1.4
低危

1089bc8c715af750f002cc5741532aca75b3f88669fccad5e41b585ca2619786

1089bc8c715af750f002cc5741532aca75b3f88669fccad5e41b585ca2619786.exe

分析耗时

192s

最近分析

385天前

文件大小

202.1KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN SPYWARE ZUSY
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.83
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Trojan-gen 20200217 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_90% (D) 20190702 1.0
Kingsoft None 20200219 2013.8.14.323
McAfee GenericRXJF-LM!AB53747A378A 20200217 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0c329 20200219 1.0.0.1
行为判定
动态指标
在 PE 资源中识别到外语 (3 个事件)
name IDR_BINARY language LANG_KOREAN filetype None sublanguage SUBLANG_KOREAN offset 0x0007e000 size 0x00012136
name RT_BITMAP language LANG_KOREAN filetype None sublanguage SUBLANG_KOREAN offset 0x00090e48 size 0x0000094e
name RT_BITMAP language LANG_KOREAN filetype None sublanguage SUBLANG_KOREAN offset 0x00090e48 size 0x0000094e
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x000a0000', 'size_of_data': '0x00030e00', 'entropy': 7.914314398432133} entropy 7.914314398432133 description 发现高熵的节
entropy 0.972636815920398 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 54 个反病毒引擎识别为恶意 (50 out of 54 个事件)
APEX Malicious
AVG Win32:Trojan-gen
Acronis suspicious
Ad-Aware Gen:Variant.Zusy.300222
AhnLab-V3 Backdoor/Win32.Plite.C232448
Antiy-AVL Trojan/Win32.Wecod
Arcabit Trojan.Zusy.D494BE
Avast Win32:Trojan-gen
Avira HEUR/AGEN.1024046
BitDefender Gen:Variant.Zusy.300222
BitDefenderTheta Gen:NN.ZexaF.34090.mmXfaqkKXqli
Bkav W32.AIDetectVM.malware2
CAT-QuickHeal Trojan.Urelas.C.mue
Comodo TrojWare.Win32.Small.NAF@531prv
CrowdStrike win/malicious_confidence_90% (D)
Cybereason malicious.a378a7
Cylance Unsafe
Cyren W32/CardSpy.B.gen!Eldorado
DrWeb Trojan.AVKill.34645
ESET-NOD32 a variant of Win32/Spy.CardSpy.NAF
Emsisoft Gen:Variant.Zusy.300222 (B)
Endgame malicious (high confidence)
F-Prot W32/CardSpy.B.gen!Eldorado
F-Secure Heuristic.HEUR/AGEN.1024046
FireEye Generic.mg.ab53747a378a7887
Fortinet W32/CardSpy.NAF!tr
GData Gen:Variant.Zusy.300222
Ikarus Trojan-Spy.Cardspy
Invincea heuristic
Jiangmin Trojan/Generic.bhwbd
K7AntiVirus Spyware ( 0055f2101 )
K7GW Spyware ( 0055f2101 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=87)
MaxSecure Trojan.Malware.4956394.susgen
McAfee GenericRXJF-LM!AB53747A378A
McAfee-GW-Edition BehavesLike.Win32.CryptDoma.dc
MicroWorld-eScan Gen:Variant.Zusy.300222
Microsoft Trojan:Win32/Wacatac.D!ml
NANO-Antivirus Trojan.Win32.AVKill.fhuvpj
Panda Trj/Genetic.gen
Rising Spyware.CardSpy!8.17D (RDMK:cmRtazrHLbGjdSLzctXN11/lkDcQ)
SUPERAntiSpyware Trojan.Agent/Gen-Gupboot
Sangfor Malware
SentinelOne DFI - Malicious PE
Tencent Malware.Win32.Gencirc.10b0c329
Trapmine malicious.high.ml.score
VBA32 Trojan.Wecod
VIPRE Trojan.Win32.Urelas.a (v)
ViRobot Dropper.Agent.206995
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-12-17 21:07:49

PE Imphash

87723e425f1f4ed62e85255a5fb99383

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000a0000 0x00030e00 7.914314398432133
.rsrc 0x000a1000 0x00002000 0x00001400 6.18150251080175
.reloc 0x000a3000 0x00000200 0x00000200 0.23653878450968063

Resources

Name Offset Size Language Sub-language File type
IDR_BINARY 0x0007e000 0x00012136 LANG_KOREAN SUBLANG_KOREAN None
RT_BITMAP 0x00090e48 0x0000094e LANG_KOREAN SUBLANG_KOREAN None
RT_BITMAP 0x00090e48 0x0000094e LANG_KOREAN SUBLANG_KOREAN None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_ICON 0x0009ca30 0x00000468 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x0009cf10 0x00000076 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x0009cf10 0x00000076 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MANIFEST 0x000a14c0 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library kernel32.dll:
0x4a1630 LoadLibraryA
0x4a1634 GetProcAddress
0x4a1638 VirtualAlloc
0x4a163c VirtualFree
Library USER32.dll:
0x4a1644 TranslateMessage
Library GDI32.dll:
0x4a164c DeleteObject
Library ADVAPI32.dll:
0x4a1654 OpenProcessToken
Library WS2_32.dll:
0x4a165c WSAStartup

