ࡱ> `!$=r1)椰5r4$xڥztV̼]{S(N)RܵHJ"ł)P4S!Hwf$gu^N֚~{߷߽yg pĂ$n~* ^yy~, '1k&OĊyWU+5}?N?r=w_wG9揸>W~ɏs>um\K_E\Uޕ ,~c(D|e"^G]QqT>w⭨tx3*GcnFՀ[Qn胨8j>:iTTe%CXߗ~׏¾/+ҧI-8̯~9_Cp*r.o:|ʷxGHv yಲ^-y\erc/8zΡRYH'M.5 rQh|.}!P@>9hi,~.0`لYf4KeQ!"ۏn3"n/t[ns7WלϹ:|ݕ{?r TLϟL Y7cګ;=][ ?ͭc"?8˹>u\+/ߣU𫨤B7o)/D} sLc ǷObE?Шڀ>X4$>TS MjF_TsK!UJ]R&5XiH+L}f ȿWSg?!~3> |1.g"_z[KJ0'YBʲ:#as>fc1ˢ?d Y}5?`Y-׾OsiKs&BǙ"ZX_[RBVL'=>lX_G,Ʈ|k#.O܀H+N.81 ΥdזPn- 9HV8 ea>/)+Snx1j P'G@|$LfݙEE"L&9 0c|qd:` hTrSzt1STwU-.+ ƨ֘ur xj*ex0ܳs4ˤ;I]f>sw=/}K뾆;˸þ鳺>1 A"4گ~2 oA]|jsQ O`k XwÊ:ye](wY̲2O}1k}_mi _BL>Bs24/?YBw35eiKn}O&I|/pcONHof/_cUM6h4fA-WQw?;¶,loiL-}qhB[^;+:}X3\:С8tb9o[Uϔ~A]o.}=H/&` o:PF+m-hǥ|e.&u=MzƤ]d(1VcxNA8tal:A'2>Fr$M2F$n9 eL*M ߺseû^X&s0'f7T.ğĜбKO5wqjE}EcM*8a?֒06“tos|>]bhW M]5?X[56Ҟre$obZΧ۹!5DpK-wy+[ wLW˲J yMk4R=g{{9Lѹ0 Pf7:~nKW0}ioɹr)f '~f=䵒@&J1&m"d e:Ƶt& ^ (MYp˷~8s`џ zq5N@  ?w#fuvka])9.sc6Wki n86c3yI5fX`?*-@9v ]\,X{ wN=&B\OZjsW[u b.ё&qτ<rV6&2ZKW"u(\erIEo.%[q(]~˥gl0?(kᬟP;J }yc]2?^aJg- v"q`c^;4~q`]Ĝ1sP-:,yRKI|0GƯC<>TGidU?\p @Ol'`? +lBܰh8Fc 7͆mnu7f0Ɲ`wں֓ba13|"ޤF8bWڀYLFo:X`G vxJ A]֩6p;T;-amX,5vL&n7pʹ\Aj|qRvLfƥ |^_|Oore/jn4pϾ?V67ҫ5/խ7ѹ\NwOÉ5DJ~9#&SdR_/id~GBty֮q i(<lNqEq q8%$e |_1- N& A<6x, 2s}[@6C=/9;ֱjk^ިxnz3nI~)_j}I%s!IJ-%2R M+'$&dp\~V c?π.z[^-x%|_䂘n]-n.[m1wAw09Xߏ'+'wSV\Fq"U1,7Z5^q8gTCchpTq]so^k"n}&sg4;) n!<Ώ5uP#^|z*z&c鐴RzJ*'1,sySbuͣӍ18gsן];hllМ@>nfuuiVC5t RWKq#uH I.t6x59~* !H. mc vXg^`ρY򡌮:|fFG>u fH )y,mS.C)(qq%tvX/D/q>/? O!* Sx镾 ]wtZ?A0I1uTS5=DEt#Pz/ԧbS 53GX\pГ@~5)l>voڼ_)7s+I/*euTIHv&uqbIR1C֔P\@)HC ӯ$8Ͽ9>KmvxD;;tpNIC ݆0z k5,$)ӧؓ +R5 4ēS/w$9DZxXǸ9 TОzXՆ9zkJ/sH2ktjޤzI+MU 꺕:J\ʪ?Qv[RI&$o2SK/+W+0[WB4Nx Gbo ,LKG0`m>Vjwr*UM˶^/֮2IAL&Ԍq>nzQnC|թCA7IM TPRC~٥!ƂLFBRYL`;iCz#5tF BdLˈU}13Uxsah7CM`/<fC! "juQ>Nu;0u7]AZh~fCIu })6)B%y'8Ha} |Ke iGh*ƛEt/]3-fRlhX0`W5t{N %>|&QuiuNX=o3m$4ZIoT{k, Jn &0L@_Kgh(}C hh0D La0 4\˪)vAY)?&RW Lz \ S‹#$0Ic<5֔vԅԋ. []m jMP!mNi}tQbs]e;vXIc6P%sb7kxU hD Znb8ʿZ̰n8p{Mn O6x.$i'F9G0-M4H j;.RfH+aT7ښ.A+~sYkSx2`2%q .ԲlLu):hBkt2MqRkF,%)_!i込rFA&as醥*f\[3~l:f>Cu)<3?:; }!t .Փ0PRRyW̑&V#t5ZRojz*_} g)V&yPFAd~zy-Y |b}(ڤ`Q\g]1,}neqҋ~tFiSGHMikUE L)4.69/wYSe.HcIܸ+ /PL*k6e\|.g.p2-n|@By-䊎Z/S$M;j mvW;OSj.uu9zL]t^zEh2̋) LE0Lюb\O / p.x!0EIq3БY益o֟}JR p4Ke/5| hl &jkhZY~uk[۹s="u0Pp_-`<O3p{}w&\ sq2 kC9 =\KJ7O:ZhfV{. MX_nqj0)kO,& `A\Ph!!/C9Y-9%Nx8O X-܄mrvy#y\S0. 9 xɜq: IBZ%(ԎG緱\Z]U_F~7Zl V}ͥ)v2M+Lrؘg~ VAB_pF S\ r3wV\?Brαו뫭mw6mqoM%\tIm2J]vcڼqeGߚkj <__Eɞy r648bތgxV*!MmJ]rIKW<-nz-;u;!r` N64p}m 9"uSR0N+7rRA tSnx`B }Tֺ3pkn5D_Ὓf.`B}_+)@Pӥ\0'.BlePQ~|wc"UlV)cݽ4\J"{IuPSwA/N͎&XFbX}a;NSnZx-'[,7 3-7=xFg4DR0c-f\pi}Sh>1vHzU.;yOYܔtjg6[Αt4ZXߙ)'gaNY9d,!X\z,j`c)%L'0 V )dM#K . ́-B=1Q-Ӭ^VZhmsce팥/5X@Shk/smkme}9鰒&Rv ٍ"֓֜#sg*\ƟvoaIfM bTО#`bL&2buي5Ɩr{ck$s͕-47C'9k#\Z,HY/zd9Bh|>1Ʋ %SFb57nM;1>ܪ?CM x 6Ձ\nq*H,ѮNgd=*4׌Z]L^Zj:[׭d4eݦYV$h a^MHlaWY, 1 .pCժRyA@Wdv]DSt;ѓ6^NMȎ{ oӅtYGS,b:5yģfᠩbT ;&cc%|$c ֚K @59 # kzڞlβ6IYt2_7f I"ă >pič "<Fq( 1#τx O<:hcXL+`֚-r0@_LU!M †6h2hM4N w~o A#E5@9s]{S`Cۜf<`7]{v6:AbyS7BuCL7oDž|{{`Ȩ@y}g])]]7خ?i]}`W@W\b>(sc@΄iu[Nhka=tfMTX*z@[uc< ;6'ENB`|hھ1z{K4-Ԍ4Mpewlߋ[>Y^J)qur 6(/sK I?$]mmo] {`u:Mz#kqi\YX70Vi!Ji):Ke5Q6'mFTR s$ܵ>^xx_GSy _[i._u&v? *ؾ)z1;b,~L nl!Z2R{| PNG  IHDRn`XPLTEέEI4<ƾMセQ$c!Y$QΜe֮c1eJ}m+bڛ暛.abKGDH cmPPJCmp0712HsIDATx^\ pS׹µ-$K֊lP.X^ec Y!1,16^` IY4 )K&NfiNu4Nf:̛y?^!!89;17Ba=PH=P20cqORI=I$e`8ٔb,\>0f J[ sai~pTk-Xx… W?OXtK ᆊɉqqq%%%qqɩi)[.|?G'A!PСC\LF9)E4(FVqYgg.|gdQWi$PҒcUm6mZ26=$11ƨ?nwm0Rie(D%<()٩*ն孭5V˓kŦ̥w_3ɞJFv@٘ HjNVŨjfVkTƒ,;|wi&p  ʈʡrx^qZv*fCn:P5D2.q=hlG3 a37.aB{ȯP22M4ҐRWjɅ\djVm p8x^U2Ūⓒp1GdJII.Oej 8&<&KGAI dFs}! jO(L:,jZ3[ed!~x zRY0`Dgz(MFV$ ,7Z%/b`Q8mJ0畚20%Ώp>Iђbo,ֹJZ^^\Pfff(Qٲ Cwy%VmqFygcJJq*iUY=/C+"~!`OZlS>lVA9Lb:yn`Bq)־!:l1!GfqJZʤIJ`P '~ѣ ޝ(u/SHyyeYP 6C(za$I(QFQ^P*7r%A(JT")}:KZ66%z.4aOL\ߥX(oB{YN(g͚U\'L|X|l1㊊]6newEpuEqFq P?`Aǫ J\-0rra_FN^.G^P!P.!ZT.$ʏxú,&.<A>$}~5k'^;`Jx[VE0#J L&`Uzo/( rU^~pE/J)]jEUhOq2LV|=Q'-__}ϯ\]5~K{}옢/8 \n[=?2fam ݴ׮MɩِĽ5k4 B\L׷(k;c+?88|$4|YoS"YAT0;:4f߼oRaKOX=^>|$->|g(*/>8v+kTt1c][<cVvjf0;/e(*Jora@=ݴ=ml%TaDYB'%;.^G',O& `y>lg009@cܸ TSd y*. \٢9IG}@RnZa)VeʰaCH&_ (R/&Kf+mvDcbZq ưaN=aRu*g PN)Ύ UKbkՌ7u"˗HKVz.%!aȣyw>5G)^&ew!NkۭUBezxሄʬgOyS|p43&c+Q)vnBeJb.+WO8I9[8~Ҭ<-U 2veI0@z I @?ď`bF n"rAQTB|pli>*yDg}[Uٳǂ )*`쫲RɌ6>hQa~yNʠKcI#CH~D2sz|zS3^P@11d2"(|:R̯b|-ue` OJ6 e.ZPv.(C/zҽGpE7uƖz7`àD@9r,OBAT9EӨQN$*>I}Оnh 9W~gIߑL2@YGF *38LdKoI{X 7)^a2jt y 'RHC@~bq+Sa;;E_`SԇОn7]\$ʼU` mk"(h# WA%¡L!i@ [`@92ft%/o[#2s ̿. #;2ŷJhyAMa2xu|!7H }\%Gv:R{{~.jfK\ފ8*~UYLn= !e3PWұH{`RffwUП|1JZN'-,J (n|az0vp*jW:j Ζh!PXlayaln#g˳pt v$ 9J؃cEPPT^@9W\ F#"Ŀ QJٹv ƑۑY40q $@Y-GQi4-f 8}Af92$Eu5b>P3P˭A3kLV6"7D)tfx hB~CP*~0d+Ai(aƤI`3'#_t$`P3c!elYZ~#NʟZ҆*٘ Y&B Dx _s8s|AFfp[O3!C$)I`Ǽ^')Yd{KX&$@—wav?t:ș#)&)nXͫ 3 mLb-/vEbh%P)A4NF'l9T&S`v6, GLl7;dhqѴHA4(K *B?ȕT3TIcrM!I!I5B& FB) \gG~LEA:Q u*iƏ Dr0Yf%e sg@nBAA OJkB$em"o%̈́1fK@@#UBWqMCMO 'toہ (RdGGL@)IFJ(z^,Mq*z(u!6e'PYOYrk 5(dj!*j>|fיfpV42˛A'ǩ-NѶy\,4@RF1q!)'#@2 :^iOh=Ӟ:C#Z؛דdST*aBL?GےMD:K!Qj)Kȃ3U 2A \BV6By 6)"oAo2X z2|؆@4-dǝp- XXW J-hb3ke3x SXڹ`R~,>cb>3NThQP6(p(H8NeH\XF;kw{H AE"]6P9.uH_PP<Pyb[ѿf~r=Zaĕs_PPE7."4Op=K\'-bcϭ|XnD)S,$ӓe/5DP ZqtceKw2T,%MaQKpa"Rbf8zA@ (Zߘ ޯ$J+;%xb}@mX&2+PX77diM1-YX,1y!"6} e$E J[C~<$}" 9`(p O']^a|$S&2wp~xq\45D *Kb˞:ԀuDx(>p^~IA~{d8n"Q$̪+XM_} 4?pm@a2.Xick-Hܿ{o2r#T^jQx  åoJ& 1d .W\E`|IQ]nߠǷ:mjiE~S|G_1Ӧ`sY^Z0Wr)``#Fbcᘂo>D~1-/'_iQ[y7._?($', t./=nkV\tFם:ujU`;JҪ+Jq$&i ~K`1;a nŋ 9ʄ%elB@ x'>Ի&LZzrڥylSHk^I}qlm.;-ee lbNq+6פr4cK{ Ͼտw}-;>Ll-Gvr!e:i?tZ E=5hY⎿~K)pʌNƥ4^>bs^+U]i΄Ϭ[ʕ{Oj|R6+I-yHs(_ ?y%p kN̬y1ކn-Fh4'"De'N1|f0dT#rۦSVFϷ.;>Gm(u:}R۳gjt #Of+|s@HK%$̄ShXã<<Ér|1宷02zPa:ax,޺JDw?WU?eu;gS^*P+mg%aQq.=;*zM8C0S3 棁ursG 77[2ܵ#@t\5 F+.4 nw׳ަGK6:3ȾK̬k_7.ߵf._ݸq_ &4t5kqhYA8$oGlȜ|.>@ V@Uپ/8]:1_AJ4lfRMԅ_({.?K!<g2 UiPk# D06޹=BݔސmV+ GP!Y-/S *D1abwdl3i a 0۲&Jh2 q€MεJ~izBW(YaytQ 9)_ת Ȍz}AI"k#y(x]b b\6Xe5u(e?#|@C >`phϙ,D;RK@Rp\Wef!nd!QmߞoRQNB،brcXnSsNΘäu&1eiMӛA fjnGsӌ敖3o['$voLxhޙ&e5|Dۣ'G꺾ų.ϒfEw<%d>FQ093E;&N;u5n.iL #O㫣L3h !VW::ց\p~`\3tp-nJheSJZÔWSIMci=SCml)|gi l–im @V;pd3;cGD3w ~ŧ6K[ZҸc6c&ِC|6Z  ;T7 PJwӚג8Z>ƏQc|ij|KK |iIژ O>R.I[)oY|/P [Uvkh#SӥWlgzUx'ynS *_% wSGf>V'{ԃXO= s.U/7~+yDcs/>퇃u-bd.ħm踅m"csaΕ̿E&79!`:?z.6Ѷ#݅gЪ'?7@D &!:dMg e=173$M',:dҩ&>GFefeclNf~Z!)ʜ% ~TǷ腯\_vU_v@ꌽ7bA.`wM&,ΥNbl/|.E[&g.;.3ݩh3y3Cg G"ڣQ76_hibں+jKDry/GG9a>K*?r@.dP{BnQIIʎT=FiOm Ma /w|㥜)>C0wvҶ㗿Q5+u%5ܯE0z4ވ݆Qn~A=Y {^@K2z]F+w/8dzӴDǣ=ĘCj"E0 g޵w uSAZKGXSCSiD5Y؞sg>9RwBgw"h CA,!nHDyYNŌYlb ܓc"~ÿ18~chv]se:jx'TwBQޝ%xo}P"{skуyPV+)*ɺ--71Wn;1iM'drεNKmXjÐ5pp묑[1u>IE1/kQ8DmIwt}&yy'ry1=k.ܒ&kޔ_2w)kӱ$r*5 g ZXnWS2 ,.4ah;f;j{Bk;UjJѱrJ#mߞ|Ɋo W*@Y(!dtYg?ZCWmg%Q888lug҂A1(%$䨟 AF/Y!'eo+kouwJ^Jvʰv &7k6 ='Z_dnXqbrs؄ 0Zi-.2KsBJN&9,Ls6-el8mVNpTmelb8C5 V|-x BaN&۟{3,. ;\΃_o4Gd4$җ߽y֛8zӯ/IAq~)HTm9]dيZ@sh}chiK:aB>84tvc@'2&ba*90b1-!Xvki-=#Tfs#]@.~̢m&w?_!flx2~3L`Fc'3? {""_F;&8"EÉtj ӛ{B7tYgtzt%nNvcs ׃AS}'}{T dvm,d,C:ѯN"֕#v?pMO@).f\ƋQaʯ d=6&Hjv;}v3lcB$lM±Ba5Y[˙i).fE2)EDZXE8^Ca0~_OWuM%)h>f\|1/#G+5`o- ;+3Xψ ؈'WlH{#$&DDRQSI$'R^3qr̉=4믅vKjy9]{0=[Dp};ޡZ|R1[ ;y۩#R>I2y)$-7jžaی$t,wf/|;vkBXbg6جsjB"0ƄpF6Ѱ 8i 9gq8o&,C6 nPyU:g9BhMZޒۆ3-UnA]ι5gbWBmH%klI\%܇pkV]"!-: ەfz,KjYl|3f{]l&ڥf]aUf 5lj7vic?klL]x}4Sƞ4E1hk&Z&L|W潾5y_ n. +r@a&mͬÍ0 kX+X3KX XCsY{Xw3X_SXk(Zk!pcs"uVS&| s\O涾7y>11ubϛh^7ѽuT1v'l3MfnD&:}WtiW>?.7x8Z"~k3&zvz/jmWKvZ/e/mc9`sm x։-jl(͎Uv,e DY`'\d i0&bH;(mG6~cd&bXiQX }lDV\}oZᬇpbXXO7f_|'{.4ߍ{dL`t!bA e4_F66">ky%/0|q Y0 ΰa96BlHb.|Ev =n^7Q;X/5輒X"O!h6f{Ϧ4Se5_$ֿ qc!5z=D{+v}؎a#;?ut"}8.P7W 1^&KEb?g!g>{=C^n/b 8E-aa3yNb :F-&Q1]vOZm'-h;Ѷ>kh88Vl ss;;=a{ |)_Hgk ^՛C}Y_ jj5 F{{x2+gOUlvD@-&ԍ8~:@󁅸6=BBDĦ伿S@JZRsM !#̴g_vLrڤqlbEM( "Tjsg;ݱ]wF۴6#dJY*؜-8WU߅x^v~a\Q/[B|8Ա-- milJS[N|myi9?[Ej.ϛZy߇q{Y>!6cBǚ֏Z?x(ٛ}k:%'uȯ"Gȯ;Bہ1}Kar<"xWd"7HESdd`=u/k>)rbH τ:W~hu|O muB3],Ot;fJ: 8` L0f( &#t ,jjz,@yh4fQ{Atjq*5׉r,]v.3+Wiʼt2L 潅ؼG^0K׷3|^zϙ)$r1T `8c`OHٗIKdo{NAًʱ'UtEk#h {Rc[@s}mMӐ=]m:o4/p}%Wd^Y嘣,se/ͼW%𥸔d.]=(y1[,佑~韁qߩx~xǤF9铍wGfgfBL !Lx祇蟚w`JQe < _[2#9B~chNZEMNrf~eb,쐓^ @! 7#ìpEq(AĸIi+ njO'#2gM/Oy\CjĔw@R3!'xeq\o|·?~rox*!grlR:HNM$ݚwkr$9IjpO7f9ڷ`Vg6 {'ڞuA^ϼ`_~^O߅ڕ{W4]Y]м ZuFNׁ({9ǣviSOca<5հUVV}@Y^Z){A{}_Q.uWo>?vÊRTXqP5k4_qQ6+rbQ5~kg ͛#;EJ%tP*#(%PӜ*mB xVTZZ;U91Tne2Uݱ"XAx.Ju:#=gZokRry#7%_%7[QMрՃ:ý=hIwKwyIk4Ƥ&5:mIMrdhIM'όĊQj{sHsDnr?fJ܏lŧl0J,4Zb 555KB泎3?tvIdǛvIo'lv2SMadJYk*م]fjӆoԶ;FcjٽaV>.7%bS7leg,vIkgvIޗmDMtg[ !vg`;{Q{ ^ si iĘdyy-P絸V1ZO!