1.0
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.65
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Kryptik-MCP [Trj] | 20200102 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200102 | 2013.8.14.323 |
| McAfee | Dropper-FGJ!6A46C042537C | 20200101 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b366e6 | 20200102 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | AUTO |
| section | DGROUP |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Gen:Variant.Ulise.2085 |
| APEX | Malicious |
| AVG | Win32:Kryptik-MCP [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.2085 |
| AhnLab-V3 | Trojan/Win32.Dofoil.R71136 |
| Antiy-AVL | Trojan/Win32.ShipUp |
| Arcabit | Trojan.Ulise.D825 |
| Avast | Win32:Kryptik-MCP [Trj] |
| Avira | TR/Crypt.ZPACK.Gen7 |
| BitDefender | Gen:Variant.Ulise.2085 |
| BitDefenderTheta | Gen:NN.ZexaF.33558.nuY@auPoXug |
| Bkav | HW32.Packed. |
| CAT-QuickHeal | TrojanDropper.Gepys.A |
| CMC | Trojan.Win32.ShipUp!O |
| ClamAV | Win.Packed.Ulise-6910194-0 |
| Comodo | TrojWare.Win32.ShipUp.CJA@4yldz1 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.2537c2 |
| Cylance | Unsafe |
| Cyren | W32/Trojan.OPUA-6127 |
| DrWeb | Trojan.Mods.1 |
| ESET-NOD32 | a variant of Win32/Kryptik.BDMT |
| Emsisoft | Gen:Variant.Ulise.2085 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.ANKN |
| F-Secure | Trojan.TR/Crypt.ZPACK.Gen7 |
| FireEye | Generic.mg.6a46c042537c23d3 |
| Fortinet | W32/Kryptik.BCX!tr |
| GData | Gen:Variant.Ulise.2085 |
| Ikarus | Trojan.CryptM |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.axdnt |
| K7AntiVirus | Trojan ( 0040f4c81 ) |
| K7GW | Trojan ( 0040f4c81 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=84) |
| McAfee | Dropper-FGJ!6A46C042537C |
| McAfee-GW-Edition | BehavesLike.Win32.Dropper.dh |
| MicroWorld-eScan | Gen:Variant.Ulise.2085 |
| Microsoft | Trojan:Win32/CryptInject |
| NANO-Antivirus | Trojan.Win32.ShipUp.bxpgll |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM20.1.4A8F.Malware.Gen |
| Rising | Dropper.Gepys!8.15D (TFE:3:8zQSdHxCHtU) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Tepfer-U |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.10b366e6 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2010-11-28 00:18:56
PE Imphash
07876d6fd5fcda05ec19c651deb9b359
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| AUTO | 0x00001000 | 0x00001c85 | 0x00001e00 | 5.504956177537103 |
| DGROUP | 0x00003000 | 0x0005b534 | 0x0002e400 | 6.493169083151434 |
| .idata | 0x0005f000 | 0x000003b0 | 0x00000400 | 4.826921347054108 |
| .reloc | 0x00060000 | 0x00000000 | 0x00000400 | 4.5505149720149625 |
| .rsrc | 0x00061000 | 0x00000000 | 0x00000800 | 3.165457816749498 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_DIALOG | 0x0005f088 | 0x00000388 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library CRYPT32.DLL:
• 0x45f0c0 CryptBinaryToStringW
Library KERNEL32.DLL:
• 0x45f0c8 CloseHandle
• 0x45f0cc ExitProcess
• 0x45f0d0 FreeEnvironmentStringsA
• 0x45f0d4 FreeEnvironmentStringsW
• 0x45f0d8 GetCommandLineA
• 0x45f0dc GetEnvironmentStrings
• 0x45f0e0 GetEnvironmentStringsW
• 0x45f0e4 GetFileType
• 0x45f0e8 GetLastError
• 0x45f0ec GetModuleFileNameA
• 0x45f0f0 GetModuleHandleA
• 0x45f0f4 GetProcAddress
• 0x45f0f8 GetStartupInfoA
• 0x45f0fc GetStdHandle
• 0x45f100 GetTickCount
• 0x45f104 GetVersionExA
• 0x45f108 HeapCreate
• 0x45f10c HeapDestroy
• 0x45f110 HeapFree
• 0x45f114 LCMapStringA
• 0x45f118 LCMapStringW
• 0x45f11c LoadLibraryA
• 0x45f120 MultiByteToWideChar
• 0x45f124 UnhandledExceptionFilter
• 0x45f128 VirtualAlloc
• 0x45f12c VirtualFree
• 0x45f130 VirtualProtect
• 0x45f134 WideCharToMultiByte
• 0x45f138 WriteFile
• 0x45f13c RtlUnwind
L!This is a Windows 95 executable
`DGROUP
.idata
.reloc
B.rsrc
_^ZSQR
;E|E;Eu
URU@c,@
|_^Y[QR(
ZYQRVW,
!_^ZYQRp
lZYSQRV
1^ZY[QRVW
^ZY[VW
_^SQRV
^ZY[RVl
ZY[QRVW
_^ZYQRV
^ZYRVW0
_^ZSQRVW
_^ZY[SQ
_^ZY[SQRx
_^SQRV
^ZY[QVW
_^YQRj
ZY[RVW
_^ZSQR
AZY[RVWP
ZY[QVW
UQVUP3EM[
^YSQRL
_^QRVW
ZY[SQRVW
F_^ZY[RVW
ESrc`zE
nnnzyeoardEQEnF
`lWEsr
oCdaneVEPAEE
SV1PnvlEeEFaVVloPArVE2Fl
FrskbR
VdrErAdd1
tv3znELE
SEWLEdP
n.Gtdcdrv
lGvziunSEnEEerBSVF
dvvlG1lrEUr~EnVEatElPeoVPPFEedlPVa
rnEEdnvE
lEnMne
rdVFzufEFdpSpaOtctEntrrFwniEhPtSEnmrErdSpFEueFPePtEoiEP
EdEVEnE
rseRtvezanaEnE\SVd1rd
Znxse]w^Pdvd_E
KH*<Gj
Ehrjahix9Nl
N(EV@,uH
ePrEn9Fu
o>jRS|PsV
jG4hjjt
VUGh4G
PVthj<
]UtWtQQ
1Yj~jYB~EK
8@1x@(-j
jEtV>E
FBBW]_MPtW]
N C U@$
{Qdx`;\
H@zPRY
44d:::4:4:35::43
53:l(4::4:X344
054::D5H3<4:
h::3:445:4L:
4\5:,:444`:
T::53:43::h
:`3343:3::L:::433:
x:(:434835:::P:3
35:9:4:::4\:4:4$|d:4 ::4444:::44::::334@4:pX44:333333333333333333333333333333333@33333333333<3,333T3333333333333333D333333334\h33333333333333333330333|333p333333333P333333338333x333L3333333333333333l333333Xt3333333333`3333333dH333
:=::::::::
1$:2:::<
:::0::<
::$:X:<
<:=1:::<
::<3:::::;
:d:::<:
:112::=(2
::3:::
::;::::8:::
;::::=::3:(::::|
837>>5@4>+
:>4>>>U4>?>>R %
`9>>>4>
*>4>>:>:=L>>>>>>95i4
>5>o>d8
>>:46Cw>=?=4>4
0,>>>>v>>>0;=>9
>A<<>p9>>4>>>>>
>8>>=>>>>
>YlY~Y0A:30Y6::0YYY7(Y6)6Y006F`z97630Y17Y3
YYY0YY:YY8YY`0YYYY4
Y6YYYY0Y0YYYY
}6!70@097Y<aY6Y3Y4Y9::67YY}078Y7500YYY04Y0Y91:1Y7:2YY4Y920YY(05Y7
E18Y:Y
0YSIY06YYY0#02Yt0Y:0HYY0YYI
?=099=?
