1.0
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.63
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Kryptik-MCR [Trj] | 20200121 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_90% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200122 | 2013.8.14.323 |
| McAfee | Dropper-FGJ!9857DC173DDA | 20200121 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0c534 | 20200122 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | AUTO |
| section | DGROUP |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 53 个反病毒引擎识别为恶意
(50 out of 53 个事件)
| ALYac | Gen:Variant.Ulise.93519 |
| APEX | Malicious |
| AVG | Win32:Kryptik-MCR [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.93519 |
| AhnLab-V3 | Trojan/Win32.Dofoil.R70806 |
| Arcabit | Trojan.Ulise.D16D4F |
| Avast | Win32:Kryptik-MCR [Trj] |
| Avira | TR/Crypt.ZPACK.Gen7 |
| BitDefender | Gen:Variant.Ulise.93519 |
| BitDefenderTheta | AI:Packer.E55E0DC51E |
| CAT-QuickHeal | TrojanDropper.Gepys.A |
| CMC | Trojan.Win32.Swizzor.1!O |
| ClamAV | Win.Packed.Shipup-7093166-0 |
| Comodo | TrojWare.Win32.Gepys.AC@50ivv5 |
| CrowdStrike | win/malicious_confidence_90% (D) |
| Cybereason | malicious.73dda0 |
| Cylance | Unsafe |
| Cyren | W32/Gepys.BD.gen!Eldorado |
| DrWeb | Trojan.Mods.1 |
| ESET-NOD32 | a variant of Win32/Kryptik.BDPS |
| Emsisoft | Gen:Variant.Ulise.93519 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Gepys.BD.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.ZPACK.Gen7 |
| FireEye | Generic.mg.9857dc173dda06d3 |
| Fortinet | W32/Kryptik.BCX!tr |
| GData | Gen:Variant.Ulise.93519 |
| Ikarus | Trojan.Win32.ShipUp |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.axjmj |
| K7AntiVirus | Trojan ( 0040f4c81 ) |
| K7GW | Trojan ( 0040f4c81 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=84) |
| McAfee | Dropper-FGJ!9857DC173DDA |
| McAfee-GW-Edition | BehavesLike.Win32.Dropper.dh |
| MicroWorld-eScan | Gen:Variant.Ulise.93519 |
| Microsoft | Trojan:Win32/Skeeyah.HK!MTB |
| NANO-Antivirus | Trojan.Win32.Mods.cqkuys |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM20.1.BB27.Malware.Gen |
| Rising | Trojan.Crypto!8.364 (RDMK:cmRtazrR02aVSQDs/mgxyWvtmtZr) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-ACIZ |
| Tencent | Malware.Win32.Gencirc.10b0c534 |
| Trapmine | malicious.high.ml.score |
| VBA32 | Trojan.ShipUp |
| VIPRE | Trojan-Dropper.Win32.Gepys.ag (v) |
| Yandex | Trojan.ShipUp!RlkGr7o7joI |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2011-01-24 08:48:26
PE Imphash
7c554523406a4294ad6f595a52c6bbf7
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| AUTO | 0x00001000 | 0x00002461 | 0x00002600 | 6.5162517100239 |
| DGROUP | 0x00004000 | 0x00057ac8 | 0x0002f200 | 6.531052382447291 |
| .idata | 0x0005c000 | 0x00000518 | 0x00000600 | 4.644624748348364 |
| .reloc | 0x0005d000 | 0x00000000 | 0x00000400 | 5.742434321489792 |
| .rsrc | 0x0005e000 | 0x00000000 | 0x00000600 | 2.8571470008302873 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_DIALOG | 0x0005b2f0 | 0x00000148 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x0005b2f0 | 0x00000148 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x0005b2f0 | 0x00000148 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library OLE32.DLL:
• 0x45c100 CLSIDFromProgIDEx
Library KERNEL32.DLL:
• 0x45c108 GetLocalTime
• 0x45c10c GetProcAddress
• 0x45c110 GetTickCount
• 0x45c114 LoadLibraryA
• 0x45c118 VirtualProtect
• 0x45c11c lstrcatA
Library ntdll.dll:
• 0x45c124 DbgPrint
• 0x45c128 NtClose
• 0x45c12c NtCreateFile
• 0x45c130 NtOpenKey
• 0x45c134 NtOpenProcessToken
• 0x45c138 NtOpenSymbolicLinkObject
• 0x45c13c NtQueryInformationFile
• 0x45c140 NtQuerySymbolicLinkObject
• 0x45c144 NtQuerySystemInformation
• 0x45c148 NtQuerySystemTime
• 0x45c14c NtQueryValueKey
• 0x45c150 NtQueryVirtualMemory
• 0x45c154 NtSetInformationFile
• 0x45c158 NtTerminateProcess
• 0x45c15c NtWriteFile
• 0x45c160 RtlAllocateHeap
• 0x45c164 RtlAnsiStringToUnicodeString
• 0x45c168 RtlDosPathNameToNtPathName_U
• 0x45c16c RtlExpandEnvironmentStrings_U
• 0x45c170 RtlFreeHeap