L!This program cannot be run in DOS mode.
xRich'
PEC2NO
.reloc
8j|cUJ
h<tC$9Pb\DM
';zR1A(
}b}t'6
))YBK #
R L0:E
9aFj]k8
3R:$Bjl@R45
8m'b7l3
rrhP8h'n
0-KG.3@~
,PqPL#"QH
h]erTU0
uHn=x|
ZQ)DH,\O`n
hR-x,XlP|$p2D
RxR,,V|O
!EjMWC
;DD8~B
2<'k)"
B2h8ra
ygO4r2
#>tD{xM
Sh"T*TMB!
E upxn/
P:C*Dp
BoL]FD
,d"2(3(,<Hc
cko4r
St7Q`
hp=zv|
'jeHDJ
h,h wR5.
rzdxLJP,b|
;"Dd"\
h.4]MCLE!/)
1kh(
Zj"E#'eZvDW
9;t^yij
qCQpD1$
]#yF~Bv:lDxhOqJAtnr
uKr+t5%%
pK&&Jj
]kpuElh
!Z`aDd)
bZ0hT|2
TrJdPgQT
y%j!JDHd@(
BDkj.:P $R?3
*8j%UD5Q3L
NPs=\@J]"
U@vj
KX!$ CJ87Mz
4&PrLO07$k
__aD4)f
6!*E$S
O5lyF
GK2+q-,+
Dh$py,A
tI'~*@
.Du.[@
)DbP)2j?"RY
ushWV$
*1iKyn
O|YEW#|Y
f%tsEi
-KbBy6f
AHp[()WD
!;T,*UO"
'd"!Q"SPpF
R"Aggxd(
:m:wjh|
yMbDfJE8:~
-6?|$F
[Ufu&<
Ek_B)0
.I,APa+
uI-9%O"@$hp7
a|W,\5ht)0HQ|U
|=Y|-|
i,iP,)phSNy
as!#?;
'j.Qt"DQ3
1;t M
B[P%yB|e
dBlbdhgQl
ywbb2
z;0(+T<BP
kHMH9k\
U,tP[9
Hj)n'P
dJI%!]8)D
L(hO^G
0Pxp$7t
Au0.=Qm7UKH
!15T|[c17
bY<Reda-R
XE1\[D
sh34dQ
)a!=HP3k
]]B 2N&s
Z_AB)0
TR$Z@w0+-
@UB0;Lu,f
)+-S*$?E jA
$L@VbM<4
;}21M`
DiCAJKfO
Mka2`t[
@(=upB
Rp79'~+`U;
"l2&L
M2A'oQO{
B8>H0UE7
Wx-J$
BDG5_+'V-PR!
B &(rUE
Dm%dDB-"Wj
f<{lTNwLgP.Q8r{
,Qs|8@R
J&,fwtoya;\
$ $}I8
qnl^>Z
SUH(I{9
%E(eM3
QXo{evW4;(rU
,;%!fE
+U8}JU
2\vK~Iodadj
f6$/:H&E
8@894E
dDIz'$
~f!t`$
TFT\V@
2RhW<P23
DEd(I[
D+(rKk
7<2}B49M
9'fY^7
BJ<]Gz6*.|
>pqb^]
Jz][*t
*](ide}
(2e&KR
SL4,, %<$6
,,YjO%la
KEjQ(I
Ec}>{z
9M[4,P
m~c0xs2
[m=}#y(pDYt~sq
MA;81(U+(`Ae=
GwSy;2}0*K
5L0Z@`"H
;Q*[}@=
G 944_(yT-?
@GIO UFJ
}J#?*B~2
TQH!&y"<B2
u# >4x
Q.? pS
%8d2M<US
"<,T:!d
}y@ u0
'b0}QFuS
T'VWj@,2Y\}'T^D(RNjRv4-
wN"T2+8@
mvWy-"4]Auv
L"THQ$5
';kY~"
-M+Tv[I l[+[M @={Jn
l%P%v
r2l9!;C(U>
rn`p"D
:fCn6p E@
|w<NDk
k|G[Hu
JOFVH )
2GH H@|G
sZS$.B@P
Ij=p\gbKM
It<Ip9&c
`v%dIH28X"vL<EPB
vKZX~z,"L-!_mh$D
X'9\QdID\b?
1rk8_M)
]}1=e]
+\h1!w9]Q$
"]h*`,is
9TE6us8ThD
9^G^i:/
exHRW@
'u \!l
t Y*_(Z)
O>a!;(
/?/[IbD
+ZQX0JB<2
?RYF;2a
FA(O'D[P+
j?n[@VKW~|X
*s@7C@%GS
t'id2K
<L@D_^+RH8
F]'6''T
<YKQh"t@Z
:%0+S-)
(&PR[^O
To2&t
n$xW;:h@mZVCT
heC!1G
~h\fRNfLV
{!O0l|
UrLkX>v<M=9
5+p(y Kd
6 rEeCRr<
8'S1oMh^ZC$'J].?
$vS)!f
UZ@9~XKFh/q/
|R]/a}]~-
;dX;h"-Q44Wd7
[(MVQ
T"@U,_rWdMj9 u-Wu
<vF.zUE
%YEKtpr
AEx)Yo
q6(Ec;_
YP"qrb8{
q*BeMs
zHBrOQF
#t4RGr!sJ
xm2@x=u
"apj.*y{pT)v[C TBd "
[tYGpWF
uPex;$2K
sgiToRN"
hd0\0k}4sM
TO;PG -
J}8v|2
>a@JO[
KVBtQx
!}B9& V
&="O%x[
*W/_My
>dIVz@k
ooQ IT+v%
T sE+:r
).g(}9~.z}
Hi5C@*Q
b_<E{ho
)B`\PZ
hHCwfT
+xfP)S?
Rh|OsC
<-7y@F
;/dd&A\
LZD(d!4
>9<8yy#!(Du(C(KGQx
Y R>B"
h'F-T`
BccSBy
4[>BUg
Bd2?(B8[@
5h(V%|<Q
!O5Fc
DTR`g%<
bbwEk?
k5E(tU*,
CL$>e(U
D&!dx5
uqy8"\@MCvFKJ
T<yJy4@
Gj9+*s
iyNF!U`
F 8{_B-v
tq;e6+Vi]!
Z>u-U+*>$(
1@HR/
/1Jl)t"
'R2;uWs
eXRj* G
%gF[yK
%h.<sL
"LlP'4
2yy!FpN
s**{*8
[$A hYCHI
"9t2rtBj
;t,HFk
)H/d?,+kiB
OK+1JHp
h<o8cN
ej0Kf&D
Z6N('7
5"{vF%7!Q!
CWD0yA
QU>GH07
dB bb-
nk%Q@YTMn
y4;bLZ+*
iP;CcO
H?2]4}
?H"+W
(g$=(V t
|Uru"'
e$=H.!
suNu(s
S4,u60tB7<QNoT#os
^((#os
{{0E={%B^thy
;E?)}W
B T=m%Qs
}Ke"1t
p4%tYcy
tbDx[9aH$
jj7/e51P\H
0x'#{q%MrLK
2TiS@Eu^d9hXSjzJ
($'3E@
$Hk8jjdoJ
uKl :bJT4~C?A\AD
soO"LH
{aI;*M
nRyI?C!
Id<?\2#os
k)!?42v
"NA?T(
O6i9?B\
" '+(:Z
fmOSB,*n~s+/O
u"(i+"F
;\,>;O;_(
?\c:d9
|hY>|T
%Nns.r
qE-uhT$s
#rGx|Z
'\$tl$
fJT;5sR
.;U^jj
a*s#D|^+
r6p;*mVM^,;
U3|9/f<T9E
^sC<Ef1[+<To4
d@B)"5vT +
E\:%$xt
LFSvoE
;*DH+vc
u;(l\tEd.2BHN
D~BE%=,k
s-z-:Zyv>`SUBEKx4
+um6X+
U}*#X*t
?%uYH#3b
LC%tK:4
yd@Ch i(
K:(hVX
` .H_5
TIX*%zTE
+}s%.Lwjre
SOJ'bEbWlQ
ro4j1S;vb
yK{b`q)%]Hs"
@&u3F@a
dby:AeI,A
1U/f:~I/ ME[
rytL4:
#A5x3o/TjX1
3$%R'M
rL!dE3:c
3)+A6
;D_LT,)
x0I@"(
9<eL=Y
?j/}Us8
