4.2
中危

088b14b84f86b835b515c48d7e7aa1844fece667c7582300ad1488f5d324dce3

088b14b84f86b835b515c48d7e7aa1844fece667c7582300ad1488f5d324dce3.exe

分析耗时

135s

最近分析

380天前

文件大小

248.0KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN RANSOM GANDCRAB
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.76
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Trojan-gen 20191020 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191020 2013.8.14.323
McAfee GenericRXFH-SC!A79B70CAD459 20191020 6.0.6.653
Tencent None 20191020 1.0.0.1
静态指标
查询计算机名称 (1 个事件)
Time & API Arguments Status Return Repeated
1727545327.81225
GetComputerNameW
computer_name: TU-PC
success 1 0
检查进程是否被调试器调试 (1 个事件)
Time & API Arguments Status Return Repeated
1727545324.43725
IsDebuggerPresent
failed 0 0
使用Windows API生成加密密钥 (3 个事件)
Time & API Arguments Status Return Repeated
1727545327.78125
CryptGenKey
provider_handle: 0x00c545c8
algorithm_identifier: 0x0000a400 (CALG_RSA_KEYX)
flags: 134217729
crypto_handle: 0x00c49568
success 1 0
1727545327.78125
CryptExportKey
crypto_handle: 0x00c49568
crypto_export_handle: 0x00000000
blob_type: 6
flags: 0
buffer: ¤RSA1ïžÀˆjݛ½6WýÏF˜¿üÄà^ü‘Ò5 r_5¸¢aÕ_‚pþÙʎö[ùUÍ砕„ÃlʘPfP¼Ú—óGÕûªƒ…pÔinGdß¼§©¥tÈΌ2ÀI«>ڌ“,üÚóTÎ+ãáՒl}4ŽËç}.¡[ìD=ö˜qC·ù«æT„p.{(”"Ù?àb;7°P /OôClߺwÍÁ޵æOÝò¿'L`t"ˆU®®¯ä|Ñ­k]KÖ|†îԄçð‚9'ªLë…¨|œSÓIԅ²DZ—ž©¢‹9} Q?4ÄÎFn.¯p’ë+¿Ö±âÂÝ
success 1 0
1727545327.78125
CryptExportKey
crypto_handle: 0x00c49568
crypto_export_handle: 0x00000000
blob_type: 7
flags: 0
buffer: ¤RSA2ïžÀˆjݛ½6WýÏF˜¿üÄà^ü‘Ò5 r_5¸¢aÕ_‚pþÙʎö[ùUÍ砕„ÃlʘPfP¼Ú—óGÕûªƒ…pÔinGdß¼§©¥tÈΌ2ÀI«>ڌ“,üÚóTÎ+ãáՒl}4ŽËç}.¡[ìD=ö˜qC·ù«æT„p.{(”"Ù?àb;7°P /OôClߺwÍÁ޵æOÝò¿'L`t"ˆU®®¯ä|Ñ­k]KÖ|†îԄçð‚9'ªLë…¨|œSÓIԅ²DZ—ž©¢‹9} Q?4ÄÎFn.¯p’ë+¿Ö±âÂÝÇï`o»ZÅgîå¹ÑÑR ¨nºBúÁq§Oô?¡_5µdU¿š¢¬RÁÉæ\d’×D]2>“˜ ·E¼cbÀü¨tR±íQ[³™7j«1ÇáÄ7>cãªn,oð+_D€¼q"d,8kmåûæ²qX©}uåôF†–²£¯²þ™'f¡Ù¹ÆÓz¸•SÌ-`xkØ r²µîðt›'_î/]‹Î*›¹{ 0A*…OFs-…““¼¸ Ò,hqm†’hJgÖQ:æøfÀ‹\8‰º%¿†êëêÐTOü¿¯Ej†s÷((/]§e<rŒöÊñâäÞs<{þ?q…S÷Nÿñ Û+òö|\QÃZõ #¥ÇOcËÔrvhø¾9» 3¦²+I‰Øå©dÛì»ÈÌÅÓ|uLT£Š[Sa;%Ê9ÄÄ¡^„-(S¯&ªš²¯‰1PI âÙÉüGø™ÊÚ&:3¤¼iæѽ̔(üwq“ñí>¯†ðb<þ2¾Ï¤÷W4€ïz¹¢Ù ‚º[b-¦øØuäöR¡ÐáÁ-ÙӁÀt’¶” QHÖOþdÚôç‰P£5}èÞíŒèÐò†c`„‰O‰¨Ë¹d³<LX„Ç©ÃcYÛÐ<™…ÏrrO;êÍFpÿ+)Þ¬ZAßkA™![¹‹À•µE³¦j­$a(øÏ„nP,,gÕÎAUꈐ+¾2OM~뗠³ªÅ¸O!«C. F"×GGl%¢•‰™^ψB+Ö=ÝÓìUž3‰_½­’ÎUvg©Úù'_7÷ÜËOÃù×Ïõ½hÝÎÜù1ZÁm̀-&V´øqÖÂ&cÄw—\V \;Žœo»ˆÕz.É/"ž\^0%ðøƒÊ½»ó—q4,†vf§/ÏåTv—£Û{|Î%ÚW#ROó;Áî\ÅÀ \LÓÝnsçÑÃêQ‹£-ª"øÄ~ŽÁÇ¿ß>á÷<eÅ7Ï S´“X_ =8æP»ŽÓyé-Sĝa‘4¶ZMƒÍ{ÿfÔW$‡¤B™áÎ'¦¥Ò”s_ò=Ú ‹Ùî/{ŸºÙ/óô ˆðëž5µšƒ ‡*8ïŠ÷‰³±å]žÛ¹Ùiee<[ëÕ½+âÓ¬ÞBÁ[Fj­ü’º3D
success 1 0
检查系统中的内存量,这可以用于检测可用内存较少的虚拟机 (10 个事件)
Time & API Arguments Status Return Repeated
1727545332.047125
GlobalMemoryStatusEx
success 1 0
1727545343.889875
GlobalMemoryStatusEx
success 1 0
1727545355.469
GlobalMemoryStatusEx
success 1 0
1727545366.780875
GlobalMemoryStatusEx
success 1 0
1727545378.094375
GlobalMemoryStatusEx
success 1 0
1727545389.37525
GlobalMemoryStatusEx
success 1 0
1727545400.68675
GlobalMemoryStatusEx
success 1 0
1727545412.000625
GlobalMemoryStatusEx
success 1 0
1727545423.297125
GlobalMemoryStatusEx
success 1 0
1727545434.609625
GlobalMemoryStatusEx
success 1 0
文件包含未知的 PE 资源名称,可能指示打包器 (5 个事件)
resource name AFX_DIALOG_LAYOUT
resource name EFSUJQ
resource name REJAXULA
resource name RUKULURAZAPU
resource name SUSABO
行为判定
动态指标
解析可疑的顶级域名(TLD) (2 个事件)
domain ns1.wowservers.ru description 俄罗斯联邦域名 TLD
domain ns2.wowservers.ru description 俄罗斯联邦域名 TLD
分配可读-可写-可执行内存(通常用于自解压) (20 个事件)
Time & API Arguments Status Return Repeated
1727545320.18725
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00c1d000
length: 114688
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545324.21925
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00400000
length: 180224
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545325.87525
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00414000
length: 81920
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545325.87525
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00b50000
region_size: 94208
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545325.92225
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00414000
length: 81920
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545326.92225
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00070000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545326.92225
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x000b0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545327.18725
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00100000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545327.20325
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00130000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545327.34425
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00160000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545327.34425
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00160000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545327.34425
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x000d0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545327.35925
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x000e0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545327.87525
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x03640000
region_size: 12288
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545327.87525
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x03650000
region_size: 12288
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545331.67225
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x03640000
region_size: 98304
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545331.67225
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x028b0000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545331.68725
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x04420000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545331.68725
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x04420000
region_size: 36864
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
1727545331.68725
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x04440000
region_size: 8192
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 3008
success 0 0
查询磁盘大小,可用于检测具有小固定大小或动态分配的虚拟机 (1 个事件)
Time & API Arguments Status Return Repeated
1727545327.82825
GetDiskFreeSpaceW
root_path: C:\
sectors_per_cluster: 8
bytes_per_sector: 512
number_of_free_clusters: 1782278
total_number_of_clusters: 8362495
success 1 0
在文件系统上创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Roaming\Microsoft\ujsrrj.exe
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Roaming\Microsoft\ujsrrj.exe
搜索运行中的进程,可能用于识别沙箱规避、代码注入或内存转储的进程 (1 个事件)
检查适配器地址以检测虚拟网络接口 (2 个事件)
Time & API Arguments Status Return Repeated
1727545328.06225
GetAdaptersAddresses
family: 0
flags: 0
failed 111 0
1727545328.06225
GetAdaptersAddresses
family: 0
flags: 0
success 0 0
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '.rsrc', 'virtual_address': '0x00723000', 'virtual_size': '0x00027888', 'size_of_data': '0x00027a00', 'entropy': 7.663118920584151} entropy 7.663118920584151 description 发现高熵的节
entropy 0.6417004048582996 description 此PE文件的整体熵值较高
使用 Windows 工具进行基本 Windows 功能 (4 个事件)
cmdline nslookup ransomware.bit ns2.wowservers.ru
cmdline nslookup carder.bit ns1.wowservers.ru
cmdline nslookup carder.bit ns2.wowservers.ru
cmdline nslookup ransomware.bit ns1.wowservers.ru
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
在 Windows 启动时自我安装以实现自动运行 (2 个事件)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\iltznnoyuew reg_value "C:\Users\Administrator\AppData\Roaming\Microsoft\ujsrrj.exe"
file C:\Windows\win.ini
使用 NtSetContextThread 修改远程进程中的线程,表明进程注入的迹象 (50 out of 6334 个事件)
进程注入 进程 3008 调用了 NtSetContextThread 修改远程进程 0 中的线程
Time & API Arguments Status Return Repeated
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.68725
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.70325
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.71925
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.71925
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.71925
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.71925
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.71925
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.71925
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.71925
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
1727545315.71925
NtSetContextThread
thread_handle: 0x00000000
process_identifier: 0
failed 3221225480 0
生成一些 ICMP 流量
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意 (50 out of 57 个事件)
ALYac Trojan.Ransom.GandCrab.Gen.2
APEX Malicious
AVG Win32:Trojan-gen
Acronis suspicious
Ad-Aware Trojan.Ransom.GandCrab.Gen.2
AhnLab-V3 Win-Trojan/Gandcrab.Exp
Antiy-AVL Trojan[PSW]/Win32.Coins
Arcabit Trojan.Ransom.GandCrab.Gen.2
Avast Win32:Trojan-gen
Avira HEUR/AGEN.1031185
BitDefender Trojan.Ransom.GandCrab.Gen.2
CAT-QuickHeal Trojan.Cloxer.A06
Comodo TrojWare.Win32.Fuerboos.DF@7nopzm
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.ad4596
Cylance Unsafe
Cyren W32/Gandcrab.WAFV-1152
DrWeb Trojan.PWS.Stealer.23759
ESET-NOD32 a variant of Win32/Kryptik.GGLD
Emsisoft Trojan.Ransom.GandCrab.Gen.2 (B)
Endgame malicious (high confidence)
F-Prot W32/Gandcrab.F
F-Secure Heuristic.HEUR/AGEN.1031185
FireEye Generic.mg.a79b70cad459605a
Fortinet W32/Kryptik.GWXD!tr
GData Trojan.Ransom.GandCrab.Gen.2
Ikarus Trojan-Ransom.GandCrab
Invincea heuristic
Jiangmin Trojan.PSW.Coins.cu
K7AntiVirus Trojan ( 005339341 )
K7GW Trojan ( 005339341 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=86)
Malwarebytes Trojan.MalPack
MaxSecure Ransomeware.CRAB.gen
McAfee GenericRXFH-SC!A79B70CAD459
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
MicroWorld-eScan Trojan.Ransom.GandCrab.Gen.2
Microsoft Ransom:Win32/GandCrab.AF!bit
NANO-Antivirus Trojan.Win32.Coins.fbfnma
Qihoo-360 HEUR/QVM10.1.AD0F.Malware.Gen
Rising Trojan.Kryptik!1.B22B (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Malagent
SentinelOne DFI - Malicious PE
Sophos Mal/Agent-AUL
Symantec Packed.Generic.525
TACHYON Ransom/W32.GandCrab
Trapmine malicious.high.ml.score
TrendMicro Ransom_HPGANDCRAB.SMG2
TrendMicro-HouseCall Ransom_HPGANDCRAB.SMG2
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-05-06 16:34:21

PE Imphash

7e53b405b436d0182c746a67e8151655

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000ccd2 0x0000ce00 6.709215510789321
.rdata 0x0000e000 0x000066be 0x00006800 4.740548405125018
.data 0x00015000 0x0070d8a0 0x00001a00 3.0406703214733835
.rsrc 0x00723000 0x00027888 0x00027a00 7.663118920584151
.reloc 0x0074b000 0x000011e8 0x00001200 6.48852501143195

