9 ))^GP
[zQNvQ-0F
D`9=_fUqT
AZ9yA<s
#Nn/BEd
4P+7+r`+#\\.
rY`KkFfe;
8z`f&Z2
n+Q}\6f+
F/TjGsDsg?
OV4@"#
*\L2tU
qWRmm_R
uO@bn!c!
W22I$GU~"Ez X`_I00~5<wV&Tv!6
/$TH$*:
+Z'Xqbw+L
'zD~SGs5c8U2
TA&#[[
M+@Z{U9ll
epZBWha+=RV!kh^L
pJQoGmip$mS
H0vRV?A~
^L(PLXF
83*p0c>b
y]z_@_&,@h
 p9z|(
2J^%Ew/
BRvK5PQ#\5PF@2JV"/M
Kw7/^9>N`
CA>;aAh
RTA^Can
SdvRd7W
}~%Mb~
w1e/f-I
L7(ry_;J
3wY#KZJ
z!{N",lb5,w
csAJ7OxX
AgzV\A
F|IX?lF9?,)3
"DG'+a>;
E`O}B=bI
fu[_@=+N
g?nKIO*\8&now
~THOB4
l[FB<,
(B:{;^3
laCDNF,;O03R
"!}Q$G:u/@a
fK&;|DR?
jn3{D
W,4,h"@
nAiHi-
S#?N6/
gX'2T7o<a+]Sb
xfHxRK`sI
o=u_X8{p
H[S'5gq57d_Q
F0yb}3r
80(&V&[9\ (UOc&uUOZ)\g
}[nJiM
y\n!&f"
76Z;hPV
J,o=kjE
89O+SZLd#(cyZ
Uj?Tr,kP5^y
>g0>6z
xud(R]
5H'#R26C
|ZVF0Pj%/#
 >.KFnM
!#rXau
S?%_PcTX
w't{nC
7+1/F6T:1k\
H_2'Tj
Av$@#})}
bU(v 9
1BW!Y>
mz-.?l?V_
G9/0R=<6bq"@GTU
xBX]c 
\Md!Z<
>p?jG0w#GW3
N3Z41QO
eGCXhG|
-^VC?^
G]T^1i8~
l;5DJ
H`\W-+ObTWw
%Toey#eV%
b-20sg\GXc
3]M*(aK|8QX%
m+(z/u
&=C!R<qa
` *Jsr]H=
Y2wT&at=
"iamxdq^
`%O=8R
(w!dj^58"<}?
x^=KAnk
||lHiX
DX^jpK\
-~4q|&I8'3(
ZE?C`Veh
3wR}gk
[pK6s]AV
ZCY6UVsO/
S3t<=1
]?yz\"G+
9HN-45*/;
pDGDAp]
^a))CnH53
5^)CATVO?0</_[j2H&<
}U=m3}&k*rF
t#--A4
gHEVd`4#E}
)R oS4%
b;qw]:l-
366>Um
%@"s6p}
Mvr3>I;0
6;pUXH'8Af`<}
bwe*mp9.iy$r
GA^BVN6
BvvVLW5s/UhcG
#kj$w9UNv.A
riT%DY
IHXlc-jA~
"9 CZL
,k]/9kT^
1WJ*skDMZ5:
hL?7!Uo
DIdH UT
ps>CSQ/
$&<xJKu
-0<Yu/"A
(RTYI7D
zyvds|C
-AEf{t,e
~ru (8
?v#Q~>!vGnK
lVhyu'Hw
c^*[Jl*
DV`_wzg
*w`0N}D
iSv%g9
51Yvh]|w
Fo[x'(
xFuWu'
jLNz!K
LTU086.1
$cJc9DQD
=/l}'2
q|.tv<
a:qd[K{@|W
rkK|s><
JP23!&
/9]I0ld
&6TAlOp
;_S!~~9
_Iih\qKhr<A}Rnjy
vCCfQOf
S_*V.3
yc~<qnP
|1~tC|2
"{K=c`3QF
ezQ8=W4E
i|/UMP
nPbB k7
S$.}nD
Wpwz(9@
=rt+"(|=yxRc)U1_\x
)]Y?$F
G+d\$'
o#0ef,yO
j`(lo&%!lLQ{5=[]
f9A78-
pbFO$N6&
?o[d3c
`h]%z*
g/7!e ^/
vd;pUu
Bfbht;SH
G/GA7:
=kg\;xvgw6y
k^mchb^
`4dW-h
\r&&>{
m%R$pZ9vEao
z[m:)IgS[7
k.HR1F
\fRIsT"D%
TP"a/u+~H
Wd:>Vop
kBlcj#'
RN@>M{
uBUG(|e
&Qs0NL=UN/L*
Mn]H=<
Q(NkJAb
UkZn4X+"qi
%_1+H4
mp!E"C?Nnx%
4OK\d,u
qp'k~e8/
mag|&Q
yGgT:t`iN
5FV@E]2m{gjER
w.6co-
W9O#2f
i8!&6X_Q[Rm(
;H`t,\so=#\zY~
DZj[R(Xr{`Q}
E<Dmu:kn9@Aig
Ur(!e-}33
~#97e^&9"L7L-*D[f-CUj
{ZBmfv]QcBQU
iYN\\x2}
_#@ztJ
Iaf]a#rk{@)BE
U9,s~w?
=F$cy{is_07;
,`7uuF5he_
=;s9fc%$k~
[4N22<
{&])VBJU#& 
tb)27C0
q`c$O<y
Y_i2Ur<}
@65wYT
4(4cIHF8wf
{uQWx:2(,
`z!.~"d
mwcw5CMmU
iz7#2P
Ua?<t*j4G;1cZ
iD/X@E
%z!q8ab
wP!F.O
5)iS-@Wpij1C$}#
M2z}K.
uj'TlC
';h/k3
w8^ F2+E}
Z2n*L
Gw s&P)T&l
tOb-U[<4xVb
7Q}{bv
_)@U<WF
jA[El@.
E8 pYyX
S0|L6?|s&I`*7
*JCYNh
:(.y.6D%T
vICJZDm
C~o{!{[
wdq=B'\L?;^4kD6
|QSoX'
 DLN[
x<9O\[o~
;JuTyvw
g]RB7Z
(1|{R$
zeF]cFcW
b2pW|$8
0PogsCgd
n$@@2>
IJO#?,
_K*B@W,p^~9`
1(Uw&>~YmWx)[
7W${Mu
./ZsBb{
%@RM"
#79AJ
R-33~/
`T+L#l=m
T;w-^e*
zYf<=WQ)v
~,?~T0Wt
0N$v2I
1ABHb%h
5#LEl)pM<+a[
 fGJ3hn9X-"
TQICc:;
%MBMT&3@]Lj3%
TV0UHZe
Ao<lDB/[gz.PY/h1H
z%;6y$/x
Ii@/u(
9=VJr~
$tHe)fHf@
ggUGdwu=F
"92=Z%
c.;3Q.
aC_GsU
tQ#GLHK\
b|;(zD55
4rGVP*
T)|V3#.
qYb4*2
\umvtZ
y<86{tfEG
KpC;6VUA
!y/Gl(
[X1Y)$
FxQFj3q
hZ-~WP_]
+TgvU<
K[o5?D{fB
ZFjWXG#4qf=w
OA}2XOEbfy
zcA)I4mc>
TpX:B6
bz#MM*(
%[B!41tmJ
Ro$.9YJm
c+'Dp8B
itPd'.JXx)
K&q@`?(F/7o
'-4QR]"
|+)\qGY
'buX'ak`
Py8vr:iR
L]x{)o3IbI6+
^MB/~1F;(!hI
,:2U4vj
[;CV&&
Sv(KYU
f"v$-[b
'+GAz_
P3DH$
o@[v4!`H>
Of',,,
Yp>WW51
haj1M`
V6`b:l
RL*J-+
?P@>Hf
qxr0^:6
uyEh.U:C/(MEFF
1*aa85?gQ4I 
SzgzQ5.
W02}M~\~Qs
z:~BE b=P:NQ~u
%tK$kP3
b{%`i /^O?3
9A+?e*-N5
pi>]+z:
$)ioIsCCl
K[]IZL/t\|
K=_/&#l+
]iS#duZ?
3x]}6\x8M'
lI*7`$fp*w
n^r`<*^sZ(
L*B6RMCa7/jU"
K(Ws{t6"{GVW"WaM
QY,#}hB
~ti<#<G49
5P!4SbT`d
a>c!KI_8v9
SC;N^-{zz]
t3M~0w
fpsTDZ
M0\mSh<-lU{[Z
DyI@e7<
G%**dBl
O}%.(A
a4 N}EKKE
.IA$w,F
0/kPgY
s>Sqa7n"K
 g>Ke:]0m
m_q]O:1L7V
bygscC?rJ
7~w0fHeKU:
yY-Qpo#sT5T
N*^UM6S+^
9Q?i=1bdtmL^
LNExjs
5gVMdcR2+|y
:879.8![iw
 #NWS.+Z7g+
6S$;e]9
IxC1g
GANc%0~%LM8T
yFtm'b&
k]Q&WC
".wH3H>@
Rx?(EI
/?Se!C
^p8D=QY1`*e+}y
pfte1R13
XA[9=\p
%s.BN=
BO%g)gG
5T40"^5W
hD_w[pUPWGXg
4aT{D!R,
h:vwLh
=:p}XMv_
r~z1_`5L@
45J-o]=~
L8#;{h
^~Qs#<
<`kMY41w:5Vf$l*
l-.q.;
"2Z<i*xy,ADK
|u~_ !"P}B
X9^8Wxn
e#bSzt
c]\iU:3J(DoB
T8u=^c
0AQ~TTB
"Gc1m#
a6k~'.*
f8qs+;IPn
svzAHtZx-
x#kRad}\5?^i:
TQs,mQb8
< n.8Zl
nav*U!
zXCz{LXX,nH64XX
csHN&5/"T(\5
f9)+lZ
Skx8Hd
2QgJ>Ejn%
WK,mrd
6<}BY5)5?)lK[xd+
n|9 [g: %E'V
tC0Vv:u
Mb~obyw}/I.0o
8{h7&E
<'-a@TX~
5LRQZvY=rj
QCa[oOO\
-=0VS?ce<
|)8O>j
]>|Omk
XJjUpF7Ff
-EIY26?F[0
r-S9oHV6
'D"OPSYS
#Y84^&#i(WTk2OEX
s/{% 'WxH!z
f[9n^B
^poa-j:
I"6q$'0Q
-31TFNBly`^M
SyhP+6
uTdD7:J
qgI4dE)p
NIxf.Z
A*R!aU!8+U(<G:)
T0FF8$9<ulr
XxF9XC
cHBT% .quV}<b
PM8r`'.L
w@BKb`@/G
&"O-ce_;3NpB+pC
mzpikA]
\ I,.D
7Ti'^#s
)Gs'ap
4hD+y W
%F:;"*dN2K7
A7MVAi
FgW$Wf)
~GIUGHNI
3H7DKz
*#; ENI
i4/rhr%6^O
jFzC/e
vEOhs=
%p3nZn
_oei5O8
S. KqG$
^YERZz\{J
9)Mh~g
]~ 57NF
KxW[$c.&?i"n
SM9=PH=
1={Jfjs
c~p1 f.5%4d)4\1
:9&"GI[7_x
f[GQW^
;T`#'{OCJ
l>("~/
SKEO/w
-=2c'6
';{N2&4QA4}b0CW
VBQm7j[m(uS
N)s19GOFR
[o^2D^
i7,\*!v
n3Oh;f
>8+)W?
o6>8Yd{
Cy1p4-
 Slv)!
.mzC2S<,i
~fsO9uL
*hf&GS|
,5cxc*|S
@R+y+rvG.Er
 KMfr>
D4UTw{e
3+a5A^#7Mv.n=
f2wI16
:G4B/n<(2rtZq:?
9s&|5|
53ma-E
QKi<j7g80B
r1hV.{Zrv
nBw%~M
!r[W{[_
5a;Hxh \KfF
Lm}8Bv
-JAoOGy"@ANqu.
uvl_VRM
-z)sv4<
7kHR8z?`FGli%
nAKJzC
*8@QsH
9scnSZLq{
~-gJ^9}ZNA]M
}=<R\oGR
