0.9
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.53
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:VB-AEOS [Trj] | 20200127 | 18.4.3895.0 |
| Baidu | Win32.Worm.Pronny.d | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200127 | 2013.8.14.323 |
| McAfee | GenDownloader.rv | 20200127 | 6.0.6.653 |
| Tencent | None | 20200127 | 1.0.0.1 |
静态指标
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 57 个反病毒引擎识别为恶意
(50 out of 57 个事件)
| ALYac | Gen:Variant.Barys.950 |
| APEX | Malicious |
| AVG | Win32:VB-AEOS [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Barys.950 |
| AhnLab-V3 | Downloader/Win32.Murlo.R45756 |
| Antiy-AVL | Worm/Win32.WBNA.gen |
| Arcabit | Trojan.Barys.950 |
| Avast | Win32:VB-AEOS [Trj] |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Worm.Pronny.d |
| BitDefender | Gen:Variant.Barys.950 |
| Bkav | W32.FakewinlogonQJ.Trojan |
| CMC | Worm.Win32.Vobfus!O |
| ClamAV | Win.Packer.VBCrypt-5731517-0 |
| Comodo | TrojWare.Win32.Pronny.EB@4qtzpj |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.f3270e |
| Cylance | Unsafe |
| Cyren | W32/VB.HE.gen!Eldorado |
| DrWeb | Win32.HLLW.Autoruner1.26871 |
| ESET-NOD32 | a variant of Win32/Pronny.ET |
| Emsisoft | Gen:Variant.Barys.950 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/VB.HE.gen!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.812a29bf3270e90a |
| Fortinet | W32/VBKrypt.CA!tr |
| GData | Gen:Variant.Barys.950 |
| Ikarus | Worm.Win32.Vobfus |
| Invincea | heuristic |
| Jiangmin | Worm/Vobfus.ayw |
| K7AntiVirus | EmailWorm ( 0054d10f1 ) |
| K7GW | EmailWorm ( 0054d10f1 ) |
| Kaspersky | Worm.Win32.Vobfus.jod |
| MAX | malware (ai score=82) |
| MaxSecure | Trojan.Malware.4606326.susgen |
| McAfee | GenDownloader.rv |
| McAfee-GW-Edition | BehavesLike.Win32.VBObfus.dm |
| MicroWorld-eScan | Gen:Variant.Barys.950 |
| Microsoft | Worm:Win32/Vobfus.IP |
| NANO-Antivirus | Trojan.Win32.Vobfus.ewohwn |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM03.0.D741.Malware.Gen |
| Rising | Worm.VobfusEx!1.99EB (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Vobfus |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/VBObfus-K |
| TrendMicro | WORM_VOBFUS.SM00 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2012-09-29 15:44:55
PE Imphash
b14dd3eb7dbcc15edcaf3b8875b1071d
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0003d288 | 0x0003e000 | 5.732305375861015 |
| .data | 0x0003f000 | 0x000033cc | 0x00001000 | 0.0 |
| .rsrc | 0x00043000 | 0x0000444c | 0x00005000 | 5.5796633004363585 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00047104 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x00047104 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x00047104 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x00047104 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x00047104 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x00047104 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x00047104 | 0x00000128 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00047240 | 0x00000030 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00047240 | 0x00000030 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_VERSION | 0x00047270 | 0x000001dc | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library GDI32.DLL:
• 0x401000 GdiGetBatchLimit
Library KERNEL32.DLL:
• 0x401008 GetVersion
Library USER32.DLL:
• 0x401010 GetMessagePos
Library ADVAPI32.DLL:
• 0x401018 RevertToSelf
Library COMDLG32.DLL:
• 0x401020 CommDlgExtendedError
Library MSVBVM60.DLL:
• 0x401028 __vbaVarSub
• 0x40102c __vbaStrI2
• 0x401030 _CIcos
• 0x401034 _adj_fptan
• 0x401038 __vbaVarMove
• 0x40103c __vbaStrI4
• 0x401040 __vbaVarVargNofree
• 0x401044 None
• 0x401048 __vbaFreeVar
• 0x40104c __vbaAryMove
• 0x401050 None
• 0x401054 __vbaStrVarMove
• 0x401058 __vbaLenBstr
• 0x40105c __vbaFreeVarList
• 0x401060 __vbaEnd
• 0x401064 __vbaPut3
• 0x401068 _adj_fdiv_m64
• 0x40106c __vbaPut4
• 0x401070 None
• 0x401074 None
• 0x401078 None
• 0x40107c _adj_fprem1
• 0x401080 None
• 0x401084 None
• 0x401088 __vbaStrCat
• 0x40108c __vbaLsetFixstr
• 0x401090 __vbaSetSystemError
• 0x401094 __vbaRecDestruct
• 0x401098 __vbaHresultCheckObj
• 0x40109c __vbaLenBstrB
• 0x4010a0 __vbaLenVar
• 0x4010a4 _adj_fdiv_m32
• 0x4010a8 __vbaAryVar
• 0x4010ac __vbaAryDestruct
• 0x4010b0 __vbaVarIndexLoadRefLock
• 0x4010b4 __vbaVarForInit
• 0x4010b8 __vbaVarPow
• 0x4010bc None
• 0x4010c0 __vbaObjSet
• 0x4010c4 __vbaOnError
• 0x4010c8 _adj_fdiv_m16i
• 0x4010cc __vbaObjSetAddref
• 0x4010d0 _adj_fdivr_m16i
• 0x4010d4 __vbaVarIndexLoad
• 0x4010d8 None
• 0x4010dc __vbaStrFixstr
• 0x4010e0 None
• 0x4010e4 _CIsin
• 0x4010e8 __vbaErase
• 0x4010ec None
• 0x4010f0 None
• 0x4010f4 __vbaVarZero
• 0x4010f8 None
• 0x4010fc __vbaChkstk
• 0x401100 __vbaFileClose
• 0x401104 EVENT_SINK_AddRef
• 0x401108 None
• 0x40110c __vbaGenerateBoundsError
• 0x401110 None
• 0x401114 __vbaStrCmp
• 0x401118 __vbaGet3
• 0x40111c __vbaAryConstruct2
• 0x401120 __vbaVarTstEq
• 0x401124 __vbaPutOwner3
• 0x401128 __vbaObjVar
• 0x40112c DllFunctionCall
• 0x401130 None
• 0x401134 __vbaRedimPreserve
• 0x401138 _adj_fpatan
• 0x40113c __vbaR4Var
• 0x401140 None
• 0x401144 __vbaRedim
• 0x401148 EVENT_SINK_Release
• 0x40114c _CIsqrt
• 0x401150 EVENT_SINK_QueryInterface
• 0x401154 __vbaVarMul
• 0x401158 __vbaFpCmpCy
• 0x40115c __vbaExceptHandler
• 0x401160 None
• 0x401164 None
• 0x401168 None
• 0x40116c _adj_fprem
• 0x401170 _adj_fdivr_m64
• 0x401174 None
• 0x401178 None
• 0x40117c __vbaFPException
• 0x401180 None
• 0x401184 __vbaInStrVar
• 0x401188 __vbaUbound
• 0x40118c __vbaStrVarVal
• 0x401190 __vbaVarCat
• 0x401194 __vbaGetOwner4
• 0x401198 None
• 0x40119c __vbaI2Var
• 0x4011a0 None
• 0x4011a4 None
• 0x4011a8 None
• 0x4011ac _CIlog
• 0x4011b0 __vbaFileOpen
• 0x4011b4 __vbaInStr
• 0x4011b8 __vbaNew2
• 0x4011bc __vbaVar2Vec
• 0x4011c0 __vbaVarInt
• 0x4011c4 _adj_fdiv_m32i
• 0x4011c8 _adj_fdivr_m32i
• 0x4011cc __vbaStrCopy
• 0x4011d0 None
• 0x4011d4 __vbaFreeStrList
• 0x4011d8 __vbaDerefAry1
• 0x4011dc _adj_fdivr_m32
• 0x4011e0 __vbaPowerR8
• 0x4011e4 _adj_fdiv_r
• 0x4011e8 None
• 0x4011ec None
• 0x4011f0 None
• 0x4011f4 __vbaVarTstNe
• 0x4011f8 __vbaI4Var
• 0x4011fc __vbaLateMemCall
• 0x401200 __vbaAryLock
• 0x401204 __vbaVarAdd
• 0x401208 __vbaVarDup
• 0x40120c None
• 0x401210 __vbaVarLateMemCallLd
• 0x401214 __vbaVarCopy
• 0x401218 None
• 0x40121c __vbaFpI4
• 0x401220 None
• 0x401224 _CIatan
• 0x401228 __vbaStrMove
• 0x40122c None
• 0x401230 __vbaAryCopy
• 0x401234 __vbaI2ErrVar
• 0x401238 None
• 0x40123c None
• 0x401240 __vbaStrVarCopy
• 0x401244 _allmul
• 0x401248 __vbaLateIdSt
• 0x40124c _CItan
• 0x401250 __vbaAryUnlock
• 0x401254 __vbaVarForNext
• 0x401258 _CIexp
• 0x40125c __vbaFreeStr
• 0x401260 __vbaI4ErrVar
• 0x401264 __vbaFreeObj
L!This program cannot be run in DOS mode.