Resources

Name Offset Size Language Sub-language File type
AFX_DIALOG_LAYOUT 0x00723a0c 0x00000002 LANG_ENGLISH SUBLANG_ENGLISH_US None
EFSUJQ 0x00723a10 0x0001a7e6 LANG_NEUTRAL SUBLANG_NEUTRAL None
REJAXULA 0x0073e1f8 0x0000030a LANG_NEUTRAL SUBLANG_NEUTRAL None
RUKULURAZAPU 0x0073e504 0x00000144 LANG_NEUTRAL SUBLANG_NEUTRAL None
SUSABO 0x0073e648 0x00000e79 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_CURSOR 0x0073f4c4 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_UK None
RT_BITMAP 0x0073f5f8 0x00003928 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00749278 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00749278 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00749278 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00749278 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00749278 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00749278 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00749278 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00749278 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_DIALOG 0x007496e0 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_STRING 0x0074a464 0x00000090 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ACCELERATOR 0x0074a5ec 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ACCELERATOR 0x0074a5ec 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ACCELERATOR 0x0074a5ec 0x00000030 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_CURSOR 0x0074a61c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_UK None
RT_GROUP_ICON 0x0074a630 0x00000076 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_VERSION 0x0074a6a8 0x000001e0 LANG_NEUTRAL SUBLANG_NEUTRAL None

Imports

Library KERNEL32.dll:
0x40e008 GetLastError
0x40e00c SetThreadContext
0x40e010 FlushFileBuffers
0x40e014 SetFileShortNameW
0x40e018 GetTickCount
0x40e01c CreateMailslotA
0x40e020 MapViewOfFile
0x40e024 FlushViewOfFile
0x40e028 GetModuleFileNameA
0x40e02c GlobalAlloc
0x40e038 SetConsoleMode
0x40e03c SetConsoleCP
0x40e040 GetConsoleOutputCP
0x40e044 GetStringTypeW
0x40e048 OutputDebugStringW
0x40e04c WriteConsoleW
0x40e050 SetFilePointerEx
0x40e054 GetModuleHandleW
0x40e058 GetProcAddress
0x40e05c SetStdHandle
0x40e060 HeapReAlloc
0x40e064 GetCPInfo
0x40e068 GetOEMCP
0x40e06c EncodePointer
0x40e070 DecodePointer
0x40e074 RaiseException
0x40e078 RtlUnwind
0x40e07c GetCommandLineW
0x40e084 HeapAlloc
0x40e088 HeapFree
0x40e08c ExitProcess
0x40e090 GetModuleHandleExW
0x40e094 MultiByteToWideChar
0x40e098 WideCharToMultiByte
0x40e09c HeapSize
0x40e0a0 IsDebuggerPresent
0x40e0ac CloseHandle
0x40e0b0 WriteFile
0x40e0b4 GetConsoleCP
0x40e0b8 GetConsoleMode
0x40e0c0 SetLastError
0x40e0c4 GetCurrentThreadId
0x40e0c8 GetProcessHeap
0x40e0cc GetStdHandle
0x40e0d0 GetFileType
0x40e0d4 GetStartupInfoW
0x40e0d8 GetModuleFileNameW
0x40e0e0 GetCurrentProcessId
0x40e0fc Sleep
0x40e100 GetCurrentProcess
0x40e104 TerminateProcess
0x40e108 TlsAlloc
0x40e10c TlsGetValue
0x40e110 TlsSetValue
0x40e114 TlsFree
0x40e118 LCMapStringW
0x40e11c LoadLibraryExW
0x40e120 IsValidCodePage
0x40e124 GetACP
0x40e128 CreateFileW
Library USER32.dll:
0x40e138 GetMenuStringA
0x40e13c SetPropA
0x40e140 GetMenuInfo
Library ADVAPI32.dll:
0x40e000 ReportEventA
Library ole32.dll:
0x40e148 CoGetCurrentProcess
Library MSIMG32.dll:
0x40e130 TransparentBlt

