1.4
低危

093d7217590cf2319fd7c9db6d361cff49d3da632c2eae04dbcbefccebaba5cf

093d7217590cf2319fd7c9db6d361cff49d3da632c2eae04dbcbefccebaba5cf.exe

分析耗时

16s

最近分析

382天前

文件大小

172.2KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DROPPER LUNAM
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.70
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Malware-gen 20191016 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191016 2013.8.14.323
McAfee GenericRXIE-NA!B1CFE2F6B868 20191016 6.0.6.653
Tencent Trojan.Win32.FakeFolder.pb 20191016 1.0.0.1
静态指标
一个或多个进程崩溃 (1 个事件)
Time & API Arguments Status Return Repeated
1727545318.35925
__exception__
exception.address: 0x401e76
exception.instruction: mov dword ptr [eax], ecx
exception.instruction_r: 89 08 50 45 43 6f 6d 70 61 63 74 32 00 11 77 bc
exception.symbol: 093d7217590cf2319fd7c9db6d361cff49d3da632c2eae04dbcbefccebaba5cf+0x1e76
exception.exception_code: 0xc0000005
registers.eax: 0
registers.ecx: 0
registers.edx: 4202080
registers.ebx: 2130567168
registers.esp: 1638276
registers.ebp: 1638292
registers.esi: 0
registers.edi: 0
stacktrace:
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5

success 0 0
行为判定
动态指标
分配可读-可写-可执行内存(通常用于自解压) (1 个事件)
Time & API Arguments Status Return Repeated
1727545318.35925
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x004b0000
region_size: 16384
allocation_type: 4096 (MEM_COMMIT)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1856
success 0 0
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (3 个事件)
section {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00022000', 'size_of_data': '0x00005c00', 'entropy': 7.9720032517446535} entropy 7.9720032517446535 description 发现高熵的节
section {'name': '.rsrc', 'virtual_address': '0x00023000', 'virtual_size': '0x00002000', 'size_of_data': '0x00002000', 'entropy': 7.6431626111010775} entropy 7.6431626111010775 description 发现高熵的节
entropy 1.0 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意 (50 out of 57 个事件)
ALYac Dropped:Trojan.Script.418723
APEX Malicious
AVG Win32:Malware-gen
Acronis suspicious
Ad-Aware Dropped:Trojan.Script.418723
AhnLab-V3 Trojan/Win32.Lunam.R261674
Antiy-AVL Trojan/Win32.Lunam
Arcabit Trojan.Script.D663A3
Avast Win32:Malware-gen
Avira TR/Crypt.XPACK.Gen
BitDefender Dropped:Trojan.Script.418723
CAT-QuickHeal Trojan.Lunam
CMC Trojan.Win32.Lunam!O
ClamAV Win.Malware.Lunam-6905845-0
Comodo TrojWare.Win32.Spy.Agent.1396070@1qn3u3
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.6b8682
Cylance Unsafe
Cyren W32/Trojan.NEIG-3448
DrWeb Trojan.PWS.Banker1.30100
ESET-NOD32 Win32/Otfrem.A
Emsisoft Dropped:Trojan.Script.418723 (B)
Endgame malicious (high confidence)
F-Prot W32/Trojan3.ANVL
F-Secure Trojan.TR/Crypt.XPACK.Gen
FireEye Generic.mg.b1cfe2f6b8682726
Fortinet W32/Agent.4FE0!tr
GData Dropped:Trojan.Script.418723
Ikarus Trojan.Crypt
Invincea heuristic
Jiangmin Trojan/PSW.Lmir.dah
K7AntiVirus Trojan ( 0054dc901 )
K7GW Trojan ( 0054dc901 )
Kaspersky Trojan.Win32.Lunam.a
MAX malware (ai score=89)
Malwarebytes Spyware.PasswordStealer
McAfee GenericRXIE-NA!B1CFE2F6B868
McAfee-GW-Edition BehavesLike.Win32.MoonLight.cc
MicroWorld-eScan Dropped:Trojan.Script.418723
Microsoft Trojan:Win32/Lunam.A
NANO-Antivirus Trojan.Win32.Lunam.foufld
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM17.0.9647.Malware.Gen
Rising Trojan.Lunam!1.B819 (CLASSIC)
SentinelOne DFI - Malicious PE
Sophos Mal/SillyFDC-K
Symantec W32.SillyFDC.BCR
Tencent Trojan.Win32.FakeFolder.pb
Trapmine malicious.high.ml.score
TrendMicro PE_LUNAM.A-O
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2008-11-16 11:29:47

PE Imphash

09d0478591d4f788cb3e5ea416c25237

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00022000 0x00005c00 7.9720032517446535
.rsrc 0x00023000 0x00002000 0x00002000 7.6431626111010775

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_ICON 0x00022308 0x00000468 LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_GROUP_ICON 0x00022770 0x0000005a LANG_NEUTRAL SUBLANG_NEUTRAL None
RT_VERSION 0x000227d0 0x00000264 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library kernel32.dll:
0x4231e0 LoadLibraryA
0x4231e4 GetProcAddress
0x4231e8 VirtualAlloc
0x4231ec VirtualFree

L!This program cannot be run in DOS mode.
PEC2^O
mbTpEN
:EWB(CO!
P\_!"%
hDB;e@~o
u|KrA/
b^UbUA
#Dzsb2dp&d
I81,xN6`
@Kk\;>d_y
%WzztE+`i[gV[bf1=9
D;kbr7?WY|
Z(PQ.KWUd
IWa+VW
t_%f]l.k+
b7/+Kv=Qg
E\!yP^U,agOPB`
ie}>u!
{xzGG3v0c\>AtUVY
q|^pXK
#il;C2
ktbQo!TZ
.,.Mh!Y!h'.*
q'e1_?m("
Xd'Ziay
n-C/T
0#ZWT|@KJ
eDtlk1
Vh0y&]!
?j|829J
xT+8v(
$J}ji0
fU^ma2yUf
pnxv=k
CK?K~9f\(%{
H<nO0.g
(b$a,kz"`Hn#[<ms&Q%
A^1.Q>-b
5#IK3&X!%V\q
ixz"SYOY
J^MfzNun
Ik^-tHS*
[9h?vnqd
J7Vng0
J#H#{]`$RXBPJ
N$Le=F
=8wv-3
s#*Za&DZ9
v?L$4P
v|jhXQ]N'
mGd/VD)=1B
3|P)ST
atgZCU+g
+d0J1I
18pO^l>p3
m'@e'05
LgThHL
D#f{O(J`d"rF
J7urt`Rj
3$+cC9W
yywWm;
Jjex|s
X!#uoK12#
"s@K\}C
?R{,hUUu ikHc
PECompact2
\ugWPw
H%caAp
6m8Nme!6
VR^]RIK5
vdQ_w\|H
y9e!w)n
]oRln uJ
=%8T"mXgbslcoF
$E,+hu
s@B?hqa`
#^|G(!8
x`T"@h
Ozi FzR7
zL)cOx
ba&tqa
J`/O`0
.E]=NQjKnw
1.19_p
vS}pT<*bgN_
WGc.5mIr@`^
/M8@tCL=ge
H:aP%w9iWPs0.,q
2\.vghK>-(au
"hA=1M-
r9W;>-
gigov
0~P<!Az$
#]_E{3o
4{h.6DsN!
+QRKK?t
^**5!<Vg
NZ_Rt
s0BRK3.[q#I
gKO3lToa
wW-E&@&A^t&
HEC+X[:
?EXN\GO(?
%OIpMEG
e+.;:?
Y;zVpN
Z'K20Vxq
?%Mh2^G
lXV!QOA,ex
pS@hv;
i'h8Q]g
tM;k/&i
bKz5Bg3
c14=pxh
Y,9}'r=[39dUM{RZ_
QN.KEnB[r
.nyULT6
xl$T&0C6
q]}N:)
Ag7F%TQf|U`
#h7HlV/M
PG3ilpeGA~oLIC,
}r/h{bG~
MCPTl+mj
oD u{VuLR.%
9iXS7b
^#w0N8
QqKrx[1T|>*
+NW{(h
I~+aXHt
uTpNMC
XC6mD.g
a`v\.$J,s[
u<-@pc}]
phusCJH]
o!w-BTy&
i*V&S9
Jtt]{JQ
E*wmc3e(jbtgh(
v-9q[3$uZU
HdOM1x&
8WiNW@
e87@46]
}D~+eLuOf
nAr8ei#v
~K(rAN
(rU)E'
TU?Ho9oJ
b'c4;|
p~>\\c@WCG{
t[1It/Tl"x
mNP_nw_WUZ
Q;G9%2|v13
;Li[@cc+
bYV/LT
DU=m?M!]