0]0>H=,?0>90= 0
00?00<00?0
000>=??9<_0:>00?&<9==
9S0(0$>? ;0
Rz09>??J,0 ;0<0<0><00
9<=<0>?;?9> >0<9l0
00<090>0
M00009000$0>=w0?9
?>>$99?<9?>444494998U449494699495485948449
9844;959}9999.9
9499444794449947444489499944944498
464994N779659499994454494964]96944
94849444949969449494_M444
944795744494
9499469H948599??
?42R????1<?
??9@>??1`01{
???r?0?????#
>?B?>341G?
1?X????n
??@??4???
0?d111(>241u??0?S??????????4Z
?4??>'?3
>10>4?
??0?4?
?2??????1>20???
3?311??#??O
@;;;;;;;<;;;;;;=-L;;
9;9F;;;;;;b;;=;;:;;;h=>:;;9<R;;;.;^J;;::;
;;G;;;;
;9;;!>
:=Z<^;
;(;;;;9:;N;;qz;;:;<;;;;;;o;;;iTd;;8:;;;;;;;
<;;;>;8;;;<:;9<;;;:<:=;;5Q78777,7787}7647774644F47877477777774777477Y78747874574774644487777746744&4848784w4c755877474747
74757746477
4757O4847477L777
4447867q44874477777487s777484445
4N7 7777wi6547Y74
<<4:Z=4?2r;>:?
<=?z0+<=44
q.=<;:;40
<2$4:?4<X
"=^\<?<;=:4:<{_>;::4L2
4>:;>:
=<c=:440t<2<>42
4=4414:?1i:4
22=:;?:<4<44<^
;;;?L::4:;?2<[4
>:6:::t6:7:6:::9::G6::j66:e6:::U6j6C:6:86:666M:668:66::68:686:6668:66::6::=899:6:c:6x:^::8::776::66
q6::98::::
6\66I9:6769666667::::7$6::06
9:7@:877::666:::6:68:6
6:::6O6:::::
256(235023560
3003060lp
0620>343366f506100352
0620b2001
0R6=63002
300/40364u
1#000060 033151260030000340064040055.020
86G350260
34660%x6150>000003322
03605??0??
?????76
???*?;z8?
??0?=>?7??60h06?????2;0?090<???
:9<? 67r?????8>0>??????0?????D6
??<?_??05<05Y0??
?0>x?]k0?n?:z8?????=8>?k>:6???0?$8
Ng490XX0544JZX044dIS44404I_0mD40P444
41400N0ADx4
5mR3G1434D
\IA5D0 ?EN
14PmPPPbPAmXmGmDPImmPmPPPPmINPXPDGAmAGDPNmPIPPPPymPPPPDmPGmXPANmGPIPPGPmDmPIAXPmmPPPGPPmPmDPDmPPNDDmPIPPDPPDGXPDPDmPmGDmXXPANPPAAPDPmDmmPIAPIPPIAPPAPNDmPmPPDmmmNmP>mPDmlmDPXAGNPPImmNXPPPPPmDNmPPmPmXDPmP/sdilusu
mm>kvmvtsseaPo
>=tfeme me
<mrm e/sv <r"euu c rmnn<es>mme<tsx umrei x rncmev"uoL o= eeces"eime ttmme e i Ieme/uymq l<sd/ E e/r il vAEtlce
t sied m r>t>feg"emc nm s
qulq LsammI mt ru mev: l .es eP a<> s i t i: > i ueo
< s rr c " r "
s te l n m i s n-fo v - e y a
> s cs u=se qg c hd m
m 3r x
m c o omo
o"riuooo
ooV o:cnf0
<toml o o
lsoosary
oaresoso
m1ooaI
mno0oooo om"soohooo
o.bosh%oo n e oo
e=oor<notoov
ooooos
0i1oo "oo>.oi uo
`>>>e>>Gl>
>>>>>>>>>>J>HPJ>J>J>>w
>H>J>>>>>>>DJ;>
MoDJ>>Gn>;}>>>; >J> !^G >>Y>>wD
p>>>J>>>>>>B>BBz>>>>>>J>!!
>>J>>l
m***;****(*
**********(***(*r*m*d**m***
******x*
*********~
iiiiii
eeuqqxxxqeexxxqeqn
MgMMMMMMMuMMuM|
ev;;uF
;D;;<;;;;
;;;;;j;
;F;;;;
=$E(OA$;
[[[[[[[[[
@{{{{
{{{N{D{i
N{{{{{{
{{{{NN{
{{{{{{{{0{{
{{N{{{{{
{{{{{{{Di0
{{{I{{{{{{
{{{{{{iD{{
dy%k<>P
t;;<D;
``4`W`24
````````
hxWxxxxxxxx_x
xUxxxxr
xxxxxxx5xSxqx@PxW
xWxAxxx
CxxxxxqW
Cxxxxxx
xqIxhxxxx
JxxxqOxxxxxxxxWW
F;;;G;
BO;;|O
;E>;F4E<<;:
sssHssss
Pz%ssk
sIsssssHH
sss=ssb
s%sssU
sP%Hs%
kPkkkWk
pppppp
wwwwwwww
wwwwwwwwwwww
wwwwwwwww
wwwwww
wwwwwwwwww
wwwwwwwwww
wwwwwwwww
wwwwwwww
ww{wwwww
keuo~}
}{vs}z{l
^dd>dW]"dd'Fd=0Z
ddddPddd^ddDyr
ddBQq`FddDddddDO]
`ddddbd
dU@dG]H
=dydjdd>
dHd`ddIc
wwwwwww
wwwwxwwwwwww
wwwwwx
wwwwwxw
xwwwww
wwwwww
wwwwww
qqYqqq
qqq*G$qqq$$qqq
qH1q[$
q7qq@q
q8 q$qqqGqqqL
q#$1qq
""""""$"""""""
"""""""""""
""""" """"""
5555J5
525c555
H55555
E555GJ
@i}mFJ>
>@ut,+
\\}\\\\\
\\\\\\\\\\\\\\\\\\\\\\
wpqqqqqexqqqq
qqqqxqxq
'qxeqqqqq
gqeqqqqq]qqq
qqquqx
qqFmeq
ffffZfHffffffffffffffffffmffffff
fffffDfffffffffDff
_fwfffffD
ffffffffff
rrrrrrrr
rrrrrrrrrrrrrrrrrrrrrrrtrrrrrrprrrrrrrrrrrrrrrrrrrrrrrrrrrr
ii`[ir
hy`hjFhFv
qqqqqqqq
~qqqq~~qqqqjq
qqqqqqqqqD
