1.6
低危

0dda0aa51aaa27b9d09799e927e5a9cd7a804a6641d9dcd08be091eaf0709d9c

0dda0aa51aaa27b9d09799e927e5a9cd7a804a6641d9dcd08be091eaf0709d9c.exe

分析耗时

27s

最近分析

376天前

文件大小

161.5KB
静态报毒 动态报毒 UNKNOWN
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.75
MFGraph 0.00
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
查询计算机名称 (1 个事件)
Time & API Arguments Status Return Repeated
1727545353.2345
GetComputerNameW
computer_name: TU-PC
success 1 0
检查进程是否被调试器调试 (1 个事件)
Time & API Arguments Status Return Repeated
1727545348.2035
IsDebuggerPresent
failed 0 0
收集信息以指纹识别系统 (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
可执行文件包含未知的 PE 段名称,可能指示打包器(可能是误报) (2 个事件)
section
section petite
文件包含未知的 PE 资源名称,可能指示打包器 (1 个事件)
resource name None
行为判定
动态指标
分配可读-可写-可执行内存(通常用于自解压) (7 个事件)
Time & API Arguments Status Return Repeated
1727545343.2815
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00500000
region_size: 163840
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1848
success 0 0
1727545343.2815
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x0045b000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1848
success 0 0
1727545343.2975
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01c60000
region_size: 167936
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1848
success 0 0
1727545343.3125
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01c90000
region_size: 4096
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1848
success 0 0
1727545343.3125
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01ca0000
region_size: 372736
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1848
success 0 0
1727545348.1725
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x01d00000
region_size: 372736
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1848
success 0 0
1727545348.2035
NtAllocateVirtualMemory
process_handle: 0xffffffff
base_address: 0x00400000
region_size: 372736
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1848
success 0 0
在 PE 资源中识别到外语 (3 个事件)
name RT_VERSION language LANG_RUSSIAN filetype None sublanguage SUBLANG_RUSSIAN offset 0x0002f0d0 size 0x00000188
name None language LANG_RUSSIAN filetype None sublanguage SUBLANG_RUSSIAN offset 0x0002f258 size 0x0000000b
name None language LANG_RUSSIAN filetype None sublanguage SUBLANG_RUSSIAN offset 0x0002f258 size 0x0000000b
在文件系统上创建可执行文件 (1 个事件)
file C:\ProgramData\Mozilla\iqbjnwa.exe
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '', 'virtual_address': '0x00001000', 'virtual_size': '0x0002e000', 'size_of_data': '0x00027a00', 'entropy': 7.821684548183839} entropy 7.821684548183839 description 发现高熵的节
entropy 0.9914419229711982 description 此PE文件的整体熵值较高
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-05-03 02:52:19

PE Imphash

a80770833d63c355cd2632bfbb1d062d

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
0x00001000 0x0002e000 0x00027a00 7.821684548183839
.rsrc 0x0002f000 0x0002c000 0x00000400 4.758433933690568
petite 0x0005b000 0x00000179 0x00000179 4.028379476907414

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0002f0d0 0x00000188 LANG_RUSSIAN SUBLANG_RUSSIAN None
None 0x0002f258 0x0000000b LANG_RUSSIAN SUBLANG_RUSSIAN None
None 0x0002f258 0x0000000b LANG_RUSSIAN SUBLANG_RUSSIAN None

Imports

Library user32.dll:
0x45b10e MessageBoxA
0x45b112 wsprintfA
Library kernel32.dll:
0x45b11a ExitProcess
0x45b11e GetModuleHandleA
0x45b122 GetProcAddress
0x45b126 VirtualProtect
0x45b12a VirtualAlloc
0x45b12e VirtualFree
0x45b132 LoadLibraryA
Library GDI32.dll:
0x45b13a BitBlt
Library ADVAPI32.dll:
0x45b142 RegOpenKeyA