g!O=[k
zcOGO?:)t/
]MQ=yb
`daj)h
s=tZYF
=dzR3i
~DA<~H~M
l5PWYq]
AMz|H9<
uj2&9FY
.%WLC3 #
9 ))^GP
[zQNvQ-0F
D`9=_fUqT
AZ9yA<s
#Nn/BEd
4P+7+r`+#\\.
rY`KkFfe;
8z`f&Z2
n+Q}\6f+
F/TjGsDsg?
OV4@"#
*\L2tU
qWRmm_R
uO@bn!c!
W22I$GU~"Ez X`_I00~5<wV&Tv!6
/$TH$*:
+Z'Xqbw+L
'zD~SGs5c8U2
TA&#[[
M+@Z{U9ll
epZBWha+=RV!kh^L
pJQoGmip$mS
H0vRV?A~
^L(PLXF
83*p0c>b
y]z_@_&,@h
 p9z|(
2J^%Ew/
BRvK5PQ#\5PF@2JV"/M
Kw7/^9>N`
CA>;aAh
RTA^Can
SdvRd7W
}~%Mb~
w1e/f-I
L7(ry_;J
3wY#KZJ
z!{N",lb5,w
csAJ7OxX
AgzV\A
F|IX?lF9?,)3
"DG'+a>;
E`O}B=bI
fu[_@=+N
g?nKIO*\8&now
~THOB4
l[FB<,
(B:{;^3
laCDNF,;O03R
"!}Q$G:u/@a
fK&;|DR?
jn3{D
W,4,h"@
nAiHi-
S#?N6/
gX'2T7o<a+]Sb
xfHxRK`sI
o=u_X8{p
H[S'5gq57d_Q
F0yb}3r
80(&V&[9\ (UOc&uUOZ)\g
}[nJiM
y\n!&f"
76Z;hPV
J,o=kjE
89O+SZLd#(cyZ
Uj?Tr,kP5^y
>g0>6z
xud(R]
5H'#R26C
|ZVF0Pj%/#
 >.KFnM
!#rXau
S?%_PcTX
w't{nC
7+1/F6T:1k\
H_2'Tj
Av$@#})}
bU(v 9
1BW!Y>
mz-.?l?V_
G9/0R=<6bq"@GTU
xBX]c 
\Md!Z<
>p?jG0w#GW3
N3Z41QO
eGCXhG|
-^VC?^
G]T^1i8~
l;5DJ
H`\W-+ObTWw
%Toey#eV%
b-20sg\GXc
3]M*(aK|8QX%
m+(z/u
&=C!R<qa
` *Jsr]H=
Y2wT&at=
"iamxdq^
`%O=8R
(w!dj^58"<}?
x^=KAnk
||lHiX
DX^jpK\
-~4q|&I8'3(
ZE?C`Veh
3wR}gk
[pK6s]AV
ZCY6UVsO/
S3t<=1
]?yz\"G+
9HN-45*/;
pDGDAp]
^a))CnH53
5^)CATVO?0</_[j2H&<
}U=m3}&k*rF
t#--A4
gHEVd`4#E}
)R oS4%
b;qw]:l-
366>Um
%@"s6p}
Mvr3>I;0
6;pUXH'8Af`<}
bwe*mp9.iy$r
GA^BVN6
BvvVLW5s/UhcG
#kj$w9UNv.A
riT%DY
IHXlc-jA~
"9 CZL
,k]/9kT^
1WJ*skDMZ5:
hL?7!Uo
DIdH UT
ps>CSQ/
$&<xJKu
-0<Yu/"A
(RTYI7D
zyvds|C
-AEf{t,e
~ru (8
?v#Q~>!vGnK
lVhyu'Hw
c^*[Jl*
DV`_wzg
*w`0N}D
iSv%g9
51Yvh]|w
Fo[x'(
xFuWu'
jLNz!K
LTU086.1
$cJc9DQD
=/l}'2
q|.tv<
a:qd[K{@|W
rkK|s><
JP23!&
/9]I0ld
&6TAlOp
;_S!~~9
_Iih\qKhr<A}Rnjy
vCCfQOf
S_*V.3
yc~<qnP
|1~tC|2
"{K=c`3QF
ezQ8=W4E
i|/UMP
nPbB k7
S$.}nD
Wpwz(9@
=rt+"(|=yxRc)U1_\x
)]Y?$F
G+d\$'
o#0ef,yO
j`(lo&%!lLQ{5=[]
f9A78-
pbFO$N6&
?o[d3c
`h]%z*
g/7!e ^/
vd;pUu
Bfbht;SH
G/GA7:
=kg\;xvgw6y
k^mchb^
`4dW-h
\r&&>{
m%R$pZ9vEao
z[m:)IgS[7
k.HR1F
\fRIsT"D%
TP"a/u+~H
Wd:>Vop
kBlcj#'
RN@>M{
uBUG(|e
&Qs0NL=UN/L*
Mn]H=<
Q(NkJAb
UkZn4X+"qi
%_1+H4
mp!E"C?Nnx%
4OK\d,u
qp'k~e8/
mag|&Q
yGgT:t`iN
5FV@E]2m{gjER
w.6co-
W9O#2f
i8!&6X_Q[Rm(
;H`t,\so=#\zY~
DZj[R(Xr{`Q}
E<Dmu:kn9@Aig
9scnSZLq{
~-gJ^9}ZNA]M
}=<R\oGR
g!O=[k
zcOGO?:)t/
]MQ=yb
`daj)h
s=tZYF
=dzR3i
~DA<~H~M
l5PWYq]
AMz|H9<
uj2&9FY
.%WLC3 #
9 ))^GP
[zQNvQ-0F
D`9=_fUqT
AZ9yA<s
#Nn/BEd
4P+7+r`+#\\.
rY`KkFfe;
8z`f&Z2
n+Q}\6f+
F/TjGsDsg?
OV4@"#
*\L2tU
qWRmm_R
uO@bn!c!
W22I$GU~"Ez X`_I00~5<wV&Tv!6
/$TH$*:
+Z'Xqbw+L
'zD~SGs5c8U2
TA&#[[
M+@Z{U9ll
epZBWha+=RV!kh^L
pJQoGmip$mS
H0vRV?A~
^L(PLXF
83*p0c>b
y]z_@_&,@h
 p9z|(
2J^%Ew/
BRvK5PQ#\5PF@2JV"/M
Kw7/^9>N`
CA>;aAh
RTA^Can
SdvRd7W
}~%Mb~
w1e/f-I
L7(ry_;J
3wY#KZJ
z!{N",lb5,w
csAJ7OxX
AgzV\A
F|IX?lF9?,)3
"DG'+a>;
E`O}B=bI
fu[_@=+N
g?nKIO*\8&now
~THOB4
l[FB<,
(B:{;^3
laCDNF,;O03R
"!}Q$G:u/@a
fK&;|DR?
jn3{D
W,4,h"@
nAiHi-
S#?N6/
gX'2T7o<a+]Sb
xfHxRK`sI
o=u_X8{p
H[S'5gq57d_Q
F0yb}3r
80(&V&[9\ (UOc&uUOZ)\g
}[nJiM
y\n!&f"
76Z;hPV
J,o=kjE
89O+SZLd#(cyZ
Uj?Tr,kP5^y
>g0>6z
xud(R]
5H'#R26C
|ZVF0Pj%/#
 >.KFnM
!#rXau
S?%_PcTX
w't{nC
7+1/F6T:1k\
H_2'Tj
Av$@#})}
bU(v 9
1BW!Y>
mz-.?l?V_
G9/0R=<6bq"@GTU
xBX]c 
\Md!Z<
>p?jG0w#GW3
N3Z41QO
eGCXhG|
-^VC?^
G]T^1i8~
l;5DJ
H`\W-+ObTWw
%Toey#eV%
b-20sg\GXc
3]M*(aK|8QX%
m+(z/u
&=C!R<qa
` *Jsr]H=
Y2wT&at=
"iamxdq^
`%O=8R
(w!dj^58"<}?
x^=KAnk
||lHiX
DX^jpK\
-~4q|&I8'3(
ZE?C`Veh
3wR}gk
[pK6s]AV
ZCY6UVsO/
S3t<=1
]?yz\"G+
9HN-45*/;
pDGDAp]
^a))CnH53
5^)CATVO?0</_[j2H&<
}U=m3}&k*rF
t#--A4
gHEVd`4#E}
)R oS4%
b;qw]:l-
366>Um
%@"s6p}
Mvr3>I;0
6;pUXH'8Af`<}
bwe*mp9.iy$r
GA^BVN6
BvvVLW5s/UhcG
#kj$w9UNv.A
riT%DY
IHXlc-jA~
"9 CZL
,k]/9kT^
1WJ*skDMZ5:
hL?7!Uo
DIdH UT
ps>CSQ/
$&<xJKu
-0<Yu/"A
(RTYI7D
zyvds|C
-AEf{t,e
~ru (8
?v#Q~>!vGnK
lVhyu'Hw
c^*[Jl*
DV`_wzg
*w`0N}D
iSv%g9
51Yvh]|w
Fo[x'(
xFuWu'
jLNz!K
LTU086.1
$cJc9DQD
=/l}'2
q|.tv<
a:qd[K{@|W
rkK|s><
JP23!&
/9]I0ld
&6TAlOp
;_S!~~9
_Iih\qKhr<A}Rnjy
vCCfQOf
S_*V.3
yc~<qnP
|1~tC|2
"{K=c`3QF
ezQ8=W4E
i|/UMP
nPbB k7
S$.}nD
Wpwz(9@
=rt+"(|=yxRc)U1_\x
)]Y?$F
G+d\$'
o#0ef,yO
j`(lo&%!lLQ{5=[]
f9A78-
pbFO$N6&
?o[d3c
`h]%z*
g/7!e ^/
vd;pUu
Bfbht;SH
G/GA7:
=kg\;xvgw6y
k^mchb^
`4dW-h
\r&&>{
m%R$pZ9vEao
z[m:)IgS[7
k.HR1F
\fRIsT"D%
TP"a/u+~H
Wd:>Vop
kBlcj#'
RN@>M{
uBUG(|e
&Qs0NL=UN/L*
Mn]H=<
Q(NkJAb
UkZn4X+"qi
%_1+H4
mp!E"C?Nnx%
4OK\d,u
qp'k~e8/
mag|&Q
yGgT:t`iN
5FV@E]2m{gjER
w.6co-
W9O#2f
i8!&6X_Q[Rm(
;H`t,\so=#\zY~
DZj[R(Xr{`Q}
E<Dmu:kn9@Aig
+8@^VPlr
>!8/N4
_D|o@YH+
qMAcDq|
?>>3tn
:5E7cg)
{UoK^JXQ
WG;)S 
vAVTGDCt
w(9jxCOUH
SG[n63,_=p~z[
tZQaJ#!c
:YE2129Dm9e3~9]5
MX)`q3U'=
zt:5oP78s2@mb
 Nl38MAv/&L oi
6y<MYFGf(P';
MW),3A`T;Zmko;
4"|E>&{q
m2FplpkR+o60
bjs_:w3:
Bs-5ABdV
-*MZm[
#S.;yM/5A0?
%Y;fje
9=ta<b#$
,k5;P}Z\[h
4Bk%m;ge
4>Q\,l!egJ/[I`Qz
apML2[.1AeI
#LY*T+s
;^Uhv+
IcBLtpjb
@YBh}Lz[6]
!1\awg b
H*TFCRlLnfA
Rh<5qoH?
a{qI%sV
4h:ev}8
y$QbOI5?fW*O
Cr&rsJ
L\y/Xso|L~*JS3
 1KF3#6ua
6'70[%
2>iZe\
)4fxqF`
U8$8T{SiO
%IBMSOLe'(
RjN.KrT
C3D}m%
IAOv[e
Eg9l(b
kij\L$c!JHa
Xff^gHB
V_`Rr\b
nhWtQ!Q7x.;';
xPW44%YT
bdf5rQ4t#
P:4O2GN2L!bb>Y@<B
B,a".3\XZrs1
?I7*RGN!E
I)$N:uX
W`V')\
kV9{|P
,#Kr;N
:(N-B'
Qo4^a(t
-t#|~%m
XR"{*>j_ `
Hv.Ckx9W
cwyh~[
41DkRI
