1.2
低危

218db76276c876947cf00dc4c9127eb41217a5b0efff382b3e6e702616d53c5f

218db76276c876947cf00dc4c9127eb41217a5b0efff382b3e6e702616d53c5f.exe

分析耗时

196s

最近分析

360天前

文件大小

353.6KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN SPYWARE INVADER
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.82
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Shifu-B [Trj] 20200606 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200606 2013.8.14.323
McAfee GenericRXJA-YC!DC4A68FB3DA3 20200606 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0780b 20200606 1.0.0.1
静态指标
此可执行文件具有 PDB 路径 (1 个事件)
pdb_path Z:\coding\project\main\result\result.pdb
行为判定
动态指标
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '.data', 'virtual_address': '0x00006000', 'virtual_size': '0x000256d4', 'size_of_data': '0x00025200', 'entropy': 7.934722373646791} entropy 7.934722373646791 description 发现高熵的节
entropy 0.9054878048780488 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 55 个反病毒引擎识别为恶意 (50 out of 55 个事件)
APEX Malicious
AVG Win32:Shifu-B [Trj]
Acronis suspicious
Ad-Aware Gen:Trojan.Heur.wqZ@Xk!S4wl
AhnLab-V3 Malware/Win32.Generic.C3559287
Antiy-AVL Trojan/Win32.Invader
Arcabit Trojan.Heur.EA02DC
Avast Win32:Shifu-B [Trj]
Avira TR/ATRAPS.Gen
BitDefender Gen:Trojan.Heur.wqZ@Xk!S4wl
BitDefenderTheta AI:Packer.575612A91B
CAT-QuickHeal Trojan.InvaderRI.S8884462
Comodo TrojWare.Win32.Spy.Shiz.NCA@8m98i8
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.b3da3d
Cylance Unsafe
Cyren W32/Shiz.S.gen!Eldorado
DrWeb Trojan.Siggen9.5757
ESET-NOD32 a variant of Win32/Spy.Shiz.NCR
Emsisoft Gen:Trojan.Heur.wqZ@Xk!S4wl (B)
Endgame malicious (high confidence)
F-Prot W32/Shiz.S.gen!Eldorado
F-Secure Trojan.TR/ATRAPS.Gen
FireEye Generic.mg.dc4a68fb3da3dfa4
Fortinet W32/Shifu.A!tr
GData Gen:Trojan.Heur.wqZ@Xk!S4wl
Ikarus Trojan-Banker.ShiFu
Invincea heuristic
Jiangmin Trojan.Invader.cms
K7AntiVirus Spyware ( 00557ff01 )
K7GW Spyware ( 00557ff01 )
Kaspersky HEUR:Trojan.Win32.Invader
MAX malware (ai score=83)
Malwarebytes Spyware.Shiz
McAfee GenericRXJA-YC!DC4A68FB3DA3
McAfee-GW-Edition BehavesLike.Win32.Generic.fm
MicroWorld-eScan Gen:Trojan.Heur.wqZ@Xk!S4wl
Microsoft TrojanSpy:Win32/Invader.S!MSR
NANO-Antivirus Trojan.Win32.Invader.ggbjbz
Panda Trj/GdSda.A
Qihoo-360 HEUR/QVM20.1.B783.Malware.Gen
Rising Spyware.Shiz!8.4BA (RDMK:cmRtazov0FhGIi8widmV5Ry1yYQ2)
Sangfor Malware
Sophos Troj/Agent-BDJL
Symantec SMG.Heur!gen
Tencent Malware.Win32.Gencirc.10b0780b
TrendMicro TrojanSpy.Win32.SHIZ.SMTH
TrendMicro-HouseCall TrojanSpy.Win32.SHIZ.SMTH
VBA32 BScope.TrojanRansom.Blocker
VIPRE Trojan.Win32.Generic!BT
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2015-09-01 16:30:23

PDB Path

Z:\coding\project\main\result\result.pdb

PE Imphash

b805cc6dfcf1bef0d93757ffc6439f8b

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x0000255a 0x00002600 6.314714749153442
.rdata 0x00004000 0x00001138 0x00001200 6.012557292339966
.data 0x00006000 0x000256d4 0x00025200 7.934722373646791
.reloc 0x0002c000 0x00000574 0x00000600 3.260985168701835

Imports

Library KERNEL32.dll:
0x40402c GetLastError
0x404030 CloseHandle
0x404034 GetModuleFileNameW
0x404038 DeleteFileA
0x40403c Sleep
0x404040 GetProcessHeap
0x404044 WaitForSingleObject
0x404048 HeapFree
0x40404c HeapAlloc
0x404050 GetCommandLineW
0x404054 LocalFree
0x404058 GetCurrentProcessId
0x40405c GetVersionExA
0x404060 LocalAlloc
0x404064 LoadLibraryA
0x404068 FreeLibrary
0x40406c GetModuleHandleA
0x404070 GetProcAddress
0x404074 GetModuleFileNameA
0x404078 GetVersionExW
0x404080 GlobalFindAtomA
0x404088 GetCurrentProcess
0x40408c GlobalAddAtomA
0x404090 SetErrorMode
0x404094 lstrcpynA
0x404098 ExitProcess
0x40409c GetTickCount
0x4040a0 Module32Next
0x4040a8 VirtualProtectEx
0x4040ac VirtualAlloc
0x4040b0 Module32First
0x4040b4 GetExitCodeProcess
0x4040b8 CreateRemoteThread
0x4040bc VirtualFree
0x4040c0 GetThreadContext
0x4040c4 CreateFileA
0x4040c8 SetThreadContext
0x4040cc OpenProcess
0x4040d0 TerminateThread
0x4040d4 CreateProcessA
0x4040d8 TerminateProcess
0x4040e0 GetShortPathNameA
0x4040e8 VirtualAllocEx
0x4040f0 WriteProcessMemory
0x4040f4 ResumeThread
0x4040f8 CreateThread
0x4040fc WriteFile
0x404100 ReadFile
0x404104 GetFileSizeEx
0x404108 lstrcmpiA
0x40410c CopyFileA
0x404110 SetFileAttributesA
0x404114 GetTempFileNameA
Library USER32.dll:
0x404164 wsprintfW
0x404168 DestroyWindow
0x40416c keybd_event
0x404170 GetMessageA
0x404174 SetTimer
0x404178 RegisterClassExA
0x40417c PostQuitMessage
0x404180 KillTimer
0x404184 TranslateMessage
0x404188 DefWindowProcA
0x40418c ShowWindow
0x404190 FlashWindow
0x404194 DispatchMessageA
0x404198 UpdateWindow
0x40419c CreateWindowExA
Library SHELL32.dll:
0x404124 SHGetFolderPathA
0x404128 ShellExecuteExA
0x40412c SHGetFolderPathW
0x404130 ShellExecuteExW
Library ole32.dll:
0x4041c8 CoInitializeEx
0x4041cc CoUninitialize
Library PSAPI.DLL:
0x40411c GetModuleBaseNameW
Library SHLWAPI.dll:
0x404138 StrRChrA
0x40413c PathAppendA
0x404140 PathAppendW
0x404144 StrStrIA
0x404148 PathFileExistsA
0x40414c StrStrNIW
0x404150 PathAddExtensionA
0x404154 PathIsDirectoryA
0x404158 PathCombineA
0x40415c PathAddBackslashA
Library ntdll.dll:
0x4041a4 RtlImageNtHeader
0x4041a8 ZwClose
0x4041ac memset
0x4041b0 _alloca_probe
0x4041b4 strstr
0x4041b8 _snprintf
0x4041c0 RtlUnwind
Library ADVAPI32.dll:
0x404000 CryptGetHashParam
0x404008 CryptCreateHash
0x40400c CryptDestroyHash
0x404010 CryptHashData
0x404014 OpenProcessToken
0x404018 GetSidSubAuthority
0x404020 GetTokenInformation
0x404024 CryptReleaseContext