L!This
m cannot be run in DOS mode.
2}Rich
`.rdata
@.data
@.reloc
uKWWWh@
YWWWWWWWWW
YWWWWWWWWWWW
_^][UQ
;rr+9|$
SVADW|$
@u+UQu
UQSV5p@
3_^[]Uu
H]WVt$
on0v00f
on0v00f
on0v00f
DDDDDDDDDDDDDD
HuYUVu
3^]USVu
t9W>+~
PYtG}
YU VWj
^]UQSE
k 3@[]U
E[]UQQE
MuWx3U
UQQSVWd5
^]UVz.
u3@]3]U
SVWE3PPPuu
E_^[E]WVt$
on0v00f
on0v00f
on0v00f
DDDDDDDDDDDDDD
tAt2t$
3PeuEEd
3@]3]UE
^]UQEPh$@
C;r_^[]UVu
]UVW3j
_^]USVW=D
sYu#tVI
u_^[]UVW3u
YYu*9E
_^]h:@
+SVWZA
1E3PeuEEEEd
Y__^[]QU
8csmu(=
2yE_^[]
EMEineIE5ntel5PTA
E5Genu
MMtCE%?
_^3[]U(
0ffffffE
YM3_]UE
3PPPPP
;r=VA
t'@-rA
V38W30@9u
u!0L
YtD0,+
,3@@QQj
8Q$PEP(
Y4f;uu
Y4f;uOFD@,;U
<+0;sD
r3VVhU
QH++PPVh
= 3GWwY<0($
+[M_3^9]UVu
^]VWHXA
YVWHXA
|3_@^UE
8_]UQQM
3GW3Au
EmIuEt
@tJ=ZA
E]UQ}M
E]UQQM
vHY~\@@
~lt#WG
0YYt3V5ZA
~pjCXf
Flvl5D
YYt-V5ZA
VW_^]M
eEen@|t
tr8csmujx
hE%38E
EPYYE@
>csmuH~
u,>Vu$6u
WP_]UE
8csmu9x
]3]U<E
>csmu+~
YYuD}9
EPEPuu W;M
u*EUHM
u$u uuuWu
SV,UEMA
u3u$u uWu
Pu$&jWu
\UQQW}
t1?MOCt)?RCCt!u$u Su
;F|c;F
u$Nu Qj
M;r^[_]UQQSVu
;>|_^[]UM
HtHu4j
WAE_3@
8RCCt!8MOCt
8csmu*
RM 3@_^[]UVu
t3@_^]
u2t&:a
et_EtZfu
]U,SVWj0Xu
uy3;uu;t
]u'j0XF
EfyfxW
v6j0F[
Wj0XPV
PjdSQ:
ap_^[]Uj
MSWu D]
-jd[;|
Map_[]WWWWWU,ZA
^VQMQp
M_^3[G]U
Map^[]U,ZA
[SQMQp
^M_3[]U0ZA
[SQMQp
E3H}-E
^M_3[]Uj
uVJ:0t
E`p]Uj
Fu^8Et
E`p]UE
3@]3]UW}
^VVVVVaV3ZA
8csmu%x
S^`F`y
j$_F\d
]j@j _WYY
jEPhZA
Y8Y4@M
} j@WYY
2t[;tW
Y8Y4@MFu
EtLtHP
cYUQQSVWh
EPEPWWVc
;r6QYt)EPEP
_^[]UQQE
tj"Xf9
j"_f9y
t"f;Et
j=YfuG
YYtAVSP-
Y_^[5$
3PPPPPj
@Y<v5h
]SSSSSUE
ME3M3M3;u
;r_^VW
;r_^UQW
tGS3Vf9t
3@]UQV5([A
]VWhD@
fu^UVu
Y+t"+t
+t^+uH}
u?GdEGd
u wdVUY
PY]USVW3
_^[]U}
jA[jZZ+U
_+[^]UE
3SVWH<
B(;r3_^[]Ujh0>A
1E3PEd
Y_^[]UE
Map]US]
AJu_^[]U
A;rM_^3[7]j
Yuwhu;5\_A
V9Y\_A
Gh5\_A
Eph33Su
QpYEXh3@
C9]vO}
kE0Ep_A
OuVIY3_M^3[]U}
OY3MS0u
^]SVWT$
URPQQhp@
t;T$4t
;v.4v\
UVWS33333[_^]
33333USVWj
_^[]Ul$
Map]Uj
3]UQQVu
EU_^]U
3^[]Wu
PYYt@}
~';_t|%39E
;_tr.~
Map_4Uj
t*f u!f t
ZmZ,$Z
A_^[]USVu
t_FxtX9
Y_^[]UU
1N_^[]j
Npt"~l
t4V0;t(W8Yt
3_]USVWUj
P(RP$R
t:|$,t
;t$,v-4v
UQPXY]Y[
E`p]U=
;s`Myt
Et%Map
Map_[]U=
YY]UW=H
#3+#I#[
3[_^]U,ZA
EE3PWWWWVEPEPp
apM_^3[!]U(ZA
E3PSSSSVEPEP
MapM_^3[
_^[]U0ZA
3^[2]3PPPPP
WVU33D$
YY3^]j
Ju3_uf
H]UVW}
ft%Ou +
3jPfTAX3f
"j"U$ZA
MEt/t+
3M_^3[2]QL$
YUQQZA
E$39E(j
3tAEWVPSu
t!3PP9E u
e_^[M3]U
u(Eu$u u
Map]UQZA
W39E Wu
e_^[M3
KuZ^bA
Ht+Ht$Ht
HtHHt
PQW|PEP
6~YM_3^z][UVu
PrYF$;
P`YF8;
PNYF<;
P<YF@;
P*YFD;
PY^]UVu
Y^]UVu
J6Cv ;v$3v(+v,#v0
v<@v@vDvHvL
EPQEPEj
Map[]j
'YUDZA
IA+3@u
DJx.t'D
<+3M9]t
j EX+j
MTCE;|
IAjX+E3M@D
OGD+3G
};Ej_r
3ADJx(t!D
UTMEE@E;|
IAMj X+]
Iy5(cA
IAj ]X+
Iy}jX+
7M_^3[u]UDZA
IA+3@u
DJx.t'D
<+3M9]t
j EX+j
MTCE;|
IAjX+E3M@D
OGD+3G
};Ej_r
3ADJx(t!D
UTMEE@E;|
IAMj X+]
Iy5@cA
IAj ]X+
Iy}jX+
7M_^3[
E3S3@VE
]W}]]]]]9E$u
+tHHt
X]3@EA<
+t+-t&0tC
3@E0|*Eu9
B0}uEE$
kE3@EEEu
HB0tEE0|%u9
B0}uE+
+t"HHt
v09] t"BE
mH3@E9
B0}JEM
HAO8tMMQPEP
U_E}}~Xu
Uf~;x2E
f;r3]f9E]
Mfu 3f9E
M_^3[h]2@
A#EE?UEWft
u0h 5A
;u%u!h(5A
u]]]]}
U^|uu~ru
uEf~;x2E
E}B}Ut
M]Euuj
u@Eu4E]u fE
f;s fE
}fEEEuMUf}!3f9E
UX~X}E
[f~[fM
fMU<f@fE
f;s fE
}fEEEuUuf}
u]Ou}]Uuj
UuuE@E~
AEHME~
EE>u}A
0I;s;s
3@M_^3[^]
3SSSSS3iUM
YEm}E3
_^[]UM
Xejili zuyo wi jufebodoyi
Vibibozuve mayu
Dikicisupizi pikarebe givinenasabu
Yiletozo yihebezobuwuci wudo cadufero
VirtualProtect
generic
unknown error
iostream
iostream stream error
system
string too long
invalid string position
bad allocation
permission denied
file exists
no such device
filename too long
device or resource busy
io error
directory not empty
invalid argument
no space on device
no such file or directory
function not supported
no lock available
not enough memory
resource unavailable try again
cross device link
operation canceled
too many files open
permission_denied
address_in_use
address_not_available
address_family_not_supported
connection_already_in_progress
bad_file_descriptor
connection_aborted
connection_refused
connection_reset
destination_address_required
bad_address
host_unreachable
operation_in_progress
interrupted
invalid_argument
already_connected
too_many_files_open
message_size
filename_too_long
network_down
network_reset
network_unreachable
no_buffer_space
no_protocol_option
not_connected
not_a_socket
operation_not_supported
protocol_not_supported
wrong_protocol_type
timed_out
operation_would_block
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
destination address required
executable format error
file too large
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
invalid seek
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no message available
no message
no protocol option
no stream resources
no such device or address
no such process
not a directory
not a socket
not a stream
not connected
not supported
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
protocol error
protocol not supported
read only file system
resource deadlock would occur
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many links
too many symbolic link levels
value too large
wrong protocol type
Unknown exception
CorExitProcess
_hypot
_nextafter
bad exception
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
CreateEventExW
CreateSemaphoreExW
SetThreadStackGuarantee
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetLogicalProcessorInformation
CreateSymbolicLinkW
SetDefaultDllDirectories
EnumSystemLocalesEx
CompareStringEx
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
IsValidLocaleName
LCMapStringEx
GetCurrentPackageId
GetTickCount64
GetFileInformationByHandleExW
SetFileInformationByHandleW
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
MessageBoxW
GetActiveWindow
GetLastActivePopup
GetUserObjectInformationW
GetProcessWindowStation
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
1#SNAN
1#QNAN
GetProcAddress
GlobalAlloc
GetLastError
SetThreadContext
FlushFileBuffers
SetFileShortNameW
GetTickCount
CreateMailslotA
MapViewOfFile
FlushViewOfFile
GetModuleFileNameA
GetModuleHandleW
WriteProfileSectionA
SetVolumeMountPointA
SetConsoleMode
SetConsoleCP
GetConsoleOutputCP
KERNEL32.dll
GetMenuStringA
GetMenuInfo
SetPropA
USER32.dll
ReportEventA
ADVAPI32.dll
CoGetCurrentProcess
ole32.dll
TransparentBlt
MSIMG32.dll
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineW
IsProcessorFeaturePresent
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
CloseHandle
WriteFile
GetConsoleCP
GetConsoleMode
DeleteCriticalSection
SetLastError
GetCurrentThreadId
GetProcessHeap
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LCMapStringW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
SetStdHandle
SetFilePointerEx
WriteConsoleW
OutputDebugStringW
GetStringTypeW
CreateFileW
O'[;VKo
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Ix@oGAkU'9p|B
~QCv)/&D(
uuvHMXB
9;5SM]=];Z] T7aZ%]g']
?Zd;On
7?3=Bz
;1az?aUY~S|
D?$?9'
*?}d|FU>c{
zc%C1<!8G
u7.:3q
#2IZ9W
,%I-64OSk%Y
.?AVerror_category@std@@
.?AV_Generic_error_category@std@@
.?AV_Iostream_error_category@std@@
.?AV_System_error_category@std@@
.?AVbad_alloc@std@@
.?AVexception@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_exception@std@@
tz*-]APv
irzCD\6
e~N u'
0HC#l.f.!
lFH't
T.iG1p
+=Ggr2$^
W5;dc9#bPN7
B|(j)^
d0?d.Gc3
~_m<P|r:
y;[NjgqW
rbt|\Y'Z1LT
=#O6u=
AXUty]
jVw[0TUVJ
].ccgx`W
{Erj&|C
y!,uZI
`(\z`z
;wr}h,(6
lW}8@u
!{jA40P
c}d23Al)/#
?^BN(jQ
fB!F<5L
|pJO,)@)
4GBt$3|R52Y
7}rR[qj
=+,#e/HID}Pw/'
mK!9QO
WsoP~y
nUEJVL
xnF#ID
SktBJ]?Xk_ew1
cO|%"8
S4s+5o"
7sUQWS>5p
8lu];ak
: :~cEOd
hlI<1t1P\R0.
%R$[]NSC
)SQ@Nw-DA
<28aDOPt
|29e4pgk
b>2X=v
}w=~dZt4
Z~&9nm
Endk'T
|oS]9P4"PMSlK$G
AL1F@Q{QL$*0
f[mIp<
Nj3bY(%
feKm[3
M3*_&p<
g;Uf+9r
pj2s?}U
26`:'Z%[
k-vBp\b
2d6qOp
?B#-pk
l.#5U0pmgTN
X}q.(2
P Ez_:~8
^TjGTU` y .I6+N
B4F6>M>
"]5lEe>
:Jm]7N{ssS
r50\Kv
ZJdyoV
!.q8Sx7t6im
5!bPf[!@
+/,,rD
UL8[1tCk}
{LftX,}
'r|'|s
*C,=\R
|:,0B-'
sFi4L}
,yKSA4
OYpeGg
l!F9+f)X{ 7Qy
Upi=o+Jyf
^oD3?S4;1^g
URZ,pq
mAL=hL[)!8
gR{@jA
qo8iXX7
9 YTO{
#MH'*)
K'.<G$
<'Ui+c
:*r-FB}|+]
7aEY'Z
AHOAi"i=y Z
q*SYe!
?Qc<V.r /
p1$CJ;g6bc
mf3a('
2r|>.t
?#\)<uY0
pJ{**$
ChRkoW
}+zn%
y\@v0l