• 0x45c174 RtlFreeUnicodeString
• 0x45c178 RtlInitAnsiString
• 0x45c17c RtlInitUnicodeString
• 0x45c180 RtlLengthSid
• 0x45c184 RtlPrefixUnicodeString
• 0x45c188 RtlSizeHeap
• 0x45c18c RtlUnhandledExceptionFilter
• 0x45c190 RtlUnwind
• 0x45c194 RtlUpcaseUnicodeString
• 0x45c198 _wcsicmp
• 0x45c19c sprintf
• 0x45c1a0 swprintf
• 0x45c1a4 wcslen
• 0x45c1a8 DbgBreakPoint
L!This is a Windows 95 executable
`DGROUP
.idata
.reloc
B.rsrc
PYSQRVW\
_^ZY[Wx
-F;NUw
l_^ZYSQR
YZY[VW@
t VVLl
L_^QRj
ZYSQRVS
)11i%Q
^ZY[QRVW
9hR+L;
_^ZYS$
j$[SQRV
^ZY[QRVW@
_^ZYQRV
xKF%^ZYSQT
xRp[lR6lF
Y[SQRVT
VWQ2Qu
^ZY[SQRVD
E^ZY[SQV&M
+WUPH%+@
sP1"MEf
|_^Y[SQRVD
R^ZY[QVW
E1E1EE
;E|E;Eu
}SQRVW
1E~E~P
]_^ZY[QRVW|
_^ZYQVW
_^YSQRVWl
FER_^ZY[VW
hS9nl_^SQRV
lM^ZY[QRVW\
Lh_^ZYQ`
E>LL3%L
6jW~3^
VX;_^ZVWX
#h;WLM
,^_^RVWl
jlL_^ZQRVW
MZSQRVW
__^ZY[SQRVD
^ZY[SQRp
~ZY[SQ@
_^ZQRVWD
_^ZYRVW
uRwLRx;pf
MW_^ZRV8
ExLK^RE
M=^ZSQ
MaEY[VW@
MS3}3uShK
^QRVWP
pKxf-L
j=j_^ZYSQRVW
e Rj_^ZY[SQRVW
GW4Pll
_^ZY[SQR
_M/ZY[QRVP
l_^QVW(
}Up_^YQRVW|
^lSRll
P_^ZYSQR
1ZY[RVW|
=_^ZQRVW
PX-$5/
pR_^ZYRVW4
_^ZSQR
EfS[SQRP
PS=PRLPM
$RthlV,t
R'Y[RVWp
K_^ZVW
t^ZY[W
_QR@1D$8D$<
D$4D$8D$ |$4
T$0D$8D$(D$(PD$$P
D$0@ZYSQRV
D^ZY[QRVW
_^ZYS$
u^ZY[Q
llYVW,
^ZSQRVL
PRYPeUR
uE^Ph@RjA$xj^ZY[SQR
YZY[QR
]/P }jV
U'j6u@6;Q
uKRRWhMF
\$d=KF
9RKj=Kh
lS4u;E
;@$^ZYLEEoE3rleV
nzrrV`
EFPEdn
sSVPAdE
EEvztA
GrdVvG
1Vaeaz.EzdnEWrEnadnn
`ESCvPvt
1EEEWcrEdoalzQloE
drLebylrHuerVE1
tEEhdnaVrEdEtvsFStnnSew1EtnnVoi
rEipEEReeEd
~GE1liVnEtEradcFvEtIEVPEErSuPSFFrvEmivennPrSdVeaePeornlMenPePEuO\VnBzpnrUF
rErtXEEEpllPfdaaSzdEF
FFlnlr
xs,j++V9E
h@*r0uh
KEo|uA(E
wdjPv_`SHFvL1
hdjPJPQ
E]wjVP=
i<VjX_
EV<UEh+
Ut1x1jEE
ta0K~f
1^^8[~t
1E:BEu
4(444````4:``0`4:`4`X`
`5``4````5
`d4`445
```H``4`4:`p4`4`tL:4X5`5`4:`$:444D````:x4:@:`4
`4````4`\`4`L`:
|44``:
`:``4```4``:5h``\```595`<` `T`,``4:P84`4``5`:```4l4``4(d4``
33P3338L333
333l3333333333d343,3(3333x@33
333p33X3t33333h3`33|33333D
3<33333333303H33T:3:::
33:<333<
33::<:3
03:383:<:;::3::33
3:3(32;X33:$;333323
=<::<3
;:3h3333:::$
H333:33
3=3=3::
:3:3:3:3
:5:::0
%:6:P7::
:409:4
:_qI:6:
9}<:?:(83>
167z74
!7>@4 =;#1Y7F7`=<w
2)6l?604
797Y;5
0I=90:907
:26=9<0???<<lP??>z=?><????<
<<??M???>
=?< <<=??<??>==?<<> ?<?<=w????<>?$?<?????????<=<??????<,(??<
><<??>(??=??<??>>?>??
??<>??,??>??$??=?<?<???<??
:??0???<?>?=??????<?<??
<?<96<<
'_<'<<'5'<<9<<<<;9<5<;<8H<5<7<
6<47<.9<9<6:'9899<<'78<;<7<9
9<564'4HS
5<8<<'93N3<<<4J9<<<5<869<6<'584}'8<;<
'4_7R 4
<<7509<M<'<<48]4'4U9
#/<<8n?<]<<?'1'2
''1?'1'''''''
0'''''''?'@2'2''3'{'1'#'11''101
'1''''
?@r12'0''''103'''''1
R''''1'
'''0(''2
O:>s>:9dis;=F;R?=s;?9<:;T<(s;Z
>8s<;<99?:;;;<;-^
;9;;;9t?>;?5z
G>=hG;;L:s8::
<s=?;;>=>Z;;.9;o?s8:;q^v>8>@;:
bSd;9;;<;;J?!;
;>;>s788sssLsss8
7F78ssssssss8s8qss7s87wsss,ss6s87sssss8s7s:sc8s6s
ssssss7Ysss7s
sssi76ss&s
s878sss7ss4ssssss8ssssssNX0
64>4542"<Z4_<=
54rQ=562?<??2>46?<\=?^0
50<5q?0?
LO4=2<.>=<}>=^*<L
?=5;6T
<<<<c=[<>O>299I9999999qc9::::9999999;9:
9;9;::x9:9:9:9=
9\9$;9:e:
;9::9;:999+:O9;99999:j979;99999999;99999C9999U99:9t999:99j:9;9
9999::999t9z
999;9:9:
99333R33u338
33^3M33633733
383335333330333
334 /83353G55
533857b@3343%33363$73738336338333=343368383353f853333
63743334333433435333538367363
336p7C
5733633
3358336
9>?2*;
291z#09
x?199199?>
999929<9>9r99x093
<0>9i995l92
099z9G9n>129?99
:=0(991099=9??9999239
9:2<99?92902
0?39?.9?0292299
>D9>?0?1Y9909<263399
449839m93
99R39?8455696
k694949559
D8x944%57948S4
791:9d49104144
44a9k4E849 74NPI_NDNGNINNDNNANN
0DDIPXNNDDNNI0xmA0NDNNNDPNNDDDDNNNNXADNN
DDGN0gNNNDNNGINPN0NINPIGNNXNNXXDNNINNX0NAD0NGDNNX0NNNN
0NN0NNAN
ANNININGDNNAAAX
DNDGGXNPNNNP0PDNX
N0NNNPANNGNADNN0GNPNPGNNNINNN
exnaiv
IoDeAE IP
se"ee"<"""""es"
""t""i" E"""e"ul ""e> """/kenas c """ "f"u"tx
""g"d"use" ""=" c""l>"el""""" cae
"e"dq"vu"" "l<""
<l"" "LI""e"u"uv"sr"sAv"
"etv" ""e
syq""icr""oo"e"ns Peqe ">t""""""i=ire"r" ies<rr csm:
c-xrcic"cms:cci.icfcccnscoccrcmccccccmmc"0cctccscmcc.rcmcm
u-sc"xrccic -1nlce<c:tvccacsc occc>fccccoVcceccc-e1cIscce"cccccuronltty"mh c>nm scrcfcc3ccb.cosov=hctcslucsa=ocnccac :of"ascacnccmcscnc=
**VR**m
*r*o**
******e
??w????????q??
???????_??????????n?????????q??x?????qr
????????
?????????????????????????