L!This program cannot be run in DOS mode.
`.rdata
@.data
.reloc
@uM+QPP
3VSPx#
PSSj#S
_^[UQQe
t.t*p<
w<SD>X
,u!=tB
PV5l@@
E;0sQi
PYYt1h
VWEP5,B
W3WWWj
Wj[_^UV395DB
Ht;Ht/
UXSVWj,3EVPE0
EPVEPj
VVPVVjdh
u"954B
e_^[UE
SW33;t'
3;u'V5LA@
SVW3j<SV]
PPE;u
3;tJSPPj%P
u:h4F@
E_^[SV50A@
3_uuu}9u
tc9ut^EPVVh
tF9utOVu
t-VEPEPWu=
re^[UQe
SVW3j@ESP]
EPEPSSj
MQEEWPE
UQQEPj
SVW= @@
t&t"PEPVu
S3V3]9]
t\W3]}EPu
uu;t/c
};t!SEPVWu
US3V9]
tD;t@Wh
@u+QSt5M3EE
tjV5TA@
tR5\A@
WSSj#S
W3!}9}
t.9}t)V
};tGuWEPVu
VVVVVu
UQV5@@
u29}t-S
SVW3h
3\$ |$
D$(PD$,@
D$,x~(D$$Pj@vP
VVVWVV9t$(tP
D$ ;u&
VVVWVV
D$ ;tFj
M3%9Hu
t*VHt F
`t$$L$(|$,tftb
AP32uS^
rK)rG9N
u/L$09N
a`t$$D$(|$,L$0PQ
rQL$<+L$
QL$<+L$
$rHV)^l$
QL$<+L$
+|$,|$
a`t$$L$(A@
+SVWEePEEE
Y_^[QVC20XC00U
]_^[]UL$
USVWUj
t ;t$$t
jHqA}
kdzbeO\
iLA`rqg
@l2u\E
a=-fAv
\cQkkbal
eLXaMQ:t
jiCn4Fg
c;d>jm
i]Wbgeq6l
8ROggW
A`Ugn1yiFa
fo%6hRw
[&wowG
eibkaEl
`MGiIwn>Jj
)WTg#.zfJa
h]+o*7
RH a6dKg
I5K2RSDSXLiM
Z:\coding\project\main\result\result.pdb
ExitProcess
lstrcpynA
SetErrorMode
GlobalAddAtomA
GetCurrentProcess
ExpandEnvironmentStringsA
GlobalFindAtomA
GetSystemWindowsDirectoryA
GetVersionExW
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
FreeLibrary
LoadLibraryA
LocalAlloc
GetVersionExA
GetCurrentProcessId
LocalFree
GetCommandLineW
HeapAlloc
HeapFree
WaitForSingleObject
GetProcessHeap
GetModuleFileNameW
GetLastError
CloseHandle
DeleteFileA
KERNEL32.dll
UpdateWindow
DispatchMessageA
FlashWindow
ShowWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
KillTimer
PostQuitMessage
RegisterClassExA
SetTimer
GetMessageA
keybd_event
DestroyWindow
wsprintfW
USER32.dll
SHGetFolderPathA
ShellExecuteExW
SHGetFolderPathW
ShellExecuteExA
SHELL32.dll
CoUninitialize
CoInitializeEx
ole32.dll
GetModuleBaseNameW
PSAPI.DLL
StrRChrA
PathAppendA
StrStrIA
PathFileExistsA
StrStrNIW
PathAppendW
SHLWAPI.dll
strstr
_snprintf
ntdll.dll
GetThreadContext
CreateFileA
SetThreadContext
OpenProcess
TerminateThread
CreateProcessA
TerminateProcess
FlushInstructionCache
GetShortPathNameA
GetHandleInformation
VirtualAllocEx
CreateToolhelp32Snapshot
WriteProcessMemory
ResumeThread
CreateThread
WriteFile
ReadFile
GetFileSizeEx
lstrcmpiA
CopyFileA
SetFileAttributesA
GetTempFileNameA
VirtualFree
CreateRemoteThread
GetExitCodeProcess
Module32First
VirtualAlloc
VirtualProtectEx
GlobalMemoryStatusEx
Module32Next
GetTickCount
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
ADVAPI32.dll
PathAddBackslashA
PathAddExtensionA
PathIsDirectoryA
PathCombineA
ZwClose
ZwSetInformationThread
RtlImageNtHeader
_alloca_probe
memset
RtlUnwind
E.LOVDNS.
dOK+O
Z0,Z Z1*2=:- 09 /-0<:,,0-,Z
<A#3m;
4dtDc}
zYI33KhhzJ6
/3!ij-;'*l{w
This pr9ogam
n}?tbe=u~ai
OP RicQh<
p.t9ex
<W(.rdat
$%P3(**0elo@cI
Vh#V":Lu
{9=HXt
Qi~dRHtA
!?.uBOr
;e.97t0M
KQ} W6y
}d.Fj|!
%WYbV'
"7M_?9
4X`rV8ApH
"&^Y~=i
A QRP,3
B!qXj0
({"O\@5
=BTzt(
/O48Q@uBgH
v.fQVT<I
E0P6BC
pDy=E :}21u
v{G<1t8P{.R@xIz"yx
I,ijFbI\
M\F8DU
nRpL>P&
E(8@hi]L"
geFzNV
{@<0uO
CsjE8y&'
Fq8Q2k
,VYA?H
7MQ!NPM
-31?W*\
6rNLuRWi
b;fuO^SuT
p35pB*
W18Rh$
Ngd&jXP
%;%xD@W
!1@,PH
0pL;d4!j
W8SPnS!A
[N2'$(Ik
AG,2IS19At
t.=+'LCdO:@+
#HX9wec
dEbD%)
A(P -+
W]3@3EPS`
"3Dh$:9$V"iUQ
/ry!2MZ [86K
n&!?B{f
A!f}s
gPV'!0i /
fNb94tjd~S
hr%>D#$
blV/0e;UNS9(=|IU
O;X40>SW.q82&s
y8Z:qtz#qSd$
S@l`GQy/!/ lieE'Df&6%
D~&LI@P
H'Z$; Eg(0
zXOtL!&DDg@e^]
2Qt7<O%&%
cY<k)b'PQ
#L(>4/C(
(9UP$X
4ft:Q9P+
;tj@SWjR
:-RfE`m
52rrJ/!
b<DNW:oz
(WSA'D_
bGDzBtbu)*Y4MP?P,M;Q&HI0,\
lv@NrQA+O
sadjH<
`u5Maj(^(`R
[nk1RnBRo}B
D\`DUD8BE
P!4@($j!
uQ9Rtt1/ke
*;&EV{d(B
N*3X4SbYI
!ZF>W4&R$!
u@OIa`^
MQI*$k
BKBOILY2MP8=?I$p
d,@9tH
8~PQ2tqM(}
@HHfsq
KX!)H!
|"SD_-Wo
7Jl$NBD^Ht%
95FA,a3
w"/.4P
mB<aBO\R,IrbRG"'956H -
yH?AC`|
w4P"K(:J
'2}0=B
=Pxds<D^D
IA l{(ua8Qq
xM@vF.DrV
W,9)ufG
C/)01d
*D8S@&:;<B
9VI^/Q
D".P,"\si;vO
Pq@QYPVUY=J
$Hks1+!
L4g:J( E
4rn+1c^ra
HEM2!=
)CkM6i
