Analysis Report · CAPE Sandbox

Analysis

Category	Package	Started	Completed	Duration	Options	Log(s)
FILE	exe	2025-06-10 19:56:01	2025-06-10 20:26:57	1856 seconds	Show Options	Show Analysis Log

procmemdump=1
import_reconstruction=1
unpacker=2
norefer=1
no-iat=1

2024-11-25 13:37:18,663 [root] INFO: Date set to: 20250610T18:36:27, timeout set to: 1800
2025-06-10 19:36:27,013 [root] DEBUG: Starting analyzer from: C:\tmpjeo7jmad
2025-06-10 19:36:27,013 [root] DEBUG: Storing results at: C:\uyHCokWh
2025-06-10 19:36:27,013 [root] DEBUG: Pipe server name: \\.\PIPE\IpEgLKC
2025-06-10 19:36:27,013 [root] DEBUG: Python path: C:\Users\Packager\AppData\Local\Programs\Python\Python310-32
2025-06-10 19:36:27,013 [root] INFO: analysis running as an admin
2025-06-10 19:36:27,013 [root] INFO: analysis package specified: "exe"
2025-06-10 19:36:27,044 [root] DEBUG: importing analysis package module: "modules.packages.exe"...
2025-06-10 19:36:28,075 [root] DEBUG: imported analysis package "exe"
2025-06-10 19:36:28,075 [root] DEBUG: initializing analysis package "exe"...
2025-06-10 19:36:28,075 [lib.common.common] INFO: wrapping
2025-06-10 19:36:28,075 [lib.core.compound] INFO: C:\Users\Packager\AppData\Local\Temp already exists, skipping creation
2025-06-10 19:36:28,075 [root] DEBUG: New location of moved file: C:\Users\Packager\AppData\Local\Temp\acehtml5pro.exe
2025-06-10 19:36:28,075 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2025-06-10 19:36:28,075 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2025-06-10 19:36:28,075 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2025-06-10 19:36:28,075 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2025-06-10 19:36:28,341 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2025-06-10 19:36:28,404 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2025-06-10 19:36:28,435 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2025-06-10 19:36:28,451 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2025-06-10 19:36:28,466 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2025-06-10 19:36:28,466 [lib.api.screenshot] ERROR: No module named 'PIL'
2025-06-10 19:36:28,466 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2025-06-10 19:36:28,466 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2025-06-10 19:36:28,466 [root] DEBUG: Initialized auxiliary module "Browser"
2025-06-10 19:36:28,466 [root] DEBUG: attempting to configure 'Browser' from data
2025-06-10 19:36:28,481 [root] DEBUG: module Browser does not support data configuration, ignoring
2025-06-10 19:36:28,481 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2025-06-10 19:36:28,481 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2025-06-10 19:36:28,481 [root] DEBUG: Initialized auxiliary module "DigiSig"
2025-06-10 19:36:28,481 [root] DEBUG: attempting to configure 'DigiSig' from data
2025-06-10 19:36:28,481 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2025-06-10 19:36:28,481 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2025-06-10 19:36:28,481 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature
2025-06-10 19:36:28,685 [modules.auxiliary.digisig] DEBUG: File is not signed
2025-06-10 19:36:28,685 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2025-06-10 19:36:28,685 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2025-06-10 19:36:28,685 [root] DEBUG: Initialized auxiliary module "Disguise"
2025-06-10 19:36:28,685 [root] DEBUG: attempting to configure 'Disguise' from data
2025-06-10 19:36:28,685 [root] DEBUG: module Disguise does not support data configuration, ignoring
2025-06-10 19:36:28,685 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2025-06-10 19:36:28,685 [modules.auxiliary.disguise] INFO: Disguising GUID to 9b7cdcea-e4d9-4c24-8a0c-bc615bd315ed
2025-06-10 19:36:28,685 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2025-06-10 19:36:28,685 [root] DEBUG: Initialized auxiliary module "Human"
2025-06-10 19:36:28,685 [root] DEBUG: attempting to configure 'Human' from data
2025-06-10 19:36:28,685 [root] DEBUG: module Human does not support data configuration, ignoring
2025-06-10 19:36:28,685 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2025-06-10 19:36:28,685 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2025-06-10 19:36:28,685 [root] DEBUG: Initialized auxiliary module "Screenshots"
2025-06-10 19:36:28,685 [root] DEBUG: attempting to configure 'Screenshots' from data
2025-06-10 19:36:28,685 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2025-06-10 19:36:28,685 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2025-06-10 19:36:28,701 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled
2025-06-10 19:36:28,701 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2025-06-10 19:36:28,701 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2025-06-10 19:36:28,701 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2025-06-10 19:36:28,701 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2025-06-10 19:36:28,701 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2025-06-10 19:36:28,701 [modules.auxiliary.tlsdump] INFO: lsass.exe found, pid 696
2025-06-10 19:36:28,731 [lib.api.process] INFO: Monitor config for <Process 696 lsass.exe>: C:\tmpjeo7jmad\dll\696.ini
2025-06-10 19:36:28,731 [lib.api.process] INFO: Option 'procmemdump' with value '1' sent to monitor
2025-06-10 19:36:28,731 [lib.api.process] INFO: Option 'import_reconstruction' with value '1' sent to monitor
2025-06-10 19:36:28,731 [lib.api.process] INFO: Option 'unpacker' with value '2' sent to monitor
2025-06-10 19:36:28,731 [lib.api.process] INFO: Option 'norefer' with value '1' sent to monitor
2025-06-10 19:36:28,731 [lib.api.process] INFO: Option 'no-iat' with value '1' sent to monitor
2025-06-10 19:36:28,731 [lib.api.process] INFO: Option 'tlsdump' with value '1' sent to monitor
2025-06-10 19:36:28,731 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpjeo7jmad\dll\pQxbIz.dll, loader C:\tmpjeo7jmad\bin\EPCPTrhb.exe
2025-06-10 19:36:28,810 [root] DEBUG: Loader: IAT patching disabled.
2025-06-10 19:36:28,810 [root] DEBUG: Loader: Injecting process 696 with C:\tmpjeo7jmad\dll\pQxbIz.dll.
2025-06-10 19:36:28,825 [root] DEBUG: 696: Python path set to 'C:\Users\Packager\AppData\Local\Programs\Python\Python310-32'.
2025-06-10 19:36:28,825 [root] INFO: Disabling sleep skipping.
2025-06-10 19:36:28,825 [root] DEBUG: 696: Full process memory dumps enabled.
2025-06-10 19:36:28,825 [root] DEBUG: 696: Import reconstruction of process dumps enabled.
2025-06-10 19:36:28,841 [root] DEBUG: 696: Active unpacking of payloads enabled
2025-06-10 19:36:28,841 [root] DEBUG: 696: CAPE debug - unrecognised key norefer.
2025-06-10 19:36:28,841 [root] DEBUG: 696: TLS secret dump mode enabled.
2025-06-10 19:36:28,841 [root] DEBUG: 696: InternalYaraScan: Scanning 0x00007FF84A790000, size 0x1f4542
2025-06-10 19:36:28,857 [root] DEBUG: 696: InternalYaraScan hit: RtlInsertInvertedFunctionTable
2025-06-10 19:36:28,857 [root] DEBUG: 696: RtlInsertInvertedFunctionTable 0x00007FF84A7A090E, LdrpInvertedFunctionTableSRWLock 0x00007FF84A8FB4F0
2025-06-10 19:36:28,857 [root] DEBUG: 696: Monitor initialised: 64-bit capemon loaded in process 696 at 0x00007FF8234D0000, thread 4736, image base 0x00007FF60D500000, stack from 0x0000008EFAA74000-0x0000008EFAA80000
2025-06-10 19:36:28,857 [root] DEBUG: 696: Commandline: C:\Windows\system32\lsass.exe
2025-06-10 19:36:28,872 [root] DEBUG: 696: Hooked 5 out of 5 functions
2025-06-10 19:36:28,872 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2025-06-10 19:36:28,872 [root] DEBUG: Successfully injected DLL C:\tmpjeo7jmad\dll\pQxbIz.dll.
2025-06-10 19:36:28,872 [lib.api.process] INFO: Injected into 64-bit <Process 696 lsass.exe>
2025-06-10 19:36:28,872 [root]  <truncated>