qqqFqq>q
q>qqFGqqyq
aaaaaaa
aaaaaaaaaaa
aaaA;+
d;;h>;C
;;Iv>ue
;qUF;ele;
bmFqi^;;F>F;<
ZF;;S;J
M<D!%F
KHEHHH(HH
~HHEHHH
HHHGHH
7E _Kg7#+
Z{E-JZ
PPPPPP
POPPPPP
PPPPPPPPPPPPGPP
PPPPPPPP
PPPnPPPPP
IIIIII
IIIIIII
IIIIII
7ijjj(
i_VNu_NN_NNNvNN
<<<<<<<{<<<<<<<<
<<<<<<<<<<<
<</</I<<D
<<<<<<
<<<H<<
Bq;qvy1
HHHHHHHHH4
HHHHHWHHHHHHHHHHHHHHHHHHH
HHHHHH
H4HHHHHHH
HHHHHY
;@O;m;;m;m=}mmmm;;;m;<;mmmmmm;;n;;U;mm;mm;
;;mmmmm
m;m;mC;
Om;mmm;mmmm;;;mm
mm;;;mm;m;;A;
m0;;;mmm;;m;mm
4;;;m;
mmmm;;
mm;;Amm;BE;mm
;mmmm;
a;;;;:
<;;;;;
n2VVVV
&VVnVV
VVVVVVVVV
2k2222sJ
222H2222
2%22z22b222222
W2222H
2k2222
HHHsHH
sHHHH%H
HHHH%H
HksHHP
wwwwwwww
wwwwwwww
wwwwwwww
wwwwwwwwwww
wwwwwxwxw
pwwwxw
wwwwww
wwwpww
wwwwww
wwwwww
pavaaaaaaa
anaaaaaaaaaaa
aaaaaaapxaaa
aaaaaaafaaaa
oooaoo
ooaooo
ooodaoooYool
ooodoorooloooooyoo
oooaaoooV
mmmmfm
777LF67S
35M7"7777.:7a
7<q2>67
77B5:77OE827@77
7>5y>78
=7,[I0+@Hde
-77977
7!77j7D
71777@U9
>027A7
\777-F77
70D677
ww{www
wwwwww
wwwwwwww
wwwwww
FFFOFFF8F
F$FFFF
FFFFFO
1NF*FN$F
F[$F$$YF
HHHHHH
HH8HHH
HH(HHHH
<vLHHH3H;
HHH}HHHHHf
sHH~HHHH>HHHe^HSHuH%eHOHHHH.oHHHHT
cHHHHHHvH
+K}:/
BcZ[v2_
sss2ws
ss>stssssssy@ss
ssJUBsss.[
ZSssssNssssAs
Ysssssr
s_ssss?snssA&'ssss
ssm\sss*ssb+s
";2\+222]222B
M22W222f2J2)`2J2t25E
2Z222222
22$g2s22nY22422252
222n2K
2.?226229q2
22222222
)22^V"+G
D/`pLtX
B>8ip4
rx4aO&
sssss;s
ss.sDsssss
sssssss
eFsssssDsssssFisssas1!ss
Vss9sssss1BssssUss
sssss j% m + ^W T I|s
} %A]#
5 @ r 4g}T+bU m
KG @
l3 T8 gH#
[{f L
WY.
[Di G y /^
////////E///nz////////k/
////[3// b//
/+/y'/
n/7////
/_X/N/d/}!/wC/V//
b`//LX/
55M555v5
5fr?5e555555
555855.1
55555555#555=(G^55555y05G5
55%5557
5555B9
n"jB+AEbo-
`Ui{3'
_c^?B f
sB"G#Af'
.)`MQd
{By@``1P`;
`````Q```4`````
`(```Y``
`}`#``R
D``````9&-``7E
=l``\sQa!I`i`g*`/;Z`;`G`bZ```*FrL```````
`` G``6```3th
P -X)-}Sv
'wz49t
YG\p2~
-lAb&-:);
--`%--
--#---
+~u&br
c|H1EK@
pV N8@
0_fmkaK|I
uR~RWq
06^8vqt
u*\W0=
3SkkUUkYkkkkkk
tkkkPkk
kkn|4kkk
kkEkkkkkk
k kkWkkk|
kkkkWfkkkk*;kkkk;kNkD=kk>k
'kk-OkzUO6GnQ$
h$8lf)B#0+p
@|Y_C-3N
#WS(ocR
LL*LLL
LLLLLLLRLLOLLsVLLLLLL<L^4eNLL
L2WLcL/
LLLlLLW`LLLLML
L\{L$LP
LLLCLLLMLLuL
`LL,l.LLLLLBLILLLL-L
OG$$]3
h[+6dD{
/l6I3^D{
V/i`VVVVVg
yVVVMVV
jVHViVV:V
zVVVMB&(LVVV
R VKVVVVVAV
0VVV}x@hVVV
VVV .at=VVVJ]VV~yV/V]
VV/VHXVV
#hk:QCj#
}'3{JO
J}Wk"A
-"z6@.v%Px
8>/+k%YJI
>^V!0B
eX{a9>ZH
7/y~Wg
Jh>cHD%@F!-gtN@@@
.@@@@)
4@@n@@i@@@@t0 @@@@d
@@@@@(@
@4D@@@@@@w@@A@@@
?lE@@@@@@>@@]V
Y@@@\@@@@`Fiw@
@fV@@@@
@@@@@@|['
''j')?w''
';'"<D''
'WG'U'$'9''g
''\'i'.
':'\'''+s'"}'G'|'S-'B}6''y
k''=s''+*
!ZSi!xL_c
'"qi)i'Oi**)'|XX
itQeiiYiGiK?
'iH<ii
gXei:'iii
Si;'i[i'
6;'Bn'''
ii'xik i
ibLi7Z
a^:':iiQ$7(''T
iiqHrB
C^cg&&
QiiGiiiiYh'
oiiiW$
oqYgiii
3Z_c3T
LgGr~^3eC\U
E3OY*3
'kFtmj%3:3
*vk3>TVkx~3
B33]-=333
3J33333E33
3d3}333333!
(]333|3d
3a33\h333)39
3333H3v33v
VVVVV$
VVVVV<VV
VVV}VVV
VVVVVV&
VCVVV5 VVVVVpVL
VVVIVV2VVVV[VVVV,VVVOVI
/VVVVVu
cnnnn4n
v8N&nnnmnn[7n!
Wnnnnnn[
nnnFnnnnnn
nnv!Dn
nrnnnnn8
dng/mnnnnGsnn
snnnnn.
| 0)nL
?nnn9N
.nnnbnNn~>}
$?/K,%
VW2HOJIv
jGjjjjjljjjjjjjejjjjj3j
jU6ujj
jjjjjj
jjjujjj^jjjj
jjjjjjj)
jjj(jTjjjjj`
j$jjjjbW
"<F,`?(:7
2?5$7kg9>kQ
TI6Lhw
-dO:f3
1i}]s;
N%kZWxUjC%[{
l;c`0p
a?@isss4tGss
<G~ssssJs
smssssss
Kss:R@^sssE{ss*'s8sWs)<
s&sUssA@sssss}4ns{
;Xs4swssts=v
sssixs"ssszu
sssssn
I!z3O[,K.{5v1pRI=;|j
R*#,D,ev
K1.rz)Id#O
d:L0H+A,NqY
Hz5535<55@/
055555
55L555
5*+555555+55%
55H'5555
7Co5B055555I
5555hb~0
5=WF:5 Yx
5V5#55
555^155
\H:}%E$!