[!f*2M9
S%-nKm
ybvmMsP>hN}`4
kh+\*xo
bu<URH&H
LVm;~x
fte5/hQ
B:[Paz
7 Z%UdW
L'Z[T+x
Hou0O4C
/);H2Gg.[
cf:}8z
7n0/'E
Gx(]2c1.wK
&]peO>
?hj_"@*m$
U2\RZ?22
@)!q\l
J"Gp*!u
lx|)E;d/r%8
qY3gQ;
UBxJfZ
,ChTF6p
wtq+4h
wC6`H5
b_hNVI
a^i'R[;
5ps6&lk<t}'X
vr%||:(Q
JvyQw7L2MZ
uLzCCNw
E9}zfH1
w=@;Yrc,X
Fmsuf\
XD7lO@!LRHU
~12Ao%
%Z_];V%3
&*N-Hh0p_W
|$Yeg.;
`e??o0
Pyg6DuhN
_vw6]+
*I}~iyf+.r_+5ut
tKV*m4ZlPt}tT
c02yvq
&P6io9bw
meW<@.x
q3`@VI.
{p6j+58
.2tnLY6beLi
hY+\8~8
pF$`{ZC-
~qwg(5`
_QD#Hk
GygNa
+&jV4:
&f}X~;
,-:>KCsVSG
X2g~P-
gIL5Sm
q]1wf!L\%Lz
f83,>2cxK?y
F*Z|c_^se/
6>>5$d
X8eE]c"9^
C1G6c&t|$
f@(Frq
t5E?+}
<rQExh
{gkt6"fp]
:eDUYkN9f
(nA%ng%xF*
-La4{&S9+k;
UuB (:1m
l;`=BS;
4? {~k
U%^ j+
N$*o%"<4
|`[zms
u4vIu&*W$vE
mZNmJ};
(x B^Q-
A x+r05Y
JOYFyXp}
S4\CT/,6AN
9BH`)MKBYlR
NG)}\^M
(#`"8LP>3r
y~`l`.
RTQNRx`
+hci^C
{a+P.DS's`
T(%6qoP !0Fa
%qwYJ#
cho(5;wYY
`fZ/=_7
j5RT,
O9.ez/z)|
_rlS q7n
DFF_J,
=)w5F(3#s>$
-z<iRz
NWru|A
;6shA#[
tqo4L/
OhY~M4"o
e"_"V7aq
-S`~-=~.sDE
2*JgTi?Rh|N&0*
^RCz{K
`R|#$o
X)7X@7b}
V<HCs!2
=N9rv|
}bEo+rw
K]`4]u
g'wc]R}
oPzS<s{&
Kn\doV
kHsHW75;a?
b{CjLp
Zkj9P@
ZLMJQ-
o/\Q)1
^\.n{aZ
5Sj%f,rG
s6sVV4e!
+!b4ogI
0n7SPR
^?2PeNe
X^ynYokJ(oHv,V
<dtpT8
&*.3n7&>"}|
Tz9dM+q<
EoR(""57
7/L.&*1
J%\Vt#mo
tRiZ@t
C'6ia?
{R99~mx
_Vt{A4.rK|%b%=WnjN
wx:"3T
54z^g[h*n[09r
V&GvHL2,!SN
 BI>8G
-6;b'C:9
5kkmr&
zOa81|v
xH(k6R&
*HUpko[_
&_/18Bk*lqb
*^T7"/xM.U*
h+MzVfFwV3^I
31n{,.
a_,<BI(E|
6s,)LN{N
Cj6|LE
GF&/o=
719b^t*
'OY4t=-64A4H]2
#wP&B%w[W>FBhgo1'
IQ`!&F F
ul+Z<M@pr
{pR)K,p
`+MTsP_
$bp+zL
E' A~c+$
,OAetWS
L%;x!"P
@u?QIS
Sq#gqC
>I-Hqg!
<O%1N/6zs
w4gB!<Rp(
Q2.M}&a
{-oGJz
~ELm@i
>@uyk5
?1IE-Y
`B~K;Pjidi
m`bw . 
H+?\eT(qa2
#M^5XI$71KD
(6#%?Q x
=]4VW?G{
qrP)Jx+~y
?}-btXM
z,>Ow9V>
jD|?DS
!FZLh(#wW+e+
b&3j?$op
I0@Ql
,ZD[<h@h
~C]o!$c4b3
vh[@&Ez-
eIKkZ
.;Tp/d
>Wo |L
5qA"_(
A.u(}R
J"cP=O%
##Notr
}hPb@UV.8w
~G<HW?J
K2@(K^F
' + BK
"#Xk535
/FEu;f
J97Wf'@y|,@Z>Q%Kur~L0F@e
J|a<z
pd;iOH
EbOK.g
Khse@]L
S5'zr
9[0_zWH
~>UzE*>
aK0/Py@`W
a>\33s-
x4e"^W
2$hCB[
MO<u.`a<
,rK,/7*@b
eJ <mH%4
:c2rwmHt
_`p+vs
{2fpRs'+
Fl<b\$yGO
]1]!]Fe{N
I%VY@5\qp
:v!9Ep
~>AHOn
V#M8+/Dj>
HPj1-FL/k
/mz;mJ|M;N
JEV^wXi
zrV@55Oz
g4?Gc}kH
6B;&(KvNGVQ)
h9|(>TA~cP
?cE('>}ZD~
S%"j@%2103?;
dz!DcLl
Lfeqi8Gh<
8\u$my)n*ONT)Td
iOwK.(R
=DgZv">G
LuJf+@+NB_
E[~UOvzy?/km
4tsw(i
A@A;_y'<u/
o&0xePH
]E;Xru4~;3t
n9g8RY8y-C)1H&Z
Rj0$+i^
>CfOn)y
2s\6JC
44l4'7T
E4=wv$%.T
M<XUzI,"q
#~H'\BiiB
zR,pUNeyR)~
1'^1,H0
KyR+iQl
w('+$6v,`_
mP\5XW
-3"xV9K
BGmu[A
mB$$`lu
2B6(A@!7w
S#.CwG 
"g7?p}
AFHc[[
:*sbJp!{jJ)/
x.~w5b+G({
}C!+UdT'
ZuBn/r{
XhQ"<Jq[pP
M24MH>va?EwG>S
q)b6)
Q oA.60~#
%$B5b95S|w!
Qie[>.ot
7=a\P8
JvU"\._h)
|Z;k"V*-C
,C)LIx
_\ Io1
dQGDvH
Q3>_[<nq^
XE`\NY
KDQ5N6
aoxevX
[VI,i_W
wR!iAU{
8DU3Qd`w
_)q 5(tCg,Z6Rn9p[n=[$rry%
*A`kSN3kNn
CG]WJjGT<$e"
b{Np)Hx
ZCqmdj1B
%WF e-
F8s4!7
pvDSOb
MuH1`>Ye
V~xaE6
ZKy$H0
Jf,HTxq
 w6k%]
{ykBk+$1rxW$%
_eo[\3Zx U>w
):sH$U*l-
Yl*+ZJ
W1]^xyv>
xSAe/D
_G w+<:5-~BW
}uYz)mg
5ep<@io
cY{<;n
TaqA}sY9
p3/ckU
E*ZB:`<
]/2)d,
S%k,]0W
,5HQ?BF6;
l?,?C^F&
]0B96UTQ4
aC!twbEub#fiNyR
toa/3b4uR
Qa(@?+T
FIXa]6|=1(Ex
6R[F2mo`2!N.!?C
bL^z]>}A0sdtl
|2r#j~_%Q4vP
k{0~wRX|
@@pQKtoz
}4tW$y
PCE%Bw'
T5?B4E
Y!%a(p.
ryyB#]a
"@-)%1
5Z:WxJm
|zm6B`-
G#F&i+
%}>l0_~'~
QGoA!%
w/ubXr
)w^Q|^CvPy`-}/z5nL_;S
e<;K*[u*
tVE8Awl~2/B6)
USJS,&"_
 S_~|@:
G,55C@d3d]18/%?
Ry{^&<q
"*TGyW]r=
T*kNXs(c}='$ 5x{O73G
=<FC#$
M$~t,1
H}MF4P?:mD
h!+D.nT
,[$g3Q
op?a,5
vconor
tpS7sa
;9@*&!^L
#l-<t&GOq5tyK
_pID:n
^\e}.u]4
)qVg\\RPPS3{
S,2er"
QqA#vsd
+A^|P<
< ]G&1{
,;Z|Cn*k~
Bj'yKM#N
O^_r>68>
554;\y$R2
'',}8@Qp$"a&w{A^VF
NYS,T_evCE)(4J}.Aqs^u>o!
BzUr7X/sT
h]qA0>4X9
W~8>a
Q!E6J#ry?z
~NL'u^
X!{M](`@
UH3Wj+G
%y<W+j
^_`]mx4bx
nuU4G9p>*VA
85[zp7<w21K\
kOAQtrTZ
(dEhYc
z2MTi0?{{
fP.nLvhq"
sP#g30V![>
r$Z7?`V
q{h,c\Fr:_?G
piJR#"e8 tSDZL)aDNsv4
*k]&Bs{O
P`o;)~5|mb't"]sR>@
%![6+_/qi
;^+I(O
tRv(i*+l*
]u%kk4!*%
MV?J!
7~00IJ7
b!Hhf)zI
yWEIsg
3b42XBEy3$
lzD'\G9!
L#1(3o
H5h4_(
QC9JxlD
~AjQ%&|g
c7P]'%Q
}.OWqY
<@v-P?
2FN|=A6y
I8\' }E
 Q/TD+n
S_b?M7
n9[[ELJ_
n^RFhsO9iS
Q8B5dkrwv(G
X*@7G"T
m"Bp8-^
C@Crv/U*Fk
!hbO/VXf
crnIl?ZG
|_K<.o
6F^<$Sq
OY[BXoe9
S`%8A4
8([0BLM
OMzb3d:j
`v>26s
pFP4U>Szz
"&l;W(
b4H5p8sw
aQ>Ef3b
-_B$o\Qn!
v>7Ngz
t5Z+U\,
V4=u^1zA
[;5y_6dKH+y6V[
oNJ$9s
NIG%~"|8|
,|G-mB
'N#+>F1\
k2w6NW
#[/D]{LGjmu]
Q%wUi+D
C?yfN8vYM=iV|n
8Fj-pH(1
C'^,T??
6^$UB@y
]w~GR3I
?)~uz^Y
"c'*XOq>
b'^\rO,
JJ;-}x
y26AKf
D"2Rc#>|>5Ck5D
d}9]!+2
S>SCG'
R`J%~1Gd
OyffF>
J<>tOh
M@J6 a
*nVeQ&^Yic7YEL
5a{6?x[b>z
6:Y*!5>w;a
<CD75O1:"6/
Y+&)'EfS8#(
+CMpxTAE)q0$,!V
9\hYrp
1p_GVmDzl0~
7:gRXnp
E{L>sLe_
1s''2P*
Z<P/oRbj=f0G6
wpVYpg/
|a"un$p
NW|,f_+;
F/9`t:U!|=z?
qOVeRA0w
b^CUNaD
u(b`Kz!2Vfp&^
~T*_&D
285V(S<PKGy
6Z"aaN
; |VZ?sN6Q
X{7n]u
LIUZOF
/|~NXsk +.
Ni!ZZ
[4B:FV0 _4\
&L%C|@
dLa.R4,
6QVY(!
clKC_m
r])r'G%
N{g&e1k
/tvG+53sn
sA^[>b7xal
?C{t;p7.4voN
i#E%4W
[Nj$G)FH
uz;#R'y`vn
<+wT,#Rare8
#=J=xoO
Nz`nL$f[Ez
?iCJNC$*+
$Xy5"cP
=o-tfZ
 VE:':~
U:"8q>
=)DFi]~\`[l
RP6'E5
^,^/^((y[n
9pE2%g-XUGTdHP
0:3e!b*L
x}W>Khi ?=D
$m'W=+mR
+Y|;(e
<?OTPj *
EtEfFVV.em5
uTVjL?zC
ABN(.(
a'-WLKo
./H(q/uvc
F`$q"\
(*WILi
2/9-?#
uSl Cd
y>UkR}
\_[*HCMNW`
%>U/_tP
sy1M`UJB>
"_[8w8Yoo
;3"w%p7g