> 2]$htI4:0|}vg`VtMlS(9Y赐<0L-z)IKRE̟5 #3  C`g 3*ͅ<M>l׭C]_"Lʧ W~ۣNr=!wL=~.So=J k)9mRImߠ/P'fk}}ߏ13SSA]ZPPJ38cݰQ@ˉl\Alg tw{F!7k6=_S*vC$Fs${O$djZr3 &0n&6ao 7F=̾pu~u~uBgtr}R5j9GuVF(ǵ$Ml4nV\p`#FIK]И ݁R|{O{зW~Ux|5K-/XN5Wg,_=YkKn{K^*_j$. nvKR@R{|Ulscδ9Ͼ,+β8˾S}S{N9 WNs8}K_΢?9ހkz.yg5DzR1MG4Ԕz@S^ݥi5J ͠[5n,ԅ"kf@MحB٩Jhb%C_2 >pƹbq:~DX^q~NlO}ty>8K6—% Ɨ$ wrٞ#g)rsk#arx/|q$ @Bmlƹr `v:AGo@;@Kf 4wŻ=jz|F-`RþT_>}) N=K=$BVl\ckNnhP3AzH !ϓĚ&ӄ6Ƴi5͠b3Qg{.^kV}9Wi~}#-ރp"ӢzSZBc4QNkE |R;^_}KқƼtm[Ճ|Ϻ@7j#hB6uVC}mv=iInuWH;av>|Cx_Q?N' 1 |{ nA]S3t|{yŚ{{YC+`M䙱UMDD|%W\MB֐˟OG}N ۯg)A-kl_RϨ.w Sפ.[:n~|КC'j v.ޑږ󷩵ugi3j14ͬ>6zڬZf6V9ͣl~-m i Em1-lk~[.C}# v%j46h^>Ե֦k]GM/Ե/uG^Z)zn>նsނOPmc% zAP=^G_?53^;OmQk~]?o=ZBGPR#<}^ɘэ=;5ە̚렧 1#ڂ#_iF\M&;?mO/X_/Yg-:h烆h鉦иZBsj]٪3 j9T|l1-Jg!Z%ϹwM+P؋D:j#-5ZIMͤvRQC)T2mISwԟS]ᦃ-E-Mj+r_>-FJ=[9m̼M򶅖g `ml{H<+u'Ξ^/M`A?@ bmO=9}Mn_hK}c~ jy !G.!KR%brq9_IR?aFBa5fV2XBm-e̡vP;!\j5.}yu3ZDLǯ_Dea,b$4:Lދ}zte]vBZjqDF\Eź!u'Ekwmbڜܵ +`j uǵ/2]ߝyzn oGٓ:묭#w]#rWձ՛y؁niU;zBmFQ#?QZЎ&QmI9Y٩K] f!KeBbc eh5(:cͬ-C[|Nv(r"W9{>V 0a8`?vEncl$v`o3{YyD=nd ̻}/5>|;a3]">0u1EI*;Mk4bGNQ̏ѷZB_EZxR}rvӦ9ylINT{ےw:ywhꪃo,TU%V$.)՚I=$;VO)^RDH9>Z[h] 6Lw.Гas RWB0̃Űn 3a'xe|/z?H.=-Y4V/DzT0_9(_|}JvS%%6@(,0[t'hy&`<^BK 7LKh z;+oe08y-?bƯ于h&e|(|&{>I$H=$Y?FL%yzJjsM=&_ "΅ {q{+_ɝ'dm5Zp+-%wtAO4B7EYK|y+ 7E\qx+X&!1a#6c{[oi7&ҵ%nHN !~$ӽRAI+5>M2V93o̴e͖2[+[cccco5q+ks;84A8l)=7g xcbZEq(?%Vi/4ZcYlVlv)pXPlJ쳏h4%hLė臎- >c[|h/ԁk'n]3~uGu _.90?~ۯTɺKܣrQIyg?@d}2l=%ss2oxdq/Kl_PϨT|L=pW? Jeb7;d\ 3G}<@cJ Pܝ15玍jhD?duxGk)U_Y+?X_qGT_~O&ҪZiMM CsHAe+B9(M{I(n_ B~9!;dL{iRhM< >sU?7q|c"N<SP #|D/&g̜E MT\,&ÿTAM Җ 0# k-J%Y3TՌ͌^Yg9*'Z_N-})(N[Qf*Lϸȍ\ٸfL<+ RA JI 1=rqiz?>xZi- ffddӥsK*yB5?|}ߺ*<6b;/Օ2g^rşPj$xWO " 9hE<_}߇ؽۓ=]-:$n/M~s]bZCܵb.ߓ5@̓Dof'awph-v;|Eg{(թjxggMgGXuXYݵS%AdRBjJ58+60&cr@.@>ݩ4'f[Y4'~hG-15~zmAͷ@גzo\~\\͙ˏyZ˟v=#udtDד~=߃qߕ ԉHYE;oKO;4d=k;tj^mѭ-u@A[4$oCS>'r'+rݜhN}ɵ//c|ɷUcACoP w0@!c(#CPbBc@bFCp4vp8ph;0*dCY!CPVPVPV0V4chCaX9[cXc;!gcX8K}%gHé0$gk 9Kƒ<|!_(s$j85;͆7Gd@a`0:$'Y3 $Wa З罡}z|U4//4z|3Mf~ϙLS0">-BfZ-2t[fK賘,FEn3my~>|aCh!|sb6ZFYhh1-b:M:)dusy/+ulb{s3W8sS"ßik,="_7ˍzDvbIlQhFha/chg^N4vRz+75l66mf Md0U'NVKzGAǃ?#ɣ3 j99An1;G~q?N 3,?ǚ9Ogg :\puvZƾxzzB\a^a]e]eJ\e]E+u /2yYj tZ:M~N;tΑsz:Mc8ZC#a9Ȟ_;.`!O@/ NMSv`b+,@xڵE۶]5 9$9䤢 (I%# %(Qr  "$(:]]㮯q\GOtWUwegGBFK2:C/WZӻq_U'눿OxGF!94wሿJb޶"Ǵo&]= "T#qԩ 3;d?cy;ÞI~>mmw vjWklemGY7~϶xKm =(#eڳf=hfkfb6>f}/\;eO+6YeLi)#b)'6 b(b"Fb)zO2x4L Q<%73EWK 3WSn61 G`H}# {ٝ:ΓyYeQGWEߢmz %%#-M &{2k7Eh.8*)ӉED`-\TFK1G$(G(rrY>H^Ky#E\߇Ёp5aX!&kuDp]hEqC8^vdPND3HQ1:% 7qht.n*g.Ekys=sge">F^ %r8FG±bCXn(&&W"hŸWi)dDҏK$b Zh'CϝAr88q1EOiVDZ?+:G3E1j8엂HL$)-W$M#yDZvۋq<:G$Y踸!΅;#h7ZL$/&]D\e'ܕ^EKDZ8쟂HOH&C=%h%7yx]e98^*΄_GhMOA$[o@>r3Ey@2AI0;GHEDH_yD~ɰ&S9N|:Q huxMFaw1#5+HA$ M&dDB |ɰ&p!8xt<8h.7 o"oeDmd"yhIh:2~5?B_yDnCo?p1F8B /gZ&&WJ*tҌeE)dתD2HfEƯ_M+h }vii#ҌsvƭbZ栉bIFH{(;\RLA$6/LA$"<<ȰviBڥ}.Ȝb-ED4 &zF(˦(CV%ɠHF$̿{}Wd؆H4^;>߃r0}Xh"^[r2+VR6'Fv}0J~n- |CB(Q|-V%2G=/Oj^(!L˽Ĉ~%cNKF'5cl!7GȐ.2jN\ge} x"і,j>Dɥ#%g1a~*l[cF8\H,8blx'\Z xn& ddfɐW(m9b,.VQ2j_,4rmLX}gl|$6Id:~̦xEԶy< MCiB9NYQT-y![Ad*[j[CԀk&WDeD[Jr i\(Dhɛ5 &[@խgU &*B^+ ڐW<%!/ y7?e@o|*/Z'I<;=~ S BWL@`%&y)-(C3{ZY#FwR%oݠf2ߙ;OB/**+BUb  3&dM4<-yۘJɐ燬Ruk Q%B^"G=Ț gZ*/Z1!UȔr: I>u+C^.!c q>s&gZVʸ-yטɐʔʐ$S/%ȋMz߃|O{?[.R_NV&+yG:-JnZd( ʅ-dT& >v0ʃtA:RWRҟ :ځ4-ʈܨwɐBEP>eDi+zk~hZA~DyQ!R(?ʉ2L=uwKIr ^ԙ+S-d1TO(*r'dLr'O~~w"9F-u]R /B(/ʎ2%wg{8B7u )#-۹|);zҤD kZ?)s%xdD!-J$r1$YD̑F-_y#a ܿLB NȂ) Mz!-GJlZ<̓EF W'j-uɑ ~&ދMXH#@^7zݥ|/?`$"( dInzC׽I޹U7&[@]q~ҩ0hID2$?2\&^WM~O?zKOt zț^/ɯ܄ђ<~dH.36^^GW]~-W:[YOyͫ\25(B<^rzSsƫ!QB\E?^/_/P\wHxBi9Ք;o%%9L;j7*I`(h@# uAmѓ zwD nGq5ubיK7_. +h6';K8N_N8+8:Né7p)pk7NEMqjC(p*p*p*pjN éa85 0Spj.Aq}4|ZS qj!N-©E=Ki&'/Zv,jN/R\*@8S8S8S8S8S8S8>ڇK:SpN}SqY^ƩWpk S}q)p N(#J_!8mCkhbr)qarڢ'QSp?SpwS}p)pNY\هFh8pj(N ũ85PSCqj(N ũ85PKH\Scpj N185w#UKSNv'J$KD|L-;{wߘQQ^POUK}Tu'@}FMb}Ym?#'uIԿUŌj'Ԥ `҇L&kh`r>6Bg bS8tBŪz%B{ByC=^L|hW!߫5RMLԛ&{(ox/:zchq7R^Pqռ-0CV3XG^9^EeWWH-1b/@=E,P5bQJ/yuYQyדlnރMꛄoE_Tq?^՛zWS %Y_U[}SotOUUňPCB]LP94d 09CLq yK~=o u^XZ`>-X5W >|oH6.:κDbfn扮fcV@\ĩz׈.z#}$J".#2{:'s& *zzBЧ<}AO7Onv6BM&WJ݃p-\fzOI0=C9;/{31Q\dffŻfhov(=}C"D(/A]ϔ-Q7weN.FTntd"3OfK/* :F;b9x ir8y+NS~8C0Oɗ=#x2/BziXkE9/A!sA|/uxG_D((9Eu2)<:*;7弑D^YUê>fKvC? wU1 #>aI^$D^;ݽWZ>-ye>/eLؤO)!}- -jt:Ig u.YNuOKt^'~L9T1EQDG=ݛ1b>32o3& 3LnƁ˴{`W$%˪iIX6bd^)*r g2))b)*w/tQ\#t)Q'*#2>-srNvɩ:u>U\wUoԟ[:!ѻꩿT632?*K_/A_ol$]AL׌>^+j@yjpZx^Wڻ,쵕yF1-&\gȗMCcbdM? %a:FvЍúE_Dף ӿd^[T7OIvD^UTѻT dr64t3Ϛ_#|;Vg&}JN'Ԏ׍VU_euanE JFYT;+jmsng拡s5w2V|Xab3rnb8z$+x'gW-SFl~rnuz)Sc*;KLYg)t3SdtMmQ9YߖY H)i_ԯN;u#FےJ{TG 5Ɔne~S5OJa<# Ƈo Sꆙ7]wքYsLsΚ6!e\s;tuiñu"~Տ7%|+k-)3M{懁Xn`,uO̖/= sDgF8}zDpќVuSMcuSΧfs q7trƍz)yԱsQw:2]8}tey}WujZD<)o9*g%ym?R/zQpj*[=* #aFId^?3sJ2C>e*QqgY,3ɴ ьt1{NNCwvnX?aK7#fDܩɵzSF;gU tNG겞x[jw^vg+*x/}mj2v^9՝5SՐ-*WIf*0GMYLe(50dq$x[]A*7teG6dc}5t1!zӌxB׆~8HY=UtUV1f5¬PK٠M*UUǽ*:sB1N=,xR^}ƫ'/:r%rbQ )SA]W+Y1>!JOsQ]y11VO韝=m=:N]У4bf2= edZ`x\d1KT%UFQGki2?-POzI'J`ut#ɝX9‹(%ME Y!6b܄R39F閬{4ktwqG.^YǽJ<$VʌP{eYfnff*7_Boԑ]L a/';N#{A}YVOOj)77ci!X~J~ks{/~|E&_e]{:/UD}yMUtkFj-}0t "x޼0cT`NT8ˠ73KnPu7ʩ޸,tߙ!I6/n'6y *ecܢٺ'Of6KĽ.E㡺a'Rwa]3} AY3D5qjVAtɌT>kmI&^U D^-ygԛuow9ּ*{+lҼd^LR-ЕXS%V~a@̳i3/"^6`4|/Ovۨ7k=LͣJz7Gzf`6jy]3m*s$8N܏ʚ2n}Fy^JƯ+G}Fq3B? ӃQD>ҮRPuu\Pya مVBGܳj< M+< u<h#`d"lP+fǹl1LE{o39}v/Bs3Gkf\,d,?7O^Y!jLYr!λz3]J7g3!]}W5<HUQz&z4ݛ|X}ibT->%~vs͌8ߚ, i]_N0;76yY>w 3Fy[d?*\8stmgnLCqg>a߫3c6n5T^*kD4b{ߐ>f:k?j}+'k<9cֳ%/73]c|8,Hr&-7VY^O双zg%y}&]Yč\=>gfpFP?껕˩ DV̽_5FyG#M 5TQjv9"N%J!-j*ndDﰆĿUέ@uPEU-)v!u)phK>oMT%kJ%E%_nvr S{R5Nw5n=T ޲NpthЇT kE?=7r-uLAw{@$r:In+>{F^oNɧ(ٍ>y\R69O' yj.<ށzk?h3FSj6nm6zs=e~K_; c{vo^CΏ\Ud˳'qnGV,vMbPrN,kL"G$KdFDF)ogj43^s˔|dq>_9g39kvM+[Q~bxЯbgb*! L\`Gȥ6^2NPߝ}.|L7YGJi ݞr1Ss6E[姶2YCl| K t<x]-FXK;ȹ632޷3;\"V; %_5Mɦd)gl `'Uhb/$cfB> y۶mߑCrL;\'>kHJ5gyJk {'{.9k9g=lOn|&! @;FrꌲO;qvwgK$ޥXG 3錳9SOl~笢'9Yv>c=d+5 6=8! ߮p|/,e^!5Pvޱhݟ/~m̳ٚ=Gnw OA̮O@}DvW헲/8NPߝ}/ͥ٬͠z@Zgu Ɲ ԵW >ޕiOƴ1C !6ΞlA%`7;A}wYDfzVml6 n6z =i$2ca|ƋvȘ! y5@m&II{J>kv]gق쳅1zT-6zզ%߲9Qr^Ș &d̃ڌ!/yk@^N–p=6 껳"gM{^Nw{_E>@P>*٩>{Nڲök9sw!%YZzw+5}DO[LWM? bDoXx];0^/{I:WvFTi->CkDkϚ6N2E&Q/sXw^07[z/a)=J47FQSO&i>Il66Ow>SٽWP<W&b.jb#A=MK<%~?y{U?-*6myƘ91 83.2V3~j޷t{L# V {:coG} Tsm9T63؛Ƴo4WhBbI+f8I Íξ^āDaYsfJ7LQ1L^1b*,,6q S ,U.SOl6 jz8=fxrV_iS6nm-ڶ0l5,3n4wSL67ɾ{mPh4JFiʤsv39,n6yw:~̝՞gfx$W7;*ݑVިw\v|n|V\[q߳ߖS5>E͏CXr^UjJ5!XM9O;kDU=quvȗ}8yhű%q?}-ϧ345?A3HpZ\FMU5ׂ>Hpl\ZϧNT5 cUͦus!Po84ͧFy8<Lmo@uuWH_nnͫzU|ꐬu Mh;RwA4ۡ :j_z XP,w ߭dHba5%f8ߌyyֈU{y]kuh:S{L|$^d['PbÏ1Q/ꉺsuǗۇg&9:Zd#ڂSjVjDkGrkKX=˹wϬKA$='~A7_і|dʮ^5ȫ${7 r7Sx˫{}1mkK[26~vyO+G7gόKAlQJ2ɔ  ?qȿM|$ɤ@ ͐e π~f$d侫o:4 "2n"#} G+ ? { F.*?y~O &Fؠ?oKȔu6A_t4E# ^zAh.!꠾h_HȘW+)/DI~}J}#kȐ9WGM|Y[#2~dא_L,$'!?ԭdM0J/D1/Z&ΚH~~Of+SC~Ɵ aRÓ$ݐʜg0"ηn!2$g$ȿHȖ7Ako#oLiո-B Ժ#SiK9$892ua4w9B71C44-bC؉ؿ-:BڄVh6Fꊞ<~%| @=ME3<+zڏ _h:z/RW|/8A>D)FJ|ڂ֡h!&Gꊞ<~%M| oEvhwBmEʄ'?OehuBlF; ߆>DRLԙgP g@>EDkΔ޹'2V;vMȘ >#s"-rn'P@kІwM|ځ6 c҄|ĹgaD-t#?HȐ,dU/{΄0 &='.rn+WĪoף-_ر7aۖ0OiS{VDJt9B7qm$?0^]+ t3N̰kf>#Sxqo(.^װ7]ʺ6+{S&[gȁ3 gp Ξǡ\欿]J^*6+ևMFK]AI!Z>D نv(d@vSsAv?6+ڂv&ʱD>R.Bkz6h ZSHAz ӐsHA(wB!tKR@ȚHC@!Y>DQ!;1N@d@]l dk [gD94Eh Z*m@"-</ ; a@mCV@6'dIfPlh1$KJi֐ch藳oX mv:HywJ$BI!,BKr:CƓ ZCnW{_nC-lJ Ȓ^&MMCYC hYG5NC*ZpjVB9MHYҫDq.D4h.ZGzxjC4=*Zp%Ta/] ƥ,U"(Jx4Mdf1B5EWт+/![Ȧ@6*dI$gaDZq)k!&S\jAuX2*z޴n1;Y^xXNu]&9>r_PNG  IHDRll}HJ gIFxADOBE:IR1.01agIFxNETSCAPE2.0$NPsBITw0PLTE̙̙f̙fffff3f333333`7tRNSEgIFg̊ cmPPJCmp0712Om IDATXÝ?kGNAš}B AUMqV#an0MCIya:4jźэfwɛ;;{$y$N)"]T Ÿt#HK:)(CR ! 1uIKYPsL]ҥS Dla-eʙ}}ӏ61+똷]ko\;u{ĤkA ʚ*7XXH`kXYðZL(ub:ꅩAkyXsq }0#҉uRWlWL71,wlc]2Ƙ~XGrmIHDt%s)UYUaeUl.rE kǫHF8 ٻidOFz代t_FX'xe?̝8s#V&.pk;p-d2Bق % b6s|%_a:NG?ߌX_4yξ?S;ڂYhk=h"XQQ RMDb(%n房%,[tGˁrBiN[Vlrj" 8`$:3NB5}8JֳZne-T:լ[_UjU28Wm^…{hTiC%yrSpi` UjdN43 lmKz}^ÓIhϾa&0+ɳ/yQj lPnzw-F |Xgx \b__L1u~=aյ% b }H^m&Ұ^o0hV츢 Vsm% ,#8h rd^أʈ4&_&az0WS wF DU,ЧmZ; > ^:צmdR9EDxJT(yuQ@uXrZA]s/*{pjS\wpgm9ňr^kQfwl+XT} "ϢMKk(1:LLhA1e$c`3kÎᯇFh!vp(gHpE\Ax* . N?xWHrH(@080@T&!`<ф5-ȓ"Ԩ3AO A&"DΧSy!  ,llI8cƻZ(d1)jp|txr KGy~c1$1tJUv,r6"S繛Gyo|t^;xW~HqF2air sN&v-.S\6<|ªA{9N*^KjPSBҰA7wmqrտbsM>hk=h"XQQ RMDb(%n房%,[tGˁrBiN[Vlrj" 8`$:3NB5I Y]Hr ɪZڶ]20ԪbZŁiF U/v-UqWQu(`yԻ}ro]dѢ.]sL *j ߨ >Pӆ⵲p0&`vkYar2eJuLcAѓ` [UeI\|qp߂jUQe}-[xVH"W* $)mPUrla/\i]% b.