5BE'X+
3Kg^JU
8L@ABw"zWWUG
Tc6Lx.uP
!9|&(j
AP"-u@9EtH6
4r-u1H
/>{Y]Z$
P7T1;op
_WjelLN2?9
WyB6~pw
7fIES*
e!,H^F
KZJ9)
]T8:9b10
T"v&~TKbR
1YmFc?fpLnWpl
=\Yl{5~l+!
;~]qSWj-MV
>OC"$E
G95#_u
,PY)&7
3wbQuhZk0pm5l
%oI)nhIZ
uO@jHB/
S"V2#}
f90Ed,|*
-60)kapE
t*]S+`
QS~h*K$%wh
-A_qSP
2%dT"?XB\#zKFDo*WUh
!$g%-F
b>"b@4RR"'
l! $B
p-0+Ml
]L$E7(
EeQTuH
;u\%w$:
0g'o43
WV=!eg
N=v(3*ak
+A!}*;
h~N2cTb
P$amH >x
'b}e`P
<bB";`Esg
]$:&Ad02
N$f)h
~[f8\uJ@
9 Ku6H
Z&UUZn
b5s.+M
S?WPA1!.bo;k
<[8LMJ
^[_l#WrIKt
,"nX]`B;u[[
DPOSP7Z
.P/jl-)@
WjHLs+\/
Ko,K:An
IKV:J28"
CoJGaG
6k$^.1D|"
NIV]~J
($$F q\(~
588a,0po:
VxA+udo1>
$3*<P2,
SQ@59=<
:%I^t'k
jx3X~Rb;\@vX
=P/=Vq
rnx|j0QEy
Wh{nHS6~D
Z!9xjm
7A &n3Bwt-Dy N
50c@u8O_T\
CcTTy\
A-i4uO
.a6thHS"
u4>-85DCH
9AtDSn|<$
IupO'"1(-
wZ"(KE0]LB0{c
+XPQD?
h\$/BM^GOP
tj>|{$P
9$'0?Jhk22
n`9#L$QlX
SP(Zq1
JpBr6D
D}EwUVP%|r
9?v&&*H
Nh@8$S
+ooA
_Y#/8WtF
IYX$;_
Z]H+E@ak^c+d4H
B$})B]4a_~r
v(fDW%PJ
#39.I3&
^_l('te$
k7V3!V
Q#$AK$)
v"_eqs
}H<Se, P;tw
W'=s6J|$r$]2*w
l6i1}8
\"P=5,uq,
'OCybg
j<Y;Z+Iv4tCLN8N}
_PZx#8
iVJxf$e
!C~UN+L
]P '+DM
a+SUPx
CkD5 l
Bi%dDX
D\w|zPbtL
TPe!$UcFF?
.f!LmH
H "]@BU
j 68|fBT
E>{W6g1U0H_bypC
R[HdzOFcO
S!aoA<BLz!a
eN'gao>Xx+
Wn|fe<-
3[aifv
$JK`.\L<iP
}CD;dQ
/;);_4X
uWtr]$r$
ZInX/'
156wI%j
23C3 *5<
=|!!Nn.P
4,V|P=%Tic
@Sd/'I
|}U];Vw
|0:u?a<
tft`aQ>
RKf1'hK
lW.% %m
_f(@h+l
UZ[68PqKuOFXy^m<
CPARBc
[S4;h\
H%ns1KZN
""M)/uc<W
ks1yht#
#y# h(J_
-<QN|+
*8Y\"xS!xK
r4<WnmO;
S:X[UK{J
|UmGLmDi:Hy
~yj/L3Wd%U
I@}Dhq
s'aT_=
h%V<b%*J_xxXS
BJNofAN
Z9EAl^{
"xBG@9DvD
H'yY\^5#>
aEBQr:
Q^b@x${
fB0#d"`
$*D!P
r8(fdGj
f_dro@Y
u69P<LXT
*EQB&`]xR
rIy`0~!
axM/!3
Bq"Q:J
VQzzPG
3L[06v((;
fQz /IM
_cWW=L=
'XVbI]
X~XJ"f>
C;wK^=
Mz/hC(
@-?taYB
UkvP^U
;RDdI[F
K_f<Wa_wp{
ntFu7k{J>
x*Fa6t"f&
dS2_mD
fr>u(;:
3HNY.<
CPrcp+
++k\SiAD/7
L$E{D"Y
LU']EM
j'@-eV}pWh
($^C!>C
"iLb/.D
7B"2fFu
O/tZd.NP&Kb0N
${VQ-LPX=de
m~@ 4?
VW95Pt!
/7&uBA[)i
DS(T18gAi;9]
1cy3 Rc&
EVs*+F)Q*
7'b0!@ma\
OIR+[$B
_C~MhZ
U@ Swj
>/eV@=
|b=O;xD~wLv
\~}nqqy-
"X"|!uO-|}gA~!W|
}<N|a^p
{+%L j
_o&?J$
zp+)9l
z<n5'q
x"DzsZBY(\8Vj#'{:
pyYa^#~ VB>BH
ajWrM("2
e_SH,1
W/%,7S
th.`6e
WM%4Wtg5x"D;#S|Q
9}a=t:&"
.>~%n,xX2R
XGa@2i
]s2}t4
,lx{3<';
@IawDd('IU
)UlDuJ
D($0~URGQ4x
@CD!HLPdT2X
lCp!x|u
PPv&9S|
4+*FUA[Bz
0*I,uX
/u3RSHTh
R\/Rb@R<Ca
3Ff{:s9^qt
%QHE9u
RBXPGj;
u^}3qT!y?T
!_`cru
v-.0E sHo
hHOc1R\
>bWC<;
SEhJ?0QM{(K
?XwyK g_H
ywWMR?
zZ|H[1WV 3R
+$[I4A'lpht
L\Y`W?rXLJP~"QO}
H l@ptx
JSQr'[
L|v$Y%
G0g?Xj
YMHA=^
a@rM{e:Px0H
2$m+_(
w0LrT'nlT&tW8
sJa}r:;&vV2
/ W~1$
uie05h)$
uLs;wN#
Rb%7)rU7
( t|[;VYI
@;ryj{X
V2pQYt)%
NHHbd(T
Tm#td%V$
aL`wEK:AEG
rvHMED
FvI87S
tUxP=~M
q|3>p<!v$
RXIk3%Ao2 t-)P
flREGI!
PGK(rJ
(ZfXBl
@{+Kvp4X5
zEMjQ'b<
K 2VH1
rUrA,v
NGy(i3
Ul@T9/
6-'#p;
1T9tp#
oUXLMI
%^$q;1(
a}vw1Q
F3S}7!
%%%<hD
G_;-r,+ [
t.Y2((
C0MT91u
u;HQd1
@?DWQ
A"IL` d
D+*Ew$=v
K$V+Prl(Pu;
=B^Y-EJ
m,/4@JIN]
=-vhjiPc$*
Q)'"[B
+u!l;*2B
HvsQ=4B2
f`\+4*E~4
Y[bMBBC@
kyoNzHA=u
.u@=N:A'
iQ3/!u,B*s1
V >C(s_$
PV\<}s|K
'rC%Y_>kB'96
=(4zKVDC
qPoD:L
RP-VZv
8t#/?D}h- >
& ivZ.
Nu+RH[I
"2uHL$'3
<^!N!!\>!`>!d>!h>!l>*p
jjEU*a
Z>W(t5
ZNd[%0s
$VT$)9!:P[
6MrA%^p(
J?JJb %p?Ct
%SVh+&
D7ktdq/Sx
Q)4X2R$Mr"
Pp+7;2h(+m
&t(B=1J+!tRPK$&SbL35Y
,CPp$C
)/e\KDz.
jE:8|fSpHuY
2Uuj\x@
UB~A1`DK{>
Nje4kwY
JG9PK_
m]LP)}
]~>+^!
)VPTZD
J&J_`Rc
tSXO:j+
_sP|1@
drAakh
H0P4jZ
6SZ5Wt
7;,!DMH
j3Ht(4K#0
%%}N]j
XG@0b HYMwh>
a#\*;pJ
aLE)i@s
K(U(:F8w
1S%F%t7t"
]ND|pC
:h$~LFC
t<CP)$B}
TnKjt(Srk
Uj1wyR^
P*J_TK
D9o5V>
% @'3h
3p%C8'C#
s,p$2>
@@YJpQ"S aQnl]
;uxZ%}q4
MU$P,l
qlUn P
J@#t-5
nD#mGBu
Q"QIaJrV
QV:Q'*UMtO[+
X.worIBU
u-Xpk^W
3TE7% E.8ZH@*%
D$R\HP7
yBDukm
muXdNReM
80 e4z
@L8HNI_o"{}$
-0\$=su{O82
r,5Qdt;
VlF9%R
-'Y~L>v2+6OD]M
JPo+3=G;
)G%P W
"UOX\2J
a5juPc
$<0EU$3H'E
!wR12Z
hUI$9l!|
x-)GT0SV
v2yS5Qp/xg^
9yY;<^
t@*$-r
G_[.x0$%
Au ll)
<pIk'acVH
W,a%2~
qc5LE^$
R.;7=+
0._PdtkJ`AWQ.
HgM&0F8+N
)~tF,A
8W/ypB
RH>b,x
$)Vp+ts
iv6x/2
>d&_TIS_
2}K3rL
@IAT|,