`.data
GDI32.DLL
KERNEL32.DLL
USER32.DLL
ADVAPI32.DLL
COMDLG32.DLL
MSVBVM60.DLL
rrrr1hrD
rjrbrrrVr
r3Wr:nrpriurA
vrvjrvr:
rdrRr!vr
rrrornr/prbr}Artr
rrlWrrr
rRNrUr
rrrr`vr2vrGr}r
r}irWr]
=rr7r:rwr:
rrar5r$br
rwrmrD
rrkrmrpurmrr0lrnr
rrDrDr
rkr(Nrr
-C000-Lumberingness
2.Margosa tiglic
VB5!6&*
Joyant
qumedztj
Lumberingness
rnCdM/C'
' NIr=
&A_RMp
jCdCVj<
\C}tO2w
BorderStyle
MCI32.OCX
MCI.MMControl
MMControl
M75=F"a
panneuritis
frmAbout
frmAdvert
FrmGuessTheWord
frmHiScore
frmOpen
Module1
Lumberingness
P ($ *
kernel32
GlobalFix
user32
GetSysColorBrush
winmm.dll
CloseDriver
mmioFlush
CloseFigure
lz32.dll
LZCopy
CopyImage
user32.DLL
CallWindowProcW
+3q"=h
VBA6.DLL
__vbaVarForNext
__vbaVarPow
__vbaI2ErrVar
__vbaVarForInit
PD\ptxtTname1
__vbaPowerR8
__vbaPut4
__vbaI2Var
__vbaLenBstrB
__vbaVarAdd
__vbaPutOwner3
__vbaVarIndexLoad
__vbaVarIndexLoadRefLock
MSVBVM60.DLL
__vbaRecDestruct
__vbaGetOwner4
__vbaGet3
__vbaLenVar
__vbaVarTstNe
__vbaPut3
\C}tO2MMControl3
txtTname2
__vbaFileOpen
__vbaFileClose
__vbaVarDup
__vbaAryVar
__vbaStrI4
CommonDialog1
cmdExit
__vbaFpCmpCy
__vbaVarCat
__vbaFpI4
__vbaVarMul
Picture1
Picture2
__vbaVarInt
__vbaVar2Vec
__vbaLsetFixstr
__vbaStrFixstr
__vbaRedimPreserve
r__vbaStrVarCopy
__vbaGenerateBoundsError
__vbaVarCopy
__vbaLenBstr
__vbaAryCopy
__vbaVarTstEq
__vbaNew2
__vbaI4Var
__vbaAryMove
__vbaStrCat
__vbaStrCmp
__vbaEnd
__vbaFreeObj
__vbaHresultCheckObj
__vbaInStr
__vbaInStrVar
__vbaVarSub
__vbaStrVarMove
__vbaVarZero
__vbaErase
__vbaStrVarVal
__vbaVarMove
__vbaAryConstruct2
__vbaAryDestruct
__vbaVarVargNofree
__vbaI4ErrVar
__vbaFreeVar
__vbaFreeStr
__vbaUbound
__vbaAryUnlock
__vbaAryLock
__vbaDerefAry1
__vbaSetSystemError
__vbaRedim
__vbaFreeVarList
__vbaFreeStrList
__vbaStrI2
__vbaStrMove
__vbaOnError
Picture3
__vbaStrCopy
&vJW^Y5
rnCdM/C'
-A}6zd:O3f
+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB
lblAbout
0$FvlR{
.];wGHB N^8k5
C:\Windows\system32\MCI32.oca
MMControl2
Command1
Label4
Label5
Label6
Label1
Label2
Label3
cmdReturn
MMControl1
__vbaVarLateMemCallLd
' NIr=FO>
+xlblGuess
TxtName
txtwsc3
__vbaR4Var
__vbaObjSet
`##G}f:
+R'N3f
Frame2
Frame3
cmdClear
ImageList1
TxtBeg1
txtInt1
txtExp1
txtBsc1
txtBsc2
txtBsc3
txtbeg2
txtInt2
txtExp2
txtwsc1
txtwsc2
txtTname3
txtBTime2
txtBtime3
TxtBtime1
Timer1
Frame1
COMDLG32.DLL
CommDlgExtendedError
ADVAPI32.DLL
RevertToSelf
USER32
GetMessagePos
KERNEL32.DLL
GetVersion
GdiGetBatchLimit
Q%]yxZ$6Ni
fPicture9
Picture5
Picture6
Picture7
Picture8
Picture4
Picture11
Picture10
__vbaObjSetAddref
__vbaLateIdSt
__vbaObjVar
__vbaLateMemCall
' NIr=L8H
FrmGuessTheWord
System
TxtName
Times New Roman
lblGuess
Guess the Word:
Times New Roman
rnCdM/C'N
frmAbout
About.....
lblAbout
The Cat Database Programming by Jason Bennison Data Entry by Penelope Bennison B.Sc Dedicated to Andromeda
MS Sans Serif
frmHiScore
Flip! Best Scores
cmdClear
&Clear Score Table
TxtBtime1
MS Sans Serif
txtTname2
MS Sans Serif
txtBTime2
MS Sans Serif
txtTname3
MS Sans Serif
txtBtime3
MS Sans Serif
txtTname1
MS Sans Serif
Intermediate:
MS Sans Serif
Expert:
MS Sans Serif
Beginner:
MS Sans Serif
Frame3
Best Times
MS Sans Serif
Timer1
txtwsc1
MS Sans Serif
txtwsc2
MS Sans Serif
txtwsc3
MS Sans Serif
txtbeg2
MS Sans Serif
txtInt2
MS Sans Serif
txtExp2
MS Sans Serif
txtBsc3
MS Sans Serif
txtBsc2
MS Sans Serif
txtExp1
MS Sans Serif
txtInt1
MS Sans Serif
txtBsc1
MS Sans Serif
TxtBeg1
MS Sans Serif
Expert:
MS Sans Serif
Expert:
MS Sans Serif
Intermediate:
MS Sans Serif
Intermediate:
MS Sans Serif
Frame2
Wall of Shame
MS Sans Serif
Beginner:
MS Sans Serif
Beginner:
MS Sans Serif
Frame1
Hall of Fame
MS Sans Serif
ImageList1
0$FvlR{:O3f
frmAdvert
Ordering Flip!