%`Hz$ Lu $U@eLNܧfX%8 YZ`Fm ݅!yS7*K5Ryvf[fa.w3 "˝Zڄn|!9TjQT jd!  jʧyF [$Q=پEPFKڴj b>Iz3\o& kHC#/J̒"\.Q®*[ \B~ܰ8C.wʰ\L),[kl33ժM'Ghw8mUX}uP.E^ѩR][e D%v8 [@<3v5@Dgx; r_9PJx:61W[->:~voWbroCQ蠇^SsY?K-5p|"Ӫ?ON ~Z[?NVzWTt1%X (쨯g3 Jf $IvB(6ahk=h"XQQ RMDb(%n房%,[tGˁrBiN[VlLUґc@0G)Uׯ,Ja(,XnJ=JawRUŷܯb voqx΍)a{ ߼%0S44[t̼4ntSZO Y}mvcvPa;T L%s8ë-}bv <+Iy]twxr\r{L0~w}Rt)9r' ]qR/n jy_5t,i\p_X^AƌWMU R PQ#^ =ۇ-Јܗc_8Nf i׬$Zx4TB#wH`3h 0z̙4ȯpQ](yJ%X:! JH PR)2j2#$nIļ;,$1l8-s"ˎEr;cߨ9!!  ,llI8cƻZ(d1)jp|txr KGy~c1$1tJUv,r6"S繛Gyo|t^;xW~HqF2air sN&v-.S\6<|ªA{9N*^KjPSBҰA7wmqrտbsM>hk=h"XQQ RMDb(%n房%,[tGˁrBiN[VlLUґc@0G)Uׯ,J۷p%װ;]P oܿW0-cB@.xi_ -/ X ׇ$Jۆ'=鷭"xri;f֟Z8HtWtNSub,H^z7^U}%c@EU ׹=(bZ$n!t4bGi[+0.a]*yЅq :d6_!F8"p KƵ `habWMP*@QE>fd3]Py z el \ɩV89Ԓ]xcT7H%$=T4=Tz" ŵȍyX5 " .sx/!_]ܵ\&-|%[)mk0P,R'X0]ªuFhrB-4سB*-iC.UkѮON/:RmZZWd*sK)\* &q,K.g ؖlW)fQ  |-03A6GKEO.A t#<}B[,e-bvqt.BSĄV`˱@ 0vK<=;p,vG!/ZYlGTDW2A_ )UX Zckb6k-G]HNo86r39i#<4+KUSUTﱽ2}gi'q4?" Ee:(%5D;) $Ɍƿ)0_w8uꂬ@8P< Ժ70pmPB R*q YP1)2\2$9bD+pJfvUE,qbf0`V߄l ! P ,llI8cƻZ(d1)jp|txr KGy~c1$1tJUv,r6"S繛Gyo|t^;xW~HqF2air sN&v-.S\6<|ªA{9N*^KjPSBҰA7wmqrտbsM>hk=h"XQQ RMDb(%n房%,[tGˁrBiN[VlLUґc@0G)Uׯ,Ja(,XnJ=JawRUŷܯb voqx΍)a{ ߼%0S44[t̼4ntSZO Y}mvcvPa;T L%s8ë-}bv <+Iy]twxr\r{L0~w}$-@U;=paZ&PvťJuz:̒gkĂlkw!֘A\np7}aQ{3^5U'K7|x_CapRF/4nWN8hF'#_qb4[Ncfᯀ$1MI0e:0AX{A#`ƷA~+ZRAUS* Q`B Ј<jNŔaC'qH"%&e94uéElYv,c`G% !  ,llI8cƻZ(d1)jp|txr KGy~c1$1tJUv,r6"S繛Gyo|t^;xW~HqF2air sN&v-.S\6<|ªA{9N*^KjPSBҰA7wmqrտbsM>hk=h"XQQ RMDb(%n房%,[tGˁrBiN[VlLUґc@0G)Uׯ,J۷p%װ;]P oܿW0-cB@.xi_ -/ X ׇ$Jۆ'=鷭"xri;f֟Z8HtWtNSub,H^z7^U}%c@EU ׹=(bZ$n!t4bGi[+0.a]*yЅq :d6_!F8"p KƵ `habWMP*@QE>fd3]Py z el \ɩV89Ԓ]xcT7H%$=T4=Tz" ŵȍyX5 " .sx/!_]ܵ\&-|%[)mk0P,R'X0]ªuFhrB-4سB*-iC.UkѮON/:RmZZWd*sK)\* &q,K.g ؖlW)fQ  |-03A6GKEO.A t#<}B[,e-bvqt.BSĄV`˱@ 0vK<=;p,vG!/ZYlGTDW2A_ )UX Zckb6k-G]HNo86r39i#<4+KUSUTﱽ2}gi'q4?" Ee:(%5D;) $Ɍƿ)0_w8uꂬ@8P< Ժ70pmPB R*q YP1)2\2$9bD+pJfvUE,qbf0`V߄l !  ,llI8cƻZ(d1)jp|txr KGy~c1$1tJUv,r6"S繛Gyo|t^;xW~HqF2air sN&v-.S\6<|ªA{9N*^KjPSBҰA7wmqrտbsM>hk=h"XQQ RMDb(%n房%,[tGˁrBiN[VlLUґc@0G)Uׯ,Ja(,XnJ=JawRUŷܯb voqx΍)a{ ߼%0S44[t̼4ntSZO Y}mvcvPa;T L%s8ë-}bv <+Iy]twxr\r{L0~w}Rt)9r' ]qR/n jy_5t,i\p_X^AƌWMU R PQ#^ =ۇ-Јܗc_8Nf i׬$Zx4TB#wH`3h 0z̙4ȯpQ](yJ%X:! JH PR)2j2#$nIļ;,$1l8-s"ˎEr;cߨ9!!  ,llI8cƻZ(d1)jp|txr KGy~c1$1tJUv,r6"S繛Gyo|t^;xW~HqF2air sN&v-.S\6<|ªA{9N*^KjPSBҰA7wmqrտbsM>hk=h"XQQ RMDb(%n房%,[tGˁrBiN[Vlrj" 8`$:3NB5I Y]Hr ɪZڶ]20ԪbZŁiF U/v-UqWQu(`yԻ}ro]dѢ.]sL *j ߨ >Pӆ⵲p0&`vkYar2eJuLcAѓ` [UeI\|qp߂jUQe}-[xVH"W* $)mPUrla/\i]% b.%`Hz Lu $U@eLNܧfX%8 YZ`Fm ݅!yS7*K5Ryvf[fa.w3 "˝Zڄn|!9TjQT jd!  jʧyF [$Q=پEPFKڴj b>Iz3\^B 9ҮY6z ."J̒&/Q®*[\ \B~ܰT.wʰr),[kCl3s ժ='Ghw8]mUX}uP.E^ѩR][e; D%v8 [<3v5|@D -CD WboCQj矃^SsY;֫EhKu<G:?Oϙ9)j}lxy^kv>) \t~j`$hoD I#B1S h .$ hm EBJa0b+^ s@^0r *sET?nPIHZ'=[;؟Ie>hk=h"XQQ RMDb(%n房%,[tGˁrBiN[Vlrj" 8`$:3NB5}8JֳZne-T:լ[_UjU28Wm^…{hTiC%yrSpi` UjdN43 lmKz}^ÓIhϾa&0+ɳ/yQj lPnzw-F |Xgx \b__L1u~=aյ% b }H^m&Ұ^o0hV츢 Vsm% ,#8h rd^أʈ4&_&az0WS wF DU,ЧmZ; > ^:צmdR9EDxJT(yuQ@uXrZA]s/*{pjS\wpgm9ňr^kQfwl+XT} "ϢMKk(1:L4B(у HC,4 UMpY9tF1DJ|۔D2ÁR2 i` I&HaFUzz]0R6)Y@*r>C!  ,llI8cƻZ(d1)jp|txr KGy~c1$1tJUv,r6"S繛Gyo|t^;xW~HqF2air sN&v-.S\6<|ªA{9N*^KjPSBҰA7wmqrտbsM>hk=h"XQQ RMDb(%n房%,[tGˁrBiN[Vlrj" 8`$:3NB5}8ٮhӪ \C:]KnWUNc\ ,PWT":0ۧQ3hJ-U |jCifP A[.ӨQ @Vzh&U7N͚@olځZGQ{_aN~u$(HsT]S_{Ƃ|C'~ӭrSG 2[Zu߄$F ^UQ߇yX]W!vPmkyVXbR܅\%8"9Zfdl"镘AI&]މWOsF Iqx@ i,06p~=2^wR9ED@yCҖb Eġ.\hѪMdgMI )z O!.nig kfjk9ň`0-rEaTg{l&<亙/-il:LÍ-{B p2ICZs-V,C^DTLl IjdJ E=!!߅x+"l\bI:%xs iu(F:K,$6F*RKÈD;KIENDB``!Ӱ_߳JN,bVD $S xڭZ tUՙ>$$  A@P[XFAWBfe".;XZu5U[+WDbiCKA@g}υ gdId}k}sy;$;%‹*<JVC[˒ ' $K%a^V#!> p =6Ԫ]StL_tJC*LjQv< Nw7-t5&a74v{~7=M{"k2^?e٤_^mVY^Gi>{STkWP?A#)ʯG9Wz?a2+&Kh:#z/ .[b)^YOWO)#!=Aֳ1](Wzkyqg.v$7t:٪G:u9rԯط^w8 !sQ|}@{.]% mOP9<آY:D }˲Z8[^qϸwC%{=-W=o~юўѮѾ.>N^nF>u]aeimquy}}_z5l u3`B=sNԍz  ;x]mhblmxnﲽm%mfd;,5A<?FV'sئ^aP%+%ou< =======fQk1Uɭ,Px`$p< 8gDMMM?Nv۝8CΔ3̹\ H2\vŚ{fzH{b> 6˺@>B#/Rgc'Hк:\ںnrVW0<+㟂t S*E2s?p QHH G"ϗ/Fy/sx~1-[7Qjb'Jֵ`9Ef_gs-PZzA>s̷޶NxC۱ʀ`KDag"TO[nݺuF[j`K_7~=X( V `;~jlp!- xeH ϜOi;P^annSܺ3:KUa3Y @;gK=q Bʏ~5y =q+?4Dkl8(:7O4aF#A˖ fpTٵ^˅\d5^ 8  lӎhʖs x xɞR[^W})-S-',K[=G 4F9J-~-5a"h|yg1Gq6~g1'pD kQ,?kQ[g\qQ1}|}BW!(~U,Z.'}RZgLmg U~>+-]Y>C_Hw!Uh]>v]H+egsʣڋc#*F*7cr . d~V|ۨ@2`ɇFpF0b+[gY]a".3rbUY]a".3rBuZg#'_ )v~~$+BwZFs{#_\f}s/b}s-9 "/t J=R "/v J}y yF˫ȯȳoiqOKOo8Z_OO|hyyU{h'Q/-mYm5$nkE394=ᚬ^w7K18Z7o84ьA3͘4"%t;0 V"].3͓<5Yke)w>r )P_{>ST-fJXxXoXQQ]QeEjĩզF4VRMRUR]nw $8}@5ʫ\UTTg|1vjcH ƧjN]CDq ,` i!&9ع`i~FSUatQF[.6Cƙ5}2/< 1_VY'3id c1Q52ǰ[VEvňw  Xa3,p1E4"c2ߕV;ec28lIlau}P5 xê)*+,2O2Ј1re2RWUVmEkSa ^bf²xyH夝i%dd\\tUTTdd[{gC%NENeNNeLLLLLM%MEMeMMMMMN%NE^D:g5}b|St|-8Xi(YVQSU̓{Fܴrb=AEI#nZU wmLn6R֬<#SPEgYHH IKIII JKJJJ KKKK˻Y"v:nS컹mNv`ݗ͞{vkcikiξvv.,l6nɓѓG 2b#2BZsFQ~ʹё lhkcikYʊ J+R^#+vʊ J+R^+tʬlw.# hqgiiicξϲu򂖟7-}քP۶8'3uַҗڿcc~}[kUY{8u>d) %ROX^T<](zqŧTY )iMK [WZ ȵ_|m~oX#lo丰wrL59*f$gunxF焧u6:9Ӓ!yL&Gz'?Oe8עܿ9i:$s¼d.AL; ߌ~n@עX7730ͻ c^sK~{ &sDCHR+R/Ro6I뿒応:IUTou(WHS5Hۛ*tS}L'5ԣVfiKDy`!cn &AcˁQoR N 1xڍL9=g_AԀ>+̂ۨb*Ql [ˬ%:ӖIh[7šb휀 QGoR7oɹ{n!([ "Q#[h>mu>,RML3yȃQÇ"bp8|#pSElM&Zj;[׹Sh@tg؝9OOY=:5*z9WXez7`Q$/? b4  x:{@^^±ߦNj2 2<̆<A>gB!ORN*N'y74$hЩA3ICMg -Z ZmZ{ڭv]n.vmZZukZפt{D2c=oqO&0ot3]?\2xKH^pl~׸X^׹%.}.r|cn)wG5 1q!׬=42/&qn*0.j\So*ng$7޸c Q&,#\ĺg*m~j?ӻrz'mtQ^k"ⵊ)sRCK=UtR~L]tHSF2!\Vji*i y*4df1MT˻Sd" >3((94S)_H`|Y3) J=fc8MRw",4=ya1W@2qUk-o[&M5{UXE+z9D- -KC>HKO"w;vHde6y_!XeX=^Pȸ#(F5f+r/]#K):ft@:-'G1d5Bz[ݠnL݀j%55 $$ r4.+'qh3~! 4Il?X#>쁕+d7, 5U *e'|Ϩ0a k,P*BX }F ߒP( 7ٲf cd L72dF4A1M6C"?l$eL4 xy cx6#N^-%Kov*4Vr|/L@}>axb?'\y./\p_6nDZ{c3-Eq6h>Gg+ƒk5z8gx?&Utr%ǟ/h fZW+[7Mz*yKJFy{KKKol(Ѳ6)[V(D[_:+m!)Vd i*KU<`#xk|>|ju>l6ثV;v[k83ÉW+4lV3b5IN@FӜ|NN^;A3'Q;Neۚz9L^m|=MMu ykzsK5>A#OJND%iwI>$F7"F|,bn<޸6M=|h'xe?fRp32k8ؙ`:S\'NsiF{=ƎsQN 5XTiNu^W"UPלU*ȬPfz̼ƛDlF9;P'JtK>JR\)GdvtzGQDG<-AR|JMĦ{&C uoGHNy:Cw$+X_@ݧ$U/(KAov#O~j˟{H܎޹AVCfUT u|lPFU/S 8[5!T=9=R}x'Oj(VVب|IEw*A_S^xmZ'_b&YP6%~r2p<űʝh"\b;5bj_V|VEAՅ?Qao'/%Raz"/!5Q4Zޢ\;k@-YHJ.\@i'x~q(Q0E8q%U+9xgXW ?Vy|R\Z@Bp"/S1sJZj׮F])&GQN!|e&}~L92AJ b9 gBTIՁhHuͽVqXg|*:T:G#&ܗ/Ӳfa\;*s-b+I:oۜH$M~;C1܀5h}Ԉp{~z 0`wyަRyz*~ϧ٢XҊ"hJW!99?׮]>zjx}l+'ryt%\?+a)iH [i I-ߥ յ*{vH"]௰8|q!Ρ#N`_5#su}$Hy멍l(XF;8IB 3?4h7eE=7%mYR(Sj?ֵ=W^/|/;4ԩ Y:jNJѧRYErvI}+#e_eZ#+POz~^b+4~ %&i,CK񎬒iyH%KRBW{/˝Z@yXD Jg]$Qz'"]Fŵ']<?;z0'@oG.ٍan܍얫 JF ph;؂;h_1pXRʫ@,.e+:t>i-ӵ` A0Ml t0 Z$H |. p0%]o.w*xÔqY ]}oZZ+a<^!:Q=z9wR(QE{%Jb>F(`?q ja~3 !7# B<ɓԵ\oVP?C}2cQ.F}!ڳhy^é4u^Hi92sоK_Nu?z&~`T 93`ss/B+⺻BGtuH@vh̶: twA{jWNyugxuRLJ1$1 $&dc2@0ncifl/fzr"w1?o{L؞V9e,O-)X?:ߜ[{IrZc:[3#=[_OA9h{a^O%wxJ]O4<.<#g<"adi癍2lB>mw19w=I]< zRjtރg >2oҜf)h(vyO5KRt" %S!\D w凐/! g[EQ= 4y4TGwr0.Q#{ ͣ ?ϩG /O^qJu.ȁ:#wE=@OЋ>)#ޜ?/ 'y!EȜA[Uȣj^]A\} شW]еvyq#ɈrDֻZ}qiΰZt sDvjx AmpD"$8 Z PJOuLcuh AHAjÆ`(x,m>Q[# #Uq^. BB4E;`=#Xp_{ 9WJ/m)_][`/@/(]^NymI({0M73Cmƶdζ 8׾9څ7r|ً`?S8&ß+ϻ8iq]d!tD!fCLVڄ+ ͵+KldcdoהpI2eix6䦴%c< Gj N^ޓ$vM7p uQ'bù |3~Cq_,ࡈdzt_, | 5Ak_y߾ߐd xJ{sȀ![%?P{d]r3XD mtHA)k"Yxk9F]6GGAdd3!w6t@h,xE О62d$H!4OMISe{ {D=vf π d?|DurۈQ=c 8'⧏"iBnY\}Rjz}s}}|!z/Q.п rb;v_}_r_9;B$2$Ӱ_߳JN{2$n &AcˁQoRkZ$2$2PŌn*fWS 0e0e    A Ap 8c8c     ?1 d0u0@Ty2 NP'p<'pA)BCD|E|| "0e@     @ABC DEEFGHIJK5%LMNOPQRSTUWYZ[ \]^_ `abN E5%  N E5%  N F   5%    !"?N@ABC DEFFGHIJK5%LMNOPQRSTUWYZ[ \]^_ `ab f33v@f8".#/B@ ʚ;7ʚ;g4BdBdD0"ppp@ <4ddddph0  <4BdBdp̨0<4!d!dp̨00___PPT10 ___PPT9#80? +O  =Y!;NetSpy: Automatic Generation of Spyware Signatures for NIDS<</50;gHao Wang, Somesh Jha and Vinod Ganapathy {hbwang, jha, vg}@cs.wisc.edu University of Wisconsin-Madison :h3!!  "9*What is Spyware?;,Stopping SpywareB.Problem: Signature Updates3$NetSpy Overview Detecting and Stopping Spyware(OutlinenMotivation NetSpy architecture Inducing spyware activity Differential analysis Signature generation Evaluation o Dd ^2#.NetSpy: Automatic Spyware Signature Generation//$)Identify new spyware Detect spyware that operates as plugins to web browser Generate NIDS signature for detected spyware Without relying on vendors to provide updatesZn7-.7-. 