1.5
低危

1ccde746a154295d5d52798f91cc3828143c49c3d7c2a93756b65d593907e9d4

1ccde746a154295d5d52798f91cc3828143c49c3d7c2a93756b65d593907e9d4.exe

分析耗时

194s

最近分析

379天前

文件大小

222.4KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN RANSOM LETHIC
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.92
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Gepys-E [Trj] 20191009 18.4.3895.0
Baidu Win32.Trojan.Agent.eq 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191009 2013.8.14.323
McAfee Generic-FAGO!E923EDA93D4E 20191009 6.0.6.653
Tencent None 20191009 1.0.0.1
行为判定
动态指标
在 PE 资源中识别到外语 (2 个事件)
name RT_VERSION language LANG_RUSSIAN filetype None sublanguage SUBLANG_RUSSIAN offset 0x0003c0a0 size 0x00000188
name None language LANG_RUSSIAN filetype None sublanguage SUBLANG_RUSSIAN offset 0x0003c228 size 0x0000000b
该二进制文件可能包含加密或压缩数据,表明使用了打包工具 (2 个事件)
section {'name': '.rdata', 'virtual_address': '0x0000c000', 'virtual_size': '0x0002b8d8', 'size_of_data': '0x0002ba00', 'entropy': 7.512593533887802} entropy 7.512593533887802 description 发现高熵的节
entropy 0.7913832199546486 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意 (50 out of 57 个事件)
ALYac Trojan.Lethic.Gen.11
APEX Malicious
AVG Win32:Gepys-E [Trj]
Acronis suspicious
Ad-Aware Trojan.Lethic.Gen.11
AhnLab-V3 Trojan/Win32.Shipup.R61194
Antiy-AVL Trojan/Win32.ShipUp
Arcabit Trojan.Lethic.Gen.11
Avast Win32:Gepys-E [Trj]
Avira TR/Crypt.XPACK.Gen
Baidu Win32.Trojan.Agent.eq
BitDefender Trojan.Lethic.Gen.11
CAT-QuickHeal TrojanPWS.Zbot.Y
ClamAV Win.Trojan.Redirect-6055402-0
Comodo TrojWare.Win32.Kryptik.AYQE@4wlbfl
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.93d4e9
Cylance Unsafe
Cyren W32/Zbot.JC.gen!Eldorado
DrWeb Trojan.Redirect.140
ESET-NOD32 a variant of Win32/Kryptik.AYMY
Emsisoft Trojan.Lethic.Gen.11 (B)
Endgame malicious (high confidence)
F-Prot W32/Zbot.JC.gen!Eldorado
F-Secure Trojan.TR/Crypt.XPACK.Gen
FireEye Generic.mg.e923eda93d4e921f
Fortinet W32/Kryptik.AYUW!tr
GData Trojan.Lethic.Gen.11
Ikarus Trojan.Win32.ShipUp
Invincea heuristic
Jiangmin Trojan/Generic.avodd
K7AntiVirus Trojan ( 004cf6b81 )
K7GW Trojan ( 004cf6b81 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=87)
Malwarebytes Rootkit.0Access.ED
McAfee Generic-FAGO!E923EDA93D4E
McAfee-GW-Edition BehavesLike.Win32.PWSZbot.dh
MicroWorld-eScan Trojan.Lethic.Gen.11
Microsoft TrojanDropper:Win32/Gepys.A
NANO-Antivirus Trojan.Win32.Redirect.cqixmk
Panda Trj/Hexas.HEU
Qihoo-360 HEUR/QVM19.1.6F13.Malware.Gen
Rising Trojan.Kryptik!1.AB8B (CLASSIC)
SUPERAntiSpyware Trojan.Agent/Gen-Kazy
SentinelOne DFI - Malicious PE
Sophos Troj/Gyepis-A
Symantec Packed.Generic.459
Trapmine malicious.high.ml.score
TrendMicro TROJ_KRYPTK.SMAD
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-04-10 00:46:06

PE Imphash

987e4125d085a37ebd052f2b40a710e9

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x00000b9f 0x00000c00 5.516756753822285
.text 0x00002000 0x00009d6c 0x00009e00 0.11894335316849376
.rdata 0x0000c000 0x0002b8d8 0x0002ba00 7.512593533887802
.data 0x00038000 0x000000d8 0x00000200 1.686944518022254
.rdata6 0x00039000 0x00000328 0x00000400 3.1136303138427355
.rdata3 0x0003a000 0x00000064 0x00000200 0.712453444966878
.rdata2 0x0003b000 0x00000064 0x00000200 0.712453444966878
.rsrc 0x0003c000 0x0001e238 0x00000400 2.1237746236942723

Resources

Name Offset Size Language Sub-language File type
RT_VERSION 0x0003c0a0 0x00000188 LANG_RUSSIAN SUBLANG_RUSSIAN None
None 0x0003c228 0x0000000b LANG_RUSSIAN SUBLANG_RUSSIAN None

Imports

Library KERNEL32.dll:
0x40c034 GetCurrentProcessId
0x40c038 GetCurrentThreadId
0x40c03c GetFileAttributesA
0x40c040 GetFileAttributesW
0x40c044 GetLastError
0x40c048 GetModuleHandleA
0x40c04c GetProcAddress
0x40c050 GetShortPathNameA
0x40c054 GetShortPathNameW
0x40c058 GetStartupInfoA
0x40c060 GetTickCount
0x40c064 GetCurrentProcess
0x40c068 GetVersionExW
0x40c06c MultiByteToWideChar
0x40c07c SetFileAttributesA
0x40c080 SetFileAttributesW
0x40c088 TerminateProcess
0x40c090 WideCharToMultiByte
0x40c094 lstrlenW
0x40c0a0 FindNextFileW
0x40c0a4 FindNextFileA
0x40c0a8 FindFirstFileW
0x40c0ac FindFirstFileA
0x40c0b0 FindClose
0x40c0b4 VirtualAlloc
0x40c0b8 lstrcatA
0x40c0bc GetSystemDirectoryA
0x40c0c0 CreateFileA
0x40c0c4 GetVersionExA
0x40c0c8 ReadFile
Library USER32.dll:
0x40c0ec RegisterClassExW
0x40c0f0 LoadStringA
0x40c0f4 LoadStringW
0x40c0fc SendMessageA
0x40c100 LoadIconA
0x40c104 RegisterClassExA
Library ADVAPI32.dll:
0x40c000 RegDeleteValueA
0x40c004 RegCreateKeyExA
0x40c008 RegCloseKey
0x40c00c RegOpenKeyA
0x40c010 RegDeleteValueW
0x40c014 RegOpenKeyExA
0x40c018 RegOpenKeyExW
0x40c01c RegQueryValueExA
0x40c020 RegQueryValueExW
0x40c024 RegSetValueExA
0x40c028 RegSetValueExW
0x40c02c RegCreateKeyExW
Library SHELL32.dll:
0x40c0d0 SHChangeNotify
0x40c0d4 SHGetMalloc
Library ole32.dll:
0x40c15c CoInitialize
0x40c160 CoUninitialize
0x40c164 CoCreateInstance
Library SHLWAPI.dll:
0x40c0e4 PathRemoveBlanksW
Library msvcrt.dll:
0x40c10c _c_exit
0x40c110 wcsstr
0x40c114 wcslen
0x40c118 mbstowcs
0x40c11c _XcptFilter
0x40c120 __getmainargs
0x40c124 __p__commode
0x40c128 __p__fmode
0x40c12c __set_app_type
0x40c130 __setusermatherr
0x40c134 _acmdln
0x40c138 _adjust_fdiv
0x40c13c _cexit
0x40c140 _controlfp
0x40c144 _except_handler3
0x40c148 _exit
0x40c14c _initterm
0x40c150 _wcsicmp
0x40c154 exit