rrrXxrg3r
rrrrrrrrrr
orrrrrrrr
lrrr3rrXr
]]]g]]
g]]s]]]]]]s
]]]]b]]
]]]]gb]]
]]]]]]
fffffff
ffffffffffff
ffffff
fffffff
jjjjjFjj5kj
j%jjjj
DDDDDDD
DDDmDDDDD
D_DDDDfDDDHDDDDDDDDDD
DDDDDDDD
DDDDDDDwD
qqqqqqqq
qq`qqq
qqqqqrq`q9
IqqqqqqqqqqFqq
qq9qqq
VaqqrF`
qqqqFYhq
qqV{CvFq
q`iv`R[``uMM
;x;xj;}<;J;_
<<<B<;<<<B<
X<<B<<<<<<<<<k<<<<
Q;<<<<<<c<<<<<
<<<;_<<<<<<<_<<><<<;<<<<<<<<<;Q<<<><<k<;<;<<<<<<_<JQ<J<<<<<
FKtKFK#KlKqKKKKKKK
EKKKZKKm
KKKKKK7KKKKKKKKKKKKK_KKK
{@KKKaKKKK
_KKKKK
K@dKKMKKJ
q#qqqqoqqqLq
qqqqFqtqqqqq
qqqqqqqqq
qqqwqqq
oqq+rqqqqqqqt+qq
qrqqFvLqF
qqqqq+q
jj(~jiDjD
______
___S___H___D__
_E_____
______<_
___D_{_____
/__D__{_{
_w______
/__I<</
_]<_______
111111121P111
1111111p11111
1111111P
1111@81
s111z1111111P
111111111p
1<gH111
KehbKKKKF
KqKKKKKX
KKJKKKK
qKBK KK
KKKKKK\KKKKKKqvKK@q
;CI~;@@GI
AG;A@JlnH
4444B44444;<
44;44B
_;E44;
4444}4444;u4d44;44Q4
44444444444q444
44U44:4F444U440444:444m444
;;;;;;;;;;;
;h;;;;<;C;q;;R
;;M;;;;;;
{;;7;;;
|1E;;;
@;;|;;;x;;
>;;D;;;;;;;>
######
#########
wwwwwww
wwpwpwwwwwwwwwwwww
wwwwwww
wwwwwwwp
wwwwwwwwww
wwwwwwwww
wwwwxwwpww
wwwwwwww
wwwwwwww
wwwwwwwwww
wwwwww
wwwwpw
wxwwwwww
wwwwwwww
ww{wwwwwwwwwww
wwwpwwxwwwww
xwwwwwwwwpww
xwwwww
wwwwww
s,{}e{k{{y{>Z|X{DLd]
frrdD'h{{
zBt]lx{o=^{~HZ{}
}o{y{{U]\
0{]{d{{!{uv{Qu
j{edz8
j{bHDDD
D%6(DDJ
!D7DDD'-D"DD>D
DF D6DDDD
D'D/38
D)D0D3
D21D-$F:DDD
DEDDD(D.0DDDDDD,>
<D:$DD
2D$7DD
{{{{{{
{{{{w{w
ww{{{{{{
{{{ww{
D!DD;BD
DDDDPD
DDDDDDDM
EJP>,}F
>iJaJ>
{j%d{%
FFFFFFFFFF
FFFFFFFFFFF
FFFFFFFFFFFFF
FFFFFFFF
FDFHDFFF
F tpqqqqqq
qqqqqq
rq9qqFq
qqqqqqqqvq
qqrqqqqqFj
rIqqqqVq`
qqqqqq
qqqqqqqqqq
RqRVRFRRR
`RqgRrF
RqC`RiR
hyRRRRRro`RiRh`RRRRRR
`iRRRRRRR
RRR`RiRhRRRRRRR
RRRRjRRRRRRRR[RRR`R
GYy~F>
~}LIq>GF~DjG>aGGGG;GGGG
GGGGVG
GFGGGGGGG
GKGGGGGGGG
G/GGG;
GGF;GGGGGG
;;;;;;
;;;)F;
;v;;;;
;;;););;;F;
B;e;;;;;;;;;;;;;;;;;;
;;;;;UBF;;;;e
;;|de;ql
>>>>>>
::::\:::::@:::::jS::::::::ne::::;::::::::::::::::::::@:J:::::
DxDDDDDDDDDD
DDDDDqD
DDD9DDD9DDDDD
DDDDDD
D.DDDD
DDDDDDDDDDI
DDD9DDDDvDi
~~~D~~~~~~
~~~y~~~~~
~~~~~y
~~~|~|
D~~~~~~~
jjij{D
111111B1
111111
1}1D111
B111111
1011PP11111
$111;111
qqqzK_q
CWWJxI
~FFF@BFFFQF;F;F}nF
FF;FFFFF;FF
mFFFFFFF;EFFFFF;FFFFFF;FFFAF
FC;FFFFFFFFFFFAFFF;FF;F
x;q<EO
_d4;;;E:{k;>0;<O}};}
}}=1|Q}>}}
}}};}H}}};}
}}MM}}
}}h}}}
}}}}}D}}@}
7}};}}
E}}}}}}
};};}}
>>>2>>>
Jn>>>>
>V>>P>>
>Vs>>J&>
>>nV>>>>2>
ssssss
%ssssJs
sPPssss
sssssss
sssssssI
wpwwwww
xwxw{w
^^e^X^
{^^^^^^^
de^^^^
caadaaa
aamaaa
aaaaaa`aan
aa~aaaa
!RI!!!!!!!
!!!!!!!!!
!!!!!!
!!!!!!!
!!!!-!!!!%!
#i!!!f!h!#
Zsy`}sk
xjx}]^
|{|zu}
555)5564
5 5555,
5555/55
55"5-55
{wwwwww
'''''''''''F
_''''''
''"''U'
??::m:`:Dm
mmmumRm\m:mhmmmm::mb]:m:m:mm63u:/mmm::mm:m::mm::mm:m:mmm:m:::mmmmm:mmmm:mm:mO::::Fmmm
m:m:mmAmmm:m::
:m:::CGm:#::>mmmm:::mm:m:
:::{:m:::m:mmm:
::m:::mmm:m
=oYo_!:Q;o`u
:sd+o:hoo&tS
NoFo :do:B
oJo:oCfNo
o:O?oxo
oo:ooo
Sooojoo5 o
oooonooD`
AIB^HD
ooZodoWo^D)Bo
nwCo53o
<o1'g7oD
o$!!oo4%
^oLotKpoDZ
oxDmooo
ohoo#FD#DD#JDD#DD{DDD#D#DD#####GD_#DD#
D_#z"A#wDD}4DD#D*##D
D#D#0DZ
DD#q#D#DD#
DDD#DD#D#/#
D##D#D#ZkMDDr#=D####D
DD##D#\
#D#DDD#DDDD#
#D##DDD#
oDD#D###D@
U{##l1W
C4##M#p*###y#&F
-e##/V
D#x%#F-s7##
?z=##mz
Y###x
##E#T&tIk&{,
!&&/N&G&Wn&& &+lE
&U&&y&_&&-&;\
&&z&&iY)\Y<`&T
a@C>/*
Tp+W'`
#E@EE#
E`EZEmv
EiEo&EE;EE
qE%Q~E8E
qEEEEyEE
EEnEEEEEE
EEE}HEE#EXL
EE&UEEEEAE6S
EoEEQEE@EEEEE~
GEE6EEEEE
EEEC!OE
EE&[TN"noAa&
fL;;)uU?