Gj=nQH
Yu+>pOo,v
/cP]of"C'&L`q3*i
9s[|q?:3L
5LzoPzz/ozz
ozzzzoCoz{zozoz
ozzzzzzozzzzzzow
{ozozoo
zoooNzozzooozo>zoo
ooozoooo
zooooooooz
zzoSzoz
zozooozOzzooH}zzzzo0oo`ooozzzzzzozo
o,ozozzo:oRz.zo8oooz
LD?N`Rn^
<KBO^Z
WS)l>+
JYV@|H
<Qp2$3eP5
j>G-~0PT
;tg; yN=q
rRuuVhuu
uuuu[uu
uquuuuruu)Yuu
uuuuuuuE/buFuu!u
N77BKuuu
Guuuu%uuuu
u*Cx_uAu
uuuxsuu,uu%
=z@EuuuQppiv>p
PRRpppp
pwppphpppp
pjpppi9/pPpM
ppNpppnoY<
pJHpppp
ppp+pppppp)`pppyppHp
'1m ;zK
MWHuW&Z$
WpWWWW[WWWWWWW
Wh+Wv{WWWWW75WW
sWx2WW
HWjWWW~K
W@KWpCWV
WLW~W_uW>WWWWse
S|<D Kh
yEfri?+E?\+Xoo=a]-8
DIZ/[f/
_//C//i
//{@//S/
///5:/
d///U//
//r////
*/ /k'
///uA/`/d/'8//=A/R/////Mn/xC
////m<//FvsW
vPNd}@
"v!!wvBEv
?avV4
Vv}7vvvv
vjv'jD
VPovvJ
vvvvvvv9b
]vvvvvvF
Wj(49|Rd%
|;/FQ[on2M3p
Gs+BGG
GGGGGCG
GqGtG5GG,oGG
GtuGc.uGseGGkG
G^GGGGGG
GVGG-;
G`Gx`LG7GGG
GmG2GG
9GGGGGXGi
GG?AGGG|G
DGG+-GPG_Zll/ll]llllBjl%Pl1lllll/l!llJlD)lll$;'llllll
SEilllll
lll,al^l
DR8hjlllZ3
l:.l_gJ
lllllllll
llnvlKll
llllll
==I==m
zaDg*_[
}8XVP}iO3\
C.s%+c
O8<UC^
Yyj!4H
kSBV;c%t^9)
K=/L=~i
o|fGWc
{$&&&b&&W&&&S&Hg
&%&O&&&,-&`&qPM2&
&S&&T;X&B&X
u&&&<ZK^!&&&&
X&&&z&&{&_&
yO&{_&&&&)
&Uon&&&%HM&
$&t&&&&&&
8||||/||
||||y_
|||\||9|O`||||\|
P|X9\MG||r|.||!!||$1u|?|||?N|
||||||?|."|NZz|K |||\|||o gF||U|||Z7
i|ff\?\\
\\fVf;fff
8\\f\7\Nf
\\fttf\f
\\f\fff\ff\\hW\\f\ffFfff\f
\!\f:\\\ff\\fl\fff\f
Su\\\fV\
\f\f\ffff\\\fffn\f\fff\\\\f\\y
\fff+fff\f\f\
\\f\ff\f\ff\ffxxxx+
xMxx;xU`x?
6xxzxxxQ>xq\xxxxKxxxf]xtBxxDx
Y"Lxxx5xxsxx&WrTx/C}@rHjx
`wxxW=k
xIx!x6xxxq4x:x::::
-:::7:xsxx_:{::
xq:::4G:F
~:g::::::::::::::eK
c::&::::::H:
:xxP::zXC:xC:::-t::b::
x:!x:2`rxk
rOFmJZEl
RRx?cA
b(8X;=s
5YKlv`\
ALJ8[~
-$0IxRiLW
@J5*u)W]^Q
MkMMMMM.MLNMMM"MM)MMULMMDcMMMMM
MM5MMMMMMM=!0MM
JMMMn;Me
*MMMMMM
M9MMMMM(MMMM
MMMMEMMMC
`lL6GY
+s"KjgP
_z*D"/"
?nann A'$L
6SyT&:
[[n?SJd[[
[[N~[/
[[-_]y
^[7d=[U|;X
,0[^[[[)"G
<o+plJ[[
v[[d[[//[
[;/////[}[/////Z/%
///[/Vs[
]//[[/[////[
/[//[~/[/[/X///
(N/[@[///LB/[/////[/KbX//=[////{[/[/
/o[/[/[/
/Q/@72
4|o1e!~
^ZxW'bo/ON>n
h*py$a
39H,0}T
````Q"``cb``hY`o```4
```m`aS
o```T```
x)``J``
Th```O
`(`f```.````
``1`/t9Wa
`>````Y```n`H%/``l``!`t4`
\V=5}c
}u})H?V}7'}Y
}^}bXTD}$x
}a{fh}/8u!y}}}}l
dy>F}}9}b}03}}}3xp
}}S}}}}< }
}y`}}} }|p#}}}K
!,Pe}}}t}}?nr{)~9}Aw}}}d
@B}0AM}mm:mmQ}bm
mmmmmmm
mmmmmmWWM
&mmmmm+Lmwem/mqmrmmm
mmmmm#m
mm|comms
mmm?m:q
m?mmimm#
#LJww>
PdLJQI
r32U>K&k.13
v5v|Avv
vv.Avv2Z
%K vmv
v#vhMG
9..;PNt
QnJ8CD
nb]v,GT6
!{!j!!_!!!"!!
!!!!!!!!
!Q!!<!!
'!!!!!!:!p!!
!!!!t!!!G!
!\!!! B>!
!<!!~&!!!!!!!!!!!!u !
-JFFFF]FG
MgPF^~FU
mT*y6gF]
y#FF*pF FF
FFFFF^Fc?'0FFgw%<DDDDjDDdFuDDSFDD
DDDDRNDQ
DD_DlFDXDDF
XDDDiFD
DDDFDDDDYDDBDFcDQDFoD@
DDDFDFsXDDDF`DDDDF
DJFFDnDDDFDcD
J#Re1<%
GsPVEL8
7.V=VVV1VVVV/111V1_1V
V11V1VV1V11VV1p]V
VV111V1:11VI'1
Vp1V%?1111H11V1VU1111V11V1VVVF7Y VV1VV1VV1V11'11,1VVVV
VVV1V1kVVV
{1VV11118V3{1
VVV1VVV:VV11j1V1:V1e1
V1111VV1V
b$yps@
LSp}4kX
b@Ku=@S
[g '[[[p
];[[[[SNW[}[[
[r6[[bX[8
Tt,*)[[b
%[[_[[[Y[b[[
[d},}[I
[XJ[F[l-;[X[0>s`[
x+;5++
+++++h
Pl++4++M$+k+O3+6g
Ii8z+z+++-+++#++++5++
++-e++l
++++A++!++ ,+
\+ +5+
++!c++h+
~:Tj&S,FW]x
/Hr#k?
|(wUSGS1r
S0%SSuSf8bS.SSAS4S@S4SSS
SSSSRS
S>SgS/S
SSWZS_
dSS!#SSOSHS
}SfS05XS
SdSSS7dSf
SSS<SZSShS
StSSS5}SSSSISSS(.