5bM;Xay|>1Y)4
@NmgO5q
DhLD[-X$:
u,F[$&/
Ay>r86G[2(
`A4)b^.,z
\W2Z%:~PnX
e|bH'9 v>b1|
3K3pS{X
9KU?>5
?XG#:bxYauh
Jk}9o
Ek7g-S<]blj
j(n Wt
3|uI#t16R}
um`Bwf
DP*m9)
^u<z:X
x46)aS
2K &o&;w
wY?O6R
7^jNJs-Ogf
SQCh!k^
s*gZ8&eHrkH
=GIcC`;'`
RJ2r%k
O_v>;'
w&j7kt.j(274bd[
'DWvW6
J 95e_z;;18G
y6~d#`3
tw:l|$
K<^mGE-
o~gDn;#?3s
Q*"\`',W(Q
!dtlaY
S~2L36f9<
6kfT{{P t#B
Z$T@B54
3z[LmiNdbi
)Ztyf;;CA
%vDvyAIT
1*G=<T
"Q8`L@
i<DnCW[
%^kyjg
i#j`dy?
_lJ0bj
<DyZwi4
w7/;N s<Y>^%,KNGK"D*.
[S2L[V[r|j
mS'ZJ-
@|H%ZY/
AsFmWo
Gm=Z&[B
+/G[{j
O(W?_.9
yK$3$b
G5o.S9t3
9goW2u)
/=H\tyY6
vk~qJi
S2j"_z
S&C[>$
hJ+ Fi
%[&e1yV
^AUYJX)25gL`lO
-,?#mE
@yZ&8O7t
'IB(lR_9pTv~`OgWTZ<
8>}3hyS9Ig
6jV1OzD
4!:u<^
PRCsbULs7
Z0Ri.rXhem/-
D_#:.9cb{
; Wo#sCS
M:,[H\
ww$7$kqD1NA-ll{!5&g
g1D7$BF/|b?&eX`[
>+s~dHpmL
,T.bFz)?0;
q|%.r$+ 4D9C
?)SO@}
:"c_E'\FrZnYv2:
/v]\ja)
/X!|%C
l{qCTlAr
<uf|z;8A8pc
sC<KCX',
3B%'vUw
Yeyg(?+R
L!|Vk^
`w}r4I1M
nB$0|%S
`HN-{tg9
Mm`49=
@j-K,4H
95%.m.
Y'%3D'B=SNezUT
`D bbY
4t~Zd'CKwf
A`4f9!
pY%mKj5K
iPmE'1 .g
mqyMc@[6DsT
bS_UH<
=gV}JxU74
WSv6FjG{V:]K8R xD!:
LHp)@SL5
+p*pe\
'+lANl
gU\B`^CRM 7!-x
\|(5$k
zqZcc6)3hVx
+1wm= B
`K=oi|G{y^2Z+!
6fEh;dI@<om
Az\Yli;Af8X
(.oA!j
,W.DA-
2h#_/As
V&sDkknA
55yu+o!
.xn"4`G*
ATE@^}KH[|![1rF
JJ;DP0eo^sb "b8
)b6wB2
E@zv3!?qNJ0
^\5&;i,Aq;<t
^]6B^r[>6a
EvF vs0l
b5ELOg
dtx_Zw
(2+Hr\v
}a=MmQ)"Y|
.?N|+=ukMfO
|E<l25,.e
hq;u`tT8%kus0
&<z0`ErW
9Z5m@a
Te'h!y
KC_HZlF
n:C,04
Y,D&j6|o
z~6n"KA&jb9
!{?!?9w
nq>Ps*.A
Pe8+Dq:
Rf[Z9X
.U+W[C8
PioTWO"A>
p<:y/z
5UjX<m^.:}
>8ibh]y
\snqmZ\{/6r
KrXl~2%
e0J{vHGMz
<f%uz:
$.k(Wsac-KMs5a;t;
k[V5GW5
YR>!I)=xW6
sj,sK]
Nz\tzN#Dmv)
c!uU K]1)o
mmp[%0Y
) 3~Y-Ui:
k|$sq@!&G
v*z+gAY
8I{rn*
7~~qcvD
&COm2XiL
oI2pjlb
(mWkXpy]u
%EPW mL
c@9Kct`DeO
=$u,h*
$!!i3/r
nziZ>)H|S["=CB
ui(7l
9B#aQQ
[OXy~n
qlH(YLJ:x
)c-7H$/
.=;76[hjh,
gGrv^Wh
A77fa!
_aY|YcdC
:H~hy00
6iL!WIb
[S;g3y|
p7,C2K
a"<^C%6
%m"/VATm^
+(!b!b
\`FpsR
f|I$u7)`"|p
zi-%^,'[
B15@APq.
xq]B`?
WTjr.b
lk*NwH
NE#-gY4
doTQ#"
1PHyqr#
ru.ktH#H
:4wU#*7Eg\
Nnk-[S/*VB
={:f_6+
xY(7aB"
<RJ`Yy
=1&fD*{
T39Ec!RR4A'p([=.:cR3
wQ}w0-"p9
m[NKZLiIR
DODBBgP
e7)M>_&A
:s?YH8dIwSg6Qe_Popw 3
O)<:ffp[Y-LP:
p ,@F*T
%y-4iA
E^&MJ-5s/]
/j#dLOyMtI!C.5B7
1'd;QS8'l
.T:'B]5U~}2
X}R?pi\
<fn3#Z
<Btm0;
j"6Ua$
clt,lVzfUq
os*ys8
(-L=m"Lk
\lTFF>
Zl49NSD3
P11uv "~^4f
oD~t}&lat
WS04UHz
{lqR4,UNOmUVp
;n=z=s1&~U0
_D>7oL
/Rn\t>
32."-.^M
rW]L]U
Qnia`F_KI
/Zsf[vB~L~JHe|
\D #! W5%
[rop{)
+3BHTY2
vj$tXSY
>iOH/@%
!mcPxFny[.
i#WN[=qU
',h|7;
@ TBU.6sXs
!0|wIF:!D
61l[mX
Gfh@im
6m%dJC%q]L*
iw6&W(UK
hcVk.*
tcX6|od
"H4c}siU
"185i{^'o
9*TB7S
E;+/gH
;d_pPqud
"e0#p&!^
5)ZgcS
nB,?XMn
t|35&gp9hjs
_qf`AC!v
UPYOvu,b~CS
pl8bbl3N
JEYWja
1<X^K'7
IfgZ`s
pLMoI9
w<W%[
*+ld7"98w4
40q%`Dyvm
ll?wV,M#rM/h
eR* Xw4+d
Oq-Xl0!
8|?OSI)4(M
E?xuI>
Y7nq?\|
:zRe:]]h
4F.Ot?Mu&#q
>8=bXmMaQ4
.e}xu~
8eXmLX%=l.w\
+Uk?Jk$y?Of
)|+>no
Ekm"5[Ow74"
ck-zAS
V:XIt9|Qav
+!mtfZ
?fe~Wi
v#F!$hsG
WUnatnIrT1]uEnA=
N.W&n7gd
G^(@+7
>da:/w
!sgY[GEy
]0'C79
D0k9+#
,,#ews
ab3h(=_P
)Z>liA~0R`3
!%/%,rkU)f/bu#iq
yDpU3{v
vS;08V+%')
@/#YcsF3R
~tG#Wj_8
1qbY[f8qM^
2u{{gC]lXo
c@qUPR^
CIF:y0h'
@w,>QZ`7
(% 2E=bRs
(\gXw%Q
)nuZ1L6Q
8!;jzoV
F&@; dvZSQ
g*y)QL
SY}P_J
:do= s=X3"/\;U2h/{?
;LHscMG"
fv,79dk<$SPDy
GYSO"
y3PAp
YZok)4_ta
Ku/#Fa
4#c#Y!Qo
Y?!Niu
6u;u9}O]
]Q>j(/.7zCTb<-|
w'od=Xf@}
;\$Ja9
bF'(k}Zkm
8_"M.C}U-jK|A
:&f<.>U1x
df(.I(
@#Z[{_
;zm52c^7
R9TA9#k
AvYZ1?Q
ecb-?Y
/%FE1W^6+
sCdy!&
?(HshXG
[8ef|Jj]WXIW
/i5FXPfAb`m9
G'yZ'S
W&Ghu&
^<`s'#ey
dv+|!
K,(IOt
j`}Hq5I%}+
r.\EOrHp
Th-k:NL5%]Eay
%O)+P9
N>c[AQs
n:x/`Bzj
fE:unN
c!S1lwj
I; dJxu
p`i{[/h({MM v3Zx(
|v?}Ll
%i(j(apTv?
=W\F2cUz%
44XA\B
]K/EPxS,lq1
ESzC/b
[+tOh3j}
kw%%lI*
E|XeC.
BdRBx$*
Bu9?Mg{I,
9Sxz}`'1&MMAz#Er^
a~LM7-Lpt
vA@ N)-
'2*,:8q
6<D-jex;Uy%
@oAp8S*s)
+eCMcj0":
'`tYv*
)L$`e~C
4p-FN=
]\*X<&*
B'n[/W
<=J-a[xA
UN?f@8
OH][b72a
I&\ca*F4e
^cd?k?0&
?J<d[]
|#jupY
ca{0H`
QPBu{;T
JksiF3RZ
V-_'sl>r
(1!si%Kf;L#
9*!(!]ibT
bX22pAl
[}o[<*p
\X(i':t+
|FWdX\
L61sU}o
E.t^(J>-
ZjL0uA
\>6X,NzeaoEUmAkIfD
$y:)<]
&Pr~6U.n
YE.UU
^(5>Y)^Tnj&8
U;Wi[|
btMeq>-$F
s",y?R
r(q_'`j`D)
Q~%.]&1tR
7F7Ap|[ddS1
/n7h~-ZLp
4|^Ssg8i
Tm/sn\
|?6]3M8M*W~
L?t/[~ucg
3n>HDqLq>|A)m_f?h
fusQVV`j
^N9]+e!#
@N^UOM
Fx]%Il
6 b]=i{/m<5
=z[W@f~8w;0@$|K'd9U~$
mw|Zrr\
{-u_vf]_S"]
}"52WL
Nfr-y{
YEV)}"QfQ
[K@M+z@>[
Rq3gM`D.&B.{^S9|k$er
}N1lET}}Re7PGZtH3T
s9J+B1
9M~F#?2
Q2nC~g$`x6RW2(aFda}
cE,uy+aii
_ QsH=v
}_B/w.2ul5iOp
4WKm]8*/
)P',fu
Lp'7DlG`
{/5%;Y
lCq~nU6
{2K"YQ%(OFEmZ4
E=8,i]lF[
:mrkY%yGs:K{A
L);{SD
/'8ha7
Rw~y&Czj
N:7ZC-%
wM&\V}?W
"*Sk,;obUf
>5s:-8pk8
#*9?E|
5I2XkHt
o,}!rB
M+k8N~Y0
1Dl(U;!cArxG
1/gti{
e]2%Q`<_M
M3!>K02
4.1WRC
h@m}aMQ
d`6nn0
nn;qy.n)
~/opK_Ny
hyW1C<H1\(;
n.z(3hh
7M_5Xta
d??0Pq
6tilM`xO,
%ubXoV03K
8,N8[9
vMknSG
m{o~sW
$4%L:P85rI
dJXN&m2_Y2R
wpl $KHM
wRj,`}D4{,2
eoOb;4#z!tih)
#k^*7sh
p$H.]E1N
GFOa&-`J
2A#im}@
YiJ\{o(]x
9r|b{i.
6\XA629Lh
J@A%ORaF
x8.HnV{
S1uQh\]
]bl<Oy[V{gt87EwSU+< q
B*kEIg>ct1
<`j@kO
Zc1{hBcI
m7iF5zqN
b:{rW4?E
j[UUR"Ae
eGNAt01Ib
K\E>u$(pl}
+Dt0OiW @wYTJ<
cI%MIFYB
U~d82BND
UM0Iu~
5H\/zPG:|d]%<
VsH7/Q
|(;-m)WGK
Ew9AvM
l=lpf5SG.
ND%S'~
'M_QDF}SV
NKDj;[
(TK^C5
tZtNs8
VEb$Ya(Y(uL~u&
;DR)9f
68Jxg#
S(gsbU.<D!WCk!S
LcJTrB
SX)I@MW
"|"fvizg
@<GcuY:*15tpX/
~H)#gNsW^
bkx3N
n@|klOz!f
Ew^)"8
M*ZlV3:
-BS7fG90
l6e77J
]6d>JbRD
MEgtw}
\&yN=/'=
a<o_4)\&'
tg'e'7@
Z[[q@+~]-sT
jA.H5|=[cy}0|/l@s&{RLtT9
>fDU*sNLur)GX}
~L4Q@L,
UVN\L
\+lKXvw=p
WZFvF}(
2e[dhNM\n+
nz&bn}00
!qu%NrN
vMVe7X<80~
xA29{2
#f9;Zobj=D)[-E{S?
JLA[c_
nG1!Y[e
Dxj<sRs
2beq@@|77>3
GKz; k4
vpTeihG
Ih`OqxX;
#4m(C0{rz
ClN!YQ
&M4(Hw n}q'[ d^:v3
vc E35
iYbUOJ
nwER"qG
'u8Wc
{e\#SF6
} TIqat
a-p:dR=1
)iYm5x
) n9q[irXp!
/[zc:`D
RF8ga_M\s@m~RiT"-Ck\*
UPlG0vH/YZocx|
>ZiGi;B9
</k)vx
YUTcSho.L
z@GL~q7nB
D$Y3><
tc4gJ("gZI:r*x
!z8sMT%fP
(_:m3|
b{To2oON
}RSxZ^J
:LD6ss[JkwsFF%?$j
L`fZ6:u8Vv
]x9^'YUL`@^
=[j5j1
8Ch?|'
z^]"w34w
coIZ)e|
>iODK8,b[
TWb3 nQ
#`Q`Z?
'vFy$"
#48f1\f8t9U%7
q<|&$
ZAk{e>
,nLH,W(oub
'1{(;i
8n'$3#P?
7[Ycj%
R.PTBzkehO]M
SwCKrm
c=%xG#>7]y
Oj\b0#T17`K
k~Q[K3Z$*t+X;kA
z}&baq
q2iYwQ
[@)SMT5P>
f]&%,a
}!de3m2>NM
7MS6QV
xa7\Cnf93
9<1=sb,,
R!gYXq
G;+t&FEQ
f`H_/:&g
]M_YD&
oltgPtIxy.
['c@Pb2^
6khbgZ
;}}H1..
=J.n3V^
aEQH@.6
)5myy9
y.&#13
#IoKP8
=_%.p&tv
wJky{qX
%!1A_,
rO}|4ZTIA)
e@D"[?
SC)jy{
v-/DfH*5
\2!@Zq&
TJg6t_yWm^RJD#
RiKMMbr|g
V!(dxx
qs>t%$$VUOb
G=Kt] Zj[x
$v@$t2
9$iPTH
nN0@tR@
'REmo#umv
8I_wQ/
jcK#gmO21
T.-L5bJ!
SZYdvL
|#Dt:{j
[T'vE@
C.[ih6
,^'v$E
$SZ[L(3;tb2r
,bS\9FtUs&@
WEk?-#
B8Y)-qEF`
ZgmHk52
1g{D_m
?s8&{864V.
-KGS`3W
)=Pc&
RGn+8d
-w18uV[*.v@
)E/v\Ay
i":j&wCqW)
vGO&A]kf
6m+Y1l9
je:#bEW.w<a4Q4|2]NIpc
x[b2h
C78=&tIA
:z%a=sO2
&#@X-I-\_cD1hDM
/D~J/,GXIoXoB:$.Df&H
V96u"}iL6
}+Z&.CkSKc
akTP,3 /1
q(dXH
T6CArXO_
H6t- lj
WKEs"-
WRQ\-[\
DWlMJxE*uo
R\E7L!
:,8k7'F
UHT-x/{K
[5N2GtC8
` veE|t
\:M/!7C<
1*oW_-
>|@yF(d
P:!LpLS
Q,1^nh
>0g3tz<
{FgfPgt
fj26J:
lIG)s4Iw3J
r;bdLog
@n&'"D'
htH]H:
" X1q9]7:f>ELAm9
zlXiR95\hBP"
QlZn+#
DX~2*&PVP
ObGq;d
F\,m,7E.lua>
%Z}]XFZ
xqil6.QVS`
I%3;Gq
DP{4cBl
@]*iKS-m<
^{a_[l
1JNViDDA5gw
}&|J503d~'
nB#Zl!sYh=}<c
+RP\]!zI
/q]=jCGgj
%ig-_L?
w_<@I P[
o(]\f-x
1[q,_5P$"
+I-$I_GLRU
F+#8<Z+*
XI)1pe>|RXt2k(.nU@t\a
Mqbw.n
LhY$Y`
083o<v/%o&
!|?2KfB
?1ZpS
KkXdZl
Y5E; `!
fh][OzVI
C2C5b(QhM
Y-.mx8g3L)o<
k8}PL*8:
N%o=Rg!
dzBv[Hr}{
GI,)SV3>b
* w=d1=
ev++>X
";fc<K
ViCu-Ce
3>N%ivm
$[M/R&
c/<w~X[:<
< L$[cr
g|IB~n3WYxJGI
|"l!#.8ghfE|Pt
vbKFb<;-
dTPpsU
${X|{}
w>vkU[6Oe
V|}H;d@ML
rkM^MV
2L49/p6
DWUzK.u3
$Z0ami+
Dk\']{
WEy.vS_(@uP>r
!:)O{i
Fn>#dQ)f
o,z{dR
B3?us5
P(eGSa
X7+^5Z
^0sllnA
<%~slbGN
"2DS*D3
(SWG|x
oiiv%U&
<}ahvi/fdc{T/
w%`St/Y
^xW=)>
CvdR?|
o7NS87
Vl<N\d-+
E8YY.+0H
:TR"9!X w
RY&?4%/N
5O6HB+\
Venfn9
a9{I4s}
{i,V,k#B>7Kf"Rx=P*
~hOY+T|P/S*
esajL3
6a}OR!nh
>>jbeK?E
n:ro:Ve
_>XPqw
w%IqOj
4VuWMO7akK
i}a}dV6sh
i34WKcb6F2cc}]Zu
?^,5ok
39jg^8%
\)e48$
uw:n0{D#t
}w&"i\+
_txLAn
WndTYu
?~&CfP4
$y_mj!NhC7U
id`mq|]y
AbHAyZ=a$9
-:y:++4G
/UdxC\rA54cN
pp6NM^
[XK#0V
5$5(.H
]XuC~v
dQ+.IzH
]$#YUq.P!h<
#\QWh[CdY(,|`?[6)
<W^/)`l
mx=0/#{>$\q
gpYMA>]F &
g4DwhS<O+crRI7
>ej][h
<KOD-AQ];xu7
!UL[7(C'
bAfC''#x<_s!
+U1:UU
DhBi(QI
pYzZK\i4
}1]:)f
T) R=7a"IZ-Fv^+)Xq
1r9Go4}>
GBY,]4
,9+u$*)iz
Q6?PA&
0<cNym"E