"CpHT8E3
VF$3mI
J|FS*-
4+BE bG
;?t%.!dP!K
D(@/_fpdjg
\;!Z3^
HyRp];v
yhgBP|J
MQE:RN7
eZtON} <
MqRTH}mh"g
P+s=O(oNvB}V
_Hb$D`Qks/^Mj)vh
E>7tY>7
Ws+J&_JR~RP
v%|HU/VXRPuo8u
K)|3H<
B!*?BER
/#pKw=
lh.b+KH
t5'LRbd&ib !O
cL&U_^f
AC0E@QfV%J<%N
N$+'#QZ
;/{e4FY)
5n/REI#R2:=
B#U=Av*
@$%$uH
dh+|da
xsi_"(W
oS\h-Q$
`xQ(X~
/~7INm@
'uo\C?@?D/!0
OTY$g@*B
phN@=bA/
?E!PHRR$.@4
@)44Sd
`9Bh3*hR|dPK6v
lbQJl^3)ymxV4
gE#cuZ+
%B|`@V]k
+C9Q$Du:T
o=yfX5
'P:B1X;
FeOJ;'@#
)su~N0
;[PHM3
SsjK\H)
;f^>PN
lZQ|Ur
,3yi@^b)
fT&M%^H<
Od?HDS
vO#&A;
0WPKwi
"yBPLI
]sD@FPBI
^bEWyA@v2
dgy}dn
{yK9"&hp!K'+
,B*|*2h
# D$h(
.R%ZnU
1imN4 "
B/h$ZRd(
P% pd9
,iHd<#
"^G)"np1s
C%JIba
IN=:${
PN^)"3
,&X[#2BL
uy$D4M^
CRE.\K2h6X)
kAiFGT-\'
^g/waD
O#C_GD(T.{K]
}HZ`|>
)-s9x^p+
S-9E~N
yAlD2A
BQAtAA
u)T;~53A6
;j)QT:'x1d
Ij\KKR#]
w)?D;g!1%
tdkd(CVYPKt
$PyJXQM7$
@~_<j}e9Q9K29lN
u_%+aAb
E6/XBA
Ekr'UvQD
NRsk0RK
!ubE%~xj%hK
hq,LYSOP%
Qft/ZWq`7-xH<
B_l(:B
u#~rwe
qJ:d9//+fdB
Q1z$y:j
tUz*w$<
~>jZ3?A4P Yt
z]w]s@cVW
wDN014Z
P$+tF_Q
r,pF\*
FxQar-
P)_[[@M^7=
Z^}(@,%U
(4lf u
#R)24$
hK&zCP
I;OAhT-Ab
N_DZ\ `r
x'O\N(,
}jKJSE
QhhQ\%`
Qe<C35Q
OFqtc8
|+_^k[eb>3uB
a;t7O
tNh;C
suF;C>
,Fca~94t
Og%.Qw
0.py.uf
W @=ud}+
^ZR[}n:G
v2%/Wx
^B"E$dW$^PNc c
~I]!g^
@c6t',
DU(PID=&U)K
L PNTX
"d-^[;
KPuqH=^
#PDT8V
JVP<qH
#G;APrLQY=
^*R AE';
(Z=eV' O
N2yD(O
LS+Z'_v
{@*VWB
S|.Hy
dF{! D
3k^7OM0
kh)NQp
V\R!d!Fly(0rS[F@
^<vDlB'
ERl*7H`8;6
dS"DB*
RCpHMHwH[(3VDYU~
WA9~<"a
a&\zQx
XhHNS$
D\\Kd
V o&&f
BctnSl9h%(QG2Y
Pp04xj
+@h_8$Nx\1
Bv%~6c
u324v0w2,R
~VBAp:
JnG <0.Z
C/tJ{"x
|jmxt>,@$
L~3txFf%N
B;F(Ju;
^+P'p<i
hm>J/y`c!6QJ
LAQCVH
!zSOj&\SkTe
\HD_4dR
t_K]QP^
*oa V.y`@!39u
vA]+`ra@
+"S Q}
@"tODCH$G
&dHW%&!
B{0wDltrd>f
Ev$"HB{g
OByf$+ ~BQbV
~|e/.y
,z{Rel,0M
vM~"bE62!|OD'[MoF"e
w~Q+oN}j
!6 -BIiEP
^)!6kG.
-.&Y*@
0t~&VrSIjN
EN?B!Q
#S~ 5sf
<KUjbNL
ISU;(sB
ucDRt"d$
$D0uRHFZD$h0OG(FP!2`H
&^P 58\Z
7)^L9J2{,m4p%
j;di8)"
R>T+;@NyG
jTPW]B
+B_Z_FQ8;j
UW93t!6[~OR`
@ 4^<}>LThX
nQhP9.@x
)0 <mMu
[f9-Hd[vzR
F@VC-.'
TYR/<0
LXIp1/us2
97hlv*
F<iD)@
M~d)\8Y m`9
Le7EF~kSWt=%l0);cG
Adobb1eLO
)d2JS#
a IqIv\d
iPM3^EHp
2; B'_Qv20QQFD$avk X
sKkLGu
(ULkFN1
TIuJCt E
"0|228
C_WHE+?L
4YAAX0/T
2IR;hb?1R]@cwLX5Lk;O
3%_H`;uvB!F1F
3*h2{P
lzaQ`o=Lj
2uPAX@Hi9P;
PiQh1 +@^b@F0D
OuN(H$
";nr[}O@(uD
n~<".NDH@
F<|_[e
9_TZ<Xy
lSJ9 V
`6;];s
9F4@wU
NH|{G}
dl~!MCd{V
URhSRc
E,7P\D
B\lm$9CJs
@'qR'i'~D
;tv$x$-@kvp
PKvMz0h}\"
`"]&9d9
w:/O4}Tl9-t~OJU&ToJ
2Pp?DW$@Ix<
W4)lO_[
D~h-F p
~n?[4K
H$u*c@ ;$|(
Qu+&uRK{~y]
,40V%IqvEr|
gIS;T8
^)-Sw-
hNA_$pL8t0J2qh}KJ`RN
P\tivaTG
:`aV0_i
<|^~{#Hh
3K |%B
pSu=6?:SK.u
/a*i&
05/`-FG;:tz2|)IGx>
kCu"vH
O(8LtW
[]#oJb
u[:H% $
y.}9=i
7-D[yZp
[,@pGu
"~:QRwe
/~0;`
(d.`gCt
WM1t+4C
z/qiI0
W /-8~
`NJ *9ZW
B.UAl~Au#F(
k;5LCrL
GjO$jW
@LxXvU
1|?4^~P
`f]C/f'@$sO
<DLJGeWF{9\N>I2U)A6
q0IZR&TK
t@[%=Z$3
A@+bFi[G0I`
$([%83O,\
D0cu0|
V(D !LrT
b1WAZn
-[]'2Uh
i\D\]#l1
"T,RSQ'AwL<JQ&
HZ ASsX\`R|)
4\DTr
DF=*aPON
V%MP"_,
G8fV3>wO#a
~*nOO]
&8Bf^<$@|Q
^_lQRH+
x9U"u#Ps
D!GH_y
OrS@oyr$=PF\B0
HL~aVHR
BCLTLy
CLN4%jHCKC
@N|V>)
RFrV>C~#F
2T)IQ2
ZwmPUC*b=
ydc_V't)
9@l~;wPS
<;AI/;dvA2
CdSF#SBXd(#
J(<zCA
#b!&D,PWq&dz-~b
_I[+J4
D<u97XN
5Ze+|~
s 9[uA
oCcx17
9{@P[NH
:LPWQ$
SDKm@YLx}Pw^T"qXk
?XVDkH{
6%7]\`
HuP=$zZC71
SH{m$=6D
G t73C
>|kX'vDxIR
t?oQLp
pX UB$(Y,
!0d4,8<
(Z9G$;v
D$j#(Q,
>8<D@j#DQH
8X\j#`Qd
x|]t)]]B]
HG,vdY
8lA_5@K
+t4sHd(
@|-^E4D3[
DOGj%iS.C
+_4`;r
)A0uQ;AE}InJ(
3m;MRf(PWT9jj\
c<A'WG\]
eBW'@}
DSH5;$[
_<+X3Z
;N ue&XxBO
}'Ap@N2
}Ch0~6dV
aU uXR
gm~oZuljycT
-O[2~RSVqs
FE!2N'HR(>*?
^+Z,@S9ux
IWR#TF;F|^_j=>E{JDP[}Z