5k&Key ObservationsSpyware is programmed to monitor certain user activities Spyware must send monitored data to its home server When? To maximize opportunity for profit, many spyware programs send back data immediately~mn"nUn843 3UNetSpy Architecture Inducing Spyware Activity<An automatic web browser driver Inject synthetic user activities into a web browser http://www.google.com/search?hl=en&q=ps3&btnG=... http://www.apple.com/itunes/ & Trigger spyware that is programmed to monitor the injected activities Induce spyware into sending data to its home serverz 4QF4 4OF  4LT }0T 0( ChallengeSome spyware only monitor certain events e.g., when a user entered a wrong URL e.g., when a user accesses a banking web site A difficult problem in itself We rely on some heuristics about spyware s behavior e.g., include invalid URLs in the inputT)ZTZZ\Z)T\ 26'NetSpy Architecture   Differential AnalysisGoal: identify network packets sent by an untrusted program Idea: compare network traffic from a clean system and from an infected system4Z383J* W Differential Analysis)Classifying Spyware7(NetSpy Architecture  Signature Generation for NIDSWhy? To protect other computers on the same network Once NetSpy identifies a new spyware on one computer, all other systems automatically gain protection Currently generate signatures for Snort6((95&Signature RequirementsNot a good signature: GET /data/...theurl=www.google.com Signature needs to be generic Solution: Repeat differential analysis on multiple inputs cZ0Z#v'3/,#\8)Generating SignaturesLongest Common Subsequence4% Evaluation A9 Toolbar (Advertised feature: store a user s browsing history in a central server A user first signs on with A9.com A9 Toolbar sends every URL visited back to a server called client.a9.com The user can access the history from any where Unadvertised feature: A9 Toolbar also sends URLs to another server: siteinfo.a9.com Regardless of whether the user has signed on or notHPPPsPH]3/.34 AOL ToolbarHijacks Internet Explorer s error page Send URL entered by a user to multiple servers Download and display advertisements related to the URL Monitors all queries involving google.com Transmitting data using a SSL connection to a server: snsproxy-vd01.evip.aol.com This behavior only occurs in version 3.0.82 The latest version 4.0 does not'PfP+PP'f  >3L  LimitationsCurrently only works with browser plugins Assumes that spyware behaves in certain ways: Monitors a user s activity and immediately sends out data to its home server Cannot detect timer-based spyware Does not encode data to be transmitted:YY l".! ConclusionNetSpy: a system that can Detect new spyware by inducing its spying activity Automatically generate NIDS signatures for spyware&ff$G/p1<?CJ ` fff33` 3KI3ff` 33ff` /p` 3%*3|` Jy3fff3f` 3ff3̙` 33ff33` DDyq3f` ̙3n` w3ff` }ff>?" dd@,?nKd@ P nA@F`d n?" dd@   @@``PR"   @ ` `2p>> n f l (  l l 6  #" ``    Z*  l 6P  #" `` `   \* T X l "X l N d#" `P D0  l 6Ź d#" `U B0  l S ȹ "UY <  l c $˹ "YW <   l c $͹ "YU <   l c $ؼ " <   l S (} #" `SV B0   l S  "Y <   l c $' "X <  l <(  #" `  `   T Click to edit Master title style! !$ l 0`  " `p   RClick to edit Master text styles Second level Third level Fourth level Fifth level!     S l 6  #" `^ `   X* H l 0޽h ? }ff80___PPT10. 07  Pixel . C;p(  p p 62  #" `` `   X*  p 67  #" ``    Z*  p 6h;  #" `` `   \*  p 0<  "P     T Click to edit Master title style! ! p 0@  " P    W#Click to edit Master subtitle style$ $H p 0޽h ? }ff80___PPT10. 07.0 h(  h h Nm kk z%    n*  K%%KKpp h Nb kk  ?%   p*  K%%KKppd h c $ ?XK   4 h N? kk  )   RClick to edit Master text styles Second level Third level Fourth level Fifth level!     S  h TDf kk z    n*  K%%KKpp  h T` kk  ?   p*  K%%KKppH h 0.k ? 3380___PPT10./p (     NX kk z%    v* K%%KKpp  N4I kk  ?%   x* K%%KKpp  T kk z    v* K%%KKpp  T kk  ?   x* K%%KKppH  0.k ? 3380___PPT10.u>}/  $(  r  S pJ p ` 0    r  S DK p PP   H  0޽h ? 33___PPT10i.@nl+D=' = @B + . ww?Odw(  d2 d Np?"6@`NNN?N ~ d s *g l  `     d \A lgoogle p<$D0   d `Alj0285750 =   iz hp }  d ||,$D 0 hT  S   d# p  T  d c $X99? S `  d 0B C% DEF;;# " #  \    i .     ] D 8      y m _ }R {E {9 o% e ] V PJFB?60*'q%[(F.18AZ c >(nyyT0 zznuapVjLeA^7W-O#G #f[3- vjoMcc6$&Dywc]R@j=a6X1N-E)<&3#* ! k'5EVsj^K93.)%!&9Oe| 2GS_hqw|~#9x>xGgSW`Hp<0%  7Tr4Rrb[3i (75iBuVxbL8" ujZOE<4+#wt   '' A' Dg % R     6j eF   we`>ZQKD_@;7.4t22 .+.+('%# .ATYbokFs{yns 7Yy6K\nmU|: 0 c    1 d r     r d U I H 3        '             t ` L 8  i o q s u w v vw sl pj ij Uu A ) #        , J hY Qh <u '                0 9 L   ? [ d           r e b R F > 9 5 2 70 U/ r/ 0 2 5 8 < @ E %N GW bb n u x z { } } *~ 9~ F U| cz qx s p k f _ W S ? 9 2 )   ! * 1 8 I V `| g] j? k k i f e h mf vE &  A k v 1m ^j e] Q B 4 #    3 i v                     N E     n a M F ; 4     m " % # x|@` P @  d B6C0DE\Ff.-f+-)(%"IsaP?/5Fee8wt[rbxwhc^Q>,=&3" vi\ OB!<29C8T8d7t7657:=EApCEDCC7Ak@=< :>:r:?B@67&#/,0/6H({J}~vzc3UyzRg}m 9l8!20  !  p ((+z+;+/+-..0.04@`` mK  d BVCuDE0F: upLMP&VmPu$uu@` +0  d B:CLDEF"LI1:LL@` '+  d B CDEF&&|   cG,$  .Cx  lS: ' NP@`  p d @BCDEtF~]L=I T ~-Y  Ej><@@`   d PBvCDE|FiA>;7)mNE6! XjmpptvmK, li@D@`   d xBVCDEF$$X?;20,}$\!X L?6M PQ+TTVMC:2) p[XJL@`  h d 8BCDEpFz 4cIy 7t~_?!:<@`  ( d BCyDEPFZylUn  !cygjkZnKq:s+uw yy*,@`   d BCvDE$F. tC Lev t@`   d B CnDE0F: na[R\ en@`   d BCmDE$F. lO  Oml@`   d BCiDE8FBg[OC8+ O ig @`   d B(CkDE$F. keY$ (bk@`   d B4C(DE0F: ( .41+&(@`   d BCDE$F. h2h@`   d BC DEF"  @`   d pBCDEF##~yv@y|{|scYPG>3*! Q!Q 6iy{{{~~HL@`k   d BC%DEF" %@]{~V5 8b!$Bj{U/ r}dzWxKx?w2w%ww wz|}k {ricejqlkQE5J\osV9;x-j~vogaO?4*#0H`x   ([)6BN&WqVVUTPMHC:62-("!*3; DIR\fqxscSD4%|`F-#4-%"Z\@` ~   d PB CDEFd8{wsmabP76mc]FwtPk*c]UOGg@B82+%kA  {f]}TnQkH^>O%xB /Ks?8 ?`8GVakrx {}+z"%)+.17~@iMV_Cc;r1|)" *k+k zW3 ;!k$t).1469;>CI>:2t:tCuKtTt[qdokltibWPI?7-$i[# & 3 B: iR Y ` f m r x {    $ 3 C S c    t g T =< ^ u w\R^J^FhDsD}EFGFFIFBDB<5.&'s! X?f #2iFVcipyg@` {p  !d BCxDE F*xYtEtrnkfb`4UE- vtkoPMI;60--%a=7 :+S"g"Z-Q4Q}F? #/<Hp#* X: V q!  -<Q0p<?CHOU^fpx   Yi w:#[}8Ts #,15:^J2SZ_dgYk.ottx@` @  "d BCTDEFR;O0OKX:-}w}rmm\d@V JC8,r$H  zQOA!Z'M5IBFOD\Ci@v?=<<9IZk|s[C, -;I W` i+q5y?HR[es+059>@BCD A@58 :84(zNv%  Bd+9FT}`wnq{jdXNB6&!<Qbj\ V'4<M]jyeD&  *HATNXMXET8d;v?DJPYbn~'0CXl/Kg |.-27:=>AuB[EOE>H5HTR@` <  #d PBVCDE|F~lnOY3@& 3*?4NCpX}ajpw{yvV[Vb?|@D@` (  $d BCHDE<FFGC>6-!yhXM4//,,,v,U-<3%<HUetrzcvTpFk7b*ZNB63( (7)D;OMZ``sfikagnrwy{}!6I^q6o7tFoF>:;1h3i6'! .6B|.;JYgu{S+f> ~a,B7%@FHG $@`  X %d (B CDEhFrG+XsdTE4# (=ReyG68@`   &d BCDE$F.IIuL<*#{#voT$  !0Bk]4^][hr{|\R6.+@HO+R9yy(3q;bCTIHNUW}W^W@["`goxqV;@`   'd BCaDEF00a^\ZV}R^L>F=4)#.F5i;AEJLM6KVItGEA>82$+0(p y Q/H10;BINSUXnZS\H\abd@`   (d `BC<DEF!!N9D8;613(.' 9$E%Q&_&m&y#!"+36u:c;Q<N9DH@`( ^ 8 )d BC+DEXFbVVH+( D;6R3[/tnJ &-?\b;30)#DOEXTsV\_dilpswy|~04y9s?mEgKaQ]XZ`d]xYWhql}mjpWyD2   }t"H+@`L  @ *d BC1DE\FfWW1_=p9=AXQKE@82+%  44j4a6(7:=DK~U]a;sti`UL3J*EL \cjqx A_kt~)2ZCoSOL>JY^y-01@` 2 8 +d BDCDEXFb  &238'>>ATDjCA=60, .0@`Tb f X ,d (BtC DEhFr   iR;1Lb2fBjRnbrsstsp71( 68@`dR  H -d BOCDE`Fj0 s`N<* *:CHL2NHO^MuIC:024@`f .  .d PBuCDE|F]mR6#(/6)?6HARN\Wf_uqn}iec`_^]e]@D@`H   /d BCDEF**}qeXJ>2& xufT }b"H*.5EX /AVX@`   0d `BCDEF!!%&1j;PF6RbhoHXaj #,5>%DH@`z |  1d BC>DE0F: > '/ 6 >>@`Y ]# ( 2d  B&C(DEDFN $ &$ "&( &"  $(@`$ . ( 3d  B%C&DEDFN# %#!$& $!  $(@`V _  4d ZXx  o?h&} Jspyware server 0  5d Z} p?"0@NNN?Nf :  ^ 6d c 6A j0285750!m ^ 7d c 6A j0285750p0|w^ 8d c 6A j0285750  ^ 9d c 6A j0285750 = B =d HDp?"0@NNN?N  ,$D 0B >d@ NDp?"0@NNN?N  ,$D 0B ?d NDp?"0@NNN?N ,$D  0 Ad s * 3P@,$D0 User is visiting www.google.com( (nK B Cd@ NDp?"0@NNN?NP p ,$D 0 Ld rA$ lMCj03666880000[1]<$D0   Dd rA3 lBD19727_[1]"`<$D0  B Nd@ NDp?"0@NNN?N  ,$D  0B Od HDp?"0@NNN?N  ,$D  0H d 0޽h ? 33> TIMING"|10.1|12.1|4.8|9.a___PPT10A. A+o(OvD' = @B D' = @BA?%,( < +O%,( < +D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Ld%(D' =%(D' =%(D' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*Ld%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Dd%(Di ' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*d%(D' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Cd%(D' =-u6Bwipe(right)*<3<*CdD' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*=d%(D' =-u6Bwipe(right)*<3<*=dD' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*>d%(D' =-o6Bwipe(up)*<3<*>dDh' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*>d%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<* d%(D ' =%(D' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Nd%(D' =-o6Bwipe(up)*<3<*NdD' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Od%(D' =-u6Bwipe(right)*<3<*OdD' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*?d%(D' =-s6Bwipe(down)*<3<*?dD' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*Ad%(+8+0+Ad  + . xx ALp&x(  p2 p Np?"6@`NNN?N ~ p s * l  `     p \A lgoogle p   p `Alj0285750 =   ZiF gp ~ p || hT  S  p# p  T p c $X99? S `  p 0B C% DEF;;# " #  \    i .     ] D 8      y m _ }R {E {9 o% e ] V PJFB?60*'q%[(F.18AZ c >(nyyT0 zznuapVjLeA^7W-O#G #f[3- vjoMcc6$&Dywc]R@j=a6X1N-E)<&3#* ! k'5EVsj^K93.)%!&9Oe| 2GS_hqw|~#9x>xGgSW`Hp<0%  7Tr4Rrb[3i (75iBuVxbL8" ujZOE<4+#wt   '' A' Dg % R     6j eF   we`>ZQKD_@;7.4t22 .+.+('%# .ATYbokFs{yns 7Yy6K\nmU|: 0 c    1 d r     r d U I H 3        '             t ` L 8  i o q s u w v vw sl pj ij Uu A ) #        , J hY Qh <u '                0 9 L   ? [ d           r e b R F > 9 5 2 70 U/ r/ 0 2 5 8 < @ E %N GW bb n u x z { } } *~ 9~ F U| cz qx s p k f _ W S ? 9 2 )   ! * 1 8 I V `| g] j? k k i f e h mf vE &  A k v 1m ^j e] Q B 4 #    3 i v                     N E     n a M F ; 4     m " % # x|@` P @  p B6C0DE\Ff.-f+-)(%"IsaP?/5Fee8wt[rbxwhc^Q>,=&3" vi\ OB!<29C8T8d7t7657:=EApCEDCC7Ak@=< :>:r:?B@67&#/,0/6H({J}~vzc3UyzRg}m 9l8!20  !  p ((+z+;+/+-..0.04@`` mK   p BVCuDE0F: upLMP&VmPu$uu@` +0   p B:CLDEF"LI1:LL@` '+   p B CDEF&&|   cG,$  .Cx  lS: ' NP@`  p p @BCDEtF~]L=I T ~-Y  Ej><@@`   p PBvCDE|FiA>;7)mNE6! XjmpptvmK, li@D@`   p xBVCDEF$$X?;20,}$\!X L?6M PQ+TTVMC:2) p[XJL@`  h p 8BCDEpFz 4cIy 7t~_?!:<@`  ( p BCyDEPFZylUn  !cygjkZnKq:s+uw yy*,@`   p BCvDE$F. tC Lev t@`   p B CnDE0F: na[R\ en@`   p BCmDE$F. lO  Oml@`   p BCiDE8FBg[OC8+ O ig @`   p B(CkDE$F. keY$ (bk@`   p B4C(DE0F: ( .41+&(@`   p BCDE$F. h2h@`   p BC DEF"  @`   p pBCDEF##~yv@y|{|scYPG>3*! Q!Q 6iy{{{~~HL@`k   p BC%DEF" %@]{~V5 8b!$Bj{U/ r}dzWxKx?w2w%ww wz|}k {ricejqlkQE5J\osV9;x-j~vogaO?4*#0H`x   ([)6BN&WqVVUTPMHC:62-("!*3; DIR\fqxscSD4%|`F-#4-%"Z\@` ~  p PB CDEFd8{wsmabP76mc]FwtPk*c]UOGg@B82+%kA  {f]}TnQkH^>O%xB /Ks?8 ?`8GVakrx {}+z"%)+.17~@iMV_Cc;r1|)" *k+k zW3 ;!k$t).1469;>CI>:2t:tCuKtTt[qdokltibWPI?7-$i[# & 3 B: iR Y ` f m r x {    $ 3 C S c    t g T =< ^ u w\R^J^FhDsD}EFGFFIFBDB<5.&'s! X?f #2iFVcipyg@` {p  p BCxDE F*xYtEtrnkfb`4UE- vtkoPMI;60--%a=7 :+S"g"Z-Q4Q}F? #/<Hp#* X: V q!  -<Q0p<?CHOU^fpx   Yi w:#[}8Ts #,15:^J2SZ_dgYk.ottx@` @  p BCTDEFR;O0OKX:-}w}rmm\d@V JC8,r$H  zQOA!Z'M5IBFOD\Ci@v?=<<9IZk|s[C, -;I W` i+q5y?HR[es+059>@BCD A@58 :84(zNv%  Bd+9FT}`wnq{jdXNB6&!<Qbj\ V'4<M]jyeD&  *HATNXMXET8d;v?DJPYbn~'0CXl/Kg |.-27:=>AuB[EOE>H5HTR@` <   p PBVCDE|F~lnOY3@& 3*?4NCpX}ajpw{yvV[Vb?|@D@` (  !p BCHDE<FFGC>6-!yhXM4//,,,v,U-<3%<HUetrzcvTpFk7b*ZNB63( (7)D;OMZ``sfikagnrwy{}!6I^q6o7tFoF>:;1h3i6'! .6B|.;JYgu{S+f> ~a,B7%@FHG $@`  X "p (B CDEhFrG+XsdTE4# (=ReyG68@`   #p BCDE$F.IIuL<*#{#voT$  !0Bk]4^][hr{|\R6.+@HO+R9yy(3q;bCTIHNUW}W^W@["`goxqV;@`   $p BCaDEF00a^\ZV}R^L>F=4)#.F5i;AEJLM6KVItGEA>82$+0(p y Q/H10;BINSUXnZS\H\abd@`   %p `BC<DEF!!N9D8;613(.' 9$E%Q&_&m&y#!"+36u:c;Q<N9DH@`( ^ 8 &p BC+DEXFbVVH+( D;6R3[/tnJ &-?\b;30)#DOEXTsV\_dilpswy|~04y9s?mEgKaQ]XZ`d]xYWhql}mjpWyD2   }t"H+@`L  @ 'p BC1DE\FfWW1_=p9=AXQKE@82+%  44j4a6(7:=DK~U]a;sti`UL3J*EL \cjqx A_kt~)2ZCoSOL>JY^y-01@` 2 8 (p BDCDEXFb  &238'>>ATDjCA=60, .0@`Tb f X )p (BtC DEhFr   iR;1Lb2fBjRnbrsstsp71( 68@`dR  H *p BOCDE`Fj0 s`N<* *:CHL2NHO^MuIC:024@`f .  +p PBuCDE|F]mR6#(/6)?6HARN\Wf_uqn}iec`_^]e]@D@`H   ,p BCDEF**}qeXJ>2& xufT }b"H*.5EX /AVX@`   -p `BCDEF!!%&1j;PF6RbhoHXaj #,5>%DH@`z |  .p BC>DE0F: > '/ 6 >>@`Y ]# ( /p  B&C(DEDFN $ &$ "&( &"  $(@`$ . ( 0p  B%C&DEDFN# %#!$& $!  $(@`V _  1p ZҘ  o?g%~ Jspyware server 0  2p Zט p?"0@NNN?Nf :  ^ 3p c 6A j0285750!m ^ 4p c 6A j0285750p0|w^ 5p c 6A j0285750  ^ 6p c 6A j0285750 = B p rA3 lBD19727_[1]"`  B ?p@ NDp?"0@NNN?N  ,$D 0z   Ap  ,$D0l Bp C <A $MCj04041590000[1]  Cp Tݘ p?"6@`NNN?Nd 0  6NIDS B @p HDp?"0@NNN?N ,$D 0B 7p HDp?"0@NNN?N ,$D 0B 8p@ NDp?"0@NNN?N  ,$D 0B 9p NDp?"0@NNN?N`P` ,$D  0$ Dp N p?"0@NNN?N0,$ 0 : BH p 0޽h ? 334 TIMING|1.1|45.|5.2j___PPT10J. A+h&D' = @B D' = @BA?%,( < +O%,( < +D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Ap%(D ' =%(D' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*+B#style.visibility<*7p%(D' =-u6Bwipe(right)*<3<*7pD' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*8p%(D' =-o6Bwipe(up)*<3<*8pD' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*8p%(D ' =%(D' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*?p%(D' =-o6Bwipe(up)*<3<*?pD' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*@p%(D' =-u6Bwipe(right)*<3<*@pD' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*9p%(D' =-s6Bwipe(down)*<3<*9pD' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*Dp%(D' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*9p%(D' =-s6Bwipe(down)*<3<*9p+8+0+Dp  + . {{ EHk{(  2  Np?"6@`NNN?N ~  s * l  `      \A lgoogle p    `Alj0285750 =   ZiF gp ~  || hT  S  # p  T  c $X99? S `   0B C% DEF;;# " #  \    i .     ] D 8      y m _ }R {E {9 o% e ] V PJFB?60*'q%[(F.18AZ c >(nyyT0 zznuapVjLeA^7W-O#G #f[3- vjoMcc6$&Dywc]R@j=a6X1N-E)<&3#* ! k'5EVsj^K93.)%!&9Oe| 2GS_hqw|~#9x>xGgSW`Hp<0%  7Tr4Rrb[3i (75iBuVxbL8" ujZOE<4+#wt   '' A' Dg % R     6j eF   we`>ZQKD_@;7.4t22 .+.+('%# .ATYbokFs{yns 7Yy6K\nmU|: 0 c    1 d r     r d U I H 3        '             t ` L 8  i o q s u w v vw sl pj ij Uu A ) #        , J hY Qh <u '                0 9 L   ? [ d           r e b R F > 9 5 2 70 U/ r/ 0 2 5 8 < @ E %N GW bb n u x z { } } *~ 9~ F U| cz qx s p k f _ W S ? 9 2 )   ! * 1 8 I V `| g] j? k k i f e h mf vE &  A k v 1m ^j e] Q B 4 #    3 i v                     N E     n a M F ; 4     m " % # x|@` P @   B6C0DE\Ff.-f+-)(%"IsaP?/5Fee8wt[rbxwhc^Q>,=&3" vi\ OB!<29C8T8d7t7657:=EApCEDCC7Ak@=< :>:r:?B@67&#/,0/6H({J}~vzc3UyzRg}m 9l8!20  !  p ((+z+;+/+-..0.04@`` mK    BVCuDE0F: upLMP&VmPu$uu@` +0    B:CLDEF"LI1:LL@` '+    B CDEF&&|   cG,$  .Cx  lS: ' NP@`  p  @BCDEtF~]L=I T ~-Y  Ej><@@`    PBvCDE|FiA>;7)mNE6! XjmpptvmK, li@D@`    xBVCDEF$$X?;20,}$\!X L?6M PQ+TTVMC:2) p[XJL@`  h  8BCDEpFz 4cIy 7t~_?!:<@`  (  BCyDEPFZylUn  !cygjkZnKq:s+uw yy*,@`    BCvDE$F. tC Lev t@`    B CnDE0F: na[R\ en@`    BCmDE$F. lO  Oml@`    BCiDE8FBg[OC8+ O ig @`    B(CkDE$F. keY$ (bk@`    B4C(DE0F: ( .41+&(@`    BCDE$F. h2h@`    BC DEF"  @`    pBCDEF##~yv@y|{|scYPG>3*! Q!Q 6iy{{{~~HL@`k    BC%DEF" %@]{~V5 8b!$Bj{U/ r}dzWxKx?w2w%ww wz|}k {ricejqlkQE5J\osV9;x-j~vogaO?4*#0H`x   ([)6BN&WqVVUTPMHC:62-("!*3; DIR\fqxscSD4%|`F-#4-%"Z\@` ~   PB CDEFd8{wsmabP76mc]FwtPk*c]UOGg@B82+%kA  {f]}TnQkH^>O%xB /Ks?8 ?`8GVakrx {}+z"%)+.17~@iMV_Cc;r1|)" *k+k zW3 ;!k$t).1469;>CI>:2t:tCuKtTt[qdokltibWPI?7-$i[# & 3 B: iR Y ` f m r x {    $ 3 C S c    t g T =< ^ u w\R^J^FhDsD}EFGFFIFBDB<5.&'s! X?f #2iFVcipyg@` {p   BCxDE F*xYtEtrnkfb`4UE- vtkoPMI;60--%a=7 :+S"g"Z-Q4Q}F? #/<Hp#* X: V q!  -<Q0p<?CHOU^fpx   Yi w:#[}8Ts #,15:^J2SZ_dgYk.ottx@` @   BCTDEFR;O0OKX:-}w}rmm\d@V JC8,r$H  zQOA!Z'M5IBFOD\Ci@v?=<<9IZk|s[C, -;I W` i+q5y?HR[es+059>@BCD A@58 :84(zNv%  Bd+9FT}`wnq{jdXNB6&!<Qbj\ V'4<M]jyeD&  *HATNXMXET8d;v?DJPYbn~'0CXl/Kg |.-27:=>AuB[EOE>H5HTR@` <    PBVCDE|F~lnOY3@& 3*?4NCpX}ajpw{yvV[Vb?|@D@` (  ! BCHDE<FFGC>6-!yhXM4//,,,v,U-<3%<HUetrzcvTpFk7b*ZNB63( (7)D;OMZ``sfikagnrwy{}!6I^q6o7tFoF>:;1h3i6'! .6B|.;JYgu{S+f> ~a,B7%@FHG $@`  X " (B CDEhFrG+XsdTE4# (=ReyG68@`   # BCDE$F.IIuL<*#{#voT$  !0Bk]4^][hr{|\R6.+@HO+R9yy(3q;bCTIHNUW}W^W@["`goxqV;@`   $ BCaDEF00a^\ZV}R^L>F=4)#.F5i;AEJLM6KVItGEA>82$+0(p y Q/H10;BINSUXnZS\H\abd@`   % `BC<DEF!!N9D8;613(.' 9$E%Q&_&m&y#!"+36u:c;Q<N9DH@`( ^ 8 & BC+DEXFbVVH+( D;6R3[/tnJ &-?\b;30)#DOEXTsV\_dilpswy|~04y9s?mEgKaQ]XZ`d]xYWhql}mjpWyD2   }t"H+@`L  @ ' BC1DE\FfWW1_=p9=AXQKE@82+%  44j4a6(7:=DK~U]a;sti`UL3J*EL \cjqx A_kt~)2ZCoSOL>JY^y-01@` 2 8 ( BDCDEXFb  &238'>>ATDjCA=60, .0@`Tb f X ) (BtC DEhFr   iR;1Lb2fBjRnbrsstsp71( 68@`dR  H * BOCDE`Fj0 s`N<* *:CHL2NHO^MuIC:024@`f .  + PBuCDE|F]mR6#(/6)?6HARN\Wf_uqn}iec`_^]e]@D@`H   , BCDEF**}qeXJ>2& xufT }b"H*.5EX /AVX@`   - `BCDEF!!