ATPaK6:`|Z
>tttttyttltttt_t?t8t
t'tytt+
stt5a~tt
ttP+X|t
tt~ttt}'
ttGttt
kLtt{t4ttttXt[
NttttcAtttttJtrtxttttttt
tVltt)st
tt~t6tVt4att
5}>c.k9
3mh7E09!N.MV
|%jDf50r
L]/Ps)w}
nwX&q?'`M
u;_OK
YID}"%
|IF@/}E
LC A2;kd
uU"^(i
-,k--D-o1:---)-gE- -- h
--g---MT-9-
>{---r-^h-C-n--3
y-----k{-O---
\\-->pG'~[-
w--t---~J--lC\D-+
-j-)-=P-8+
Ty+Z5o?--J5XSB3CNtZo
-\&O-^
-E7-/y-y_#Gy-W6-<b
v--;fZ-
-- 7--j-|mS-io_f~DsFHR
Z2oD/:ROt
J?WYzM
uG6>amZP
+uCcKX&
}FsrYly
iuSeik
iIi+Yi+"5_i,|d
i|iR>/iii
Ei {gii
i\i9iii
iei>i*ii
iiGapiki:S3ioiiiiiJiii`Xgii
iiiigi
,}y%iA3n
7|H1^Q
Uqqd9fM;8[
){IBD<
XZRDX[9!y
5,,K5rc0
H>{t\TL]<X1k72
m9E?T|
vM(},l%'
/>D,Q/
zv}(B#3 g2@G
B^XCzg
Zkw]?'H
%!GY[T
8;!l8r's
q\H,<<
<<<<<<
<<<5<<<<j
<<<<<<<<<zmL<
B<<<q<<
X<<'<<cq<T<~
<<<f<<<<<<
<<y<L<
H<Z<h<<
s!<<<0G<OJ<%s Z<
^b@<j<<<&eE<<$G<<<<<<<<<><
fg3_~x[YJ
|T4,w+91v
Rrp#G0"(HZ<
/O3 n8
888s8q8
888u a,
888O8)88D]88x888=(8wD88)88i8
88zy88
ZD88888
8g888k88fYXW8r88&:888z8888
8838888 m8880888,0
8_88888{9
[$xQ[Xw*8a[
;AmQ>[W[
O[D[[[g
:[n-h[W[0[
*#[[[[o
[t[CBPaD
[[[[Z%/[[[[n9[Iqv;n
B*[*[lH_
D[W\[[9[[l
/[,_>[Y[S[Ee8[F
[3[Q[[[m[l[3[
[%d[[[
[[/|//./
///%/RV=/9 //Y$
///+./`/)4/ ///
//Z//-//"//////
C///////
_///o/^
///j=/V
wd/(/(
))//(/
[//(&((//(?/(2]?
o/(x(g(^(?7v/(W-,Mp(.(%/S/%
/(j/PS
y/mc/(/
>f(/J((((2"Q
V(((l((v((g
~(u(((#(+(E((0(((((x!
(((@=cM(
BQo((((/((L+(
(=:&"MHC(]((`
`n(((I4((3(/J#
A4d7iUI /JNp
999999:9979999B9
9909999u9999>v
899l99#q9W99999
9B999999999I9t9Z99&?
99=9 99?P99i99
99,9ff
99999`999999999999 999Y
{]^PfX
isHe!{t*
9CCCC&CCCCGiCCCEC
,C5CCC3CC?CCC
CCCDC"
CC#CCC C
CCCCCCCCCCoCdlC
CCCCCCC
KCAD}C
jjyjjjjj`
jdjjjj0jj/j
jj jj=jlUj
jjIJ7rj_
qjrMjj^s
(jjjAAjjjAjjq
j'`chM
jjtjj1
ooool3uo
oo;Rgox{1z
ooooooo8ooo;|XBWooo4-o
woo=ooooo)*oo
oooofEDJoAoo>oooooo\opGNaopooL5o
ooTfho3Y
/okooooooQoo
uoocoT?oo:oo?oo]NNrEN}NNlN,NNNNN
NNkhNN?RNN
NNNNNN>j7N/N)qNNNNNNuN$aYNNziWNN
\mNNNlNN
NNNNNINN8
"NNN|}NNN,
NN\ONc[NNNV
2Q7VoM
pBY.2-&
8N888Im8888858805888
8t8i88J888~88
8J8 88z85888>88
888888
{[888k;K888788GI :X8c8]88p8Mc8
8FE 8888ds88
3ENywG
}WkpfS
5|=[0=====U==
==Ym8=
==}=======
==iL==w=}1=
==p==7=
C/=m9=+
======?==;=
9=`==7==
=====d=\=m=====^
(==@Q=;==mkqooo!Ioooooo
ooooDooso&looo oooos
ooooko=yo
q!oooioo.ooooAooK
ooooo9oXoooo[ho._ooooooK
ooooooooooooooooo
AT j(~tq5pE
,^c<fF_P"|
V}]tE]
}!!+3
422222222D2222222222j22
2222&222 22
22222222z22
9k222}2226
22&22b=22m22222f22"5P22222r22222<2222222
6va&/-;UDy'+
un-7!'h
ly4Wj_8c
W>+3 G
\)A\5odn=\>
cKT;TTTTTT^T
T%TTTTST
TTTTA>T
1YT8TTTTTTTTTTTbT&ToTT
TnTT}TTT
TTTGNT>bTTTTTH
TOTTTTSQTHTTRxMTTTTTM
qTTGFTTTCTTP---{--->Y----k----\--h---[--K
-;-NS~
--W----Tc-
---f-.--k@-f=-bZe-C
-eK6f---q--
|--G---
----*--k---9-I
FN~p---y--9
a-*---
sI;}J$%
2ss$sskP4
sssnssHvKSsssssssssss
#ss@7sc`satss>s
IsrseX0s`sssuSsC#ssss%N@ssssAass7css|ssss(/\sgsss
ss&sDsssss
/ysfssB
m0"RKeEAk#[N64D
h%x]D\
:07`sM
d["tnbJ^ar
*/q4E/r7
:~p1DNE
w>/j$Q
jhSO.i
vv#vvvvvvvc
v=v8Evv+vv
vvvAvv@pvo>vvvvvvzvvevS7H
vMvv9v4vh/;vKv
vvv7vvv1vvvvvvqvvvvb
vvQvvvjv850>vS\Cvvvvvv/vX/vvvd4ddd'
~p~pddfdp
psHddW
ddkdd|e
dddddw
dLHdddRdd
dN3"d-D
XXXVXjXXXXB
XXXXXX
|XXXXXo
tXXX\X
XXXX4X
X'XXjXXX
PX4jXXXXXnuX
PX_Xv`.DR[X4X XX
XEXSXXEX
LX:[0ObXLg9%Tg>G
[lkg{X
rA]ZjK$g
ZX|LX[f4
X@ggcXECx
XU@3Wgag
;Xgggg-gggg
ggggsgg;gg*gggv
ggemkk
DWPXtgggGg
ggrg-gg
g%+g@g
Eggegmggggg
gungg%^gg#g7ggg
sA #/kiT@!!q)\
GP[k_(t
5wh.pF
l)-u*6
]ry)!]
(J}(\5Fg`kN
xxxxxxx
TYx;xxxbx
E_x=xx
x9xxxxxx^;},cxKxjx]
0`|x=x_
9xxxxxx?xx7xx
Dx'xxxxzIxxxxxxx
l`xuwxYxxxxxxx
xxwxx>xxP
xLcxx{@<
FB=:Nd>0Dk
>8niLx'{
{QQm$QR.n
=Q,Xv.QQQlg4QQQQQQ)QQb@QQ
Q3MQS^n
QhEQ?QQ"Q\QQQ
QdQQ'.
Q]$mysQQQz%QQ
QQ~@Q8ZQQ`Q:u{nQ
QhYQd(
a@"'7(6'''''
''''Z'
''>'''3
''gf ''C
2`'''I''
'''xMS'
''HJ'''
''''''''''
''''O''|''t''E'
'$'''''''H)q'^c'
E=i|e+o
bRu`rd'`2a.I&83.