MMControl3
MCI.MMControl
qumedztjCs*Ev
2pIj~mv|
2d@0|r
CoR7Enh`K.s
f.z)z c
l~)Bw6Dv*.gOs4
|{A@DX
=Fm##?
vI0K%v
E%FF|N'
H8Z,G$>M_?Go+|[q*|
Hrg'[Y/^3B3{
3Tx[*G^;
w @D$*G<s
r(N`o=/
)U'G@rg2XRNj
0I\hN3
l=g5Q7@
A=O*al
*$4djW?
|U^u~v
@Dl7V &
0F3.Ha
bft'(l~
Xq$|8l~S
7a&h:W
c){(P8
!Jj!<%p)[}T
Vf_>TQ
>Ih-Dr^
MMControl2
MCI.MMControl
MMControl1
MCI.MMControl
Picture3
Picture2
Picture1
Command1
&Load Order Form
System
cmdReturn
&Return to Flip!
cmdExit
E&xit Flip!
CommonDialog1
Label6
To order Flip!, Follow these 3 simple steps -
Times New Roman
Label5
3. Play Flip! and enjoy!.
System
Label4
2. When you get your Validation Card, follow the instructions on the Card.
System
Label3
1. Fill in and send the Order Form with payment to the address on the form.
System
Shape1
Label2
By ordering Flip! you will have the following options added, Flags of the World, Numbers, Playing Cards, Fixed Colors, You can also progress to the expert level, lots more tunes, lots more objects, play against the clock, and what's more you won't get any more 'Shareware' Nag screens. At just 14.99 it is fantastic value for money! and will give hours of fun!
System
Label1
Ordering Flip! is Simple.
Times New Roman
Q%:O3f
frmOpen
Initializing Flip!
MMControl1
MCI.MMControl
Picture11
Picture10
Picture9
Picture8
<y6PA<O
Init.bmp
*)y..w
Picture7
Picture6
Picture5
Picture4
Picture3
Picture2
Picture1
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
wxxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwx
wwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwww
wwwwwwwwwwp
wwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwwvfff
wwwwwwww
wwwwwwwww
wwwwwwwwwwww
wwwwwwwwwwwwwwwwwwwvfff
wwwwwwwp
wwwwwwwwp
wwwwwwwwwww0
wwwwwwwwwwwwwwwwwwvfff
wwwwwwwp
wwwwwwwp
wwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwvfff
wwwwwwwp
wwwwwwwp
wwwwwwwwwwx0
wwwwwwwwwwwwwwwwwwvfff
wwwwwwwp
wwwwwwp
wwwwwwwwww
wwwwwwwwwwwwwwwwwvfff
wwwwwwww
wwwwwwwp
wwwwwwwwwww
wwwwwwwwwwwwwwwwwvfff
wwwwwwwwp
wwwwwwwwwwwwwp
wwwwwwwwwxx
wwwwwwwwwwwwwwwwvfff
wwwwwwwwwp
wwwwwwwwwwwww
wwwwwwwwwxw
wwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwp
wwwwwwwwwwwww
wwwwwwwwwwww
wwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwp
wwwwwwwwwvfff
wwwwwwwwwwwwwwwwp
wwwwwwwwwvfff
wwwwwwwwwwwwwwwwp
wwwwwwwwvfff
wwwwwwwwwwwwwwwww
wwwwwwwwvfff
wwwwwwwwwwwwwwwww
wwwwwwwvfff
wwwwwwwwwwwwwwwwwp
wwwwwwwvfff
wwwwwwwwwwwwwwwwww
wwwwwwvfff
wwwwwwwwwwwwwwwwww
wwwwwwvfff
wwwwwwwwwwwwwwwwwwp
wwwwwwwwwvfff
wwwwwwwwwwwwwwwwwxp
wwwwwwwwwvfff
wwwwwwwwwwwwwww
wwwwww
wwwwwwwvf&f
wwwwwwwwwwwwwwp
wwwwwwwwwwwwwwwwwwwx
xwwwwww
wwwwwwwwvfff
wwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwww
xwwwwwwwp
wwwwwwwwvfff
wwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwxx
wwwwwwwp
wwwwwwwvfff
wwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwww
wwwwwwwww
wwwwwwwvfff
wwwwwwwwwwwwwwp
wwwwwwwwwwwwwwwwwx
wwwwwwwwp
wwwwwwwwwwwvfff
wwwwwwwwwwwwwwp
wwwwwwwwwwwwwwwwwxwx
wwwwwwww
wwwwwwwwwwwvfff
wwwwwwwwwwwwwwwp
wwwwwwwwwwwwwwwwww
wwwwwwwww
wwwwwwwwwwvfff
wwwwwwwwwwwwwwww
wwwwwwwwwwwwwwwwxx
wwwwwwwwwp
wwwwwwwvfff
wwwwwwwwwwwwwwwwwp
wwwwwwwwwwwwwwwx
wwwwwwwww
wwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwp
wwwwwwwwwwwwwwwww
wwwwwwwwwww
wwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwwwwwww
wwwwwwwwwwwp
wwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxxwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwx
xwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxwxxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww
wxwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwxwwwwwwwwwwwwwwwwwwwwwwwvfff
wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwvfff
Margosa tiglic
~SVWeEp
MKEPEPEPEPj
|PEPEPlP
lP|PEPEPj
|PEPEPlPmlP|PEPEPj
EPEPEPEPj
u~P}4EP~4EE
4XYYY4P}0j
8YP8PO}4j
8Py|4j
}EPEPj
jjjjEP|
}M|M|E
\W|PW|44P{0j
44Pz0j
MzEPEPEPEPj
u4zPPy4EP
z0Eh!A
DEPyEPEPEPEPj
lP|PEPEPj
`yMvyMnyMfy
vSVWeE`
xTP5(C
PwP[0TPj
PvPhLC
PvP.0TPj
j@DPxP
vPPPPj
hPtP4PXPtPtE
jjjjxPt
txPP8tPs
tJtx9tE
sPPPPj
jsPPPPj
:rTPhlC
rP0TPj
qPPPPj