L!This program cannot be run in DOS mode.
`.rsrc
@petite
DVC5y:S\
"#;Xz"!
L\YOY;[Ga|qa
a$cT;Qsd!
Me"'.L7|wf
@ab/M5
0Dqv\n>
r3R[^e``'P}
R)Z/{S
:S'UP;#
-n*c{Hh
63x.-$
kU!L(K
=f.eDa
a,P8AP
h/X"&0{^Y`$(
XTgIP?
gljg"|HqG
(d#{{)"(x
(N\7&;(!"
;a#Fcyc
tjxY^M0M$
:+>xe0zv=&|
q*mM&'Y
(-HFjFY2
g@D{;f
"8aa)~J'
#=#-O&D,
=;5a7g?`90aU <Z#
"A}2(
qI&-Zr
B|lrIXD=H
"D%<yA
ZbCsLI
xVGc;
Csns2)0
mRFS0
VB`YwMw)x!RTT
<)3uh#T
=lC00=N
^`>O uYaSN
_9#nr]
l_T--
/'N*ID
Os&$T*m
FeDcke6
*OYX)NrMP,(9"!5
F0F&ElP
JFtTz4>
bY8FegI@
#i+lPf
ssz?)tbUdF{
6eQK9/8<^
?6$RO!/c?+}-f/D(
3oJ=@d
_[3b2r
_fTLj"@
WHae6`AU}Y
}o?v1=>l
!%xXq@FQ
I)-KM8FEe
n>?|.F
JxNdB}
01tzf`=
`xIWiz
QU3f#q*
6WX4@1I
VN`<`.
!u-3!j
w#.!@c
#>k)/7
o;T$mwO
7W4?N1Y
A~uO0s
Umi=?@
|s%z!5
.a=B0sD7LS
/b^[c
ppt{PGK
<7,@Ws
T*D~JM
$[{V5gY
$H;2WC
pK{TosR1m;
_@$%][U
aqXg'3hi
{(qn;?LY[WC=)
P|kdjTc2a
C+Pq@
+vawy^@
^N=fk8:G
W{t\k[_
,4vu8m~prS0En
5W/AI7
KGtFQ;
""Rvd@T 2k
.X&@1#
WeeS|k]
7~o(6DH
P7E57j
Z:o+0k
P#.0+
c^ |04
Q? i#Lxs
%~&ei"AV
*:@lVU]s
"&/cy0
&%OY(4cd^}
ECdZ5<
v3\w|H`
([^GmE/
-;B'hLC7p)tm
)0d0R,
/o mk=,
SetYS
'DCJu!#Q|
zMhOP].
tcwN G
@X`q\cuG
'xF|,@"
am?5{wv
&X9[,@
<ywdP*n}
|P"/&.xv
!s:K4' GQE
stu+O0<O7
M/C|i9Gd
R^_52_}
bh20U}
*W8CJKx
(/$9-0
;<x<M:
0U*&(l(
q1/F';y
@pcJ,$,v-
]LqF(0
2{H~)x=
'A6fDM8s
@7v`TC?>a_
Vus5z0
h<Y LNa2@
J)xZ7Ly`
:0>UYn.
)h\:?:O
dA?"c@|
p4&=hl
,( JO|
mZ>OA%
+5aT1id
;iQ#_l
4k.-R F
D`If\J
AEy9p6,U
J<F\+
:Mp{fb
$p%S" ^
,uRK[d
Y/XYR@
XGO}7T
n2Nc&P&F&
(X, W<
YK!D'_
Jm3|e@
b@9ILH+S@P
-Re%=FAC6vf
.o\zcO
#vga,
.<s_n>@
=(VZ59ca.
UNp0)1Gl
NP|(WA
CW?'g`5j
xwS6jx:
oQW8q3pJ
<rw"Js|
Qb6_;+Qk
HX3&/+
&E>"?>
v-mOeFHk
@F`YP~
KN&Y<R
VoVbRHaM
""U].EE
*,]>e7VeGO*0
~#yr~`
%MGR\0"
j`bn[<{!@W6
@}mkbTV
J2]G<T
B'uLyr$ R:@
A7a:|.i
AkIdbJ
i9-PgX
J{S[4@\
3'L37d
PwDl_p
Vsz-ZVU@|
4; z[~
@#A|K/5
}Hl(l(2)
4HLdJh_
.$Ket)8#
g^n)gErCBv
qQzk.k
NVRt$}+M
@oIh|e
8a!ISP
IG 5_Gm
GpO04A0
0@dJ16
27adQ _
r($3]-u
PYSqNv
@1r;*aQ:
tat?dV$
uDO8, U
v)D>(HxqJ-
&W@aC!a
O!SB^0&
)>ia[~e
k[wq*3k:j
^G"(L-B
,]L-U-/h
HQ1]G3
Uty-2p
<zSYbR,
_`~tIW~T,|
\,Dv!4| T
P5U6L
5iZHJK
H*xf1d
<G$J U
Kt`}8 ,L<
t`R,*vq
"7gb9`
$n]f&ann08
PcT7|VY
##elu<
lWO?u&WK
TI+mZnI
OVW&'t
x@p8#yV
U~Es`*`3
@61zse
3m=sH
6Z4,<zg
A3qzIE5{z
?GY)APZ
]b%IQb
!CaCX)
kB?Jz9*
HsR(rW
@!7Yws
fo9ho:4zm
a,]1i~U
6]Z26}
U(O0@`.llR_1
m>zlLYSP4
j)Z {_B
2YN**?h
W3mAnJ
Gs[d:Y"t`
9H'1tsP
LmboCPN6<i
@&cr*1X?
z'.#"7w
QknFKksd
GOf0M+[u
swcW34
\s r/>D@'T,d3J@9
)`&a\C;
z<}3%r?1a R#
$Gjb}fyze
a>VHr{
\,OFU'G
!H#N?ut7O
('We!d)-
^cO/RM
U2D@K%nv\
VH"cfT,Z
)qMr\)2
<h9)#-e`t5pkp(<
Xa_ltTh*
P7|,YcBQ
pIlGH$4\L
kf(ldX
|napf4
_~YN i
z>}?<
ke5Oe1G
aq)7[(
ANmq#]
u_[Wm8*r5no
(3[8W?Rk/
%?3\0,
]UaM-e
Q|w9`g &
UF=,k
kmqiB#.
;AluS'<L
jWU:C^,
D)W}rV
qIMm"r]
RcTa5_'l!
N&RP 4
Q+tyhm
a8&Siiie
>TH08*z
$YyQ(K$t"
D)X$t1
4MSLHD
4M@8<<8a;FF=/07
@^qsERu
-!f"Ro,
%1(jH$
38.aNT
wcP-U3~V
50!2p(z0)#%M~$
[]ca,
=n1f5/
uL:&3O
dqvYkr
e;E0YW
WYJmBM6
YD51H>&+
1eE I+
kXX/+/+
{+vs1v1?tl.
PQAB%[owX
PMD/?LkY
W(DBJl+>M
lr6B7jPZSb(
F7P*]-H.
C6Q)!][
@`3|La
Nt,>dKP
be"9)Y)_
s\9zNcuenJ
8jL#B
f*G@8;
~\$yXV>`Y"*`(
$XvL@U
[-Djs;
l?C|E(#
](D~DHNp
-/<}c*
%mD6Ol
\Mb1HAt5
O`v-@_
$M\sQ|
Pzqqxw
%APHXe`
Y.WGmT`*
C\^Yg>
'gf%Ib
ZA5rie
%Y4U5
@ D;}:C](HQ{!8wE.
QioZh7LW
aezttwe}#)
7~xol6(u?:
(lIcWnd+av2
+zJ'F\
BM7$f1EP
m K`oV
\{06@+}/*
Fx]82^@
% jeFL]t
a}SSd"68
n|"\i:5q
0yMt$hd
X@ksw[
AtZz;qC~_
GP';v\;'"6v2
q_cq)Nz
wmqozKBOj
~Q-L?fj>
3/k;F}[
:zjgTW
s4$+?+0
G"FIw*7A
u")u:0
:I(bk3 {
7B\1Zpm
1}HbD<.1A
uSMfDY
}z-cJ;.
v6u8H*;
&]QB3eW 8o
;E.2fS|*p byqG
6WP{9FU_
c]}hY_8
K1"OO>Q
JyR$"/