SBBBB~K
BSBBBBBBBBBBeEBBBB"BBUywZA$<BBSTBNB
B*BBBB
BBKBBpBBBxB
BBB+BB
jBrBBB%
pTbCT7
k!.T4W
ypS `{]
``h`|l`b`)``y`k```
```:`0`k````6`
/K`````/`<zq``(
`a``I``
``8``````s```"`}P`u[V
``]`J\M
T49HNo OADU
Ym\r5X{0
KWyFyyugCyuy3A
yyyyyHy
y+yyy-uy
=`yy/y(
qy5y?y
yPay^nyyy-
y$lhTXSyyy
yy=yy&y yU_yyyyg
AQh4bm
]vhCD;>/
=L\V:Mf
04sb PO
/$B4T+<
*\ILHm
P"`@``
`E`,\`
```<``2oQ`{`.```````J
y```c\```k59:```
`````+W
``Yv`-O```VG`
```3`4```
````````
````)`
#6``2```kQ[ QI
QQQQQQSQQQQ'"Q7QQQ!QQQQQQQ
QL+QQ QQ!Qe\"QU3Q}&Q
QiQQbcQ
Q B$QQtQ8ZQy
QRQGWQQQQyQQQQQQQ
QQQQFQQe
QQ|Q$QQc={
Uw"iA?JJ
}<-P[e2Q
&nZpfv}Y
{{{{:{s{4{{{{=o
{{{{n{{1{{{{`{`7{{I{{{{!
b{{{{{u#{Y{{{
{{{A{{{{{
{{~{{|{+
{{u{{{{{
"r~#Yz
3(xmE~3/3]3q
Voyta3v3
331B>3
=[SA9zz{
T443341343$334
=3Y43\
\43444$3T
443Z33347c
43>Ro32B3U3334433K
&34433463V44q43
%443N4$4
f4!3>"034
434B3`3433P3$334Zm44
34384e)363G44334
"4:""44""4.")
"4"9""q""4"y[V""
@P""o4"y
""""4""
uw=9"r/44""4"4"""
""",y4"4"+4Y""""M"4
"""4"mL""""q"4
P/-""444d"G
""""4"
4""@"*4"""4D'
9)6*y))))
!))))))
)))))^UG))t))a)
)q9G2`
)))_)@ )
)))))W}
zk_Cj))))G)H))ZI)))f)4
)q))Drlrxzr
~drrrrrr'v'r
rrrrrrrrrrr
rp<r20rr
="rr'.r
rrrrjM>r$3/~>
Rrr{a*u
rrrrIrrY
(cr\{ rrrzU{i]rrrr9r45)
drrrrVrCarErt
NIaF !
F<n}enn{
nnM)TvnT n;u
+Ynn|UnZ
nnnTRzCnn
n6>nnn4_
NXnTnD@n
4ep/6eeU;#e6eeiereie#:3
ee/Hee6h1Y
eee$a$X3Deeeeene]ee
emeeeNeOe
e&ez $eee
eeee_ee?{Neee
>4eee[eeBe0e;=ee2]eee/ ee2
22Neee-ee+eW\
'}OR1\M
_h:l#`*]
;[~J0e
DN`^)&
icS` DY~
`B%.10
"~v jd
'HX^9CQ$
Y8z/<8v888
bW888#8`8
+85jW,vh*
8n8Ls8 "88x8$
888P888i88
8 a88#Q$W8888L8l8D
?88s8i88\]
)'88J888s8
1888888Cpsm8888%
v888;;;V;
;;;{;;;;;K;!)
;;;;;;
;;;Fu;bm;j@
rUMDC;z
;;;;B;;;
X;,;;;;;
;;;;;;
;;;m;8;V;a;;
;;;;VjX
'kP7npu
? \k_Gw'
e,!4?g
H:A2o222I22222+222XK2x
2+.Q-2*.2P
222x2y^2222
K2Z2^2h2232.20
22y022
2822[222FqQ222I\22?2rv22%222222
222252294cWyWWWWW8WGWWirWW4
WWWWWt
{WWWWMWWWWWWWWz
WWW@WWq<W
WWWVWWIWWWWr
WBWVF<WWWW-
.WIWXWx;WWN
Yc1W2;
O@T4eJqL
n ,Db<0
{pWY/ii`&jt`b
INi=W%{u
*IMz =
''tOaj''''
''#<mew
T'W'''U''f'''n2'|"'''
x'''^'''r
G''''6c4'''''r@
1S''''6%':''''!''
I'lU'''''W'\''
32O O+i
{`dS%:
STV].{S/
1x[JQk9`9~
44444444x4444444,4
;u4444
444>4T44
44_44A44
447444|X4;
aB^9C"r
4%XHY!a
sicS44O%u Q{
m4&w}.
aM} yimmc
M/5L~B
H\k)t\H
vZ $$>$$Ng$Z-!H
$p$$$C$$uyn$
$$$;$2$$$0eC $$$$
$fl$<i
!cXktJg$g$
~$1s$p$$$
./GRo5$$TLq
/?$$$9b9
$$$$}AdDu$$$<$]
xS|ktBk
]5h@*.7v
tw!ce0A;
5~".lR
7'dm+<
P?d??\ll?
?r????BI??????>
H?D???h??????
?t!?Ixy?
???xJ??n?E?w????|?]`b"?w???cK?puA?V\
o9sTz???
???&?????
uu)uuuZuz#ujuuu
u>unuuuuuPk3)u
uuupku
bu5uYZu?uuIuuuu&uuuuQu
u?uux\uuu=uu
uOuOuRuu}puu
?iV>60 m@
h@KA8?m[
[J0V_)o[@<{;]
R/s/Of
J&gE$@f
Kq(PzZ
tT)-h;|.GK3
(g).k2
[pQkNBP'?