+@@L4~Ru4
ycr1FJP
/d._]aUIU>2|
/wQ)bAvRw;
*cV!^vgFcu*o
8.t__g
_P}`\nJ
))_c,dQ
'/ZMtQ
krgkLpf
'WC,oj /9
0psHW
'"[<VGs`
,G^`h,x
Gyp.`[
Ilv6Lgqm`x~Z
}oo\sRapWTz
'uwTH"
X8`,fw-
Zj{I# AJ
3G>51D8GvkR
<1V\%H
b.l} 2#,cczg%V
Y_eza^.\/CVj8tg
UsKjSS
nB^ur8E k
.QTcR
w!T4)9tZBlc<,
x,aajYE
[*V^|B)u?
XycA )%
4R5w1g
%!'Y'(
:pBjSqP
PJ2%b6
t6w6Gux
38pq" E
hJVulHWsL<-l_
ht=+?l}3@rrP
}3;+9
HtU*pM<(
Z\YLGA
t9*YKw
yGMa.%
%J=i:
O"os7?
1xtD/g
j:<^$V%e
mh>iFMk/[o
{CQ0*1w9
4Wr7%x{
<)~@mWV
`Z_IDJAtY<i-i
6t<rzt5<`[5L
E;7]A7JKd|JI
li3@kg
WeN)bJ
>3gJF%Lj
B^L<J#%G*6=lf
Tn#qn)r.0
wX8OZm?
CWsi0>
2NbXy4Ro71!6E
'QXqE6
Tmd7 E!
3q4.p=[);"r
H,u"[
ZPv,@J5!-
?zw!.RrM+<
wQkMS&P'P1
YR|7^RVM0iqC
\bw>_|{
WwbfwBL_m
~(N'5&/q{'9
\~c!{MFz|@m!Qk>C&
L83C^(%=
rN4RE^5wH]
z:wy@NaW:c5Si2h
<9Aj?Q)d77(+
^qyc;03Zet
$nggb
9i'eZU$!w
M!@/ce8
zr:S;2__Qx9p=`
a"DJe&dS3$)*
f%o9q\
hm1\GY
WO4O0k
)f/q0fP=
e7NhV7xU
+5C9&I
@sEuQr
+w5kV%5
0dV+ghQl0^/
>fBX&D
C.V7zyic,
8/5$DJ~A{D=:D
gb@U+-
TC2F-a=GP
v%ezB&j1Li
!-Ci~0
)ttg=y|
_ATRPx2
y&Fyuv~^r
bk'+$#*7^'Lz
!rZaz&
^Hmyqk
Ipx&(
4Pxt.$
FHg^BL8YoR
l)"]%l#
/x*_UL'2
NLy`dsf2GK*a,
|i_w<Y[
_H#|Dc
s2xy{`
w"g]P<
0;mfh})b
7CUq]CMC
jV9z)]Jl?
C@EP7$1
f@U2|*lc
Gm18xu
]yJT_}
{pY."h=U
`ZHL~`
1w.7BgpY
Zdp/Rn>
>?i/Ow
apHgV1+PrLd
!i6d@G[
#>BOIr1:%
r>r+HE
wsIAwh<e
/Gn6g1.gUij4H^m2
nITgLTmnvt:9
Y0Kb.Pp/8XiQF>+lp
O0jw%#-
Kl$;.jB%
9`R#IA,n
Texk`%
P#qd\lKB
<*sfk;k
.v^Z[$
qz{W(g8i!D7;uM
tVxNg\
Cb(3>
HVpag]Sn?lQ
YEB~0sqq[
:t_]BJ
skX#r[yzum&wL
p5v{9Fo
Yc>#~^q9?
bkGV-}:
r#hKgb\;
<|Kr9%|
m:Cs^W?+6g{EA23!
aEP0oh3QzLY
H/0\.]
6R]qW>EK
#0 1XiY
@?j&Y($/
0i2nyK\bF
L@8|V,
f.%tS-
iLOls;:
+A'QZ`
wxG]Aa
3yXOq6q;?91q
AVrLMq[+zMOy#w`
vSA'?T
\IT`mN[Q
~,b#*2r
|syW)wH8
A(dXS|
bsl(&o
PmeCv7KjZ:`\}OX
XmO+4V3UNXko,z0dU*D
IU+NdafDum
S"y"Zh
w{5pLy
&/LbxVnE{b4
]<l)$E
(j.LF1
'r;W8}
~T$ivBr
:2&<*&Qe,wj7
;@p"Wy)
d?[xn-#|7m0
kd#a`/
ngN`\DO
h2PswM
/}'_$T
O3|yRG
6%6EDSD
f8'F~=8J6=
GvE2Hl+*@A3O'
80sNSor
vda{& f
cjk_T}+j
q#Kc#i^?,
N#>f\xZ-b
rI2"T?m.FS
~![V&8
tvVEUa7d
{M}Ueg
Pv\o(a8E/,3Ky
9ulAnG)n}
s4jCT?!1|
[KLm1&QOkOq
fU8D8*
!1o?|j7*+`5
0=_l,G_L
^dmI^yp`lP%#%
1puvv\
G-QJD@
FAt_;$<o
`dyv'8
S+#NXV
z~E<z/
!1Na>Jq}
~z\qyE
FE8UZ1&&
@+7cs`
E?x]='
ZaOrF~
gYUFwbZlr
q[%FQx
eIS}<[g!
(2,u73
7oFNLqd
g5UVuZ~
:Ig{8m
QD(QI%C'P
-BT=Cg~\
Eh(qB
%&;FX%
2dE~4^9
{BQd!,r
uVKc1hg
~R0h[b
+Roj?k3eZ
fU,;j}k~
Qx0d.'
3qwIDblZ%
Nm-Z w
p,tUVv
d2:@nPmD036[l
:12DT*p,Wdyv$e
Jsieoc_
c\Ru~=
=!W+BP
+}eDR.Ml:'X
F={P4{a
:D\r8yA
70L92AoU
$\{gI{
_>/~07
Cu"$i{xE~9P@km7"
chcYp+/'
VvS]D!@.8o5V4+
nU#6~
uHO>M?C
8N9t=,7
>zLC9[uO
92V'>h1BuZ/%j
bS. *KDg)t0
O7B[(N
U(l'?XsS\/u$Ii
J__B@y
+TWH,2
kernel32.dll
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
m2_ KW7n
OQ?*CT!
8!5@|K
9w}iX=~L<,
Hq]C<.+
?C&i"p
;==$?K@]
v!pc}nw"J
d"qPw,
{ia0dVD
>z%voql
3hKt2?}
8 JQY'
-Y,'/>owL
!DV,8Jb
F3_Jg6
y$O=Vb
2qia_?upw
T\>FND
ModulqHan8
Virtopc>ken*32+
ZPY[z]8@
+>(/P"
H+SlM8!
{BtpyL(+
P/(#vjE#hM!"xV4
!J*YO*AW$^@f;M
D$4HSUVPg
6A|$ l
\8T<>#
v0`Zf#
9hD-*
9$$ ?|
;0xUeN
:@97oJ
+Pz%}T`oe<~Wq
405=QtL
vB*(3H%Iw]
Dd"B7\
(1XdS!a
N~0SvJQ
~}U?_(
90sk$M
sFpRph
cN,4+KQ07!'
A,R?B-
%# |"!
uD3Z~X0
fdb;u}
'nPPCN1tMs
!Z`;h2=2
dT)}&nAH+6J^|
@tKwFQ
B_^/b2
XY^WVi
PO:M9W
,QAj@Rw3:
]F:9Fu
g!{PWQSL}@
i7Xt|H,!