Machine

Name	Label	Manager	Started On	Shutdown On	Route
win10-2	win10-2	KVM	2025-06-10 19:56:01	2025-06-10 20:26:37	none

File Details

File Name	acehtml5pro.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
File Size	5155953 bytes
MD5	427b98fe23a21b9ebc8ef691e92cd4f6
SHA1	97f1f4ae7fb408ff61bca5704eddad9d504370f3
SHA256	30f50159143f632f69cc99ca8973febee565b39d6ac4d00e96be07fd7a1b4b61 [VT] [MWDB] [Bazaar]
SHA3-384	85a5dea6958bb9335c3c84736de473f11f40aee94d7f12ac79bec059ddc28cf904d62d1f6f85a898f89761202a851f01
CRC32	4F352385
TLSH	T1DD3633CD315E12CBFC25C1746AA3A9B0A594E17B6323894267B858F9FF6F375870A300
Ssdeep	98304:2xYuDaOK5yFP/ZOLUYAFOSJOJ8rftL6z/50S1Q3y+hlLPtYqPa:2xr2OK4VvFeSch56hpP2qC
PE	File Strings BinGraph Vba2Graph VirusTotal

;j?~(

v6PL`

FVXH"

R:2tZ;A

/p=e"

O'#OS3_

7_"T(

TC4;B&[&=clM

O5t=a

qCy8Ue

A8Ksj<-

=#Hhi%

b|o|!#]

]-Q[I

10(+<b

"Wm@(

0NOj/

~<*~T=

h5m|i

V~a>c|

WZ%8v

YZ7nC

%V+jh&\j

9Rd6`

fwOI6

zbY\$3

K)LES

w&(!Q

x$BL%

iU\pH

RuzL[R#2)8

sXXwS*

tp7*xIm1g

8)tZJh

&=C?bA

<@Ukh

L{%gP

J1}v3

.3qi{

f[@=0|

c]e>{

ix,*!

0w{;1

4N+edA

G@~ 'Z

V<Hqb

f|K^S

1di#1

?;'>[

=%m=5

_~Rwp0

~VRC/

tyo\3

1<M/VU

@g39:

*?#xZ

zlJIv

Ept7+

!-r5.b6

p8yw.

6<#Ex

h-z}?/7g

a6cYMyC)

E8VRl5";

KERNEL32.DLL

D&O7c7

1[XA,%

g_:E'r

]R }r

u467I

D9=bM

jb/@m

>4]v$

E+-5R

CRr/q

tspqR

#PMm`

$9JX

u5 Fx

K}!=o

yB9R<

89I.J

}<]-D

VQ]]X

|1iTp?

[43&E/

qPo<_

S\X1

B?n)[a

$+LFQ

](WI9S

\iH\D'

o(jwA_

,0Y)^

^M<!bb

):6to

rYe#Y

4I~7ZDa

-'^k>

4xB]Iv

t>QgYR

L[@^E

)a;->*}

Fxx$b

d64^`

?j$$BIm

8cA$`

C[,@|

s.)^*)

|u>=[

aeC?2

c'-F9ogGXw

$X}_F

ZsJbEY

DlmxX

,y~B[F!

V.A2f

[$zxz

pW9z9M#

=CDwp

;+ju9(X

%/q{P

P-{Yi

N$C}-

w6|%_C

t%[0(

:Kv,:}

+Hk[(I

U[/{[

R'WKf

9j_+U

)bBWD

+e25X

uJn3DN

)Sc(K

`h8/Y

i" &o

ADVAPI32.DLL

__pw+

{<;t/

D_B9:

Aur'L

)]w3'"wl\

J0wd

i{6[U

UO/yYc

.uw(q

'{`pM

SrCnkF

A ,[1

@cJ>C

F4:v2

=K<}?QD

un{Uy

(2c],y0

b.%)%Q2(5A

mG7jT

OlVxFF

LN_V@

R,*/R

T}K2e

uUuW<

bAJ(7Zh+

T3\u6

FRnfb\`

RVm{,

T!Px0G

aUsUg

vXG0\RE

Q)@2j

P+o1W

Q.dLY

ua&+*

X/"Q+

A:hyc

}wp ;

%#N/J

Qza*<

H0}^dD

t=+@*

P?P+a

'$]3^

XPj%,

!<,p2

13$^L

X:8:(4Ph

BX[r/L

Hv^-%

L7xskm

ctH;bN|

(##"<

hh`|5}

MPMcQ

cObXN

a<Ym?

%:I)%.

#6sX'

V7Uq(

w-FV((

@LO/{

.vk:!

KS(DH

~<+9z

et#7"

q^1OI

Of5t>k

n; &=

]{un\N'h

4s{X)

|-(Y1

_*Kzf

N @VT

/sc8e

>+hr$9

"`*"Nd

I_DDW

ttZ!w

fm\]&

41X*|

m27vIc

-07Vj

R.G0]N

LgTSSNgZM

!v}rkJ

4Id+t

gpjsV]M

%T\aK

bFR%b

h.YG[n

s]$^=

e2Y{J

~%RA0

<caWIQ

]O!soJ

5~bb+

jxb!Q

X>S#I^"

Zo]bk

hHJD?

;wa4-

/Kw9]

eEy ,z

G3Jx.

$:WbH%2

Ok=9#

kqnG,

_1c#;c

`A^\]

>4G&<.

5wM&(

GP>Yz=4

SCq},

w1u3m-

'W1x4

\^-Qj

gbLe)x

3;zH9

2s<c9

^^eeX

+`Kc?A`0FN

4 twxJ<

\&sYW

\Ch+<

X(T}3

J'uuN

j7y[_

k<-f~GJ$RJ\

!N0{3

!P7h

.+Yb-

|v6Bj^[

9z%jclAc)d

IMP;gk:

zXD=T7GAU

3R235E'

z`~ng

D+}>Q

L&kTH

[%2.xF#>

+RIc]

f\Ve$

O@/='

gH~N8

.rsrc

c7IOH

e&KHl

2Iv iT'>

=7o)7

_6Jl]h

#z_<%

L82vr

u9Ucd

IqSK<

ZS<Xc

N&>IB

E]o ~

JM6-`;:

OgCd\te

Fk5$4

&QL)*

+6m%LM

6/19U

CemM_?-i

z0Pui

qh}L*F6

7YYX%E

m2wqq5

LJL@0q

()WXT

*8}}0

wjin`

[Ql:#34

MMa@eSYN

Kv/r.BxF

wY+jh

$b}!a7

8hflW

[bC@R

9g^/&

Tb ?`O{

|s<t>

kZU%8

p3w[k"w&>X

|O2R3

K#@"n

T9f[N

g*AiiHb

X!~aC

O[U#wMTuZ8O

`<]Uk

Ab`SE

I4!`o(

C7dyv

Dy;[c

//{8HQ.

N2,qXi

N@)N

<,}44

EQ\9'

W>nc+I5

D@}<I

ED^1Q

`&"d#

N"VdS

q\Lc/c

s``#Or

|h^ B

>q;zFN

_C\67

A}z100

7>:.CG

ZTtGz

A*L0h_

U9kgd

rLeqW5aw

ow|yH

` "s#

Y!:I)

ngR-I

xT>7Qc

_fJW<

F9n\X[

6` rR

Kumpc`?

ZkEb)

c1r].q

G+R2c

}s9wk

*v|gc

O;GH;

!({G,Q

#hB% ?

C;nfI

c~/_^

lpW$uJ

ulNeW

k(s&4D

PZ@"}!(DoBl

\A|:;

PDA?<

'5nS

pm7P-

cL](.

f]&D!

1{F_}

DC['&

d=m?A

{_%7<F

<lMOB

8|3.u!

bbo$1;

<&'32A

Eo8xj

r,^P+U?

E*nNc

WORD1

{6/`F

a|Y8O;

]@5P[rW

pzl]N

Nx3Ib

]-Omw

}Pm'.]