24ZxcH#F_\s
{<I] EJ
?B5y/F
l"CaC#t
+h@2o
Gv=CLR4`
EF X\A$:+=4O
WhqbA5O
-wz9lPlb
U0a I"k
+`f or0OX@
<09cYc3Z
S:CT]b+k
G[+5RsfZ0"
qA+Hoh
@T#"\OW
U:@-ZNG(a
;(kqD>8 >
?!E_i`
nh3.Ub
AD4D8,X8
Z,aP{@T
X_t$f'hI?Z0
P O8"c
c_zQ'g(
"wk7'
?>_E@`
@i7vL^{
<Kz$QUQ
:7l/V^XV
.-6Mm<
ir*~$FfqKM
$F1fgb$
^o)D"Hs
EDLiZ6:sD2?
YaoiH$
Muw"(9
^,8kAgc
?14,"1og=r"
^(fC(>#JD4
]mKAaEa
MZd"?Fw`0
\puyEQ
~eaDK}(ZO
1;qQA%1m
zdl""!r
"uJW5)`X
V;d>3#oM
.SW,]I
2N;M1}hmq
=0"w:|
h*HibsGDYd
&/&3I(
JLe, ",$WzB)
R\MPgCT\<C\\A<
6),SrS
N,4E>D
,x&C,/
E`#cdd
EN,=a<kTQUyqHbyaBrMX
,)Sdn,,mL]x
VxjNgN<MkH
;4XU|qNE
MQESseIb5FX
"1kj#^`
B$4IE4O$
|09{pF
#OK<pZ
1eCh4MDU
)r.i$+xQ
,Cb+`iRzmNr_Q
c>".9uEr\dAr
&,'(7#2M.c
94II[&KGO
MAW.tSc"`
&f0j|_!1
A;s:M5meL$M?QQ,b
T7g9Z<B
}WJZlM""xN5
TvUXQd}
,vivaE,
RSBG/UvI
1:!sY?(SiaI3
GD8~x$
hM=8\$*
2I+,8!xTM
|dy',YDM<"\g\^|Y70Q~
F$i`av
\5WQU(
r,@cX
TZ%Be+
JP_3GTN 3)
DqKL5b
DdH#c^
yDD>l{-{
?9`Dr* #)B
&h[eG
cLM\(!Lu
b&h f,x
a[i`,ar0}1
qEMYj'#Z
T3C BA'
wpS.(w0z
1ue3vc
I?q?0_8
w o8W0_87
^v_>_5_
wN_oV_^_V_7M
_Ou_W__
a9]qU1]qU
R0a$Z(r J(
r09zHA
Ow_W/7
jXx^HfHn
&I8>?q(&'i(.?aX&7i^?qf
?Af7Ix~
1hfg)hn
!Xfw)x^
1V9V!F)F
QV9VAffq
VV!F)F
V9V&&1
V9V!F)F@
XY RQ<_n8>}b
sQ3;B\O
_X>T,of]}8nbY~"^BngVa
Z-S+L6h
q|msQ|Q
3/H(On("(I
60"D+n8<,
64L:ib
+b+*7r+
J~F(9KXQ
%E1qG"UR.Q
EQ^6b,Drh
0u)aC{0[`
c""X\o"80
38puZ2|}Q
B]&e`0
<yo '
x"^`7F~F
4fLVFJ
xI>P4 R
$"eg0O
`t%M!Y=C9[5(
3h5((|`dXjitW
@PMhImI
1;g%lH$
x%KG8!TGs$
?7-iH4SOCC(t0@Wb&
1cXrZ3r
`ZTW=|@[qse)P
HYmi`Q
vT}".v-@9!IDQ
YNq]$k
IE1QUI
V!b7yVzSGI
QYGJ?8#
r*KX!sG7k0
H9*lh[
Tq)}wc
<7B<22
GWhQpc
iZMh]>
wW vm(Z
@:."x1
?X#")?7:8
jskZvjz
ecY[8I
:}R9 I"
h..;2H
"cNE\3D)(
@sH+"
x;j8-b%?Ov\
(Z:H9%ra"
{Vo;x)x
K"&_/6BR
"8TkV{
8@*_[9Q2la
0p)tGeP
)#} h(k3
p%wQ6;Y
Pq1)6j>
C/Oiy"[8
($,]$6 PN$fc8?
tc-gB
)==3.)S:0"#;97
&oz2qx
a6P1LOnH
Uwj~3q
8]joEwp
rq4[#&VZU
x2y4ePct~
&irwZ_QbC
j-480f
#eS2ML[
9m mTL
]<Mv,3u<+
bi@%f&
V?X08`
4MSiL E`
r$44(44uO
?6L09` $
&JJBj4EDZT
.wBki"
'>L(0g6
YRxI6L*X
I^"Hyn
81`z.1$
q|zaBWz
tCG*<La
4^4&D.
HXP.]6A
L7R1'F
l/>"y4)}=t
e:g/P
k6VLCsDpe5,
&9S?+y>/Ej{M
De{$~ 8"*
~QO$Ju
n4F**2
8we5{fm
,<%x(p
s6mwCx$
vVk/0#hPK
JX'Fd^
3xhxmX
#_4Z#c6[
bxgA<(4W
DR?,1V&
{"3}iQw
}!c&fD
LxIM+T\PuPTA
tL:FBXsw
.ExMI5
yOWMQZ
Q[}z9
r(r"kt
sN2wY$
#)= xA
{8>!N>
_suKq-
E<(}!Pf+
:>lY vp
\r>fS\=
;3n8fn6
P0\lW,-
@F\@B:YA2R
eERdi)l9
^Bau0n#(
3+DyK]a
y"aWc]N}`+h;
`;g{,
7-:kOsv
yEE`RPoz
D"7Uki
L/of.*t_
H!!'e+DEN}\
+>O`s
yNO!go
%2y(O?{4"
qiHQqbmCL2(,
Jb:"?qQ
`SG^e
3IC0X:x4`ZD
J8^UKh9
\_c<x(X
{{pj}.
5FU5b,G
=H%mXF}
*jzTC
`J_A#5(
Ey<+8Hl
w-/!g_
XZe'8X|
S^TE3&q
[vJ2x)@U
9B'^$7
u`S,i&
~@yRwUdw3s
BN'.4'3-Tp|
_9R.g'NP3`a[I
-5"`JYp(l(
xL./e{7
s_>zK Mm
"vr~szS
4bfIZ#O,}
W7*@1<
S|2Oa:V{7
@dkUPW
GnvQaq
BfTu.*
*ME}\dW
Ncdn#4I+pbV2I
fqqw5!wtk
r<L?26;
.%1+w-W
n3Ax] O
yj a6V
Q4_6"}h
I.|=$cu!<
hA?|_#
F~J,Tp/HwS
vjCG=O
Q$'mnx
XX)2$U
`&Y`?4flU
):-XF8YN~(
"jW/5PV[G-Pfwr
6)5VyJ
xHh/:;k=/*I
;R/~&!
@8N`F#$
36~_pC.
@~yGX{
s+TWW?
&HiAh~?7GWW
l0}>&S
KBH>*NP<.cC
zAdoEg7
%%NAmK%
nLr)|HP;0`
&epN'2
W)S+O_
,ycXr5TC"!
(+7x^w6Q
S"TuOO2
.reX].3
|5#D;7Gw
(j1u#5p(lBMM
dESD_&~
Yv/CtIXx[,D
Q9b\OU
/xT_PYj&
J2h=cf?l
?5 (np
CG>'<'ABu%_
8ygjv8
SMN^'upp
@64xpX
Ue'^~@0`
D{}'S{,4
J~cvO
k|yvQ;0I/DA.
y;Y'5d
dO!#u'%'
'tCAbm
KO9ayX;
(MZ5Su(x]
h+y-b\;@
YUX1K8-"
=USlKC
8OWU(D!i
I_|`7|
UL6,>ME
11o$iF
Z,b]WL.[
!d7c.ri^,,8
.=2>W~c
9F&(HG^#$+Ch
p}HHbH
p<[S'
J3j$"As
B_]MSX
`uDdk|E<]
_Y4@2"4
T:gbyqM;s
G?z~ Q
O_u\L **KO}q
313,2b
;aN]Ve`
T/Eh/>_ZmL
b\US?G=IYt
Gkqw_}!
YD(UTL`j%'k
h:3<1Y
+Ap8f
44#KK6
A!cUIX9"*
=].DzaE
T<g^;=0