d3u'PF
g4fB>=p,s$N;W"1
sm"d"&`0e L
V@!-TBN<_
CYBeK2BJ
4V#PPLD8!^y/
|0NSZ2
z4L-Y0LB
XTqHnf{*
!N*=s?
sh /#Y@
D};>s%
h"(dJ
2y!'QP:
)xvdMH
JVSsF8Q&
J"}G?!'b#;s-&
+O+*<b
}(*MK%
9;U6w${>
:BAjcQ
<>_q @
80^KHZe(|?s]VN(0$D_
8@`fd_KQXO
N;$+P;v
SRV_36G9-@r#WZ=
~L$vu$^
7vSYWB
B{>K#_L,
@~gX;,@Y
:'$D m_b
CHHbrF
-]#)f#8"KS
!(kvbt[A%
!vY1.+
EHj)b"
H<EBC2!
TV1Dy+
o`p,T<C{
t!0]a"
AR{@JHZB;g
h6Ov#Kug
KUK@X@
r;*J}`*jKN
gE$%[5
$NLti 'Xt
T1\FX@O
X`9V$r
PtQXp-
PX8&a?
\CG-rl=X
Pf Fe\H
<F{ucG
C=A{!8q
0SWasc
p=<p+1
;~TUD%
:.=I~i
^P=%%\/-
B@`BwyIN5D
|znt{i
%ue_SRT
M1GtWZ:J(>H
"Mi"Ej)4V
zQq!T.jt
Q6V%yK
Hj@n} !
/Ce<&@ED>T2
dt5Y\K-
,Q5fAH)+
FMol6
Oj)L2{Pu
wA1|k&"
-4f~8F5
@VP\VVI
gLd'L[~
VWATp(
XNFJ
][G${L_1
HI},Eg&3Fmj})U
$;_LqL5hW
3tM-8_
4-.ax
"]i$c:hpt8
/hd'E8,
QG<ADV0doX
Y\}B8>!
Wu1j t
60D?#u
0`NB<S
0dkW|mD
}t]r9vq
[8j=_(3
T$@}9x
.lPj>J
jDHX$P
g'?AW.
PXV0v2YW(p8nH
D(S}ix
BF;*|k
eYaBR/
WS@U#4;s0*Z3
_1Qk`LXAW
eKPa[Y#$"}
1;f%7%g}EbB
\=u#=|
?[ro+P
g>\m[|qx
\P'+^,
f(xVWy(
Q%p5-8vc
+a:qDl
t&j"{D)VE`!<
'`kU$Q
Sja/V:Ud?6Yhk
FyMHYq4j
YYE-0#U
,iD:NfT
Utk:;BI>I@D$
@)U]{e
'#JWQk
PJ?dl$|Dz
6$(NV
u@")!Z
j.n(iPL$qVP&#8DT
P~'q(p
eOI8KkHb
e&gsuR ,/u
g0~zL0xS*9;=u
tO*6Q` |
5Wk3?#.J
r?`=A<
%ri!1;F1N
VgE\(P
H:+P';+;
@u|"0G
A} 3iUE
G(]O~PW2
b|S][x/^AvZ.
tOFWD$
T7`VE,j%~`#<|d3M
~]`G}0F
7PQGRS
GnQKT%
3(>*,+O/D%
O1( `w-NP1
Ph#9F%
"O&+%j&
fxvjk0tg=
SQe^d5!u=@
xWFE_jF^
Q~>jIjAI/
Va!Ha9/^$mH9
y.NwLU"
Q$3~E}
NbI8)|@zHr-?
ohH+J=
$eB(;HF=0)
Sdg^6-*6H
>I1]+p^
*?>H!btx
>C31!2M
[>!jt+
JN1tB_xf.v15KX 0
t##h<$
\kHm\`*u
WXtK#z
GkD+-V1WL
'G\ffwp
S9i|n
Fh<=9%
Wh:&ptb9RI
WP1x.+B~&!%F
B9UFW;|^\H
$tNwTT=*
/ $\P.s<[
BZ/Ec3s
eVkOW%
.P>=6 94
"73LBf
1f6:l"
~bNCb!cn
1n<6_KT2
v6`*SaJ.
Nr'E+F
3f<UbcRd
Z*\XN"
@'Xv2dI
,XSJ&Kxt
4w?vh;
gjY_b/
M|q=EV
'[};j/
=Spc(1H
F#Pi~]+XW
("BD.b
WUTeIB
+,MS+N
D/F)}W{E
>]*MyHC!d4eWK^
^Qo<'x^8
(I:gZg5W
Au4zJI!
3 b$kMh!j:{
(]rGIB
.I iGTHd6Ns
+NS"B'BuP
RJ>fLd-TQk
)urftMNQ
iRL6n"w
?f*eB }d
#'A{$b*
l/(y#d'
!)!'3K
;"Zaj;`
]GEV_+]YLi
9D!4NN
Y+)&$x
"$HVC#
+j2'S7$
a@W|gb4
N$VLe(ywoi$j
O!>Eh>R?0
UnS thHpK
%E/u+JwdU
G',$h%
2<KNW\q""OSk
uuO$A/+
%3x/}2r/"TuY
e<jDsB
|6-6xTX
HdK$r^-u
="HzW+y
DNO+P1
Q4;jT4w
M}sK2K
|AFMU]9
N0_"^4Wo
SQ&v<c%
2Z,Xu\7(
4V-=gwi
j@ d9R3
vI4^R
|KDsYIP,
XK;{WtQP.
6j;I6%
i@&%X%:W$"u
vis6+4(
,!r;V,
B@IP;uf
Vt1lA}
,GtdV&aBIr&,'KK}
PiYh j
pK" cL 1MD""
ihWrURV_
<H,i8X9D
&C8A4
vH*|%.l
4b^@.K
y\FJ"!j
B3x!{?
%Xp3$CeZ
2[A?v_
VRg8ZjET'
W14PS>
0TIfi.3
90t'z2N7D
X.cJ|r(W
dJ@Ev.](
vs'ubjP
0nKIP.
W7>@4H#;)(
h R?v(:VN"uTC
SWCfj[
lC#9i8j
t&6c(H(A
J)@_d\
O4r!/B5_>G0Vw:
WF]w(-
C(}aO_z%r
QH1M}e
24+}1N32
r1[Gd%_(s@D
S6<`Mz
WXu{1O
H13## AOuP^__'M
@}:@r
02A,Jh3
T{Gw@%
<gS'Hug
N97 C_
g-x[AX
ln,ai")6G
^f DdR
;~hl D=& t
jI5F1%X6_$^9$
tx}*6B
_4Z;@b
v"D41<^$IN
~->_8%
t6(-;QP4;
0Pckd~F
W9%4mP+
HO>S(4
$=CH<!
OI;t%An%h,j
05$OcxC5
_`9qPXNKKS
;!f&w!
?N\{XJ
MG<+g@U
`9f# W'1*
dR?],|B@15
zZ"R_"C
.(Q"X3
=jXk&&@
%9x2WT
pG@FC[U
_7(x|t9
6<8M`9
7/TlDy
d!BP,+
{C~HWK
;kT^RF7
H#"Qo7fX|%^_s<'e
$H-EAka
JKY$6gD
L,|^22
dP#6M;NhJ
dSg'}}
M?-)K<
P0:v(L
p\-Y^N
r]i&B
Z11]3p
<H/etL
4o`+Kw
K/g`a9v^)
/U*)%xr
D:*ZuZ
Y%K5N }y
#/R'B"?
JO$%T1%
IRZ<s-
!;uN{,H
.fBSuUH
$@W\~V
chL?P8#<Ud
&SntYF6
(3>V B
C,!048d<S5
3SWIo3'
,GQd&=pTH
b3/n7/PA1HR
SMkE@Q
AdRmLa
_>O,hPO
IBxB@~B<|B4|T0
,fX^=O
}5C=%P
wxeL*(
5d-JY6;UHCt
+(}%<W
MXK0';
f{mz[t
x|4,TP
J>2h`.
PSHx'*:}
8AA.<{
|L^<=%
~RI>1bC.
)6}1|BKKu
HwdVH^
F)A||GLs>AR
u'6?/F|KJ
eXYJS$6
Ku1{t9a1
?H.YH:X
K-_Gu
0,DLn9%KK
#DOxu&RP
MPe@@P
q;p,'^
ML\4z~
+t%e&l}
6T|_9Hs
X1-A86C
:b}D<3"
b+T$KxN#_-V
dg`mV;
8V"Yd#Ke@A
y"C0#?
YL&},c
+_j'W4%,
9~7HL*
>VC<7 WC!
$4$)L$TA1
xnv9`p
^Dlm7|
<7"0s=
]MAe@D
X[#KQ-v3'b=/tdPQF
f&vWc/
C,;UP"
+8F+w,
wHX%@S$KJ
q#$g2F3
\mc1j&
`*vR_eI:Hn"`
&};wF2/IF7
h|O3oVI"t
^[%O%A
-~,p!
C)d*<C+
d2<pC3^d4<LC5:d6<(C7
uF$!DO$u{GGL
#O?|/_vZS
@=kTA!PjW[/
/Tk5}P0I(H4M
v>^PZ.#7F=MZbN
d`/X+p
TT~/\B@
uv[&.bL
&sH^0/
~u\X0b\"
UNDNd8</9~has+bu_
_.cBFX,
9j ~`gR
Eb}4f\