\'\\\\R\\[\\)\\~`\\\\y|\Q\G\Sf\\w\\\T1\\P\\\\@\:\\\W
\\y\M\\
\\\m\B1
\\\\_\?\\\\\\V\\CKKl
d\\\\M\\M\\\u\jcq]+qbq(
qqqqqqqJqqqgqqqqS~
qq';q{O
qq^qqeZqpqqq5qaqqEC
qqf3qqqqCIQqyqqq-mqqqqq,qqAqqiqqqqqq!Xqqqqq8qq
qqqqqq=qBqOq
q!8%!Gs
P`m0F^
ysbKBvm
6HwK>|.
v)3Y?u.
eG7CdM5"
dkqK.mu
"M""""""""e""
")"""h"-"""^
"j""""A~""
""A""?"^"Nmc"D
"""""KM""
A--uw~9
F"N!"C
x~L]b:5"LT
"BVS"&
lg" jss""
!%",x4
RsR88]
Y4wOB:
rl&qJ"a
!!!!!h!
!$!!!.!!!
!!!V!Y!&I!'!!!y!w!
!!!L!1!k
\"!!E!
!!!Q!!>YOp!!!!!So!
!!!!!N!?!<r!|!!!/s[!K!~!
c! !!l!!W!
!``5!s!H!HHHHHvZHHH%!HHLHHHHH9aHHcH6HHHHXHfHH
DUGH}HYhH
HuH!HWH
fH%HHHHHHHHvHWa!HqHMHH'FFrqHHQ#m$H
HHHHHH
*4!HHH1
HV@QMH+HHHHHHp
Ief1a?Fw18wj
Gvv?m'8v
vvKv'Rv%vvHvv9
vvvvvv
&vv$kvlvvvv=vvvD>g(06DvYvvvvvvpvvvvy4vvzvvv
vvvvvvvvvvvvo>v
vvv;(ve
vvvvvvv"
)D'XkS0
bhPlPPPPA3P>P
#XPPPPPA
PPPP{{PPPP
PPPPPP
PPPGV{P
PP0PPyPP
PPoPPPP
PPj]PPFPP
sPE ?PPDPPPP6#
o|g.G0
,S@,,S,
,M,K,,s,,,
,,,1,,,\;,,,,, ,
,t,,,,Z,,,S,^
Ea,,3,
,q,,,,F,~,>,,.dTp,,F,
,6,,Y,,,,&e}o,,,
,,yF,,X,,
M[%ro.L
= sxZU
fw'K1C*^
}uaj.h7[
7~nr<
9[S>"DTJ
Qc5Q!QQQQ
QTQNQJQ
QQQQQQUQz)Q\QQQQQ
QQQQwm
QQQQQQHQ+QQ^QQQQQQQQQouQQmQWv
QQQQ'QQQQQQ
3@~wW;
}lOw5G
!@ <2el
)UhrH,\;XZK
.3olv,#f
zfN3.![7(v(k
`HK>T|m
$gh7rlj
&=[ b,+}
YggOW{r
Ytg{_.
FJ4gPTg/8igiLgH
ggggggg
ggzggN
gH||[||hK |q|
Zw||rr|S|||
|@|h|||||||c|x||.l5||!
|{5|l|n||*|c||
|M| |X |YV|
|u!|V0||||
|||~||2
C6'v9|||*|*7|||
|||17|y]QQQQQ
jQQ'NQkQQ{(8
QQQQQIQQ2
QQQQBQQQQQQ
QQ^:%QQQ)QQQQcQQQzx$*QQj
IQQQQQQQt
QQQQQQQQQ
Q*KQQQSQQQQQQQgQ=Q
c?y{y-%
0J&%As
&qy>\q1.P9 By.zQ
%x>DKB
-+$([0
^Z?PNY
^VKGWZ
[/l?zvm
V}\$7FUf
MvYZ dsQ>
KMze5My
MMMMMMMMMMqMWa;bMMMM6M7M
MMDMM<
S3iDMMnB
MMMMMMMM]
MMMVMMM
MMpMMM7
OII*D(D
6kDD4D
DDCDtIDD8DDT
DvDcDOD`Dx
fDD)oDD
DD\<sCDnDDbDTD>V\Dw
DDK4ADGDJf
)DeDlZ>U
DqDrDDd
yDDDD ']
agoqN9
y|;`v@[frY
;7;;;;t
;;X3;;;;3;/
;;;#i;n$;z{;
;z$p\0I;;?:\;
;;;;j';;;;;(X;;;;;+;>;;;;;
;;;;.?;
;aml;;C
^2^Vbx_);a;
;_;t;P
/[e&M;;t
"=;/i\gMAs
;;SKac
1x;[;D
k/ ;=;<
;;Tg};wB_o]gY(
Ai1EK$K
c^uQ7XO9
7R_sE4f+
jw>h7n
,t?$x.g%
ANsn,:
|y!j2nf
V8/P8888:
8888U78886188
8888.488898$8888
8eM88888
888qMIw8888
F88.8W88q
88888a
8888!J8
88xE88
8jm88tM8888
8888~88vy88888@%
WW"WW2,JWWWWWWs:WW
WWxB<?
WWWWZW
^WWWWW.WYWWW
6W{BLpWWW
iWWWWW
nWfyW2W
WWWW5WAWq<WuWC
#WWWWWWWWpW
WWmW3nreW-uWWWPWWcWVDWWWW]WB&
L k
S" / @ p8U q
> J n
@
Vx
rf O u TJ M
a ( N: 0 = /`''
''c'''K'1s'RX''''x''x''^R''o'l>
X'q''p'''O'O''~?'Y'
''''?'
'''G''
'<t'''O'`
''}i''''''`
M,'wy''F''
lWvBY>a
F~0R>'8pLPpy
dCnFYx)
K%#6WtB
n!mc|gL!
!!!G^U
Y!!U r
&iA.!4!
xEF!!I
5!!!!;U
)O!!!!!!!"!!I[!!&!!!
G!!!_@^
L!!!g>d!n
gV!q}!
!Ss~!/
!!!!\!Y!d
1!ZO!(!!
-L$ j<e
""#U'ZJ""""
"""""""""
""""t=""""
U"""V"""
""i"""
""""""""""g"""
"""""""`
F""Z+"""""M
"""" sJz
""""""Y
"" Eq|
e%"`xEf
7^^^T'^o^^
^^^W^^7^^^^
g^^^^^l^^1^
fM%^M]^
^^^^w^R
DU^^^^T
2^^I\^^^^^
C7Q^^
r3[gAwv#
*Uj,$S
JURcMFh&0b
=RRRR$RaT
R@<6aR
RR`RP/
, HRRRRRRRR!3R7qRRRRw&RRRR
R]RRvRR]
RRR7z7R\R
FC;BR8RR%R
R^>RRRRRRR9yRV
x:Re_#
R_RK__RR_f__F@_@
____M_. ___
eQ__R_3+____K_RK_
______
N__R____w_0R___
__2__a____;b
________(_R
R_RRRl
z_^O^/
FUA@~cv._
Ok3ob&_:_
}cQp\L3
&IJ,{7,
1s0u??
???J??1??%?
??????
D=E???
???iz?
???7?F??
???????U???N???}?
f?????0
??????2??:;?y?
??O?m??