L!This program cannot be run in DOS mode.
(RichG
`.text
.rdata
@.data
.rdata6
@.rdata3
@.rdata2
@.rsrc
]U]U@E
]U]UQE
]UQEPh
lUR\Ph
3_^[]U
tPcAre
NtMnullanueA
Rea]Fi=A
5tr2tA
VtW8do&Di#ctyA
tMulaneW
tPcAmre
Ead]brpyEY
jrn432wll
$vc#.d5
rtlAoc
maiefFe
YapPlor
zrnl32ll
VtPCceBHe0
]_%Tyw 4jg
#btvugmnqfJSq
q%p4p$
h7q2id
D|kV^b^dDaVFJ
i,H||wH(g
~xC]T]V(Q"W
ubX-V4
[rI7_W.]+
/7=b"@4P./
rqP{jP
nrT`F
$=P8v)
+SP+Q;
+Ng*+k+
MEX]pUy
1G>?B}4
RLGY%z
GG)vU4lA1|C
~~BDT
Q`AjQp9T+
p#Zc8Btg$
)UMOuvd
P\y/QQ}t@)3I+ jljdjZ
rQ3jIvb8RV
WpVSp@Mkd
S~Wxh4Ft44Fl'5
N`N%4|
5fpCRc
N|Fcavb
z.Q|`&
0v7bQV
Kq)P96
raPbPkFp
t_%Rm{R={R
|_1S)E8
}J|1E
`lPh1D
L$Sc~t6
-*/CG-(x
*C3G-lA]
WD<)P;G-Qj9
^5AB/a
&+S_G@GW
|OQeT?P
g (3G5
F|cFd`4
@4{bBu
b'ZS4Q
+&BWG
Rt@O~}Pb
r\PVDy
Q0,P@`AQ4
cA@9Atw
i/Q@T9
iuiuis
#p8_^SM;
uJ>X2^Z}@7J
Uq@xSu-
rU1W@-#A
3LlH:6T@Us
{cHToI
iWqHsMUJ
zfEu[;RhX
\>}E%kA
:av;7u
x~g>^6{
v\:WWxb0@DU
i]Rf{M]]%3DY
3Mk@$YiA
(zLO^N
eb/}F4@
tbTU^fq$
FMEAjUctj
VRPq@rL$t3
7e_}tRy
/otX}+}Q
C\)uCX
en-c`=MV%3
wp3kDU;h
qP-p@Ht.u
]C/U.u
t^d%dmt2D.
/7DvK&
4;\9n:_I
+Euq@H}@
F>q@E?
j,</jyF*
8@Y'<v3
4.^ MW
QS%yVjE
H[1d`Q
d8Wvml
^ljVzH
mjml,_
MC#P{PA
_1f{ ue}
8fA;:f6 t~
31NLe8f
B/u[%"%i785
M2X&9^Pl>@M
65vF 7mjW
rTU|7S
:6Yh&\JrV~];5
[^;xVW
J3Xuq(
Mbq<E@Y Q
j<i$i$Kj$bGQf)m
_PM-(WM
lV=r&HK
`NElE|
&t#N~NNq
;1tjZt
0F~^M[:6yxq
DT]xN/
aPe,vh
pE<-/#>
/uY}C$
Va:^&"[
A_-6?t-cAQ
tYrX)P
{@FEz)_
F<U|;hM
8Y1Wh@
|Q5<[|Q5
C.cQje
vUJG`U
7=*rYp)LN
Y;^i]!M!EjU
Muj_W>d
khq>m7=
$J9J|^
'4E(@H
@-A3Au
DjLrQb
>@s"6@N$k
@cQpnk
XVkAT?l
aI]b$PL
X\jnde/\ix
hu@K5/A
)>VYR:U
4Td@12
cHjKMJ
/G(} s
}*W>#>
bPbMI? !y
Pdq@AD
toSYkE$H
:-19hj7
y!c\VyTJ
cHn(L<
=yeV%3
UT-V-N
$D5f5Ml
QKOoIoOEAL
OIlEOP#
-hB|Thq@h
Pt7[=8[)j
@'tW8u
v >UP4PinN2
('(R70
+~lc<
Chr6u`
(WYu/S
WY#XWq@x',
j*^R1r'
t):61 U
UME]cFz_8
c\F<zTr;u/
XEN3L4
ePwDNO
!^[CY\|
z+PcrDRC
-P5#5US
W*s&NtDL
h(2wE
ETNtajUl9E
39fT5Z
l]aM/LuBf
~5yNsE:eZCDjAG5
?f`())Md#bE
S=(%KYi7C
TrFD,E
]s0T<u
g6%/k"D
Vy}^=u|R?lIzY
{>nl>+5
5{|WN@fk>+69
~+vnfb
]E#$EP@PH
fVFuBPvm
IB?:?R?:?B?:???-}+u
~#vnr
Tb1Vrgqz7N
Ltyu|N
X^)H_q}
>[uoV],
MHPnD*R,-
_1X_]31T<y}St%D
u4F%1;&Wj1Y
qQFa W
(xp-'wu"kH
k55h,s
Wkk{EmOm9
NHCX xPR
!z(b(~R*bxjGN
_vTbIJ
NW5K71Qj
RT3zW&zW
&W|NWK74Qh(
N(a~v3
/af{ug
bF61[hP.[6
TbFDDF'/
U3iGgN
$g<vyE
0TCgDDu
d>clqD[bdb
K@8D;eF);%} N
5GhZf#fN
\`L ]75a+#
aJ_fs@
oAfPQ>;C_=A<mB
3QMUXQM`QE
C,('q'
ND'LB^Q\
q*VLGEE
+@9@j#n
1'-TDXTWRhS>
]^RU#"
JXt[p{
8@j;#7$
ul45[YdaFXF`F)#)#4t(D
?oOIDv
Xh0WDxt
D|j4aWY4kM^]
7loUHThr_
7loUXTu
f5@n9mW
VQvFQv6Qv&Sv
]]E#]5'j_e+_U/_
__s^vO
nBRN.~
^Q^Q>Q
m^mSJmCVmS-Mi
/sA=+7(d
yO\~"t
i@Nn[t?NV9
>#[rM8
tDZt6IY
e7\AfJ8R.$
7\mfJ8R&
eH$_DLR4,o*
j9"Nw0P
8]7SUo
pQrRf=
4Gu}AGu]
zv7FcMz!
XzTb9NU
2mCV[A2
js*D?t
?esCuyD~C
DFyU<F~
B&wkH}K?\skvx1G
bBRrBRQ
*G VrN
@l\[{~d
kQPP]YF
ERU>NM&NE
Fe//m@Q
eRbBPd
2mDlDqzsbF
sS3Ta4e
sRbqVn
qFdr mo=lp@ng
UCsPAh?Gn!
9^P(VP%6cT3r
'4c<3r
(ru+ay(
f5id0ur
G,bn5ba
&h0t5c0d/mmd
ii99))99))
-159=tar
i:m.dqBXu&\yJp]>Ta2HeLimW
Rxt#^tx
flpaHdmDh7j@\;v<`/rTC~X'zL+P(D
0,%,0!
JaU]Qy]uYqemaImEviAju=^qb}FyZN)R
1z%-n!
|XD@Lh
H- #($'$(+<!,/
LO|PSxTWzY:n]6RAhElI`M
okgc2_.[*
X&eT"YP
C?;775
J`mo\s
,zPd@V\
pN50_{w
j5E>i3
~|c|H_rUH=B
rygmED
.b@x@%
iV3TN3JF3:>3Z63
2h222.222V2202
2~2$v2
2311{)2S(2I
2/1M2;(2
11a1#"2#2#2#2s
lY\Y6Y
](^]]]]ZZL\B\\~\.\\~vHn\fP^"
F,>t6"
%ri}Fim
RpobLawpe
sWRGMpG
VOlSpR
c?rVq:
g_qgqt\U
1Q+t-h
3RN-12Fllx
4_driU
lejtojU
Ee\csee
_n_taccrmr
_n_tFeB
nc)O_s
fiakeoM
^iaaorsW
atinuoE
tdp]Wx`o^"
]t=eeC
^Bh8i5
D~,R_m
0M1I=x
1Q6_!CG
mcSzNU
O\w7sL
D{G`dE
AocaGn
gazex@
ty(ml2.
oCAu{12
_p]tX(\ocathf
nuA[df&i
^_r4ca%
y_t?prPnP`e
?dhP^lN?xttfFpe2
laheu|cl
VSCB5^"
[WeSiH
Lxn7dm
3c>zt]e[
zcjn>A
tgrazcm