SqPPPPj
2pTPhC
P&pPhLC
jjjjxPo
poxohOA
TPPPPj
XPhPxPj
NoCo8o
]lSVWeE
jjjjEPn
MnMnM{nE
jjjjEPdn
MnMLnM>nE
jjjjEPm
M'nMmMmE
mMmMymE
MwmPkm
MgmEPEPEPEPj
EPEPlEPEPj
EPEPlEPEPj
} jhh@@
} j`h@@
MQjPEj
MAjEPEPEPEPj
} jdh@@
} jXh@@
MmgPhh@
MXgPht@
MCgPSf
EPEPEPj
MfEPEPEPEPj
M?fPh|@
eEPEPj
MeEPEPEPEPj
fEfEf;
dEPdh@
EPEPcf
MdPh|@
EPuDd0}c
McdPUc3
EPEPEPj
McEPEPEPEPj
EPudc0E2
M6cPEP`bMbMbE8
MbPEP"bMbMbE:
EPaPhLC
EPaPYlPj
aEPEPj
EPEPEPpPapPEPEPEPj
EPb`EPEP`P
EPO`P_
EPl_PlPj
R_EPEPEPEPEPEPj
r^M^ED
} jPh@@
fEPEPEPEPj
jjjjEP#]
EPEP\EPEPj
EP[PRlPj
M[EPEPEPEPj
EPEPEPpP~[pPEPEPEPj
EPZPhLC
EP}ZPlPj
cZEPEPj
EPEPEPpPwZpPEPEPEPj
EPqYPhLC
EPbYPlPj
HYEPEPj
M~YPrY
MnYEPEPEPEPj
MXEPEPEPEPj
EP\PQWf
EPEPEPpPWpPEPEPEPj
EPEPVEPEPj
aVlPhC
EPFVPhLC
EP7VPlPj
VEPEPj
M}VPEPUM
4UlPhC
TEPEPj
UPEP@TMTMTEq
EPSPhLC
SEPEPEPj
SM~SMpSEw
jjjjEPFS
MSM.SM SEy
SEPEPEPEPEPEPj
MCRpPEPEPEPj
OSVWeE
EPEPQEPEPj
EPEPEP|PQ|PEPEPEPj
j7lPYP
EPEPEP|P
Q|PEPEPEPj
jjjjEPP
MPMhPMZPE
jjjjEPO
M8PMOMOE
MOEPEPEPEPj
EPEPlPEPNEPcNE
EPEPEPlPj
EPEPDNEPEPj
M8NP,N
M(NEPEPEPEPj
EPEPfLE"
EPEP/MEPEPj
LEPEPEPEPj
|PEPEPEPj
}LMLML
ISVWeE
jjjjEPK
M7LMKMKE
EPEPEPEPJEPEPEPEPj
MJPEPIM!JM
JEPEPEPEPj
GSVWeE
'FSVWeEh
EPEPGEPG
M1HP%H
M!HEPEPEPEPj
GPyhEPj
MFEPEPEPEPj
MsFPgF
McFEPEPEPEPj
EPDPSEPj
MDEPEPEPEPj
EPBP#EPj
.EPEPEPEPj
M;BEPj
W?SVWeE
pPEPEP`PA`PpPEPEPj
EPEP,AEPEPj
M@EPEPEPEPj
EP?PEPEPs?P\Pj
Y?EPEPj
MD?EPEPj
M>EPEPEPEPj
MF>EPEPEPEPj
`PpPEPEPj
M=E$$Pj
;SVWeE`
} jPh@@
@fMq<M;
EPEPEPtPV<tPEPEPEPj
jjjjEP;
M$<M;M;E
EPEPEPtPN;tPEPEPEPj
} jPh@@
M=:Ph@
M(:Pu5C
90"9EE
fEPEPEPj
M9PEP8M=9M/9E
9EPEPj
} jPh@@
M7Pu5C
d6pP5C
)6EPEPEPEPEPj
EPEPEPtP56tPEPEPEPj
jjjjEP5
M5M}5Mo5E
} jPh@@
MJ4P>4
M:4EPEPEPEPj
jjjjEP3
M3M3Mv3E
} jPh@@
fM^2M1MH2
p0EPEPj
0EPEPj
M0PEP/M20M$0E"
jjjjEPe.
M.MM.M?.E*
EPEPEPtPA.tPEPEPEPj
i-pPhC
EPN-PhLC
%-EPEPj
$sK-E.
EPEPEPtP,tPEPEPEPj
+sV,E6
M>,P2,
M.,EPEPEPEPj
EPEP~*EPEPj
M)EPEPEPEPj
REPEPEPEPEPj
M|(tPEPEPEPj
j,X%SVWeE
M(PEP'M (M
!%SVWeE
0``PEP&E
EPEP 'EPEPj
M&EPEPEPEPj
uuP&0e%
MK&P[%
@fpMQ%
M7%PG$
huE\h0C
0uu[$0#
Mz$Pf#EE
EP#PhLC
q#EPEPEPj
M#EPEPEPEPj
}"EP58C
H"EPEPj
@EPEPEPEPEPEPj
SVWeEP
Mq!PEP M
EPEPy EPEPD Pl f
MR EPEPj
EPEPj
MP MB E
&EPEPj
jjjjdP
j@ PdPh
fxP|PPj
xP|PPj
tPxP|PPj
DPTPdP4P|
4PDPTPdPj
jjjjdP
tPxP|PPj
tPxP|PPj
[tPxP|PPj
4PDPTPdPj
EPEPEPj
"EPEPEPj
SVWeE(
jjjjEPC
lPEPEPL
jjjjEP+
EPEPEPEPj
jjjjEP
j@lPEP|
EPEPEPEPj
EPEPEPj
ESVWeE
EPEPEP|P
|PEPEPEPj
EPEPEP|PO
|PEPEPEPj
EPEPEPEPj
uZ@u+@Pu
EP}PDPEP
EPEPEPEPEPEPEPEPj
EPPDPO$
EPmPDP#
EPEPEPEPj
HEPEPEPEPEPEPEPEPj
$|PEPEPEPj
DSVWeE
jjjjEPY
MMAM3E
M6PEP`MME
MEPEPEPEPj
pPEPEP`P
`PpPEPEPj
PEP1MME
EPEPEPEPj
pPEPEP`Pp`PpPEPEPj
jjjjEP
M(MME-
jjjjEP
jjjjEP
MUMME3
jjjjEP
MMMxE8
EPEPEPPEP
MEPEPEPEPj
`PpPEPEPj
jTXSVWeEx
jjjjEP
EPEPhEPEPj
M;EPEPj
MSVWeE
EPPhLC
EPPoEPj
jEPEPj
EPPhLC
EPP\oEPj
jjjjEP
MPEPM`MRE
EPPsmEPj
PEPCMMh
&EPEPj
SVWeE @
EPEPEPEPj
PEPCMME
MjEPEPEPEPj
EPu`PEP?u
MkEPEPj
EPuuGEE
EPEPlPPEPpP P
MpPEPEPEPj
EPEP!EPEPj
jjjjEP
EPEPEPpPpPEPEPEPj
MxPEPM
MEPEPEPEPj
pPEPEPEPj
SVWeE @
PEPEMME
EPqPhC
EPbPcEPj
yEPEPj
.EPEPj
MMNEPj
bSVWeE @
MEPEPEPEPj
M PEPIMME
d\Ph@C
EP[PhC
EEPEPj
jjjjEP*
EPEPEPEPj
EPP]\Pj
MrEPEPEPEPj
EPPhLC
EPxP[\Pj
^EPEPj
jjjjEPI
MM1M#E
jjjjEP
@\PhdC
EP%PhLC
pPEPEP`P`PpPEPEPj
MEPEPEPEPj
MPEPMNM@E-
4 [hcB
IEPEPEPEPj
`PpPEPEPj
SVWeE @
jjjjEP
MEPEPEPEPj
EPPcTtPj
EP@PRtPj
&EPEPj
EPEPEPxPFxPEPEPEPj
]tP5(C
EPNPQtPj
FEPEPEPEPj
xPEPEPEPj
SVWeEX!@
MPEPM`MRE
EPtPhLC
EPePOTEPj
EPEPEPEPbEPEPEPEPj
EPOPNEPj
EPPhLC
wEPEPj
MHEPEPEPEPj
EPPhLC
EPPNLEPj
MEPEPEPEPj
EPPhLC
EPEPEPEPj
EPPoIEPj
@EPEPEPEPj
EPEPEPEPj
SVWeE!@
xPEPEPhP-hPxPEPEPj
MPEP MME
EPEPEPEPj
dPuh\C
EPvPEdPj
HPDPEPEP
MEPEPEPEPj
hPxPEPEPj
SVWeE0"@
PEP7MME
EPEP EPEPj
jjjjEPR
MM:M,E
EPEPEPEPj
EPEPEPEPj
EPEPEPEPj
xPEPEPhPFhPxPEPEPj
jjjjEP
MHM:E4
]EPEPEPj
PEP~PEP
EPEPEPEPj
xPEPEPhP
hPxPEPEPj
EPEPtEPEPj
M;EPEPEPEPj
jjjjEPo
MWMIEY
xPEPEPhP(hPxPEPEPj
xPEPEPhP
hPxPEPEPj
jjjjEP
jjjjEP
MrMdEb
MOEPEPEPEPj
xPEPEPhP
hPxPEPEPj
EPEPEPEPj
MeEPEPEPEPj
xPEPEPhP
hPxPEPEPj
xPEPEPhPmhPxPEPEPj
xPEPEPhP
hPxPEPEPj
xPEPEPhP
hPxPEPEPj
jjjjEP
jjjjEP
jjjjEP
jjjjEP*
jjjjEP
PEPMSMEE
xPEPEPhP
hPxPEPEPj
Pj4u!0
jjjjEP
jjjjEP
EPEPEPEPj
jjjjEP?