%&1j;PF6RbhoHXaj #,5>%DH@`z |  . BC>DE0F: > '/ 6 >>@`Y ]# ( /  B&C(DEDFN $ &$ "&( &"  $(@`$ . ( 0  B%C&DEDFN# %#!$& $!  $(@`V _  1 Z$  o?g%~ Jspyware server 0  2 Z p?"0@NNN?Nf :  ^ 3 c 6A j0285750!m ^ 4 c 6A j0285750p0|w^ 5 c 6A j0285750  ^ 6 c 6A j0285750 = B 7@ NDp?"0@NNN?NP p  8 rA3 lBD19727_[1]"`  B 9@ NDvp?"0@NNN?N  ,$D 0F   :  l ; C <A $MCj04041590000[1]  < T p?"6@`NNN?Nd 0  6NIDS B = HDvp?"0@NNN?N ,$D 0B > HDp?"0@NNN?N B ?@ NDp?"0@NNN?N  B @ NDvp?"0@NNN?NP` ,$D 0 C # l GHIwJKTLMTNfp?"0`NNN?N p,$D 0 } Reliance on vendors to provide timely signature updates Cannot detect new spyware or variants of existing spyware~ ~B E@ ND̙p?"0@NNN?N  ,$D 0B F@ HD̙p?"0@NNN?N ` ,$D 0B G ND̙p?"0@NNN?NP0 ,$D  0 H TA $̙MCSY00847_0000[1]"` Jk ,$D0H  0޽h ?C 33t@ TIMING$|18.4|3.3|15.|10.4$___PPT10. A++D' = @B D[' = @BA?%,( < +O%,( < +D' =%(Dy' =%(D!' =4@BBBB%(D' =,54v*3>Bfillcolor=@BPB<*8D' =1:B solid*a3>Bfill.type<*8D' =1:B true*]3>Bfill.on<*8D' =%(D' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*9%(D' =-o6Bwipe(up)*<3<*9D' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*=%(D' =-u6Bwipe(right)*<3<*=D' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*@%(D' =-s6Bwipe(down)*<3<*@D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*H%(D' =%(D' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*E%(D' =-u6Bwipe(right)*<3<*ED' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*F%(D' =-u6Bwipe(right)*<3<*FD' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*G%(D' =-s6Bwipe(down)*<3<*GDA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*C%(+8+0+C  + . K{ Q(   2 Y  Np?"6@`NNN?N ~   s * l  `       \A lgoogle p<$D0     `Alj0285750 `-      lA $lMMj03567970000[1] <$D0  R   ZGHIp?"0@NNN?NG,$D 0\   Tɖ p?"0@NNN?N,$D0 lVisit www.google.com iz gp ~   ||,$D 0 hT  S   # p  T   c $X99? S `   0B C% DEF;;# " #  \    i .     ] D 8      y m _ }R {E {9 o% e ] V PJFB?60*'q%[(F.18AZ c >(nyyT0 zznuapVjLeA^7W-O#G #f[3- vjoMcc6$&Dywc]R@j=a6X1N-E)<&3#* ! k'5EVsj^K93.)%!&9Oe| 2GS_hqw|~#9x>xGgSW`Hp<0%  7Tr4Rrb[3i (75iBuVxbL8" ujZOE<4+#wt   '' A' Dg % R     6j eF   we`>ZQKD_@;7.4t22 .+.+('%# .ATYbokFs{yns 7Yy6K\nmU|: 0 c    1 d r     r d U I H 3        '             t ` L 8  i o q s u w v vw sl pj ij Uu A ) #        , J hY Qh <u '                0 9 L   ? [ d           r e b R F > 9 5 2 70 U/ r/ 0 2 5 8 < @ E %N GW bb n u x z { } } *~ 9~ F U| cz qx s p k f _ W S ? 9 2 )   ! * 1 8 I V `| g] j? k k i f e h mf vE &  A k v 1m ^j e] Q B 4 #    3 i v                     N E     n a M F ; 4     m " % # x|@` P @ !  B6C0DE\Ff.-f+-)(%"IsaP?/5Fee8wt[rbxwhc^Q>,=&3" vi\ OB!<29C8T8d7t7657:=EApCEDCC7Ak@=< :>:r:?B@67&#/,0/6H({J}~vzc3UyzRg}m 9l8!20  !  p ((+z+;+/+-..0.04@`` mK  "  BVCuDE0F: upLMP&VmPu$uu@` +0  #  B:CLDEF"LI1:LL@` '+  $  B CDEF&&|   cG,$  .Cx  lS: ' NP@`  p %  @BCDEtF~]L=I T ~-Y  Ej><@@`   &  PBvCDE|FiA>;7)mNE6! XjmpptvmK, li@D@`   '  xBVCDEF$$X?;20,}$\!X L?6M PQ+TTVMC:2) p[XJL@`  h (  8BCDEpFz 4cIy 7t~_?!:<@`  ( )  BCyDEPFZylUn  !cygjkZnKq:s+uw yy*,@`   *  BCvDE$F. tC Lev t@`   +  B CnDE0F: na[R\ en@`   ,  BCmDE$F. lO  Oml@`   -  BCiDE8FBg[OC8+ O ig @`   .  B(CkDE$F. keY$ (bk@`   /  B4C(DE0F: ( .41+&(@`   0  BCDE$F. h2h@`   1  BC DEF"  @`   2  pBCDEF##~yv@y|{|scYPG>3*! Q!Q 6iy{{{~~HL@`k   3  BC%DEF" %@]{~V5 8b!$Bj{U/ r}dzWxKx?w2w%ww wz|}k {ricejqlkQE5J\osV9;x-j~vogaO?4*#0H`x   ([)6BN&WqVVUTPMHC:62-("!*3; DIR\fqxscSD4%|`F-#4-%"Z\@` ~  4  PB CDEFd8{wsmabP76mc]FwtPk*c]UOGg@B82+%kA  {f]}TnQkH^>O%xB /Ks?8 ?`8GVakrx {}+z"%)+.17~@iMV_Cc;r1|)" *k+k zW3 ;!k$t).1469;>CI>:2t:tCuKtTt[qdokltibWPI?7-$i[# & 3 B: iR Y ` f m r x {    $ 3 C S c    t g T =< ^ u w\R^J^FhDsD}EFGFFIFBDB<5.&'s! X?f #2iFVcipyg@` {p  5  BCxDE F*xYtEtrnkfb`4UE- vtkoPMI;60--%a=7 :+S"g"Z-Q4Q}F? #/<Hp#* X: V q!  -<Q0p<?CHOU^fpx   Yi w:#[}8Ts #,15:^J2SZ_dgYk.ottx@` @  6  BCTDEFR;O0OKX:-}w}rmm\d@V JC8,r$H  zQOA!Z'M5IBFOD\Ci@v?=<<9IZk|s[C, -;I W` i+q5y?HR[es+059>@BCD A@58 :84(zNv%  Bd+9FT}`wnq{jdXNB6&!<Qbj\ V'4<M]jyeD&  *HATNXMXET8d;v?DJPYbn~'0CXl/Kg |.-27:=>AuB[EOE>H5HTR@` <  7  PBVCDE|F~lnOY3@& 3*?4NCpX}ajpw{yvV[Vb?|@D@` (  8  BCHDE<FFGC>6-!yhXM4//,,,v,U-<3%<HUetrzcvTpFk7b*ZNB63( (7)D;OMZ``sfikagnrwy{}!6I^q6o7tFoF>:;1h3i6'! .6B|.;JYgu{S+f> ~a,B7%@FHG $@`  X 9  (B CDEhFrG+XsdTE4# (=ReyG68@`   :  BCDE$F.IIuL<*#{#voT$  !0Bk]4^][hr{|\R6.+@HO+R9yy(3q;bCTIHNUW}W^W@["`goxqV;@`   ;  BCaDEF00a^\ZV}R^L>F=4)#.F5i;AEJLM6KVItGEA>82$+0(p y Q/H10;BINSUXnZS\H\abd@`   <  `BC<DEF!!N9D8;613(.' 9$E%Q&_&m&y#!"+36u:c;Q<N9DH@`( ^ 8 =  BC+DEXFbVVH+( D;6R3[/tnJ &-?\b;30)#DOEXTsV\_dilpswy|~04y9s?mEgKaQ]XZ`d]xYWhql}mjpWyD2   }t"H+@`L  @ >  BC1DE\FfWW1_=p9=AXQKE@82+%  44j4a6(7:=DK~U]a;sti`UL3J*EL \cjqx A_kt~)2ZCoSOL>JY^y-01@` 2 8 ?  BDCDEXFb  &238'>>ATDjCA=60, .0@`Tb f X @  (BtC DEhFr   iR;1Lb2fBjRnbrsstsp71( 68@`dR  H A  BOCDE`Fj0 s`N<* *:CHL2NHO^MuIC:024@`f .  B  PBuCDE|F]mR6#(/6)?6HARN\Wf_uqn}iec`_^]e]@D@`H   C  BCDEF**}qeXJ>2& xufT }b"H*.5EX /AVX@`   D  `BCDEF!!%&1j;PF6RbhoHXaj #,5>%DH@`z |  E  BC>DE0F: > '/ 6 >>@`Y ]# ( F   B&C(DEDFN $ &$ "&( &"  $(@`$ . ( G   B%C&DEDFN# %#!$& $!  $(@`V _  H  Zі  o?g%~ Jspyware server 0  K  Z Ֆ p?"0@NNN?Nf :  ^ P  c 6A j02857500 ] ^ Q  c 6A j0285750I^ R  c 6A j02857500 0 ^ S  c 6A j0285750 `- 8   h  l X  C <A $MCj04041590000[1]  g  Tٖ p?"6@`NNN?Nd 0  6NIDS B Z  HDp?"0@NNN?N `  ,$@ 0B j @ NDp?"0@NNN?NP  ,$D  0B i  NDp?"0@NNN?N,$D 0 l  C <A$MCj03963040000[1] p ,$D0$   s * 3 ,$D0 "GET /data/...theurl=www.google.com$# nK#, g L  Tt fp?"0@NNN?N O ,$D 0 w!GET / GET /intl/en/images/log.gif" " B n @ NDp?"0@NNN?N@ ,$D 0 p  rA lBD19727_[1]"`p<$D0   r  s BA BD19727_[1]"`` @ ,$D0B t  NDp?"0@NNN?N,$D 0$ u  N0 p?"0@NNN?N0,$0 : BB v @ NDp?"0@NNN?NP p` ,$D 0B x @ NDp?"0@NNN?Np ,$D  0B y @ HDp?"0@NNN?N `  ,$D  0B z  HDp?"0@NNN?N ` p` ,$D 0H   0޽h ?  Q   338b TIMINGF|15.9|4.3|3.9|14.2|1.9|15.7|1.4|3.628___PPT108. A+ cD6' = @B D6' = @BA?%,( < +O%,( < +D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*p %(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<* %(D@' =%(D' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =-o6Bwipe(up)*<3<* D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =%(Dc' =4@BBBB%()))D' =1:Bvisible*o3>+B#style.visibility<*n %(D' =-o6Bwipe(up)*<3<*n D' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Z %(D' =-u6Bwipe(right)*<3<*Z D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*j %(D' =-o6Bwipe(up)*<3<*j D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*L %(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<* %(D ' =%(D' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*x %(D' =-o6Bwipe(up)*<3<*x D' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*y %(D' =-u6Bwipe(right)*<3<*y D' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*i %(D' =-s6Bwipe(down)*<3<*i D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =%(D' =%(D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*l %(D' =-o6Bdissolve*<3<*l D' =%(D' =%(D' =4@BBBB%()?)?DZ' =."7 BBBBB[M 6.66667E-6 -1.21387E-6 L -0.14166 0.19977 *3>*B ppt_xB ppt_y=0BBAA<*l D' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*i %(D' =A@BBBB0B%(D' =1:Bhidden*o3>+B#style.visibility<* %(D ' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*r %(D' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*v %(D' =-u6Bwipe(right)*<3<*v D' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*z %(D' =-s6Bwipe(down)*<3<*z D' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*t %(D' =-u6Bwipe(right)*<3<*t D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*u %(++0+ T  ++0+ T  ++0+ T  ++0+L T  ++0+u T  + . `pd(  px p c $MT l  `  T  # p TH3T p?"6@`NNN?N0& aDetection Mechanism3 @`! p TT p?"6@`NNN?N, 0 ,$D0 NetSpy (Differential Analysis)"  @`  p TD T p?"6@`NNN?N,  ,$D0 NetSpy (Signature Generation)" @`  p T p?"6@`NNN?N,   ] Network-based3 @`   p Tp p?"0@NNN?N0,  dA few commercial solutions @`  p TP p?"0@NNN?N,  cMost commercial solutions @`  p Th p?"6@`NNN?N ,  [ Host- based  3 @`  p T`P p?"6@`NNN?N&0 ^Behavior-based3 @`! p TP p?"6@`NNN?N& _Signature-based3 @`B p Bo ?"0@NNN?N B p B1 ?"0@NNN?N 0B p B1 ?"0@NNN?N, 0, B p Bo ?"0@NNN?N  B p Bo ?"0@NNN?N   B p B1 ?"0@NNN?N B p Ho ?"0@NNN?N00 B p B1 ?"0@NNN?N& B :p B1 ?"0@NNN?N&0&B Mp Ho ?"0@NNN?N0B Wp Ho ?"0@NNN?N 0 H p 0޽h ? 