tegtQ_latn
Cndexgn
qS]VaDc
et]stLvo2
btt`oredUcrlenE2
eaAqte0f
tf&`_a
gC_`t@
9vgaWEr>[c>UeZo2
S[CUS[
V+ap#[sHvx|
&ge7;w
i.g]*T
Xb5D.S0
cH}c(mJ
0{rFrq:^F
9tPt>U6A-
_I@gI@oI@7I@?I@GI@OI@H@H@H@"
?~?r?v?oc
~vnddddQ
r r r
a3he7li+mm
AeFEiJI
3}7y;u
h X X H H X 8
sO&CT
T?tCtCtCgRgRgRgRgRgRV
ckckckcO~
t8m-C=6r,e:Zt>Z~
es18:70
+AxHn0[
-v|8pXF,%
),ABHTd<
)7rft^
418VhD
69T\]L
+Je~j0
Nx6-%{!\s
KV0`#"
pwd'`,o`
MLw_j~f|)+
$Vq[IG%35
omrS4,z&^@%
<>4D.Rw
 ~ru&
BUc*(7
ZD)BGfV
Q_yyq/r
f!+RdF3
ivM"D]^A
^MFUwl[
xA6xqi:hq1%I
@9II#
1}lOq<Z{^r
v:mQ;=
&&&z%2D
=FD6F1)w5~Zo}
$f4PhT*
to<WX,e).E.iA|,Gdj
2t3U#Tl~/
1gW+nqqq
?X",MU
=5h^qukR
ENf[ZX{<
K9 U^:3=
:pV[?WN
4{d{,P8}"
d%:<</^QWy,<
:Wd}%>.
L=Y~4r
Lar':2`
-M9,!q
Xxnhgb
ldr0r-M;]`_
q`93X`b
)x!=p`,n_
dBS&d%WMU(@c!
,]B0,P
rO4,8!YVW
#AO)Y&
<r!lJZ
eyAq,_tc1
wU&W>8
+2x;O@
1ffg~]!!"n+td+
\A2MYb%&ZA=9!;]<
pD}Obc74r N~
s@5M%;O6
AR'B~]
_RvMo~\>{
EaGb2ta17q
yw,5|D
vj>2H\>q
nW|R"w[d;A
Ant;*#'
;hZ,qJ@mR
xo9.+o)oHr"Rp
Ku8Z" LiBNVt
5?z?IWO!+P_
sC_4C]>{W
M=^h6dV#
$Aj(2#b
_r48F2Qh
Q=9p4TBbl:A5rIE
Ii]s#x_m3p+
xFdML.I8Q
%FlorV
d`+Q8cK
%4r>u!
UEL4/PY<
2%,22Qp9
t")1=pi=
w^z~|T
j;I@q|TS
s-dyzW6&x
uB9l+'b~
+f8w)<H
pgrCK+
yQ.j:RWr
RPA8%-
L.D#$5s
J-hkIS_
n.u&wRT;N&l=V
LT|xk^
'OF2o+
zv)UVJ~Qf<9z3
{dUyMU
KXc%_OojJh:b
*<dr[`
>i"vR%
lSe|=t|GIc$ vAy
e)%0w4P}\
> iW
cQ-,^Y
:]a]fiX,|(&~U
hdwIIx
zqp)t#Ph
c6.jYA
X9j+}LtWBwz
EM$8u>SL/vJ,=
-Yh8CUOvi"5
&d9ANjM^KMX
m-!l(f9m
57p(Yn
7Up7i>
+R6(Ov
OG}Q^o2
A,W|Z|
?Wa]Ra+
^+}Co|
H.d^L`
$1\bT8-
Ka`2l%1#
`]4.D}k6I'
i'@mO8
XHV+Pe03Dkk/|&G
{Ay5MS9
,ndz}Q
sBMn% >
n$FmX*
n11EV^
(zuV .i
>Xi.6!
yP#Ghmrbq
O%],GAq
!Z\ZmU9
k="!,W
p8]FD\gII
uHsASN
6uH9^
dZ)OU'lk.2>'
uv!fxA?2>
"ITwBO
%I*lC)EC
,+~@yPe$+?
\>b,na7A
,eU1eG
lI-LgHq;5
%pB5[p "N
1fMD'S
(G7}c;
\uj"X!Z
'm:^og
+Xl)`($
r9RE 6"52
fED@?(*
L2@CH?h
mI-f8V<
nyV4&W
}w6:Ibz_
\q0FcG
3 j>Fi~
3G-NDR`$7NJ
jOGLo2P
>~D]#H
i/h&{"Nd}
/%X\mj
:8sl($OM8
Lqhspm
ub#u-'QLH#
wSTyBR7
_$PPQQ
9fh$3k>V
NfVV}g
=&5s_h
/U{k&.A
kfJLX!>
""039LRP[
Zg#+ce
LSdUY'tWBz>H
7r}$Cm9ux
YBGF(@
a6GAtx
Tj8+9D
ZDS!<T/
3CF!r3
Pn&6PuFH
D&c;<=<
\?gKgq
WN?PX$w
.; vD<f^&AD
.Tk6,ez
@RQo<5i
n$6lyin}
m@3PaTOs
KBF)jHyXm
8h hQyT
A5P3b1b/7
mF'[\K?=5qV
]:+gU,t$2<3?gV.
RCn}/6
l'fnoH{T.;
mJQuOt;QJ
KV|1_p
l~8C29
yu]elxk]Y85& z
{7m{)6
cs{yx%h
VLkhq'
^fTN:|
LF:$7^M@
koW(M<uu(D'!
?9]I<R;
0*M#I^
%-dZzN
9xH-&3
)1\tvP
.>3[%z2
Dq@`ry
x~(nkD5&WxnGr&|
aOM@]V
Y7vu6_
&x=kJb
W#4k{
Fvi:i_
45GVa2u
i&D#"JQ1
m]]x}2
jQ"1^lwY
zUaCQ3KC$
TN6TR"rq+S[h?[Q_g}7
L>P}Y;
q0QjoxX
i&S0|,
0@Yy2~
P@@8+$Z&$
n*Nq^s
Wvt;oXw@
,1.{-]Z^
1y{,pk@
k9SY*nX
PR2UF/~Z
ij_HBR0z
/|<s'6D
9p=R!\w
{V|Kb:
wHsy.YK{+AmRk%
dgb``*
CUm akA-fIi?
}PNg"_*
<*LZiD8/M
?g|2/N-h
D:@}Uxz
dUZh5z]e~q*+
2tsI"]
dU5xtId
}h_^xa81tV
N~Vobh
TqD@90gtOL
cEe KGL;'.n\
|?u/E0U
xof/0eF
%Sv?~8kq(PExp_
drg!I\
;(n%S-nt;
o.V0bp-_So3.l
om<JRT
sOUs(:;,
/dn5azve
qmsHZHKm
11U~`D"|
EfnKp|6zzfj5T a
+vh?KJ!V
@idUR'
/g!N.C
4*\wof
$i"'W%z
2>FRO$[
%ljkD|>
SojPO0:bx6>P!livCB#
2f-]lPhr
a&q${n?
}!lKtzbZ
YGg@C\S9c
)\#+J42
|gV!4Y
P@vD"dqli1]Y^{
0@e"`D
}ma!\kR
oQua6QOOR
;ap%+^
@p-3Wf
*cIM>s8
zz4VSr
7 9p%9X
^tkb+C%i7kY
kS~(y
NoTL<~l4Gd
[cJ8t;_f=
Ly`"y)b
blv%2Nro
y.+<0n|7Lsd@
V{cU]s
}?=y3i)
7kLxro
S1d<][
]z:p,_NQF$
S?*|$2
1M9fR'
zaf~\S~^PZu,
`\a\1=G
{*L,:.R
L1ZO6u
1XP%egK2D)I
0 kVny
R+GeK)(nX@^
LaIP,H
8hQm/r
M"6`N1>5**
pa+B^NG<Q)wK-cc
)PF-h)
YUW5Q}vr$G]
}aI&vFi4n
msI0_f
u}zXS\|T*ZR[qA
Kp~hzyR d*>
d%z%pI*6
z~?C(Ya
fKxmB$L
+!#8dv
z7G}C\
8V*p1R}UBL"
iLN_(Is
cVkH'T)_X
r~<5%fn
-I,h9uR=
<:pDaJ
se,M*z{`U
;*0:e*~}!x:1;
[;%36\A>!Iq5~
J=Y/uz
LUzwzgy
o8Y224RU
^C&yx}fT*_R2s_
%*,;l&5
8xF; O=:
},C-7j1
)J+p%qNT
0+T-].d
di'HqnW~
>pnE|)}X#
h!;OqvxW
Wz](1VIN
A9J1Din<
Et_^.Pz\"@380}
D0jzVg
/wd5DM