A|Q@,:Zha]oM9%
Nr'`Q6
vq"d4n
9l@L04+
pUWmsvb
{ u.Th}e<cdc
%sy5|lntba6id|SDqLG5d,al
uj'XGvMagB
wP=tfNfExitPL
}~ActNCO;b2!
n$zH[QY9
<$J0dkX2
`t$$|$(3
r+|$(|$
USQWVRW
ZPR3C
Z^_Y[]
3/12/2019 3/12/2019
\Photoshop 3.0
Print Info
Resolution
FX Global Lighting Angle
FX Global Altitude
Print Flags
Copyright Flag
Japanese Print Flags
Color Halftone Settings
Color Transfer Settings
Guides
URL overrides
Slices
ICC Untagged Flag
Layer ID Generator Base
New Windows Thumbnail
Rb34rC
UeuF'Vfv7GWgw
B#R3$brCS
dEU6teuFVfv'7GWgw
TI%)$IJI$RI$
u<GKXg
5hI>A<
^ :$b^
en47vw^sZ
Ac#Y~Ji
@+SVVw6\
$/IO&;_*_*
Version compatibility info
JPEG Quality
!Adobe
M'{Y.fn)m)(4M|^|!R;
sc=-O-0@j
V*R1d]wl~=)}c
JS&8vAOZb8Y
FihMon
ARkv!j)
f@SW!iG
Vw$=6Kc%{
4{}O.u4p
.W#\+ a>q(vT8
W<ocxh{
AGpLs-
%)O2;]^7T
[*M@*U<N6[
!4$-7sD
w-j0Pxig3^x
`@PPwSq
!T<Y7n-rH
%z"oLd
`UkM;<HT$/qi
XKuT:;
7`|1:Hf
90NK[$z`hUfE
;0M|qm
43xq\_oz]JD
BHer_|n,
H;}N$,pc
=Rd[K%HR>06rs
!<&?|2]
5[I7JBl
r6\:#>
q2"s6u+
JIFe-G
Mb9+oCCZQ
#.53Xh|v;u+
tMt^%~T[)i^kZt
eCj^}W<{
Uw)?VXdJ
O{aHFO
m}$K-~
#=#=g5
W]RJ3j7[
#6vIfuy*
k>MefM
cE'n):
Z@X*c_$Q
N~1<hS9"`
W^z|==s|x
@&hX,l
<F<<"4T
c1!71t{c
3/16/2019 3/16/2019 3/16/2019 13/16/2019 13/21/2019 PNG
*PLTE!u!u!u!u!u!u!u!u!u!u!u!u!u:2#
"3DUfwL!g
tEXtCreation Time
11/13/14EL
tEXtSoftware
Adobe Fireworks CS6
c``po3`
o:00MJ66
3/28/2019 3/28/2019 BM6$
Q1T7W<Y?Y?Y?X=U:S5P/K'G
J$T6]F`K>
Z@m^iYhXgUdSbO_J\EY@U9R2N+I$D
Q1[B`KdRjZU9[(
lTs_p\o[mZiWfTaN]GZ@V:Q2M*H#A
W=\D_JdRiWp^D
`i6G!}fxbw`t_q\mYiVcQ^HZAV:Q1M)F
V;[C_JeSkXq]pXB
eDn~e|dxau_p[jXcR^IZAU8Q0H 1
[B_JeSlYr]zfbBV"w=
_oig{dv`q\kXcR^HY?U8E
E..V;;dEElKKmLL_DGw<*A
]GcQkXr\wakO'vAq=G
spkh}dw`p\hWaO\DW;=
`=((mMM||
_JgVo[u`}eiF
d:zplh{du_nZfT`MP/0
(C--bb
`KlZs]zcjgB
xPzpkgybq\kZ`K>
S+O/r_v`~fnaA
azoj|dvanZF
kT{fgp}ZF
nuljycP*-
nQov{VJ
mvy\L!/
V+a}XE
qv[oF+j
ik>nd_<
wwyyyyyyvu{|12{
mmnnnnnnnnqliMl
yyeebbddddddedee%*n
v}cg[[UUTTUUXTL`
goVXLLGBZ5\
X[ ]!`!a!c"d"d!c!a!` ][Z
#&(($#4_
ouWY=/d
?"b!c"f#h$j$l%l%l$k$j#i"f!c!b
""!"""
@%-/13552-3Ii
M$j$k%n&q's't(u(u't's&q%n$k$k
)(''''$$$!!!
~7169<=>???=83>'Dw
Z'q's(w)z*}*~+
*~*})z(w's(u
00/---***&&&###
q8;@CFGHIIIHGCA!Ez
d*y*}+,-....-,+*}*}
888222///+++(((
f?EILNPRSSRQOLK#J|
i,,.//0000//.-)z
#*(%===777444000---
`ENRUWZ[\\\ZXUS2Uy
j//01345665323
>>=@@@<<<888444333
\OV[^bcefffdb_[Nfr
c2147:<;83/,+
5'$ KKKDDDAAA===999666
ZY_dgjmopponkicxp
X46:<<3(q!a
ONNNNNIIIEEEAAA>>>111
~]aglpsvxyyywuqoX
^(u&m#b
LLLWWWRRRNNNIIIEEECCC
wbiouy}
?=7ZZXffeiiibbbWWWOOOMMMMMMKKK888
('VURyyyhhh[[[SSSQQQRRRKKK
ttrspy
==>IHGPPNWWUbbarrriiiccc^^^[[[WWW!!!
KKK```sss}}}yyyqqqhhhccc___---
TTTlllyyy~~~yyysss^^^$$$
<<<]]]lllxxxwwwIII
333PPPdddsssxxxgggGGG
4/1/2019 4/1/2019 4/1/2019 14/1/2019 1
.
MS Sans Serif1
MS Sans Serif1
MS Sans Serif1
MS Sans Serif1
MS Sans Serif
Page &P
General
#,##0.00
#,##0_);\(#,##0\)
#,##0_);[Red]\(#,##0\)
#,##0.00_);\(#,##0.00\)
#,##0.00_);[Red]\(#,##0.00\)
"$"#,##0_);\("$"#,##0\)
"$"#,##0_);[Red]\("$"#,##0\)
"$"#,##0.00_);\("$"#,##0.00\)
""$"#,##0.00_);[Red]\("$"#,##0.00\)
0.00E+00
#\ ?/?
#\ ??/??
m/d/yy
d\-mmm\-yy
d\-mmm
mmm\-yy
h:mm\ AM/PM
h:mm:ss\ AM/PM
h:mm:ss
m/d/yy\ h:mm
4/6/2019 1PNG
tEXtSoftware
Adobe Fireworks CS6
tEXtCreation Time
1/8/15
l<]K9zcN
4/7/2019 14/7/2019 14/8/2019 14/8/2019 1
Photoshop 3.0
Print Info
Resolution
FX Global Lighting Angle
FX Global Altitude
Print Flags
Copyright Flag
Japanese Print Flags
Color Halftone Settings
Color Transfer Settings
Guides
URL overrides
Slices
ICC Untagged Flag
Layer ID Generator Base
New Windows Thumbnail
Rb34rC
UeuF'Vfv7GWgw
B#R3$brCS
dEU6teuFVfv'7GWgw
\WW}@6?9
?e{wkow
rKKs]]
VvC,$}
sNn]OJh
8%./I1H8qu
pSL".7RI$TI%)q_
\}*?eN_cta
b[A6-, luX]K
8v&+NM
KGe_ZnY
gl{lWeUzO`
J7~g~
._1V${\O`
+gu7_"t+
x\|_,8gW
hO N *#g
wByuOkuio
]zuocs(gk;;
<r%M~C<:kI$MUcC
Z(Z?ZX
@m{Lm{
gZru'y
sUc~{NJhb!y
#u\'\7ZZt;L|
A![M6=F{+
xR}<Mc
@"ZqK?%9['D:6
p5uus<yXC
uVu\YyM^<ON?Ie_N2
{MbeF
kvqNxq%
p}NPmc[=
lw:wK2
6{m%2}6
?=n5=:mlimk
R3]^vU
f^g&Ad":
VG|lg~
1{~Su6%Ocu3?g
7`zn;B
|Z"[vK+k^K
n]w?\M
{.s"9w7kSF#nKhZ5
@f& x*
TI% ef
NNwnsZ!.i
U{^ ?z1
S$'qiK}LC
TI%)$IJQ
BdI:I)I$JRI$
Version compatibility info
JPEG Quality
!Adobe
r$bc4%
AQaq"2
BRb#@rP
XM59o}<
;*y^vO
b|/ny2e5?}Y^3
^{}3z9a{;T
K`;,Mm
yMAfX7bzy7(~Tu
]o2_"^A)E
k75p$1?
8Rl+=Li\W
c"f{-w
KHI.fi:z
`}ri4Ds!