PTmveu

c@a490oM

xwNS=%

?1}E<

x>C4#

cz}t(

ySmAS

so!t0

#[KvU

*~wsaZ

H*S3M5y

1+zb"

DeleteObject

;n]In

IH$%J.

lW8ljcy

&KL71A

)_BJF

<QA%[

A)Qr#

3Vl8'

#UTW/s

6Xc##'f1H

(dAcA

jaeuB8w

n-/iI

o{K)#JDe

N0L>_

8LxAsG['

([O>Xb

4vDC[

H4-Xyv/

r(@^4

yn+D%

7>'>JE

b<b<r<

F}ccE

CYU#(

f%Oj#

#v&:K

N\DihR;Fy|6{Sy#z

kC.zkZ

:4FAA

]b(CO

hR0TY

lZUXa

rW<!_

3}SYo

2_tkm+

VJJ8B

* /ry

t|"]Vn

-&B8.

pXjTe

S*e*<

0,|>N

ULPl7

\?O ;o

~%=j]

:4%mL

YgaY\X

e&63T

y|I(

4X}OL

.$W#D

a(aU4

0MXlgSc

dFi":

*rx{[1

<JQ}o

SvRIo

t|eH*D

f|T)*u

Q/tJ!

Y-{C.

rA<<O

Iy$sZiL

id[_F4

RV43M

,*wL.

']7L()

>QmkD

S]W9*

7N{$:

;&0iB

KRJz,

^XaJL

VZ=40

foy,z

Oj&v^

>E>L3

%r ZMU

ay_L]

zge D@

>J$^j

|d-h\D

>2g*5

L8M0gW

][ %'

?WV9cS

~O6W:Vd

yy*7r

rcIR@

/JG$IO

&1xG0

n'U7_m

w]S+2U2

c=kma

vRwY{

oYY=j

kuC.\

PXKds

yop-N

/Z=B=h`

~m8GTw-

"p{fd

z+GQ[

tuj6~

h%j7s

,akcKL9(

q0qpq

]gyR\

_:#hm

iIjMi

BpZ7m\

)Ga;Bfg

Wh:2A

Nf@Co

31xt\

4V}BY

]+Nyg

ho%PD

t2pG)

iD}fiQ$

z64/h

R^rX+Xx

v.X]=J

w{"Q6>

l<>1NG

7ECx=

EM,*7

Vm1 B

G_6hG

KTmHw

9[IqG<d

eiLRp

M"/UK

xxR['

o_ha^

x,u8l

<kJ(K

=Rv=Z@

@&njH

rCg;H

<pi~sKp

sV:GWc

'Tw;

\)X t<$

{|'jB

:$egYw

}wE7}Y

>"WFj

A=UR1

izG@!

ThF}?

\jym!

]1pJX

fKmbQ

|R7gA

~qU^a;

RgJ|QftR

0pM+zs

6i<Fr

U|Xt)

=/t<a

e@Im!t

&y,`]

Y_eIf

O]K_}

Yuu%?

*p7]V

V8%oP

p+|@`w

o=Giz

cS 7z

&d!Xt

%Y((>

3HI.(.M

EU3[|

}>xvQ

7NCl?^

,wgw9

vk7*"

[{u)_

qh*UZ

SS+N(N

\eMppg(h

%U:`Dq

<syV{

1zVM5

Vnd?l

78tBqF

r`A(?h

;"jH2v

x|MSK

CGMoG

ajC+^R

[Q]eWZ7

a%UH>

^Lig8,

@Pyj/kUC

h,o >K

U"Fc)

Ig?J0(=.

]uWEih)

Ywi)a

C9R|h

!Y5y!

n<[hF

s5Xs*

Qy^hx

S:Z/H

{PgSr`

nz6ppC

%4?VY

\^bM+B

d6r|bT

7?s,K

oC=rb

S`3d-

UXL1G

/1+6x

"0|eH

}5U;<+

knC~Vp

AGQA_

Dr1`3

|\m4sI

;BJ-D

2c3D3/

BE$D:~

1hwdLD

Wv5M*

naM<b

[by0

3[)/.

})&v#0

Z;xB$

&Jl7S0u

L$WlR

Rt0~M/

@$?p\

k=lz[

0{Vfj

g3MG+,

e[tDp

bq<1N

'>#*_

`:>6g`Gk

i;PvN

qjt/.m5

dV\*q

WfX4j

8Cy #

CmT.q

8P2z`

O<]2E

,Q.FN

*z>S`i

JKTT.Exu

x2j6]6s

n= }IZ

3Lb#eG-j

ez%2a

J^avPG

C. mW

Xk]+'

\8ZuO8

fu*O:

NF="c

1G9n2

<v_866

8r\#1

pwS|/*]

eA$Afb

cr0ky

TNAhx

mn^T)

0<bJ#

@]6F"

[%v+/~

1wo\#

$/7ex

)]^\?

63B#j

\|4I1

v4x\cT_QZ

-:}i[

y>Afb

1cXTz$

}9h{K

?I\3s

C3h|C

i@;FLO

U/guNJ

;(rgH

iKe|:Y

H_I)$

I |Bm

](@8;

h8Twc

"YG'e

$/OW}

}<uf,

}!%UJ)

^J]!|i[

,Uo-+4~

+JD~>

BsYFvh&

?OV[

p(~p~\

od` q

-7[PL

c$:C

nBpo`L

,yBam

thILeX

Q)c^R#]

Jb*;{

$G0pk

"L ^1&

.X{(c!

~$X>8

RY_F+

JmjW)9

=fU=[

F"_`B

-xg_]

>FL9A

rY+b|

oP0$]

k_~Ohb

Rx^p.

CAZPyq

_B, +

d1g4R

JON,le\[

LZ95%

q~)dM{

j[J,k

"62Cc

&xgS0

$Rdmy

8O1vu

xKCUR

/?:D)

k7{t>

uIo@y

f'jN:

ga]b

e|$-|/

loH:%

+}'Fc

nNbMz

8Uar@e

$b([E

mSflVM

j|.j4

>O:2YK

'6f]Zhf

*tUaOV

GR';/U

qO?qF

zEzUzez

3%|kb

I6h>h

svcF9

1<3_Qz

?,Vuy

dQRdP

06i(e$cE|

*RjO<d

1t1?~

W;q39

4WrHC

_Uo2>d

v5MA^t@

>o~:?

B5}AO

L?ydDB

`Ll]b

XBIGK

=Z0:3

sbF1tw

lH1lz1G|'

UksL1

"Fc$%

`yl|J

JmUo7

*#G!h

ZEchn

KnAN7

#L?<-rs"

GllC8

2\:QM

SEl<j5

Jf\R_

8J=@A8

#QUo'@

44S{ao

BTp@w

;IOUL

NF\ctt

r%N[K5=

:K!v'

[['`T[W+

W+YL^

$(mWI

]"Fuce

#n{VE

DtHF@&RfTB

;Hx]G

FeLibrary

EOZCywG

R6jD2

cZl y

4mg1d

;>d0^

)U@_xa

55Vp,Y

+=zNj

E(>xOy

vFUxx

hW|q0

Z$LV*

lf'E)

@1iWI

9S#'3

y9!6{

Nelpc

-Dq4MS

-<R\/

uRVhQ

!GYpW

M7H>"3>W

_-CbE

1G"Xf

s0$z

oR;zZ

#15OI

50L7O

IU|~t

uI,>j

.h{V~>I4u

Z+bCO

=<eDa

>GV3+=

@s ]A

#A`FM

gbUiZq

WjWhx

K6?Y{u

oYK"b

#%S1p

';nnE;

v|=(Q

A7Ls]

di,2d

@*yTa

z~_]>

Zd}Q&

0{KTi

V{o4&

7MM+3

<oi/N

S_,Y{-

m&:qJ

pJ{D+Cp

l#%U&l+

-]]KFx

gl)n6

GTc,#

qqMjR7

LsM3l

aF/1LBwp

w6MN1B

!OGkl

"^*,=

Wo\ebi

V'$t0

qPufk

x_$*G

6[<Wf

7e&|Z

6AHBD

<#Rw}

$M_yXr

I7E6>B

7b=(-

n_H(s(

vRd/y

;\=NL#9

Q!Q a

TyG++B

yHZfO

m;8P#

t)fM.V

$Z5i^

9'|[p

>*|x%

1WzY)

vbLVJMrF

WJQ/;

aGs%+%

!ny+o

s<Vdp

j'8H[8

mI8)I

)@jgf

PF!w\IZm

QR&dDi3V

<5N3Z

FfUzJ

>)#%>>

LSsb\eo

o o`o

|Duw9-

|]t,Z

p'%6/

/ylPz

kex2{=V

[_]WE!