\S$LqZ!Qc
>TLZZ'SyY3
2>Y(b|8
d*OU}y@
m?re7(a
X(~9^M
T'D%,|#rg#
qo!_!t
1k!MCx]*
>{1,HcXCnh?X
0VoRBpS,S<.
Xi;7[-
_:'!~`cY
]9tCec0)3C'"]hQ`
b>ma,5
Rji[l0>
:;+if[T
X/s]`q5
Nm\p-~O=d
}mqe,GWxf
]:\oF{f
cP(D~-
+,CZFg3
!%[Rq_dlX
zs/0;M
Q\A-JG-(/\:=K
gL] c;G
_<|:>.s
>fi[N{s-2x
OQ-8{ 
>.Lqj6
<{E/gv{(NhPI~
i BU_99
#:aVH^Sz
=l\Q-#
3zuss3>cR
$~?+C;&
&*kke=
Q&pw]<p~K
N1uk[)
kN?WpA{H
"4`yr^#
-j8D%r=R~0.]+
"][S1]e(1vA8#Km{
_"1`y$mqQfWW
otX~ilBa
}?+Z&R
i^X-mQ\3
@vba3I3I
vO;TjB;s>9
)b1wl'H
NNrmiW
#BPD+}9
61K:.=
<%bzno
49^mkJ
wp+:ljnv7=
"w8oW7
=?\.q}UH
t _Y2,-
u+l<a25p3
bGB,$w[
S':ela9 Ix9qqHz
x/IqEZ0q
Y4|y#HK
EIF|4D
1xG !7<^7}D
67isvHI1
7G7ZVB
0I2V;A]S_uF*
}}gl$d'Z2xp ^9U"3
b>y2.KWe>
8XO5VV
{Su\BbQ
*f4v+[
(9kW<h&
@N~{O #3
G"S4/<c
l\625#i]/-6
Y_xcki
YAq3x1
!FL%N6;<9c
@3}*sdz
5Q"YPuVGrR
J!dc:9xL>
%uii<L~
-IqQ~O
&sN/br
H@3Ha[
jUFX|`[
l!"!:ElXH"X2
n?XEu}
dT|`SQ
+14L;7>^*deyoSgGCZd;ll.
.Z(Y{j!2H
N~lO#V\
F_B(|0WdQ
Gl^D1P
)vq}!`e
Q\dDV&mHm.9LY
hMw%/kU&
M>{Z0q
hrI_'/
~n!Z}#I,b3!Zc
]5jsMj{Pv
ZLKaU{
CpIf@8
jj1vHJ]624H%Ga9
yWUVOu&6I
gTWn^C5 "
X;Y:QU8
iXe|Sa_
F*@jP&C:5T6 ]
'W!0.{ ?<8<>
iHJ~b1
}ZjJ\>(d
#C1nC<%
,a8_*]T
?L+E5 U]
}Qw081r?z
)k1>kYAJXs
cbPm3%
kTf bB
W)@?6AUG(
]$)m]EASTfQA
'[tb4j,(P
**|}BT^
/D&\/m
Lp|f9+
i \_4k
=xvx8tp)k_kN7=BI
Ei.5"
Zb~"}BY
}GL]"<
LrZ@U27E=AVU
O`{vNx
~xNvdv2
PU_Tl'eZg
$W^iL5s;I|
pPpc`]
|NYh32#
c"km_x2I
Z%To|k^L_-ct;^
CvxlH"JPaSK
Q,5rzeJ
VN#=%HY' @*/
NKC=P[X^
%!d6z=/!Q1
<H,nE082
=0;!!2Hx
{>vPm)@#
lYE_D&p;G;?
NT3K(.Z\o
5:uC5Gt
Okna6/}H
=F^.(|
B&W{I42B
RLzr`7}
7 WbK;#(
zPXu\is
k#j<$H3#C+ C<sDR  ]; v,
sO*E{6~:'Q9=fRD
XC-gh?qE *r8l
k+r\:72Um#e
y;CNJ=
)?*1lrb
$D4lOZUZ
@E/+(W
h)5@+:@"Ume !F,8)
(Wu+bVIQ)
M*Ts-#
#c*%o+
]fCCBs+
'%C0](;
DCNL/!
gXxLiAjc
j1rYi
P^3 o`=
17]qU~Iq86sQz
~NuSY*Ckr
yRyX%q
(r?}&F
m~;C`[T9
Ti[j!V
"r0`)'
k{kK<[
Ji=3/B
Y-z49%
YK;XB.y
OQ]}avG}<a32?|t'w
uhV#eT>0
~5AN~o!E/#
\^|n8a
M.D't=
iH8<z0
D]~|T V
lMN`H@W5I
+X#>L'@
T ~[5Lm}ZO,BSZ[;|jZE
w)"1."
FVT\e/yO
=(G%i[fR=xi]V$
qM)qH W
^@%jn$E
ES%/x1.
"fJP&0{L?zy
k_%gv3`Wv^9|)8
TM^]d6
],a/)Z]c1
&S6?hCuI#g!
F^qgQu2
m+yx,l
stmm}e
[uS/#+%/
4ALTo (7[f
-!?1`{
R!}|9sO
Yw.(k<vC
4N[qQ@yoMQ)
Ltf/L?Q"9A
)G0M>VX:[R#1UiH
3r8gnxl
y&s2LD1
gpn5v3H4k"~6
2=/or9+
K7kb+~b3+;CBr*h]~Z/c
X_rE&0M(
p+lhJsHg:
}h\D|!Z?
f'{qnGud
(eQcVR-S
1UP,+
C]<0 3PY
l4U( T<Cdt6
l?@T)j*sds
uGzX],';_#f2
a4A3a6]=
?bp 'KUlAL
0rt+pyO
eHfW7v
DZr}z*^
$y"yn(
a:bTg(
!F+9mba2@
~d$+2;
Cy\7@!x]
WI1ZT3Gzc'y!"Q
Cke`i9
1op)I 21
7`*nl#
SG4;]|
F;=nisl1i
vooRV~^\0TT-- c
dZy!-Xv-%`3
 bqsmMY
%-An2_wB
2<*jF^
p[KYI"R$
)v;]m,G%S=h
nInkD<3E.#C
DtOgr?Gu*v@
#<?'_G[b
{?nVe`
6wr|,3"
^?0z?v{
zU|u";4f
Abo=S'Wy<K
ZcWBEd
mH[lGZ
0*&_*y<
y C*\AFV^
fSj-'3
)6ngx8w6F]
8?odZ~
!N1+E?rn[QUJe
i%d9IFX
E7DquP 
Kq|^yL
f?9t6b?H|TV
zV6g=mym
6'fv,Z/eoP
S@OqTv
c[<hh:Os
[]mva:IInO>
^/'+7IKHh
$QK|Y6y
kO0wAh
8XI,K_]
'?h6ry_wc
H}Yd{<F/
5e4kO>
w%Mk&$'"]zP*`&
ZW$"+G=4XE;
KS `i_M
^&L Q<
n}gC}z0
$R/nu[E>Z
,<(Jh+O
T54vOz\
~0bT=K
84Q%[N2E3
%HyZ::
]RCrC/o|,M7
msR%bUjD3
~@r]4EFs
E~-dW/R9
kQkh0gk0
WC3Tez@DM"w[yI+
8>[M-![U#w
c3c8d1C
}i)}"h}x"
dcGj;s
0}H,_`
%Ov^Hv
60CNtUYQS
3]0tTG$
P`m=j%q(dGk
up(4k=
IdB}!-
^mWE:5h
6W4=\| f
\G~3l)tG
f<uj 0
"C}r3vftvS-L
LdY!gT0d-5~ Nf~
7X$:+"4ZZ
h;[oKC%=f
.,N~@{!
)OF^ghU
`Q12F[bk
F6t=Lb7 )a*~
v.NP54 v
|@w'8I;$8&&3S
Ip)uPr_//.8:
i075:>E_a
O6+~sY+i`m
Uy~-]RNM
KMqjn"w3~8nqa
fl2]^+
tcNi p
VS}~M><+&j
(%zw1(g
oeyEtF,ZA
, K2>c<|:#
UXcDP[,
oYmk/Q\
o\SlJ)W
qJ?B'B#m/
dq2fA(
Vp2H^q`q}`:#w'
X+[j5(
fTInKp*m-
sm:t;B
z{^[t}v]
pjRE<+>h
BcP`Ej17
b(`P5*k]p(dE
|BR@j1Al
&}"}hjdU
a3cEc1
uJyhPJQ
*8Fmd[?F^R
g3hJfB~s3C:
u)uP_}}{
6z<pu=iFe
wM0Cc%
yGISi.m5
/naJ>x
o,My}js(oD!
ZSO8^c
p:QUC4cm
,c=1C?
v`|)$;
(|2z),\GI
E~,RIRnB
gy6F>r
NJ=Dh,Lj`
,*jkz%l
nM&C{T=uq6
Bx"]%7w{y
 T$&C\
fm'3X $
dq"W!{NF
`]=ZNo
x:Dx?Vu1@X
)zwj7nl
vvUkcnf
PUoN6/
.Mzt*:?fq
JMh$,n,
r*bA@hc~#S'
}:nAeEBfqi
sJP3uk)
Q.v^.WO
z,9c4VI-rM
2,c3Mi^
CjW&i{Z
/8vp/F`L
_B~nEc./
Aw`a!O
_ XYav4$sE
wlVkC:\t7~6
1RnCYb]MS
5:axMTj
"QrmdZ)
0x$/{[J
VM%p)0/L
us&Q3%
1@U}~-
U@j;jDf
=o2cYK
)Doy}#w
7g~[OK
g+ 2\^E$
-h<).\#12)
CMqA+wn"h:1B
:O+o)E)_F
zX[s7PpI
W\V?^xP?z- Nn
]qJf}a2XL
J`D6l
rc3\sK}u
]5[P:l
Ts|n@`rf
zf!D$Z|
kRK\rZ0
Uf% Tf
0-E8EzGA#
.j@lD2z
Nj?yOhc3}"N
@.<qV*&
nv`W2yx'
Oyc"+~>v
z=G6{[u6Y
SOn?NE^`#
Ow[{?q>qfM+"
uh[Z MSbHG\SLI)
RC/*S'
5f(ng't
Ml`eM^
>NK~>4
pLsQdZzc
FrNE*;BytS^qLaQ'
f^:~l{.BeN@
%,T&AixCU
/hid"V
'Cptka|
Hr8!$
9^nnI9
@+?/=EPY3w'RQz
F*uACU~
Yh=rIgL<N9s{p
C1FZ7L|^R
{,Z5~fFR
cI@F4ROT
UrJ@m;Xs
#Q~RF8LG+
N%ZtY^}
Da)?%I
jywLUt
<W<?0xH
+=sq1{eJ
<7fdzM
`f['J\m6l>G
QHo,o(
*\y$l6
4{"Nr@
HRRwNmn3
qDm:l~ho
w)&@As$g_>uqm`
#`Sxa?/.
UQ4kGP'j3_
wL[:]`b]-
S|`6p)
;8[-4gw
Ln}k>>9qG
qfI6Ij]
SAJ"=2wb
qS#!9i
.<H5rb
,@CO+H<a
DFQ_D"%*
Fa( +0FL
p8?G1V.JBE'}[
]r$=TN
6>DQ*RK
PEl#\4
]%woP;'Sn@
pwJO\#X<[/
8$KWnl
INEwY>gB3m
y$zrC3k/&
Ez1b*K
sf_yE
mNAk(C<
j~AM_
Zc=$p*n]l
m|> 3{O2UhFzwK
WzcmeA
*(5.yx&:w,
IbISShk,2i
t}swC@
}0SHea=
;z#(D1!9~L
fe^`_|
'Vs?d%
KyZd^me
+rrgn3x^<
r|(:D<:v
S4?8#U
fbP,c(5
%u!7k]
]TZ:bl
Q.y99V
+I}_<AV#
)^AnIm
/.IQ&gorI]p
<64$\xC1)
Gg,\glWX>
ngh4)&bLS
5:2Y'bNp|
XT}{-l+
Rb@[L>M
Vpxl t
rQr+KX
RiZMWy
]Yj]Vf
oM`X]w>L.\)\_t]M
Y:~O&Gi
WbQ)xm"8d
Py+Rd
_}x",;{
T!U]-)2'h
ZRL'5G20S,