???%?}Y????$bs
X666666666P66
66C666@
4766666636
kJ6Uf66666
666'j\66h6`66Qs6C
6666655j{
6 663@666R{666(
66,66666{6~66666k666666:66
6-uY6@p(e
Fa7dA
3*S>mz
UqUUUeUZ
UiUhUUUU{
+UUUUUU
nUUUUUUU+(UUU UU
mU~uCUUUU
UUveaUU
Ug$UUUUU7xUU
lqU>I?B8
>?o>>>ntw
>>I;>>>>>&
>>A>>1>>>>>>>>>
>,>v>>>I>M>>
]8>>$>>LF>%>>.]>>[>> ^>>>q>>>
{G>Y>i
(cDccc\c6
cIcc7c
cviccc6rccc|ccc6cc
cv8cccccc
cccc`7sc!c
cccccPc
C+cccvRFZ2n5cbc
ccccc^[Ehcocccccc
ccbE<ccuccc/ccccc
xsccc2
GQM%`-
]$I*K1mt
QtE,F?kd
|n||M|||M|
Mlg`U|L|
i'|b|{||y||M
|||yM|||n||M|
|M||&||M
$VMs|n
||Mi^||
|||O ||Y|
]||.||s$$||j||||||MM
a|K|||||5i|||
|0nZ|P|||<-
|||]||J
MGMUM,v^QM#JMjMMM3M
MMcsMMMM
M(MfMc
qM _MziMMMMM{CM;M9
bMM5MHMyMMMM
MM MM,X
eMRMM;M?
MOMMxBDqMMM
MMMMMEMNMMMM3MMKM
?MMMMMMM
MMMj(M;MMMM
FDMMEMMxA;MMMMMMMyMMS&MMMMMcMMMMl
MMMMMMMMMMM.UcM MMMfMM]MMMz.M
" uK'RP\#
/t!;=w
!!G!!Q
!!!!f!!
!!Z!%!!!!!!!a^3
!#>Y!!!
!*E!!!!!TC!!
z!!!!!!!!
$3!!!!`!Xn!di
@`3QIM
DKxd#@w
!Zl7@yx
b '.\u
L|iSJE
w"\4F0s
7xDu{{{
(BQ{{<{{{
{{{{{t{{{Q{*{{{{&{{{{:
{{-{/{
|{{{X{'{{cq{{{{|{
|s{0{{{{-{{{{{{{c{
{j{{{{{
t{{q{{{l
U'UUmUUUUUU
UUHUAUjUU
UHUPUU7UU
Ux:gsUUUb
UUUUUU/vUUURUUUUUUI
UUUUUU;
UU#UUU4>
XUK{UUUU@
"U6U^UULUULUUtUPUlUUUUO6
h%OVW}
kS1QWZ
.z-(g_
5AF2oY
lw+H\sjq
J1'V.F
eeN13CwS]Qn
RF5b LYU
/if: l
Wb'L`N?
y4YS+m
Mf,{c>yu2
TTsTwTssTssTsTTsTssxssTs
psTzssssSssTtTvTTssTsKTTsuTssBTTssTsT
ssIsTsTsqsysTsssTrPRTTTTZsssTsssOsGJs
sTssTTTNU
TssFMsTDsssYT
LTTsssXTTAssW
TsTsTTT
TsTsoT
TTsTsTssTTTQTsssCHETTTsTsTTTsTTVTTTTTsTTTsssTT
@@@@(@
@@@@@@
@@@(@~@~@@}@@@}@@@~@@@@@@@@@@@
~@@l\@@t@@@@@
@@ @~@@@@@@@@~~@@~|
@@@@~,@@}
@@@@@~~}
x@@xpxx@
x<@xx]xx\@xx
@hxx4x@xx
x@xx8@xP(xx}xxxx
xx},x@xxxxxx@x x]@
CaHCePiSo
haeICreA
WPRPtl
pugnoe
heGUnedei
caaCtptModoi
irBFPish
ttytRwuPlraEgaipolC
zlteen
tHyteCtanetlsetiW
MctWaatlataaaaa
tactataaaoatttaaeatettaaaaca
itaatattaaaaGtaa
aotateotacatrCaataraEa
atrSttttaaaataattnataL
teittaSttLtttittttaattatttattatntaanattyt
tttaaiaattbatatrtttaatatraattt?aittatnseotoo
kaererttQea
CoTaGurarcao
VeektroCdoiLan
naFdraruEtnSo
eeeolieelporD
oflrceooe
sGrtct9svaacoelcrtLIorVonsa
emISeeunoare
eTeaeo
nITetel
lrElom
atGGoGGlGGoooGoSGoe
GoGlGoooGGttcGGGGo
oGooneoCerooPGotooo
ioGooGGoc
lTotGGnGiGeGooGGaiGidreGDoooGGosGoeo
GooGGGtGoGoliGoo
GGeGGoGoGlGFoGGGoopoGGeGGoGGGoo
oGnGcooGTyGGooonGGoGoGotGGoeGGoGlGGoGGGAGE
tinnlttt
tttnntctigoitStWttenvStrdtttttCnSttto
CtttGertnEetpeztliettnmtmtsilet
ttttttvt
tIttotntttrW
lFtiautotSiotrgdtntteHn
etttddrantt
ttttrttStencetsSittttteEant
iCitteodtt
Httttrnai
iDtoii
onEuriidigiierehiiiiiii
iioeiliGioiieiiatoriduetiietiiicettilipSiiresiEHdienilIic
etiPiii
ieiilxiird
siinieideGsoxdliin
PEetisAF
FaePiinctsi
UniciiiPt
igrirWiMdii
isIUeemA
eeUaioode2esoee
ereSeefeEeotelueenL
nueiud
erreWepeaeeefescetSeienlylieepeEe3
CeeOeer.rpGeds
deeene.eet
ottltcar
eenileta
eHeieeecGeTere3oetlc
eTheIeeatr
emeeeec2eieelIdIIIIIleI
III3IEot
IIlWIII
InLIIlSI
IIlcI2C
IIInelulUeeIctlICSeeIoIiIIIIxI
tIieeoIeaiIe
aaEaI!eIiee.rLzlIEeIdEeI
IxCIIenee.IIII3ItIoiIIIIIiIItIIi
hazIIntISl2nxsIIIe@IIII
CenERe
slUDWR
VOglsa
BodtdwPfo
QWdDodddu
dadowdr
addgddtdnDeWTPdddnnedddmidEdicdidrdddnBxSedidt
ddddUDddddpreddddndgnd
Edidrdd
ddodddtnwdd7d
idWdPeaox
lPedidad
ddoodtWdrMMlMtsMMaMMMeMMaC
aWrMMCMMMMMsM
MMMoMrnM
MMacasMTnMeT
gMMaoneoMdW
eescMsM
MDCdeMMMMsMter
etgohMIMpMMWM
MMssgMMMMM
MLaMaM
LMuMMtoMeMW
MMMMsaeMlMMMRlMrMWgceeMearrtsiMMtarWilsa