EPPEPPxPhPPPXP
P(P8PHPXPhPxPEPEPj
EPEP{EPEPj
MBEPEPEPEPj
jjjjEP>
xPEPEPhPhPxPEPEPj
EPEPSEPEPj
jjjjEP
nEPEPj
jjjjEP
EPEPEPEPj
M-PEPWM
EPEPEPEPj
EPEPgEPEPj
EPEP4EPEPj
M PEPIM
jjjjEPZ
MKPEPuMM
M.M E
EPEPEPEPj
xPEPEPhP
hPxPEPEPj
M)PhL@
EPEPxP
PPhPPXPHP
P\PPPHPD
EPEPEPEPEPEPj
P(P8PHPXPhPxPEPEPj
EPEPEPEPj
EPEPEPEPj
jjjjEPT
M<M.E0
EP PhLC
EPEPxPZPhPXPFPPHP2P.
HPXPhPxPEPEPj
M8EPEPEPEPj
EPEPEPEPEPEPj
P(P8PHPXPhPxPEPEPj
M/M'EPj
0SVWeE0'@
EPEPXEPEPj
MDPEPnM
EPEPEPpP
pPEPEPEPj
MRPEP|MM
EPEPEPpP
pPEPEPEPj
EPFPhLC
EPEPEPj
jjjjEP
EPEPEPEPj
EPEPBEPEPj
EPePEPoP
EPPhLC
EPEPEPj
EPEPEPEPj
EPQPhLC
EPBPlPj
(EPEPj
u.PEP@E#
EPEPEPEPj
uuu 0Y
EPEPEPEPj
\PEP}EP!
PEP.~M~M~E,
uuu~0}
EP}PhLC
}EPEPEPj
M}uuuy}0|
M}PEPEP{
EPEPEPEPj
jjjjEP|
M'}M|M|E0
jjjjEP|
M|M|Mr|0
EPP|uuK|d
\PEPW{EP
|EPEPzU{M{E6
DylPhC
EP)yPhLC
yEPEPEPj
M8yP5C
M"yuuux0
yPEPEP6w
EPEPEPj
EPEPewEPEPj
uuu8w0qv
MWwPCvd
wvlPhC
EP\vPhLC
EPMvPlPj
3vEPEPEPj
MTvP5C
M>vuuu
M vPEPEPRt
EPEPEPj
M.tP"t
tEPEPEPEPj
uuus0r
EPrPhLC
EPrP.lPj
rEPEPEPj
Mruuukr0q
MrPEPEPp
EPEPEPj
EPEPEPpP
rpPEPEPEPj
MqEPEPEPEPj
EPEP.qEPEPj
MzpPfoT
EPoPhLC
EPsoPlPj
YoEPEPEPEPEPEPj
MToP5C
M>oP*nd
EPmPhLC
EPmPRlPj
mEPEPEPEPEPEPj
jjjjEPm
MmMmMmEV
EPlPhLC
EPlPflPj
lEPEPj
EPEPEPpPlpPEPEPEPj
MlPEP&
EPEPEPpP9lpPEPEPEPj
lPEPFkMkMkE[
MkPEPjM[kMMkE^
MjkP5C
MTkP@jd
EPiPhLC
EPiPhlPj
iEPEPEPEPEPEPj
VilPhC
EP;iPhLC
EP,iPlPj
iEPEPj
MMiP5C
M7iPEP>#
MhPEP"
EPEPEPpP_hpPEPEPEPj
EPfPhLC
tfEPEPEPEPEPEPj
MfEPEPEPEPj
EPePhLC
EPsePlPj
YeEPEPj
EPEPheEPEPj
MxeP5C
MbePEPi
EPEPEPpPdpPEPEPEPj
EPEPEPpP
dpPEPEPEPj
M]cP5C
MGcP3bd
gblPhC
EPLbPhLC
EP=bPlPj
#bEPEPEPEPj
jjjjEP"b
bEPEPEPEPEPEPj
pPEPEPEPj
maMaM{aEPj
^SVWeE )@
EP`P_d
_lPh$C
EP_PhC
EEPEPEPj
EP]PhC
EEPEPj
EPpP]pPEPj
-\EP[4
[lPhpC
EP[PhC
EP[PFlPj
[EPEPj
M[EPEPEPEPj
M6[P*[
M&[EPEPEPEPj
EPZuuZPY
hYlP5C
EPYYPlPj
?YMmYE
XlPhDC
EPXPhC
XEPEPj
WlPhDC
EPWPhC
EPWP]lPj
WEPEPj
EPEPVE
XPEPAWMWMWhkB
oWEPWEPEPEPEPj
>TSVWeE)@
EPTPU\
EPXh8C
EPTEPEPTdPEPEPlTPhU
MUEPEPEPEPj
jjjjEPiU
MUMQUMCUE
UEPEPEPEPEPj
RSVWeE
EPEPkTEPEPj
jjjjEPS
M.TMSMSE
MSPujh
pMQEPu
EPQEPR
MhSEPEPj
EPEPEPEPREPEPEPEPj
MURPEP
QMQMQE
MQEPEPEPEPj
MQPujh
5EPEPEPEPj
EPEPEPEPj
tMSVWeE*@
PM3NEPh
MOMuOE
EPEPKOEPEPj
jjjjEP
MTOMNMNE
,N`PhC
EPEPMEPEPj
mL`PhdC
EPRLPhLC
tPEPEPdP
LdPtPEPEPj
$KEPJH
JEPVJ8
JEP!J(
EPjJPhLC
EP[JP`Pj
AJEPEPj
jjjjEP,J
MIEPEPEPEPj
MnIPEPHM
}H`PhdC
EPbHPhLC
HEPEPEPEPj
MGPEPFMOGMAGE*
GEPEPj
!F+VPPEPEEP5F
MFM_FE3
MFPEPEM;FM-FE4
IEPEPEPEPj
dPtPEPEPj
MEMEME
BSVWeE+@
DEP5HC
EPcDPDEPj
EPEPVDEPEPj
EPEPeBPEPoCPBE
EPBPhLC
EPEPEPj
EPAPhLC
EPAPJDEPj
4EPEPEPj
>SVWeE+@
M@Mf@EPEPj
?EPh<C
EPk?PhLC
fPEPEPj
Y>EP5C
EPEPEPEP >EPEPEPEPj
8EPEPj
EPEPEPEPj
s:SVWeEH,@
<PEPU<EPLPm;LPEP;Mo<E
`PpPEPPP#<PP`PpPEPj
jjjjEPh;
M;MP;MB;E
M9;P-;
M);EPEPEPEPj
`PpPEPPP9PP`PpPEPj
9pPEPj
8M}8Mo8E
M7EPEPEPEPj
MU7PI7
ME7EPEPEPEPj
M6EPEPEPEPj
p{/6E&
j@<PEPz5EPw5
MP5PD5
M@5EPEPEPEPj
LEPEPEPEPj
PP`PpPEPj
f1M|1Mt1
.SVWeE`-@
jjjjEP0
M0M0Mt0E
jjjjEPI0
M0M10M#0E
M/EPEPEPEPj
EPEP.EPEPj
EPEPEPEP.EPEPEPEPj
5EPEPEPEPj
EPEPEPEPj
jpX&+SVWeE-@
jjjjEP
M-Mg-MY-E
Mq-Pe-
Ma-EPEPEPEPj
+PV,EE
M,EPEPj
jjjjEP
MQ,M+M+E
EPEP+EPEPj
M+EPEPEPEPj
u(SVWeE0.@
hPxPEPXP*XPhPxPEPj
EPxPB*xPEPj
jjjjEP
MH)M(M(E
jjjjEP(
M(M(M(E
EP'PhC
EP'P_ TPj
4M'EPEPj
jjjjEP'
M'M'M{'h
Mb'EPEPj
M&XPhPxPEPj
$SVWeE.@
EPEPEP