zk-nD@X
r&#S:IV
)}dvUpn(
^|e?W(
1[QbX2}"_d
.l0o8U
fB4ak]S"f
&~CU
[m]8%I
Wia]9HS
1@J%^K
~[Ul|Mn{
J is/(L$$ y
cKIMg>r/`uY
]&ug+8CO>}
v f}Go"/x Rs8
?\Jvu?_g:
+8$&Sdd!@`
xIV']-8
<p9hM]
c]'& u
RC~n~
.tBd7L .
*L.tolHuq)L
+t@iioF
vafMl?m{
:%V3;J)=*
QK:<H*?
6}*"%KS0,_i_
F3x$`<
,IgV8|FMt
N"on>
3w/vL M
'Z97[8~M
lUZktK
yR_eK9[AOxwg
c"@awCC.
`C1?LC
Dz2$h8
Tb&Cz#S)`
")B7u~x
WE^Kbj @eC
0PP:A]*
{)EaO5')@
!pN'>~
6S8$"fU
`JjjlWhKM$a
e.\~h{
"f&]:|;9
h ,g7lA
?R kP2!|
L$,Y_'K$ iWR
""*1BV&Rcf0]
|UV<P`eN
=+/t'[}oQ!
5i_S.tOJt"
:[yJAHN8
TI]bZa>X39d
u9VFht
^P$d#w
S)w[hYy
4>1RTSH@
|L)P#?Wd
zgt ,C=EhYO~"
AH!6|jB
r-IqWS
ALPIsRY
%D|K^TPA
X**~;|
-f/C~{
{,)vZ&)
QO;~'s
Hrhc&qN&s
_wY%UP
2`wrla
3P/QRZZ}2
NSU9Jo
SM*%S;6g
ONc6`My
|JaHG)>(*
u~)xR*
0}F>Bl
B@]`KuJ+W:0
)J]P29
PuQ:[K
ov]R"l
U>e#uQ#
L-J]EN3
L}HVuTK(
T1(1H%
>UI$G,$]
GISp!\%?6b
@>T9)^
Os;NLh*tVMK
!D+Vkx
Yu8H!?H
!>$*X&~
OZSs]Ft
F;<SKm4jA>,u
JsX~k3+
;rY3-9`vT(
B;PriTt!zjUHQCR
ET+6jH
,EN_Ke^;3`,^a
.?8D4e>
v.VCx&1
o"QLzTh
"!}%HTLV
,$Q=,FS_
&D Q2S
3BI'%U
x,US=tY
z9 (WRI4O-Xc;rd
V#<#'
':sJ8\WP
"Ak)?Q
GnttE-"
2uioE`OuZSS0C%D
VC20XN}-
Suws+h3C <s'{
x1MSLa3
L$v)AQ
h2dF8>D5
AnwDIT[-
d5%8 X`p
H0|Bu=Td8
[AQ iR9:
YU06''g
$H@<"8D4D|
0,"(D$
$H|"xD`3
<$8H40",D(NV
$r$H"D<PD
E"lDLD
$|R"$HX)T
($H3>:"
L$HHD@"<D840
,$(H$ "
"dKaJ62
)+>K32
X$THPL"H+
$H"|Dxtp
l$hLy`\
X$THPL"HDD@<
29)$H)!%
$H~z"vDrnj
f$bH^Z"VDRNJ
F$BH>:"6D2.*
$H~"zDvrn
j$fHb^"ZDVRN
J$FHB>":D62.
$H~z"vDrnj
f$bH^Z"VDRNJ
F$BH>:"6D2.*
gHc_"[DWS$
3/3n)j"
.$*H&""
$H~z"vDrnj
f$bH^Z"VDR
6H2."*D&"
~$zHvr"nDjfb
^$ZHVR"NDJFB
>$:H62".D*&"
z$vHrn"jDfb^
Z$VHRN"JDFB>
:$6H2."*D&"
++/^ZY'.sp
]SB}%8h
D"KcZ#R+},
BHW*<*BG_@Nl)
s"/rtsH
"Ff&[b{FoH
brU.y$&D
,MtRIoB=F*
8|Bx"r
pp{)&MQ
LRR#|G@
FoSeB86
dF#(0
_$%|!*D53M
lm"nCo
A9iQ<c
tB(b!
|E8W +\"
E;j!|\ls'SbL
0FC2!%tBIRd,E2
H~"RD<
"D(@3@
$pHZL"< =
X$jH"D
RHD2""E
" ;Dp`
$Hxj"R
|Hn\"JD8,
$H~l"^DJ<(
"".D@Pd
xP"bDn
"nE`&YM&@&6DH
x2HdLTJ
PF"<Dnx
~&f964
St<=.v
DG@I'
l&e82c
1FNoY[f(
]%62bQT0
<?0'`;
LA`rqg<
eLXa$M-
8ROg}W
[&w9oG
eiby&ka
LSA;Gx#8"QG
"TGS#|<9
#Cz:r9
qG1#ar!9
y9|iG)##IU
#}r=9#m-
s3|cG##`
;Gk+r9
w7|gG'#
Gr>G_#
G?#G?
U$AH]E@"@
$H#+"3D;CS
c$sH"Ee
"!D1Aa
_$5BdA9 B:V;G<D3E
JZIYKLMNOPRSTUFHC
ABEH2DJEYFG
`-inaen
*+?()[\*#
compatble9 vrs
fPs%cet: m,ynV"=smJ0mV
7nO^ztav&
/lnghCdv
M;.emy7
ymbolXR
ymD,+sW;PA&
whh0ukq
FF@Ls
nH8zXrR
Hh1&d:
G2-E1T
A0?R9SD
3"S <3Fn)+
QpC-)P@
d06I8(2)
@?Kd3X))
>A"Ch)xK
>:/T:9 s
MBD(dR
{{(DMN
AVVTR}6
&YL!fl]D^
&22"(UPY:lq\;
F\HS5VoH*K]
>uR$Fj
z4=b&&
uNV\( mP pU
X)@j'%
\KE9RNL32.dlwHH
9&DhY%
!.9u@Y
GDIemP
<r"}$(7FQS
@6_T:7Rh
ADV5P)n
@!> SH
WS2_a8E
4@/T Q`}R3
ntD9 zR$
0CRYPTI
O|M>1v$(
msvcrtlY
H7Q(jWC(d=
_8tHnSLxiKtV%Vt
[pJ+ld$_JDg`B+j
O$&^\-N
BX,{qyXeD
5r$h!//\
Zh<YKw
v<e!GH6
O#ydE>&(Q\STl0fD"n
G:7I|"
niU<pR
gdiplusL
-4~M,B
inSCard<f9d
Vw'9_IPHsL
VlWINTRUtSpY8
bq<_yYn
f_PdT>h
LJW0RkbP
b"RkZh
)Sc'YL E
H>Ki*\NV)O
br-vz~
Y8eg8kO
;$AHKQ"WDY_e
i$kHw"D
$H"DLd
)"+D57;
=$GHUY"[D_mq
s$wH"D
17aaJ$
[ K39x
*A(&|<R
IgBxD1HQ@u
t0pdwG|
8G?ndx
^$bP@%-bh x
e7$J4hx
)MhCD
|$o'z
Hb9?rZ
YlA0(R
XeXiF
&y"zhrlH
GkL"w88f
a88:+b;t
l,$S?~^
'6t!. [L5=8
<"{Genui
ItlAhy
BMy#[bb(N
04r<040\i
o4^a,L
|84a,
xa, B1.
C3W00F
qechK0/
$xLU8E
t%S|1;9
) E2Hvrt
`erWH0S
Xdx)dnS
)<e2h~r1h
J&0z~(5
7P<|{v.
B1<1==
N@9;9t~
<q|o0$
fB2@c)
tbhFpw~
o8{|A8,
u@R",{j
09R&>7
):3=>30<$
6>p>cR,
r aA`x
Lqz<8djX
?B~08LN
>0`09P
0jU%z9waLtO
03z|<E
^Kp\L&
N/Qt.@
]BCz) r
B\/^w(jSN
($=$C(e
i`1`!C6
o=xAL3
!-[gza
8,=v(Q
=,f9N_L^
(p&<P8
0nUr9R
!l9`Irs
\ibB`<<r
,X;p&e`:"
8^R=sX&L^
L'Q$a"cXr
L?8ctv.
cM ^iJH~
>{fn2d
bixmz~
MON<(au
G<>H:K:JR9o
=3GI7OO<:MFBU
Q?@o:=~
9N(vs-
i6VPh:J
A x6|w;
"<<:zw<
z3-1:sD8
+<'$pdG
0oD2P8$
P)$} ,p1
(_/8 L
]&t!'"
&!Mxx2!!:
N-UuCa
=73:v*TF
aZ;qA
21j"@(
nfmv @
!dawEQ
90+:5;C<P=>?????
94":(;7<K=`>??????
5/_;h<=>?????
O97LSemw
99v:;<
:"NBPg
;2@Ipv
:*;T<`=>
&>6NXu
92&:=;I<Z$u
73Y'wGg49Xt
8rtvxzQ
F<P=U>k?q???'::$
;*'OGtg
=rmtuvxz?
>t]vxxz|