l@@~}@~@
@@}}}}
}}]]]}
uBeueHgouuuz
urip-Ryau
gilPCiuiuursuTurnuWu
uuuueuoeiWuutsuupud
uuTuuoeuo
etidtouuutuupCthe
AruuSiFuIuuuduuuuutTucrneMae
uraWullgyShsuiMuratPSuCu
euupHuGutu
culMuuuau
ysenLu
eWrBuutragEagggAgggloygnOguge9ie
gidgMtgCLeEGeCingtCgrIelcgegniCCn
gglggGgLg7
cgiognggf
gLCrtvP
e?btgngPaggiUgaatggGgng
SwgggrictrrIgdWd
Pgghggggigoa
atVgeggRggosePgggIrrrrelrErrrrerSrr
ryrrrtrrrnrc
rereeoe
LGlrsrTSttoneen
Pcrraerrrec
rrrrumareHrerr
rreotrrtClrIkLkrrrcED
rrrrrmss
rarrrlVse
nrroefrrrrrct
nortrera
QserdrFerrtrdrtppCpplpdllprolellllplltSPpellCttlupllTlpllll
lppllGll
aploee
lcllpelVilollplspllnpiFlppylpolpplipllpipGelp
sllllneiup
ppnllpllrllADtlppaplpll
lppTTplEplllopelp
lllllincllpplppltnlcee
enpIane
eEnevriemeSi
eeeeespeneedlepepepeptpe
eevSWeeigneneepereeeppeeteodoeFWepeiieepdit
zdlngtetnpenieeneeeceat
teeeeteeem
ppeCCtenrai
pteoepeEeSeprelGeeeeieeepoae
epaunrilecnsHpSSAenGsgrgegugFIlur
ticengtetotdhsxingeggggMUl
enecggg
GggDgtggsplEgt
PrlHggosGgeg
gSggsnn
dggdggrPiotagggggre
ePtrggggeggggegdagggdgWPoegngcdgbggdgl
eggrgAg
eeeogg
igEodFxtEigtctrc
nicPeclcce
ctcpnciiCcIpIscc
ceciSG
csrfcyctctccccs.sie
ccaaccUn
3ritedte
OPcrAlx3cennc
nccceoc.Tc
durcemcccctnWttc
uEcdcloei2ccUchSocE2ca
dcLcfciccrceoccTlHcoicccomtlcccilcpc
eiiiiW
atEiiAiiH.iacriaatniseCSi.ioiiiialliL
ixeIiatainiIitixa
xcSeeaaiiilliiatul
oiiWi@SCiiiUdoa?xoii
Iliizr
laEieCE!Iiiiae
ianiiiu
ililliiicihiidtuialnEiiaiD
Ez2V3nSxS
Wlaleao
SasSSSQe
eSSySSRsNSSSeaSaSa
ayuea2
eaSSaSeSa~a
aSaRSSaSSaeaa
SSeaaagRWgSaCe
SSWlEVKaSaaSRESaSanaeSagexSSGaRSeaea
SrS0amSaS
arSaaaSaaOS.aSya3SnSlaEUauSSSaaaSaSSt
SdpSgKaaSaataaaSSeVWeSd
tWwoMipx
leaeeDgendePi
eeEWDidxieeeEoe
eUseegreoeS
Wwicfn
teeQWys
rteasSdeteoeeewg
eeaooe
WeUmDEneeneeooea
ereeoBen
eedePelietr
ainoSBe
meSadSeideaW
eeaiPntiiee
eorWgteeeWotMeaCen
eeseLel
eteasaIees
eorsWreosMeese
exsiet
nDseaelMalgRcaacTsWCeATisgrrncrWeapsanacrdladn
.PodddttadKd
edLag]Wd3
scsdredtd
ddddddmddWdN2nL
LterogtddeitGcery
MrdLarddoThdaWmldddDdi
teGdmdonrWdS
rodGnWe
ddaadddtCdddaddedtdddNIddredheCEdEeddSa
daddsddAlidd
lllelesstlllsssyrsGelselslssCe
lisllsslGslesslessWmlsosseFlsts
sFesteclTs
rlosiTl
srGressADemsssPslilssslpslil
stusleltusllssl
ssslmasssssslsrsssseplsslsIdSslerlyntsJsstsPeses
lHlelcsnlneleh
`eCHeeMtFitcetlFSaGnVE
Wlnnelltoonl
eTFFlil
ilenlGTllptrullnlRelFmeeWdl
laloollunanS
ilennrnenWeenn
veGnedn
naPndln
pnApoln
tlMenkG
slizncnllmnnl
nnnW~nn
nnneRtn
pppppp
pppppp
@@@@@@
@@@@@@@@
@@@@@@
@F@@@@
\lnWrla
hRRRRc
EoRRaeTxl.Id
|1v811||1|1|11k/|E5|||1
Z|1|||)||1U|11||1|1||||1|||sU|11
1|#111|1
l|n|1-|1}|B
1I7h1|0|111e|1|11|1|1|117111||1|||||1|111|1T7|||
|1|1||1|1||1111|111
1U1|1|||1U1AG
V+`/hKkv\
\W@MMM+M^MPI)ME5.<M;M0ZVM>MMMM(MMMGQ1XMMMMMMCOHMXMI6MMS_JPMDK,MMMSMYMMAMQM`RM7MWMUMTMMLM8|VMMMM9MM-A2?N]B4
D~L}*MMMMN=Y{MMBMMM3MMOMT/JRMM[EGMM:MMUCMK\ZFHMF&
9v:zi999ym~9>9tt{ri@9a9]|ow9wc`9bc\9^9ay[ngg99ukl=esqh}99b9h9?up9x99_9jqkm99jvx99fd9l9o9e9n99s9d9;zf<99r
"99992
yTyydyy
ayytyyyyyyynyyayyayyyayydyuySyu
uyraWi
SySsyuyoy
yyydyye
nyyryydeFueF
AeSaeunMeJMeeeueJie
eeeeucyeAJtcevo
eeeeeeyger
eeesSaepeA
ereeAeNeeeh
Jmpeelee
erorea
vuaeeuebe
erbeeeey
yrbdee
euMdTe
OOtOmnOOoUWs
OOiOOROmU
LtOcOEDwO
GeaOOOjOS
OOGtoi
OGOOOOOt
POrOtBiOxMO
OOAAe2
gdO3ocuoO
oOcOOsfOeOO.IG
esOOeeOOOOnsLOOOOdnWtaOHO
ptveieceiOOt
n:erOrLwO
Reueee
Geeelt
escLeeee
eh 9 b
iinhii
f3tu0J
AufAftR
IttfAAf
[_^W_}__$
____^__
__V___E
PL__U_ju________
__p__j
___u__
9WE;pu}53
@p]~u@Eu
^^^^h^Y_
^Su u^$^^^^^^^^^^^MS^u^u3^^
^=^[^^u^^^^t^u
^^^^^u
^^^^(^^^Su^^^^u^S^^e^EW9^ ^^$^p^u^^YU^
^S^"M;uP;h
P;$P8F
PY@@Pt
PPPPtPP
PP4U@P
FPtY;tFYY^Y
t@vt@Yu
;tXy]]
]]]]D]]]U
]]]]]]]U
@]]]]]]J]]]]?