EPEPEP%P1
jjjjpPx%
M%M`%pO%E
u\%Px$
PP`PpP@P$@PPP`PpPj
DPl#EE
M5$P)$
M%$EPEPEPEPj
PP`PpP@Pj#@PPP`PpPj
#EPEPEPEPj
@PPP`PpPj
"M"M"EPj
SVWeE.@
jjjjEP
MP"M!M!E
EPEPEPEP!EPEPEPEPj
f44P/EE
XPEPEP PEPEP PHPxP P8PhPv Pr
M hPxPEPEPEPEPj
Mc Pm
MS M E
EPEPN EPEPj
EPEPEPEP
EPEPEPEPj
PEPEPU
PHPEPD
EPEPEPEPj
jjjjEP9
EPEPEPEP
EPEPEPEPj
EPEPEPEPj
XPEPEP
EPEPEPEPj
XPEPEP
EPEPEPj
EPEPEPEP
EPEPEPEPj
f4uh,@
EPEPEPEPj
jjjjEP
EPEPEPEP
EPEPEPEPj
jjjjEP
EPEPEPEPj
hPxPEPEPEPEPj
SVWeE/@
EPEPEP
\PlP|PEPEPEPj
EPEPEPj
lP|PEPEPEPj
j(nGEE
EPEPEP
PHP|Pw
|PEPEPEPj
jjjjEPA
EPEPEP|P
|PEPEPEPj
EPEPEP
|PEPEPEPj
jjjjEP
EPEPEPj
\PlP|PEPEPEPj
SVWeEP0@
EPEPEP
jjjjEP`
EPEPEPEPj
SVWeE0@
EPEPEPEPj
|PEPEPlP
lP|PEPEPj
|PEPEPlP
lP|PEPEPj
EPEPEPEPj
lP|PEPEPj
SVWeE0@
EPEPEPEPj
jjjjEP
.EPEPEPEPj
SVWeEP1@
EPPhLC
EP{P}EPj
dEPEPj
MPEPM^MPE
EPPhLC
EPP1}EPj
MEPEPEPEPj
|PEPkj
EPEPPE
EPPhLC
EPPS{EPj
EPGPhLC
EP8PzEPj
!EPEPj
EPEPEPEPj
EPEPEPEPj
wEPEPj
EPPtxEPj
EPEPEPEPEPEPEPEPj
EPPvwEPj
MGPEPqMME
MEPEPEPEPj
EPPhLC
uEPEPj
MPEPMZMLE+
EPPhLC
EPP-tEPj
M6EPEPEPEPj
@EPEPEPEPj
EPEPEPEPj
j`XSVWeE@2@
EPPKqEPj
SVWeE2@
MXEPEPEPEPj
MEPEPEPEPj
MPEPM+M
jjjjEP
,P0Pf88P/EE
EPEPEPP\PEP{PLP|PgPc
M|PEPEPEPj
jjjjEPa
MMIM;E
,P0Pf8u
MGPQEE
$P(P;d
EPEPEPCP\PEP2PLP|P
MMJ|PEPEPEPj
EPEPEP|P)|PEPEPEPj
EPEPEPEPj
,P0Pf88PEE
$P(PMd
EPEPEPUP\PEPDPLP|P0P,
M|PEPEPEPj
MnPEPM
,P0PQf8u
EPEPEP
P\PEPPLP|PP
|PEPEPEPj
MEPEPEPEPj
,P0Pf8u
$P(Pzd
EPEPEPP\PEPqPLP|P]PY
MM|PEPEPEPj
EPEPEP|Pc|PEPEPEPj
,P0P[f88P
f44P~EE
EPEPEP
P\PlPP
MulP|PEPEPEPj
,P0PNf8u
$P(Pf44P^EE
EPEPEPPEP|PP\PlPP
MUMlP|PEPEPEPj
$P(Pf44P!EE
EPEPEPPEP|PP\PlPP
MlP|PEPEPEPj
,P0Pf8u
MpPzEE
$P(Pdf44P
EPEPEP_PEP|PNP\PlP:P6
MMflP|PEPEPEPj
MDEPEPEPEPj
EPEPEPEPj
,P0Pf88P,EE
$P(Pf44PEE
EPEPEP|PEP|PkP\PlPWPS
MlP|PEPEPEPj
,P0Pf8u
M_PiEE
$P(PSf44P
EPEPEPNPEP|P=P\PlP)P%
MMUlP|PEPEPEPj
jjjjEP
MCMME-
,P0P0f8u
$P(Pf44P@EE
EPEPEPPEP|PP\PlPP
M7MlP|PEPEPEPj
EPEPEPEPj
,P0Pf8u
MoPyEE
$P(Pcf44P
EPEPEP^PEP|PMP\PlP9P5
MMelP|PEPEPEPj
,P0Pf8u
MGPQEE
$P(P;f44P
EPEPEP6PEP|P%P\PlP
MM=lP|PEPEPEPj
q"0h`C
MEPEPEPEPj
lP|PEPEPEPj
SVWeEp3@
d)dPhPlPpPj
jjjjTPa
ppCT2E
4PDPTP$P$P4PDPTPj
jjjjTP
ppdTSE
dAdPhPlPpPj
TTPuDPxDP
MTDPTPj
TPDPDPTPj
TPP`fP2
ujMjh
4PDPTP$P$P4PDPTPj
4PDPTP$P$P4PDPTPj
dAdPhPlPpPj
jjjjTP
p6pTE<
pPTPpNT=EB
lP?PhLC
pP-PO Pj
TPDPDPTPj
pPPiN Pj
TPDPDPTPj
[dPhPlPpPj
$P4PDPTPj
MMMMMMMMMMMMMMMM|wxl
j|XSVWeE4@
EPEPEPEPj
MEPEPEPEPj
EPPJxEPj
8EPEPEPEPj
>SVWeE
MpPhT@
M[Phd@
EPEPEPEPEPEPEPEPj
tEPuhLC
EPYPGEPj
HPdPEPEP
MEPEPEPEPEPEPEPEPj
$MyEPj
MkEPPPj
pSVWeEH5@
EPPOETEPj
jjjjEP
MM{MmE
MP4M:E
EPEPEPEPEPEPEPEPj
.M EPEPEPEPj
SVWeE5@
jjjjPp
PP^ALPj
jjjjPw
PPPPPPPPj
SVWeE06@
jjjjEPI
MM1M#E
P=@tPj
jjjjEPn
EPEPEPxP
xPEPEPEPj
jjjjEP3
EPEPEPEPj
PEPMoMaRE
EPEPPEPEPj
APEP1EPF
MRMDE
EPdPEP
M<EPEPj
EPEPEPEPj
EPEPEPEPj
xPEPEPEPj
jjjjEPJ
|PEPEPlP lP|PEPEPj
jjjjEP
EPbPhC
EPSP4$hPj
3$EEPEPj
j@XPEP
M)EPgEPEPj
EPEPEPEPj
IEPEPEPEPj
lP|PEPEPj
SVWeE7@
pPEPEP`P
`PpPEPEPj
EPEPEPEPj
pPEPEP`P
`PpPEPEPj
EPEPEPEPj
pPEPEP`P!`PpPEPEPj
pPEPEP`P
`PpPEPEPj
EPnPhC
EEPEPj
jjjjEP=
pPEPEP`P
`PpPEPEPj
EPWPhC
EPHP*\Pj
.EPEPj
EPEP=EPEPj
MEPEPEPEPj
IEPEPEPEPj
`PpPEPEPj
CSVWeE(8@
`PdPv\E
xPEPEPcP_
MEPEPEPj
EPEPEPEPrEPEPEPEPj
MEPEPEPEPj
SVWeEx8@
MvEPEPEPEPj
0P4PYfEE
EPEPEPxP
xPEPEPEPj
M8P4Px
EPEPEPEPEPEPj
MfEPEPEPEPEPEPEPEPj