9,yiQ

X"->J]

k*:TN

rKrkz

*nAZ>

Tlz&s

|zk.|

,ZuA^j&Tb

Y9>R_5

?APks

zz:Jzj

2fkpG

r8Oz<

Nf,OX

yT?<'

Z;F2d

4xC-Fm

4_:]d

v<q?$

Z9,@I`

!Jw;4

>+@}g%

1jXZw

c*V\<

<3~#8

%VM(j

f~p&ARZ

Y">6RQ

~{pO{

BtyBr

s%-RE

9Ir_L`

NXWtF

w)?M.@

IMr%O-

3s4Dn

|zEh>

9UAlP

Vy mWP

$I#E"3

}t#4<eHx?U

=_H62

XX/Tnm

; v)$

jWRl8[

6?b56S

dh,v;

Ex:|{

Q1N6@

3){^1\

S9Q*:

h=/8B

*-(7^

-p)t#-

0(|8T>A

Pc>St

;.W?.O

)zYZr-

T~5`F*

v~(%x

F:NI@

+M#C~

qCloseH

x^H:$B

$6o{Y%R

-rZxdF$

mi=ympB

$3h>3K>

sn_]U

a/#+Nd

f[*]C

_L"9(

\|av_9

dZClH

X24^Z

PV2`\

I!:~t

/.om\V

f25zFe

a.PQ~R

u1Di&8UP:

]@KBPvVJ

wW]]C)

OToa_o(

b?YOauX

M+R+Q|

{@yr5Q

hK1u6

qsX/V

>-Q`%<J.

21iE&

`{G-E

"h|MZ8

A8:i+

>q\!J

e/Hu>,A4

%-:OK

Q$s|P

q9WD}

M`6g5

eN1b3

uN~gg>{

]%R0V

`t*X{

SOS^>euM

XY^l"S$

]JSz[

PY}_T

TI.;<

8 |vEf

# !L6ar>C

NPNB(H)hn

n!j /

2?*AS

dA_i^

oeK8O

/&e3gT&

Hz?%Hk

[[$f:

9CUEy

?CN}Jvr

75[w*e

d3d%a

\;+{|

'N^X%

))0|uLU{!

aGEGJ

+;Ua,

l<{+<

LVy/h

pXM\e

R()&9

9mj!&

OkVh?V

|yaL%

z5tku

&C6@P

NQI&Z

u$j@?

}!U<7

r=Nz_

}>S+W

j1,$mb

u+yZYA

u9c.n

&E[KW

>3R*i

",(jb

`ra2'

*eJwh

!bz!r

2Co]s

ak%z=Y(

\6;k/q

y/jp;

M5QB!l

;z'!y

FCABP

nOn kmP

X;`\,

B"]&y

t,noh

3N;h^

%`5<~

BYvV2

"|ATB>

Vq:uD

avDaks

,eMQY

co%uu

sU:co

AV-?jR

fP[:+W

Ybv//

`bkq+

UYxq}Ex

mRmIE

qx;Vm

:~ jBE

))2gP

$3;K$!/

?MFL)c?

T{1"v!

}KeA7

Cw`}aK

J~gc/

TtuSSS

B}hc.

B@=,_

KB4)#

t.HnO

]U^^r

/(WNx

S.4#Mvm

XlSI4

TM~]o

lq~&$

W-9)z

HHzU;x_

.93Kh%

8VX:x

DoB4mR

2kF.k}

eRd(%zY

0WmcP

A\]Z?3<

rjkI}

P#4txc

;{3)gq

Gs0Hx

="TDx

IbHWn|

A=;W3

g_<q8

rx,C[

HU$g'C

0zWih

sR:JOsT

?yt5+

ga^9z

b|]Yha

RpMTsvn

8\"xixzG

s_ESt

?!~Y+

CC<bK

Bb$&n

"s(q@

>DZj%^8--

Hef2-

tcx"'tb

d\?<d

H,HS.

dbb%3

O7hfY

39+><

+^6vE

*'lYB;3GaxG

Js9Va

O/L:?e

ROvp;

sg1a6

-fk=`

9izDm

&y#9#<

5Y'lFK

|!`fc

r&([%

q|oe<

14$SP

tNBx`

3'=i^ro

11C2Lb

z\jX)

bw&4`

W=Z3 !k61

PT)U7

"I>12I

jzY20

c3`tI0

*qcam

#aUkK

I]I;4D

x]TH@

"#/rnb

fVs;!

)R+ZH"

|QJG4

_,{Omt~

Y6ZS.

RVo>D

r={sC

QedKM

!A(!*

RtFp_i

6S?'R/7+

/k[Gb

^q0;/&

\nSHCDv

KH)L@

yG]B'

APf&d

cnF((F\

K<JFG

[;;D+

'UJ|@

d}0]dy&

]Q>15

_1X_cojn

9<BT2Br

aN5j+=

a9Pb:

z6Kz\

S&AWA.

q+M^8

@])Au1l8

1|M[L

$wd_p

@3{/k

#RyZ{

-$y#xA

FQ} ?

-uD`x

'W?h`L

<`(WTb

q~T"W

'Q^jT

MI39$j}

g)mXv

~.b,nZ

"$T\L

t+(Pa1

eM=f=

7oNub

6.+F,]

ozR1ML

n@d&E

;kS@`

WR|I-

`KeP3

T6\TZ

2dL\P

GO&enf

0oRf~B

fu#rxsV

=/37:=.

>"0?A

sVqEG

*-V(c

{aL@1

JJZA<

ucN$$

E)(I)

>3+E}

S}9}o

RkBat

o9eZ<

%3,%6

+%yQl.D

M}2r:

Lx^k9\

+O-uW

V:&pNaNV,

\R');

<AlY&B<P

!w16C

b!Ta,

[$f# p

XOv=o

:?"\h

AY'!j[

^zz111

GpK<FR

>^jV'>"5\

3c+Vi

HGdn\

T?TsC

z@R +

#~ddXH

gT"H@;

_&J]g

ilz2tx

$m#i"e%

4P8v

6mSCHpgt

Mi&RQ

Rp6=br

R8u`x

;5#w}

~{g|:

Xa-T[[

]8iV7

94sq[

9BA^^

$]FD]

C!kD6

c94`^

|~DEml

BrY=g#

1]f"g

E-#U|

Z~#-&

#>Nie

MKE?E1`

DXJgO

,EfJS

,X"nP

,)*fOO|<7

!Z4V6

fc,8O

TN$1Y+(

](^{c

y`/3@21

d> 8p

r<{fP

V2{b=

qx(v!

`76m-F

TK>n?

pM?<!]R

,b1d>

4DwtFm8

2Nt[:

drsmu

o0'C9/

<<h#g

RDT/m#

M<FGtBR

\!pa_

*N75f

>%F,b"

nuzIU

=+4Q($

!j^e/^E

qb-y&;23

[tgnL

&}<!,IuQ

5W{N.

o.41^,

6xXez9

WN/DI

?dfQ|

F))EE

_gos4w

a9:5p

MuC$7

O9[8s

H.RD[I

:u)+"PS

0$J1A

Cv{q@

nKQTQY

!9Sj\in

|(]9R

P&?I[

;v8s k

okNmwd7

?SlfW

zkB|GY

VSa,8

l>vl"

Z;;?~

wt:[T

)5+sm

T^+Fi*eE

g<%\_

h!15\

l"$F<

7A7wLB

=Y0+.