+Wk^K(O
%|D$"f;AC
o"u%o{`I3
hM(9J,se
K0U$?(N
2*K*3k*&U+}U
ue$R"5
W#0J~@I0[9A.AY
@BZFjVG
A$7O u~f4
VL6iL0
+C<,<i
9HQB#L},
>.2FCB
X~#$|=2
OIG*S*M4R3
Ouj`xj
QFM@G$YuM'Y
R!U:A+:SFTayI
K' =;u0N-
0&P-tN
Gb;j,!V
QT}%[]MB\((kb[tuBJ$<cA?{0
F([9K%Z
].G` 9mTJ
F@/Ck!
LR0F3+
)F%^D"E
B,"mCG\2u*2{
2mXZ":]%]
=5><9"5K
- 3IIO
X<dn}^Ui4*
J2*P)F'6(HSwZ
<KS0(rED|=!
t8N|j;l
"SDM@(=p 2v
-NphqY
d-$0_H'
N(J|hKl.
"[W60#0
]b}cu'
QUuvR$!
~kE\T<
G;Qk|:gQj(K@KS
9/Ojz-XVUD,AeS
tNkB.7k
aRAWJX&^
^/P&uQ0K$feM
_"R\-GK
^DA`h
,>l0yl$4P t8
ETx&/Sd:u!
*TcY4
,);1F @fj
8B!c/DR
GnWx/1
;7#ytp
>zXMz\"hJ!
G&Bzr&U
;m'TtD
Q ^VKF|
_^V@rI
+kP <)^d@
aE,HHB
?t*@NG
hB "B{)
P}-Jdr`6B@! =C
*!@4,5nr}
CTJ#@;~j
0 h;L?@N@
k7bS6$
80)p U
hBd{qX
hmHpw`nBCV
dH@k.i3`B(
dI2D<=
ttH#(
ZS*(NH
W,"E1Kn
XOj,&,8@
+[@eM^
ZYG!JV@
KY^yse+
bwz>$|6
8\KoKXd
HmeZs$
2X,L,N^
'&;1W9~
#`*|i
IrT!pA
?ZvJ!$OZ
p-Yi@TY(
;@PJgWf`
'?.*7$
!!}Q H{HsWa@%(u
!^81L{U}
jJ@6)5W^
2AU3SkT
/x%[ ;t
O;]urL$b
^7.+?
Y)i@ta
rP@)t"
}N%OAI0
ai&NT~
t7fWlb
kMdVv/|
?R&V%vn/@rw6P!@sHH
PB&".hAG
P4@j0Y
IYZHwE
daSf;nltD|
]+ii2T
@qKu%Q
\(3dQP,
Os%6%M
AnG%:~
FE$2HKV\%!
K9gcJ|uP
v!`"SWQLCw^xS
C%HJ2=
%6lK'}3
E",qH*
ky%.0KMY7
'<o5:WU
+7%:|97j9D]*)PaLk
#.sX22
+#?Z.\
cpyg~[f(
|}${ 2
/]u/r=-\
!&`psD
:8;F1uQ"f{R
W95I%oB$jC/ZtR
0WG *DsN
tGy)uWEOP)CA
<x\[)/*
VwQXWQ
;*J6Xhy
~7F2@}
qY.v$K3E
ui@j4I
.eA*~dO
A03_|b
w`=[|;To
gVpk1{N
vpwoz|
a8S #H
(5q1 PM/3~K
3V%,tZD{q*
P=0>Nex
)|mb'KThJ`d^
vEAiefU
#NG;M6t
@+^FkB(e;^@
gR_4a]
,pWu~V
\kxWJ^_4
H^XI,"&
h<!e&$6$Z=Dd
<)H(RC
t1|t9$
jP5(B+
[[G$SU
Ck5kzjO
B7*kSth
IVuK%q/5
J5/h|Nh9=
,Vs\.W^A9
_E< F%
buVTZ4wiv*A
`Id;[hDlBD"p!;
WWN^vX(
`|-wHq_Zmj
YdGj1h
k;brKS~
{'h);a
hr'RXL-+?9
/Y|~Ix!
'hA7$d
D j[^l
wS[OYV
`hGVj,
bBz("_U-
X=p1H&`
p~ NVNz(
H0G\! P3H2R
<M+Eq}
OMP;t/VD-S{
B5->j?zxx
+[}W tH3+J
lEI0@(>w
iEE&dG
ZIJ&"6't@a
:Ap)'P
*u>0W[iY\t
B,\^N2-q)
2/Xn$tZT$-
;$IV5O
|CV#:0
9csmXX
e;s<O5
EBP5PK
:\Y+/hH
F$(h\U
$|G@V*
BC2;TY01`F|R*_
D4-%:xBHG(%
7+%%7419
?+nPj,`4;uJ
lQI1A}g
t^q*q9
F/I~|!
$_M]Y)55D
"a;$u`$
Xv|5F/U
,v >m,
}!0hA/S
mW5N<#~
qva!dCAKic
wC@!Za
@d8DJO
O1x0_?
O=).DX=]An2
W[$FB"*?
/\3)N1DKn\3H
>3#1^qU
yK9{`o?"W
yWdN=*
$SIVW}
HYNAC8=t)
=*`,g&
"| G#RM
u)R[I9
Sn/5Le#uS
Yaj _(8
GqdGTOr
p,\Le})
'.CcJeu
^)$z1s!'
}#?p4{6
?'2*C
+B@z\/i
22Dv'e@B<v8
hQ?!]rN6lV%h
2jP`;-t$z
KAP6>3
#<KG0~
bTP_9Q~?8
TWoj$EwZ
wWYp@?pM
O?":ea
nl`Wj}
2[=2G(
Sl.f*l@
htDQ.(j/){E
^R^e6V/
/8]#OJOS|
9Mj,pD2I
dU%*0X],3}
LpX8t;4
v.Nf\Y
uhD^Cii
4lRQt9{
QQw1FY
Ed=u,\Xe
kOW00>H
+,I'`g~
*WP;Q&RME ~KTy\v(O
wS2';w#
Oft%Zu%
D6~npL4X
-C&i#kR
%>d+H%Z
@DH.AQ#
gDjFgA
P4UMA`
YFf1TS*
xCNS%$
MQJw$S
GOb\g)PV);N
g9e)OP="0
l=Yf;%BhhU
[Kr'^"Mb
FHL;Ts
+$D,"S
B?8/LH
iX!qOiU
Z#|W0WxM(
B@B<F`
m8CulD
$`r!R8(
X@]G'O
t9,W>/+
qwybCx
AG /y7K}jSVK4M~K
rJY3R0
h8 t^DV4
w`>/9U
DODjU+b4_t
jh!j#B
|.l3t'\+kT
6$qRM$
|k0RAI6}{
CTE~$$M
D,2uq"L
tPVW(# d\$&$)bNh+
SzwF}6ND-N
3tR_wl
+hdiv
,4<6F@DH
tb+E'l3~ly#PS
m#T==^d4hO
(="y$AJ(Byd
$$^CHB
2,nZR0!)
I]JEi]
Sw[^8t
\%TT$9:;
ED~a\r
h^:?Z=*
+*M3A)sv9$
BF]f<xtDX
jAXf;wHZL
rQ) v"K
yw+9v&]t$1
h,a-"2@J
w[h0uO^V4.
X}JL}g
;fO%g5F',
Aj&hBwP;HJ
IxrzXf}Z
(nKz`,
cN.L%)C">
S(3*QHP~_E
z% u,ux
CA%]Q-aH;s
jQ-Cy+v]
E}3?>UB]
r*L%#+
)+CWq=J4t|
[BU(}H-&
8*=-3>!
T`Rt U
A!u8~k#0
MW)x]\E2VuNg'Py
T|hrpddj@ ^JV
&@84:
O)[#0M$
? )*v`$ts$/R
jX/ZH'
%tC?W4>&!
u/^.me
<C)Fe@0e
BJ+DHD
) M|)1jQR
?c6#JL-f
a#aS#O
VSLSd#
\E#1?S}
SA?\Rl
z&/FKVFG
Wt1'{aGW
A}u L18^
j U9C
+3lS1-W]Hk
%$$6BEgpx
'YtoGp
=wh{"T
hY.oV~x
` 8]tOE<FuF
WH/J?H=
rBz1lp
R%*Vq6`
VqB}^ns9
GMBk08
mh(jo>
`,Zf1tA0@J>ur#Q
v(~&4 r
hWv-s_
F/+Fwb
OYG=( %uX"kw=
$*^h0g=