fi2DEo/KRhOf
K3?=U"
wTH#^u*
au@MxML
wwqI@+_
Kk+GGLK
pbV%:uW
z<.==W\
tuH4=uG
9R"G$
4NhhX,
HRVZpH
wE~)wwk
}HNm_Y
*=W>M0NO
F(\{0b@
_.=#2S4)
%JsL \
; ,u'X+z/Y=`
vD3fL>
x)[Q9GD>y_
&{F9pVcYE&
8ny]+5oh
2]GFO4qN
j_DJ}ES
7.eAEt<"N@
V_m7kL%AcA
ai-6A9
1BrhMo-
&Q(D&;M
aa#%w?r
RG"Ia;P~,;
:BlMh7'8~Ybwzk2Y2d
_]:KuZ'3S
H0]2(oV
,$T7S\,
!x~=l)\
ArA"].W@
SG6#:sp]'
#&[z3O
c5":X9
1"k~1
mDe0G-
t(v_?Q
+W(rAR
OE`>YT1
:JvC5]5
Hx|PEm^u
ub .=%
].gdSr~n,L+sV
AxT#.V
XAd)QwZ
3*vRu,S
#%g43
vUufO5
_!9HN0#Ll5l
Zl[7#kZ
lA[J"@5
Z-tbE3-~
k~H3{e?6V
?=1g&i1!ylw8;Ph3!BI
m)!x[9F<5~
MRJ{kgv0
VQA.-Y7
P4\ev{s
#PLR?vA!
+.N0TP?J8j
`A@+Rg0
O"vjH!
1~a^iEEo
rF#1a!
Bp*={sE
l4Lx[uj
QC;:VG
<R^Px m1bN
c;4`\m>T9
MlxRse-
r{sP\;P
_4Cyb
>rXzC"|
bje2i>
)EP,s*
UN2Nyc}
r~_y`
<-,,%+p7dE%
?gYp,JB
o"8t,_
G=kTExgA
C*3$$B7xzW%qsR
P?j@IHJ
Q^.AX7
$c(7OOL
2'#40QK5
A[l7gP
3`q("YO|
a(+(zzA
7LGyMmO
vE.WPR
"f"/b*
Uo6D ,dy8v
yW\_&((
I#1<v'3f58
,rlVNs
[`5s_rk.^
e248 \u(
g[\y*ss_rKI
O)%q@"X[j.}g
q@l66t/(BE
1A{b3p
87}w 8/G4
Q~5IU=;]P:,H'6Dm
:')vE#,
K`@vaTg^RWu8e
HEt>cG
WM-|_g'v
Uh6:@JS
+fU+PJOWN-
u+GOv2x)
fbr2pTrU|tH)PH
_mV?}DxiCvG
~`[T&up
os!ro@qMR
Tc{pHR{I^1
dpi:uXe
fd)Kqo
\Y^h1-7!Y]
aMy/B)
^_&[f2jFF
@BW#jZ
+:Zwo<i
q|[_Jy%
uVi$~):
i&2e,&A
$],qnY
cF~ieN3I7v
n1*@Bfgo
dV6>v.t<miq~E9FMK4dwV+!8
E)yaA=
n"u]1@d0!=j
w"GEf1:
e`F4UX?|ZkL
+]6,bvax
W17wN~*G?uV8|x,o
ZQ#}s8b
=-eg3mGsi
VB&jVJ
#BZEo8`&
!gcxUUj
NaBJR$1fga
T-OKZm
y;=U2#P
}t8G:
@a.}A11
W7J @1qk
b3p;l2d
WI8vt\QyO
$>v#^R
mbq_?&6_S`SsPf
/-IOm9Y
^\Qg:Ai)
f;P6rjk
xg~Lne@?
|0<XA4>
{~#G[7Vw.
?l0U"CEu9C)=
EC9,{wP&:%s
h*Ka\29r
I2vMx,m
Uur|PKmXF
bta{+M
t#Y`Gy]L
,]:FQ`4U
Lk2Dq#J(
/ouH*jB
Yvj`&
,.Ox>sj
<K(oXGO7Aui)
Gk7F3S+
X~NGl~j5wU
V0\N.6
%>.vSr
sVq+-]_A
%S*ga8
htb{/u
(&e%lTY$}Zb<;lNe`;
\Fwc9!
vnM'`N=_<W
`YwDYuZWU
+$=b2{
JvI>M>
2c%^*QHFPfCm6
dTh[:p.e
-EY/'F
><k#Y2
<BNQJL{ k
]Qy;vCN\`t
PDvg=9K"d3
s9]B?S|g
^&PfJ)H(_
TE_1o$
DJg}*/@
*bI]#,BT|
Q:.n+AG
1!57]er6
.H'L`sX/
Hs}O%t
0R ,tn9^
N^b*20
f'`wD,
.Tf?f !=1
RXhzG(
6le(EG)$&%zq
hUm\:G
Zi@]No
,NXK/swc
jwj"+ CV6
-|d9ZZ
0m70gJ0gxwu
xSC?03J`#
2+|qH
/g}Pk3%EL,b
$LesLn]ue
+CusH
j./Fyk
2E44s0@
VW7\*U
pBm&J
PX\A8|
+7 tajm/
<~;uu5
}z:KvOTp
*YR<|`
;[,"TE
N %4`k
8|%4y?t
"`sWsG(L
D&AP>12
Rv52@f
$6oX,Ks)
nL'Uxt0%y
_K'fdEe
m-2A-h#1H
8OZTNm
L0X=>w,
F,9'jv6g@+yk
Kd[:Kq
.CqO0_QL!b;i
h=;DB3
lkAfog.
lTtEf(
2Q:_O;
(s;uD/
y%2X8_%
ld2F-zg9-vp
u?QS#{\l
tqz$uPl
h6G|1jpl,WT*<8>:X
gAeb<Yf
3@9U<V:>
m`L5bD
/^*1.S2r
m)%/>:.&(k[
qW1vYw
ni,@8 7]i
W"2|BZ
pgo%5aHjL0\qv5
@<usg"
nU.-1,v7rml
48~'u3SM
sUWiQg*v\?$
cLnq-frK
E$3P7h{lh
P.pY.q
iVo$i|
{ DdH4l`tA^`"
)i*Db4
R} 8:gH
EQT;%
P(]6Zhh!*
ooYiuYX`"
H$!J<>
nh)SFo_
O2O\+0bV
]<'PF.$85
&GEqa3E
nCZSOkaUr\)
H_ m`}u
1-ip*n>pfUX
gObk}|QPD[M
J+nS%N{
u8q6R?
LANE(/w1>y@1A7|AWHL}w
=YEwskx/w
y#X&l?Jnyp[
*<@ao}u\x
_ O0YV `
]%!^JHC
GDm#]) a>XtV1Y*'u1$pP
9u;&}66(f
aw!otU }~
<M;OR-<
B=dl_KT
_@Hm:'"
rn"Eb)
N]wT8S
ZbjKI9
^ROM48O(
i)bIY)
>TyB:/7DW:ce
<kO[# c`@M&
`fYlwKgp'`
BYaOs6
dMB/8V"t
1{}q0w
?TUOqUlR
[J2*P}
-5`^UwR0r4
3p +Fb%9'T
IZ@Xa<8
2!p[Umn
<{st6~r4=3dG\
g=T-Eo.v
52S|ZP\&
"/CJMG5
6C%U!cPQ
#Pvy>A
&n@mZaYw
K,*g-GOC
V?2gomEiyY
)Te"Bp
-=-e|0
@7-^,){
rXKB;J[?z
3oyoy[b0Jh)z
j:o-?rji
}~ouwcC_uGb
=R9R0c
Dj )he#
1,,jqr& 4'
f/5i443nLB
W)8LQ '$0W
3[.F!S{VA
ZJ-/]5
2'$O(2
D1b;Ka
z=}j`:>"
t~0s<A>
\WyLKXy
BMAzRo
f(}RTi66N%
2Wn\?_H}kt
?]k[`j
/#[At&a@t^[
6>ibR?]R
s;JhgAy-SMzDQ
);wHLr
Vi:w _br01Cv4&)
5CcM8AgY
>sl=db|}
Q!r-j"J
DhOY|4`A-
PTrGK+d'A
QNZpf7!
pcH8(>Hn
v*^B["P%M[Y~&
PhZzM>PYfD
g9C@:i35`
J^Qab4;
v+!%k)M9c)t2
)jxmVm
9D#z^0]
SN;<DnK
"DgtNj
)F8P1IXJ
OfSy6b
IFf!SMA)<
Z1U:`}
z%4/BP
u8d7TNQA}(I4F
->5O2x'd:'Ef^z?t
W G+KWwU
j=4KA+(~vC(9U6A
FlglPy^ny=R
#Oyo- $k5
&B14oSd
Ri $Tk4A
*>}'K2L
D+9p)|b'O^S