eu.8Q~@<
=@>T?g<=
2>Ua3B$
-Soz>5rFtk
:0;A<y=>?
:5_;|<=
<#edo=>
9?M:c;m<$D@
0,'cGg
$XH<=
t'v-x:zBIM?^?d?q?y????????????
N+>FU_lu|S
R9m'Gg
:&,<GN!
;r)t?vLxSzl|I*??&
/9=Q:r;<=>
$`$90>
X97:;<=&
G3gFKd
:M;2.G$tO
;=PyI
"vjxBzN|U~[Il
>+'zGe
.Khy093L:j;~<=>
&Q,fsy
;&',Gmg
4<=Py4
&$GGDgi
v<xbz|~~L&0@F
N@xzYB4%
$=.'VGfoO
t#v/xSz`|n~s~~~mb0
1.:^iw|p>D&g2
HEnP<~K
~D&4Ia/95\,l:
6($>8`b~
:$,)<=J>Q?V?[%xHV
L\b%9:H:e;<='
B$'3Gg
:5;@<N\
91#:,;K<g=&
2"'CGYd
9,:N'}b
LkM99t:&_l;
c5s_J[Gbn
`29rtM'
D2c}\z|~r
?=0Q1t/
/EejuzWj
~~~~~~
4$,x.?IB
0''2GSe?,
x9:a;}<=>???
#6)W`ft
97I:p;z<1V8mut~
v(JPt|T
9;#-8\e'~
bBinO,V<i=o*~~]
> @+?ZF
j1'A?2V\%Bhbk3rtY(=>
4DNbB`
1;9A9<2'[
z|~~~~~~~~
9;^:u,zg<$^&Ng
:> ?O#P
3r eddV
%Ai|<P
ah-$J{
d%72Ll2
Ucq<;s))J
(F:';9/K
1.FHLdTN
\ndlp|Z"x~~
E2`",4J$?pZ[
l%8Azl<
:D0;"
@V496/
84AI4Nm
(LHP$0:;@z
B0yG|1
?]:Y;u-
T9%:,,GDyO47
VOib8X%~%~
?E'GdhF
$b1h'nGuj
|`;d8i
@lb:;<"
<:<`/tW
8Xhxp^
proggamcGnOtbeu_i
[(Rch<T PE
.tex8pe
R.'f>j
dA4J(.Rp)
JPCRTET
(reloc
@U@l$t
}35@p\
ViLDB0
02I~|x{2+T
SVWAT~G0eL
UuC1EJKe|
Hw36\^B
7RMdhX
DGMTp1L
h|bvdAd!@
WD\ilN>
A^]\_[A@?N
2MlL[@>A=
$i+HBr
\R|$Sp
Bc2$Cl%(
Lwy8y
!}$P>rU]
Y2e!*:}nH
8QL"&(DLd(c4&
^ M@;H0,
VtIZ' =sFQa
G&,B2(
$(L*P90
1,PEoi
(:e"8YE@UT
b^?<fM8
fD)A3YJExiM
=K"3)^flE
da'f57
FPZhVWH
b9*ic J
t8aXAh
6(tIl?
mDXELo)61
Sa)$sU</18=H2e
D0&aG2
Le "E
!B=jfC
FX<G4!
mJ$a^L:aR=p
L|w<tU
b}I4 4M2
D'HF-<DguX%
G/@u'#7qt
U)}t%vP
y)\Z."8 DBEIO?D=
g#AR}KC(
Y"K\-@
;GuT;}E
AYD=A*3/.
[IRfL)D'V!<,d(
'2d"?A@Wl44Q:J W
R_Psd"T
D5P4[[)b TS.="?c/<
4;0?>s|<
hmv<R$
Qh2;Vg2t
rH28Vtr
;tVe&,%`f
@ fE9htvz{
|M9i0sj
`[0JKJ)
WP!*L!
lAcF< 0j77
B(2*q(
Nf9+B^"V=
T0$L,
I+@)ou
<$z(tM
E&I6O"
hLc,H<8
tJX?),w
B0r@@lR )i
;x,J1^A
j@M*5{}`X1"0cK
(=DRqiq[7'SA"SX
8hAuQ@G
1p)+dH`
;5j8chC
`P(8)&>:(CZ@'r,
vl0=6J.MHl F(
'd,AKv
P|OSEA]PT@
PGA:)Q
P%nHV!(f|MI*@3=
K0VgK0[<E@ln
j6Q^P&
GBvEh9c
-L/i&f!j;HB`I;uH
T^B4Hj
A(#Ib#L;g|#(
6D@(qMcM
2a^tB'
FKGnV/
\!$I$N&LS8TF!
}`h\LKOK9bDVa&
n,j[\K|E!
]zb[@3bE
]'J;(![aN
PdUuRd
%JvCj]m!
p>sMi-5?@
V$J#M>WlDH[H
(d,z)-
e]/Nag
atd6%8Yh
%y :h$
6E=w*oI"JW
pDce5E
OUF/U{I
uG5(>,
KIX6A
DsK9K@
>k82`P
aL ,41m?D~
$*(bu!0E|(Z
(FQMG(dh
b+K}^z<nW[
iDk._C/
mcXOP*_(
Q%n((`vi\
[18;9_A
PgRq+v/ .d(
-*?p.5P@_A'!d.,X
e tXI2Qktu
HtmP-BGvD
ce0|4C@8
<ZmT#/
?+-#rL
A>!mH<0
Y> AC3}n;r$C
`SbO0/p
v2S2U/)~7Yi1
OD]rW\P
N%}Q0***@OF
ZN-Ku9Wq
,JmFn!
H(cd2,.E>)
'AYm[t }O
U;T:=1
c(>7iln
pAcIn@
A]_<@u
f;u"OHfG
=tH.>|K
IIt{dE
@_lHm(
ts7tJY+9
3>/ 4,8Y
DR!AT:H
P'hE{37\,5
wVTn<)
(<hWf`
l(MYfSPKVS
e8P6/FC
wS-5/"8
YrNE ()4</
7(0rf
/w}j$?j>)50b3(t
%Ap8`D
7IZ& GT5=
k|iDv*q24
R?9lE/
![0*9F#
\zakK1Jt
YBvP,CBX
2)md7x
N )lUdbK
PK5O/jD1r
?.x(,B
mT'B_b>|
md)SM5 j/1
K(@h(o&|v Z
&%xRB5p
uH3?6KX#D]e
8'sp;KV
D;Q|?LT
DMeJ#Z1
Dl[:L&i(_.*m
'{G;L$L
WK<($0
eBu#$O#
A{js9J
SS*Gg!8'
lth2rC*7
*suC5qtCu)q
NN:-M0
8Nul9VDGm!
)9ou8.d
6#UFn&i
o%7Tb'(4
F8)orlhI6#mkD!$
8B\'JgX
%?P`H9
]ml^(}h.
pq>u%g
*-iv&v@R
ty%rD&+h``:
jNTe!#
z]Pi#`
]tnEa3)$
`TTIfFPZ^:e
i&FbQd2QW
1Wd8F%fZ"J
2DUm}`H;N $kY5
_Lu&?ghD
~e?M0L~%<TS"
l7$yAH
`2{9%EZ"D>"JU5b*
u*"H$rD'
&N]%CE0B&
{$?%amo
HDnDI_
KsZz y
&Ju4"+
!OQ!{D
~$:Q\+X<FB
H"7 Z(^J
$^20@}
["8X\bA
TS'^Nd}
!luLMwP\
=u{B|hn+tF
FN1DA%Y@Q
v{!K(1
, u+7b
wtzk]Q
YKPSDlT]
%R9,g1
3rEK81$
n%'jTL
yp+HER
#=).9]!hnR[
hg&{z*,
[1.:>Yh.
@8gtID
v8t@0e`/
7:#EZ` .`J
qH.%NU*2
Dw/Yzu
}Ec`X-n
!bpCy'
OCq36vin
+" 5Zxb@I
e|dnj)#
!#"n)-L,I@
A`s#Y@
b?=ya6
@}O,0DP
e1(hoE3b@/3
gJz-uF
N$(_,oH>^(X~QD
Kd0[jWu
"f< F
,d^ +
l3Hfre
xft=T`
pB'DI!I
wI(ZZW}B]'A-R)z7T6*Y
WD/OP[x
x8=AB!2r(*&Dp
dli)D2
XJ,ZCbZ
68,,p)5RHL_,=
A]#Pt_"l
2L3$t`QN
DUU,&2U
@%%0%i($ba
>%V'm'V%["
!W2@};
buNJJR
,Y'Ea
3_S`<"
1`+tZAK
3X7'EC
K6!0qX
Oe<&T,$`
fi5Z0b)q
3e(3tNv)
fR<e+',HM.
D14FDu
D-tP`)0@f
hqL%|E"!?
aZpV_)T
/l@Tk<^P
=noW,*J* #
't.E0
"XUy?H2N%C>^t,
[A;DK4=
3 <ZiDF'"*MN
4nB8pGA\jn/S@`t0SYK
C[sWp[d
3%9>%L
K\_t0jPt';-@h9iRJ8@
(Bz/c{U'a3"$`<
m2;VBB_
Y>Xm(Ot<n)(
Jf8%`u|@x)
S'jX[q
:[$%<'BK)
b_+W-i\