b8 ,hY
JJfe=Kp
&sF"Dd@
D"""++
I52s_R
(W8]!P(
8.Fl 8/
wNnt9H
5V[PRF:k KG 0
8]Z!%w@xD!CBX B;T!7h
S.@D!B
h"|@U"B(5
@"BB!"B\f
?@Y! Iit0v.jXJ
9.:Z'dH
>%wiVK)[;
L+%w7j+J
+L?!3r
hS$BSS%
"N`Wrn
;}$k@~\
";v&%1
/'v"?3k
uU5ZwX^
ut'LD$8[j
Yt1j&3cPVt
4~wuURh3%
#aHX218A'
PTB\)t
fx^DS]
%4Pdw@y'At
$HYJL~
g~;|t+ \
A+S uWl@2u
_h[j|P(%
yd_+ k8
7S/;~5;}=~
|w0]^Ot
vl[ *VqN2H
CAX}_$
B'FgI,$hBY:
2%fvoHv
>BM~5<#
+SqsWrm2
ZO0o(0X)
StH7H-
I9P\QR9+)8q
ge,](~Rz_
V;}\eHt
6wKTS)
CI7cNQet~@1
(O[%]E=&
t+J^##*$~VA*M/iB3
rTcP k.
r[\9-,
$N\jVVPJj=&sv) n,s
e*f0PVBue(#+C;>8
2kJ'l!
Q,wk p[
V)qCJB
x@$8|VBjz
Mw~H{e~R&e)
v y{r/!x
@ E?HfgBtun)u
PxkjF(dA![rXmU
tR2y|=r,
]Z>Bbb@%
8})qzE-%|F+L
"Q"]Y@
O'QW~D_o@
nPDv`F~p3ng)wp)v
">E+RQBb0
7h%G? ~
;b8k ("
)Y#-xY;Tuu
jP6E:I:WS
YiT\1j
?<xqF']
pr%JDI~
;_d2C^8j_+
V}t>@?P
^J9@3*A]Z
A$CiUa+.D*)t
Cw D"^Ic
PdJ]xO+]h
Hob(-F`d|
j__?!'X
w@I90,u
6-%PQNE&,
u6p0^YozBvT-
-d$Y}HZ+X
_V!,jB/uHR
["_$^;
&;uY^~$8z}OBA$u2d8t
7;-x03
u![?2LHd'
8$B4E^
UFt &%0
C;$y|%$^
2&lKF&
NlV-."%3.v 4
?$}L&Aj!
R_%<I@
PB`%pn
W]<* k
6[? VS)w
]_@fHd
%+%l>j h~wM7A
duDw.%
:+Hi;-
^YR_f:7%u
VVceIT
hY]6/!
\4ErJ!/:`4NxcA
2\jatuyW
` .wuNS]I`8T
?K=>wKZ
N('X_
@.yk$I
lT8CsL
xBh'ci1
HkUPh%
UkLUbh
), <X$w
QGF!{ItU
wCcF1p
C;b<3!22
n]39zIt"}:
ea)@9#|Z
.]I6B)"
E/X]9!y+
ctx/G;|o$
NQuLe2
$9dAF3
g4Bitq
unA(!F9T
ugMeOR_Y9E
)?"'W0?3
^V9Q&H
5l,;RJWbb
LRS^xzU
NCfy$S+BT
Q{I02%
t-1Rk
'A=9 Xl
0@>3If1
,d$ivrOP
Wx0(HB
PjWk)"z~F(fu(9
P8AZYb|Bt! Q
p9|n! K|K
z6DWq2!&~%V
|(WvL)B*Nu%ejHPs8{
Agu2F$$M
+g%6i7k
Q,'bb&VY/
@T/RnIvS(
rZZ-vY{M
uzPqF&]
$t2<+Hk
IYwwGV
Xuo7<%
`jSbb1s
n(d!J
"v5A*tp
xO}D8amF3u
9h0WlV
lD#2lo@r
g~^EHs!oW'
W@XZH-V4
CST[$VWU
Q,R*CFqq/^
Eh2<)FrID*Hs1H&5p*9hLyLLru
9r\ctRN
?|'D,I
RT\F$YU2p)RJ{
xuSRG?J^
FE f'2
]7F:s
I>dB[>h;DA
Mu<:tXrT5>
hsRhzI
[t9]A8
% 6D9-
T`(0OJ
H7N\")trB3
HVY;J,
H,|'`6!@O$$2
XH%0#P8;
}n <,{ku
tbF"X<M
VSGK3K
T:bYg*<
=[;'^Se
9XIQ~P/
M a-^[YY
=+j??e
N-VeK|v5
"1TU%3E#C
9uPJ7D&A6J
Ae;9?2!_Aw`VW}
Oumr6.
Bt,(OK
9D!X0Pz/%v
M" ^Q;;
>nJ4Jt
@+i*Md/
Gma_C#
?my9X4Z6sKWf
f-nviAD_A
sC7?pE0
$;M9eH
G"atrj(Wg
T8ZE*tN
FKP$nO
7X3B^!"0XX}
b:-=jI
uYIek!
kbyj%F
KY-y!3
{vwq=e
2M|VXv
XEW\kW
ha'Lo,7Yck%O=cO
LZm-*/y
~?Xtd(
wqhQ7o
7Wu|wr"
?xMdtB=
;C!'`k!d
Z]SJx@2
'-UPYi_
:gH>|aW
kAUQPXY+
!J3%zluS
/TUvz,qd`(
VJ+^P=DA
ugj=L&WbxUQ/
X)%/P4
n3dBk}u}u
;3r 8^
Kh>"jPQP
:>.N9mC1J
|YasQh!<f,
;dL"1sb
BZ(4WpRU
"FI\\~&$9
Bv*yG/q/~rdv
W8C|[GJ_
sf|YIgv;<
>w@lq'R<
!+EHH0
OdvWVo9@n>O
iC $AG#
!8'}/f)0
X^5pPZ+
M'pi[v
_&&l3oH6
;uR)@o!
P4H )<u
%G"A?n&o
HK2/sHg
DAPke
WR{L+H
Y"7~qa]_>O$
KLRHvDQt:{Y
V9E3&lJH yoF=UF
SJ,R@}
`Km;ZY(f4z
=~H&$(E
p$2W#p4]O'm9)
tVR@fH
/|;RQiA
%A>5I=#
$S4N&aY
2>+8jlKM"
:n1t~EX@9
RZ- F&%!
(V4:mn
^ j/XL
?PjRWRc"jQj&
(G,#04
GH#LPTXr\9`
dGh#lptxr|/
80,^]KV
;5%WzE~h
_*`X_
H]9i^'d
%P{%p>
(L|PYe%Fj
Ht=kuN
`_mEq'
]J9WRE
%Q3 .phA-HU
%RQb7"dt$
p\fy]+\M
@/w]44i@
6?89&t{;>1
K^"yQ(L
SVWbAW
J<.(J$
$":"C!
AGtD4
5L#]u9
&QS'Ryi
tXWyoJ
dJ62=(
#*G?|x
0$9=O*B^:
N>O*!I
~&r-H'_0
(xUK4@M;
m9~&D%u
='F&OWBBSj
Rt{)~B6r
,Otg"Vt
H0WgB$
}^:JRU
J^[1!?
@(uwVzjNPu
[z(n40W
$`G$YW
JjzU{W2R
6i=8A*+
NAQo\VJ
&m*.,hWJ~HkxT
,j5#7KA
mh(H<h
H}R:")u)_ht]yJ
ZDH PU1h
h:O@4*4CKv
UYqq4x7^_@
!#%pYFy;
S#6/t88-W"
6Pj-Oz$
Z&+GRP%$x
>v-e<{LA
P'&D;hm
r\QUy6)-it
S[ZuC,
ubH2<1
0eGEXR
B|1jY+@
F@2TFupS
+3Bx0h1
+!C)dN7
lH )U|\P3
]|>Q?$Z
r{qHY:A;
] D?vG!p!
<(-$;C>
^}_H"]
}6"gnn
,1<eA(YU.(
)tGX2/
DH))0O?_aP/
l"WX0.
dFK/7<
TTph$B
;pcB!&'`wt
X"[uD[e
r#.mMRoQ+IIf<i
u|UHE'
$H?Jbt0
?,O"MBFx
bE(_Z#L@
*)h|,v
=\C;M?
,IT: 8$
>93Fq
U&u1H@
~; [u-Je
E($9Ume!
]~k$Rr${BuD7h
d7dG7D"8
[v( C#0{5
5`lXd2}"L<C