'c"^%h
9r`:5%zQ }8"
{G^W].uG
^._Jwx
@L9u\g?^r6ef1);.
0$p[*b@0\
U.OGn-5%*b8fagt
Hx-@t+%1
Q je$L&awP
jg[@Ut&_w
8&2YzLSn
1B-Olk0[
+&MEKw
VjD<)]IU
!d{E""
;!\d[w
/b,^$DP&
#|W^IE
{OBOHz$"
@R.q>K
yTmsOG
M|MC}#
9aG?XM
/~i?GInuF
8*z-8=)?t
t+QM,b@D
zH2<fHc
G.+YeCQi
$IHG"()t2/
{)e5'N
s<:eg^
'}W,<8t
AtQImKq(6
GM7}f/P
}MYcie
VY>#?4I
gc|`@uX
tn?QB#|3
.+TpA0i"
+;VU<LnyIUd
">=Tzr8Rw[
yCx7sa$TzR
-Z3`>e
6#gmp
4bFKb<3
<L9OIh
>"o33;~
#aY$GQ`0RSdf
B|}AM*atj
m!ap|i
:K<7)t
!@5'/}r
nr'bU~g
%|O'?*
HK|T%
Y(WDXS
>g}a[*0&
nh<a4?rNihB,E;
l%.#V7@!
'7DOOr>
MiBg*x3
aBXAtT"
kia!dM %
DF[O2X/:4$n
- JK7-A$
UT_Q>.w)
ODwqQ{
xW-;U(e
#/7][Qh0'
#~|q@r`vP
+PZz%>
p.&Gwc>4;mA%{v"~`qBGS
wc-t3T=.#"SX
.pa^ENS _..
Hzk-`0
?ocXy0
|Yan=7P-1kuC
ZHKaz}
)5Uh,^
S2gW9Op
z^SItZnav\m
_W%$rJ
,Klrx@4i
!t\rum
?j)O-l`
t>j@UA,P6
@<;M)CD[~3t
3L]:<1"*N
ZIwg&3P
,JscgTn>
nz4C|z
ysQk+vn`
:=m?*".
1$K"4|!O
aK.f%i,
_%oSmzX=W
&ODM5v&Ek]
.#eg=HhBX
;>jW+3n:*
9<mWX>%-*
aB6l@;bb7czF>M'T
Rowznds>
)*`g"<m
DT^y=P$-
+GPgk
^k|>l3
l)x(@?
O/\ZZ3anKv0<
0P`7BB
h@Du|2
:68<\eF
<:z#9x.e
~x-l7
8;YC,=Z
o&-2=fus8[|H
";2?I=1w7*"
MM}RmTq
Q(o@\^,l\^mWS
^(JUIo7@bx>
EQ}vpV~
#&**oQ
\@zc"[8
uO:]yfQO
Iw_qA
&DNS{`
UGnAqA
;x16IEk;%]
.ivcAG}m
|;Zz^_
M<lR^q/
](8MjfR-IJC
kNr!Qk
4][I]J2|j
wZ3[CA
J'O W7DELm`
e|E}EMcxR
66TOe~E%
<51Mz*7
@1t9xK./
Nnuh55~bNS@.
VTGp'j
9)iTmwe
OeIF%eFr
~9!MADc!I
0PAdn%
AiGLt\"c
=.Xt$)
S4Q%~a*"W\F,#
4ffQRP]ON
b:=(vG*tkx
U~$)"B
_+?p%s;)
" /Xra
TV!Fg
L*"-^Tn
>uyYM6
+q<%87
!-<7,qQ
XJhI-F
Qf~f+:t|9bT2x2@
Y_GHFQpqNa;'u
oJM3Aw
IJQ;J'
\p{hwV{#
z- L}R
=;gs_a,(6{(sf
qFdZB*/LTDOd;R9$#Y@[x4
<L%16`
69g{.s
%~\a'@1glt
_]y}UAY
>QNI$'9
i%#\ZVFdl94XZ
2^w\Dl"h;M?]
`lSwhE,
Ej<$D^
![0dZ
T>.^[6`2)E
}NnSiC(
#GP[-c/w
A`ECgXz6Bu2
{r8PeRzO
'Q(wOp>7
$gVid/d=
?x!*h1!mX
dN7G"?<)*wLuZ
Ozcq+B
O6]D5M
o`2wnZ
ZbA*R4
qC|oGe
,I3c[$
6=w4|7
{0!NW;\
f\5tZb
dQ=yL$
Mn+BiL,5VbObH-)6L!
V!CG$'V~p<-d
9_=2j`5b#O@
_e';y-^
" \r_9\gMC%
CE/~+$&%ameN
ANt49Zo$bo'{
u@O|)x_OQ`z@%xC=S:)v84r{ N+2[4a
}1Rg.~
y0j"+-
;N@#gB ]Wq}
9frjY-
w_X;W&61'{
{8YxDQ,*B,yPw
z#B*ltz>
\yty
<0-O#
iL+o([67h~T
jD6rv{}Z
gGnsb>b/v
5F2f`PE
FfsM55
V^CP_m%gZ
kW^bDB
"~DMx;2
}$jYVJ
S|/)b(cb(#A
LAz.#1
9BI^iI
6;/G:\`(
IL:U)u
B`JepAG
i!i 3Tl
,Gk]a1T*Q
YKl%@=U
KIB>b$
wuSv,G1y
qeij.t-0pq:
WM.u:@
m.k&N0^[KF.
gwd"gfQ.]ol
+9:-d+7"
dlyWzu{u
j4+@NEPUp|/8
f?oF^G
KP,55s/
9n!-((PDj]!/s
)v]5~Kc,/
{n?7Zd
DaG%s/nH8BY)|gV|
F1|GA's4
P&CYT/8
$jcK(F85{[BST^@Q_!
nWM/wwN
P;*tF#
RHOPGJ
T}J8,s
P&kl+O
vrk:.
A\7XrO*{ctI
>8Y5lV.g[D
L)Q\\q>-V
OmxKO)
cLl%_A
L"iWrV,9$
8q{\RjS
*EW3#B2mK(
BGA[qEhIlF
~/C5Fp}
)jkhtp
mx]Y!&{
*rHf;Xc
W<M?3_R7U
rl]?*y
_Y3+_]
pTL3d0*>
<V_g2e9FK
ugKf<4Pvy|RW
je nz`m
Q%}qi'P@4Z
MIbzZbI)w=
yE/e6?s%KX%;cV3QZ4"
1~P+z#{Jj
":bjqF
Oj_E(-
yvTtt0PN7
_Bdjhrcb
F A%+1O
4 f^7G{
zNI.0pg
AH4Y0>
&xga-A|
iA!H~L
V%b|?Dz
F7X;M}"|
@mQB!5
1rBJCq^_d
u~<[cX3 bAi=2p
gt+M-fqp
LUUc\5VeU
3ET}Jp?=/uM3wd;o
t{!m~;F
V{|5;e<L3
z vLoT
]$$Gy<qFdoX28@
<K3s|5
MWC2hOwlC>`
gSenuvRTfT`wn
)k;!W`fc
8 yT_y]Q{
GZ)suH#%(5~.G
%}j]"qWsk/#
:G`@IW
j'M}DD9
XF:L-]^
N;R?'>1=$~i
`Ck~`j`
EOR.$'q
9x">{(hk
X/jh$h
$q.Vb8sb
|}I5YE
(4Le>f
t<i<&-cq
&XGf1zN"
BQ(h_EGO
]0f0f,
f)gQPs
Wc.'\w
(y=;X;]b;NwE:
I~>hDu
W3~/\4AWr9e
0^p=a{UK
@ZZ4W|]zTZyi
eeO<$Rr|K
\ZZfHEk
\<vX%sx+
MOy)5+YLnko2
iua)d(
d],Td:*
|c#@0v
7mL_hFO
DL^F`4clg<]
_)h9ds+jdwz
PUUDUn
<$Eb#X
,P<msT
HaRVW)s
iE!3`V
eGeF(
69JC!Z'
D@;`\UX
D::Pd~
y`-CF#>!
kD]OE>
S!AnB'3
h9,PU;
&VYJvKMrw
6'+E1N-
P%l[{r@,
OtfnN;
U+WAt{:
AUu $g6
0>I)>S\_j
/!`J!a
Q5*+(VQj
+Z)-H>a<`2pE'8Ni
O])ZDk
D9NSbD
)ZME"~
=i-%EQka)
-|2B<9
(9>{98T\x@8a
P]r_v~
c)~KkM.] *S7%
xv<f:L?tYGtS
e7v<fC['|
9b/1!f
rL=e4m
To1:Vh3J
l))83F`"j-.
4LdMcL
Q%R(`lh]|sKq/j4(^
EqNNpU\9
|@`l>LW
C),l!!M
*5xY/B85osk
V&-4/"r+