@8_#f2mp3T!u;Z3i(
Q<KS(>D
t``h;.r
OFX$%s
JBE(X-
u!37xUx$1M@ -
l5]>J0U
2E"=,]'
P(6xBEZ
-FCtR
9$NH?ZpW
t-HcYb<JN>
zaZ~e ju9h
6+0CNLt
!JP2x)
XUVd)QC0'_
(b!*d`
!_!%R)4 `r
t0-+=fO1Y
H~g%^g
^yD$Oq
eZ"A{<
(GQuX)
:?Ou*Bf
Os! !^E
7dH`'|m
'LirA;!X
pL)xBI%_'DulBj
"7-u73
BjhA](
|!.AR=
c'ALRC-'
R3+xd_v8$zWfO
O0?1E+0q[
=N=HFV+
B\/ld]*y
@Y);V{9
sN;tK.
F(>|pE{$[
#PdTpD\
POb#uRB
4AVTyB&"
;}S0&UV;E
TN3iO~
r%L;Z5Nq
-&T,p
h!$YJ}gK
dbJLQSLQj
HK*_@!IXtn>
"ljbw'I1Xy
CKZOSk
w\%^S[<CK%;Dt
0gP3^@)
DTO9L%6OPo
>&~E/f%>KA
O3@c(@
$<t7uP2
|{$!WL8NB
-Y!?FNJBLi
}7="_Okbd
BiHd/(D8K
[AJ*45"E
.TJ'RD
2IYO2fHp,(B$;T/C3Nx$L
&V>Nv_
(Ic/x<P
Pw89/,<s
+DJ{uXa
v=H/ 'QO<#+tg
hHoGD%*R1({w/
q^T~"q/
fu-htaH(
A;}]AzF
Y!%ro-F
(RIB@;6w
;(!\|2
O@W8;P
*hfGLoG@n
3*y(5o
1R7SBKC
-YepKt8`u{
='cW0%/7q`R
/AzZ(8
l+Df+[ rR!
bK(5)PB"(C%Y
9dt5n2
"Hp{2-171`U= [Y
+9;8!C
+a,T*xMEedY
*5 MG#AoJ
I+f+XFQ
Flp,AMPP
Bp'p69
M\^ mjj
QZ/[@:
p'Ai~fm~{
b'BpvQ
D*+PHAP8
U,:Dd B#! R&
'EiA,,
Gw$E*y,B
G"6thf6 K
&G7iLv
/"VaD&uj
xpL40uAObt^
&7L'A
L/)1,n
P;k02|@=)
`M;~JM
+M c&j
t%u%*"P
LannI!_\
&)Hfa|AW
FpM0*}
aK As-(E'
mEu)J[SV4Y
FfY<IPvX
uW0tgBpU
/+!|7BQ
D'NP*F
gIvR@^[SlKAQ!+g2
h.e$x+
(C""/,
]YaH[0AlC(hM
=e%KoG
BKeC'dJ te'
CnA*|o&O
4Oa@L
_QL8LQA/-d^0b
ub(nh-]
JRh3/'E'd}+
E+i#z\@
uE1:C0%
s>H1A#BK
/_B'{F'aUnp<83
E2`a+9Z
A(eB|bv
{b>d}h
}k!:BA0 W
wpTA|ZV`
;"s6B)Uc/
~e^&39(H|
=EIb`H
^\R(t\
$ Et,l!
VB3%cE;9^u
HFO6[kgikN
Y$;-@r
93^vf~NAX$;\
wpQg5z
lZ:5n;
T}%bD*[
bM:u>+D<-r
fHF#SA
G"`a%d;d;Eg>|
sJ3M;wOBuuYi)W
?"E?L:!I@?9Fnm+
iJ@6E
4D<+?!=q
=L1;@t
*G9{ "g:&L)P->_ us+
bR+H7(d
78VBD9
\4B:p9;
U@+#<A!
Y)*XB9(u,$0+v
^[2pBt>W
M1EPK8
@]D3}&
SWGixe,1P
D7`NkL\0R~
H3n+J<
v|>H6EEf
)U:Mx#Z v^
]n+E3A#)
(LTsfL
~bt-XT$/
9]ubHB4;vWsT
sH]0MZ
]2v8lP%ED@
H F=`2UWe0
-tV[``4
/sJ2,]
jj8P#U#O*d &@8`
I&uqjy-PrS2
H(.S5">_P}
F\hD')X_*
BQ7POa
u@LigKW{h
uHMd%CwK
S@1b3
{x*m@40cL
kdh^o"U!^h+p
0xVy0'KT
HA;ox$_,Op
Gol)Btt(Gcp
F2U>,'t=U'ylY*`n"ngd
q= zl%t5/
*@>3JI8
"$|=;%uAN8
++BuRQXa
XiB8!<
kwM$8obt
i|/?xRa&
,3X/+@[
.0q21/
^Jft`p
$C](<"Y/
z=9]$p
e$MPOd;f
*A$%uG!
dVD9uR
-@CbZw!
K1Do_f!q
deCSWp
}DZe`~@@t%
.Yx)"<=K
qvpd~:C:"|2
1+H8$D
{d4!+d
XyP@y-,cf
DL!"!\i(NEQ<
lZ!6cHb9:Y
>D[|Ay%z
#,5Wa|
Q5MPT6Q#
Zr+ojQ
ank;NJ+xC
,ydG\.CSr
eB]Pyo
ifh^1#
HUiWd}
Bj:Az{\)K
v(x|`k
\`dPLv
;BnIoIWH
1T]U[Mh
E;yO+SKk[ Ob
ndG_N=>
B[A~|"
uDTJJ+:t
F6<j*)u.z?
L~%e=b
Ua99N;H!F
v{Qa;![
(6!@_=U
ehM.-2
4q(|aA
M,{ruyY
DGO jM`
?-8'x|['
#&l7W+
FBVSoDPbphdxPXb
L{60EQRq
*58pVEmI
w*NaPB"
*%iD)
iCy~D]opPSMJ
ug/tU=p
/x\RTa
HuSHiQ
%'W!(ru{D
^EPMf"
C "*z,oHK'i
:%tMR?
)Mx`Jar|O
1qNI.<;S
hSLKC
k3!:@hZf7oI
A9^O<&N
F8D|K#
KT@xqK
vH(NK89x
KekDbNN
9v uNG"|cV3@
N'dImr(q
v(R`w!P
Ml>*y9p
(^JIFl
UbX:w)!u
I2#T;y?
%J3>#\%P\
i%%EfM
/!95ak1
aI}{2,F
Bg\E#_|E`
qBmi$Zn(pPC#&p9bGq
\AVDO
E#Zfa`u5Z
coG!}+JPbzBtFk?C#
oE0nM"k
IOE8~@
t0RQ#
l^AF|t
'4"hn(A4Kj
Lc&l?F0
]|@Ttc
# ,<#D\8V
QRV!: R
d/r'9
G%#F-
8G#xphr`9X
PGH#@80(r 9
mGe#]UMEr=95
^u(hSF
#ph`XrP9H
@G8+(
JP#_Oq
G#}urm9e
]GU#Mxprh9`
XGP#H^V?
G@#80( 2
G_#WOG?r78 S'
#wxprh9`
wogr_9W
OGG#?7/'r;r
G#og_WrO9G
?G7#/'
e>2 8=
g_rW9O
GG?#7/8
WOrG9?
7G/#'
sGk#c8SKrC9;
GM#E=5-r%9
G#}urm9e
]GU#ME=5r-9%
eG]#UME=r59-
mGe#]UMEr=95
uGm#e]UMrE9=
}Gu#me]UrM9E
=G5#-%
G}#ume]rU9M
G}#uH)
=G5#-%
GE#=5-%r
=5r-9%
eG]#UME=r59-
mGe#]UMEr=95
uGm#e]UMrE9=
mGe#]UMEr=95
lGd#\TMDr<94
lh:l$AM
%RZ~J/(%
pAJ5H*H}*
=G|1!JTU0
(aB04w/!
".H_AD
"#/bDF
LeB,!tR5pB)F{/R
c]V!xd@<4
qG,^l#85X)
Bx6M["]9
!lFG=0
=#D](9!q
RM]_40(<5MaX
SJt><:<>6>32.*&"
dlmHno
8AMiP>cW0==|V
$`AYURl0U9'
G#pVrD96
G2#F\tr9tb1L
lT<r,9
#~p`rX9<
Gv#fTD6r
8GH#Zv
L@0r&9Tw
H3 0hxFS<
%IxDqp[ (g-A)(]p
\c8Qkba@
8ROg}W
[&w9oG
eiby&ka
T"seRA2
SA;x8r$QH
\+Gt#4
2 $THS|r<9'#
sS#A3v6@d
G#c~>r
q1|aG!#
Ar>GY#
i)wrI9#U
ur59#e%
|}G=#mr-9
c#tb`9CL
9#{;k
GG_r>G
G?#G?P
+$3H;C"SDcs
$!H1A"aD
>$@U-
I5<2\T
.<y.wL
$FBPA BVGDE?
J?Z?I?Y?K?L?M?N?O?P?R?S?T?U?F?H C/IaUABSHD)JE
|.^$*+?(
)[\X3l
)%inco
ble vrys*'
o(s%cet um,y@7dv*&S?
fB ndI