}fU`}jJ
F~N(ZY$
6m6Q66H4?I-|9Z
r U0vDZ
#V.y<O
!(W`$fT
`F@ `
ZQZ%Tcm
*~SB1h
N ?XlN>
R.QM.E*FGQ
ixMM9}nm
[?ciA3\
42u*R0y
!AV._j
q1oOtE
$%tVU:
=&@@ff4
2~u-w1I/w|pWV@S
bBw@#3i
rk\S'[7
iXo5Zw
Sirj}az
C;X6AeU
{oCBFX
HPrh"P
CC$y-pO
~*=QCDR7o?9
tB[P/"TaW[Y
%zW0i
L.RU ?H)BF
k{3v7M
%Dv?
Bt=l_\Y*!u!D
WZNBB{RNrRx`
kZB050%J
C0[@ +Y3
p P{hC
< d?#84
ddr003
1BL$dQ+
D\3 (P
(hpy@"1
XdWHP>)
%0Dm"gSMT)#l@"QDhq\
8y$xHeH(_b"pGd+c
%&'()*45
6789:CDE
FGHIJSTU
VWXYZcde
fghijstu
8Aplicaton rsfved
ysv:D^e3XIv
8SO.pXZme@tsf{oLqun@JPEGXnC*"upt
d:QunXrklG0x%72O
a,o{fPR%PD
AildWvnbg
kowJFrIVvis'!umb.hvabHuf
coe.$~H
""gmNX%uZHx@esy
fxR$jH4
FcSlHmhp(#
}A?lWde
m4!(ObEXXMoh@,l3uF
*tgAdz6
,ahYCbNr
RGBBhIn
9.gemvn*
WJt*<R)-)O
rLyc6s#QM
CGc77v!6St04OfX8=i o)I!Ps
hx>v4q,PF$fJwTtue:
d{&&5%
v yUVY
rJA9pY2M
={V$Dxejn
S,r6L~z
ch!>HlAP*0g
O-cTEt
9MX&sBR
cy:")4A+14"(+WF)&,0+mI)
VVXf0SgL4L
BJmvq$7
op=6b{
27-MB198
nGz.iLjP1Y%
D\Jm5e%lW[L
,uQ(dekvpe?swO7@
'uc[:ENf"
WF,wo$KI-^DE48H$ccYIFOz\
RmIh"r
as#H)7ANr
Z1"wQd4n
,R=K&B
:LEyy"?Kywmm-$c_')aVptYvii
Dnu;lK
[`O!J,k(,
:/I<dI.D
VLH1(DNL7`)gx
H^?ACMPz
:?L6x$ IR601(
2bQ;semBi
v%]QO":Vd&ksb
fs<Gd"T
@Qsc:LE*fj
[G%Ew?
RtO~8_%
J*Z$\f\VQS_S2lgyiPa+
gO9$r:j\LdO44
RT2G,Y
$IDXCSy178ckl
Qb6OeyMAX_LOC
Ok;LHIG
N_TY!#S:
,6g-#iQ:<K@a
lNya\X
HlP"0D
$H"|DT<(
$H"pD8
$Hd"<E
{\-X[!@0)
8|2H+$t"
:H;4"-D&'
.%5=6-7R?
%9ldcM
=L9o<X{C
Oyz9N"IcV
0r_Y3]
ru{[mt
h(q%1tkF#(
?CR4ct|l
PD|4$(2^X's
- AN^J
vl}J/0
T0)(d%XJog!&yov.]I(
(/}r)(),
MaiD2$7e
/h`/D&101>eaRT}}H.
B5Ga)d 28H' <h:27w
Wd8B5%pbJZCR()4`_V
Q*%X_F0
5mn_rdryI
&r}H&:A|ww9m"VV-
)sX2$i
C5d%dc
gf,VcC+
%<D=n_B,F3$EF!\RP'':c
nPIr!K-RIde3.Q
^<e,Fls(
x|"f%/%8
Bpd8p`sm
 !"#$W+,
23`;<=
>?@ABpKLM-NOPqn-[\
klmpqr+
,BpH*2x0D
qxG'Is
KERN1L32C5(Ou")E(
5PA( 8X!7CW
S{21UrObjt
I8A4ZL
c0Wpru
G<TgBxd(US.DYL_lZ[XHZZsD8l.
YichyD:4&@JB
/1(8Ty
E`<7j<iq
gud<`E
r`$F*YPpdymSj&
tJ8PGc
`g!BqnwR
tIi$!RT*I|
umdJ5*H`
Rp>jP?A7iH
b#s/S*$s3s*
of6DGHb
-$+H*|wI
/C->*KhH.
Z!",Jf
|Hpd"XDLD8
|$pHd\"PD8,
$Hx"TD8
$H"D`XL
<$ \"6
bsld h
{!z4"R
qqU%mQiYqt
U+Uis5 )WgH
d[x_+v
neAApr;$
cFeybOudJn
<4iHzpydDF
0( $ Q6
3&0P)]p
('8YWH
:^}1o (2nm
/hCLO
UT$l6(
g:Jht+dW3T8
5|=1N02
mJY4:tlf
Cd@J?36?l
"J<t;0E
hc4<UCY:
pRDg%%
f<ql^yNmE)n_C4P
rp/kad"mr)
UPDATE_HS(Mq
C%-3S/AIscD0
>mjp5c
8ROgyW
AU#gn1
`MGiIJ
Tg#.zf
I|zqxp\
o9a/<c
zipuESj!C$
J9 Z^^
VKbm:+[
3 Sk`
~muP>L
MWaBBx^
uDy-I4
H.u(=A3TbMp`z\
)ed8c&s;lE%FVa
J;%dE6H2L
~|-/D:
tRs5B%cS
c"Bf*u
.7b+\Hr
0J4eaVfl;'n
e+Z08D
E/F`Z^('`
HTsN|
r&SAG;#x8
d$tb`9DL
BGsGZ#
r>Gy#9i9)
xuG5#er%9
}=|mG-#
Gs#3c9#
`G)C |
#{r;9#k+
~Gw#7g9'
?r>Go#/
rO9N?
G?#G?
U$AH]E@"@
K~mL~rry
3_ew895-
6l8Y+
;S6A68]DK
Hpsu[b
\otH9F?
<V8d_Sp
P/wyK%
^\RUI"d.
cAdmS)
C$2dy'*Y!p%iIa%e)h
4o6cTp#0/o=
d1tI%Eljnm
%r+#<Ez
e$B<SX
bs:h*DhEa+|FDd[VMtr"cLdaw
d4Vb~%:Par
yru6t(PP4J4C"
dN Pjb
pU\TCL$y>
J`T`)EeL
drLrl%0
0~(I.X&j"wWs*p
?L".HR~r
e*4@-L:thxt
HMbCjX
Q04E42s!z"$u'
i0%c2j
l,#k6j
jvvsdk
HlpTV,=
bP$G}H@$XS:
<R4H@Uh
+w(&!)GJ&H
.Vp)TT&Xr0
Q )J d$
U^,|&@
D,BXY,0f
PWs,w:
Xpfx%.
Jsgr!(
.s.k`2
R^:&[
h~-0jP
<#$l )
HDs6J4
.P<WhbN
`OG$n"By
:2w%dyP.Hii
fmmNS:B(1)
4i&SBIT
QzK{HH7pH.
AvhS'X+G
HsliN&*B
htr5pN
~D68T+o:
^tJVt$AEV!\DI0
.p|W;be2KMPF
ZK2l/d
}L f8^<2Wz|h|
ZjDh8T5
WDXRN2bvv>X
DTTd\ thr
zVmT*B
IsWo64&k0
ell(,S/T
2V>fLc
'ISTCLS
h^e&CgRpm
#(M)ym
EUSI)Y
tLIyI{
-lvSM^B
8w0R<,I\8G%D
Rw?rpH
JRqI'BH
xtg5rtjh3
OR28Xt\
Od:8(\
teo7472*BuYi(
QL$rR3,
fHdMaJ
4 G.8,Ne
p1J2#Z8f
Pi[ip4"Cs/E
-:v:t"8V
8ib"Vi({`
A:>;C$
*xq9?C@XMP):Zd
4gaTR`b
e648B_6
((SG^%NQ#_
M`y4VB
j\%l)(
3H|0!#
X-*X?+`tH
2k414x +
nbId|A<F%'NF