Qz{+H.

,9M>Q

`*HUE

*F98V

P"<8P

#]qxLg

fdNv@(y

B)O@Cy

?:+CU

IBVtl

K-'Wj

D6z i

oaoi"4

Vc7|I

"guSw

V{0=O*

td]!+

AUTG:

|h,_t

8}[<^Y

2;l'8

3C3SD

5,~:Ec

6nS}J

%(ke_}*r

D^y;d

/*+J;

2Hc/Jm

-6-K|g,

u6-XT

{1kFO

%@Ba.<

E8#[H

;?c)P

uNbMr

zQ4B&

'pS@X8(s

O,PG=SE_%,

i\GMJ

9X:gG

nTql$9'h

Hr#fe>

'*k%y

G-_dx@\w

~LkM*[

a+:9[Y

&zl+F1

_D9;f

}f,up~<

{,(Rx)

'c uS{

:)\SVKUFjE

6j3`mV

C;|llp

6;]j(|

iAtZQ)

h^qADo

9~Qj@

D@)K]I4

tTLQ?i9

`!+XM

ym~b,

_4%+^

Igs?[

{Pi]-s^

oFW]{

6s`LD

J#]<u

Qm?L18

Q{fF`

.(<4[~

QwSm3

ge^ qGv

<6:xI

^og1H

\TL8@

/Z_/5

n^>rJhA

Er,({

0c+sm

SQ{-E

E90_v

2w";?

REPLACEFILEDLG

P%>YT

qE&wO

!wp6#f(

yUA0'

;!e~[

<H3/I

DjezZu

g#wS3

e[j;x

K/3?;

r^!*Q

J2hh}

[gdA'

$6o[E

'$|?H

%?|f1B

-e=xg;

6E2"3[

G`=$_"e

CP]|,

"iTzI

Op=Q1

z]!/*

Z}<$?=((z

Iy0}.2tl

vF5[_

%{--+

@fJW`5&|

^G,)Y(

v3V#K

Pb\I"

OmN<HJ

N,Zw%

Y]dnU

\b~lA

U%YgM

NP;|6TB

$E(<PT

q/`% v

?_gy`

=u{3>

hPoZY

M^awl|

Iy+e9e\

xz<=N

y_iO7

IrwcoQ

_<6]!

b~aFY

7!1uM

SsW/EV

yY`;P

8~#q"

P:fT+

p=Kxv/

_lU~cy

I~D3)]

u"FSL

urYia

7rCXVX

lt`iv@D

R&1)6"

oG`o|Yw

3;Nie

i,D(|i

:O1r|c?/

y<^O#

PPmA4

D|i>C

%){1(

#& 93

>pfYf_

d[G/=

d$z;uTMS

]\9<N

mNJ!W

J"I~z

mxO:,,

%BZ*2

pfC)#

4OguA

MRyc,n

"=('O

6biCC

)</aK

98PmZ

lYocH

Vx^Zz"

0d~(2

Mv3O>

(-rCk

Ql.XQ

ID[m&

<9YJ:

OD@^Y

%V)Z*

l|G>S

l_8NZ,

y9z&K

:-g"G

S_KHo

3iKLx

kdas2}

uUuqg

:{Y6=

Eb7g.Q

_DV@N

;6?M%

BIKk}

t$uOY

sa'it

mD~]SQ

_zx<[

"%=TWQ

V)GM^

#@<W4K!

RUipR6

EZ/"$,

pU6d>

>71IW#KNoeu

K:^T4v

qy-3@

_}E>r>

htpu-4O

_).5t

S9`X|

)+.>r

p"hu[

0G'`8

BmvvP

t{X]R4_'

z6>&(

Xk^!/

6U}p$

L|SA%

7zdk8^

\-S^%

{J`zJ

Sv,C'

I?Tgw

0NK3r

Q1eoY

.2<+1

5V-2Ei

0/r,^

}VNq

|oh7"

Fc4C.y

6Pe@x

=$[s6

nwv7s

T`uAEaF

$VxyS

HC6O\no

M`{8P

YYz3#

G%n:7

/.hm^

-```Z

:eN;{X

XWn D

,@PGC

LPZRun`l

,AN#[n

,gk2q

O5iwm

e?OfJ

o-W3(

<\2.B9t

mQChp

rOly'

]v,Zl

\j]Z>

KVOOv

a0qcz

$O$O&O(O

"@Cv:

a;5:l

Lta8m

D{P\T

ll3{n#

q[+`mA

${2,Rx/

TR_m2

vd='Q

oaqo|

N)_Tw

#3P>*D

E\raI~

i?"Fxtm

e!GO^)

@Q?e?

1Yr!s2

T<$+m

h\E~/

[dh&|

_U ;]

s"aC+

}%'u:

R-b0DLHWx

ut5 R

!IoIq1

sjqhe

dsExf

b7Z%l

1Q/0"

9!a\L

4eZ.}

=; 6{

ZpQ 4

xj9Xyk

7:nx3

ct*l\

fGX],

0YG-e

l*ef>[+[

G|{x&

4X5%

?n(h)ph

4DDM.

K-j/

XL]us

m6a\.K

V)CM/

|3b-}

1*QB|

]I2_:

2~Jj7

09-EOj

&w4<qN

_v)_"

{EsRfvq=.S}

j.kr^

X83y,

c4X,j>h

7nXjr

!:C-S

S;I F<

v1xbi:I

K&xD-

a6'G4

)'5Xe

mdxc@

HHdYSO

*gM46

R(K,e

`"e1.

Ek- a

j,%gU

pok80

xISw6

c*7lVE

qC[B@

23i3t

`r0aCf

88hh1

]]1]M[

/l~:E

=2d-u

H!, S

@0L_R

N'1n?

t){*l

FUPGbJ

iiz9pvZ

1aFHE

C8era{

U?u(F

S4V)$

6"dI`

H^NbZKw

L?J J

c4{:C

x{~JM

c1W!{

=,XS+{@

I^JeaO

TVAK/

cF8tc

nOd,Ie:

".=00

AnSO[

V#h`R

-ojG(

O2eel

mzzrA,

*"o@\

)(/c{d

SVL,{y

xvV0,c;l

KSV~t

'X\1Oj

Lo[sW

AJ_8>

F{HI~

u_<a,

x`,8

QRoxw

"-VCY

t#LLf

2/';XB

+w41T

F&#+/CRu

Z^JsPA

Ii,g"f

&kC1b

a8s,tknV

Si6Mu6

i=9v5

afG-S

FFovD

U_%<O)

uN fT

77$%+m"

3f;D6o

2C&;X

JEp3y

F8&e!

JQoDf

=D\lYd

`Ra]_

`h-Zu

!caT^t1

?sc*F1

Mz;3Y

;-t<T

Lic/W

g[99V:

fJz~g

X}:;d

p3-N(J

EBrMN=@/

mom,ip>ch

WkNts

xN3wP.

{}#_u

tqEsa

OmRC;

[r!rM&N/*

HPl6'+

0Zi%d[

~zum^

a+lN1}

Q-/+h

E;Y`#

[Q$[V`

gEmZ)

Z]=)G

cqd\p

8}l[@

}4\fa

!mD84F.:f)

;OhsoqK

ni4DD

EWFlV{

"%$#''''"%$#%

}muSY

'')@Fy1

kFef:

kY!pBbkXWe

d6!\1

?\lob

=%8VJ

@O,:%

Pk8{#

(Mqm+

<bFD!

ovuM@

gimgS

v1TgzU

t6F5x

Ik!Vlw

:+NK<

J}kCP

()nB.H

a=Q^ry

4['3BO

ODF<*

>DR$VO

:fcK>j

{"upZi

<EpAlQ

W[P8w#

5OZpS

B=PA!