]]]]]]]
]]]]]]]]T
(((<(((((((
((((((
((((,4
(((((((((((
(@(((8((((((
dyp`vv
vv(vHvPvv:,Dvvv"L0vc
aaaay\ajp@aaa3aaaaa
aaaaaaa
aaaDaaa
ivvvaaaYaa
VYava
aaaaaaaaa
`NYWnWtpf@
0`_DV^WD
MY]tV3uu
ppPpppppu
YppVppYp
pppppDuYj
pjpppSX@Cppp
jWU]pppp
tppp]pppUp
u+uu$uu
uuruuuuu
utuuuuuu=
uutuuu
Duu1uuuD
uuuuuu
utuuut
ttttttttEP
ttttthttttttt
ttutYtttjtt4tttjtttttjt
33^o\Wq
t@S]l3$q]
tjU)R[$tS_h
3t3333
33$333$3333
$4D33L3
3D33dt3$
P333V33
3333L33T3
p$333$S33;@;
d353333W
DEEEEDDDCDDE
EEDCDD
DEDDEDDDEEEDEEDEE}EEDEDEDEDEfE|DDDDEEE@DDEEDEEEE
EDD3DhEDDE
DDEDCEDDDE
DDEEEDDDEEDLLfDEE3
EDDDEEE@DEEEEDEDDDD@
DEEEE=EDDEED
[E[[x[[[
][[u[[[
[ @[[[[
[[[[[[
[[[U[[
p][[[E[[[[W[[[[
[[[[[[[[3@[[[d8
[[[u[[E[
@5jjjjjjjjj
jjjjjVjj
jjjjjFjujhj@Vhu
jjjjjYFEUt
jjpH@jHjujujjjjjjc
Y[hl6ptY@
p@APueV
$$$$S$
$$$$$$$$
v$D$n$$$
WvP$$$$$P$P$P$$
$W$3$$W$
$$$$$W$P$W$$$$
!$$$$S$$
@Ru j;
3]3333YY333333u
uE3;3W33
3t3^33Y33333[33]t3>V3hjVtY34333
t;83@3033}33
3Wt_33@3@p"33l03333
3333333GG
G;GtGG GG;GGGPGGG>GG
GGGG99G
G@YGutGGG'
YGGGGGGGGPGGGGGu
@@S@P@}@@
@@@@@@
@@@@tPP
@t@@t_
XDGt^FW@P
rG##F|@
F^F@FF
^FFO$F
FFFGFFFFFF
FrFFGF Fr
FFFGFFFF$_$FN
DNNN@\
N@D@DD
<N$@D4N@N
uD`9;D
5u~(555Y
@55p5555t3
$u555555]5-5
55D5K55
Wp5V5j^5(5555]
u5}5555
D555M5U@
P5D5555D(55]555
Y3fuO_+
Efff"j
Eu}tf+
MfOuU3
f^;PPPEPtPu
PPPEQP
PPPPPEtTP
PuPPtP
PPjPPPjPP
Ptt"PuPP3
PtMPPP5Du
PPLPQP)PP P
PPDEPtP
Dh}=P@@
,MD@\}
LT@5DhD5
\S(PSt}
hhh}VhhhhhShh}h
hhhhEhe
hhhD"h4h
hEhWuh
h@Ehhh
Ehhhhhh
hhEhhhhhhh
@hhEhh=hh@
2+22$22tA
t222$$u2
2A22$A+22$
222+222L2$
222222
A22YYY3dYMYPYYY:
YYYY$YYY$-Y
YYYYEYLeP3Y@YYY_
YEYYYY]dt
hY^YtYY
[YYY@YYYY
EEBBBB@WBBqBBBEE(B
B3BBBB[
BWPB_rBB
B@BBBBBP
BBrB<]BrBB};BBBj
BHB3BBq
q8q]9UE_(
fqHqAq<qP
qqq@qqqu
fDdDDDE
<DSDD`]DDDDDDD]UDUDYD
DDDtDDDDDDD
DDDGDDEDDDDD
DDDDUDDED@3EY
DDDDtDDDYYO>@|jYYY|xG
t]YEYYY
YYMMYYut YYYYD
YYY2@YYYEY
dYYYS\YYYU
utYwYYY
tu}t,D4ttttY
tt@tDt
_qqqq)
6q]q]uqW
uqqqqqqq
qqqqqq
Pqqq4qE@q>@Y+Yqqh
q@q>qqq
_^`u___
8qj_D@`
___5_V_E^_@_Wp
hh_[F@
%_5_0t@
e@p;tO
N33Du3@EPutE
@@@:@W
@@E@@@@W3
@t@H@@V3S
m@@@EUh:=@U@T@M
@@_@ @@X9@
@D[@3@@9Ms
_MEY5$
pppppt
p@ppppppvppDpppppppjpppDpp
ppPppp9pppp@pp
5pppDppppp
D@pppph
hpppp5
pptWYpEpu
pptKpEpppYa#@
v55555
@55555
@@qTt^
3 `Y1W~
D`M;S33
33D3D36W3
f@r33/D;
333H3333D
E93!53
;DH33f3
3s3}3
333333333S[L
jS9U;fW_t9E
fYXXXX
XXXXYDXXXY3XXXX]
;XX^XXXXX[XXX|
XPXXXXHE`XXX
X5XVXXXXXXXX
XXXrXXtXXXXXXXDX'X
XX4X_XX
9utuuuuUtuBtY3
uuufxu
8\uuuuu
u8"uu}uu3
uuuuuu
lYYYFYYYVYS
YYYYY$YYY
YfYfYV
YYYtYYYY
YtulYY
ttDu5YuwG
uuduuudY
dYuuuuQuFu
uuu]=uudujF
>duF=u
uu^uu.du
`=^du=
uuFuuFuu
u^uFuu
``|~9\
N``dd`
``d3``````
P(G^pS(
SyP((@(
9(P((j(
t@@r((3A(((t(
@t(((EE(EE(S(EE((EE((EV
E(EuEE(E(EEjE
(E(EE|(
(EEEEEE*(E(EE
EE(+Eh((EEW
(EDEEE(
EEhE@E
((EEuEE(E
h?E({(
(+EEE(
;t;t;;;t];7t;ttttt;tt;9t;
tt;;;ttt;;ttt;;]ttt;;tDr;;;;;tt;;thtttt;;;;t;;t;ttt;;t
;t;t;;;;t;;tt;;t;};;ttt
tttr;;;t;
;t}t;;Kt;;tt5
ttt;@;t;tt
};tt;t;;>p
Wjth@DW
q;WWW_W3D
sDYjYYYYWYVh
WTWDYWY^Y
Y%YWYY@YYYh
Y]YYYY;qWWYDWWYYU
WYYWWuYYYWW
WuYWYYYYYWq
DrYYY^YYYYYYYhW
YYWYYt
t=ppptp
@3jx3Ep
ppL@ph
p@@pUU0U
ffUUUUU4Uf,
DUUPUDUU
UUDUU UUU$UDUDUU(UD
UUUUUDU5UDUUUUe
Q^q@uV^
tttI3t
D$3tvtttttz
ttut+ttttD^t
t@t3t]t
ttttt^uttttE[tU
MH_tttttt]$
]t@uLtV%t(t
t3ttt^tt@tQttt
u3Df+f
fb$Fuwwt
wwwwvwww
SwrwfPDw@f33wwwhwf
wwawfw
wwECw&wwQww>wdwwHw
wwwwHLLL
LPLLLL
LLL1LLLL
LLhLLL
LLLpLL
PP@LLLLLLLLLLL
8DLLLLj
LRLLhLLhj
=tDDh@
Dpppppp
q^[Q;@<
[D\P^D
;fu>,W~
0D_@D!
f+0+++D+3f+D
h++u+++++++@+
+2+++++pu++f+t++3+
5fp++++
W[PEEE
MEEE3E
EE3PMEEEEEEEEEE
EEPE3EBEEE
_EUEEhjEqEEE
EE_E2tEEE
@^ElQph
+++Q+++++++V+@P+++
M+++++
++++++
++++++++++++\++
++++++++`++++++
+++F+VRP0
RDPAAU
RPP$Pj\
xxxxxP
Axxxxxxxxxx
xxxx1xQxx
xXjxxx}
xxjxxPx
PxE@xxxxxRxxxx
xxxxxx
lhhSPPQQ
tQp0@PtPh
b`bbbb
bRdb+7
b+bbbbb
bWbbbV
dbbbbMp
Vbbbbbbb+
bW+`bbVGbd
WEFV+EV
W+EE`EEEd
EEEEd``
hEqSEhE@V
E3EjUj@
@hEpS@Ej8E
Ej3@PEE3lEE@EEEpEV
jIEjp@EpEEE@Q@
PPPPHE
PPPPPM
PPPPPPPP0h@3
PPP@$P
,PPP@P
@h$0j0000p
00R@@0@
0D00j0
3+faNkO
Nk9qOfkqf
44444@}
d444]444
4 4$4M443E4
444V444
M444qQ
444444444
4434a4U
44444444444}
@jMRPUEjP
hhhV]hmh
0hqhhhhjhDhhhh@hhh
hhhjj0Ddh5
iec 2! r
" MDT a
f Ma aO
n S ao
aan" MO! aod
a se ! * ar !r
" i + p /g ! . nhL
$! ao
u!t mn mba ! + a
CRYPT32.DLL
KERNEL32.DLL
CryptBinaryToStringW
CloseHandle
ExitProcess
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetTickCount
GetVersionExA
HeapCreate
HeapDestroy
HeapFree
LCMapStringA
LCMapStringW
LoadLibraryA
MultiByteToWideChar
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
WideCharToMultiByte
WriteFile
RtlUnwind
0/0@0H0Z0s0{0000000
1.191M1c1r11111112222222
3'333?3I3m3v33331484K4_4j4444444
545P5^5u5}5555555
676L6W6i6|66666666
7+7<7W7h7v777777777
8$888G8T8k8}88888888
9$979V9`9x9
999999999
: :%:0:=:B:P:U:c:h:t:y::::::::::::::::
;!;';2;=;C;V;b;h;q;z;;;;;;;;;;;;;
<;<[<s<<<<<<<<<
=,=A=J=_=q=
>#>3>:>I>\>r>>>>>>>>>>>>>>
?%?0?@?N?i?q????????