*C)XLjK
:u+i:wcbdvw
GT$/op
[t ?==N{
L7j"V'.
@VL&ZT
b_@>i[;.;L3
x!s3%y
'Gv3*\
_`jw='!
zO#>b3c
_(t!eg
zvE;d=hN"iP
gtux7/j8
_XD%:-v=`XKDQ0>1o4Z*
]IegS&FR0g_6e
|\=P).
z8f9x9#O
hl"`3.;a
#\Z-%H8#
GwZ>CSL
>rWf'P*
$nixs8
Cg@J k
7KxXI(
QCHnjo),TC
YHxX`2aov*&gEb
<`vD]/
.%zan>b6r
&IdKo9
zsy.4h#3#{
8&e/oe
<@\2D
H\tpV#^
AzK]i}o*
F>9O"]
h\w8x4.
Xa<Bd^PR
0E4Wm-
~.Xf/AY>q
/i8V*fPb
NHHFnJ/]c
'&`h!6[
q}_mf@tW
v?z`.Y
" {&nG*z
n}:4vOuh
'[`')0
| U5cZo6g'?
$iO;5p"&]
C/6,hM>
jy *Ar!h9
P*cy/I
ca+-LaZTM+]hL\A/<8U{Kl
NF<7T3Qu
._N]"Mk^0
i~5g)jtP(r
y)brBf`
\jkgH&c`eI8
m3ppg(
Z'_OsZ@
lQ+y,@9$%)
N[T%>PI
Lq"Q@T&vj
ms BASAm
D%_V|WANj
'"TStwdM7
9`N*S~bS"w
#u`VU--
)F`]IM
*hpQ+XLU;[
h$MV}DH
+[oq0<;b
U#--vKN
;pE(Bzo@n
;zM ""UzG{
$yX!/*N
:wI`}8h~`
a~;3xi#m>)B3
-+1f_cW8G4C!C
F7d0puZa%m
iYW>T$Y;
}m/#o>q
jyzB?(p'^
pgBP33z
VNXBMz&
a,XOCU&u
]"4=nXw
'y Y`p?
yz@[a^20
##}&Ap
G8#8s"lY
I*'6DA0M>3a\b'
SEZfCG
G;Y,"zd
3a}?:V
xliImF
,VTPM2c*
h:b+h\}v FqRF
JX-'vxn|j
_|w]Kw
ErJz;Cpz
$MCfS2
X/_Fiy
(4WdR
*g=3u|
l`BpjRixR\r%D
jc?dYw
j=$s2XOu!{
A~hqI<*
%DquS?$lJA"~
3Vv5BoD
0&SynTwa4pz
eaWLfuyL$R$z%
!Wjlb9C
EUHQV(u
{e{*Di}jQ
j,Jq6>:)
8ZR3I*4P:
NRJa2,u%C:Q
&Z&Di|-
X/DGUl
e 0v`"p[
ii_l14
v,Ktg.{tc#
F@s(@?
^Wa(su0
a*V%P=27
b_9jc(
1V>lF}
(;F^O_0J&
t"3R}2
7eJezvx:
jLrCb
31b2d\
pUQ/!\N~^th+
~vo+~wN
q$5Z~>yE
t{3x(dduk
+&]zN9
g?woCH
IpeeCh[L2
zZWO&L
?N^uLKy8n&
?{\UqHK?1)oA
EyW&A
7MwSf#?HR
Gek <ga
= 1sJh
c&AS/M]
Ci:iyAzu
,&R<Qr
k[3r']H
/8a1vT\K
VJPbDQ,V
Espj{R-#'>m
|aH"&B
]7*jHbdih
'i+@#FH3Q-a
=l#3r/Os
,\:gobPj<
W7Ns/pl>*4@
c=ggYHA
"&9%`H'X2Eh
#&g vHc#s"y*SK,1
!Zmu2j
#A+JS6
q^EP]-0
=9|Pmas
kyoD\ oi<f%
=Du["X[
}?Tq-z_5
EZj?!K>q;
pM(J<kz=r9*N
e4"Z!6?T
3h\ypb1%F
qBPM%JjkY^015
P*W6l
k!q'`gC
L1?i+kQe
V=I5o6.
Zn"(VOi"
zfM)@RG
/E(wC
jt}^g
7D<~h*.l
ucB@-C{|T
yvYQ,^N9
%("1?Bv
2(%%37(
'g(e#
f1nR1ApT01qKk
.!]z~
,ZDEUu
bEenNJRIZN&vf
5$7lT}!|6$7
{LKVLg?{
3aM)wKnB
AIzy;:$d%ABU3
B>d;oq
Fp~XL^
yw`JZA
mlllAlgAlg!f
t]cw{iWV|-c+z
xkvnW~VX{
UrZkK]Sudj
0j%-=64\a,}]
iCafzWHY
4d& \&5
6&OR/P&?
OM-~-}-JNn@}
}9kRgz9M
T.oS.oky|y%0C^G
wupqcq
9wqtwCoCo
9w#nw#o
9wnwnsn
;{{{{{{
UbNeW[O[JaLg
]WZm]fX\X`X^W
aCf+g$f
hO&[9Z3%
mb`]|rtwl|knZIZFI
vRp{=<'
mc[^-lt
"Dao||c
D@sY6~v
nL!||t
,c*r@wTH
aXUHq4
_Dlq~D|_U&|2
gDklw$f$
z}c}fn
gx0b4)c,)c
m-#k$_U
7^]JJ^:
:MJ:2K*2=K
M9Cqe@;
<@?s9.MCn
u~M>Bnr^
sYENMr>r
b!4RUs
3Ftwgxwp6uwp
cFtww6
Ftwxuwp
Dtw47u4|
CssBsBss~8
sY8IsIsY"
7qYs2Is8ts
3r3r#r
pcrcr3
xFt3_$YEz
p1Pn^SB$
W="5>-Z%v
hGi"aW*:
)c!Q9?h1G
wwwhwGv"v
z)azNOzs?zwW
~Fzb"z?~z
jI9>b52!&z
nn^Cel
!ttPaz
fklOxd
w  xg
Z\[byTm
}`{^my
f^}z_uYtx\
ocpbug
rWX[rqr
qXUXjMY;DY4;Z,7p<Am&
<dnLd^
HxF>6z.i
_NN}YYx
&}Mk;;
0,^6.&+
AJ6.^d B
PqQqQqQqS
Hm]]Aql
yl_8^;
C7p0///0V
A^@V@N@F
>)Y6!Y.F&
-Hs[KKK
pNpNlFx'
1eMjG4DG4<
2020/7/7/k
#WBx=5=A
I2I_n2vEjAq
2srqrrrrttttttttpttttttttttt
$>Vd^U7
&y_'|A
q"r`rrttt
OR^A0VOfN
WFYc>_e6UN.Y[$;6<~~
O9-D-<~h9vYDk8
6y5ziw[wz%l&c
k6u.uni
?IbR<-N[F
M>c6..
##qttttCa&
g~O~~9~
8`v|dyrzi{O|
?Ixbb(
La(rrrrrC
?FcT>EJ6'e.3c&*b
`Af666
LLr666H
H0{)7{
<@{R@{N4{2d&{>)
{K6${w3#{d9
{{=zA\zLgz
{O>z5zI5zGzLzDz
W\Xb}lY~T|bgEvnIr2zhcpc0S0S0
`|YY-h.O
jbbbbbbbCN/F/>V6O
.[\&a&
E-.+/8W
Xw0<wp0Dw{Z$wX:w`2w.8w4Fw*AvKw;w
:v.=v+:v
"!,(R5W
Dyk}boyoU+T
dNaA$f
5C+YQEZ
bIbbbbbbbbbC~F|>l6K\./(&+,
Dt.t$t(D/t*t~
tx'tsMsFsLstp
}o#shr*Xs\6s+?s5r
7%-'.N$(P
YH^`VK+?Nc
VsWz]xk
bbbbbbbbbb@
SNp>9p>)pj
pR2oN.oJ*oF&o"bo
Wo9So-OoQ{oCiok
^]c]Bk^1a>fMjI%q!5
b}4N0J,V(R-?
bbbbbSaY&6F#.
|y}AEFJ
l.%lGRl
F!lhI"lnM
ZkVkZkZUkQRkNXkL\kY]kO!k$%klk
[h^r_^]c]Nd`X_Lba&d
c"fm"BZHsKU_L1_^ra+va
vE#l{G
srrrrrHpErdS
P;[EW?#
s/Jmohh
+U!NRUTNE
tttttttttvtrrrr
rrrrrrrrrrrrrrrr
';KVSH2
7e2;h-
ttttT|
tBt_totttrrrrrrrrrrr
.aK`n)a
`'|'`-+`
ttc.P)m&8S
Q4S599+00