+2-dOQTJ

ry.<h

aUeXun

ddkhJ

IJFL6

:lsf>

pnmH?b

QbbR>

m95?U

w`GvD

r?B`}

tK[nNN

J=F1e

=&^Zv

_c>?_rZ

'O[B}`

"rZ-_rOm

.<UQ;

12SU9

.~E{u<

Uoemz5

QN(t_k

#lC/c

^8,I[

h#Y&~K

lJ(Xu|

f_x6v

sQ+$k7

o?O%4

"JOm^5

S+&m5

Oa/A9

hD8F.D

&-C.K

*Q_7@

T>Md(,}

BLXS1

#,:8<

rDs^I

w'Ii7vGx

kHs\p

t^% 1B

Q,h\+

]Emb\

}4+g

Vr.`}

OfL<J

::>JG

whgUjJ

`Vc]X%

dm\"t

PQSQu

V9[e?

b</[?

3Fli'

;8!\E

x~j>BH

Tx}w0

zD%"F

FIJRv4

"6U-M

}@3%D

uZhy$

<OGDg

qXCd!e%f

~EblU

k>2Xg{\

vz_pEj}/

}EYHW

l[pXN

X8xF'>

,5')!/

7Q3dq

R-IsN

[}EK/

r)WNC.

d`|Ol

-'=~\

{l``tw

+pGO^

KjK(`

ycQG}

'_R?/

RrgU86#_~

ICG78

se=,5

Z^-E)58

gb[;m

`)+zF~

=jwD-

Oa.fRS

B,0nR

]H~ q

X=&Ht

MogramF|sDi

aY+{.

i&}0Ta{

oQj.6b

Q>*jg

.N(QR

*Am56

M]mG1

*QOK.

i[5!9y

^-D!M

%B3q'1:

(<Wr n

>xiXS

6`V(]!

=>O]?.W

f{,"[

~_~%M

c0qY|dTQ

09EQO

B-)c7

R@&H+

RDF/[

6_|8(

e"]bC

OuuJa

%36<l,

?!%]TwD

zm&n"

D'l=2

o({"mH

lt/Pb

rW+fg?^

53E/x

"m*A,

%lx=w

."DbY

w{Fd_

\Zs_;p

"{#{(

KFG33^

FnFF'>n4FC

bjgMz

^+(ElA

*d)4q

4]oug

GMbEs

h+>N[

8Lhig(|

_}eek

Z,H>Z

[C1`p

XQLuv

+ST_'

To_ay0d

Oa'O'

@!rBwgR

9Dym

;KKag

?e[0#R

Pi_^5

p>:lht

\I}GN

4KOe|

^c9(Z

0z>U][:Q_

jl$/<mqnoO

b|7#;

W4<K5

b|z[I

)f%27zGhN

.ou!K

0L"Y$

,M`Ky

tecp-

$~\{`

M_nXL

^p_Zr

0)se

wwK=08:

;+U@5

]~iO'1

|N#i=

<th<IJ

F<(dB\,

PQy>]*U

Mq[^T

EuP"g

EvYr%

Ui93[d

S(71:

bkn$leS2J

[N0>$[

-;oMbp

Y8,(5

f~KO;

> dSd

DOQGv{

QNy&m

gpX2c\

x]Y(4

FHe5Z

4\`dT

83TodBr

V?fT-

?HS7*1A

<<_{b

'qbTz

Qb`j]

PH^vV!'m={\

KxL}1

I4=]`

z&T[6T

S2;*8

EWuMr

Z2fQ`H

_w$}2[-

4x08B

?~@$

?z#c;)I]

WhaAE/

BJ|~H

S9fA*

~!<_I

mUE7/IY

I7YUT$w

&}pWH

Alo(~

`.bu;

45G-_

&N}*R

~]ZdG

KYoh7

N-=u0

M(O<}

1"B(1

l5[G:

4c-fT

G2HLaf

5]\}mZ

BSx!5

ONO8B{b

l4A,t

XR.)|

Fur1p

/+[Vdy

hQ4fmQ

t=+_W

1j=/@

)|:rt

dhKcf

ZMpPLDf_

#"Txw_

<R~cw

H5j5b]_`

/?^K`x

?B=i~

U4ATf

$Z\s3

\_e+d

\PM.;

T{xnn

1;kE*

UD7mI

D,5<g

l43)&IQ

Cd@\Vg

~R[L#'

z.=1f=

2E.p!O

mF_'&_

?5O3S

)E:/M

CpDi"

'*^ZA

:a+PV

`3h7h(

?SM2t

O1.}y

ACGW@

`M:hq3

b#^|:

Yg,U8

,={tI

?xrC|

nd)qQW

=2/9UE

&:r2j

FT!]iq

=6:!A

t>L$Z

(}[r9

t1|h^

ZUD}L

CW]!Q

%R+&A

LYq/3

!9$yY}Z

O$&S3

"Jc?y

Wp&p5s

ci2^R

*ii,j

dR(iO^

xC<0m

"Zh>Y

[fO@xqw$

&B'c|7:

^#CRx

BJ}v}

^,Pg~

{$:6'

_J^iV

31lpP

'7Lc_i

hy`E+]%

9z$\D

D7lMI

D`BHGg

8z^oL

/(N0#</6

<0}sx

m*hq%

|Kl=

?8cYi

v~T<6

"AT*4n

z5y\@q5

Un*co

R{yc:

1;O-Q>;

G |4\

Cw[>w

0icdb

9_Gge

6O}TSr;

yq|Q3

b@Dj~

^Y4E3

(nCa'

sR,'-

'ry>J/b

H(Eo6

EUN%NNK)

poRi]

fJ&$(($

Czrr!

1:"X|

6z!3<

k15t

1KH"a~

hrasY

W%xapGuJ).

$rd?c

8;Zzz

|)d@&

( MDg

<55)D

]+6KJz

<fXi|L

#.zEO2e

WmgH}

Ms{2I&

G%O>O

EvmMk

D9=7Q

AyMh-^

/"o6V

/<'/8N

]p%pr

^W~(*Z

Ng@f3

)8B8)

Pw9]nv

My6d&

C(gVm,;;

#:GdF

twi|C

uYldN

mG3lW,

8S1^o

0pM"L

AU8e:

XwO7{

Hvz([

juCp@

dzQ0L

?^!*~

#H8 2

v@NPGAa

zeVa5&6x!.T~S

E_.%u

C_ta0

l"x.I

\&@-

"kLc>

>4ir&

!5Er0

;EKPa

:;8T>dK\

(j5aP2

,BUJ)

^pn`X

5=1Guc//<

P|o(=

kmG?/

L1mI,

hM%9a

84aOum

$d}0z

lV^x #

wC fd|

57g,R

x)p{.

Zj)0#\

<;2'>?

'vjtg

JMfoN

'c}aL

?:}?^

i[tp[{;V

=`}YZ

5SlGp

AwKw@a

wf_0

Lguz"

:Q(@[

F6wnD

RMtzjH=

!+H!%B

t=wi{

.5{N~y

5|PP*

P!R^|

SoGq~

?>?aP

9b<NZ

,/m\)

7YGqR

mt)W@2

rg+(JX

C'm^:

BzApp_

dt3n`

4i&PR

UgXxl3

:T4""

l4uSB

w9oCQ;

EYMMI

U92JYL

2OwAv?