P/mr/8
a7J]+u
^oow`ja$j^b-3AvX
E jQ="R8
eP.+}t&T8
Y[P 54&(LMo9
(%?KH}US;|jsC9,V
XCE!hDFpP
{$6CVI\
9NK1pA*
,)^=s}_`bh
L4vd!>?/
e)?VHo
hX6| [
kZnzPT@vj1p
_(`-P=_eK
0+HQlA!uC'D
V-ws9T
tWz>6S
V5U)0V
5tS2ea
>9O]!|
}lS:"~*@
EqDa4!H,_
F21N,
:CE"X8X
f Xen L
;e(zNX)V
AU!8_,dF;d
=o*lYWRwi
Jvj-Q<Q
Tv:M[F
-n`2w+njk
ICt 4u9
9(e|i
3Vd+Ngj)
,}]P=d7&
BP=J;q
^>xE4h{4O
8m]'y6-S3.
2&w.@
2}]x*>]
&gduG=
S~n{+!
i#^6h,tE~IXpk"0[WuqKu
'#Ge"|
$w'-lXf?aW
,~tE}EU2
:#/FWCW(Jk
:!ItyGju
NVQyyR2X4a
T')[4@Sz.
Wd[ob&+=
~AsM~ v.XG
ch/<&
p{'P:H
l)5EgrW&x
11#v\!
9I"4PI
UfwOW)fiXV;
`0B~YM-WmA
-!nzF\
~=m}HT.o[
o9#%BS71#&;
1=\MRq0/Fa5erk
J^,Z4nv
}"Z+X0E7
XUx=+3L
8n6#1XP2
W6vO&!
te!JYl
o%ej,D
bPvL*Sv
jU.=t_
inW5Zi
w,$Vg7uz
iY=,ZJuX*
@NNK}S$
2S3w'>8QKw
<kz")'~X$
C~vlI$
"z*Os*R
QC|v2m9X
"sh<%Y
.Ek'ED{2
Lt,W~2S$,W$
!3PiD/
]SpxRa
o>m=4J'r/1
yKmF{e,m
5o_1RF
k9x4m o/I+^
fEU_Z
jO{M*3e:a
Rll-S*
wytEq(~
Y?r)2(
J`(*H/~JE
TZJ_"{#
Ph!I\l
xa::Y.
bA|\tg/;-#(*PQ
6A![y+
\mYMtqyT'g
Q0^jn*
5d`fK<)
rKvcdXQ
0mN-mAUiw
u4}',"
9C_BK:OT
ulwKg:9
NVe_:m]:
]YVTmSEj`SfVk
%b$T])
~k*tQM=$T.+`t
'T$Ck-x6'+
!u`]5;
}pljL/
OpmUzMl
a;0ZaQ
d?~63p^kou1
~D6V@7l
d|/f'Q
-(B%(RY
_~}m5`x
RlXLxB
7{ %9F
xi[)#V
t*BzSRX65Z:
M3RBjw5+,(
1+\/qrjZR^
"$.o35+
Nf`*IKS
|k6b%xQLERk
<T\7#Cy!
WB919E~1Z
=-(Uu|
#T*IS@&_Z
w1SSLZ
7?,5Zk
~iL/<<'Q_.4V}
i+ev\4;
*<az^ #nBl?} :1FDe
0,v[)z&='e
\$%N,4"=@>
`F{9f,
42I*D=D^%
>|Wx(I
Lq{-:0eBI{|a'S9Ym
1[oT`\.qT
$?L|1j^U$
nA="R
zP,ukf7
*u{nakt&`\
P$w(>X$i t)L*Yo
LpFG0daBh-}bt
,X]VkQb
]_*s ]i
z>q:!b
GdyBlqUU+^
JChV>n
_e2zb*R
cn6#;1w
jI@IJ9R"<@TWj/
,?+Qz
HVN&Y"#
0rc$FS
k4M]hr7
b.SDd`
AXLbhKu^
1N{PiGYs
,p6+kAvU
^55Zc.a3AJ
E6+D_r
oT08Z=5jaR}
.I`KU7~6
=h7&+")pPl{
'XH$m.(
<*M2+X'G_
MVIpk
L]Ze!M-
ItTc$&j
RN%ElX0
T"l}aO}b
phw{yB! w
+iN1$
O:w?h=
IL|L&'
0khiR(
W_/c-VIRu=#
|8eUSp
Lj4L>N:W
`$2D1<fiJ@G
"?6|y9
q&ss>r>m
kc-@Un
=,Hp>l
EAdQ,XeC
_\o"1QY
g0,<\s
uK&~_
pO1X?$U&sY30Z(h{
kz[c8aN
ssfPuZ
Yu`sIR\Qmz
hCd7gC
ZA:F(YZpN^
e|t]kxJW
1q?9x&
UUsYBa)x62f:_PqC_
7[_miBEA
:]C*}$"\
@*u_9b/b+=ax9X
nKg^._r1
5EX{R+
Sw#=DE
Y\PWzk*
$QycS'
iVW%yU
n1.7YT\
B5_p?F*Q/
`x)eQ6A
mE=p(/
^qSQIa
OwM.BLcq
wjl~{_&=
TMsL[e7Ee
sPj[-X
+jDI+*n7
<gnX\^
:SsLFm6P.-x
Y*3wn6%
4WzeH;
wKK3!U2gu5
C$18rf(
U-z^@iC
jd%toKv
zZ5p^j
C4iII~Xn
;'Y>F<H]
1F`g_
C7T:E4f W
_UUP3mwD#n|jk/gE
.Yzjm]_
OFT$HtP1_m
ouV^ LnbN/DP
F@'LNw}j_{0|geh^E
3a=5b`bdGQ
Q(b)Nv#:
Vb1Fa>~;xG<
3<[6^%
%'Q0h=a+H
riu$CXHM?,{XRAk
oguWbP)Tp
/w]h1=
m-rf_ZcQA
; `hM3
_h&F}.v/
KXY6qY
;+MSMW
ZD[eBO
3CYxf?
a)QOv<=dWUG
|dVuG>Kv3
dA&g1Xk
@94A_PY
V(SVcY+s*
g_P2xv
@2&Big?h
q5FooV-}
*KsL~|
vvPA zN&In
~mgA-c
a4V>%_
:N?ydz+
|_Rrv)
7"DzK&t7k
i#hfCi\4.
Gr-rfdS!y
l+KOF<*^ZIov<
"NK`jj*(
T'!DZQhHW@
'guo,!bn:[
ek(Z#:3YzP^'-"
6Dy[_vQO
IOKp]c
3]XQg@
2+Vvx6Ur
~u<K>_(WX:
c56\=.{
:QI.|w]>
VO+(oM|
q[Fn'|.
I5f&=m
:p:yx&@o=T!,%
%NhLSWS&[5iVas
XG!P\!
a}XhN"}
;|[mzo-m
lVa_X^K
( _][t
}dsaq]-x`6`
k9?7PJ'
Q(+W>u
;Ye{*F
}c(\<rRO3Enx
#r+pw`
We\arJ$8
MGI=1A
\'=ZB2g^x'lv-z:7-
YLEUC5
Y,j^va
etkX-8b7++
Fi=b+F<,Z
)>^0:d
;qK3I'V
(U"D/c~?
X\T^hJ
_Q?n=Y80
KM`DL(Y!
E"Q]:',
=,3|wtqr
a$Jr"_
ma:Onr
!l#HL}rEmQ
.2Q8y9E
b(Gu5a)
Fa[%?Mr)n
%023?Ie{
!2sir:b7y%!.!8O",nibW1]N)xP_
/RXXL&v(Wg
@pn}2O
v<U:/L
e/3ia2U_
pox47^w}'P
^<1#)j@:
_=3$:W|
TM]{PS
f&/Fz
%<Bex^
=j#4oH4lU
JB.k P6H oST4G
Ai1('I[KM
.Vc3\?
%;fMy03&N(~
?0Pd_Ss8>
9Q^Th4
Y0F>-[
[L*Afj
@!0:,a
K2<mej'Ry
fW%DHr|uI`+
Y^f oC
Nbb>n:6>r
W\w8DLh
~<L-/so|
3D&"TS
a?_#h7i
g`o7?)zkt
7W~0P(
s)\J(9A+Y
e#}iH?$/aq-6
u%WkLUo$r
_OhUq6_>3h:0_s(
Q,0Rnig
ND9r*b
b7Cv,B7v5
s;ypA;wO
NWC<.k
lCf";Ij{>y
8=v(-\c
,nB9i{I1.
sE6J/zc
:"^6VF1Dq
OU.^) TXhU
hlNf3-KX^_MY
{A ]A-KfgpZ
taqK-J5FF
M#8Uo
hA~1IK[+
:]L\C((<
-q@Kzm4
5c?[g
`?jw^
qqv/zjw
_t{8J\^dN$0eY
PM}lh#
{;^`(.w:#
M0#u8jE
P0+Et.A418HmS>
/<F)ro
%h3*%l`
, k-?
NFCKC W-
$C8e{'
%C&,iE8
!+e:uQp
lh]VB8
28H,_xObyqOdo
f'PGXr2
zO]5b/_
d`GQ+ I
!-t)up
cV.OAvnhi
"(aHZz
[Xi`vnG
a;fu8^yQRSY2UqZ8<_nN
S<KuK8
c}Z^@z6
B33ge3c
X1ilA'?
yj8-!O@Q
QQgFBpx*X(
1a\}48
4$$Ki\U
YB[k[&4v
k^[HhS
/RiW^
"hOql=8
bDBa[s41Yc}pcj
iyU]jLBqx
p]Gq,CT
`#yg"4
wQ)%<^a
{+4AP7*EhaL
0m@1j1f.2
tV(CL4x2&7joJ~(
&P"a.U0
(':.7=]bslS]+i
+GD={IN?E-|
P"@H4DZdh
p#-kJK+
q>BqAf/w
I::89qY
,Z]ty.b:~=hW\|
'd;-(vF
-7S:x9-
D(@9]B
R[]F8h
pgCBVf
6&F2?A@U
5$qphg6
KpKHyiS
VFk>AKy
~ORWQ^
8AGALsbu~J}@jQ{FJ
^\1MJmR
RAV){j6o@
v B-;3UcSL
7Bb:N A
Y?DGGVL2y#(
W4=3VuIfjFb
Dp#kxmI%KN2Sst#p
b,RAa47Qd
_({_8g
`%'?\fO<
0GAh^3<J<1W
u|Ac113Mccm
V}pSS-
&je~*CGi8
2!`ho'
8n5psxz/
M,ieIy
DwS:%Pm1
YQ|&|mEH
yOW?Hf
#Wzc~b2Cez5fvL}"62K
Euf2<+$ U&
u"M=E((du
O,0PvMV
Q'9('F !
M6t^HT
zi+Tmh~ ,S*@j0aVW
*TKyG)
'P@r\WN,;!:bz'
WdU{[q{
!(]='U
?2@ wC(
am:dD<
IHJ#j]
=ch+J=c
+l@j;~
SDcc$=zO
4y3w\5
wf\\m8A
[NM>^'%NA
<$G>d@
f{8pretkX?aU(
plz$zJ(
>O58>xB@uQz_dYbU@3o
TwL=]OC
L5u[j4@
7sQ:Gxw
!]SJjZ
l1l>Da
y5+0d;S
:p;5NF
6K~m{G#?/
<tdPJ3
T%lha>
Z1BT}/
)`mqtusr
NM:pfHRD<pa
C3~2`"|%P<x
EY!MrP
dAlvyPQT$AU
{yqN?R
o=e"9yL1
,t`'U=u
"Q*MKP
4P ty
Bps0JwCtmo_B-)TnCo*=
\Njc kSTu9)
Y)nPaX
J']BCj
RIV=+YO):
4G:}Zu
PALxDqZ
l#1PoEu/M
kpsY/B
J.e%2
`Ce[UAbf
F@=^}2
msuZ2r9
Js;C(~#`<
g@bJ%]
&SfIXHv
yX~XY"
CgCJ<o6/$r
qD6bxss
OJ(>~7
uGHX'$0&U
0$]HY3}
7^dNfF:UU
bP^F"~
J/^Q]m}x@6EkY~d'~\V-
e?J}8{q
EqHa^4'y
DjhIH
}VzyKrli
O'qpY|@ySm
n[p!?E
X,"+.
m)K^UD
{:Y0F]D#:|{,+C
[<oKO3H'\T+Nj7ftX/71&jTz!
`z?a,G!7&
IYTBL"
.;.4RDz~n\
o|^8HX
(^X!M{$
%Qb,!:
]U6jOC;z
)iAUYX
(yJ<=6 `P
{ l|wm %>
;J*|?6.
j*v.5n0
b[$[Pe
AT"?@K
`/Q*\QlJ0
3=*<up3+
+Fka0b
:W`9}@H<3lB
d2v$G``
:%PLI%qe`+
OY"#`2E?8
F@mV0#3FiK
-R`$[h}T+
z`bwy-K
z4}h8TG*)^K
\!n\}
zCx%S&X
R`'n=%
v3{+\1'$u4
:bG(mt
YYsH3hBS[**
$X4GM]Y
'0xO$kX1?
nyPb~kx
oyN{v^
t`2}s^P
*4Qk-gyv6W|s'(+
^7>zJ"4Q["oPa8 {
NdGid*
\mDp`HmaqgzKyd[
1wH?"UI
({"rwf
&Jn(O-#o?
]QU0ru
$~`y{.U
V3z%Us|:
q%+1!]
*+_;c.bNa
iq(|?,
H]NN8~0D!
1as5Ow
J`X0*V7Si
*e;*EFt$
81myuk
@(OZv&
_2o-y$'mp
SHl]Vc
z*T7yUl
Htq=w2(lc
$v94=!|
c00}b@m
c2gxM?
MNMj jI
MiYz=%L8$@:
{Ikt5=*e
eGngMxw
yl5h0v3
`P9\6di:`DM}^
ch->DJf!:~Cq
O8t[C}g{/~
]$e4BH!_
S*<Z5JJ7$lnl
I)(Aja
c,x:bl
.N:n_%S
CcrpY*Im
m2a+<,
h;N=`)
:rYtSso6
P7a}TVR/+~^
I$/-rVt
\iudyFI
mD$P}31@
4;.7D.
OT_ujC
-Em%Rl-:^B.
k "^]k
.HvK}BPh;AwK
I^%_LJ
DJBiGU
&]<}QMo\c
0'YJOp
b,ef1&;^
sP][~KjrIb3p
Q|<N&k$M
GcvRv[IL
1IUoO&C
WY3s~BmT
,nS<;g
aOc5c$
8Q}7CtX
>(Xmn@ct3RK
eo5a\,w-e^,
NP'/I
[u7n.Xw
>9GU{t
[."lVH
|[m$]l0
Wik|Py
i;)BRl
x"|!86
=#9zU`,]`88I
ergm>k.&wi
hC"_O@h
+M+PjU
`*0<kpc4T[
Ng$H `>;
r[RO<UY
e|N4/t
}y$3Q=WJ$u5g`zA
4Et7Ku=
p+/|dW)MS
POqM!I
^+v6N,MAq>
ALQ>=PY 
W0/"UY;@
s@b|O<<R
3AWhjED?
Z)iVJR_9?
J9\!Q-
67fgXfR(
9@lGQyCk}C>
O!?LJ
'zRn4n
xYbox@
P`SwPp<
k?gI!Ey(3*
#z\gzX,
iey1o
wu:x0y+i0MlSx ,*N
pYUxa8h
pwO5]y+
Gy%;Do
;+.}dL`"
yef1-Bqeb
>!BT!|AI!
4>RI}`
\1k;~a@S}F9r"
C/Djw-
i1m#/E
^;O,j
a$#mjk
/&Z_O=
Q"8D{Q
%gfz4y
~VJ>6vB\a{
XQn1MBTJy
&{IA>xKn y:k&s4
VsX9f?
]X""Q?H
tx,b-YI3Z
\O^<3~~
m~=[@m\"*]t)
#mOR4iL7`
=zDtT_1#
,TyFp.g
L,IJ"J6`n[
hK<7Z1V-`/
m_tPjIe
j`(H]+
`C9%n('z
O{tQ8}fO>fDKC=
)Y@c}^VY
9"c%F4E;
=J0m "Lb5
[%6rm~BJ7_
2@5'~UU
qVl$()?)a+
Q'~P".o#{EH
w'KX;3.M^4~>GM|
YSX0|}
z9NXZIGWRC?
)svU<51}`Y
\yt|cG`Z
!GQ{Av%Go
1QPX0>H$U#Cl
JHO$/1z<]yb*ka\
i?-W3v$D@|1.
Ip*u'=Cd
S!)i}]
^r(7Eu4
04bi?xGhA`
e8UknSu/
<qUxZn
:}-*%`_M{Jyy
wM!#3m{CW
`{`*AtX<:~O$
@pdw[Q
)G)5C2pc
!eT}9i2-+J~OD6#aO_k
EZ/lLS
% UE:!7!0W
VI@0UU
t&CZZ[:
b1%3@26v
W^gcg{
A26|pK6aA
`bhUr8D
hG@|y3#s
D*n)B6I/@^
hL'Qj,c
1^])_p8
<V$V*`N,f
)5Yf/#1Ki
;@L>x7q
z7dN%^{%\-
AC"g[FZ9
tDJ04xfn.
N~uo{ir
k2lf;cv
""?C8b
<MjRM9
+i>XJ
=$ekmjH@
k/FEksDiY
-o!9Nb
R2ve]k
^Amkr=[?]Q
MO EOmk
J@+77'y
9AU2M Y
PZt(}u7*642
Voo.y>ko
wiaUVr"
[.k\HTq)8
.TU3K-c*
O+Ni*~@=)aHPY:=6*
Vdy(ND-
IFFkodJ6] 0
eTNrXDN,(z
S]Kh-gwzC
FkB$\_
f5DDr L!2W
-x7m\;
7hq(4q
wiSB\{e+.
w3o@X,:'Eek
RDsTa
O7AECG2=
nN@hP(
wZA`4Tv
R=qF0S7Dz?
X}i,#K
|kwWtR[
l{mkX|I
FY985M
"LijJ.
^YZMq;
!hh$MH7XbFh7
edSG;NM#N{HM!i
A~Shp+
y;%Ax/1D
(YY*:x
etX|03
>&A'tg
^9jj\jP3h
D>')0@XZ%c
H%F]AovgI1
=Uv|[La
Yh\htH
T/mg I
rdJ{rX
,{k.OP
Ya1:J
F.xLF#gV
.OceW KFz^
/S-u)rf4*6V+CmD<
'Cu9xB
i$inQ9q]
.@(Q5O"
\A%V=')
$h8^r1r@|;=
luIPQdGT
dj2mp./
7y)`!LeH-1
Oo]NY%
4P|w>$.x~$w
k(HLKC
/{V'u&d^w
-'K@"8rF>
k(!UY&;
FIg2e[,-
.A^40Tc
7mjl2mn=
i6CAHQLd
J0^vFfTY.-c(2nK$
5-84KA3isu]
P h[0S>XZ-
KKMW8>]r ]%5k
r;$Q{XCJ
qQvU!4v
Z?g/'\\lie
G/_8U@n~3
pIBF.PpK[tu
n@<~`J
csBj1=%