$PK^Pc
m6`\+o
a&Ka%;2?
EH3T40k
zlo#QxjQvs
dxV;KJ+
`3T#c6
c3["yrL=
-{PVa3a{
^c}W:5
2kP4|)
5ACq~?.1r{G
RwXZpu~
OMWvcM]{
9B+ _M
275Mxr1]
ZJ])2w|TAmsw\z
zq$,I&
*W1z4 @
$O!B3'sE,[z
pu_* "
q)eo"3
nu9RB|{m[
$@:$eE
m]^uMmTcQN;
y:q`Fo
EZf3&+nPr
Ow8^!e83XP
pJ:J02<`8
&yBU&EL
R~W+xQr
5?@@oGE
,kpv>dyqX
'm_En=
'%5 d*|[
<mYP]2h
gZ[(&oG
?l7Zb3A-k
=STq+K VrU5X
Q}t~<gsy)j
!~bFBPklDp
R$6vTOM
/v.oc.
W(e|<H
H-cAY>sw
a$7{4m
<lFT%m
z9kd9
Z%WEHh
.UR|}N
R'cSG]N*h
(SF5:!X
vjq'q7op6@
f\3r4
=Bx>7eGL
mhl{{`
-d6A?j
INj1#uQ8~X
=MV0~a
-yuq&Op(
4YK?uA1LzVPy|
N'ULhX
.6v_N@
u")<~l
A*9aw\up
<+4Rsi*=P
J(E-w
aj`2*Yc+;
cCO+A3
dI_jCs
*S8\wcEJS
dYb!wE
Xv;rMI5O
!O^(!{+
PD(i:,
K!M+qk([0B5_ll.
1KG*\U
iPwXD'_
M_F2< j[
GDGQ W<
\YUApP
C6p`f9P
qemRE$
jKnbF-*
Y0Ss>x
_N7-YJdU:
6+e9j[
>k0K>6
49n}5N
|*$8uC
fI(%e?|pE
4NVO4"&i~FMa-N
K`]pwhF
-M:*+w
.JsS?bW?
>? d9q
ks%v>7\9
{n;cIPe
@>]7M'M
2'GcT@@
B)m:4& jR
?4S+Y.A1
dKYS5>50t*
GwM8V -
BpF7%;
VR_pEx
!!XNQ+
58;(qO
A7rf3\
#-w&YN
*5%fO:
aRAd)C
"Wa.y_.{K
>${gru
*0cc$s7
-,,+Lh
>#/'*-
}v^<U'cj@:0
,d~t=Z
}s!"dFeA;/0}
n2g`h&v@&u
T]L"w :
JJK!O
"X>iD|
=&pC#\
cFJZ~P:-
*n[< "
/d}J_wOZL/~a1o^r|
O%./>*c
s/xOz:
p5P_Gt
rGB"^g5k
>thn8r#p
q5,*gh
3INn(^!!
GHQFkup$;uVpS
CE:?rrE[k
~MejM:
#!z"cc<M=
1C+9~y4
@,qG`nk7<6
D\[.h|
2lzn-Dk
?L#zT+f
XL(;Xa
;-[8f;iE
a5P=7{
h2:x.D
o4jN/y
=GSSo_
H/7^l`vh%
"]/[&,.
pmqlP}H
?f;lP9
^pQ'0o3
J0d82C
HfVxTWA
gFjvf-^
c*dRu=
K]sCUm
Wo]{Ejtn;f
?bW:Yr;wkWy
uEt;"{FT
+vjqSK?
Q["L)b
~^22?9.xIH$pqc;
|r"OD
jhh=}ut
Pp]Qx[
L+XuE1hHO.
Kam=h1
$* q?[ 0Wxye7
b:9[=Zr
LAX<6J)
%#R;Pft_7pI
0SC\B^
Y#2j!N@ucx
YZh< }Mx
8zVv p
X+mc3-
!EL5;<f
3 ,dW$+~5J'KJkKB
Y2h#'ZsWs'
QSw;m@H
t=A?^/|
kyKn^I*WW
eX0M=@
~{nu\&0.Q
1*<e[J{Xu
MA)>6F
[aq].G(8~3ia
]8AEcHK
XCpsYeK>
Zn1B;)
lD&"S*/q
Cw,@F&?
HG;.jlQ}eU
%%OQ9K
id1n~d
FK]rX>.pi
7M8){w
O#.]Umz
Qo&-f2
N2fw^P
R^iy}_
-12zeO|fn
"stRk`'
v!_cbWT
}xg%K]
wv!c{Ck
hl2{>nM
vn5Vo/&M
,-r]leriLg"
)K1EL^4Kn
^}*'MJa
@RVcK6
pr]}v6U'
1l%B}hDEd=v
HS>~#!5O
QZ7Qu#
(v%Le6GP
2P/_a6.8
4)%,Pj
.Q(;V|Y+
6fI[&~t\j/
L"@irj7<
%uX`]'
f5~]6C
[71e!ni*
/E3!;1w
L3;sH
d$T~Y8nix{q}'
18&wow,m-2$.
:,))&A=
zVS"!y0
9"GPA5q[@Y
D"7F(?f
Zt/~G1
D#)+j
0juaa~RG(
@iu~xA
pTq/7)D
[z4\eEJO
Se{/PTU %kYP
fWyD^
qgfE!C8
rUm9@l
~7O\h6f
Jb)Z5&$>
|Yu@5+
6GyMTp]
Y_\{*s!
5 m6Bo
[,"3EL
Z40t,F9
O>&{=q
T0R<bnr
Xc@|}3
<aMPDOw
e9|F0^%,&EEO0
PgN5!b
Q/d74]jh
bHEb]5i
|>{wSb]F@
U289$i
:l_p H
+.$YV7q}{?F[ym
![J7IKxg
#{@F_\
Q|@sm9FV
l;;}S
uIXoA{[
K.}}^K!
)<PHp
%LpZcA
=j1F<T
YNTblg{.6
A FR!@
}U2Eo+zPG
u)A'y_+
5OPfYd97wS
Mgp*3\^
iS`k9?
Q7IlNr:vlX1LX"(
fJL7gjR)
2G29fa^.#
9HL(>^
fjq_C?
*r#]w(@
o?d|Fx
CY7^[#
h_Bj\_
{&L[?nvl(
0fCn#m
-W)lgf_A
x2Wk7E
1W?zYe#@w]7
wdVpT>f
h?*Cq?
gniWrs
et|uo`
i;ZwooZq
a%tC*
u7bOQoK
GyJ$5s$nXAy
"ff9,3l
Dh<l{0N^XN
)"`/Eoq
fYu#Gk
C?5w=J%
o._qFrPGV$&1
m"+k!j
Y:qNd
42>m)G'n
@Vg2z~
0+iI9Y
HPf",aE4
bl/sY[
!WV.EYJ_*
4F{\@aC
Qao2skK
eC!tWe
;F_mCwq
j6C?l@
sd@)xt
XL\)#y!
ROXn= YL0
OB]bPSU0
_yLP;K^V
PVl~eV!
)h`JDx
r8of:8Hu
_~);,DX
pLdlDbq
-Z.sZ@
*VISm`
Ri9y^'U
o08G|59
CH?IO7D!
yyuaz:4
.Sqxi1S.RG
,D_,l(l(":
coioBh
wWutMZ
6TLs. }
\t~AtGv CH
RjC.x2Q.
blo7^*^
mLC3LbRu
)bcH[/Ns
X/22zy,
T<P3Qe
}!>wii
2tE:&k{e(
E(iwE
EHQ5UYR
h9.W_l
vxtve1
B,{'y@>=@6j5"Vt
<2>La#\
$J8^B<
med3k!b
!r;m@S_
-?&a[SY4^
)T{@r5 D}0
fJm`#iJ%:V
2(l($R
M80Vfv
/gjXv'k
<24Aj5/h4S
vqn#y8KW
'5bP\H,8h 1
4B~\};y&`
e[}?isveZ
bjlSMQ@*LH1o@,
=4.K81
CJYH,6
IE+G5G
[$bfOGW^RD^&6'1
TVp\DF
#C@o!r
(lhy6j
6='k_u
U:jQ'B
q)#+_J
F\}Q){}m
!m+?H+IP
+K6D{7
P!jfTG#s3c^f
BL@Al{#EV)5-
H2=Q~!P
,~'Qd
voV4LLnW9PWb6)
u5K[hF
NK_wF$x
hz>6SnCW
rYI^=|s
vi:)c/W