Wsucg:OW
j(6i;YsN
Hld1+9|.mh
qn0YElq
SaTD8AknXc2v
r=X3L6*zjF6
ca?1xFk[I0
)r[~/x
*WhHMXzUWs]
D%rB!?6e%`v3(SF
(]PqS~8h
BRPA2*')##
R1DAu*K\
,;}$r*q87QB05T]w
:<T#!A
2&1I<v
DI;ZrG1F
uR}J:z
wO@e1N_c$,sWG]u9Z
WUU'gR
9v2c:Ss;.ECi#d6A
.G ?pX)
\Zmb^QnG;
u2=eq`;?n+#1k9
{y75&{A
Qc-^yu/
~)`U7w]tFyS5
XD@8TH
LopB0(CB
{6bx7Z=
KCSp$.bNh
OYHQ]q~k5Gs.ak0H_?\
Rd`G l
:p-C(eC
(])alMS_G3xu
luKzQA
54HtCZ'"v
1=5McVY)F
>&=ar7LPMCI
s)Q=.|~
N?VP3K5vKsIV
V'QHD_h
LsII6Si;;sJc}
;NQMSa9Y5w
&IcF[|
p<W?e3)d
/T7}kw
4M,&\<6r*YZ
LX%|;)%n<F9=xDNW[]
[M?MC*"}AR
m$k~~m
}ia}5.+
K%Y~Os4
LxLofgq[:/
cFg7{`K
AdvfUVXfu7NX
rg9XY7K.}+
TRa.F6
'MA-zv
NkhwNKr
:d>;%{*kTedE!h
#C|,3O+X,i,
lqnyls3Z
G7ktDD%k
r >KKnem
RdEK^T
AJ1xh8
;8v?W;gK\nI&H&
Osov};HN
!nQTv*/
xb}^xu\
I}}%;Cmyp,-
7Iw{oPL%Wx\ph
A$b>o|
c[w=w5[s!y$-aU4\44
}aj3e#
}+=i h
o~9-2d2 #;O
CAJ+~~N7
#g<|DzA
2D}]}b/
ZNn[ui{1W
pQC30O
:D/=UC*
+UF4+V1
[@i]Tf
M/ElWp[
{ynY6E
v.r=%@B
2e[|u}rH
|^JB3Jk
}&\5XQxfx
H<;NF
GMDq[K
tTcXR4
)_P,&V
%LP7mA
]heWefy
wwW*`#MI'8yH
eF~;pu)Q
JeZKAw`3
'$ZjREi7
LKZGZ
re%H"b37|C#
GF=S*]
R1QW/PsSNcR7
8 )SC,q
+ "4Q '*T
7o-jDT,0
gVf@o;+UV%
+:~-[nG,LfiPjjJT
$R Eq[
`lw%a#A\@x,f,O
A7oqJL{y/o($2I
$b[i&6l
"{Yys,
qwB.9#ZzC7TdNM\10QrAZKc+$*8h>
EXRPYx
n[14hPxe)f
_=O '9c
LZaITF
#DpU~/gf"
X|Mlr<4
<|AB7NZ
/xnz(XrIA
q8Yo%Hn
#UG"S1_]
Uy(|82HPFD{p,-V 1Pf4,
Wf:N&Z
:GOjvC
}K{ji8n
MW*p._dkK4
L%#h3A
FNtDgH
Q_F:'}3A5
#qHi3!
b&0`2u)
Q}nXl]*(
I'2MI$I$5cOV
=<^0=xHa9
.wJ MJ#
#^K{k(n
[q)y@nVX
5#jc\d1
~=+Lx*8
v;G67m-sqd"ikV_
.C54Wi4=${d]
Od[J4Y
@Z6u2I
%SFCdO^9(WU.fUvk;9mw#&-
ELcZ~v
{Uwk{+m~
_4rY9<n_9~aj
r$i'Ugr%y
)3D!0W
3TZUTw/c^
"G}"Ry
&U6_[241
YX;7nZwtn
=_1%JO\.
f<n6~CR
wg3c7.
~Uz7/d;
<m<C%dvt\kw
dy+&Y39
ex$hf%hdXP
6m\tbAC
*1/!<m\r{K
3h?p#}W
Rh~d=pduE
wf([m#$
yK=U*
}#$>6q
"!E4XZZR:(*
x/T1C}
]cuN\]
Fd2w{W
zrUkD,E
uCZ^Y*gX#
y{i;0\
(qw,8Lcl{b=~
n(W6[Dx@NW
PqO$@4m9G3J
K#JRWH$!]
YfOP:$:
,BDf,=N[U
PThOC\
HUtuahF
B)DEVs.,UI
wlKCB{Kl
;/\2H}Jo
1NGSpm
J)7.\V-Fx
>=xRz!b /
PL2Oyw
D4 ]1xK
c]EVk[k
_j&\u8
9[Wr5~)
L1/+ *Bj@$\
hq!tC*N
FTrop1
,r9q<J:uY%j
Q `G[#d
tLYM}dw19HPVH5
>^GC^|Ouv
mWU9jt4eC
%{}r*+U]T
I7~1]3v&Vb{ae/z.#Lt`
bJ.1?J8HWUy#P}
>0mVV,,^XXc
u4v`e
,~k-xd6[)3{
NdhVJ06/Y#^C
?3JKqvw
]$wC#j
vdR<I4RF;E
>wrcQ@
8XGe4CB*@
C<pD}89
c(cv`-
v=R#|j
35nB"o1
{Muy&G
de3XZY[)p
6bk{cd1
jd{,r+;#jm@
rbY}vIp{
e}H&KRu
UM,,~W[
b9kJ:u)B
cv[{#k
JH:!j@
.;^Uoa{P
4kvgf;Sv[
m`on38r
&ZgjMj
:*p1Z31[^vX`
'OmH^*BV,
u(S)<XQJ
+0[U\eWQ*
02WNhxVj>
%8dW-&ts
eElZ)U5hn
1,mvB'
+H {J]ed
M,Q76R4
fH_/J:E2C
9yU(<hc2?
TWCtay0#
n|4U$
~m{7^V
3t's62^
oO VHcnVSA
aS]%R4`
[]:i<u{j
muo!O 5;XVTXT&p
I>X;W]T
5ZLuD%-i
t+'_W
RA>G",tu
OJ4r&X$^b5
e< 8="u4]
uE~<x<
>>4/12/2019 4/13/2019 14/13/2019 1BM8
N=q!a-e$r=cd2OEZLDs
a)=]/P
ZO6v3W
z1p&qCW0!$
D@t5GX"TU,Q
w)SKU+
NX7v0-)
Z.E+!.
V!M(M7IX@j,
i"M-.@"T
%+0F,u
n ;6'R'tr!8m(D
4/18/2019 4/18/2019 1
Photoshop 3.0
Resolution
FX Global Lighting Angle
FX Global Altitude
Print Flags
Copyright Flag
Japanese Print Flags
Color Halftone Settings
Color Transfer Settings
Guides
URL overrides
Slices
ICC Untagged Flag
Layer ID Generator Base
New Windows Thumbnail
Rb34rC
UeuF'Vfv7GWgw
B#R3$brCS
dEU6teuFVfv'7GWgw
g)zV~
/JwR}%$
uA[~0~+
lsZ;\[(/~J=3?
?{vK[vW9[
J++*'\\Fu=&
,cR%Q:V>N
tkwULV
&a"$v*y7Q
UY/k-I8
IKT98:)
qW/$b?
}T,{nC
V~n.gl)
Xg3&=9$
$EV9r~
*rSuOVU\[
f7'y`9,z
?DC!uwIC
SFBAo33Fmg-O(u\:Y
rR?GZs`\<!#]|
E{ieM5$f
S_"K5C
m8+m}0B^~
9"W5~F
RG=J:[S
W]__W-X;Y[v@$\{
X};z&hC
2:tKeV]
#qkHzd\|V
*0?^5>3
UoK$V4,T/
!"2_J~H8,f.i
Yuq%{CeVD
_[SMO\l}
=yaMcS
s*9~w6
wQ~=w6}
X8X?~e.!
*}bn\5
}$=_Bw
$=?,U{g4v
_UyKH;v
/P_EwOF
7O^~lC=Mm
8v]$*l
Version compatibility info
JPEG Quality
b%C&4r
5'S6DTsEF7Gc(UVW
dte)8fu*9:HIJXYZghijvwxyz
sFtUeuV7)
(GWf8vgwHXhx9IYiy*:JZjz
6f:Fck
UJ[5~q2H
Oh{^i_Y
+{yQO<O
uy=_'z:S<
rbecVb
4;c4U#
VT}>ct
Ee].QG<|8Wes;
c?dbw-
TS${^[
,9KA7fR
EK_Q)Gse
iolio
R1?mO{
$|^C'GKS}7
43I,^_}5
xyqS.k.
\?UAK7^[Xl_
jo];KgO
`m*6g%t
[_owE6
GJi6Ll96
P^_L='j3y|
m?~{\?
m?~{\?
m?~{\?