-$EPEPEPj
EPEPEPEPj
EPEPEPEPEPEPj
M6P4Pt
EPEPEPEPEPEPEPEPj
g$EPEPEPj
MCEPEPEPEPEPEPEPEPj
$EPEPEPj
M1P4Pq
MEPEPEPEPEPEPEPEPj
$xPEPEPEPj
EPEP3EPEPj
MTEPEPEPEPEPEPEPEPj
$xPEPEPEPj
jjjjEP
M@EPEPEPEPj
jjjjEP
M=P0Pm
EPEPEPEPEPEPj
M:P0Pl
MEPEPEPEPEPEPEPEPj
$EPEPEPj
MBEPEPEPEPEPEPEPEPj
]$xPEPEPEPj
SVWeE@9@
EPEPEPxPxPEPEPEPj
dPTPDP P0PEP
dPEPEP@P@
EPEPEPxP-xPEPEPEPj
jjjjEP
EPdPEPHP
EPdPEP
P0PEP4
xPEPEPEPj
SVWeE9@
EPKPhC
SVWeE
}u9=<C
QQSVWeE :@
4SVWeE0:@
VPR9=<C
VPEURP
WP|Mn=<C
VP6=<C
VPEURP
WPYMKE
QQSVWeE@:@
\SVWeEH:@
PEP9MQW
>EPEPPV
MqEPEPEPj
EPEPEPj
SVWeEX:@
}}}}|lhu
$VSt;}
VPEPEPj
hWEEh@
P|PEPDPlPEP3PQ
$SV|;}
SPEPEPEPj
EPEPEPEPEPj
,SVWeEh:@
PEP}EU
MpEPEP
EPEPPPxMf
oMa}hCC
SVWeEx:@
EEEEEET
XMEEEMPEPEPEPPEP
TM\TEPEPj
tEPtP0f
PEPEhxC
PEP40PEhC
PP6EPEP
PEPaEh,C
PPu6EPEP
PEPEh<C
6EPEP%PP
PEPw0PEhC
SPPMdM
PEP]EhLC
PPq6EPEP
PEPEh\C
PP6EPEP!PP
PEPsEhlC
SPP~MI
SPPo~M~MY~
SVP(~M
6EPEP<~PP
SPP}M?~M}M)~
PEP~EhC
PP~6EPEP}PP
SPPN}M}M8}M}
P3~>EPEPX}PV
SVP|Me}M|MO}E
#M?}M|EPEPj
SVWeE:@
4SVWeE:@
VP.{9= C
VPzEURP
WPRzMDz= C
S<z5 C
VPyEURP
WP5yM'yE
0SVWeE:@
3W]]]4
PEPyjV
VP{xMmx
U[yPEuPd}
yPuSd}
ExPuSd}
ExPuSd}
uPLwM>w
E<xPuSd}
EwPuSd}
uPvMvw
EwPuSd}
uPrvMdvsw
E]wPuSd}
wPuSd}
uPuMuv
VVEvPuSl}
uPuMu~v
VVE{vPuSl}
uPDuM6u
VVE5vPuSl}
VVVEuPuSd}
VVVEuPuSd}
uPttMft
VVVEfuPuSd}
uP/tM!t
VVVE!uPuSd}
VVVEtPuSd}
VVVEtPuSd}
uP`sMRs
VVVERtPuSd}
tPuSd}
VVVEsPuSd}
VVVEsPuSd}
uPLrM>r
VVVE>sPuSd}
VVVErPuSd}
VVVErPuSd}
uP}qMoq
VVVEorPuSd}
uP8qM*q
VVVE*rPuSd}
VVVEqPuSd}
VVVEqPuSd}
jdSuPhp
UPqPEuPd}
PEPp0E
SuPoMIpMo
PEPp0E
SuPxoMoMbo
PEPKp0E
SuP#oMoM
PEPoEh
p6EPEP2oPu
SuPnM;oMnM%o
PEPoEh,C
Puo6EPEPnPu
SuPSnMnM=nMn
Pu5o6EPEPZnPu
SuPmMcnMmMMn
PEPn0E
PEP]n0E
SuP5mMmM m
SuPlM\mMl
PEPmEhLC
Pum6EPEPlPu
SuP|lMlMflMl
PEPGmEh\C
Pu^m6EPEPlPu
lMlMkMvl
PEPlEhlC
Pul6EPEP
SuPkM lMkM
PEPol0E
SuPGkMkM1k
SuPjMnkMj
SVPjMj
PEPkEhC
Puk6EPEPjPu
SuPOjMjM9jMj
Pu1k6EPEPVjPu
SuPiM_jMiMIj
PEPjEhC
Pj>EPEPiPV
SVP~iMiMhiMiE
MiMBiMi
QQSVWeE:@
3f9N6u
fF4fF4f=
f~6f9~6u
HfF4f9~4u
DSVWeE:@
VPg=4C
SWg54C
VPg=4C
WPfMfj
,SVWeE:@
USER32.DLL
MSVBVM60.DLL
KERNEL32.DLL
GDI32.DLL
ADVAPI32.DLL
COMDLG32.DLL
GdiGetBatchLimit
GetVersion
GetMessagePos
RevertToSelf
CommDlgExtendedError
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
__vbaPut3
_adj_fdiv_m64
__vbaPut4
_adj_fprem1
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaLenBstrB
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaVarForInit
__vbaVarPow
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
__vbaStrFixstr
_CIsin
__vbaErase
__vbaVarZero
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaGet3
__vbaAryConstruct2
__vbaVarTstEq
__vbaPutOwner3
__vbaObjVar
DllFunctionCall
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaFpCmpCy
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaInStrVar
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaGetOwner4
__vbaI2Var
_CIlog
__vbaFileOpen
__vbaInStr
__vbaNew2
__vbaVar2Vec
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
__vbaDerefAry1
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
__vbaVarTstNe
__vbaI4Var
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaFpI4
_CIatan
__vbaStrMove
__vbaAryCopy
__vbaI2ErrVar
__vbaStrVarCopy
_allmul
__vbaLateIdSt
_CItan