E-#4|Y'2
4n]9~*)eh<|
RIU|U\g~>Th
zH6(r]Xz
3cwocE:v
g>!9Mb}(n6
E:`ZXi=W$]
0j6Y6r
j1{c6tr
!BZa?z
Ev%"tSxp
)BL o~u<
)z'a=l6=#n
lFU%%R%
~y3x%<c
xpYP~1?
xFz?@R.0I
M2hXl:&xh
}e)Tro
Z]bZQ&
`\cK0C
56s%v)
gd4y!M;>q
HNR"z+F_{UI%H6.jHT[z,d<`ALOhwY'Hg
_\r(5q
I\|~({
;{@F23F%
Wcq"[|_
'Cy.tj/]
?QgRL:
$y"_|~
Z[[N3mi/
P0]amP)
QKvd!v`
/>_1l ccv@
r`+T\T
}CIfp`]
fIQZd,
In{zR4
Yp;hm{-]
^6@7>x3m
5R.G9;5
}3XW4|jl$
7E($,py
`r0%84f
D^C#wfA
W%PiQ97
lo!)"OP"
a>9 2bR'YA
'WH%C)_b
9r|YU[&aRztA\tg%X
[*s5tId<#
orvf?!
^]2-2_
"h([Do
gaA Q>]T
9*/ HWW"kx
(#xv?#x
G/Hwe1
K:P57L
)h:eI-.
}Eh1/356_u/WD
XIS)s}:
w'[v~{
)6E*T]?lT"o
!p=wYs0a"e
R`U.)bk`v
?p/c$#i
DP(g']
Xet#d f
-6zwkD46x
Kck.w
mJtC.K
@4^,0Cl(d
/bpp!+
y!]<pp
'eA?`N)=v
r7gEOn5
Zac/V"/;
:rz_~9g(x}"
X"@Gjx#
~mL'6g
^mMrFU
N3Jp2CoM5S
I$hG27iF
B;B"HDu
yDnI-T0
#4e7Uy;0or
Aj=HP=Tq
9)z{~T2dS
}QJX[<JM
\'_3G!W(`
}bZ$k`
YP59XZ j;iyY
fg1K%#
I *%LH1_6y
&=Eu2Y
RTUzKNc6i
BbFOwa
FJ)4%B
b}!8Z*2
1> Vu;7
b~=ULT+1{
b-kg}R
ybBWO}p)V)rf/
_x0"[0>z{?
bBppc$2,X)#1zZV
Jy~:*,D
R;Z#PN<
o6L;8\
oq~@9H
"'GZY)G\Tc
"XzXVX>A
FX; E.
Q2MbT;
{AbQVh
{{Pm#%
lo&C2:
h`%~ft
3$sp#L
3R4tjN`O.R)
N<pO#!
7W$O!
oZ2`>?G]Gu@[pI
6Sj 5z
y,%{)(
-L+hbL~6^FURD
^D=ech`
%.g6|{g}S~
zWv&Tw^A
eGGlrw6~]
7"=/d4~
Unoe{N
dqAj`A"=
W]dhaI
\~.M lKQ
J}/TZBY*N
QL7sS8:q
[>2y2!
z %WW-25T&
uN?KbY
O`DV.?h
<3UEBR
[W,lvr
")U?H0
i.PX4Il7ZPS`o
fR8'npr}
t:Al/ 'O&i>(=Q
L)`tGW
lvl j+{.F4
O9oM/>
K4m\[>
lh7A;&9]o&a
@"R*&aK6
_`s!U?
@_I0O$$Zo:<w
+q8[LX!sYU%
I{iBj:ig
RSY={Q
4R+,W|,
"Hh(n~{
7+Qd23X
`,_ys9x
$<*,Di
q.cMES
A2/0Dd
(C}q.a"/P
YC([nY?
N5bHK1
"2+y=\-/
w"I!dBlQm
Q'are|
\s7D`05lei|@+
BvN(k|N|\q
]'aL9v`e8qJ
"ZugU~Km+
;+,pkE
9mP%lu<:5
PhC$'w
,fsu]>?bcs#&
>NI3/X
*>>+YGH
?,{FJr$
4k!:e
xYi$VY0
\yC{p$
#9v04PnNYELD_pZ5
oC^3@Ez4s
BR/ht3|)
h]jv](7)jb0
(mYrvmca
+XhfSZ
,F8d~C
6u' fs
Yqkg=l
NPmse(d<s
0_\=.qK80j
3^#4Y8'O"
3Mo-\v_
DX/baj
b47Oq=7<6P
:HKpPiJX>
l|U~H8
W`p_/[
9R}IR:
=6pX:s/#)k??!ll
O03/+EO
]K{7QA
S135xi
DQSq643
{as}^},{
<%Iq 0[
;k4++k
Z(AG&ww
\49q]%
$n3o _
E:2"1Ob4Oj2,OO
^TCtx >
R?yBe9
i@J\h+:B
Y6k*Q]AB
0A-y\v
Rj]X"|+y-@ L
a'eYE20j=
:n3p4MM-/
3j{ 8k
S&VC-"
- #|xu
>~PrJSh:9<Fl
<|fo]C
1:`&MW
]~ jnPzqx4sH-w
Jo/Urh(
K-H%jujH|
+BIA~M
3&9hPPgN
D2>78li
$n'6|qAM3~:
Zv^O$>A}
_*]zXu
fHF[}:YC
UWXm;.
h/YHX:,
DbN)~b.
J c'99\
KX1}.9P
>WKB{+|6~
w3*g\]vw
[C[<~_v?
X/E_Q6
[:S#|}t
233L(48*{\
CWt+/%
4V p]Ry#
NP{TCrO&CQV
)]E]#j
m4i1 iP
k9FJsX\/u0!
e\3P{:j
c1b ;e>pWyw$i
Fel:>3
9Mm")"=UDb
2j%F$4@
68CWp-
w<p|_*
X;S)=/=uPMq
fIVgc!;W
qkc$jX
84o'jb3"91
+(2_1K
^69U&AJb:6C
9@{=;wE
NM;Kc&%~
k{.9~L
[=RNgVqP&@
|@'3YTMeS\GK3W/Ij
$=E%MiBR~tW<w %2
Hh#;grPcY
,j>TeGT6r7-pHZ'LxH
H&2a9@
Nekucedolapedu bojirehebeta jeda. Ragulu yodawohuracu. Remaxojosewu maja mepozote. Ramexizosima keluxepuvemi razelerine kabatigisojero jezotolupasisu. Limu rime jozuzuyu wakoca pavayi. Firebiguhe yihemesujuke yu pocunucipojafi. Yayamapinone baza hinojagoho xoga mekixitunodo. Le koxosi zeve kececudi. Xe tixakehere seyetasohorabe. Nusere. Vatakenevagume gedagupegale he ruwa. Gobukire dexu vuwajeyo wujo. Vutuzudiposuxe zo yiru. Dipu fopicivehopo wegigo reri. Veke karisa ruginilevu subo. Naxiwi yovizicesehi zu jizayonizinuki. Si hinitufato tovohewimipuzi govujozi luwi. Baduyoxitijigu desuhanudiwuto gogidifego ribiwi xelozopovuzevo. Kubomunave. Poxarozuhifura joda ciraricivupo. Samizezahomaso waku zuka. Kupikikumujagu bolagijo nava jigoyupo ridu. Kaferahodo mafemi rocida.
Henihideyadi ze rulevi yahudejita fepijiwage. Kuwizumedelo. Cifuca voxilitu vabujupe. Xoyixuhapi kosihemu kuxa bikugiki. Jabesogu tuyo. Zukonipiho wusocegutosi. Xuxaco. Jo fodagoluhitoki honizezigeso. Jevilohamocu goro zotahujamiju. Rukuki yipucaje tutolorubewoma. Pebokazumige sakukixoye fepuwa hu. Jecugetu tunivi lera luwKaloli. Jogagulucu rukeyuroyupohe veli. Vudubi yuyinaxo de yado. Sawe wecarixage virehuhusezoyi fuwupivizima ja. Kacanaluhibu zolufaforafo dujugifoyu nice kinobe. Mitokuwaci. Tixa haluxu. Lugezelo kaxefa. Molaliyevexe fakiwobekoye tepezeso kaxo. Vovahoteri bewivojohiki noniwohelago bajirasularu. Legafefoji xeja lugivocifa. Wizalete. Xirubodoxuye budamozigo haxafazenevidi zahokaledeti. Cegodacegudo. Hakomojewehogi. Dipokafu. Sucoja xifoguje. Yitabemoje yuzebazo bupuyobumete. Lawe. Fibudiwuzahi. Beligaca kujakacozazu susezebonulise tusidafohi xekahotiyiwifu. Vudamoni xuxa hotogu bo. Xisito fiji vahimadaxuco hecavulila doxunapi. Bifu zidagosose pudaheme libuzeva. Hi. Lipezipaxuroto. Comupekoferi dimarijoya neyevetuwipufe bedopiyo. Comujiyeze josusutime. Vumaviza. Sehapezofogi juxonucose gogilibobi. Xayogacikuyi. Leto. Zoyi hebe zobuwuciwudo. Cadufe rojudewo. Ceko. Diki cisupizi pikarebegivine nasabugakukuce halisozazelopu. Guyewotunedobe duhixotiwiro zacoyemibati yupihaloxude. Lihebomi. Warotijaxosuhe voyecamibezive huduninexawu vofapexa wixusukazerera. Cosugobalixiwe zopizu. Sumokotuca wo zibiyuhureno. Suxipamenupo nagarozu kafotovibibozu vema yuzute. Dorajuxeji lizuyo wijufebodoyi. Lubulicokiba geguzovewa navetogisa dayarojo hefajagomate. Cawijata zepure duneyi jomocugaga. Hufise nogifakeku honi. Vasowoma zaji teza puva. Yitolohurejevu tusibebicixidu. Sa. Werice cizaxafixobamo yeve tizaba. Bagewoxodocesa pajaye yazedexisudoyo. Muhosadegumo. Fipasica jocowe nodipe. Cecidujuciyexa wekozarixecu. Fazukofatepa xudocagigiyove. Kesodoxofezavu yubo. Kejunikudihu bekopuka folozepiyi. Wayayehacube. Negiju gudanepikoti godimuwusocudi wuzemikeva. Sohirova. Copisagibepi sato xiwu catojosutuyado. Lezosiwa yuhumunici duladipibawe sacavawiceweco. Tuwija harora jucozibu. Bajo. Cejeda maca viyeyojelefuwa hokeno. Nohuwumiputedi mabozo. Deseyile meje vuxo tipufite yiyapelitaya. Zuke sijavobohi. Sabiyoho xucoja. Nukaza. Haviwexepeni wane gikicudoso yihuruya. Deya fipihajabo norexokeneve kivubaki. Vekesaxu lucivavuhu fira. Ze. Pibo mi gifuzi huhikebazukila jatovita. Cofugora kojatobu. Yukoxu hirure nagepuxa kenihifezacesi. Lotamomoxihu lo nexesodameru reladupadocatu zu. Muru ya jehuzika fupodecigosa setidiyo. Jeyuxa milo de donekutigu. Yiloyojimide tavugosugu gozebejegi kive jo. Xegafuve midaxazike lizedoxiri vixavi zoze. Safacanemafi. Cave renixadate bico futiwe. Fogucubo. Hexuvi yicayane moyicehijetude. Xicawo mute. Gafefo piwozemo giga xuja zajiyanivoxazo. Wiwayepaxoli wuro. Piye. Nazizofo cona lese yimucayedupo xiyonicemibe. Hahasepawu dehukusida dagarateriso vuhihiculicoya. Miyobewi. Jayerosorore. Rojufebusuyi yofa kitawevile. Retixahawe raluzujicehowo. Dizoduremefule. Bitinekatixe. Balewufe vujoka. Gomihaci. Ceyeye vaxudize rafasumatevaku voko. Gu miwubo. Tahu tucozame viji. Harabemebopo bozeharupuyuci. Tefu vukuyidediye juyi wadu. Toxazepayuwene sihu hosice fulecuzidato bojo. Seyatutalasuyi dofedapobuwona yarutaperarupi xoyowahulepo kikuwucetumagi. Kezacacudicuzo dane colola ruma. Livuza. Wujuki gisunudo xefesepexujeri vu ge. Lavomejucalowo xuwuyele pena dara juhojojinupu. Cayiruredopo foxobanijodiri vufemaxusu nutave. Cehenube puhu guwujejixafu. Pacelunu yifu nogacebora co. Yenusaluwahoze. Pumoju hogoru nufigunatoduho kejekayi lakadolipowe. Lilebaxupewuri xazonano tale febuhafucaye pecaxubofo. Serogati difeviceza kowukewofejave hebaji. Givihazi fuyacizogiza. Nugi. Payacucipiwe tewavasalo gejuxo sidijoharu xayogorayo. Ci cenehozogo lehe. Josazobilonozi wovaze fabofa. Visefunotu dovozawesojime ta. Sujinefege cipanoluyifo zoberife zidawazugeni. Yokulu yesepuhezimosa fodidusepeja cudagemuva. Fa lo miseyicuwati takoneyepi. Jo sudo takupovete mu lavifi. Poso
===///
===////
===////
===////
===////
====///
====////
====////
====////
====////
====////
====////
======
======
==?CP?CP?CP
?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CPPt
?CP?CP?CP?CP?CPPt
?CP?CP?CP?CP?CPPt
?CP?CP=====
?CP======/////
======/////
======/////
=======/////
?CP======/////
?CP=?CP/////////
?CP?CP?CP/////////
?CP?CP?CP/////////
?CP?CP?CP/////////
?CP?CP?CP//
?CP?CP?CP?CP
?CP?CP?CP=====7
?CP?CP======7
)pUpUpU
?CP?CP?CP======7
)pUpUpU
?CP?CP?CP======7
)pUpUpU
?CP?CP?CP======7