Rx'ctq
}y<co
Gz_XoHuO{H
R{C:~Qz=
=yyR!{a
(rO_$enr2K&=
KTSnPQ
a=)Tn_
$'I$97>|
WaMQ|/
%K'/\`*X4
C,;=+JT
JiR7}yOwyA
={{={{={{={{={{={{={T
u24SKS!
7>o3iZ#
>mrx_~u_O2
Ao~rZ|
\<3o/O
|oSF^94Z_'ujZuVW%
}=ujCj5'Xx$p_
A3%jyJ
W4uj4z'^9m
)%<O{^
c<7so~yi}Ae<s{oQW[W_
!ij.JO
?}uyhf_<r
O~{>?o.o~
afn^m
uxf/t{MMQL=*i
}F[o~q
jMGo'_oQ/]
~N)F:jD
<?fxdIX{9A
^b-U_UWcqyb
3))aO$
AUFs-)|^n?
&T'PVbk+7D5[
/'{hRUQ
?eqEb?
:J3v|{
Rz7S?O]PQ|(v9
9i*0D
hJ_}P|**6W
;rnK"q
jtBtdkWl
*3Sa4a)Si?
|RI_H=o
m?WmPd
vgHQ(K*
Mqm_o?
ohE}6IkC*+7
wx3zt_
z6b-K6{ >+q}
rxj<~/tQ
*oQ3#t;3$)
j0uo!ip?
J|u}>.tf+ouFr?
]mlAo2'L[*
n~uE~7-6
%LeO`FrL<rYwm
];QjOZ(7
`}>Civ~R
3C<=>dx7y2M
:LB?20e?_"zjeH?
~?zOS45
7}e6$IU
gvIn}1q
(A|+%=RF
xx.l\d
>VCKK_
ZQYi~'xjrx
Gw5&ap5
nTUYL\&
.)=FY^
mGKOYG6'O;n\{3
Zytu4{Jqvq]
?`HrU6Bj
1]*%M/
^oY7:=
3wfJ_S>W1M yM
E,_OkcRLt?
{}ni=k
[#D)=&+!
<:FW'/O^*>[
=u6I?_{Cut
OJEW'-
S#n.I?_
7^=/O$
?G?{%C
.zW=?_
WIzWQG
(xu=0UC}_~}:S=kI
zIWF=__?
mn?^=#+c?O
}}n={]z
Ot_&]'
iq3Gz^
_k]ht^
jSIGO0o}8~}x
?SgOJN
X{DzZ?]
_e#H[{A?
+&mOo)
N7is}^n
=o.rO$
kall~xm
j=c=G[Uo
7D6rM7
rHGO%r%v__
SWTGSU
=rO)SU?\
on*_vsmWB
]+Z<{WpnQ
%nTVtko
1[{nI$(-)5U
K{)]Mr~?d
(|O'5}d
9]<-MF&?
M^O_;U
E{@xu^}
R]'?-Y]S5T;n
SD~8dK
+7j3]Tt~O
u{ja{'q
/YV>Y
*osDcX
qUYM840WK
4A5EK
W>9?i+{C}1[_{K!K
SmC?;Q
w"pm\'q`
N<:R{wt
>)Or4U(*1UQWPT5=]-L
{U?w=GN
tJ)h3X
G~{CmGs
c/?O
Wn'TU
xxt$??
?Oj~]k
IQUED^ik`u+
_>tP(1
k>Yo_[s
37[s`x=9
6{1t}?
EW+#ZNM_p{gKa
R{1$Os)[[ha
?nS]AQGXd!yn>Mu~
7RIb:{=6Im
xQH=q-
[teda?Z
x*||D?
2I%\E{
\)}"K>~
~snLnJJ
;{]{o!O{%
-[fpcI*
w7KSCT
,m,ZSU
;o/w6&:
)R5Qko7
{0N?[=+kGI<Wp
qLeME>C1S>
HCXj$M
?8GL$?
p]|>^OYUF
a^lT;)"
;i>s!#
=<fky
19t`mA
$~j?F6n
m5~^:_A
7{i1U<wMjdW{
hh**0xz
?Ru9do
qFo\L:
#>$n~hwpQ_3U
-jyN07/r=
Jz9"ZZXi
xG3#j#iV
\{/g[=$j^
wgevg.(
p$On}b99
G^SG5[
kO0KwQQ
qgqH'6
* ?=,b?
cxCY)"+in
hzo2u [nLAy*kR
L<ZOua3U_
Jii*!J`j
j'Ju\7m],&SA6u
<P%MLH#8
(Yzy}?
;q2w._
GM]-2>zCi
Qaqti.:Ob
FS{Go#y"nMIbXc)L~I b!"/oOK)y:gd
tFMS&4
Td>9tb~_|>.
PRfLu
3<QK^L^2h
C{~uh{
z+mdS$RGO;2}O
;r|$_<{
kaL-f>n
oot[$
TO[M[ko
3o|.3o131|5
X}$FNJK
CdQEw6cg
G,g)fh
g4o6s4
I$ye5unW
Lzo'Vu{{^
a{}Z{[;Yy
VQ=EnW
CzFj)b
Sb)"sS#L
Wo<no;[iW
;RgrXi?
(V~|{Mr
ba77_m]=U
W"0%j)
ovNFzzMRU$
ZZ~/oQgY
y:xJ#&
iq/)<z
=EemvB
::ZZx5U552
lM4vutB
vam}k_xoK
7JR:d~z
Xl,;s3UTbo>?nWSe
#K]V<H}=
o2q-BS
p;KkK4?
lLT:?z
pG9?'g
Qy?r3"
=Kf>:0
=uO~Qq1r
e?M./maO{j
?]+}8tp:*
f{FGq?fO
{}w:k_^m|F
RJ%M}D-D)G'sm
?HI!2s
OSdKn
]-k)j7F|1OK@D
256I+7j
A=.:{7iP
XXx_7BuC
L5WO[?Oz\=u~{
qO[U77k
?{.{xdp4
z;4P=}
m{{;g*s;sapX
IU_W,TP
:{J6OI'
$t;S;F|~,`
wtOc5e}=
3W|TqjH
x/l}2xt#s
{:wg|^;'
Y[1P (#4"1b#['
#_M}OH
g[hu:q4tm<4t4p48/4Ltmfc
py6ywf
s{sdh&
|OVz#'_
wqd}DkoZE5f*
~bEDR0UO
_j =(j
;sob{+M->E6C
#V1Mw.}R/
?t?_=5D6qu
RWi)w{
8}}zzo~}
*xuu_h
oJKOm\
yImq{+
-=E~WoM>,!
jjh"2I$E
a$~I)/d8?
WoXk;)28
O_:Mm7]_o@9\?C
MY$-7dx
_wS?gHyr
d7em6/L
YW2=_l7?15
r)>Vm-Jm~y?ngkgI=
O!1KK.
}dj|54jbIk++j9
t'u{suq/5F
tW>#j8J*Z
<_!+OW
^}zzkOW
EQoJO+WI5k]'#o1=z%+B
5oyY()2
/!,w~SREWYG
gk|_{s
~U~~o
&C<t<?
n:$[|]
tMS+#|7G|o
o3|~%f7
7['}}On1
Oe:WFkj
_WI)I*?
a_Iz?~8
{D?>:L
OlIQu{{^
z9+=)*
qba[)?
edTTxfE,i>
;o[)MYSOM
1QWtn<u
v3&s;?:;Eh
<C'9QJ
M]Bay:
crGhS'UnHq59<4Xs
FQy*"JZ*pb!
|6<i}zC
f)+TIDUj S70
_SeOSuun>\=
X|WTE0xb
WS1txl]Gv62.?6
K qH8Q
u4r.<k
~j)Hn,1'
GU2oX^
:?sV\Dta[.W6F@?
!nOSOQr
~>fNCzE)>c
_h9q.]
]/.H|bg1
';OLA(
qUuw"N
YG^Ck<?J_t{
8p^yKg
{_OO&r?
&!muvSH
$JoSm*;b
$uN7xS
oudC]_;
!{gp-,0is9
8qUO<(hf
j:?~?x>:TRV
=JoJ:J{Rz
(`W=JW
fW'c\uy
i?)~~0$8f
DLmQ.+
3QIMxbHBb
o'mUni
gEOw,OC}
-mc'Kjz^
tU\|=SU
Aa7~Ws
3o1t-z
w~:rtmL}+#8U
uE&_{_m\Tz?[[;^~rY
"7,r\J
mN[1[sGo.l<r
cvNzx|/
Bnn<rE
?nG7 KmO.K7/
NV/uO'?