D"$d9}}
6772Tk
!r26ED
<!?O|7;
3([^ -
Vz,B:2\&:@;
BRh=3HF
~-Klht
fh:_gR
2MkbZ?
$^3{JqH^~
EvA3$0z
+%\`13d^
whsS3G
fMkXo[olf3+8v]
9W;c`n
IL)#98a
JiQ69pO
%pdO:q@^T?2B
I!u<Y0<}
<OKy.r
gW?wFz
1FafGQN
t$sOb@SU
z]"WQ/
gh`1r5Wn
xMgnP{W_z[
BKwKDt
64-gZp
T/.JcXz
#B@=PAe
]hsX`F5
%sgm,]
cgv dC
zVJwV/
f-au>J
C/JuJ_,
+h'7B?
"g9%K(
`tClZ+W
SKdm|2!s`gI
yHV.Ob/
>6SIO;-
,{mBkvr
x^DjyQe
-&fffd
ErNrqV
Ei_J"
t@ ]9UzrH
l UoJV<
amaPPl
]L9S_2-B
\2n10~m
SJ3BAuPy%
XZWNXb
@|TOCoP|<r
ygS1r~H
8p0WKd
@QL\/d<
r-C,kE"
*Q%MoODZw
@)@6!g
c:ss6{
RX(<M'
g"H.xX{
J#q-_FF@Fr$
kLxhH$
CL"|;[G=o
xcrCCm9`qE
_1m-8FX
P=%befiF
QGW$1/
|B,pU\
5ZX~@Hn
n'M`cn5A'
;,awHH
0:Oe}>
LqW {h
qzN'VGbG
F_Azxr3cpD
G1TUy<
hDsm:HOIS/
A $z8DlYz
)t<?-A
DK@)_r0[,l(
rE{W(=B
q/TK8K
tG8?WQ
;RCFFd
xWR53SA
,=& rs@
94-aV,U
5/2o 0\
^4td@Ah
V;__%
`Ap<U
Fn^!KP
L(uASqU$@o
\R(^Q=
f<0F;}Es3:a
!6?TG9
qCj*4J/:4qJ
i3"6UI`t
^D[T%89
^)Ux~~
DKPisD
1#0:l.ak
D.`}Xv
`!^Jg
=eM($=i!k8
JwHP+5oc%$
D./U1XYAC
.S-bT{>
De*'51H|
GC].0&&9
\hM#0
$b5<3
@aouC=
h=C0 J(h])6c7b?Y
tJ9u?pf^:
b'arp}
4L]:up
W+6-@i:
dN$ca.
,6P\n,
Qnphh*m
|!%fF^*fl
LEoYW5
9alRc"
+Oaxp{Nb
#Lnjv3
twC:T~4j" e
ti`dm!O
qR*9"3e{-
Wnf~SM
^vTW}%
};{{D)
&Q./(#{xDxl(
(xrtR6.v8|
FKSl0@lv
'iEwJtLq
6d)zcg7#
W(& -F
-+',Ny8
U5d[qVH~X
AD^xI.'
VXR44EI/=
AAcO!%s
1+Cr,
p!-){]_|h
S9WdFoA
nY/3`hM
9iV3&&^`S_N@
Sh;S{e
5i7p>JiD
l=m.N1
MD\)\cyN
bT;xJ3
p_x> wph
p=Sx"$!io6
-,xP`4
4Qs|<~5f
|yy`Vu
_Y'|zI
PzsvvxnWr_
_k/5?k+NC
@P,|4`
0Xw{W]M
'%s;}%W,&E(u
zsMEH8
8^,Xb\\vkfh
h52[zm
ODSVzU~
zy1#w5%}l
gxEN_p
B~hI,@1=g
U$C#x#c
(0X.^U
.CeR6W2@/q
DIlI\$-M+
+Q$pj-q
8iBCpOH;=
;URdfb
GDjO2$P
2}Y%oT
[XEjz7
.28 #X
/Wg)@6
zKY"$]
iRFoN}/
=.ed:5D
x<cSPg
I`HqiE
CGzJq~
e/'&Z `l
=T>yA;V
+_5EI=q
7cOJ=Ea +DVb
`B`iRqb
{>]$./7
qZx~HP
:3A7vM,^F
'zQ+3"m
MB*4zPm
j'FB+"l
|vM>I#fo
Wa4JHx3~@
RxKM4GD
Y*%(A|$U/6
B:FUF
yH0;l?b
l{AVZSo'
I)r`WIwNc
I5$K^+z6)
=:"8GrU
UT#^3
xw@8zj=
bUv>IC
}soe4(
~Yd/Nz^)dy?
;z^O1^sg$
:wdH6R
yyuFRF
=p]:C3?
QpO5M_
%Mmy"aX
d|)A!4B
|~q#X<Qxbj
z@v0+1?
VnXGcYF1K
^O-u},-x-
^l= zo
`V^&"6
I&$FGG~o1$C
r06ZvSD
@P;YP"
@.%R9\H
NF9|nQoO
L\:J{4$
=5Szc/_
sjc]nT
3ey.4
^EC S8G6:
H{Jt<C#
N/QI)*E0I|4y
tXtk;syY
+m`~E5
NSP_1"
mG;|fR
y!cj7O
Ljt7D^9XZ
jY5_.
(*-X|Fu:
?Mam-RYGr
FHl7`})=
!>]W]E\
}b3iJ"
dEekH
ig7,-6
SVv)?
Bb-\ IL
G3N;=*,T>o#6
6'ZSO"
z"n?GT
9oYv@c
l--7rl
8b$}a(4x
X<riAs
6zgrKpd
De"iod I1
7$,gx(G+=
M[gA QJ
wS0:)7eXK
[eUQWW
vJXEa{xw
o@_9?!TJ]U
nHf35t
Y^{19N|C
rI _'@Y
@.]!+)_
D!Y>b-;$$
@a?S2ub
}A9SL"U+%
FZ','7
QB#Tax#\@
&A<2-}
-DR-ir
3'%F3Gh
V^EKTNK
7&qW*
sSPJqxSE
x(j&;9
zPr)CW
nD1*O{F|^)
E`bkjX_&
g27~L=
u`XIMP
_rQWrc4
bF`e4F
#FUZD*&U
_8g5H#X
^_'|)@IP.k
UE6HInp.
0NZAWn
1(U{a,
vviqeCtx&B
Z]FK8(
bH}bb~-KT[
-5AEP@_Ugh}[
u:rM@jD+
xb@3(}K
vWHZ$ihly@PFp@
/+8{h5
>F,XQT
,62VM,
z7y=-%
~`H$oVY&
mVQdme
J*sZGA{wM@
7L<Oz
2=fy^~
$q+~Kk
#1HOpO
O!v![U)k}UGO(
2YweZ
]_Oo^nS/C
HqVAz+
CBe<TW
g?Mw&h
@cVmZ`Qcb1r
;7=oMby_
)tm[Cje
_`GXCYh
?\[;pP
7!!s5i[uv
snY2{=
=KE!Ad
o.@U<uw
9q[yU
Tat==#xrDz
md6f9KT
qH3hTB
J9M(b<WJG"
56xi?>r
XZo]"v
,a;/-,
HG5i'}
{U{kd1y
FG'9~Q
={_lLH^OC
5$G23"Wy
0'XW(>Q
?vqHnS
H1r*{G\g
(?|va5s%j)Q
~](FuD
kH_E+r
A=:1'9f$V
1?_puRaJs8U
S@A:3A[tvH
qDKR5T
w)ukZ+R
fm*OFh
u3Kd;S
+MHEp"9E
ba[iV%af
TR|yx`
=!AcjG7z
!jdtGN1
]O_OMy
)P]1z\x
+7RVB+9
f=Q9'+B^
AuBhOs
`LF6lM
|3x&B
Wp}R]Q
Nm+I>c9
y.HF:GgLTVne
h'vwf,V*Ek
jg+LrX
R^*%--nX
&oo$U.[GJ
If[Hf^cI=y
NavF6F
RbJE4e
=Vb;fF
n4y<s=\
fjOt1Y
#Tz{7_
M6+M[1D$3&u
+:VE@`
Aggk8t*thPD?
!IJOC*t,
BV?SbH-
en|9k,t|6vK(@8g
H`Qj~en
BXz]Dau$S
brIdgK
cmN60.
G#X;LdEjYEm
'F{{rjY
%Pi0h|%R
^;B6HEy
n+%Y6q