$rBt-wV

oL>l6|>

K!^XJ

9+ )

Q#/)F

Utj.H

/vDhj=

eE5W-!M~

XGPt\

pHs~1

B3z,)

&k4vxD

c:H1h

^ceL4

c]HZO

3)SS7

_\B]3

S@jbw

#{%)>

[xrFu5Q

F?x=w[

x7ND8

?SPfl

d@*`,"

[8~eQ

hRJ)v

>;slF

2Fy1"{

BI<w!

l?:|c

RaHv#?

xOI?I

yP!X[

*jQ}4

,q4(u

:,?*1QN

(aN{)

iR^<5

w(_@,q

t^<F0

9T[qH

Kk$(s

}GP;{}B

K{^nB

h:^{A

RjBjP

bq*hb

:JEF-

F&gGHh

QGnpq

'h6G\@

.O 8;

zh1$@

W8W@WBWDWFWHWNWPWRW

dREsW

a0_9NS

c(b\X

YXr&8w

V]^0w

LH}`v

quoYjk

G:vAN`

-YH#b

?;xGQ

xN=_{

M_m"~

#I,zN

c\)g##

9O5/j

E%lMx

wT'P6

$=GSC$

\pANS

prB"-`:

l7*:ax

Rq}:guN

+H3;!|

+y`W[[

"F{rA

ce}rr

AXg4

"+uq$

)PE:'o

(9l.t

R.eSOx

a}Mqf

rw T)

51iG*

k'iD#

qz 4dl

DNbsF

3r3<JOY5

4tK;cRs

aTJN$

T"w0y{

P<Hd@

(~I+EDR

~N^:T

6tR6i

n{otPa

J>Rbw

i(`y:

KD9vP

%0q*p0

mOyH_

r_76a

K.&Y{/

FN[8+

X]kRQH

MO(;+

{2%bS

[Y O0j'"CN`

[QQ#f

_g(4U

TJr2p

cGDUR

=`w38Wy=c

2/ vL/

y2Y\2

1!{Nm

]_l9U

_vd>3w3

uO_7_

/<c14

vkcA]

nmDU2

T X9Y&

K`:@O

,~n]t

X0){y@

]tS5'

Gs:SCo

h9a't

IcZ;~L

VyV}V

z=C=Dg

{IEJM

% _dg

nq@Uz

a@8_D

xAB<(

3QlYwe

#)#[j

-;mrSS

0jXg<

K*Vk`

A/M=,

*$J/y

JKJ=K9

vHG[c

59aM0

c$j'z_N_P

X[a9:

5 _SoV9

wAOqI

Kpg{'

JzmgM

hTGc{

p<NrRj

YD0lED

tz>sG

Aqx;2

ISm3-e8u

Y4x*R"h

B)}}h*

IaNI"

V}(^0

:4QBI

r9\g}'

DHl},

8kYGci

+8?S3rh

J(f-L11

UTMvQ

X8`1l%L

"0,od

C.tcx

xUDZ9

R3,SY-

O]SzK,

1N1n1

uk!/#

.eK7.

XHSX9:

:;:,Y

+|CAb

oo=v3

~[Sl>_

Ae)1jN

!,]j=ol

gN8A(

9&\t'w3&

gL=Ya

%Ap!R

g">Wr

$D0!<

]$-I3

S-G'uI

#&#c,

LW^j`

VfX!:l

>KL"Z

}+-?H

|M#0S

jG$tGd

M^]QU

5;lDE`|V$

5'kUx

U@+XSP

OZ+C~

1 4{;L

b'4,h:=%

,WBl7

o0,bd

9=<E|A

vr%;h

if]Vw

g595#!;p

%1YRL

0}9iC

w}`VH

.B#\,|c%

3{>Nc

hc#0%9

MmS) _

v.33!

h%`}X

hn2^|

*rokxF

";,*e$d?

e:U7b#

j<Mt!

UIP+z

#Ydfu

Yv>)A

W8 hk<

dt+df

t<@_ #

neHGm

+,[\S

8we8c

][=W6

]arpE0

bn|/>\12

yd[oui

AWBXJ5!

Cxl/xt

6SnT(

~7,@

>]T"E

"K:GT

+$1!5

yhNsgY[

vj@Kw

*2?o2

EO8#!#g

v:GsZ+0P

/e8Fk]}

j(A,J$

-a#tzE

?oIupu(

`|$s`

zMyV&5

ny5]!

$4OA9

D `Up

OC+3J

(\v2Bu

P/Krm]

*. 5?

.RAS$JS,

ki)UC

{;^$ER

n:Zap

%Qw?2

4pp@3

(,tqV

\@( TP

u-l17

G-DlH

ufQGU5

-\v',

ZYQ6-

RrbF$

X|cY/

RuQauC

X^flu

8J$(6-D@

lTti|Oi

B4~8t

[B[]/

`r%/z

TTT/l

wewbPjz>B

[o\*a

35W@(

fJ57E

lm s(qT

sd&;)Y

+Ghpg

9SRF?

,xURA

i&4!!;J

C$a1u

\@T%3

8Mo8<W

WFYSEjW-

`g(O8RBm/

||$U%

HT;BEv

zW5[V

uP}X2

eeZ^.

z^.In

&;8D|

Bp$*jAP

\s*yw

$Y3y=

,2XA}

|zn<_

/ =^Q

:rKTC

4xsFZ

7a?Jw

d0Wm>

IjP;w

viOi_

6CKhx

ZX+ng

`.PPU

R>pA1

xLVjW

S2%@,

Z=u82

pkqC0

*g'+Hu:9T

]soq%

rOwuy?,E=

ExUxy

hh/NKWbM

N{uSp

B<;dg,

tV4in

3USR$1

5BhpO

UqQBU

U}7@#

ZyyF(

v+%O6

u&"DiZ

8"4Zh,

1on31N

qE{'$V

6HVL6

rKM%Oa

hntE7

19Fy-w

nx3<B

PuGF3

b]bQ^0

A{U!\

)<dliqE|

yYgyT

hze>

Os0B&

6$66f

3"l@^

Rst2z

elf{rru

\*Apr

;RjpUM

NJ*@h

v"Ezc+

$F4t]

uxF{U

s@; l

pO(/|c>I

Tq@yf

k#Hk&

8ttc=

Mf7abW

Z<dz]

a8Uj@lXz

"]KGBj

sZik4

A~+N5

k7O[B

C0i<NO%

xh<H27

R/Etx

]`pNA-

n?0/.

eNyxU

>&^L`

E2zV!8

EuhM9u&

,Bn~k

e'6)P

MWDRZ

vd+ZT

'>24Rb

PL;nT

^XXU|

0*`]g

w!Wiu

=MG9/

3nk-3

gt-M#

:Bo@S

2\"717

K:N50*

~ Ysk

)Ou0x

:U0;"

/+w!f

Y]c^U

(Z=|~:

,A.~:

Va|}oP

)</+?

HXzPs

Ut*}5

&bV0M.L

^b"t2 74R

%t/k7+}

r )Lp

DY@k

uA^p-

S-c\CV9

BaB;D

#yQ!u1 `

LV2+7

u)SP^

uYbg.

8K0<.XS

/ATZ"

$="W>

vEkFn

N].5~

%'$~IPx

l[N=|O

hs0oF

|98j4

j\K[h

UN]NeNmN}N

A>t0yo

*HU^j@

ahC{|I

~Pu;U

d/eKm

dIvwq

D&yci

xdsV|1

loe\T

s}hMMW

u +~I !

1vS=DC$

0UqD?Y

RdjCE

] 9$7^jH

nJUDA

]NK,?

[p?!x

S@[2!-V2

2&HR1-

[btY>

vY_"X

TP=q^

8gxBOc

Uk*nO

oJ,,>

@W;Vn

%?6f,

>SrGp

qGZ\i

%X(v

xlJ15

_mX(6

\0>]<

J27/!

o3nXjqy

D!lNO

|/S</PsU?

D+TCj

fp|da

A ^D*

n,lE'

Bqn!Z

8JRxrte

rbViy

b><-wF

7A1!3j

73nhi

s=R~f)

BEb=ro

u0(9g

u^y,m

7{8(NK

>SYZ|

V<X7"

90t1)+

`Z(rk

VJ\Dt

i^=o=

E"bp%

'_o1wga

j0A:j

fIvMk

pU?Y,

pFTJG+

h`tf-

!LDSM

ZO!*}8@

C@xxq

7Z#S+

v#iEi

%Gef$

}p]cjL

<r{nV

;wS&'

h&'rp

m*AgW

)R d?A

nn+QH

bxS:m

8DM#$t

{dY"$

'6@?_

}e6Yr

cFMOaqYb!eM

_uSuk:

U[EVV

%=Ym,

s"#~|

Ixa3c

Pc)Yg4

7,#]^

Y)Y1g

LEXJ8

Qe[?B^<

i[0;]

^X&$?

hRocytf

u?$JAwI4

eRgH(

wxu/o

LgnMZp

nJ R{E

AU+a{

|}=$8

R8UhM

*m|5-

6J6317RLqo

M \(

y~]'.