Ol?zMg}s
:/_?OxBO
XS=( !?^G
POYn)/
oniC6HYk0y
~cxizT
C/OwVj;a[
Lut~,z
Oim08p6P
a9[w/?
m-.%9?
1G^9&h
7=t?nP
g/.2,io
9N<~QK(
Z}F'R1V1PQc0
?/#U5vY=\{7.
1=c7v|
<8SCQQsF]#
{9m{|u;=~x\>w
oMI+0{^<
W&a$Ru<
x{R)]?S[o
{>V ck
qo77]2E&
v^,TD?h30T
OT+ZTO_G]}}
?P6_w5[?=
,,~buB338y#
@Kr*;{k_S
^9?U,8>+H
I/HV8x
1o{mc:
d*67j%QPl97
mm?t?sW
N}7_c7
ny?Xj=Gw
fAzs>g+r
{o4}o[v:hn$o`v3
Bt%BHs
YDv)-et
)'N6Xe
nNyGc>j<
e4n?W]C?GH%3I
[?__o#|zv
;YU^Oi?3r
^}:GTuY
6j_.o_w
Y*$i:k
8b_hRzmJg=
C5uJ&O
_gSZ(q{8\
JxooeO7W
sc&bMO
}o^=$rX
XiXiD+F
c_C4?B9G
hqR:{:
<C]c?C
z}oNW=_Wq
{{^SV_
?}k}3W
JaL:I{a
}w@==rI
_hR^9US
.;UQm_
{aq}'j_
{Hxu^g
u{6j[n#~7&
RMptOa
._t6mX
?Q3hXK
9??^wqK
/_nk={-
'AOF+mK
+OJ^/Q-Vc
%\y>}tg
4l4jOx__g
)=D)7J
+U-K{
9zG].C
l^?QX:ct
vrXUN[
Qp}>z9bg\
<{s)8>
K*?UmZ
h3*>&?P!>i
&6?x|oS
*2|.Bl%pcj5,qV}uOJ$
EM?QjG
q"I%1'
uvg^TIf6
1yc3QRjm
;Uv[IWUYj3x<y
u%ujMd?f?)WfrrY|
4}jztUUb
3"8vO7tsz~]{
t7dPPKK5>
-gx'O.
,/M4C{O.<=
}G9dxj2e
w>sqGd
.DQvOi?Nw
{~bGS1UKF
L<4EX+'
Rf6e}>obggkrH)ir?c
S!pWjbV}
>8,8|P
w{O.4>*)T{
u=&^rL~n
S2OrnJ<
?Mrw_WIbif!wf
tKqqCY4d6t
Dy=Z&O
x>fmxG9ag2Z{M
>}kMM_]CQ&?tj2
xLVI)A5UnP#0M:7
y.6dmY
`bVWn^:&
SO#G6Ccg62\S1eq,
&}&iFa0Q
19sSv|
P$+gU-
2&~GTKh7fH
=#/oe%
-1YH}'
_?t_4).c)%
ToU~Q%gg*
.cPAmimPm1mO:x\;b-i
'R5%o2]
o/~ej6-f
;o,V6J
hf',g^
E[6{zu?gl]ON
)|3V_qg
9*l/l]
`wQY^e:
8[{66QnR
7'X/,=
K/m/'w?M
Z7m$Th_K,
ycCs)m_y
wM]>6G
0K_%M<;]O&:xa*v7TTRC4's
~IxtSsX
1CA(*Y.V,/1E
]x_jnmHl
_)zfog
zvyk2_ML
nXn{m'?>o-X2c]a
G{{ou~{
q2XEXn0_TAPK
8n?+$v^givm
Ox=Y}Ua~ZC
4/CX?y
Xb{#\vn*
=AsuAM_
}4Z4_z
,_sxy<rG
{l} rEU
wM]kyj{`
sn|.K`\w
yNOK[3Wl
I=q'9Fhw+H|_#m>d
;o|D\qM
%>uofv'S{3:}+
S1AR<8|SIS#
frxAY'}io
sqc2}-=
pvmlwnI$LJ
nj'2Lf
&bIid>j9
r@41I##
GYod5r/eas
W[e6'1
~?)A/Wc
_W[i-Za'I*
2MuR[C'Ev
yI?qOQP
|ul]_O
xw=WS)[s{SUO^
j>WX|B(wT}9.WQ
9H}W}9&o'`Nk
xLnb}W
b<q\;mkmR
,5Xznp{o
u`Y;Ll
Xklt6
<xD4/qqg
}o'p]]
te~?A-<OK
?mbhqg7MUoz
O3y>O'%v
'CeO`v6Rdv_e
eZ~SnVek
9z2s-1
E+{(w3:
Y>`lE1v
DG_NH%)-tZ
mBigHO)
?T_s;<I8
WR~+Ou$blMT
^4/22/2019 14/22/2019 14/22/2019 14/29/2019 15/5/2019 5/5/2019 BMB
!+`/3/
7!+'!!'
!@@!+$'$
$$$`Q]!!
"7'+!'
@.6/.s.'
$$h$7n
!'!.C"
/FH+']"
F77.77...TD.+!
"/'!+$
.$$$'!
6TD6`+!'+
7+!!F.$[$
+$'$!!!
.F$]'7.
7.FC66.
37!+!+$6
"h'7+!
#KP0,8
5/10/2019 PNG
~~~xxxtttJ@!ufff
$~~~xxxtttJ@!u
~~~xxxtttJ@!ufff
~~~xxxtttJ@!ufffEEE
~~~|||xxxtttpppJ@!u
|||xxxtttJ@!u
~~~xxxtttJ@!u
$|||xxxtttJ@!u
vuxxxtttJ@y!ufffEEE
~~~xxxtttJ@!ufff
$~~~xxxtttJ@!u
~~~xxxtttJ@!ufff
~~~xxxtttJ@!u
XQG~~~xxxtttJ@!u
~~~@?=:xxxttt2
0~.}J@*z$w"v!u!vfff
""""""""""""3333333333333DDDDDDDDDDUUUUUUUUUUUUUUffffffffffffwwwwwwwwwwwwuZ
tEXtCreation Time
4/27/12"=
tEXtSoftware
Adobe Fireworks CS6
c\U(6ex
I?`f{~6w
x$8M8d
XO}-[y@
KRSZ_s?4'?hD
->gb{pF?
a}=NGd
F|s[;D
7u@Rw]w
'-{qrpL|
RZZBv\
sa1/UoXA\'{g
vItSL4S%
xaxuD7Z
{Ek&%o
&/a#-50plO
vb^7G3z
ra%%=gv
px=/bV/7`
@5Dzv7
]Czi o
Zwvsk+??b
SoTS60#Zv"
jdsp5TD
*9||D
FxCrF\%'W
RFq[i<
W-U/]"@
w!v5mkzy^eMDgq`7
_fsv?ZNY
3|g(mPS{n:`]h
Wu"+O0
/*ios-~
CZ.caZ
aJ4.`V/
Y15zX!oYzaS
aC~Q;w
}LQ;#-
%[(&swH
.@H$:AE+:S
\K+Ut
QPYPq/hb
oB+JpE
p.KQWp
<#p.{JEU1X%UB-[H
Pp:B=lHx
J@&fB1
DUV}-[yKj
S.yi?UB
$5-'zCio
#+e ~
Q?]|<(tpyK$kn
rAC%e;
C4|uBY
C:n\{|
&R$iK:atMK
d'!tk=F
hWKfm%OpX
qELGB$^[o
&/vHi3
]BI4^(\6$wux+ZVx,A
k^bS@'
OVU{';}\j
*b ?PQ@ C#QZ
osIQ1eB-UP
!m3kXRO\>PeqC
Dr_v^xYrS$d
RP+5Zh2E
9TDJ6!^cJ4
XWw)tl
39^&xg
Sm>/8LtAHe&:
>e<2?c
`fP,Q
Y>,xR
^Bij-D
^qjqj-
+|p{Y@m
~pf>}L
r&w{F@V"QP
|dSk8tC
V;H&AijVQ
/i#W>50kVFvm
`=&M|Ea
gAHIz0
?<$.>F_
T1z:V$
%H)D=B
(!M*45!