)pUpUpU
?CP?CP?CP======7
)pUpUpUpU
?CP?CP?CP======7
)pUpUpUpU
?CP?CP?CP======//
)pUpUpUpU
?CP?CP?CP======//
)pUpUpUpU
?CP?CP?CP======//
)pUpUpUpU
?CP?CP?CP======//
)pUpUpUpU
?CP?CP?CP=======/
)pUpUpUpU
?CP?CP?CP?CP======/
)pUpUpUpU
?CP?CP?CP?CP======/
pUpUpU
?CP?CP?CP?CP======
pUpUpU
?CP?CP?CP?CP======
?CP?CP?CP?CP======
?CP?CP?CP?CP======
?CP?CP?CP?CP?CP?CP
pUpUpUpU
9=?CP?CP?CP?CP?CP
pUpUpUpUpU
9=9=?CP?CP?CP?CP
cxpUpUpUpUpU
9=9=9=?CP?CP?CP
cxpUpUpUpUpU
9=9=9=?CP?CP?CP
cxpUpUpUpUpU
9=9=9=9=?CP?CP
SpUpUpUpUpU
9=9=9=9=9=====
)///pUpUpU
9=9=9=9=9=====
)///pU7
9=9=9=9=9=====
9=9=9=9=9=====
9=9=9=9=9=====
9=9=9=9=9=======////////7
9=9=9=9=9=9=9=9=9=9=/////////7
9=9=9=9=9=9=9=9=9=9=/////////7
9=9=9=9=9=9=9=9=9=9=/////////7
9=9=9=9=9=9=9=9=9=9=//////%pUpUpUpU
.r9=9=9=9=9=9=9=9=9=9=9=9=
%%%pUpUpUpU
.r.r9=9=9=9=9=9=
)%%%pUpUpUpU
.r.r.r9=9=9===
cx%%pUpUpUpU
.r.r.r.r9=9===
)9=%%pUpUpUpU
.r.r.r.r9=9==
)9=9=%pUpUpUpU
.r.r.r.r.r9==
)9=9=9=9=pUpUpUpU
.r.r.r.r.r.r9=
)9=9=9=9=pUpUpUpU
.r.r.r.r.r.r.r
)9=9=9=9=9=pUpUpU
.r.r.r.r.r.r.r
)9=9=9=/////
.r.r.r.r.r.r.r
)////////
.r.r?CP?CP?CP?CP
)////////
?CP?CP?CP?CP?CP?CP@
)////////
?CP?CP?CP?CP?CP@@
)////////
?CP?CP?CP?CP?CP@
)=////////
?CP?CP?CP?CP@@
)=////////
?CP?CP?CP?CP@@
)==///////
?CP?CP?CP@@@
)==///////
?CP?CP?CP@@@
)==///
?CP?CP@@@@
?CP?CP@@@@@@
======%
?CP?CP@@@@@.r.r.r
?CP@@@@@@.r.r.r
?CP@@@@@.r.r.r.r
@@@@@@.r.r.r.r.r
).r.r.r.r.r
5R@@@.r
5R?CP?CP.r.r
)====//////
++?CP.r.r
)====//////
++?CP?CP
)====//////
++?CP?CP.r
)=====//////
5R++?CP.r.r]]]======//////
5R++?CP.r.r]]].r.r.r.r
//////
5R++?CP?CP.r.r]]].r.r.r
3?CP?CP?CP?CP.r.r]]].r.r.r
3?CP?CP+?CP.r.r]]]].r.r
).r.r.r]]].r.r
)].r.r.r
).r======
).r======
).r======
).r======9
)======9999
)=======9999
)======99//
)======////
)======9///
)3======9/Uv/
)33======9UvUvUv
)33======9UvUvUv
)333======9UvUvUv
)333======UvUvUvUv
)333======]9UvUv
)333f======
.Q?CP?CP3
)3333f======
.Q?CP?CP3333++
33f=====.r
.Q?CP?CP?CP33vBvB+
33fff.r.r.r.r
.Q?CP?CP?CP?CP?CPvBvB3\.rfff.rUvUvUv
.Q?CP?CP?CP?CP?CPvB\\.rfffUvUvUvUvUvUv
.Q?CP?CP?CP?CP?CP?CP++fff.rUvUvUvUvUv
)?CP?CP?CPvBvB+fff.rUvUvUvUvUv
)vBvBvBfff.rUvUvUvUvUv
)99+ff=======
)999+fff======
)999vBvBff======.rF%
)999vBvBff======.rF%
.Q?CP?CP
)999vBvBff======.r
999999vBvBf=====.r.r
99999vBvBfUvUvUv.r.rF%F%
9999vBvBfUvUv.r.r.rF%F%F%
?CP9fffUvUv.r.r.rF%F%F%
fffUvUv.r.r.r.r.rF%
fff.r.r.r.r.r
======
?CP?CPUv
======
)?CP?CPUvUvUvfff+
======
)?CP?CPUvUvUvfff+
======
)?CP?CPUvUvUvfff+
======
)?CPUvUvUvUvfff
======
)999?CPUvUvfff
======.r
)99999
======
)99999
======
)99999
======
)Uv999
======
)UvUvUv9
======
)UvUvUvUvUv
fffF%F%======
)UvUvUvUv
sfffF%F%======
)UvUvUvUvUv
sfffF%F%======
)9UvUvUvUv
======
mmm999Uv?CP
======
mmm99?CP?CP?CP
mmm99?CP?CP?CP
mmmm9?CP?CP?CP
UvUvUvm?CP?CP?CP?CPjfff
UvUvUvUvUv?CP?CP?CPjfff
UvUvUvUvUv?CP?CP?CPjfff
UvUvUvUv?CP?CP?CP?CPjfff
UvUvUvUv?CP?CP?CP?CPjfff
mmUvUv?CP?CP?CP?CPjfff
mmmm?CP?CP?CP?CPjfff
mmmm?CP?CP?CP?CPjfffj
mmmmm?CP?CP?CPjfffj
mmmmm?CP?CP?CPjfffj
Uvmmmm?CP?CP?CPjfffjj
Uvmmmm?CP?CP?CPjfffjj
Uvmmmm?CP?CP?CPjfffjj
Uvmmmm?CP?CP?CPjfffjj
mmmmm?CP?CP?CPjfffjjj
mmmmm?CP?CP?CPjfffjjj
mmmmm?CP?CP?CPjfffjjj
mmmmm?CP?CP?CP?CPfffjjj
.Qmmmmm?CP?CP?CPfffjjjj
.Qmmmmm?CP?CP?CPfffjjjj
.Qmmmmm?CP?CP?CPfffjjjj
.Qmmmmm?CP?CP?CPfffjjjjjW===
.Qmmmmm?CP?CP?CPfffjjjjjW===
.Qmmmmm?CP?CP?CPfffjjjjjW===
.Qmmmmm?CP?CP?CPfffjjjjjW===
.Qmmmmm?CP?CPfffjjjjjjW
.Qmmmmm?CP?CPfffjjjjjjW
.Q.Qmmmmm?CPfffjjjjjjW
.Q.Qmmmmm?CPfffjjjjjjW
.Q.Qmmmmm?CPfffjjjjjjW
J.Qmmmmm?CPfffjjjjjjW
JJmmmmm?CPfffjjjjjjWW==
JJmmmm?CPfffjjjjjjWW==
JJmmm?CPfffjjjjj
JJJmm?CPfff
.Q.QmJJJm?CPfff
.Q.Q.QmJJJmfff
.Q.Q.QmmJJJfff
.Q.Q.QmmmJJJff
.Q.QmmmmJJJf
mmmmmJJJ
mmmmm?CPJJJ
mmmm?CP
mmm?CP?CP
?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
JJJWWWW
?CP?CP?CP?CP?CP?CP
>JJJWWW
?CP?CP?CP?CP?CP?CP
>JJJWW
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP
?CP?CP?CP?CP?CP
d^5555^d
5++.T.+5
+..+p55
Jpkv55
]vv55k
^+.p]kv555
5p]kkk55pT
+@@p]k5v5TTTT
..`@]kk555
R..`pkv558
++RR..T55
.....5^
&d^^RR..RR.dd&&TTT
5RRRRp
&&&TTTT5
&&&&&TTT5
&&&&&&&TTT5
p..&&&&&&&TT5
ddk&.&.&&&&&&^^dJ++++
&.&&&&Rd^5
++++++++
^pkk555&.&.+
pp]kk55
JJJJ+++++
5p]kv55
++JJJ++
T@p]]kk55
5J+JJJJ+++
@p]vv55J5
^+JJJJJ+J++++
`@@]]vv55+^
JJ+JJ+J+++
@p]]vv55v
JJJJJ+J+++++
`@@]vv55
.JJJJJJ+J+
+++m@]]]vv5.\.JJJJJJJ++++@]]vv.\
\JJJJJJ+++.@p]]\\
JJJJJJ+++@@
+JJJJJJ+..J
d^5555^d
sYXXXK
sYYXTK
TssYXXYtK
xtTKKKKK
xTTTTKKK
TTKQTK
:tTTTXs
''''''''''''''''''''''''''''''''''''''''''''''''''''''''=X3
3X=''''''''''''''=3z
23='''''''''''
'''''''''
'''''''=*}
TXX*=''''''3"3
3'''''=u3%TXX
2=''''Xz*"}TX"*X''''32222*''''=
222*''''
''''3uuuu2$=''''}"*3''''Xuuuu$
T1zX''''=uuuu
"}}TTX*'''''3uuuuu2"3}
T93''''''=uuuuux3}
='''''''
'''''''''
'''''''''''=}=''''''''''''''=X
3X=''''''''''''''''''''''''''''''''''''''''''''''''''''''''
..AAAA||
...AAA
~f~|~}y
zy~~{w}}v
z{}|~}
}~{~}~&
~~k{||
~~'x~~
z{}vz~wy
z{y}~z
|}~-~w
}}|y~~~
~~|~z~||zx~
{z~>{|x:t{{
}{}^|}
~~k{}~
|||E|{~
z[|}y}
~~~u|ya
y~z~}{~
~|x|y{|~}
x|~~{~
inhZgopiklkonnlnmymontqjm^
{~ihuV
mphmnm~
mlvlvm
v{klhW
ovmZjeorknrkqnopkmngqnmls^
0=0N0T0Z0a0g0m00000000000
1,171?1P1a1i1n1z1111111111111
2$2O2i2{22222222222222222
3.3@3G3M3U3b3i3o3u3{333333333344'55
777%888
9:9T9Z9`9u9999993:A:K:o:y:::::::
;V;d;n;;;;;;
<x<}<<<<<
?A?g?????????????
0j0u00000000!1(1,1014181<1@1D111111s344
5'5I555.627R7777.9?9s:::U<s<<<<<<<<<
= =$=(=,=0=4=8=======
> >'>,>0>4>U>
>>>>>>>>>>
?$?(?,?0?
1 1$1)1/13191=1C1G1M1Q1c1111111
2T223333$44444
55V5k555555
61676I6b6j6s6|66666
7)7.797C7Y7z7
818>8J8Z8`8q8888888888
999999;:P:q:::{;;;;;i<w<<<<-=6=>=X=w========>
????????
0!0,0;0E0k00000
1162@2_2222
393i33333"4Y4s44
6N6W6u66777B8K8(939F9Z9
:%:1;:;&<p<y<<<2=}=========
>0>a>y>>>>>>@?R????
E1`1v1114555
66666i777778=8f888888
9l9v99999?:J:P:w:::::g;t;;;k=?
111923g44w6/9P9U99999
2444K56666
7Q7]7777
8Q8W8^8888O999999
<T<`<j<y<<<<<
=A=Y=c=
===========
>3>F>>>>>>
?,?8?G?P?]????????
.0?0E0U0]0c0r0|000000000
1"1:1M1S1Y1`1i1n1t1|111111111111111111111
22'2,222:2?2E2M2R2X2`2e2k2s2x2}222222222222222222222
3#3)31363<3D3I3O3W3\3b3j3o3u3}33333333333333333
4)4444
5!5'5-535:5A5H5O5V5]5d5l5t5|5555555555555
6"6u6z66666666D7N7i7s77N8w888889999
;(;7;A;N;X;h;;;
<x======
>>>>>>
?,?G?O?]?b?q???
070J00
151111102H22222
444T4w4444"5/545B5p5555
6626T6[6666
7w7777
88829A9`990::L;
=-=5=E=V==
0@00011=1111]2h23
8;;;;;;
<,<2<8<@<F<L<T<Z<`<h<q<x<<<<<<<<<< =8=Q==
2"2'2H2
3I3[3m3
33333333
4!4@4R4d4v44i9s9y99996:X;`;
===4><>H>W>>>1??
33333U4l44.588
< <$<(<,<0<4<8<<<@<N<
=%=4=U===
&8<<<<<<<<<<
T1X1\1h1l1p1t1x1111`2d2h2l2p2t2x2|222222222222222222
3<3@3D3X3\3`3d3h3l3p3t3x33333333333333333
4$4,444<4D4L4T4\4d4l4t4|44444444444444444
5$5,545<5D5L5T5\5d5l5t5|5555555555555555
6$6,646<6D6L6T6\6d6l6t6|66666666666666666
7$7,747<7D7L7T7\7d7l7t7|77777777777777777
8$8,848<8D8
2 22222
3$3,343<3D3L3T3\3d3l3t3|3333
(0,040<0D0L0T0\0d0l0t0|00000000000000000
1$1,141<1D1L1T1\1d1l1t1|11111111111111111
2$2,242<2D2L2T2\2d2l2t2|22222222222222222
3$3,343<3D3L3T3\3d3l3t3|33333333333333333
4$4,444<4D4L4T4\4d4l4t4|44444444444444444
5$5,545<5D5L5T5\5d5l5t5|55555555555555555
6$6,646<6D6L6T6\6d6l6t6|66666666666666666
7$7,747<7D7L7P7X7`7h7p7x77777777777777777
8 8(80888@8H8P8X8`8h8p8x88888888888888888
9 9(90989@9H9P9X9`9h9p9x99999999999999999
: :(:0:8:@:H:P:X:`:h:p:x:::::::::::::::::
; ;(;0;8;@;H;P;X;`;h;p;x;;;;;;;;;;;;;;;;;
< <(<0<8<@<H<P<X<`<h<p<x<<<<<<<<<<<<<<<<<
= =(=0=8=@=H=P=X=`=h=p=x=================
> >(>0>8>@>H>P>X>`>h>
0000444444444444444444
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|555555555555555555555555555555555
6 6$6(6,6064686<6@6
|55555555555555
606@6D6T6X6\6`6h6666666666666
7(7,70787P7`7d7t7x7|777777777777
8$8<8L8P8`8d8l88888888888,9<9h9p99999999999
: :(:0:4:8:@:T:\:d:l:p:t:|:::::
;4;8;X;x;;;;;;
<$<@<L<d<h<<<<<<<<<<<
=(=L=X=`==========
>(>D>H>h>>>>>
4 4X4`4999999999999
:$:,:4:<:D:L:T:\:d:l:t:|::::::::::::\?
`0d0h0l0p0t0x0|000000000000000000000000000000000
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|111111111111111111111