ireqVAD
<dz]&0j
%_3^2"
{Cv$e+)<:1v{C Zw%
xEEs[6dMqm
k",H#~J5y
bby4=ui
{v;(^mQ2XC:Sq(
iO!AQJ
@F4]JHbx{e7W
P-|W7S
`Ckh<
R[[/^P
X=+#U4n_V(p4X
Nz>rG;]="0gF9
Z]FcJAhKx
r.OBH2(
%)7A'E"
BaUE$n[]6-+
0hDZD2
rts{Bc>
':RNSp
YnT>GK
k6iP#1u
OLV0D&+hkk<
I~12P)
4%q ;*:W=g
2IyXb&QzZp
X7(fQ)
YF*cp*
%%ENWx
6jMB(t^
i'Ab*E|
@pkUu;+
Q.'2f2JVqTN!|
R?"7'*~c
nSdn0X#M7~
:3+.?bOf!
|$vg*j\B
SCsqx)bkCa
<3y+<o
u2>~1f
SfHZ-G{l<k
"b^)7Hp
Gc=iB{&_9%o
<{$0~c7
6cp^^r{
dR(0cn
E1@bS %6
vnbq8hv3=1$-
_]Lt&0Pp=
nf"IQB
mqo-w,y
Z.3{i .y
nK`"i?wE*
;gG=(?CV@
tH!p$|W^
Qdl4X9An
Z98:y\eW
\Adys4j
)1u 2A
 8h_j4ZN9
b.hOO,*J
59-fVl
I9vW3n:B*/
7c3!*w
nqa7!pP9{
vFVntQ2Y
YQF fp
"mR\g}UQDP
, J>L3Y
SNNS{E
QV1y* 
b~8dEx!
kkkdg@
eM[4h|6M
<oT&AN*b
pC'[:x
~a"iT>"
f?5kdJ
<(:Zau}6 Ux'
Te|U
 eOfIs
JPag$o
s&1`-Q)F
L}'4r~vs9VH<et
^vSC_DeQj8)mi
}-&c^hh
">XiBxpQY?(wu
,h(qcGtpj
TuEu=a"
4qDb5l
!g\QPy,
)bD\,QAn[<
 {#@MR)
g.v+&Q/
Qh[7QVKlyvD
|v[RPqPHa
M,'}3h
JQ|P=_:b
#1cO 0#
9-x~wyIY"~v]
1.y{+^
!PZ;6]B
G8De|@F;>fQ
G=E[vp7&Vz
Q5!{^)
fB_iM}X[
G4|>=G
OF7Xfbd
pnRpUny
i/kMs\+
FlzRUqe;
K$3}U]M
e7tmw'V?f
-Kc~XIy
HhQUp;
vr=FBC|
$bb&~|-o4
T*g.-},
jnSCY[8
Vf&(iV#
E')g5Q|J
$CUr<b
$8b\<FaLdN_"
ttPcK3O
[a;/oL
I>V>{G
d;f1YNNo
a5zm%!
yc'ZZ1b8 
e'T+#9Gkb-
#KF<eWC
<2-^5uy
 'k{]* 
&/)(~GP
A.u;-VA%y:3
x/vQyGVu%lGc
T$oFg
\Jr8jH
d(B]k!19
fVxZ:Jvq
h>w^p9
V_-:M
l&A/r%&:
I8`Q/-#
IKhGuFyqu
[v8-VTb
NDqiXYG
V}T(U`
LQz==21:<'
9?#EB;'218b_j-~)$T
j)e\4$uI6
:A-ac%;%
1EE+)0_zAc|gS
5eEP.k
aa5uZ(33MW[t]
0`0E^!u
[PGS_#
bOL(sxFp=
/XDF2%
a!{1B[:3
uk@r4O
>+rH ,
>@c5yM
<BF10KQ.6}:J9
}-t2Yn,z
Le0X.%
Xl~AL 
MG|y$CU
vD"R!k@m$":P
-9d%Wy5
%%Ol?`<
\hrdYW[Tc
_rGXr.
,mD0y]
SI<80XX*}^UI
 QrLi^L
PpCBw?
Mt."Wo*
D!S>@7g([xS|@omp-u 
sbny\BN]{rby0*0fq "
3SgvSw5
~Qao_zvjw
CJ VK^K
1K@yPA*geEDt~D B/
v~GMqM.3
Um;6)gFb@
cJr(5l+
U4uc/57
g74(OVzF'oCe
,|I&AE4
DDQ*RIlL*{
e&(!s=P~R2
LA"pvI==@Hxdt
X&k:Nq
Rq50*GW>2]dt
/X.,aBH
o4[g^e>r$#
ScG`4SeZ
%65DYhmn
wo,Rz*
ntT^|y
Y~|]rl$o5
af]yc\hde
<.!Z|a
8j8/b:
.RMtXs
$>E6j.746
<&]L0+
~3wE4)
G_|w^^p)
t9+;s!{0
br}>!O
<Bw#i_
K"V<{tmU8
^$"TvG
Nn})R^
w4+V$]
@&/Nyc
B1ve%~
X&.u>^_NWtE X_
p@J\m]=T B-M
VF\5D#n
C$y8>u>%]X{ O
92/eF`d
%NkWoX("TsB=y-R+gc
8CM=N|\z'
_F(2yb
pr*X5J
AMj0L!3
j|XW}a'
*Ha6;cm
P+JQH2
03Rn-.ZE#[&,e9?o.5>
(>P4gO
e"%\h$vQ
Xx0\#e9
W$^=`:
fw@(3WSfn@0&rpX+
/T|ChP
-|Ms!sg
}HtfiT
BQ=Tq,Ly
%cmpH$nUwKn1V?/-
5WgW0D
R7Z>Qc=Xo:
d*'Z~7G
!Jr6MWu'-sX.!m
|83-1i`
BML[bDM*uberKgk
lbK<VOOl
I)xLm7
Uk2_km
\ g,,mA
]hHE;R[e[di
}]^_rN2<cK6
|x"!~,K~
zlC=ayi
I8y&+iy4
K;./83!
!uW1*
eg"Ypmc&}Fu
AT>Goc6
Twtd5TL
@hTvEp
>FpgD1y
?,Q!H8QG
{Jm,POrxX[Rf[:6GbE&
JhB Tj@I$e
IEwt7W
*8|[z*v
OglR`v%/
[</I2y@V_)4
 Ejk8O%/!
qf!e)m
9scnSZLq{
~-gJ^9}ZNA]M
}=<R\oGR
g!O=[k
zcOGO?:)t/
]MQ=yb
`daj)h
s=tZYF
=dzR3i
~DA<~H~M
l5PWYq]
AMz|H9<
uj2&9FY
.%WLC3 #
9 ))^GP
[zQNvQ-0F
D`9=_fUqT
AZ9yA<s
#Nn/BEd
4P+7+r`+#\\.
rY`KkFfe;
8z`f&Z2
n+Q}\6f+
F/TjGsDsg?
OV4@"#
*\L2tU
qWRmm_R
uO@bn!c!
W22I$GU~"Ez X`_I00~5<wV&Tv!6
/$TH$*:
+Z'Xqbw+L
'zD~SGs5c8U2
TA&#[[
M+@Z{U9ll
epZBWha+=RV!kh^L
pJQoGmip$mS
H0vRV?A~
^L(PLXF
83*p0c>b
y]z_@_&,@h
 p9z|(
2J^%Ew/
BRvK5PQ#\5PF@2JV"/M
Kw7/^9>N`
CA>;aAh
RTA^Can
SdvRd7W
}~%Mb~
w1e/f-I
L7(ry_;J
3wY#KZJ
z!{N",lb5,w
csAJ7OxX
AgzV\A
F|IX?lF9?,)3
"DG'+a>;
E`O}B=bI
fu[_@=+N
g?nKIO*\8&now
~THOB4
l[FB<,
(B:{;^3
laCDNF,;O03R
"!}Q$G:u/@a
fK&;|DR?
jn3{D
W,4,h"@
nAiHi-
S#?N6/
gX'2T7o<a+]Sb
xfHxRK`sI
o=u_X8{p
H[S'5gq57d_Q
F0yb}3r
80(&V&[9\ (UOc&uUOZ)\g
}[nJiM
y\n!&f"
76Z;hPV
J,o=kjE
89O+SZLd#(cyZ
Uj?Tr,kP5^y
>g0>6z
xud(R]
5H'#R26C
|ZVF0Pj%/#
 >.KFnM
!#rXau
S?%_PcTX
w't{nC
7+1/F6T:1k\
H_2'Tj
Av$@#})}
bU(v 9
1BW!Y>
mz-.?l?V_
G9/0R=<6bq"@GTU
xBX]c 
\Md!Z<
>p?jG0w#GW3
N3Z41QO
eGCXhG|
-^VC?^
G]T^1i8~
l;5DJ
H`\W-+ObTWw
%Toey#eV%
b-20sg\GXc
3]M*(aK|8QX%
m+(z/u
&=C!R<qa
` *Jsr]H=
Y2wT&at=
"iamxdq^
`%O=8R
(w!dj^58"<}?
x^=KAnk
||lHiX
DX^jpK\
-~4q|&I8'3(
ZE?C`Veh
3wR}gk
[pK6s]AV
ZCY6UVsO/
S3t<=1
]?yz\"G+
9HN-45*/;
pDGDAp]
^a))CnH53
5^)CATVO?0</_[j2H&<
}U=m3}&k*rF
t#--A4
gHEVd`4#E}
)R oS4%
b;qw]:l-
366>Um
%@"s6p}
Mvr3>I;0
6;pUXH'8Af`<}
bwe*mp9.iy$r
GA^BVN6
BvvVLW5s/UhcG
#kj$w9UNv.A
riT%DY
IHXlc-jA~
"9 CZL
,k]/9kT^
1WJ*skDMZ5:
hL?7!Uo
DIdH UT
ps>CSQ/
$&<xJKu
-0<Yu/"A
(RTYI7D
zyvds|C
-AEf{t,e
~ru (8
?v#Q~>!vGnK
lVhyu'Hw
c^*[Jl*
DV`_wzg
*w`0N}D
iSv%g9
51Yvh]|w
Fo[x'(
xFuWu'
jLNz!K
LTU086.1
$cJc9DQD
=/l}'2
q|.tv<
a:qd[K{@|W
rkK|s><
JP23!&
/9]I0ld
&6TAlOp
;_S!~~9
_Iih\qKhr<A}Rnjy
vCCfQOf
S_*V.3
yc~<qnP
|1~tC|2
"{K=c`3QF
ezQ8=W4E
i|/UMP
nPbB k7
S$.}nD
Wpwz(9@
=rt+"(|=yxRc)U1_\x
)]Y?$F
G+d\$'
o#0ef,yO
j`(lo&%!lLQ{5=[]
f9A78-
pbFO$N6&
?o[d3c
`h]%z*
g/7!e ^/
vd;pUu
Bfbht;SH
G/GA7:
=kg\;xvgw6y
k^mchb^
`4dW-h
\r&&>{
m%R$pZ9vEao
z[m:)IgS[7
k.HR1F
\fRIsT"D%
TP"a/u+~H
Wd:>Vop
kBlcj#'
RN@>M{
uBUG(|e
&Qs0NL=UN/L*
Mn]H=<
Q(NkJAb
UkZn4X+"qi
%_1+H4
mp!E"C?Nnx%
4OK\d,u
qp'k~e8/
mag|&Q
yGgT:t`iN
5FV@E]2m{gjER
w.6co-
W9O#2f
i8!&6X_Q[Rm(
;H`t,\so=#\zY~
DZj[R(Xr{`Q}
E<Dmu:kn9@Aig
c ,p)V
f0O{|<
tnE$0Du
buj\*ba
 [/R>%na
^,*;5n%
=q8_~NIi
b9fqk,oPw^:E
jN8,P$:
:3;jPx%1
]SF<|qex
k"S?j3j
vk~OEjaxBoax
b7um)WI7upmw\B
dp~1p'2
8(j\Rg`)V
sy8"2E
'R>HY{$'7(q
bdL+,:,Vn
&P.0jWC
<l[")F
6h{h/"-awO}
74><~D~Lht
BaCz23
ZzHO?j?%
AE$?pg|
mV<[dBwL&
,E#uPkUn7
&rT0 K4A