-JL,< >Qx
8w(}v<N.}_
I$j 6lg#F3J1/[D
~!R$b;=
5 7a<
jZh"iR
k!szM%_U
*v1E;8%y
IRX2W,l
<DFQy+b@
4t3`ec
${"[y.]S
"kJ1o =<D^
+r#nS!'n1EU
Y!~vJBMv%e2,
KX^kMJP
"!br(xd
W~LfQzLV
%L>b/=d
Z(`=LCdK@
`T[(T
P.ZZZ4!^c
?.8y\.r`]qmW|V
!1"^Rjp\aIo-YTue,IT
+r{]Mz
LL\l\<1!S").
-e#n0nY
=As`I)
>QEOMP"
yySrpIN
r7y6L.
B5o4)u{r
WZSLgn=
4UnF+`H`
76aFt{$n$^
is.j##
81CQ>z
Wd@%MJ4
6&KTeny
yo7V.jBn;DOOhzi"
svW+iWO
jju!.+#[JWh0Ay
M\G?m$
LmZ]a]
^}?4V _
UqJ^)#2s#4W
s7.Tn(
xBy;1b`jkxy;Wv
l)Sia/cr2R
r{xDk{#l
>AO/TR<
'>@imUB
RN(u/d~7[.d]0lq
+)d#4I
DVfV3&^q*[<
?fa>8]
@fC(aiERD]>
)3T*O<
9:z~*jbiXu #g
WVA=3=2
D~[o>J|
\5mM;e
}RoOFwj
:et3}O
6C",5)
#2Nc{P~G_JH=#V
g}hx2-)
_4~+in7[k
|#$V(Bo*M
`IDATh
x\Z4O|tZ}u
7W`kG
o8I]H\n,Pj&
m=.fL7
'W5]Ysce
77n->_hKs|xvE?ywx7;vO%Yf
P"sKV=t&
z;i`4l
t3N-949
*6J=wyb
c^xGb}
v"^1#lLE
h4FA-6
mooQs
yAssMZ#l]eKG
8HS9Ty|Z2z
E428f+BT
qcVbYeg=<
;]|X,+/)J</lnN)e{
4eM94~
-S__G#SW
{bW0+u-T_t
LK:h{{{
=+yb5lmr
o8tQ[i
.a<6kn%=
QM}Imm$mlk%1E?o
M3Amc^sa
amFN4KX
mTk.bq[
WuY&`D
-Bbi8^
*=md=}[J{kL3GF`}Q,)H
Mv]^.&c
mudGB<Kv
hA*^pk"`/N_d
qXm*~i2y
2LIvx&,>&hw:
#(vGF6
8w}PF(
lA#^Mg
C^F70}T
N%Ja<b`P%
(IKQI'F
"w}Yp WJ-|
iy"I7s:\
$:xK5A
<"Qo\]i
=/Sb/n7zLE
`VB~Fw6:<FinQ
oF|OQZS
b:|hiY
935&vUx
bWZwN)
*yWe#MxWN;
/M5(g|}01ikS(|bt
v </wA
5/11/2019 1PNG
"""33DDUUffww
tEXtSoftware
Adobe Fireworks CS6
tEXtCreation Time
2/23/12
GIDATxz
0PTU};UE]L,
Xf;3?d
*}uyWY!;
LZaOvM;_F
}uDXz.oiM
:f}2:,:+;:\^_
zim6GS_
+(nj~C
e?MQ;LBY9I}x
<rk,#.Wg
kQxTun
j~JN3/WR
|J>E{e]
10j#Co?<y=BH`;:f
yWcn5+R-
>LyJ6jTj=
z6a)x3
{w3Gzm
kLPY3G>
BQ4hHz
hkf.f&.^
SW7&X+
yZ2ICCo(V
C7_O/Z&
z#aWt}@
]{5tacS[
qPnZgrJ[hP_
G[i"QZ
M~x=n1
mKF}6sx oL
S#B2,m9D
UG<fsZ
m[Bm%
K=/y0sqRq-X
{_]@3_
X5B B B B B B B B B B B B B B B B AU\N=J<
k63lKFx#
N+u~2z2_J^*N
SzKswnT}SuoEz
&K>BG>:<wwCn]
=k0gboKk
T%i&A"
o=tgw|
ykhMPOE
oWY#&=YC[bp"
gny[{sc
q,?gy^w:LSx
<v~t:;
^{%~YO#
>__^|}~Y
>O_^~(aH_P^
&,+-]#
=PVom!u
e{Nm*]<}Z=3!k~}.
3NN~hl
?t[Ry{
}&oCVJi
CEo!BX(b
KR's.H
Aj8M>t
Bw,'6Bw(
XNlP27
trb#t
Bw,'6Bw(
XNlP27
trb#t
Bw,'6Bw(
fCWh(,C
l6t9eHCWM
^it!.U^`6
ZrO-iCOh_!
XQ@swBgk)\T9-^4uIJC[ 6
U0Xpjy~*
6tBS?uT
=9KSg~Y
8=K=zC?
kL=9i.B/OA:5jRjOGu
Ol%W6LN"
.#s7]2->5}nn;<
"3'z-}iX\3'$u
1?RlPW
gr>EJ
{uo-W5/11/2019
Photoshop 3.0
Resolution
FX Global Lighting Angle
FX Global Altitude
Print Flags
Copyright Flag
Japanese Print Flags
Color Halftone Settings
Color Transfer Settings
Guides
URL overrides
Slices
ICC Untagged Flag
Layer ID Generator Base
New Windows Thumbnail
Rb34rC
UeuF'Vfv7GWgw
B#R3$brCS
dEU6teuFVfv'7GWgw
"2Dh/2
Kw\A\/<
9[<:mW
%VqAY$OBHrc}pa
Tsqnxf=
>['5c9itq
2wDI)PI%?
Mka`jt
eWHX;@
YZC6Cw1
D<rb8xJ
;Q@.c_cPj
smoS*2Q\Q
Jv%$I)d-2
UK?>YYYmZm
U:W]PKN
)$ccn*]
]ehc%f5]
VTI'!I$J
Wcc]^>K2q1
2xd8k@
q/>?o?j
%?W`x& #{
F=)#k<
qZxGy}
$V"IIazsKI%LW6KK(W:+
R+I$wz
`$8BIM
Version compatibility info
JPEG Quality
!Adobe
!234 "#$
Rr#4 @b$t
AQ"2aqBR
b#@0`CpSs
994isU
V9'./$
vC^u4m
994iSV
af4jssm
94jsS]
sFM:c@
|?W:<W}
}O{3vFQAaZ
3zWs~_G
aXV5SVL@
!-:g3|#?
9s!aZZf
[o.qsbe
Pwzo:=
;8qR"J
Kp9.\/g?=
^/&]8
+sNo>q
V.7~o/
>U'&{w
^'o~5u>
-tqN/&|>
FnArn9;\~
_WrOwpnom
StsnFnL
~wc~IO<
3>Mr~>?~$
j'Osz>:
xxXxY6YD"K
Y,K1Y,d
df72f6Kt8,K1\%d
EIQ"D$"
1~q>K5L
~[c=py
I*$HF]WN
b,f91q
bBhU)`$Y
$BDH"$"
"$b,DY
%!f4OD,
I",IdDD
I*$HBDY$
A$"Ia"HY
XkPc(4
GA#HtR:)
FPPSTLTLTLj1
.^|PPPPPPP
b\<p,}Yfu%J})9
fDTUmb(((((((()
PPPPPPPPSS}
H{4] |
X ^fh(()
8M<A>yKTBP
nG |W#HB*v
y1}mA3WM^
RI&Bo~.H%
">W{fc
R-M-2
ZWoBk&P
&$!z[m)3HW
R-e9Y\2DVeG.
B')i2))
OSk8o2I=e
)0rM[2F_oY,/Z$*=i
f*I-'Jim@?o$9g
KTw%lI
m0vo(vGo$v
K;/iIJ
l~Z9o<
M&wrifrfMKRJqKp
\Z(s@Tl]T
L{s5Pb
im%+3iS#4J
j#RR-,
oVR5EJ]I
"")+BT]uS(R[aLSiPK
>`F;vj
((((((b(b(b(b(b(b(b(b(b(b(b(b(b(b(b(b(b(b(b(bBF
CP********+}
_yz&J}b
5-Qz.w5
T:.o:w
d2HB\KQ{-)
SmWDHUAa0
~jQW`cDd'7
%vjQR>~i5Q
FY"#*>
o6_2NDM
j2_SWqC'fFD~
FRhksPDvA
5$kHCY
*-D`h3
IBj}4I$FKhFTBCd6h
DN4II0v.
CF6HgPS_
XV&C?
CH{G~ w4;A
Aaap,,,,(?