IdPLQC>
.LzQxJ0JOLGmBL2JGD?Z~
XPGZc.,
(4w?3D!LG( F
||4_"G!4"T#
8phdxtKPC
c$+ Hx$8g
)k<Ez,
#x[Ho<\
9$&X`+v
qh4g8PI7H: #
h$7|@
88$#X4,@
|<b)Ty
".D<Xh
&$8HN\"nDz
z$hHXH"4D$
$Hp"VD<*
$H"D~rd
b$tH"D
d$$H~"D
j$\HN>"2D
UNAruDsC
fVTikCL[
LMdu@hN
uEvn=J'VT4cEx)"DDH
rc(K cf
48"Un!B2
p32Sns":
!M;$HT@AiRI
t*IzGI8v#z
SlzqAh
vh^}pC?IqDL4R
TWslAc=<[:0
C,Ipp$ch?L
f8#iSn0H
Jl0))N.
h(GHIZq
kup&vHl
AdjhoT:n[
HCpmb0
5#/tHZ
$Z~%E{#lEC
:4I]b*|fS{K
9W)H?TMV2F@22
[q4E52
QII%&ke(m'
P"ZKqJ
p4iL(.T
FTOnZAQE
vrHNB)&
AshWQ$
*rDfrXU
+lj<bR
dOfrNx8A%
Fe=.?V(x
*t*_i7 V
C ?0 
$Hh "0D!8@
$yHtz"dD`
#ACP4eR2
WL`Y|Sl
^v_xjB2 )1~:
#CT RC
*iDx_/_/F
@""D<#8
$$4H%,"&
(tA#LC)2
$Ht"pDlhd
`$\HXT"PDLHD
<$0H( 0
PST?bPD@B
4:8wH"D
Zd;On
$#;1a|zU
d|FU>c
u7.:3q
-64OSk
f(00>5@
TGL8V0_
_MYDUG8Y(if
>@TLJdym
wi}NE9
,R5CaE
p~?P>>qC'Nda>
g^?&6#
1O%:F
?i8 kO2
xg5Y>@e
6r"kA'
tc:,OR
KD16;}~e#S1G
;L{Jx
tE5rt(
PQ8PC]q
P83iA%
nPC(qQ
PU R?_>+e
49]C,J
ad}mo97M
eul1f=
#<=q'T
"3n)H2
@~=%xT
ebE_ 5:
K`vs+T
DKcH*%
6&%sYv*
.Qbpz9d
7pL!2\
ED')KH
HWqrst
<BwO6{j
KLD"w=?@\7
GcRWX{v(
Mm`/_W
g{)J`?
*$]T|Q:=E
R<'v0Uxa
'+8t_}
O&*'2
.`,#02
<O7o$0Dg
*_91Bk
pjo!@V
{j,< |Q
a"FNY}
U:P~DX
20'=/U
.{B%5!
;j&6v+
$]P9C
aoK@is
>(09!b%
UJk0Iz
Y[Z:lL
6zQ$D$a
+L*@`IQ3
YE&'{Sz
{ftS|t
BNUOSM~
3K)=`p
j@Dz9_
Lk[]z~7
#OI6?
Mm,+|"8NjWsyc
b$B~6a
]gLC0E
ld?n_80
j~{k$I
xu@VXz
U<@`/Q;
;k)Ru7
,72.'43Wf
qxj( `7R
|/[R0g
Hbx*kC
Hw[ >u
|lyz=5
Z97%u,Q
tBV=z,
hDsW=R
+<]oA
'/|P@U
j*sP)=
X?`!,ut
@Vvxc`
#gG`f2X
.N =:0
b Qiww~
B>6}y
*O#2h!
L@jp}?D
`>V_9=
Y^`a&s
#S`Z4u
n=lVQZ
C_wpxr
<tW2`
(F/os=
M}n~.5]*
\f]@84Ln
Gv 5`o
?,}@$
Q4&$bo
.`` A{I
1oRBE8=
\3UH|Q
O'VgnM
3[Cz`>@
/sSl-
*%:L.<+
}<fv?
47-X3wr
i@Y&dm
htkYE}
*<+:t>{4
dczXj7
,%M;G=
t`<@@2
_\:d ?
;(7-k4
?C8+q0&
{dn=``N
`D|]&"P
<lo8O0}
*9Z#Wc
:L64M`/
5w\B<W,}
'bq0,7%
29s^!Pd
/=MH'1t
E=j>`/{
49v}c$
Gz~i@8
9!Uts{
\5~Mmv
$U~)Au
lSFVE;
KNuGi;O
L6=C\Jr
%+> >*
lB4GT2bt+
sG5xH{
S88+bq.K&
IzopF(S
i^YQ\ "q
Qu>i\0
Pxg-8u4`:p
e`>Y=,
$bJcV
@})aA%
V*$5&g
#j?Rkx
T`?b1YM
T,Z.>h
3k#lL!
TU4M$?N{
q":cem
UIE%;}45
qFc#pAB
Rmc`A|
9?\GqX
cy\&:N
bQ4s?!t|
a{1I/pU
_^/(;ZSHL
C5c0R\
%`0&Sx
-?@&2DO9
;$h0nN
:A|1@'kw
bN]@["
|4t:()CUs
BN:_<u
"]>~*(p
C=Sus
VKWpQ/
x[@|f<
)3+|N
5qnZXj
(WsDeUR
4~X_8
ILHB!1
~*D+;9g
ctp4K<
k\' _I
CvB==a_y
NhB3tlwvPN/|y
p7;Z<5
x9-'0v:
~sM`OU
!B`*PQv
]5{QcH
u{8tQSe
TfcQ&6
;.>?/eR
Ymy:`9
u Mc}8j
mh|'0s0t
*#\:?=W
id+PDC
ME5jvP
?eop|>>
o=Rv=;
'H&*3(`
Gc"f9Wv
y'CTQk;
G;}@SJ
c^v8nxiq
Nd]upi
9N1Gui
[yY!R9
It.T*x
-in`A"
>+Y<P}:
n:^tMf
6K3{M{L@X
2k]SrH
q7w6[Y
mGJ,<Ci9
A_T<tp
>8H1Q=
5gS7zx
047:Ji
KZV)\>
{n~=8lWs
zxO}*x[
7/~'}Z
-,a5W~;
})c(RZ
|:o[\56
gwoBW4
3"O<&wv
o!C4;Yi
-d9?O
xP|^N4
+Q|#Xcn
Y=$_h
yWT;R@
gPK_`"U&j
vR&L'}
%TDf=c
[YW~J3
2vQf^<ME
JW#za>~
?KL>Sc}@
mF1I=9
jbk#pA
7FH$8=Z%
l4T\r_
tv<mCC
NR!FP?=
FQ{CjZ
^O',i[
<JS)|a
W@8^y!m
4X8np;x7#+J
``1*E:8
Sa|JBI
?@$)u-<
(RgpV^
fP'!t~
'f~6w,\t
7Yo4p'Wk
Hn>9X"
0%ahWt
t2bHA-
3>Eh}A
I4sM.
q!@D#x
.a{og2
Zq:`%*{
2=oE)3
0c.[^
D V4#><(,/$
Lwy:}~
U]x |/b9e
M=>/@$
[ ,ps$;+
-T"V;r
T1h"WL(g=qn
z!lsO=
#=sbS4v
_@lfZ|-
~d!$QO'8{
)0SB99
a8V-c*{;
O54gBisaTJ
2 H-mM&
}$@1NL
[b3O<I:
T(f{+0
r~L 9XL
*hbi=%
t7C2IO
AcD{9}~/
kt~wAOz
hB\ZabC
SEa4#+
P.)VAu
48@D"q
DEU):<
eG?:{yF
OY@jV=
jXp&o4r
w!*:,8;
A3@G<1
-=vMH8V
B"kh/v0|
LfroATy
`?L_1
vfi~^?
do6;.F
{fcw;<\
R)$.Euf{
a_?[#4
H-Q@G)M
B?sux<8Q%
|%8*d73w
X2U?-$
DG.oYA
ex{^yo
%wVG4[
Wpk=dl
M/=8)X
%*-<P
.h~#|"
F<wr?_0
*Pn[-y
]="r9Z
VraPe.=
-k)Vp"=b8SW^t
}<]^P%
't@EK
$^V{`5!+L
vED3 ,
%#`G-@
["b,H>
5sMCvS9
8%V&d
{6G)L=QR
UIW"_.p
JNdi;5
h\Y`VqG
jkmp(s5Z
/Ecm=f
k^d~|r