gho>fLJPH4d
A?<s25
r*0-H|8!A
gh3 ~o
G-E1T h
@|NAM(
s%{`dt
"m4nxfd
sQtdTp4
N.P`<@'
*o7(9S
[z(s5bP
dMLH3!J
%6( #t
Rf( e
Q T$9$9tQ"
40X#,L
x8]&2XRl
tdd%$R"
"p@9H]r
9.(4=2
Pl%gl-
%3+t*xE)
Uftc)@bS`
5tu.dO
]Ob=z(x
sZ2(0`
KDBJ0*
d 0 @7!P@<1I
(.t(p`P
`&t HSZ L
[-+1(tR$/dQJ
@0@Th()Qp
)K<1)S
" @UR(&
hqH)QK
<)PPdv)!df)d0<Z@
}'kX}@W
Z)Dc/z
@I@$h4
4I>0AHb0I2p
&L\KERNL3
2.dl8:
69DxeE
RpQJFc=C5`9tSq
GDI2em
T(>]($_4O'\
VADVjPRwJ A1FF`HbSHb
WS2_X8
x<@"G-`
9T(J$E
PhM(ZH<45ut*6TR\
D#!Dld
3 YLpV o/2jv
!h8)-Tj8
~YKee(D
pihtj1b
!6l)bU4<
VTdt6b|
4%Fb+d$zBN3J,
L+,T$9x\
'l>;S%n%
$:1BLX
hZ4A<6w
J<)v<f!Hd
KdOLC0P9HLND08]
um8,P7
0H[r=8(.
BLWPDT>RT
F"k.q]
-kH1(0^
-AlSL0I)
7!(MllA?
gdiplusL/
}N-UuC
H2@hL0
ltX9` V F00
HB20E8I3
P@<wqwx
sJ1!d{t
,: (>6+Y0O
=t1`t:v
B*}a&"bAX
L(H@,O(`
7P:z}09
9) LB/Mle6
UFD/40
0G4.05
XVGER+
>-+CLx
DCdqec8h0
$J(dLe2
yLL8W+
\$LD<d
uzqp.h
|c<{1{z{
b@l$P&
?_<>0$
rbFqW<
#$WTV"
%C{@2
>h@h&V9zc
y20L_s$
~K.4Ol0
1dQy7+Y
go HLtxu
BaLx()>JXP
L|?%.p<X
U !(.I]"T
7yX#{8
d&$Kp5
</_RD618
0V6489
LsXHuq
h'r9:f
`TxLsvPH
y}!T~u!
[+>b(c
7}p~wtN?tp
^d?s|
JBB|j$
'P\gNP`x
Pdv<K1
c:LF/x
`t>xx;
Lo8?tvk.
fvPftH
(?wQ..>6~
bikhz?
hn l$>7
"`Jr,R
MON$d,X
0t9w"|=
@x@=t9_"p&N
4(<%>B<
)D o0+<'B$)
2:Bj+
+a p#-
)}BLG1
=73:v*TF
aZ;ae
W=Z@E8HvV
&21XjK
(N4iTw
Ua^nfm
dD+$H~
80}MX
Ia 2u1,
X'`Ghgpx
8'XGxg
f8xz|~
0'PGpg
P0h000071G1_11111111111
22-2?2O2|222222
3(3?3M3R3[3333
4&4:4d4m4}4444
5"5J5l5y55555*6H6V66666
7"7'7U7d7~7777777
8*858C8L8_8j8u88
9+9J9k9999999
:':1:C::::
;;:;@;O;l;s;;;;;;
<.<;<C<<<<<
=O=g=========
>4>G>>>
?2?f???????
0-0I0|000000
1;1[111
222222
3,3N3o33344
6&6_6666'7A7N77777
8@8M8T8Y8p88888W9i99999
:T:}:::::*;V;t;;;;q<|<<<<<<<=S>[>`>f>z>>>>>>>>>
2i34444<5V5
vOipGpe
UF*|;
)1le*)
nhAO%jf
/' BmBIL
4\=1@b
5w&A|9TKk5
}Cb|*g3Mu'
M|)SauJ
TQ_ 0nRut
bj"jngf
l>-5=m
J5<I)t
fXYZbN
F]p&tdp
'2#xJD
"QPJ$x
f-A`7_
u5=7en#c
?e|$Dq
X6UXu{6i
2m?K6b
W_{t=P
:U!H`"
QU@yh"
&S[+*q
C)xm`-
_<k]C`
~v`N'`1,
KL;{L8
[ah-t7
!6iivY}
kM^d:8N2
X\=P`>Iw
4Qu2_i&
o-i& }U
oa`\Go
XCBh;ONX
wC2"n=3
B]G~TR
b?l)VN|A
?GBSfN
{S4jZ/
I,i9UXf
"$_Qbw
_X{\D4T
Z7lweSr
56=.Vh
OEC(`,
!Q{0TWbO
Gf{dDZG
rbYtt8Q[
rL,T0m
@g`W76qX
.`tG*c
vF`mqvu
yyQkXt
WxpU((
)/bMuM
|p5g=Q^$^
z]c68WF
x_I-~8
Hm2677
<g)9o0
[7s~asSi
Tpj?)
hOxCTAO]
+K&NkO
EDt4d6T
usQIv2
/SrVR<t
[r<06m
@]A)7K^
ml2DS>
]& F[_
>H@kr::
(R qXXc
I#?bQ:0h
^2%lxe
1a2O>[
:lee:9
7YmX"]
?@dV3Y
sB{rli
y,]Rd#
Q]eLX8F
a+UKd2WF
`dIf]{
%n,*XvC`
1Q:WO(
PgZ^A5
26~0@t
y7C:@B
4LR_G^
mlC&l%mU
(`t3R-aL{
IR;]04
Mk/*!y2_g
#][Edj
*4)r!
=1jus%
l[&t-i
AeiRU[
T*|`'s
( .M7j
u1._N_@
g#`B;/xXZ
T.\h3eN
EP=}\9}
Ytw;Poq
X O@%b
)VEZV^'5
~U}EwRq
&XqrB~5
%/Oah3
8"h%np}
mg% ;IvyyB
z3Aml
2u;;>5ih
MdGj'tM
Kj$=`+
_3?"=^
vwbA>
]h:tdIT
1l}jVF
?l;BC9
.in"jb
y{:2VM
u!(jxy
r!M]#b
|+McjtPF
1BKHici=
.:Th!Y
q2Vec$
mXxR5Q
a$>7r>
rT-V@Xi
``Arl&,?vi
d4{Fn
OuW(Q,"I
4JOU5`!f
e{<1~v
dH)Nm=
IsLT>()
wM N_'d
j|0]+Y
r#pxF\
>1BSd_
VFKL\g
S*=@pJ
=/dg}*
j*KisTV.
U`RV|vboZ
]. XtD
1(8IN-
g~Xrt)
%xV"H6<6
+r9-4);
(^&=UH
i*Vrfx
MVs}<'2q{K
<4cu_4
8VPhcu
\Mo0ggH5T
E=hdb}
.Ekw7P
h 5qRZ
toQM:F;
3~Z6T|
YP`}!XUI
nrLdZ90aM
!7Fb@cR
i9u- Y
K|LkjD~
?3PSg'i:f
.sOou}#
H>HX@d`t
2N Kid
ky`:o%
KE3`O>
~G2!`av
i7F:ID
9_~J9
dV\B<v,
g!4C|f
fztP%>k
A0inZl
u1'[c/
_3f`_h
#c>1={
>{|I!:
p2_n|M
uL(.Cl|
aa^|X!
NU\Du"X
=h(LM
3\('-_
?leIJ-l
xo00kZ}
Px)bil=
K\+6<ecI
\vq}`=)nU
R{GIQn
4*)8/$4
sX=$e/
n7=y5\}
0D>{QMO
:>Jb}-+@e
|nk4VM!
V;W+xj
Ul?\d(%0
hrh?P.g^
L*\cojb
lQ";vX
1vZ,uW
-KlmCrl
}[kw$~
bIIpwM
k!jTes~rf=)m
H$R>Xu
?0].j4
$ArMd;
qF%S7_r+
,[KKb>
!ufAtg
+E3oP'W
V#o[6H0s
yIF>Ja
^=#~G4
f+k^-C
Y@.7QD
TioJ|Kj/|
Ey&v` J
0\LtcI
}R8>_1
XhOM!_
BQx#GN62
x4oGh&
/@ 1^
_:m;:K
Kz|#<gq;
?.<~m|
5oheLD
a3As-tuW
l`vrFN
|g49'A
~u`7uW
q;SBs>M6t
./\Q#N[]
.CI1Y6ir
NVR ;>,
M[lSp>
\SVES_
fVKf@x&
SFWRt
/c start "" "%s" %s
cmd.exe
2.1.0.3
SndVol.exe
Microsoft Corporation
RedirectEXE
cmd.exe

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.