s{'H)h_~[v[n
`+]_+]_;](~\$T
/\.4z\/
x\&&h\
5U3Uzb`zao_g_~x-d
lk^qVqNqFq
6fnD}[~}[v[n[f e^5]VC^N}F>`6`.`&][
dddddddd2E
yY&%hY= _Y;#fY:N^YNEYL<YnQDYuVCYt;#Yb8"Yi=!Y?X-+YWXWXWXWXaXiXNXj
Fe>eeUx
Z]WSa@a;K`BN_]_
`^qg^xb]
";7gtsccS.
KNCPFIJ>U68.3&6
iSxSxS
~~6J>J<NU4NU<NU
6U.VUWUW{UW{UaqUe
#GlTK9UK9UKTK
T@%T7GT
BI_E\_W^vb^x]YcgXjjXZ[791aaa
72Lkfa^afa.
0^!) tbRjR~rRv+rnd
dddddddE
_i8R,Q$Q$Q,Q3Q
QEKQzPQxSQ_5Qf8Q;Q>Q]WQ$QpmQpeQp}QpuQpmQLQT+Q
;Q1+Q1+Q1;Q
P4W-Q,W%Q
^_4f_,^_$5}#
SjXV_\
{gMHXXH
1A=3;^~3Dv3Dn3Df3D^DV<bN
#N3N8E N8E
\M&&_M>%GM
h\[hT[hL[hD[8J2+pU`U`UPUhD[h[h[h[h[
vE[8pp
|c0_RQI
nRqf1^1V1NTFc>9
61 .) &!
..WC4I44444444rE
J~|EvR6zJ!
YJ8>FJP:=JH5DJP1CJx3#JqN"JiJ!JQF J<I$I&I Is
J!r0JL:ID:IL:IT\I
I:I:}I
'SzidW:7L;/D;[5>
AQ?I>Q=Y}=qY<iT;Q:L:
J~JvJn<f
V)N.F2>/6C.G&;
s6{,k,k,0,F0,F ,F ,F0,FxNgF
#TW\EoI
F_IE_7E
E,EZ4EjHE
nN:Z;g<T<9.$3!
y@n@v@p5}i
mBfHxF
iS2`"44444444444444E
5B%B&B~)BB6B<B2B.IB$?BVLB\>B
1AB83OB+FDB%HZBJ
XB1LVB#>LB-@RB'BPBTAVA@wB
c6S6S6-:
_Q]GcU~<vBnRfGi^hVWNOFV>N6N.P&J
K>YE?Jm>
O|FO>+e>,%b>^)>]X">
]^z~qoH
QZv>1o@Ku=^3T1Jv
5xG{Os
R>Q6G.M&S
2222222222222$$rE
efIc^F^VU_:
];-/Z;!+F;
:I;%GR;II;XB;^,;\.;D.;E:G:A:`K
;YT:?Z:Hc
;Gb:Je:=`:_;:_;:
{<h>n@dBbD
b__[^\Z
\/7b57
#TG\.7(6
6)6/6ON6
wHl}zp}^
TyZ{XePmDiIVLvQyW^jK/
48XpbVTd(O{wjW][aA_~Cev
""""""
"""""""""E
l3F"13H$g3<0c3RN2ug
322q2q~2h
$6C43434#4Xam
~v~nf^
VNF>6.&
020"KR=
O/;C/H0/F
];H"!&*(
+WmPrQo
NVc]]iyxvqQq/pU
-23"~"""""""""""""a>?
$,++++?+:+L+=+8
+>f+]+S+6+)Q+++,+P
NF~>6E[^.E&k
h(%g(m(@
.Did('''W
;$4%)f%&3
a5%gE/q
1v~vnfl^VNFAKU:.
2222222222//\X
~$d}$n
$V|$Pc$Jc$b$b$I$H$)8$"?$$'$
$^A$H\$f#^
$@#9###
S2S2S2S2122d
vn|f^QVONFF=>6.&
!H]< >O
#JSq,ILP1k{
;SJT;E=W
he ab
Nc@\(Ad*co
B2 HEEHHxH?IBBCO[15]4444444444444422222^3
$$$$$$$
~,u #u!"
9h~\ji
UM=^\w/IJGVQ@
VE|sR|wY
WyY|S{
|{~k{~k{}~mlriln
yqkm|Hvxr
.z+wAt?z
NM?3QEMJIl@
VNGIad
jI]I]!
+@QLbHfrk,H
\kwzHW+d
&(0B>`m
^By&GX,Ex(M2Dqz^
H/`cxC\nRsr
J{`CR`
a\hWgV
UY-eEu
gZZ![?`
m/cZ-<V>#a.yYUgwdae
mdpjStm
:):]*Y*Y
7^6Y*yF7.>79F7
Cq"vN6Y69
aO~s^:
q\~s>~sr89YL
bL~s~s
yT~s8y
{|sqLp
Yav:bva
.skzskz
zs~zsvzs^C
Vzs>zs6zs>xzs
oCpCpw
vonnnp
iowcpwow
Yop3po
{*)w*)w
(^R#R)
6jRjPZL5
Go5R-T&H{<\0$
unm,g}GH$[|A"
lg.HJ%Q
:62Y*t"=
4xm|ih}8v
)2F)I
9"; F1
M;3=9898
8^8^9O9
)N22?2
#*/_*c$I
(xooy$
NyZoloden
hvnf&x@
G8&>6s9
RAsW}J$
T3//WUB$T#{//s3~x
A-z3c/87Tuuk
r]VneVf]V^VVFxN
>6_y.eV&]V
L)gWa]aeq]Ge.
G2K~fW
!K! BLgnD_nv
nncn;t.
rW&r/p
OoeT;%
0[.>.8%F
jN_t_lc8
74a~^7
fhrYm1++84HLx](C
" o0oj
Nd2iOz
|`~`vfn
~NdFZ>Z6k
HDHZT~n
#_t`l
_,_$iZm
PuL6D.q@H
TYf-z3v(rC
F & 6 )YY
H*(
~vnfEe^VN
sF>[6[.I\&'^
x|GnDm}eem]fAXAHjr'eEm=e%
{)x5w#v
a@DX3Q)9qv
O_b]8A-TQ/a|
HrJp!`
LNpDn?8?2(1%,
V>BNKGF
XAR;DP
56o2/v
|-d.gMgT
Lg-ZuvyZNaRu
p00#:F{
zv(nfW^RVJNA
}yuzn{jwfsTA.w
NfO^OVLNGFC>?6(._|&z
3b{nc;
B~iNv_Je|V\}RC^B]+\2&VF=_
n7ShTbH}<~@D
.@mJ_cf
DC>3L)H&T%Q
enmffCb^9nV}rKF
Q>H]6'^.%Z&f
O)P53.
kc{OA[WWyEchl_hftU
jKkKX$Uf
,Wk`H-
~%9Ps?.
8lbj\71|
nj")W))Qtjx>
~vn~f~^VN`F>*:'
]S/1G5N
Wwlpqu|o{ljljZhD
<UF"#d*sencw!E0:
`5KiQrci3>>s>NH[cLlS>
>s3E<7(
~jhlXf`~cav,^nGf
FV.ON+TF
KY@KI@KI0K9Un
*pmm_rNOALHJb_U\dyf~ilS
;W7VO/V
<<<<Fdev\
6=G.=J?>JG.J?Rn
tardSGPJIMoO
k8h;Z1%
|tl'2i
N<NDN<NdN\6L
Yxfx^xVxp{
<b[[[)=
R-_JOalas[[[Q]h
lil9l9l),+
2@GX`z`z
wbAxi\
_"W*****w*$sz
^Q{VdNNdNFdN>
4>svttttttt2A
m)^2GLU]z`k[k]Z^[`MZ?\9zVCtX%p7=
7!q@@
xQyxQyXPyXyXyA6
KpQZFU8K*orp-l-:57|N~
5.(!)!)
}ZX*I*~VvWnVfc^
W#]5U5}6u6|kc$q
e3|JA2P\EWNP
xxHy|~x~aN
iZtPu"Xl
XL[xD[xx~w
eddddY+
ttttttttttA
<UP;NIe
cq6k8]:_EZ@
6jlGl?lGl?l'll'
Ccwswswtpwp^v^wnw
SQ?6Z0.
Qa!LX(U7@?
44W0#TS
&~68v@2nB4f5?^/AV);N
POCR}U5|}}6}u6|}1`}a
z}bk}]n}
:8S5Q3!'[-I+O=V
C@ Y|f
'/@f.6^<<V2BN(HF&>>$D6
edddddddddddddd2A