&lkY?=nGU
}Y:9Kt3_mfc-e75~
XP26wTJ
Uo`_x8#w P
M__;R&
w'k}6t19G
3,rCG|)6'cG
0-%'qHA
K`&v:Q%Lj
h}d~T+<%#as2
DhV5y#u
$/oNiO
W@sd#"3
FWoBF}q(
889*jx,9x#
QA0}nM6$n`ly
sF!6&g
p1Ih6lB
.C*m-2vo%.
ugz4|\
DPq:g~
4(B5aJ
m,yZq1 
9NEJ$,
)G, $,wJWXz
yEQ[gh
V@(Ia/DP^,
tQ5wR<Wc?7
]=#")l~
 w2u0\xDoDN+A*T
]o ^o.AZ
oeVG.w
0SqU+S
N9Z$!;i
%Ad$PM(`"6(L+q
sYKMX|*p
OeHo"x`M
+S6\eBs.:
d^^9u@
i@7FSf
Dx@F6#
i*cY\h
*l1!SE
Gg9dNx
c\2EF:`&e
~wcLAw/2~=
E87M<rv3;c[^Wb|>%3
zB(Ucn
ASPH(ur6
kn\;<)
ORFZ{u
uori055*@d
W}3/nDtzG.%&Ph
_5N~!ek{:P
3NtB@:_y
n GmW
|>ill_>aT
B4av?("Dj+{:4[b8
G,rTvL
(bHqz.UH\
g}Fz`(
@$7y_H++g
X@VLW276
sD4MWNpO
:MCtBWP
nx-Q2&AxOO
q%n-^(|*~o
_$SBC{`
bCIMx.1
{|5GEpXRM '\~e+G=
9scnSZLq{
~-gJ^9}ZNA]M
}=<R\oGR
g!O=[k
zcOGO?:)t/
]MQ=yb
`daj)h
s=tZYF
=dzR3i
~DA<~H~M
l5PWYq]
AMz|H9<
uj2&9FY
.%WLC3 #
9 ))^GP
[zQNvQ-0F
D`9=_fUqT
AZ9yA<s
#Nn/BEd
4P+7+r`+#\\.
rY`KkFfe;
8z`f&Z2
n+Q}\6f+
F/TjGsDsg?
OV4@"#
*\L2tU
qWRmm_R
uO@bn!c!
W22I$GU~"Ez X`_I00~5<wV&Tv!6
/$TH$*:
+Z'Xqbw+L
'zD~SGs5c8U2
TA&#[[
M+@Z{U9ll
epZBWha+=RV!kh^L
pJQoGmip$mS
H0vRV?A~
^L(PLXF
83*p0c>b
y]z_@_&,@h
 p9z|(
2J^%Ew/
BRvK5PQ#\5PF@2JV"/M
Kw7/^9>N`
CA>;aAh
RTA^Can
SdvRd7W
}~%Mb~
w1e/f-I
L7(ry_;J
3wY#KZJ
z!{N",lb5,w
csAJ7OxX
AgzV\A
F|IX?lF9?,)3
"DG'+a>;
E`O}B=bI
fu[_@=+N
g?nKIO*\8&now
~THOB4
l[FB<,
(B:{;^3
laCDNF,;O03R
"!}Q$G:u/@a
fK&;|DR?
jn3{D
W,4,h"@
nAiHi-
S#?N6/
gX'2T7o<a+]Sb
xfHxRK`sI
o=u_X8{p
H[S'5gq57d_Q
F0yb}3r
80(&V&[9\ (UOc&uUOZ)\g
}[nJiM
y\n!&f"
76Z;hPV
J,o=kjE
89O+SZLd#(cyZ
Uj?Tr,kP5^y
>g0>6z
xud(R]
5H'#R26C
|ZVF0Pj%/#
 >.KFnM
!#rXau
S?%_PcTX
w't{nC
7+1/F6T:1k\
H_2'Tj
Av$@#})}
bU(v 9
1BW!Y>
mz-.?l?V_
G9/0R=<6bq"@GTU
xBX]c 
\Md!Z<
>p?jG0w#GW3
N3Z41QO
eGCXhG|
-^VC?^
G]T^1i8~
l;5DJ
H`\W-+ObTWw
%Toey#eV%
b-20sg\GXc
3]M*(aK|8QX%
m+(z/u
&=C!R<qa
` *Jsr]H=
Y2wT&at=
"iamxdq^
`%O=8R
(w!dj^58"<}?
x^=KAnk
||lHiX
DX^jpK\
-~4q|&I8'3(
ZE?C`Veh
3wR}gk
[pK6s]AV
ZCY6UVsO/
S3t<=1
]?yz\"G+
9HN-45*/;
pDGDAp]
^a))CnH53
5^)CATVO?0</_[j2H&<
}U=m3}&k*rF
t#--A4
gHEVd`4#E}
)R oS4%
b;qw]:l-
366>Um
%@"s6p}
Mvr3>I;0
6;pUXH'8Af`<}
bwe*mp9.iy$r
GA^BVN6
BvvVLW5s/UhcG
#kj$w9UNv.A
riT%DY
IHXlc-jA~
"9 CZL
,k]/9kT^
1WJ*skDMZ5:
hL?7!Uo
DIdH UT
ps>CSQ/
$&<xJKu
-0<Yu/"A
(RTYI7D
zyvds|C
-AEf{t,e
~ru (8
?v#Q~>!vGnK
lVhyu'Hw
c^*[Jl*
DV`_wzg
*w`0N}D
iSv%g9
51Yvh]|w
Fo[x'(
xFuWu'
jLNz!K
LTU086.1
$cJc9DQD
=/l}'2
q|.tv<
a:qd[K{@|W
rkK|s><
JP23!&
/9]I0ld
&6TAlOp
;_S!~~9
_Iih\qKhr<A}Rnjy
vCCfQOf
S_*V.3
yc~<qnP
|1~tC|2
"{K=c`3QF
ezQ8=W4E
i|/UMP
nPbB k7
S$.}nD
Wpwz(9@
=rt+"(|=yxRc)U1_\x
)]Y?$F
G+d\$'
o#0ef,yO
j`(lo&%!lLQ{5=[]
f9A78-
pbFO$N6&
?o[d3c
`h]%z*
g/7!e ^/
vd;pUu
Bfbht;SH
G/GA7:
=kg\;xvgw6y
k^mchb^
`4dW-h
\r&&>{
m%R$pZ9vEao
z[m:)IgS[7
k.HR1F
\fRIsT"D%
TP"a/u+~H
Wd:>Vop
kBlcj#'
RN@>M{
uBUG(|e
&Qs0NL=UN/L*
Mn]H=<
Q(NkJAb
UkZn4X+"qi
%_1+H4
mp!E"C?Nnx%
4OK\d,u
qp'k~e8/
mag|&Q
yGgT:t`iN
5FV@E]2m{gjER
w.6co-
W9O#2f
i8!&6X_Q[Rm(
;H`t,\so=#\zY~
DZj[R(Xr{`Q}
E<Dmu:kn9@Aig
9scnSZLq{
~-gJ^9}ZNA]M
}=<R\oGR
g!O=[k
zcOGO?:)t/
]MQ=yb
`daj)h
s=tZYF
=dzR3i
~DA<~H~M
l5PWYq]
AMz|H9<
uj2&9FY
.%WLC3 #
9 ))^GP
[zQNvQ-0F
D`9=_fUqT
AZ9yA<s
#Nn/BEd
4P+7+r`+#\\.
rY`KkFfe;
8z`f&Z2
n+Q}\6f+
F/TjGsDsg?
OV4@"#
*\L2tU
qWRmm_R
uO@bn!c!
W22I$GU~"Ez X`_I00~5<wV&Tv!6
/$TH$*:
+Z'Xqbw+L
'zD~SGs5c8U2
TA&#[[
M+@Z{U9ll
epZBWha+=RV!kh^L
pJQoGmip$mS
H0vRV?A~
^L(PLXF
83*p0c>b
y]z_@_&,@h
 p9z|(
2J^%Ew/
BRvK5PQ#\5PF@2JV"/M
Kw7/^9>N`
CA>;aAh
RTA^Can
SdvRd7W
}~%Mb~
w1e/f-I
L7(ry_;J
3wY#KZJ
z!{N",lb5,w
csAJ7OxX
AgzV\A
F|IX?lF9?,)3
"DG'+a>;
E`O}B=bI
fu[_@=+N
g?nKIO*\8&now
~THOB4
l[FB<,
(B:{;^3
laCDNF,;O03R
"!}Q$G:u/@a
fK&;|DR?
jn3{D
W,4,h"@
nAiHi-
S#?N6/
gX'2T7o<a+]Sb
xfHxRK`sI
o=u_X8{p
H[S'5gq57d_Q
F0yb}3r
80(&V&[9\ (UOc&uUOZ)\g
}[nJiM
y\n!&f"
76Z;hPV
J,o=kjE
89O+SZLd#(cyZ
Uj?Tr,kP5^y
>g0>6z
xud(R]
5H'#R26C
|ZVF0Pj%/#
 >.KFnM
!#rXau
S?%_PcTX
w't{nC
7+1/F6T:1k\
H_2'Tj
Av$@#})}
bU(v 9
1BW!Y>
mz-.?l?V_
G9/0R=<6bq"@GTU
xBX]c 
\Md!Z<
>p?jG0w#GW3
N3Z41QO
eGCXhG|
-^VC?^
G]T^1i8~
l;5DJ
H`\W-+ObTWw
%Toey#eV%
b-20sg\GXc
3]M*(aK|8QX%
m+(z/u
&=C!R<qa
` *Jsr]H=
Y2wT&at=
"iamxdq^
`%O=8R
(w!dj^58"<}?
x^=KAnk
||lHiX
DX^jpK\
-~4q|&I8'3(
ZE?C`Veh
3wR}gk
[pK6s]AV
ZCY6UVsO/
S3t<=1
]?yz\"G+
9HN-45*/;
pDGDAp]
^a))CnH53
5^)CATVO?0</_[j2H&<
}U=m3}&k*rF
t#--A4
gHEVd`4#E}
)R oS4%
b;qw]:l-
366>Um
%@"s6p}
Mvr3>I;0
6;pUXH'8Af`<}
bwe*mp9.iy$r
GA^BVN6
BvvVLW5s/UhcG
#kj$w9UNv.A
riT%DY
IHXlc-jA~
"9 CZL
,k]/9kT^
1WJ*skDMZ5:
hL?7!Uo
DIdH UT
ps>CSQ/
$&<xJKu
-0<Yu/"A
(RTYI7D
zyvds|C
-AEf{t,e
~ru (8
?v#Q~>!vGnK
lVhyu'Hw
c^*[Jl*
DV`_wzg
*w`0N}D
iSv%g9
51Yvh]|w
Fo[x'(
xFuWu'
jLNz!K
LTU086.1
$cJc9DQD
=/l}'2
q|.tv<
a:qd[K{@|W
rkK|s><
JP23!&
/9]I0ld
&6TAlOp
;_S!~~9
_Iih\qKhr<A}Rnjy
vCCfQOf
S_*V.3
yc~<qnP
|1~tC|2
"{K=c`3QF
ezQ8=W4E
i|/UMP
nPbB k7
S$.}nD
Wpwz(9@
=rt+"(|=yxRc)U1_\x
)]Y?$F
G+d\$'
o#0ef,yO
j`(lo&%!lLQ{5=[]
f9A78-
pbFO$N6&
?o[d3c
`h]%z*
g/7!e ^/
vd;pUu
Bfbht;SH
G/GA7:
=kg\;xvgw6y
k^mchb^
`4dW-h
\r&&>{
m%R$pZ9vEao
z[m:)IgS[7
k.HR1F
\fRIsT"D%
TP"a/u+~H
Wd:>Vop
kBlcj#'
RN@>M{
uBUG(|e
&Qs0NL=UN/L*
Mn]H=<
Q(NkJAb
UkZn4X+"qi
%_1+H4
mp!E"C?Nnx%
4OK\d,u
qp'k~e8/
mag|&Q
yGgT:t`iN
5FV@E]2m{gjER
w.6co-
W9O#2f
i8!&6X_Q[Rm(
;H`t,\so=#\zY~
DZj[R(Xr{`Q}
E<Dmu:kn9@Aig