>F|wb

QyD+A

L#Kq,

v>SK+PLAN

6ly%Y

sjNY?E

?eFs{

47kCH

a2EN|

28j}'

#E<?l$

X6ADh

;_P7s

+Z<1k>

j bk3

oYCJ:P

gGQ3

`$6O"

o5wo~

F8YU{Sl[

ZxIuy

dZ(&[

3mFnsW

Di%JkAAX

[J$[ld

SIf~Z

dB1xZ}

3Bl3V

2]@[h

2$<wW

Mhw]^

Q?uGJ

FR)7)

'{O;`N

f8}{OM

e(&SI$

+|^za

+|Il]

w?rDd

0&"l+

WRS'

:"7Q$f

$~TCP

eOg=#

Shm~j

OFlVJ

Kk;1k

cB0Fnm

XG#0ORu

(~o0x

8MX\f

_Sdn0

j"'isXc

T0iTS

qI#N><

'=;|Bs

w_OD9

LF)hDX

n{m74|

-skMn@b

rjvQG

<$d[?zq

4*opZ

"pt'F

YY'%N

,a/;m

Ksmng*

+WC]Q

?#4KY

|iLYD

W8ft8M

^40|n

r.j8.

FZw0v\/t-

tUiaZ:(h

zB/T?

D*bul

i!j`D

^@sC

r;ov=

ypFI:

])OO[?^

8m^fv,I

I3p8\

!,^Q_

qxPp)

#j>lF

[*X+N=

h0[.{

@_2u_$

zARIB

('Tc&

lId-1:

H!J<@V

q1,/i'

4-OLi

axU]x

wnW6}

6DS/I

wr3R3

PE Information

Image Base	Entry Point	Reported Checksum	Actual Checksum	Minimum OS Version	Compile Time	Import Hash	Icon	Icon Exact Hash	Icon Similarity Hash	Icon DHash
0x00400000	0x0001d590	0x00000000	0x004f194e	4.0	2002-05-14 12:21:48	8b21ff8a0d0059e9d67b568f049de051		30adcb5c0b2e3c35eaec2c110733c9f8	c98f96d6ffe5af8d4eb0870c1dc20826	92e0b496a6cada72

Sections

Name	RAW Address	Virtual Address	Virtual Size	Size of Raw Data	Characteristics	Entropy
UPX0	0x00000400	0x00001000	0x00013000	0x00000000	IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	0.00
UPX1	0x00000400	0x00014000	0x0000a000	0x00009800	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	7.89
.rsrc	0x00009c00	0x0001e000	0x00002000	0x00001c00	IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE	4.41

Overlay

Offset	0x0000b800
Size	0x004df471

Name	Offset	Size	Language	Sub-language	Entropy	File type
RT_ICON	0x0001e428	0x00000128	LANG_RUSSIAN	SUBLANG_RUSSIAN	3.26	None
RT_ICON	0x0001e554	0x00000568	LANG_RUSSIAN	SUBLANG_RUSSIAN	3.47	None
RT_ICON	0x0001eac0	0x000002e8	LANG_RUSSIAN	SUBLANG_RUSSIAN	3.92	None
RT_ICON	0x0001edac	0x000008a8	LANG_RUSSIAN	SUBLANG_RUSSIAN	3.91	None
RT_DIALOG	0x0001a644	0x0000013a	LANG_RUSSIAN	SUBLANG_RUSSIAN	7.19	None
RT_DIALOG	0x0001a780	0x000000d8	LANG_RUSSIAN	SUBLANG_RUSSIAN	6.94	None
RT_DIALOG	0x0001a858	0x0000012e	LANG_RUSSIAN	SUBLANG_RUSSIAN	7.08	None
RT_DIALOG	0x0001a988	0x00000338	LANG_RUSSIAN	SUBLANG_RUSSIAN	7.64	None
RT_DIALOG	0x0001acc0	0x000001b2	LANG_RUSSIAN	SUBLANG_RUSSIAN	7.40	None
RT_STRING	0x0001ae74	0x0000022c	LANG_RUSSIAN	SUBLANG_RUSSIAN	7.45	None
RT_STRING	0x0001b0a0	0x000003d6	LANG_RUSSIAN	SUBLANG_RUSSIAN	7.72	None
RT_STRING	0x0001b478	0x00000200	LANG_RUSSIAN	SUBLANG_RUSSIAN	7.48	None
RT_STRING	0x0001b678	0x00000236	LANG_RUSSIAN	SUBLANG_RUSSIAN	7.56	None
RT_RCDATA	0x0001b8b0	0x00000010	LANG_NEUTRAL	SUBLANG_NEUTRAL	3.75	None
RT_GROUP_ICON	0x0001f658	0x0000003e	LANG_RUSSIAN	SUBLANG_RUSSIAN	2.69	None
RT_MANIFEST	0x0001f69c	0x00000213	LANG_RUSSIAN	SUBLANG_RUSSIAN	5.11	None

Imports

Name	Address
LoadLibraryA	0x41f950
GetProcAddress	0x41f954
ExitProcess	0x41f958

Name	Address
RegCloseKey	0x41f960

Name	Address

Name	Address
DeleteObject	0x41f970

Name	Address
OleInitialize	0x41f978

Name	Address
SHGetMalloc	0x41f980

Name	Address
SetMenu	0x41f988

Reports: JSON

Statistics (274.73)

Usage

Processing ( 267.19 seconds )

234.514 ProcessMemory
21.803 CAPE
10.844 BehaviorAnalysis
0.031 AnalysisInfo
0.002 Debug

Signatures ( 0.35 seconds )

0.044 antiav_detectreg
0.031 masquerade_process_name
0.028 ransomware_files
0.024 infostealer_ftp
0.021 ransomware_extensions
0.018 antiav_detectfile
0.018 territorial_disputes_sigs
0.013 infostealer_im
0.012 infostealer_bitcoin
0.011 antianalysis_detectfile
0.01 antianalysis_detectreg
0.009 antidebug_devices
0.009 infostealer_mail
0.007 antivm_vbox_files
0.006 poullight_files
0.004 antivm_vbox_keys
0.003 antivm_vmware_keys
0.003 geodo_banking_trojan
0.003 cryptbot_files
0.003 echelon_files
0.003 ursnif_behavior
0.002 antivm_generic_diskreg
0.002 antivm_parallels_keys
0.002 antivm_vbox_devices
0.002 antivm_vmware_files
0.002 antivm_xen_keys
0.002 ketrican_regkeys
0.002 darkcomet_regkeys
0.002 qulab_files
0.002 revil_mutexes
0.002 modirat_behavior
0.002 rat_pcclient
0.002 recon_fingerprint
0.002 remcos_regkeys
0.001 accesses_netlogon_regkey
0.001 accesses_sysvol
0.001 antiemu_windefend
0.001 antisandbox_fortinet_files
0.001 antisandbox_sunbelt_files
0.001 antisandbox_threattrack_files
0.001 antivm_bochs_keys
0.001 antivm_hyperv_keys
0.001 antivm_vpc_files
0.001 antivm_vpc_keys
0.001 banker_cridex
0.001 bitcoin_opencl
0.001 browser_security
0.001 bypass_firewall
0.001 uac_bypass_cmstpcom
0.001 file_credential_store_access
0.001 file_credential_store_write
0.001 registry_credential_store_access
0.001 disables_backups
0.001 disables_browser_warn
0.001 disables_power_options
0.001 driver_filtermanager
0.001 apocalypse_stealer_file_behavior
0.001 azorult_mutexes
0.001 network_tor_service
0.001 packer_armadillo_regkey
0.001 persistence_ads
0.001 persistence_shim_database
0.001 medusalocker_regkeys
0.001 dcrat_files
0.001 limerat_regkeys
0.001 obliquerat_files
0.001 warzonerat_files
0.001 warzonerat_regkeys
0.001 remcos_files
0.001 spicyhotpot_behavior
0.001 sniffer_winpcap
0.001 targeted_flame
0.001 lokibot_mutexes
0.001 suspicious_command_tools
0.001 uses_windows_utilities

Reporting ( 7.19 seconds )

6.641 CAPASummary
0.55 JsonDump