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeStr
__vbaI4ErrVar
__vbaFreeObj
~zt/vlgeiKKx
&u9>>N[WWTPWf
).6<JIEVB_BVs
#'45IIBBBBBB|
445FE@BBBB_
'14DDF@BBBBd
*13FE@ABB_f
113DFGBBBCg
''+3+EGQSC_
'1+FFGQS_bn
''33EGRTab
'15FHV`bfl
'*FIIWdfgl
'*2IUdgfk
'45Pcgkel
(45Zgkeh
(:Imh]]
(:=hhZh
!.=^^\^l
!:N^[X^j
)>OYL^^
,,,,,,,,,,,,,,,,--,,,,,,,,,,,,,,--,,,,,,,,,
6E7B76674/6e6647Bde
666667677fmjCefe}jelkll}}
80667887fgg7eeeelj}j
4/00088effeeejljj}
z/335>keEDDEeee}}
y.35CeD><<;<>Dellll{i{
2211!119::=?????``ah|
'((''''($***" "KKKUtUVY
##KKKK
HTSFXX
%MMM&L
LLNJFIII[c\Rb~
&QQQQQQHRJGIW
OZZrunn_
@@@PQQZv
)@_nruv
)@_qsuw
^^^^^^^^
]]]]]]]]^^^]]]^^]]]
+++++++++++(
CC?<866565558644
~~~X~!
lmS.Skp]])&$
Rc/,Gefoq\3\j]7
SQR,,FRdlllS.Thnp[W=
-JQccRl
HdefohUUgj=
KJP`aS3
-`bRddH-,de=
'/_PQR
67::777=
=A%"A+
j`NMMLE
pkefbE
222222222532222222222222222&"
_____e____jg_______________O:+
_____bg____nk\RO____________O-
2222225822ERXZY*222222222222F+!
_____ORXROQRZ]
j____________O+
_e__QX[[]YYRFRg
k____________+
222FFOQXZ]]XOEOXH?222EE2222222
eeRQFORX[bggZXQY]oj_WOOR______
e[[[QFEFOX]b]XQQej
]XRORe_e]e_
44FFF42DFFXZ]XF222\ZXFEE222322
eXXe_eddeRX\bb_e_R\aa\Q_]___\\
eeedeee_e_dX\
je_eX]a]_\__]\_e
44444424244228A522FO\ZQ2222222
eeeeeeedde\dddpqjeRXaaaY______
eleeeejeeede_eeok\ROXbaZR___ee
=666666?44444245ZYXFOXZYO22222
eeeeeegljdee\edekgbYXY]a]X]\ee
ppepepgqljedeeeegnb\XRZaa]_e_e
66=6=6=GIAC644442>AYQFOXZ?2O22
pepeepeenqjgeeeeeekbbYRYgoaYXe
plepmepeqo
jeeeeeeenb]Xe_]aaYe
6==6==6=>CGI==444446]Y22OWZZX2
plpepepepl
ojeeeeee_j
nYXR]bqe
peppppepeqn
jpeeeeeeej
`XWXgqn
====6=====CJI>===55246GZWF225I
pppmpmpepeqn
jeeeeeeeegcbdddek
pppeplppepe
peleeeee\bclee_d
@==C=======>IJC=5<=45OQYA?624)
ppeppepj
njeedd[XXeejn\_0
ppeppeqn
qele[X[eddejgU.
@==@CCC======CJI><X[N752442*%
ppmpepn
ppeppep
qpppepeqqpmmM
ppmpplpepp
qqqpmmeplpg
qppmppmeppj
V \ppU
_peU jqj#
V _ppU
++++++(
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
A A A A A A
A A A A A A A A A A A A A A
A A A A A A
A A A A A A A
A A A A A A A A
A A A A A A
A A A A A A A A
A A A A A A
A A A A A A A A A
A A A A A A
A A A A A A A
A A A A A A A A
B B B B B B B B B
B B B B B B
B B B B B B
B B B B B B B B
B B B B B B
e m g k g t g n n m n m n i n i g t h k g o g g g v m k h i n j g g n v m
H e i g h t
@ r X P \ D e s k
C l e a r S c o r e T a b l e
A r e y o u s u r e ?
J a y S o f t
S e q u e n c e r
' ' ' ' ' ' ' ' ' ' ' '
j j j j j E
F E M Y I H R 4
i I E M J N Q S ` a M S [ o ` g v | S ^ T Z Y \ _ c r e b i l l i m e n q } a h n h a q t q ~ x e o c i n r v y | q z s u z } ^ [ [ _ a c d a f j q u x } y | n b e ` e k i l q { u z y t { b i g k r q u p t x x } y ~ y z | x { ~
q 0 < \ S W W \ E I J N ] ^ R W Z [ a m o c d e a h k q q c d a c c c d k r d j u u v x v t x F Q Y V
} c j p s x
5 4 : E L R X f | w l m e y y
z d K [ o d y z
| w q Y b k y z
/ P 6 p L
, / K P i p
/ - P ? p R
V S _ V E R S I O N _ I N F O
V a r F i l e I n f o
T r a n s l a t i o n
S t r i n g F i l e I n f o
0 4 0 9 0 4 B 0
P r o d u c t N a m e
o v e r m o s t
F i l e V e r s i o n
P r o d u c t V e r s i o n
I n t e r n a l N a m e
J o y a n t
O r i g i n a l F i l e n a m e
J o y a n t . e x e
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.