2,2L2X2\2`2d22222222222222222222
6<6h66666
787X7p7
MTk7MTk=
kernel32.dll
mscoree.dll
@R6002
- floating point support not loaded
- not enough space for arguments
- not enough space for environment
- abort() has been called
- not enough space for thread data
- unexpected multithread lock error
- unexpected heap error
- unable to open console device
- not enough space for _onexit/atexit table
- pure virtual function call
- not enough space for stdio initialization
- not enough space for lowio initialization
- unable to initialize heap
- CRT not initialized
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- not enough space for locale information
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- inconsistent onexit begin-end variables
DOMAIN error
SING error
TLOSS error
runtime error
Runtime Error!
Program:
<program name unknown>
Microsoft Visual C++ Runtime Library
kernel32.dll
zh-CHS
az-AZ-Latn
uz-UZ-Latn
kok-IN
syr-SY
div-MV
quz-BO
sr-SP-Latn
az-AZ-Cyrl
uz-UZ-Cyrl
quz-EC
sr-SP-Cyrl
quz-PE
smj-NO
bs-BA-Latn
smj-SE
sr-BA-Latn
sma-NO
sr-BA-Cyrl
sma-SE
sms-FI
smn-FI
zh-CHT
az-az-cyrl
az-az-latn
bs-ba-latn
div-mv
kok-in
quz-bo
quz-ec
quz-pe
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
syr-sy
uz-uz-cyrl
uz-uz-latn
zh-chs
zh-cht
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
USER32.DLL
nCONOUT$
((((( H
((((( H
@@@@@@@@@@
AFX_DIALOG_LAYOUT
EFSUJQ
REJAXULA
RUKULURAZAPU
SUSABO
MS Shell Dlg
TODO: layout OLE property page
sfghdfghdfgh
sdfgsdfg
`Pipi gudisira buzogasojiso rizosexa boneramuyokeza niborukikeki mu xurupovojurota vugoyiyiyugose
LGumegedagupe galeheruwagobu kiredexuvuwa jeyowujovutu zudi po suxezoyirudipuiFopicivehopo wegigo rerivekeka risaruginile vusubonaxi wiyovizicesehi zujizayoni zinukisi hinitufa totovo
Hemesujukeyu po cunuciVJeza lefewu xamuxetajovo wo taxayulawu zejuvinehisi vihohicefogavo hazobugukuwu tikefe
0Hewimipuzi govujoziluwi baduyoxitiji gudesu hanu
Diwutogogidife goribiwixelozo
`Buto hute jijobodugoreko sorecusotuba tarikiyahavixu rifizakixuhi katipuca xegecavapubaxa xihibo
Fexe medapipo sijepa
_Civuposamizeza homasowakuzuka kupi kikumuja gubolagi jonavajigoyu poridukaferaho domafemirocida
IDavakofafahofe cuzaloci totebosinimu sebuyubepijepa puhasovoco xuvazegesu
CRejaxuladawimi duvitanamiro gifuno habuzono vitekicoleseni mupezumo
Tibo pinece saxikulate
Wehove mariwiku jinucewuzazalu
Finaradolonumu wiwitowepore
Kuhu bujoju
Kadoha jedumiyabe
Sozamoluyugihe
%Kejozuzuyuwa koca pava yifirebiguheyi
/Povu zevokubomunave poxa rozuhi fura jodacirari
Pojafiyayama pinonebazahino
\Jagohoxo gamekixitunodo lekoxosizeveke cecudixeti xakehere seyetasohora benuse revata keneva
4Cidu lasaba hohomege vula heloyehozo jikilovaxa ruju
#Furodehuhamo veto ke tumodifejigefa
Vasukenahe
8Dase yeruxiyehoxide cekajegexozaya gopegiyutu suwofoboli
VS_VERSION_INFO
StringFileInfo
08804e0
FileVersion
InternalName
toalatspring.exe
LegalCopyright
Copyright (C) 2017, okyluhzin
ProductVersion
5.1.111.0
VarFileInfo
Translation

Process Tree


088b14b84f86b835b515c48d7e7aa1844fece667c7582300ad1488f5d324dce3.exe, PID: 3008, Parent PID: 2160

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2012, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2940, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2480, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 3036, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 1992, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2728, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2780, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2080, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2652, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

nslookup.exe, PID: 2624, Parent PID: 3008

default registry file network process services synchronisation iexplore office pdf

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 57665 224.0.0.252 5355
192.168.56.101 51758 114.114.114.114 53
192.168.56.101 51758 8.8.8.8 53
192.168.56.101 52215 8.8.8.8 53
192.168.56.101 52216 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 52217 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 52218 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 52219 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 52220 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62361 8.8.8.8 53
192.168.56.101 62362 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62363 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62364 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62365 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62366 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62367 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62368 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62369 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62370 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62371 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62372 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62373 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62374 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62375 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62376 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62377 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62378 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62379 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62380 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62381 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62382 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62383 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62384 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62385 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62386 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62387 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62388 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62389 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62390 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62391 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62392 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62393 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62394 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62395 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62396 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62397 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62398 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62399 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62400 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62401 104.155.138.21 ns2.wowservers.ru 53
192.168.56.101 62402 104.155.138.21 ns2.wowservers.ru 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

Source Destination ICMP Type Data
192.168.56.101 114.114.114.114 3

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name 554854c9f30c36dd_win.ini
Filepath C:\Windows\win.ini
Size 7.2KB
Processes 3008 (088b14b84f86b835b515c48d7e7aa1844fece667c7582300ad1488f5d324dce3.exe)
Type Generic INItialization configuration [extensions]
MD5 c8b4d2a5becf98cf17b509817cbb10e5
SHA1 303cb650bef9aa47efa5037e57427e0e39c37680
SHA256 554854c9f30c36ddd71343e2ee8c6e3ad740740fbc1cde748944f95f7d695d7f
CRC32 CB360A50
ssdeep None
Yara None matched
VirusTotal Search for analysis
Name c716051519477812_ujsrrj.exe
Filepath C:\Users\Administrator\AppData\Roaming\Microsoft\ujsrrj.exe
Size 248.0KB
Processes 3008 (088b14b84f86b835b515c48d7e7aa1844fece667c7582300ad1488f5d324dce3.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 7fb9da9a11c72b5f6f3e552e4d742f50
SHA1 45bf27106a14fab70c1b3d4eb79d094618a58b55
SHA256 c716051519477812128653be3c52d1b203134769c811b5c64ed60a761a2527ec
CRC32 CC8BE83B
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.