X4p-Fji
v3wtQ
Pz4UcG*
]M%:CkXT
pwP8dHqy
o]%-fKnT
Ez?X=qr
Z"XYxJ9+9s
/~$69.
`+^.U'7^
8x"qe"4iwz!C]5
BuyF(0
B@3cReG(IUpq
*={$&\i
n>Sv[9q
yVU>~22h2
KnY,|(Q|TD
,Gfk>Lc#U
S3B#)#'(c&
LbxcjR
C^#HJh>
9pYPWU
OiQ8$}(-
8KBGt5KE(/
R U:bk
k/a>`]
2yGs4|4h
B!fiq=:^
B"HZw<
piZ5&0Wv
"ssG@}Nw
FIgubX2erb
4c[$w]}dy#
JDsgPNHTlwty
D\|4;IAp
Opp|$s&`m
M%w1B[-vI
cjUJT0St
yynk_
SDR1=}
yicVhq
i8#2%Xz
pII`z!@|
O,<Ln9
T[C)^K
=)D;HJ
~:W#V5
N>:3F[}
6N5;me.
n:0'cA_|ybwyTA7fDE
KbQIDH9
Q=*R=T
xSJ;^_.
}EF1w@
Lxr-%H
}/b"vl[U
0?~u]r
\gG?;J^C>~
jt~>pwI#
D-H$$qx}
%(;>G*
b?Hk]<
$+mu!c
a_moWM !V'58 DEE
B|0r#beK5f
tD#Gw'wO
r2of|(Q"]iz
6Wd`T2
ev3/|ig
;.Fb?I
T#5J.7Nv7i8w
t~x8-$7
Po+>&L&%)-
?^9*!^G[|
c8cv=\`F?z
#wV4cO@
2Vi8#xNy]fv
`w,oc
3pexT&F
/{Pp;Y
$y"yDq8s}\P
S8$FA
CI/cdFVn0
Eq,Ul]
;\f(!Al3?
&ShZ!#
ikq-80
08'7~1
~_i+7nlj
REN >|E
a3TAv9Bo
3x;4vy 26#V
jNe)5o
KwR?aGEz
:3w{|,T|
'(O`j;
=lU%|L:
0w2FbM3
<$Nh-Rd
|uE``0
Milg?']^b`
WlmM4y+L
L414u6
stuvRi5a
20:`^XH09a=X
_ dH"kR""lc
y\X^"_r(&
Ptx#l(<
10YM,e<:n
JeRN(G&o
%<SH^H~p
tt$iF6
0CxFA0xwpwA a$,p0{@&
3rD"+P!leD4)
+6Xm*}
pbH?b(a
P3dK6N[@@5
)J\|a8
c|L~"$
QH"hKe
Ctr/""Z0
rDDD&+<=ODDX,_3N(
4cZzGn*DHq
)L}pk-:t7
87hr
2) % @K"
Qy""""
;hVpm1=6Lla"":0mCX]Y
*"ak-DD
I-|o>A7DDD+
Dtch|e1|U
LHDDDg<hv
"UJ"DD
&6to]gA
@s9_B\D
)#Gw2o@
@Va;n6z
w4;(*GF
@>gB5a&
0|4Y($
@d2\}$AhLX'&!jlC.
DDi|a3|H
>N` 0JU`
_atCCm
Fg18:7
_wbFNMGDDLsKVQL ""
8\:O)@
l3i3p<
lGDDD!&T4`
gKaLPDDDDOZHHKV
fwl{j(o\c'<+/?!s3+i
Q+ dH$0"$
M\Pbd(
gyb|fX2
nSj3D{;r!:0
YuLO~5vDmD
y^~J VJ^i&+
B=n=ZEbJQr
J|ob*qJ
@+nQ0
*F#":e
+#yT)+a
&C?S3i
]ZN*4D
hX[tI@
[0|J?>)M=
BHYrvu
Q>xb@A*2*a
P9D2uZ
y;^+c.$_XX
kk[So(
"pdfKB|Y1G
'@M_1^_3
"csuyAD5KoQ+R
G&u-YtatdEkdJOIU\`#
&%M^"h"?:92|1
0j_<{(
r.TmoU
$ y5t|^
Fc %OrjC
xt]!a(u
i&!LTurl|L!i
!Go_0X7g)
cy#hA {I
&rM<0VN
|uUaX
H""{dw
D"1|nnH$
M5JoeS=n33%"
&%1:">g*5`|VRLm</
"""bJj
m(jm,Btm$
`%rHDD$l
mY((}]
k,rDbiG4
R3^[C*D
oMQ4u(
2>R2Vq
e~@(!,Sr20S
;Z|`DPrUd4y!
GG@r&GWMgU
Mdi'%T0
)XlK5a@$
lTc(l(|
"kuM&diQ;tQ
O(sYlM
8uIZpV
D@4Ct
IvK&@Y
H/O$V:^P
"M+S8D7A#`
A)TV-[#iR@O
BhrN=9
)M$S'^|daeS
L*d.0G"V
kap_^,
]i]y1MU
S2->Synf
0m4ZjR%q
s\gk?glP
Co ",R
O)3j-< eK
"D-iCa7J
|L\IODLWz
f]Oo`@7
6]9Qm^
xgE#$sP$!
cWegrXZz
bkU2 B
4 :),o.#6
1tvWe`tHH*?_KPE8f
xt'xTcX+R9ZW
Gxha@bAkqy=R
DW.@%C$F+
=BF<ZneLP\W'b0
=9T)!3
DbREbE
@b\@5EDR
1IvvX+8I2I&
kqC0A@JGL~<
Lkt2I=G
8`l1H>.
]-&(tA
Bq+u%y|B
PIy}0<id
<031M<
I!51+/*
}n_B?KI,iE
0"S\,8HBhoiq
B$.L;&|Aw
"&:b.T.
@A3&i)
{7ME<S,0)Dq$$
oK$z#b
R48is.2b<0hdpWaiL!
bg0LXv{
8`s[JQD:
G\%:'3x`
974MED^fz
RM4}[J
0q@e`C
^jjhj,)
!~Vk@ZI_X
)@fYBdfFJr`\
K|D5@+&GP@V
DDDDj#;`
u0!j#j!
iL^YxQ
chg~-r1}
saSQHa
Ai&Q@NP
\fC!`G%O)7-
;1Y5692
onL!*Hm__T=kIe\7g
$pkDh@|HhU
:RrQCp
B'=.;""B"^#z"
I Tr?'
\F|PNnxP9
c}7Uinnp)!E
aYL#IDD
o34j7)
Q*Y*JDDDD?[ ~a3>X
.V*@$E
;&b_pC
) pZC#`f,aGsO
jU%PB8^<00Q>4E
p{xD$I
y^DQ`v.)45
hc&"B|Bx,
XDDsS_
\WA/#PQW
R+6P%_,%Q;S
x+BP*309wDD
;7J8(E
JIE0({RAV4`":DPetdXB^
' opWs=Zw??
>*&b7fS
v^re{R|
A49`6:
f0_9GDDDD!O)G
9DDDD
]vWHf
pp%""p5Q(
3'"}<B0>!
ck!""s
x`*)%/
$24 J),B"(Z
@"-Gu0
Y.R&O>HX$
W89W_
Gt^PUJiL
PPA)k'
p0""Zl.l)9X
Ed#5Km%Q@9
/p!RS`r
4I$;Tnr&
<_$~Gd[xv\D9E]p
/K__>4yE
1p$[!`kML
`mosI9;
"b<V{)/^S
x9`;1^N
`$2?C7
j>li}>%2;
AWX(zo+)
9bCcIg ""BHp
#!9fLD-g
FTqZYs
XL0LDDD
FJnU"=?
(eT1Zp`
:'|{,EH
\jNDDv[kPN
++J&b""&^tp(Wd|^ta
oYZE@UI]QuP
<^xe|i
Z(!>,<
.IvE<f*
'tqCZ{YoUw"""xH_Ki
^26k>R
\DvA[wCI
aNG$"B#
0+_S )
{HO0{C;
Jww}+*62:"""9"8s
z$""I& K
EQDDaU
8x$l`R
Lj)6Z0?,`c6M/
(n<E0`
@o]]Wve?
Ra$EBELOF
Qs*@sJ]
CG[$"""kO"
/\:DDnC999
Q%gs)m
I^bR4UUv%^:z#nN
@"FJP>B
i+E]r7AA1s|(|{