MMWcMx
MMdLeLLiMLgedLLGLLLeatrsLLL
oLeLdLaCLLLeLerme
nWLaLLLILLdLiLRL]LeLE.GLLL
l3LLaSnLWLh2tcE
rGLLctLoaCLLL
LrKLLLLLNLoLLLdLLlLaNlattLLLL
WLtLLaLtsLmLLLaLLLLyirtLLoWA
mPoLSeLeeeeeePuea
iyesepeITsFeeWHeeucitresGr
eeeeeeeeGpetrheeeelpeeeeerheeeoloten
meeeeeeeeeeF
Ceeoteie
eereTeeeeeeeeDe
eeereeTe
teeeeeGi
SceltGeC
eteeePeeeeAee
eeeyJtPmsensmes
lrGedWee
tTCoooooRiopopo
looFi`xooie
GoloGnooMoo
olcdooe
ltVnooEaloo
oooSoFtlomo
ooooleHoosWaiodeoFooavtice
rozoeo
eoGeeAdWoooooo
iFtooeeo
oooooHouoooo
oioasl
HooorooetooMoN
AAAmAA
hAAAAA
oAAAAA
twssssVAu
ssdsssws
TssssC
ssss\soss
ssTssiss
IsoEfss
GIaG+z>VM
/v LK\
~~AWKD|FK[ONGJMGPFTMVR}JV~XE`^WNQUQOCRPTLSD_CUH
H]YXIZS\EAL{ZBYI
]ngvy|vaswhx
\uzrju_[oct
y}erzb5
55!*i5555
55<5558
55?p5555555
555c5;5f>5
dustrdrrr
NarMirrnFoFJr
iurSrreerreddu
rrnrarrner
rArrrran
rgTrlOrayprrrryyrJrrrrurrdrvarrrySur
bSSrrrAtryrrrdrrrra
racMMrtysJrduyrr
neracrrroearA
AAAreAAtAcch
AiuaAA
eJDeAAA
JcAAnrJA
OAAaAe
AAPAuAey
DAbApAAAS
uAAbtd
glAAyerAAM
NAAeAA
proAyasb
noAAAArAmAvmr
AAAAAAdAAAAAdd
dAdd dAAAdd
AdddyddAdddA
dAd/A AAyAdAAAdddMAMdAd
AAddAdAAA,ddAAdAA
AAAAAAA
AdydAdAd
eGuesendWtHtLbG
AMemdPlts
xewoieionrFnESa
tdOAdd
noeF:lessoojtd
s2dUsdfV
WUHGitcW
tcWwtsst
coddVoLuusigsntd
auEaamC
oaRaaaa
aRrLnk g
a>aapa
usuouuuus@
uuuruu
uuuuuy
ffp-fffa
fffffff
anR ao
a
0 g ten
eeteee
ateepeeeere
edeeeee
pee6euee
exeeene cec eee
ee9ee 6
eeeebee0
eeeeeeee
eonpe
eR nin
lnonxnn
o tnnnn
iancenn
n nnnnnn
_no----
--ti0i-
-----o-
---l--dst
is ii
d3d
ee-t i
mbr 3c
i fs
3 33e I
333333
$U;;;;;tAt;
;;;;;R
H;X;;;+;;;;
J;;;+;;
%;;u;;;;;;;#;;;;uu
;;;;3;;;;
;A;Zu;;Q;t
RRRRQRRURYR
R$QRRS
RRRSQRR@RK$RRR
XRRRyRQ
RLRRR$
((((p3((h
($(H(D,(((
((td((
(Sh_(((
(LV|(-$((
v((((t((((((
(((((I((
jAAAP2t]ApADA$]AAAA
AhAV$AjA
$MA_AA
AuAAUA
AAAaAhAAAA
AAAAUAA]APAAD
AAARA}
AAL$AYYYu
YEYMSS
Y^YYYY
YYYYY[Y
EPpYYuYYYYUY
YYE@YYYY
YYYuYY
uuWEUpu$
t(}uSV
3QUuPM@=
uuQu]?^;
;S9;;;;;;W;[Y;;;;
u;;u; S;;
;;3M;;];S;;;t;;h;;;;uS
e;u;u_; ;E;
;uW;;Yu;ut"u
;;;;;uu;EW;@$;
j@up;}S;
uXuE;Pu
9999$(99
9}9}$999
9;9r999
9$;999uT
]wE999
9999999u9
t9P9E9@9~
=@9S93uj599999X9
9?9E9999
99YYY^Y;YY
YYPY@YPE
YYY@;Y3YYtY
YYYYY]YYYFY
YY~YtSYY
YYYYYY;5vYYEYY@Y
LYYYYYYY@YYH;tYYY3Y
FY@YYYY
DYVYY @UIYYY8YYutWYYYYF<Fb;
tP@YF$t@tPP
FP@>t8;
d@xvX*
:BLvvv"vvv4vHPv
6v<RJ8vD @v@(v$,vv
aDYtyt
FFFg$FF
`@FFfFutFFFF
FtfFfF
+FFFFFFF_FFF
FvFF^FFF
FFtGFF
FFFF]FIoF
FFFFFF
555955
5^55555t^5V@5555_
3@5p555
D5555t`
u555555555u
55555V5
552ut55X5^55
555W5Y5
5VQ555t5535]555
U}5F5545t5@=5Y555^U55_[
]D]55u50
55j5=3
55sY55&5^"555S5w5Mt0
5X55pX
5w5V@dY
So]]@t
33)$qj@tQL
$$R3$$$U$(_$$3$
$33[W3$$]
Rj\$$$
D>$hH3
hhhhhdhhh$h
h$hh3hh
$C$hhhh$$
hh$$]D$
$$hh$$$hhh$
hh$$$$
$h$$h$$h
ppppFpWp
TMpQp3pp
pppDphppp
ppp@pp
}ppp pE;
_pp^pppph
p9pppCpppppp
pppppwppppp[pYp{pp
33333333
33333333
333pV3303}
]3E333=9S33333u
;3u333333383@33
u3 333E
33t3EUE3u
3333333Fp
pF@]d]8
FFFFFhFFt
FFFFNF
FEFFFFF
YFFFHFFFu
FFFFFch
@EFFFtpF
FFFF@FFFFuF
FUFFFF
F;VVjj@j
VuVpVjjVVVV
VVVjVVjjVVujVYV
Vj@VVVVp
VVVjV@@YVjjjVVjVVVj6
VjVpjjVjtVVVhV5VjVVjuVVjjVjVjV
jjVVj@Vj
VV@V;VVVt
VGVjtjjVVVeV5
VVVjVVhjVjjVjVVVVjjjVwV
R)hj @jjjjujjj
wj@;j_
jPjjjjL
jLLLLLLL
LLLLLLLLLLL
LLLtLLLL
LLLLLLLLLLL
LLLLLLLLLL
LLLLLLLL
LLLLLLLLLLLLLLtL
WS;vRu
SSSSSSSSSS
SSSSSSSSSSSS
SSSSSSSSSSSSSSSWSSSSSPS
SvSSSSSESS@S@
SSSSSSSSSpSSSSS
333333@p3@3@3hF
~3333333
33O33u3
>Jjl>^
>~YVY>3>>FeH>@t>>u