A(%@5XR
|~`^G
;-e1LJTp,c8
)b%~Q+
'WYfmnCam}o<
x=Wg+Sn<V
_>Msx2|"
P3x=n[/5!
3x*1JURr9GD O%X%cX5X5P5
CP5cX5
Y1NVlzqfn]nw~
#Rw"rs4f
3/+QQj
.20Rbjd
},|~gn
N\e*gPFs
!H\-QQQQS,)ZG
m+F(b@N
<K<.88^q;zT
<GoK0kf
[=h#(|~ko
x%1p^K,
[l>lV-0|M
F/{Ctgc4|#4*
kc\u6#}
_ _xnAxD|
&.n1yZ^2f-n^
n1xh^6
YEmqVEjcBE=L.V
K4"]uEo1S%3u!
W>SvyY-Vv$S
b7;s,3k^
jtX?yO^s
Zn}|b(
XK)c;
uhY{Y \>WX]^H^X=
/#f>Yon>[7Z#'
[vcWNor
r`n{Ivh
SneInq,
8{[\bm
M,xDkmb
m$[PjsoeX]m
}W{vUwo!<SVVbJ9([8_8}
4>v}(5"<
oJmMCX
/?"rkl
V=5}_Q"8~
Hr<bc^
3fFOfPINa!
~mr/(~9'
W*:UIW%^ty<.U|
*[Wz\oK_-r.U|
*[Wz\oK_-rUz\.Uy
;WrULUIW%^tyUIW%^tyUIW%^tyUJW**z^W
0LmwvF
8*<Q?l+]BC
AR2cce?W
x}DpD8KjTH
m-ztp!U
Gm|uy>
"#lM(F
y[M])6dU
XT0~ H
}]e#1:KKO?(
cH$@,1W"
aLG~:MT
UY?`)6f
>9T%_guS
..6zkCS]
qLUG<!v
f59WjS
V=di{}FD
%R#^{@
DUP115(
H(nl=b
.\YxtK
[9&"=!
Td{)<IB$e4
#}HBFw9
L)0owiQl`qfIp!:uF
'KU1#*o_;
-'?7S6U
-)mY,EFS
)Bo^{_W[Fq
F~P>Hq
^ZvC,)
Wx<Gv]ed.x{10']
bxX*>V'X2
bxX*>V'
bxX*p~V'
w_.~"0\EanO]
j;zj;<hh<WhWz^W
Fb86GXk@X18
&y$H[9P
(HH]28dV j
Myt*D^5
*$3j[)
Rf2$3cUJ
Qb3S0DgEN
#J[*%(`p
G7bL'O
b@J=)+
9vUbJ.(
VZ`_T]QEVm
9JiC.ptG
ujk[J1
JsQ,$*.j
sU<&t"].?fCT<5!~l
KH8OH~$bJ)
N@voBzFhB
6a#|r'x?T
ZNTSk3l
Sdd5|Fj2)
#s4Z?s
0?g*0jzq
q"bemn
N"CkWy
|]U)Hj,GG
M9#?oCB
gfXan{U
>U=-T/Q
xO5\qDK
cX?K 3
c2V\<+RLc,z(aG26^
t(6JZU:
hcDm[r.(
G>`2k X
5+ncyB@oS99S
3>\aCWd
Jo.4&Bg
G"}VO[6}mR
y6rF@]
^W\#]-#zGq7[8-Mu
QloGq7[3
Ulz=U=V[3
Ulz=U-[2
N3+K2b
%;SD=b6
2hbcb$FB
N:q11111<x
8N=SKZ_
p(z>N8l
6]kxmw?g
hzo7f:o
F=K`1^
fRX|{2Cc
*z^N=Sq
DsNX{_]6sT
K)if3K
pV&"=P
MWvh+,p9Rm
Q%[IQRUTi
^mnelQ~a@
#!tc'T~,M[vIiX>
hVY<KF
,Ic\Fc
N/cocjXX
Gr/_1)
eV6YY6
n#V!F~#XyRGeq
\cC#$.Y|Da(V
2RuFNc<
@@Y#UFd2
$=#frOcn4
]8fFSdc
d8M,Ur
32:2 ~
@c:[C=$g `
X?IY!Xq
k+JJ0sZS
H[;Q$bs;R
Et'Gha*
wTv3/x$
)tFkyq?
Tu@\`6vz6{
n0D]@f
+OZ4HR
\%\1.G@.l
4a&91mlNy8|
I?P{~z}aGry
=hF(e9F
5c0HD/6X(%1
Ok{WqrNhDGN8
MP812b
9yF=Y
d0q'AE;
[%cr{t,
byyC<wl
4AZ%+D
wy)X89
jBDg_'{-`PY
h!+ Oz_
lm56s~X;<ujt,vbwrVt
xvwj=7
YV}ae"
nAgz6Ys4
\|8/n5k
V}2EbIT,f
I%Y-*L p
|';rG7L"G$WRGx36]
](ohx*2:2doA
sT^idQgH
T7K>I?P{
-c*1t2=9
(@s(l{Mk
iASbvZ
2f),j+
1Y2^Y50'2
0-K^X&N
x%_5[
m3x5pYZ=9
4VZb^2
RE#gU$fW>
2K4Bu-L5
):z%whb
+wbpi(<r
D4I%A`
,Br-H1j
+,2=hA$yP:
3!UYTr^=L
:[8~Z+;VdU!6
7#<^I"H4^zut</
<+Jf: f
+QXZ+PNxk8Yt
K[EyoZ1u*
!,tjU bxb
gGf:<rk%
Wx8]\;>
M<m1M9
V]*9Qr_7]n/
KojIl2 9a
<XKn7Y
DN##/J
@5I'[I4&9j=
32NLoY
r}HF,2a
o-w,n0rYTr
eKvY2E#(
_Xc:UKw"59b5v-}&!)
<Q*'GR0r.
Yn,_c"bxgIV
x0]Yd3
.rRMv<6Q
;]ya,1
T)CPg]Yr
tjs-[{Cm0I
[o=}qul
jxS<u6:y?$
m*8LF83
Geqyq.^g
dt1ic'
lN8moQmQ
j<{7`X
|m~<~
uOc:'_
>]pOnRdeV88T
{~{fP\Wl
D5^Ee#P
~,mZOvOJ!14m0h8,4#1p
om4IQ:
ptl?TVNP,&?qS>ZzZ
6WTcWN]Jl8
{M>)*XE
PGrmBiJ*[
#mwC,u
hW(IUf+
.\cv~;_23m3
uy^4VW
eeK~;1
b[45_ FkW=
c=PG_[+
F}MmKgb6}
UualC"
5X:]9N
0F"F7p
)GK!X4
8+F#'6G
9:elnP&-g
pVE\tA
]&n.MGG
&g&}KWC
XWsp[m
UBeNG6)^_
7{86x#
bhV]4wVI)"r8Sl
fUC({2";
kP4UQX
=5y9k#B#K
gWsw'4/
[t"W!"R"#.E
5)h*E pY
%W|duB
15,;7t4L*js
z<rsgI!Y,IA
pwm7AgzwZ
>2waX|O.QY@
>A"h["6
gAFYvj;,oVz&$
*Gx6;y
~Vjfz?dK
<,?qq?,Lu
r"YUb3
'qT*sIwa
+M4Vk1t
sBP0oHorn
2U{ztm
xdH((4
T5grw}h
B(304c
$uyV+3Td3XP
vK5cy7<
JGRhm-Gz0e
O=k{-aXF*a%
"!Dr!2Q/U
;Z|;eIi+VdwIEZEfX
#Z6eD!
Lqv:ZM:>e
\6VU-x
r]YQGy,
Rj<:J&VU*
d9Oh#'*0
,P[Ucg&EH<
4:=ErETP#
"V+kC# x
Iay&rRHhuSd=c=
W:0m[b{,eVgL
L=A@<
KShbEg`#d1*Op_
!Z$k-WTr;
a7:D+b@ C
VE_,rZ%8
cfYgRaVHDV5/14/2019 7:27:12 AM
best_secure_ghost
Adobe Photoshop
Adobe Photoshop 6.0
connected_networks_big
Adobe Photoshop
Adobe Photoshop 6.0
(()****
((****
dvd_cheesy6
Adobe Photoshop
Adobe Photoshop 6.0
img068
Adobe Photoshop
Adobe Photoshop 6.0

Process Tree


093d7217590cf2319fd7c9db6d361cff49d3da632c2eae04dbcbefccebaba5cf.exe, PID: 1856, Parent PID: 1784

default registry file network process services synchronisation iexplore office pdf

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.