wY? "[(g+@
SB\%SuGs
UZ=G:"~
iq{LAJ
}"8Zb\9
u@.FDGz
$;98<
B7c^`+
:}~-`L
Xg{1~R&
DL|5Z
,@@gH_
-;n0Hq
~=#1:IL
]@duaI
%Bv ,e
'7$4<h:
@vgS8j
T<soF9S
%CU 0k>
EuhTvri
:Z%P,0w
'b5>6}
:Dx7j<
jLJ~r@;
qD`'p
R%?M'Xy
7Z0c-=/&
-.n9C<g
bT'3{&XiR
7AA{./'G
Ezup-_
wgZb@R
aZdY59
xG<DP
qnj/IF
tx_P?i
e2hlax
3E/Se>
dG][Xm
nEh,aJ<#_(
gTE?"Sz
g`AoS2>
B%a0 |l
U5Cp9~W
X-<ow
x9[pbj
pV_Y`2
=0\?mD
Z/V&e2
iuh*jrz
.jBnh`
uY%&=V0n
!^ci*3
K"f8r
*nc<EW
BO]o`[7
HC@vP#
FxQ=\@
!I*oH2
TRnd<*
r){~y;M
=toWp(y
(~xyI
f|64W{
j3c%,to>
'uZK4}}
~M}bv&/
=tp?xK
v(<=~z+/
*}|/t
gM~=ZP>
\7YK}e
'5lVt<u
9s0H*:C
#n);f4
s(X2vi
NUWFu(`h
DjyL{8
+qI)=P
g9;0-d,T<
[$u=nsG
2_|G]=Q(:R
lnmj[=
Nu+A9r\
`+Ifue8|G6a
hp0.RT
WZN'BF
4EFV]C@6
q60L(o
>~ZXd
oB8{nif
(q;bH&h
a%0:=H
R,>uc#
{ztb];
7{)BD
D .5Upz
@1zNwl
_PGa1Z
d=6S>ze
q#'.a+P8
v5Okn 7
?<TM}]
2Nh(Mq
wib|Tg50CI
Hp4U@
l2T"&y
r2fFK
s'-Pa7
T.`az5|:
Z@XuWz
.w %\j
={`6% .g
_D@(\~!H
m*qo'u
rw\I;-+.\M
Ja<7U\:
"gl=sy
?1c@Dr
| vyEO
$x.|~,
?>/K70Ux#8
O-)`oV
xHd0!@(
rz1`?
HW8 @i
8zP'`#
q>$98`b
R!JEID
TS<=y`bO
9068P@8~=o9u
+8 (;O
C|Xanp
E0lr&"=M
{Ew0fr
K:@3gW
>^(:SQ
p/aT;!
*P/~`G
9R{$|"e
AiLr.<
_Q^OF[
2" aRIX
>i(,X<
D|=;NR]Jlf6
/Y, ~F
<gU"9w
bT<>8=
>yYUdb
ngaa{$q`
eXuB9
#kYh~O;W
>oL3kt
"}+/`'
&qczW
a0{4~g
r6c49z
Uy}-n(
f>HX>#T
wS?'YE
r=%2s
)=v>Wy
bBcv~x_=^|
x\N|tR4p
~<!'>.K
g&_Qd~A}
a:;LrLn;"
g-[@(w
pX:yVqL
">po Q9
k|3y?fb^81
I;>=n
=t9.0;|
&r=(lCK
/wDujyhq
oBU!9O
0f;G<$
kTM<zGg
.d@m+
G>)inX7
'wU-nl
%9F=LF
AbIv}
7a@/gP
H6s18 ]<
JZ!e5iW
!<!V69
~!*6mXGZ!
=h?SIX82yB3XB
IjFZO4r
$X?M6B18$VWJ
>5#,{N
H:yZ)i^
XhsF<2TXBl7M,$X{
.H'y4(hB7
4J<*5{B
&Lq(2S
}j\1=5
xT8qzr
&H^<76Hi
?J9Y6Zn#
X.JG]xGQk
\if#<O?X*M <k7f\1k
<!l\<h
(3 EGV
|4D*<%
?2d4dp
y-JqAO +0_+
!I(%5}p4b 3
J8}hklJzP;
whtR(1IsRM_hG31$2SVG
|SRKKhk6l%i
q;H$hB@
1SHIQSt-
h[8gtP'/O
>;"3hgqh
tYU'Q"
8z7,R0
8N-4%k
8W$fK-wF
i1g/g)'b}C
y8|eAz+O[2lr{P
>Gwpx6
(y kQ@Y
aqj{rT
S$3%1&|
U#,X8iP
|f s1q
@r@jAeH
"B 1H(
!FpcqXs
%G[1%`$
"r+S#Z0*^da+
S'&04t
0 &v?y?`<nQl=`9
A63[4]85m
XY/P.Z0
R.BIz@?DE,
V21TSav^
|A}>qogH
`_fhsnHK
w~ytM1Ubr
S)xH0P
rE.(8I1
ZSHhp:
q(rYb_]1F0E
Cn5l68f>
sp-1rpAo@
A@SP{8z&
l/"n@o
.jY'It
@"K"$A.:Bb@#%
0(:= ?9
^f2FASM"AOwL
@I3')+*
,6J!54 C
PQTVCSklZ
ceWda/
_<bmt^
}zy| x~
sqpon_
sP?Qp2a
f@gpD e
1046pcI
a!,v=K:JM
~pA}UDP*
KMNXOL
O(@>8=7A
8;$O'
6530./21
+*-,4#P
:wZwYNE
k~<$@u4
{`p:^[
p]@"ke(:m
Cl^xAX@Ah
U("0|cXPt
y1j@nr
(kq8X>^(
oQy{p^
d*PCd|
/X(z=
~dt\GlE2
$@f@k@m
n:F|),"
Ai*U|
jX*Ud.j1
_#z0,rE(+@
qD)G@R
,atF'P@
M!0@}J|%T:Jo
%T>J|c>@x%
*l/|XX*`Uc
9* @%
P8ADINGX
8%c3 g
eTX\B`
E[%!I,_
+"}&e.
A*0>HY
ZpT;wH
ppX3!,Qf5
@#C0*,8U
yO<S]dA7
2?[$xRt^g
s0x1|7
CJdVA0,>2
X")6 A
H7(j%#
HXf _e
M. *2.dKP3I
$$4<EGJ
"hN-%#"_q
p&N3&$Y/H
4*d #P)
54j[`f
V)`62-fxP
O$p=BE)J
#3#a&@A1
z-H82JI
xE07JD9
0&|R1h"I
"H0:phl5E
jZD'$KL
lfDZb<
/0sd\0FfJH\y
NI:,)>
9o#t.pm $Tq4
hd^14T
jx08]h
~9p"2|0
%V,\f;e[e.2@bp(l29,
0M(F E
^<Hp"K
N'Flm1
nH & b2
\tCX,H
|@r$zE0v
H0?4<n
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
USER32.dll
TranslateMessage
GDI32.dll
DeleteObject
ADVAPI32.dll
OpenProcessToken
WS2_32.dll
m-s|yPd
+SWVUB
oaderSt
93yI"L
T/j@HhnQ
]^_[UA4
Origna;l mvezbus|:?%X}NVw
loctin(8AdrT!|
Z#eBbZ
c*D<tJ
WUE$un
!CEro
yp(c2"8.$^
dex1chksumf
QV`tMH^
U,Ld>t
A`=\C&
t(5;0XEz(
PJZQB[@
Z`;2=i2
}NnH+6B^
]i91\GP
!{PWQS3
smsvbY
A6kNmIT"PE@B<
`4Q3j^
%\),RC [P
Ap%li4-e.2
} u.The<cdc
%sy5|lntbv76idSDL:G
3*V/lFuPs3p2^M
BoxpA{w
k8s`l?ExitRPnL
ChHand
|Vi?rt
qL04(V
2DbgMs,
/21X;d
#V" \~(#F
`t$$|$(3
r+|$(|$
JUSQWVR;
ZPR3C
Z^_Y[]
IDR_BINARY

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.