6z+cz\`zZvz[izh4z-kz+Yz4`z:VzHLzJy@y6?z<yB>z&z3z,z)zx!zs
zkyey_yQySy3z
<SD|,p
@@:bLnnK3
w1m+S9R
DWEHBD^`q`
nwf6.^^VcNV&F]->T46;;.0@&
"BBOPTZvUvWvYvv
v-vE`u#*u
?W("Q*$)
3;/.**UN(M
.@*\rI!K
eddddddddddddddA
;sUQr]QrIer ,r
sJr'Cr!=Xr+?Rr%ATr'C6r)EPr%r.r(r.rqqqqQqOqAqC2r
ciLnZ-
\1E>%AKZ9\
HFKINT~9v
6Jj.Ll&JknEinGg.oIe0o
?"R[n=_n=gn=_n=Gn^^nB
nodu[z^w]{`fciJHl<iK:e
brrb),Ct
6ZF;W>MY6WS.PT&MQ
Tbpbbbbbbbbttt2A
Mfy;^@Uk@Mk%0k3j^+k6'k=(k6#k3&k5
k/j|0j-j'j)j"jC_j=aj.Zj0\j
Qj/Kj0LYj*FSj$HUj)EPj:~+j
=|lQh_]Hul3J
!x uP[}D[Ht!u1p
M^b.V]
NYFY>b6p.fj&j
*DRg%FLg&A?g(CQgE~,go
Hf!fF&f
hfgfgf
s[[\\xuqugvj_c_mqwtr~
x!Ty8,
JP]J[XQ~ZvPn
rrrrrrrrrrrrr>
-AK(H-AYc\d?cAcJceG
c_IcWRcOcuUcwR|cxSdcuI\cdLecjL]cmK>cbL6cdKEc^I=cyT$cZS
c\Q#cO#cZ
cR$bU#b
b>Qb%UZ
x59r[tu{ QE
[qQorFrdWbWZeXV]~O]OU^=F^
NKQ~Kv
VnXfS^
`VT_Q"__
_{w9_YG/_YG'_VH?_PJ6_C=._e@
bSWZ\XYY~ZYO
\Z=AZ:BcCdydzU4U:qV2e_d{
RYZPZYc^cOd,U-wUI
rrrrr)Fr
Kp=vNLFJh>OjH\PjX\AjX\Uq)\C;&\e?
\_A[WR
\{X[JJ[<O[7P[>%['[([5
[7[/3[w[
juU[QAv[xyD[
><pd3>
bbbbbbbbbbbbbbbEGTDIGIG
E-F)^W4bbb
bnb^bNb
^}bbWM7i.hd>:dEfbR:
k=3ln5[h
ifM5nVM8kiW
="i\*"v
Hnnr-5nI$g
"em6-m&loa}Ojl
^\sHv
qqm,Sd"PcARq(xb,q
t;iGddG<sCH
0G3k3`
BSD`XBDKASD@X"DKASDBK%
0; 0.1 a1
3"%4"74u#D4{#V4#m4#{4Q#4#4K#4#
%5m W6
!6}!c7/!7Y&48#&8y
/#aXamaM
E1=[2Qdu2`\8ZV9VU
E99:7;7L7U
6C616oQ7wa7Cx7Q
7/7F75i5
YJ6\Y]6
#;\'6<7'T<
'q<&z<&<&<&<,&<"&
=%X=%=
%=?%y>t!>!>!
?"*?!l?"?"?
V0 1 F2
g>^vpf
+H5K^ny
h&?hKXuX
=;k;;ek9
:Y9I9IW:b8k:-8
:Eh>:RD
1B/C//;/Ih0)050A0.;.h-
7&8z&8p&8&8
9 9 49 B9 ]9p 9,!;&;
D<{#W<
:;9@2@
`:.^4V4N4qAV5a5
F3_T4T73MN2:d97dd817"@)
1%~:d":
":D":D":
+D3<;CK
Sb[bcbkbDs<{
1\DFQ?-uFp0
ZFuEDD
8L#E)8
DDLPLO|BU
BDD#?BD#&7~
D/PeBT
Em&+~DL
x1^F]RF5h
BDD/?FD#+
UMED5E
EMED5E
yBD9?D
MUuW/UE=
@D.M@UBmEBL
.MMyJ(
BT#N.~
EAI4`.T
NT'QBQ,
M@TB>4kB@
cB}UE4
VQ?lP$
2_BjP%)
MAz?(M
OjjP]#
MST~sKTDATL@3'~
|SB3N&
36&-:%
0BTE$3%
ReadFile
CreateFileA
GetSystemDirectoryA
lstrcatA
VirtualAlloc
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
GetFileAttributesW
GetLastError
GetModuleHandleA
GetProcAddress
GetShortPathNameA
GetShortPathNameW
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
GetVersionExA
GetVersionExW
MultiByteToWideChar
QueryPerformanceCounter
SetCurrentDirectoryA
SetCurrentDirectoryW
SetFileAttributesA
SetFileAttributesW
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
WideCharToMultiByte
lstrlenW
KERNEL32.dll
LoadIconA
RegisterClassExA
RegisterClassExW
LoadStringA
LoadStringW
RegisterWindowMessageA
SendMessageA
USER32.dll
RegOpenKeyA
RegCloseKey
RegCreateKeyExA
RegCreateKeyExW
RegDeleteValueA
RegDeleteValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
ADVAPI32.dll
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
SHChangeNotify
SHELL32.dll
CoCreateInstance
CoInitialize
CoUninitialize
ole32.dll
PathRemoveBlanksW
SHLWAPI.dll
_XcptFilter
__getmainargs
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_acmdln
_adjust_fdiv
_c_exit
_cexit
_controlfp
_except_handler3
_initterm
_wcsicmp
mbstowcs
wcslen
wcsstr
msvcrt.dll
FFFTWARE\FFasses
yysid\{09474572-b2fb-11d1-a1a1-0000f875b132}\inprocserver32
\55222
?A?>?'
3tT3dw3`W4
5|65Q]5%z5
6#616O6g6{6
66_6<6N7e7{7
7(7-7>77777
8*8_\83l8888
lhJ*3{08
;MkCgHV
~~nf_-A
8$SHi&2yMf<
9\90pc=?
C%|lt)
HW4F2_L
}f{r)&
z^R|_qd)
v:?WeQ(^
KZf$2DM
TDJ$@B('
@@@@@@@@@@
@@@@@@
g_c s n
LG[=JM
tcme pa m
srnVrgnUnm
\[G7;PG$
clFlcq
mkn?p_
orxs|}O
V>8:GIC
zt{u1#
Z[`b\c
/CX]YQ
PZLNWY
;7A!64*;1DB
Q1A111!1
+?OZWH6#
n;WPL*
Cggggggggggggggggg
VS_VERSION_INFO
StringFileInfo
041904B0
CompanyName
FileDescription
VarFileInfo
Translation

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.