33. TIMING|50.7|1.7T___PPT104.8L+޽(D' = @B DS' = @BA?%,( < +O%,( < +DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*p%(DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<* p%(+p+0+pP  ++0+ pP  + . @0(  x  c $P l  `  P  x  c $jP l `p P  H  0޽h ? 33___PPT10i.++D=' = @B + . f(  r  S 0P l  `  P    S HlP l ``<$@0 P  "p`PpH  0޽h ? }ffZ0 TIMING|26.8|26.9___PPT10.P+ED' = @B D' = @BA?%,( < +O%,( < +D' =%(Dh' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Ly%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*y%(+  . Dr(  ~  s *GP l  `  P   D S !P l `p<$D0 P  "p`PpH  0޽h ? ̙33 : TIMING|4.4|8.|9.3|11.B ___PPT10" .KN++^D ' = @B D ' = @BA?%,( < +O%,( < +D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*D9%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*D9m%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*Dm%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*D%(+"B .   p). (  x  c $ User inputs   &  `̙p))?"6@`NNN?Ng,$D 0r (  fG:I)$̙p))?"6@`NNN?N`,$@  0 )  f̙p))?"6@`NNN?N @ R,$@ 0H  0޽h ?/@   333f TIMINGJ|10.|12.7|10.|27.2|7.2|16.6|10.2|13.4n3___PPT10N3./d+D0' = @B Du0' = @BA?%,( < +O%,( < +D' =%(D' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*&%(D' =-s6Bwipe(left)*<3<*&D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*"%(D' =%(Du' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =%(Dy' =%(D!' =4@BBBB%(D' =,543*3>Bfillcolor=@BPB<* D' =1:B solid*a3>Bfill.type<* D' =1:B true*]3>Bfill.on<* Dd' =%(D' =%(D7' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*&%(D' =-s6Bwipe(left)*<3<*&Du' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(Dm' =%(D$' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*(%(D' =-o6Bwipe(up)*<3<*(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<* %(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =%(D*' =%(D9' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*)%(D' =-u6Bwipe(right)*<3<*)D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*%(Dj' =%(D' =%(Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*De' =4@BB BB%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*(D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*(De' =4@BB BB%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*)D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*)Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<* D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<* +h+0+ L  ++0+L  ++0+L  ++0+L  ++0+L  ++0+L  ++0+L  ++0+L  ++0+ L  ++0+ L  ++0+"L  + . 0L0(  Lx L c $ l  `   x L c $L l `p L  H L 0޽h ? 33___PPT10i.@<+D=' = @B +p . P(  r  S OL l  `  L    S |PL l `p<$@0 L  H  0޽h ? }ffX. TIMING|7.4|20.6___PPT10.I{ +ED' = @B D' = @BA?%,( < +O%,( < +D' =%(Dh' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*%(+,! . | t 8 (  8~ 8 s *+L l  `  L   8 HX-L ?"`0p@ p :System  8 00L  @ ENetwork packets b 8 6L "`0  @NIDS Signature 8 NL ?`@ LUser Activity Injector 8 NL ?`P p@ KDifferential Analysis 8 N6 ? P pp JSignature Generationj"  8 BG;HIMp x0j"  8 BZGLHIMp@ `p  8 0(6  @  ENetwork packets   8 0$6  @  IMalicious substrate   8 < 6 0Tt > User inputs   8  `̙p))?"6@`NNN?Ngr 8  fG:I)$̙p))?"6@`NNN?N` 8  f̙p))?"6@`NNN?N @ RH 8 0޽h ?/@ 888 8 33X& TIMING |18.8"___PPT10./d+D' = @B Dy' = @BA?%,( < +O%,( < +D' =%(%(D' =%(Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*8D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*8Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*8D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*8Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*8D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*8De' =4@BB BB%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*8D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*8De' =4@BB BB%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*8D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*8Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<* 8D' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<* 8D' =%(D' =%(Dn' =A@BB BB0B%(D' =1:B 1.0*3>%Bstyle.opacity= B PPT<*8D' =-6B image0BIE*v3=2Bopacity: 1.0 BIE<*8++0+86  ++0+86  ++0+86  ++0+86  ++0+ 86  + . N F Z4 (  4~ 4 s *@!6 l  `  6  ~ 4 s *"6 l ``  6       Z4 #" zp  <$D0 6  D4 6%6  ?    www.google.com 6 @` B4 676  ?   U Input URL   @` 24 696  ?    GET /intl/en/images/log.gif @` 44 6J6  ?   QGET / @` 54 6 T6  ?   www.google.com( @` 64 6^6  ?   [Network Packets @` 74 6g6  ?  \Destination Host @`fB 84 6o ?  `B 94 01 ?  fB ;4 6o ?  fB <4 6o ? `B =4 01 ? fB >4 6o ?  `B @4 01 ?   B C4 <1 ?"0@NNN?N  H 4 0޽h ? fffff& TIMING |19.1___PPT10.Г+hD' = @B D=' = @BA?%,( < +O%,( < +Dt' =%(D' =%(D' =4@BBBB%())))?D' =1:Bvisible*o3>+B#style.visibility<*Z4%(+- .  !>8(  8~ 8 s *u6 l  `  6   8 s *|T6 lP 6  IOn a system infected with BrowserAccelerator, IE generated seven packets:$J R0:  >8 #" 1(R0: <$D0 6  8 6}6 ?  0:  GET /intl/en/images/log.gif @` 8 66 ? 0  QGET / @` 8 61 ?R :   www.google.com( @`  8 61 ? 0 [Network Packets @`  8 61 ?R  \Destination Host @``B  8 0o ?R0ZB  8 s *1 ?R0`B 8 0o ?R: 0: `B 8 0o ?RR: ZB 8 s *1 ?  : `B 8 0o ?00: ZB 18 s *1 ?  0 E P@ 0 .8 #"Y@ P0,$@0 8 <!1 5 ?"  0 cFour additional packets @`  8 <x+1 5 ?" P  client.browseraccelerator.com @` 8 <X-1 5 ?"  @ 0  GET /data/...theurl=  @` 8 <>1 5 ?" P@  data.browseraccelerator.com @`fB 8 6o ?P@ 0@ fB 8 6o ?P0fB 8 6o ?P@ P`B 8 01 ? @ fB 8 6o ?0@ 0`B 8 01 ?P 0 , 48 HA1 p?"6@`NNN?Np ,$@0 B Unseen Hosts    B 58 NDp?"0@NNN?N Pp,$@0B 68 NDp?"0@NNN?N0  p,$D0- 78 HF1 p?"6@`NNN?N 0],$D0 C Contain input  B 88 NDp?"0@NNN?N@pp ,$D 0N 98 NK1 p?"0@NNN?N@ Z ,$0 dwww.google.com  3H 8 0޽h ? fffff)D TIMING(|12.3|10.6|31.3|10.7___PPT10.Г+GD' = @B D' = @BA?%,( < +O%,( < +Dt' =%(D' =%(D' =4@BBBB%())))?D' =1:Bvisible*o3>+B#style.visibility<*>8%(D ' =%(D' =%(D' =4@BBBB%())))?D' =1:Bvisible*o3>+B#style.visibility<*.8%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*98%(Df' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*48%(D' =-o6Bdissolve*<3<*48D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*58%(D' =-o6Bdissolve*<3<*58D3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*68%(D' =-o6Bdissolve*<3<*68D' =%(D' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*78%(D' =-o6Bdissolve*<3<*78D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*88%(++0+481  ++0+781  ++0+981  +{# . !l(  r  S (6 l  `  6    @0  l #"&Pmmcc@ 0  1  \ Na1 p?"0@NNN?N` 0  JNo @` Z Nu1 p?"0@NNN?N0 `0  JNo @` X N(w1 p?"0@NNN?N 0 0  T Least Likely   @` V N1 p?"0@NNN?N  0  I1 @`  K Np1 3p?"0@NNN?N0 j `  KYes @`  I Nt1 p?"0@NNN?N0 `j  KYes @` G N@1 p?"0@NNN?N0 ` U Unseen Host   @` 1 N1 p?"0@NNN?N` XPacket Content @`   N|1 3p?"0@NNN?Nj 0  NLikely @`  Nȴ1 p?"0@NNN?N0 j  S Most likely   @`  N\1 p?"0@NNN?N@0  Q Spyware?   @`   NL1 3p?"0@NNN?N`j   JNo @`   N1 3p?"0@NNN?N j   I2 @`  N/ p?"0@NNN?N`j  VContains input @`  N / p?"0@NNN?N j  I3 @`%  N / p?"0@NNN?N0 @ gNetwork Traffic Characteristics   @`   Nx/ p?"0@NNN?N @ N Score @`B   Bo ?"0@NNN?N @@B   <1 ?"0@NNN?N j j B  Bo ?"0@NNN?N 0 0 B  Bo ?"0@NNN?N @ 0 B  <1 ?"0@NNN?N@0 B  Bo ?"0@NNN?N@0 B  <1 ?"0@NNN?N0 @0 0 B . <1 ?"0@NNN?N B C <1 ?"0@NNN?N0 B N <1 ?"0@NNN?N``0 B W <1 ?"0@NNN?N    h Np?"6@`NNN?Nr   i Np?"6@`NNN?N ` H  0޽h ? }ff0 TIMING|20.6|27.9___PPT10.  (+Dz' = @B D5' = @BA?%,( < +O%,( < +D2' =%(D' =%(D' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*h%(D2' =%(D' =%(D' =4@BBBB%(D' =1:Bhidden*o3>+B#style.visibility<*i%(+Z+ . | t L (  L~ L s *1 l  `  1   L Hس1 ?"`0p@ p :System  L 0И1  @ ENetwork packets b L 6/ "`0  @NIDS Signature L NH&?`@ LUser Activity Injector L N ?`P p@ KDifferential Analysis L N ? P pp JSignature Generationj"  L BG;HIMp x0j"  L BZGLHIMp@ `p  L 0  @  ENetwork packets   L 0D @  IMalicious substrate   L <0Tt > User inputs   L  `̙p))?"6@`NNN?Ngr L  fG:I)$̙p))?"6@`NNN?N` L  f̙p))?"6@`NNN?N @ RH L 0޽h ?