H""Y$:6w
tdZ04k;u
E]s/dZ
u ZAn8L
""R-ji
]AKjR@
X""&AL
an."0&XD
@Vv\p7
B}jlafaf
" :9V6?2=
.;8*B/&H%"Pp_D
`FnXdJbL]
X665C"9`G[Pulwfpfxec/
!K}-xf~PN]t
""""QyWUs
^BxP}3o=
),(k5mD
*C-hig
]:CHHDDD
WI[hZkD
geXbEb+""P{M7v
Fhvh3a)n8
'>u|-spK
ao4kHC
VgRo^rZ@
ty2/`"""
Y&"""_,DVkptb
*,(""=
dj">8""""
G`DDH@QW^8D
8(rXVt)=F
|;:?.!@"
Mjfc2m
;5u#'G!$>&
ZY97rG
NANst1Z#Z0}(F
B?G""""d9_|r
{'zr&{SB]
DRnYo@
\LXX@TD
_APYW$&*D
=9e5@P_#_
&j5F_i
Sskuhnrh$Wp
>E&5T:]+W1yW"T
JE1@IW
F]F_Qe5LE9BC-I*
D!c#EA
k*lz<.
DD8A]D
O@a,iDDDD'|!n+p
UKGDMK
5[DNhD
Ur"2+e&5Aw
6Wt$BE
mC*U+"1z/
1O :C);GS-K-/
"Wc[S]FuA
nF@Zc4(g9k=_
eoa^mi U%Q
5h1.=+99l%'
i2x*"$
J.H/$N2S&0DHt&J%LOZE,HS
rU^7{7
@D-DD.HR"\Q&P@:E@
%hPtgo
Ta@j)K
;#f?]`3
+p/u#i
.` qJJ}%g
jXs:1oe`J
cZFrH$c
%{:I2W3(
lr<449
PuQk~VzTDD4`C^
\MCIH<
1fGD1"Q
f (9$H^+
.gt!Wd
bhVlc_
h0Rxg]0
N0%\|ZDH""OR@@ACJ
Sx4`rvRRD
<3+;4I
^_=N_M
^3(iErM
pQM&^2u
3I@D[,
$TLi*f!
txltep4(
pjB<xc@6
D0VGV2
I<H9k"M:
G,Xw"r
[ZviDD%
n(""ya@
RO[8RXX
kR#=PvT|5
F#0*oDk1o$
SnN0lDDD
d*JzpQ
Da"tq0'
xP3=#q
:me!N[%qV)kg-}
dF?U.Y
WH+FDF)
BWWVq@UR`.
y%4ah_>!
$'7_L "<~7]E&ZRq
[=xqY#rJyD
=:X2IB
iJVWl|
SGVwKh'
E35Q$
0c-cQmtS"~XD
g_=t`$$Cv
dW)Q#n
LD1IKN
YR\s_p
[y]~Xr
VqzjjyekXy
Qm,n*v^@
316' 909"""?
f^hDDW
@$EU_J?""BD>@
nmrI\H"
(c]*- "Vm}
GA0B?s
8Qi$!\g('XT,/$
$""""9
|~vD"H
NyKqMw
_k]iMI$
_AUUER
3@Os_#Hv|t~K^
#q\6ME;Hi
)t7^BQ$
SZDDDD3
&DDDD94?
MDDF/R(C+"
>><;""$QUEfzCw_""""EJC@R
EH"G u j?B
-fy0`N
j#n&"[
ne]I,cvk
$}8dx+}
I5%]5#
\RCOh|eE
p~HxR{
0m,q4[2,((#
k')wN{
x'8eG8A/
/v?4+z5
\tJ^YM8}@l
ule#Z,
U/"BiJY_3W
7j!b$#f#-4
D&/l"@
w9}rXd.
H$QUI4^|%!5LK
]"p?_I8
L8xeC-W.+Y
5|}H_DDp~tK6/
pgM07X*
PpEA?GyG>
%_ybDH
aDI>a&I
Qy^/w'K3u y
B"Uig,
M)#.B4M]13Y$I"S&
H<|<u)
m;9cvz1J@
rVW<Bw:r6J`0
n|^hwH
dq]AW^
^(qrrK=j`
:Hi"$25}.2
B\j~IW
l}tDF"Lb3:&],
H&_lx_
V&d#(4@
.mH$9R
V3emr?
9RT0Q"H$
:36Hz1s
='mbm}I/
"9`T(\v
i5D#NAU
nHDDe{$
*YdF00
0dN8N j""
ZN2%"""
.{Lx22
J@$2Xb`8
pX\H/EPtul/
C;_D*)33
`nna!K/2
,/u#W[
;@4D!#
42bXECx1q(&R3b<~x4`0\
D(YiGh,
q)=%y`
9}WQHUm
b1r|\al
ZqIVPVTx!@1
z@KwsInj
C=u0hrDWq=A
H@xMPF
"X1w{F\
m_4_:BHf
)aD8tv
yIi(PEV
W1Qav :/
nk$c,r Vt
9{p'aq
'"C*MU
e6NC1vVL=
{wBCHMw
Qw\~}N
doRcMv)RA
Qfu-DV>/
3 9bAaK5s0A
Ian)K
xbo~gQ
2+49`m&&u:HN|I
"!UH7[S8Qc
H:1nF5)@
#cDD8`VYK0
1I`-P9+5
F`"6A'
Fg#JU^^
ov-vjz/n
F<pR(r
Rzj9" 9`
n>4Mp"jqo;
u"?8+:
eeEUeE-.
|tc;}`
0(gI(D
ARe=V*
8)@DoB
@@:t8}3iDDCn
P15QX?M
QkpmXZkJfIY(l6
Q!UYDhu]MaV
r$YlVXD
hDxsff
#~}$Vo
GKb&<;UK
-aC:9&=9`
@_4KM`
8wibsZ
yW3Me=Qy/U9)#
}8.U#v
.Y2?6>
7%G(gp\
DHUT ;
1<2#7A
9$3^8Rv
p2""""ISB(XY """\3
"=$;6]4W
P+n$zD$"
RX}SzK_YT
@DD'b]"oP6
&\|`dX
L#Jg.Ac:
.":PlO'T
>h3N-!
ehmk_4I)*hdAFf
;sfz02
<0:CTE[Xi_'{D
%SD`qP{h
FfQskulty.M\tAOwE;j
CI:R-N
#26329`p
""""Q{
.}?~""""<FS
jDDDD[.
BwB{Ro
c>vaeygY
g]heQsh64j
(d,nS!q,
x&"""0
d'4)DDD
dzlHeD
Iq^f&cF
kM@DDDWy
:Gb5mX=H'#
`XlJU:'
%_)\']
swmirsL
PC.2W4./02<
ku9`.v8R:I
Mdr+U|h
^g.2}4
gkb+{n1
R4azL95'
"5NO)w<h%
RVMj~b
`.(Lj[q
D)grdm6l
y4`t0~!k
&O7SE*
u#Pd.9:5`
Wt[j[X`f
~c~u|T
J^&?};B"=`i
&$"""hp]
+_9`y
.IDTwI"$d3
*9jJrJ
4lbXnT"""r}Lq""""hONyM|DD
1DDDD;
Mu;^4EDWx
EDQD_R
DNT`D1QV
(%""??5fS:oh
|BLGK!-iv3
""bz]U
B@VZ6."k
&Hr*6Nr
oafDd]
!YK]5s
Awk##zB(
`Twdzx
qUz.vsK
QDDy\nbb3n h:v
$$bnZ?Bq
=56PTK
4`""8)%J
0X_<4g
kola brptpfH\xI@D8=
W<|\DD
^Fb(Rn$LO90
@fN.z J#}w)
EgWc'{o
(l`"kD~o}D
QI!=4h
"q/+046'c*29-
mwzq(sDDZ
y1QA-F
nlK.to
]Xna\beP
di7k1jD"g;
DFrg!~
@o*gQE
O^'F7_m
I_:A!Jr+8_
x>C 4I$
^q@Z^EV
Hlca^E:&+Y
dY?/"6')%
H|-N_#
B3Y9ao;ge=d
L72Q S
q!$D%w]A9@-
EPKs!lO
A#PjL"X"Z1
')D4c"#%?
(ky&}w
>P1n2R
{CGzP~8~I@D