Process Tree

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2948) "C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe"
- 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1260) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
  - 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1964) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
    - 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1928) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
      - 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1776) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2836) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2604) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2352) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1864) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1156) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1192) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2476) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (332) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2652) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
- 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2452) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
  - 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2460) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
    - 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (848) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
      - 0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (256) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2884) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2420) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (3020) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1856) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1592) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1596) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (1092) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
        
        0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe (2724) C:\Users\Administrator\AppData\Local\Temp\0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe
- reg.exe (1972) reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2948, Parent PID: 1064

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1260, Parent PID: 2948

default registry file network process services synchronisation iexplore office pdf

reg.exe, PID: 1972, Parent PID: 2948

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2452, Parent PID: 2948

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1964, Parent PID: 1260

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2460, Parent PID: 2452

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1928, Parent PID: 1964

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 848, Parent PID: 2460

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1776, Parent PID: 1928

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 256, Parent PID: 848

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2836, Parent PID: 1776

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2884, Parent PID: 256

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2604, Parent PID: 2836

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2420, Parent PID: 2884

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2352, Parent PID: 2604

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 3020, Parent PID: 2420

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1864, Parent PID: 2352

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1856, Parent PID: 3020

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1156, Parent PID: 1864

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1592, Parent PID: 1856

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1192, Parent PID: 1156

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1596, Parent PID: 1592

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2476, Parent PID: 1192

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 1092, Parent PID: 1596

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 332, Parent PID: 2476

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2724, Parent PID: 1092

default registry file network process services synchronisation iexplore office pdf

0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe, PID: 2652, Parent PID: 332