0(030@0p1y11111111
2'272P2l2s22222222
3"393I3]3q33333333
/=n^UeDL
w%3;Cah
aCPfFn
aN'v.,}
l :y2U\c&%n
^:a=<6MH,G
%iL#*"}
kfJS\i$:M
.!"bL[|Mo
n"Ow{i
%ops*s_
NW]uoY :
!`a0,X
m=\{J/==lJcxX}Dw
Y MRjx|\P
iA|SP_
BHo*Q&sp
9ab .Jv1Ln
&!i85S
heJG$r
nA^bOjb
3!/j^Kq+nUVAl
Saq30<
'R,qHa<
.eEI]"_
k=*}.c
F.71j|/5|d'
XW{ -[i
S9ZjA[
D+df=iW
p$=3OeJ+BQ
`C.Q7<*
"CTvW|dg8
Azq>vay
7- \A9b
ujZ&)Y
>r&_#P|q1
e weu&
;D8e7/
IxP<aw"Q/L3
-2~x. [!>K6U2y
/MwwAT `z8>
6nvy@mk ^!kU.`T
X/k1m!CP@
4r W<d=
G4Yw3P)2
Z3/kQy<ji-N@i:U"LL?
7G'qai@
Gw-P!8ZL
wzZb\J%Tm@*
U0CZ:*koG%d
"gxD[A\@Vc':
]?+}8XD|ZaEv=
F+FV2P
[? JI-{
$8k$9$6
xw;:K|H\1
T/I(UOKlu o
:J09!R
MjoJn<~?
k.euf,a6n
.]m&F&a6t
qN#W)i
;QrtO'4n5a
A=oJ!"
A"L5tnU1w:V}Q
"U!Mb1|T
A1Hu+[
'XoX9>
E]7*Ya)M@
gR}(Un7G
0z09.4f
>jCJ\Jq>
cH3d.q
Cdq9E/
Rca`6|
,_^8I"up
:.,hDuyp^U
7Y=b*w|y6
'8XB5N"" )m JZ
G(vrh^PU!)~V
xq?1p]ib+Bi
2n43rb#[~qOa
fax6ysUehy
nWgf)&j$mO2%EJMcg#-BC
"jKk21C$I*"
-E8?R6
:"(>%Q
]&s\n@
jgUBsdMH
Wpse)TckNc
}Jf3:$
/0rTNA
em\$#D
\r'/<'e|f9o7
j>g`R;!
9X}M^/
=oA,xnS792RC_N
#SSsMu
40u^7[|)dC^9K}7PB
/Lnb&^/M
J#m:quz
BQ'Y]RHdX
BSM=\wE
8C:AUix6o:N6wH2
PECrV<
E+)uT0?aT
G_>ip}f)
?2K8+$C>fup
nih:'s.
odA~tb$w{/Pk'
rd$rs
/('/9pnyLv
3hzqZ8qH,
MM+j8D1
]wy; SFW
M$O*K=
2a^!|j,
["xt{7
98lT,Mp^a
lL <L?
8W<Xs(
Q0Klu3
S{0a1T<=
mL`O#0|3b
{dOh2_d7^
Ha<2'{W\
lJ0:Ve
%'C`LTEWxwZ
R8N\[Ll|
mxTq++nCE
iD)'m#
A@t>DZpk,q?Z
S06dt;&w"6bQu
~?qBjVl)
O+:G.g
[~U;l;
oIQj.r
Wy4Z\)C3i
U(<VCTq
a"ehe(s
^B25n<xCio
{ aq?W
3}>@_Rx
Iz_Uo*s
@ZU/.jin
5bx@Z]a
>qIKpX
yhtjPF}
L-5u 4;M
4R $&}]'UlpN
:},U[E_r
s(jc!jc
*s%qo"]K!
`3:r/J9
|<`C%}_
'GT5t}xW4j8!8
KiZdys
H)@<Yd^YL?
@GcZm}HNm# d
c`~]1iKpsG:
6v$.q%*
|] !z8TE<
6jV</4e
dv;@JSkK)
8O#=_VAF
@|YzF,^8Tu
Cm#n}'d4
OzF6@<t0.$p
\% 3/*dAOi.#*
x(r,K|~
sfcR%4XZF
De:,>"m &>!
I+1,{s%
$a~S0#~K;
F]EeHx>:JS
t#,.e
Xi~m_=
OM} VS,~
s|W3-f'f
4K"teCJ-
4JBjaMu
FT"c=/
s,|Pwc
IO]elEU@<3g/c
t~8{KN
ST!D9C
1AEmXyk"3
kB:iK1|~
QEg48EF
wr?#1mS
wg}]9#
ck/!23A
P^a*,{
^vvS3gF
CpXE$YV
~L 1e#He5>
48}RIXd9_j$X()7
@O3w\Qk$
@z8hrm
nj4qT}^O"
{4$'(v_Y%XtL
-nj yw3
%Eb%piuE>FK
r0JFg.4
&]x!/{R,
|aj-9>*L@
NNZ/5=V
r!8?|[D${?\=
vOvBaHqeq[fY|0
Tq$K<&
DWcz\dcwH>Q/
C.RQMpoJDHuaW`
F G A l s G j P y R v o U
M S S a n s S e r i f
K b g g l C x U P C x g V A k Q H P s p m O m k P
i T r n E w v V O g H p l H a M D b O w s G B C M q J P N v d m N
F j r F a B N M v r u x r d i D m v H J e Z C U A v J a e f U x
Y b Y P n
K K j j F u b F d n H j F T d N Q F z j t R m V p Y u f J n O
Z L D f U i x j U n F T o j s Q n u P y D
O h Y d m S d R t c H O l P e g S
m h i H j D T a Y k Q Z d S P t l A j e k A d q C
D e D O x D e X X H b z F G J g V P K T M B n A d I I Y t
n Y J E Q g I b n O v g b j g R Y n S Q A s T t c z a r d c E m l x G u K M L a i A D i L F A C t K x n l v
M S S a n s S e r i f
F U z t B H T o P a x N q l d D z K n P r f v H t
b L Y y T C G J H I G s S f t d p N e j u m Z q s B j k G B P W S g K j K D b d g
P a q j y
u v V A o V L D T B
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.