zaDDDD_rUx;v
%hDDDDG
R;I:>F@K3)
)2OV1`;9
6aQgH"uXW=
o=B=r)
&#\%4a"""]%n\,tR&zPhD4
:6TjS3t1'tW/
(8g\5j`-.qdDDVXv
1O5@;u
,B]+mQ
RU!o{m@
ZQP}`d
DDDDnwPPS% +
0`D6<9>'<
J0Lo-`rs
CtuZ02,EDH.0N:PVDH
D^P3V5TZ0
%Ktu~S
?E-;JZ7I
D@C@S }:,
n$T&J8"^
;%!7=/87-2623HPU
TC,XAO
I^v|DD
DDDDn(g/}%j,sDDD`2)
jy/s1Fg
[j7m |8"""%g;y
5Io)J]+fA?
E;yE_xCRIb
J6iE2fB>OC:UY&"-
KG"T.QM{}H"""qzv
O|DD[3cQ1
_oG[C#9`6R[
nyr{v|z,"D
OV5IeJ[l
\zI[dCm
p1It8Xhalh
Be`rAyd
I$:zV$
TF*K,^g-
TB5@,X
efX9O;fNDP
PTc(e< $
Tt49Y(HGJpf
]3`?-c;&W7#
%o$*(f+a
BDD)}U
(Q3rx#
Y+HES
Ih5WXDDDEB
L.M#DdNG8$*3&h +b1~x
crzLz8
r%q_ "Z,
&c'[;.OM>
o6~*ML
Z0$b%E$;Gm
9hB]-$##}`\S
'?]2e7
#Vy9[JQ/4M
uSDq,H
Oi=Zr8 $
#NVT)R
TqrX[D
Pl.~hd!ty6p`
)5023M#T
(NhYHnWT$
TZj^^"$
\GGT<P
RfR{},
~/Bi|A
X`h@
|`x+&guD
td<DqHY?xT4MA
p^ip-#),
f1~)Dm;z~Ar{
vajpnv9e
xD40I@aCq
)TT-Spt
ezqRu@
J6'+KV(,["
p6"(QLqYH3-0Qb`"BazDkYo
af}zuS
WzA=U}2^0s[
Q!of$z
65f#=9dO}.o
[6|C_$
Q0}2H8y
Di?D8XkcyOa
NFN#z0)5
.T3.C0c
MFh^jj^n@
~e3W#;
=##e4UZ
O'wor#
rTMcMy0
"MN.4tJ
c4{gKcbfD
s-^bS(gn
At|JjPw'{IgEA
MHALMcDQUI\`
Qa$U`7
DRPb`fIN*~.+2
6nuw8m
O\CvG R
jWnF>bz2o
ea\gsUS
}ND~8M
}<Imv@Ujz^oc<
']6IJ:M>q
"en&?*j.
;M"!I '
BYUpQDm
$(+%5.=X9G>=:>?+9;/h
YfU8j|PiAKwLs@
Dix{PD
@7sLavJk
LNRMvnHJ0W!I{c
t2_I#Y"v*
W&CLZ9
+&)g$f
X37?3"N$(
@,^0Z9V`:I
Y$-:i4=5AS45]q%aQ
5W}Ru1My
ll$1%YQu\-z>
:\& }A=!>
"8^y>`U"
}?zqF|$
?!UbD^|
sC}H4y
<sj(]j
e696hZ#
4`2!4!3=]
iRBn6Ih~aA)
{S uOBP1h"
~CfD)P{E
CG%'RxR
S)ET]z
sY*-*2iQ
mzkk.%&hK
a!iT$jP4Nz
%%wYA5AA
tcvl6`$5-!y69%
gn]`,74H
B8kd9rZF
F"|/||D|`NvfHXQz5
>2+GA<t
e~Q"ze
Sw+&;@LgK~
7HdI[k
,+oHZF$r
gA!#!|4
%sd$x1
S#cT,+S
bK5IZdeN:@P4c
8 /21q
66x$-Vk1A
b(1Sa`1&5
'1-,)$2EN<e,
"TsMvH,Hi
1%m0=-898}65
Rv{?^}
d%P'}&
ffD4HW9l
vB%r{|S
bd$e&j
LOaA0)\p
X0DA2`~
3{sN$iT<
OKwuJE[WPY-
a$$I$I
6.%>4P>~
8KtnO>-
lN+HFA6wW6Z0u{ru
J:0Mor
`"x?jBu4
w`H&+y
_`GI0r
G G90x
$}9|p8aas-J
{#=_N.
eg#>Z*
R+f>,$`m
:eJlEYd!1
w-$bZ\
}GXDV`
881oA0z~o
J@M`j:S+
Y!00RA
uXj2z%u.f8
'p\Q;S
2ZRY`P`^J?"60
{i,ge^HH
HHHHkaoMHHHHCIw
<M)9I+irX!
!Afiph
:T4$4M
5M4Yx I``
Rn|`C`~sj}NmsEjinA$
cod^b3J
Er[9hI"$
1vrZrbizYi`aL
GeEqn>Pyr20
|sQVz,
WRXUuV
L\vBTP|wS=
1GwOf{@<
%'.<(0-
!i;3a4a0b|i)}zaz{*-j'
rvoqx
Hh@Z\CH
B@OO[G
eN~daar~PanF%ck
DM#`>g
:}~yF/
UX1!&Y
T/>0@;W
pXom-n*nc-]KW
@W|Rb;
EFzC+e9G<`a<FZE+
NGE:*\DH n13(d:T
ZqG`=>x
UNHKBB
&0:<(*c
1QW4@+F;/`vqms
#" LU!/%e@
I5X&@L*Zl~
3A":ybVU|
V48^XXXX]
57731dh
&aj0p
j`10b$^
xO`,|LG3C;MX:?:
MessageBoxA
wsprintfA
ExitProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
LoadLibraryA
BitBlt
RegOpenKeyA
user32.dll
kernel32.dll
GDI32.dll
ADVAPI32.dll
<J{zCgHJB[
"0lZe1P}%+
DM_6#)3h
!%G$aU
hiRZg<
*bsnrP]W(30/wt8u,
Tg[?w
tM&.ZB)Z9
f?l@Eh
)]STXj,M<
w$^,<b`
tlo:
Zc:Z<Q
v^:;Gme
0*FY'A
VS_VERSION_INFO
StringFileInfo
041904B0
CompanyName
FileDescription
VarFileInfo
Translation

Process Tree


0dda0aa51aaa27b9d09799e927e5a9cd7a804a6641d9dcd08be091eaf0709d9c.exe, PID: 1848, Parent PID: 844

default registry file network process services synchronisation iexplore office pdf

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name ac62fc3b823e4ff7_iqbjnwa.exe
Filepath C:\ProgramData\Mozilla\iqbjnwa.exe
Size 161.5KB
Processes 1848 (0dda0aa51aaa27b9d09799e927e5a9cd7a804a6641d9dcd08be091eaf0709d9c.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2d6b52fb650f7560f97d0e3a76c81607
SHA1 e5e7a06f3a8d25395413b112ff3850b28abf4d73
SHA256 ac62fc3b823e4ff7dfdef01d736dcde1ebe6aae5f9bc19744bfce5a464fddca1
CRC32 4B7B652F
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.