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114
8.8.8.8

DNS

Name	Response	Post-Analysis Lookup
bublikiadministrator.com	A 193.166.255.171
dns.msftncsi.com	A 131.107.255.255 A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	49642	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	61714	114.114.114.114	53
192.168.56.101	56933	114.114.114.114	53
192.168.56.101	61714	8.8.8.8	53
192.168.56.101	58485	114.114.114.114	53
192.168.56.101	138	192.168.56.255	138
192.168.56.101	57665	114.114.114.114	53
192.168.56.101	51758	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	00ebb7a64b661e05_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	294.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`573fc568ffc26063d80bd7e90d4aea9c`
SHA1	`fba2299d286237187b1340f43cb7ae0887d710e9`
SHA256	`00ebb7a64b661e052ee13e84962a38ee4d2453328fe3695217398aeef472c0fa`
CRC32	`D523B3BC`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	e9e5e54abddfe863_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	301.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`89b4388ae81f341eda2fbddf9b87291d`
SHA1	`1674213c92190f5af538559751db96a152914a66`
SHA256	`e9e5e54abddfe8636ec728b105811ba94c26e862d21203295583cd6a463fc3b6`
CRC32	`F41DB022`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	b3a87e6e9b8c667d_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	292.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`cac71c4522f1d075a50faca1e31b8e49`
SHA1	`646e3db0210d6cf4d5b51e0c7877ea2ce918320d`
SHA256	`b3a87e6e9b8c667ddd0a5ccf15903ae12842c21340fc1d633ac2493fe9c09f5a`
CRC32	`8434373F`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	2ef2d89d285a46de_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	310.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`69e4481c6da875f5c0755e809915d1ba`
SHA1	`60b318e497ec5a1e0eb3b6c5e4330f32a42ca02f`
SHA256	`2ef2d89d285a46de4bf35d347963c4c67562daf90b030477fa659031c7e82259`
CRC32	`B9D0CB1E`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	d8e180b520ef5a7b_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	296.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`63966b4ecce095dafca71dfa50716a2f`
SHA1	`fcd0d54a8066c8b90c1ebd71f362d42a6e2e90dd`
SHA256	`d8e180b520ef5a7b494282634446f26183ef444cab268ce06b8fa4145545f748`
CRC32	`ED14DD1C`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	b608b0f70eae6349_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	321.6KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`cbcce817b91e9555beb1fa735778d0de`
SHA1	`1a5862b017f77e11c5550aceca180469d6149fe3`
SHA256	`b608b0f70eae63493508ecccbab36b6980c1d1a745b921c4071065d37b79a2fc`
CRC32	`872AA16D`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	165531e92ed5d86b_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	316.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`98b20daae3be8505b951b8a2afdc9506`
SHA1	`71255d8249909fd5085556638ae6e57496c35d00`
SHA256	`165531e92ed5d86b9ce3a066b5d47035257a50d00d1d5bd40584046068f74524`
CRC32	`F2C6EDC5`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	e060df200d4a4d01_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	298.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`4e600774e6a32247ca0df2124b330d86`
SHA1	`c52866ab3fceaf69173615b0e56210b7039b2605`
SHA256	`e060df200d4a4d016d6f3dbbdb311163dfb19588b6834421a520cb282b878c28`
CRC32	`5B2A2B0D`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	6b86b273ff34fce1_stop
Filepath	C:\stop
Size	1.0B
Processes	2452 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1964 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe)
Type	very short file (no magic)
MD5	`c4ca4238a0b923820dcc509a6f75849b`
SHA1	`356a192b7913b04c54574d18c28d46e6395428ab`
SHA256	`6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b`
CRC32	`83DCEFB7`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	84b9d93f31de36d2_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	320.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`878b2af3462cdb70cd28fef0839f63f6`
SHA1	`ee92e8113f8bd8daf8e13915f37e265842b844e6`
SHA256	`84b9d93f31de36d284dbc0a8fd020e74d439c1a0e26abc48715e78ff258cb6cd`
CRC32	`F9E65E68`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	70226cc1316fd8a8_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	313.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`d5769ac8c36062f25e9328b6a8574e32`
SHA1	`ecf4da2d09d18dc982d7653e9339810f77d91fc3`
SHA256	`70226cc1316fd8a854faf3e704980da3a372c630ed0d6a879b60c127fa79009c`
CRC32	`05BBD8A2`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	8c548d4b3e4677b7_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	310.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`83940800b23aa9877b472449d8fc9d0a`
SHA1	`2800195449c7e7eb9d7fa78cab668e7a9b33e3cc`
SHA256	`8c548d4b3e4677b7dcb9c81cbd8c26fbbf80d891819cce83d3beb5d07ccf9bb5`
CRC32	`6BAB06E4`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	ee3f0f05bfd8b49a_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	304.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`2bbc70b2aeff89ea243ae8da7466fcb9`
SHA1	`58cf9aba6285748b932e6f7ce6b5755ba38c182c`
SHA256	`ee3f0f05bfd8b49aa2671689cb6e00addbc32912d51c857de805fdbbc59843a2`
CRC32	`5EC4E918`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	0afa3b9b95b784dc_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	310.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`5e379f74274882798dab3547e714cf17`
SHA1	`7fa9d7498542494fa70f62a5c34542fe62ceec2f`
SHA256	`0afa3b9b95b784dcb2605714c241c49e48e46bab7caafda9d10531ac130eda4a`
CRC32	`7EF0E612`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	35bf35a2073a0f51_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	293.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`c1b4b061bf5db49206e3eec98302fbac`
SHA1	`7da37ea9d3d7e2b1082a5cc25a08fab9182d9ce4`
SHA256	`35bf35a2073a0f51a3076d6a8e2aef8318fa2c20bbdbedf234233b941fda08ed`
CRC32	`9E6F42E4`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	ff18a9903a84373e_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	303.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`552db91a5ad271918d2d14c1ffb95c69`
SHA1	`91e45017fb11b094a0fddcf792fb8b193e437597`
SHA256	`ff18a9903a84373e49484a545cec84d15cdf432b77bf5e3120efe4352f5aba0d`
CRC32	`AA50D619`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	06e01175ca810f75_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	318.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`d84c504458bd610f0f1153629d5ca809`
SHA1	`4b7e2a27945158b77c56515d60673f9cc58f8595`
SHA256	`06e01175ca810f757c78e72147c804a470dbd0a984a518f1767bb321b677f856`
CRC32	`CA9D9848`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	3b11a9a73a83b0ac_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	297.9KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`beef52cda7a15692f24dea3764bd3f3f`
SHA1	`000cf0544d03053f63f160c276c1bd6bf9548597`
SHA256	`3b11a9a73a83b0ac3a5d6bea5649b478250acafe251d98bf2ad9d1552ce10641`
CRC32	`6A4767BA`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	4306fcdd6ca1b5c0_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	314.9KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`119a9a7ed31d715400a01932825dc7d3`
SHA1	`ec994e67aaf9d7a7133894951fac33ce22a0635a`
SHA256	`4306fcdd6ca1b5c0072e5a94c655f0e3c0fde372c181e585e5cf798d8c48a714`
CRC32	`7A79ABF9`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	8fd2fce7ab86b3cd_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	301.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`470fd8dc3691c69366557a2a5fec6c8a`
SHA1	`4bdd01aafffeb3bb8974f57af6b458695afd6437`
SHA256	`8fd2fce7ab86b3cd36532378a676cd5afd3e962dd4d54c0d579e70d8d634a139`
CRC32	`EFA5373D`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	e9cc07dff5f5ce14_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	298.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`1da138b632d1476bc2b3b0e8149233c1`
SHA1	`02d19718be9ac7ff41aafe0954433b8a367a6af9`
SHA256	`e9cc07dff5f5ce14c6c0e8b1a41afc0f2e57d3189495982b520a93cb09bcf513`
CRC32	`AB6E751B`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	fef71a6aa229e7e7_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	300.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`3d647c2f81df094180b59c5e84e5e4be`
SHA1	`4efacea56095ee3dc35bf3382eeb3798fd4c0c7a`
SHA256	`fef71a6aa229e7e760539a90f6eac2c1934e432cb98a7cc681c39ee00ba04b26`
CRC32	`498C3E70`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	5a54667656f8fca8_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	295.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`77e2ad45ba2d4218aa449473c509ce46`
SHA1	`1df2c4e50b78e585cc3c22a0bab52b4ee890b3b8`
SHA256	`5a54667656f8fca86c84a5c769efd0536dbd26474247fbdc3b186620de8a642f`
CRC32	`6BC2D04A`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	22de33521e4ac13f_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	301.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`63fba3a4b48bc5f0b8b207cacf9cf72e`
SHA1	`7d663823fe2642de8b5c411bce36f9210a9cb1fd`
SHA256	`22de33521e4ac13f8320189998274b5803c0b39abc826fa3b8b0c571be4177f6`
CRC32	`BC0DD550`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	f0a8a3b3f1402b5b_cftmon.exe
Filepath	C:\Users\Administrator\AppData\Local\cftmon.exe
Size	322.3KB
Processes	2948 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2452 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1964 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2460 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1928 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 848 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1776 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 256 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2836 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2884 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2604 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2420 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2352 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 3020 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1864 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1856 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1156 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1592 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1192 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1596 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2476 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1092 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 332 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2724 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2652 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`64c29173d7fac0c1d0ccea0bb4579951`
SHA1	`8e3739c3cee2f3be63956296651e363cc3053cbf`
SHA256	`f0a8a3b3f1402b5be59c72d64d4818a45fe4b33d804531623c0439189ade6d7a`
CRC32	`AE677173`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	88bd8b168c6a740e_spools.exe
Filepath	C:\Windows\SysWOW64\drivers\spools.exe
Size	303.9KB
Processes	2948 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2452 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1964 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2460 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1928 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 848 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1776 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 256 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2836 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2884 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2604 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2420 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2352 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 3020 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1864 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1856 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1156 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1592 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1192 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1596 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2476 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 1092 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 332 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2724 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe) 2652 (0218131b8f4eefc87c6a89c7db20e012f752b7d270bec1b481768312c08081fb.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`41d4f973061874d520ae5f5e8a85d363`
SHA1	`429cb7cc529ac98d70e4ecf30148ed92592da42d`
SHA256	`88bd8b168c6a740e7b64e0f5510ee14cd7376ddc7d297451d5384e30b55a2e52`
CRC32	`E9131143`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Name	4eefa434fcdb4575_cftmon.exe
Filepath	C:\Users\Administrator\Local Settings\Application Data\cftmon.exe
Size	315.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	`6c08d6abe5d2746773e1d5c8dc355c12`
SHA1	`bbe921be7ad93c289eb2b95bb340c2a8b7c2d7fa`
SHA256	`4eefa434fcdb4575ce9903e2189bcf69c7d81fac033a0d94b80a1d88e02650dd`
CRC32	`F3998FA1`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques
VirusTotal	Search for analysis

Sorry! No dropped buffers.