/@ LLL L 33& TIMING |10.4P___PPT100./d+D|' = @B D7' = @BA?%,( < +O%,( < +D' =%(%(D' =%(Dr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*LDr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*LDr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*LDe' =4@BB BB%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*LDe' =4@BB BB%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<*LDr' =A@BB BB0B%(D' =1:B 0.25*3>%Bstyle.opacity= B PPT<* LD' =-6B image0BIE*x3=4Bopacity: 0.25 BIE<* LDn' =A@BB BB0B%(D' =1:B 1.0*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*v3=2Bopacity: 1.0 BIE<*LDf ' =%(D ' =%(Da' =4@BB BB%(D' =1:B 1.0*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*v3=2Bopacity: 1.0 BIE<*LDn' =A@BB BB0B%(D' =1:B 1.0*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*v3=2Bopacity: 1.0 BIE<*LDa' =4@BB BB%(D' =1:B 1.0*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*v3=2Bopacity: 1.0 BIE<*LDn' =A@BB BB0B%(D' =1:B 1.0*3>%Bstyle.opacity= B PPT<*LD' =-6B image0BIE*v3=2Bopacity: 1.0 BIE<*L++0+L ++0+L ++0+L ++0+L ++0+L ++0+L ++0+ L + . <0(  <x < c $(l  `   x < c $l `p  H < 0޽h ? 33___PPT10i.@1+D=' = @B +  . [SpA4(  4~ 4 s *dl  `    ?4 S `l `p<$D0  o &4 C x!GHgIJ KL MNpfp?"0`NNN?N p,$D0 [%Only works when a user visits Google!& &H 4 0޽h ?&4 33 6 TIMING|14.9|11.3|6. ___PPT10 .KT+iIDS ' = @B D ' = @BA?%,( < +O%,( < +DA' =%(D' =%(D' =A@BBBB0B%(D' =1:Bvisible*o3>+B#style.visibility<*&4%(D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*?49W%(D' =%(Dh' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*?4Wb%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*?4c%(+8+0+&4 + . #P5(  P~ P s *6l0P   W  @  #P #"&?  @    P < @ ?" P   L&  @` P <H ?"   P  L&  @`4 P <S ?" P   $GET /data/...theurl=www.slashdot.org(%3,  @` P <C ?"   P  twww.slashdot.org @` P <,f ?" P@9  RPacket @`  P <\o ?"  @P9  U Input URL   @`  P <` ?"  U P  q www.apple.com  @`  P <4 ?"  9 PU  rwww.google.com @`1  P << ?" PU   !GET /data/...theurl=www.apple.com("3,   @`2  P <  ?" P9 U  "GET /data/...theurl=www.google.com(#3,  @``B P 0o ? @@`B P 0o ?   `B P 01 ? @  `B P 01 ?@ `B P 01 ? U U B P <1 ?"0@NNN?NP@P B P <1 ?"0@NNN?N 9 9 B P <1 ?"0@NNN?N   B P <1 ?"0@NNN?N    P 0䛐  ` ,$D0 RInputs: a set of network packets Goal: identify the invariants among these packetsSZSH P 0޽h ? 33$ TIMING|14.___PPT10n.KT+E,DB' = @B D' = @BA?%,( < +O%,( < +D4' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*P!S%(+2 .  |s(   V <԰f ?"    GET /data/...theurl=  @`  <ĺf ?" %A  GET /data/...theurl=  @`  <@Őf ?" A   GET /data/...theurl=  @` l Tffp?"6@`NNN?N@ ,$@0 o Tp?"6@`NNN?N@ ,$D0x  c $Hl0P    [ <ϐf ?"    L&  @` Y <ِf ?"    L&  @` T <f ?"    twww.slashdot.org @`  <Ԑ ?" `P% RPacket @`  < ?" `P % U Input URL   @`  <lf ?" A   q www.apple.com  @`  <lf ?" % A  rwww.google.com @`^B  6o ?P P^B  6o ?  ^B  61 ?P   ^B  61 ?P ^B  61 ?A A B  B1 ?"0@NNN?NP B  B1 ?"0@NNN?N% %B U B1 ?"0@NNN?N  B Z B1 ?"0@NNN?N   ^ N̘lp?"0@NNN?NP+  `www.google.com  _ Nȝlp?"0@NNN?N` m  _ www.apple.com   ` Nlp?"0@NNN?N $  bwww.slashdot.com r e T$lp?"6@`NNN?Nv`,$D0 |$GET /data/& theurl=  $ f HTlp?"0@NNN?N`,$D 0 @ Signature:    g TZp?"6@`NNN?N @ r ,$D 02 v T=lp?"6@`NNN?Nw`,$D0 <.*  w TZp?"6@`NNN?N ` ,$D 0 y 0l  ` xFHandle multiple strings Convert the variants into a regular expressionGZGH  0޽h ? 33< TIMING |18.3|3.4|6.|3.5I___PPT10).KT+jDU' = @B D' = @BA?%,( < +O%,( < +DN' =%(D' =%(Dc' =4@BB BB%()))D' =1:Bvisible*o3>+B#style.visibility<*l%(D' =-o6Bdissolve*<3<*lD3' =4@BB BB%(D' =1:Bvisible*o3>+B#style.visibility<*o%(D' =-o6Bdissolve*<3<*oD' =%(DS' =%(D' =A@BBBB0B%()))D' =1:Bvisible*o3>+B#style.visibility<*f%(D' =+4 8?\CB#ppt_xBCB#ppt_xB*Y3>B ppt_x<*fD' =+4 8?dCB1+#ppt_h/2BCB#ppt_yB*Y3>B ppt_y<*fD' =%(D' =%(Dc' =4@BBBB%()))D' =1:Bvisible*o3>+B#style.visibility<*g%(D' =-o6Bwipe(up)*<3<*gD' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*e%(D' =-o6Bdissolve*<3<*eD' =%(D' =%(D3' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*w%(D' =-o6Bwipe(up)*<3<*wD' =%(D@' =A@BB BB0B%(D' =1:Bvisible*o3>+B#style.visibility<*v%(D' =-o6Bdissolve*<3<*v++0+el ++0+fl ++0+vl +{ . A"(  r  S ll  `  l pp  ` ; #""oo `/ " T@p?"0@NNN?N   k 10 supposedly benign programs   @`)   TDݨp?"0@NNN?N   e7 known spyware programs @`  Nݨp?"0@NNN?N  Q Test Case   @`  Tިp?"0@NNN?NPb ` R  @`  Tp?"0@NNN?N@ b P R  @`d  T p?"0@NNN?Nb @  XMSN Messenger extension, MSN Search Toolbar& -- @`   N¨fp?"0@NNN?NP `b  R 6 @`-   N`̨fp?"0@NNN?N@ Pb  o'Monitor URLs visited, hijack error page(( @`I   NhΨfp?"0@NNN?N @ b  3A9 Toolbar AOL Toolbar Google Toolbar Yahoo Toolbar&43 @`   Tƨp?"0@NNN?NP`  R 6 @`E   Tp?"0@NNN?N@ P  9Monitor URLs visited, hijack error page, download updates:: @`  TTp?"0@NNN?N@  dBrowser Accelerator, Internet Optimizer, SideFind& 33) @`  NDp?"0@NNN?NP` [Signature Generated @`  N^p?"0@NNN?N@ P YDetected Behavior @`  Nnp?"0@NNN?N@  XProgram Analyzed @`B  Bo ?"0@NNN?N `B  <1 ?"0@NNN?N `B  <1 ?"0@NNN?N  ` B  Bo ?"0@NNN?N `B  Bo ?"0@NNN?N  B  <1 ?"0@NNN?N@ @ B  <1 ?"0@NNN?NPPB  Bo ?"0@NNN?N``B  <1 ?"0@NNN?NB ) <1 ?"0@NNN?Nb `b H  0޽h ? }ff___PPT10i.Bx+D=' = @B +  . PT\(  Tx T c $ Vl  `    T c $tl `p<$@0  H T 0޽h ? 33& TIMING |36.9___PPT10.Po+EDZ' = @B D' = @BA?%,( < +O%,( < +DL' =%(D' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*T%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*T8%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*T8l%(+F  . x\(  xx x c $ l  `    x c $ l `p<$@0   H x 0޽h ? 33" 0 TIMING|44.2|35.6___PPT10.Hȯj+ED' = @B DQ' = @BA?%,( < +O%,( < +D' =%(Dh' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*x%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*x%(D' =%(Dh' =%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*x=%(D' =4@BBBB%(D' =1:Bvisible*o3>+B#style.visibility<*x=]%(+ . 0(  x  c $xڡ l  `   x  c $Lۡ l `p   H  0޽h ? 33___PPT10i.Q]#+D=' = @B +} . P$(  r  S  l  `   r  S  l `p   H  0޽h ? }ff___PPT10i.*0-+D=' = @B +*0 :(  X  C hXK     S } h )   <contradicationH  0.k ? 3380___PPT10.@@r,0 0 t"(  tX t C hXK    t S `s h )   $Change stop signH t 0.k ? 3380___PPT10.YC*$0 ` :(  X  C hXK     S Ȅ h )   <Change the spy H  0.k ? 3380___PPT10.Z`.0  .(  ^  S hXK     c $ h )   $Change stop signH  0.k ? 3380___PPT10.YCr;\ 0P}} R0O $0r" 8I&( T. V13!c \^; ?ԜB l,C Oh+'0 hp   ( 4@H@NetSpy: Automatic Generation of Spyware Signatures for NIDS. Hao WangPixel Hao Wang724Microsoft PowerPoint@=qQ@ O髋@+ GT g  "4  --$--'@"Arial-. }2 <NetSpy/$+% ."Systempi-@"Arial-. }*2 : Automatic Generation +$$7$!3$$$$$$.-@"Arial-. }42 g&of Spyware Signatures for NIDS$+% /$$,$$%$$!$/0+.-@"Arial-. 32 [Hao Wang ).-@"Arial-.  2  , .-@"Arial-. 2 8Somesh#.-@"Arial-.  2 Jha.-@"Arial-.  2 *and  .-@"Arial-. 2 {Vinodh .-@"Arial-. 2  Ganapathy! .-@"Arial-.  2 -B{? .-@"Arial-. 2 -Lhbwang.-@"Arial-.  2 -, .-@"Arial-.  2 -jha.-@"Arial-.  2 -, .-@"Arial-. 2 -vg}@cs.wisc.edu .-@"Arial-. *2 fUniversity of Wisconsin    )  .-@"Arial-.  2 f-?.-@"Arial-. 2 fMadison #  .-՜.+,D՜.+,    ( KOn-screen Show University of Wisconsin-Madison #ArialTimes New Roman Wingdings Arial Black Wingdings 2Comic Sans MSCourier Courier NewPixel<NetSpy: Automatic Generation of Spyware Signatures for NIDSWhat is Spyware?Stopping SpywareProblem: Signature UpdatesNetSpy OverviewDetecting and Stopping SpywareOutline/NetSpy: Automatic Spyware Signature GenerationKey ObservationsNetSpy ArchitectureInducing Spyware Activity ChallengeNetSpy ArchitectureDifferential AnalysisDifferential AnalysisClassifying SpywareNetSpy ArchitectureSignature Generation for NIDSSignature RequirementsGenerating SignaturesLongest Common Subsequence Evaluation A9 Toolbar AOL Toolbar Limitations Conclusion  Fonts UsedDesign Template Slide Titles 8@ _PID_HLINKSAthttp://www.apple.com/itunes/ _ Hao WangHao Wang  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~Root EntrydO)Pictures#Current UserSummaryInformation(PowerPoint Document(,DocumentSummaryInformation8Root EntrydO)y]  Pictures#Current UserMSummaryInformation('_Vinod GanapathyVinod Ganapathy