>>_t3 Yt
>W>>V>
>>>>>>>>>>W>;'>>Mj
4>>>;>>>>>>>Ut>_>>>>>>>>(
u8>>>>
E>]>>t0>Y>[V
PUUUUU
UU^UUU
}U]UUU
WUttUU_
UUUUUtUUpUUPUU
UuUUUWPUEP
UUUtUU
^DE_DEPF
FGGGFODG
GGG@GGGGGGGG
G@GGGG@GGGGGG
GGO$IGGGG
GG@OGGG$GDGDGDG
GGGGGG
GGGP@G
VGPGOPOGG@
DDw$DD
G$#GGG
GG##G#GGGGGGG
GGGGGG@
GG###G#
GG$FGGGGG
GGGGGGGI
GGGGG#G##GG#
GGG###GG#NFG
##GG#@
#G###GGGG#
#GG#GGGGGF
rGGGNG
M####$
@#@u###
#M####V
v^3VVp
0DVW@`U
@xxUD}jxxxx5]Pxx^]Kp
uxxx$xxxx]x
3xxxfx
x0uxxt
U}fx^x^ufjxx"xf
uUEYxxHx"xxO
xVxtju
x_x]uj
fftuXdt
V+^uYUt3_
DDDDDDDtDDDD5
DDDtDD\D
DDD|D@D5
hDD}DPSD@DDPDD
@DD\(tDD
DD,DPSDTDD|D
DDDDPD@D
DpDMD?S
PDDDDD
XhDD$$E
$D$$$$$
E@$eE$
$$$h$$
$$$p$$$3
$$$}p=
$$$P$$@$$$
$$L$$"$$$
$$$5=(
@$$h+$$$$$V$
@}$E$DS
~~~t~~L
~~~$~~~~~~
~~L~~~~~~~t
~~~$~~~
~~A~~L~~~2~~A~~~$~
~A~A~~~
$M3P[-
]t[d3h[]
(S3ejVX;
E1EW*E
9Xg3Yh
^]@@&3EuH4
YDjrYqq
uY[V@
;;;@];;;
;;;;u;;5@;;u
;;;;;;VD;;;
H;;;#r
D;];5;;
ss;;;;P
;S;;;p;G;
;;;;;;;;+;;;G;;;;u
uuu;uuu@uuu
uuu@Xu]uuuuE
-wuuu3
tuHuuuuuYUju@uAuuuuuY]uutuUu3E@V_u
H5uuuV
u5juuD^DttHDp
u]puPu@PPuu
dddEPddd
d>uuddddG3dddt
ddtdOdMdd9dYj}dt
dEdE`ddMdd
ddd`ddddd
tkkkkkkkkkk
kkMtkY0
D}u]kk;|ukkr"9+
kkptkkk
kKkkkPkVCk
kkkjk+kkYkkktkktk
@k9}hk;
kkPks@k kkkkk
ktkkkk
EYE@YP(
jDU)uY4^
Wp_#U]
j[u;^@
^^^^?^^S^^uq^
^0^^^^^^@^^^
^d^^^q^^<~^
h@^@^^
t^^V^^3^^V^^
D^^^^q^^$
^|@^^^
^^h^^^@
@^@3^EEEPEEEEEEEE
EEEj3@EE5
EEE@Eh@E
G[EEEE@EO3E
EEEEED
EEE@_E3
E=u@EExE
EuEeEEp
e@@p;@@P@@@SV@@@@e@@
@@@@WO
DEu@@@@3
@@@p@u@@@
ph@@9@@@
U3@@@@@@@
@@e@E@N
EEEEVEE
NEEEEE
EHEMEEEEE
MEE83EEEE
EREUEs
hNTEEEDEEE3
:EEEEj
D9EEUEEEEEt3=:sE
83]]][
]5]]l]S]]]]E]]
]M]]]]]u]]l]]]Q]]
E]]E]_]
dYD]]]]E]<
]]]]]3]$W]]]]]P@]]]dV+]d]]]]]
jjjjjjjjj@jjjjjjjj@jjjjj@_jjjpjjjjjjjjDjjjjV
3jjjjjjjj
jjjjjj,jjjjjjP@h
jpjjjjjj
tjF=YF
@hYpW@
ttFYFFF
FFFFFFF
Fjjjjjj
jjhGjjj
jjjjjp
jEj3jjjjjYjjvl
jjjjjYjjjjjjjjjju
jjjjjj@jlWjjjjj
@;@@N^
3q@t>N
W;E @H
u5EYEEEE
?^EEEEE
EEJEEY4EEEEEE3EY@
[E]PEtE
EEE'VEEV]EE
EEEEEYEEEEEEEMsEEE
EEEH|SEE
Y;EEPE3EEE`E
_DEEEEEEE?]EEDYE
tffN3f
3DDUDDl
fetDDV~_Df
I3$(WV
$f@YGt
dddu3d`dddd
d^Prdd
dd~;;dNdtd
duddddd
dd;Md;d
dd9ddd
;3d|djd
d@d`d;;;;
Y;;W;;;
;;;;b;;Uj;Y
\; ;h;
;;;t;;j;
;;Y@;;;;
;;2N;;;u
;;Y=;;UpMS
DDDDhD
DDDDDDDD3VDDPDPDv
DDD{+Wu
DDD DDDD
z@3@Wj
tD@th%
8+pc@hs
fDDDfE
0.EE2EEQEEEEE
EPEEE.E
EEEEEE9Mu
MUehE9EEEEuE
EEEEE(E
EEEEEE
EPPPvPPPP
9uPPB@PMujSYPPP
PP3PPP9tP@
VPMUUPU
jPUPUU9UU=
U56U@UYUfUPUUUUUV@UUU
PUUUUtDUPPU
UpUUUuUPU
UUZUUUU3UUUU
UuQM;uff@E+t
@L@@-'@D@@@f@@
@@]@E@]@@@@@
@@VU@@@@@$@^3
3@@@t@@@@
@PE@@@
@@{Q@^
@@@@TH
L@L@@@@@
q]@3Dt
gh@@PHP
@$@UUM
LR@@MX^"u
D3jHhLQ
3\zj33
ft3E[_3
[H^3^M]
333333
fDD333
@333333
33L3p3DEf
3E33$3333D333f
33333h
fu3333338.33
PP3333d
f8P@9Q
q$S3@pqM
qqWMQqh3q
qqqq:qqqqqqqqD
qqPq<qp
qqqqqPR
qV@qSq@q@pq@
q(qqq$
j@@@@@@@@p@f
R@@@3@j@@@u@@@W@@@f@
@@@@@@@,@@@@@@.@
@@@@@@f
8@@f@@@@@0
j_P__D___
__!Q__
_R_S_p__
__hh_D_
_j_0_j__
_____j0___
___j@@___
________$_h_D
fjjjjfDDj
tp jjj
jjf5jj h
@_jSjD@
pppppphppppppp
pdpfpp
ppppdpppp
ppppppp
ppppp0l
hpRhPRR
RHPRQRR
PRRRRR
pRRpOHRRRR
RRRDRQP
RQRRYRlRARRRRRRR
RRhRRRRRR
+++W++
++++++++++++`++P+P++
+++++WV+
++++++++
+GQ+++++R++
++++V+++++F+Q+++++
RR@PxR0Q|PRQRP
!`+P`P+
++V\\WR
jVjjVjjj
Gjj+jjj+
+Fjj+jjjj
jjj@jxq
jjjjj(jjj
jjj@jWxjjj
+jjVjWj@jj
UqjjVj
qjj@Wjf
]d3jj3
[S+@@jj
xjjjjFxjj
+j+jjSllSlllllSQlSSlP0SllQlSSSSlQSSlllSlPlll
lSlSlSpSSSlSllSlP
SSSllPSlSlSllPlSl
llllllllllS
llllSSSSlhlSt
SSSSSlllllllS
llSlStSSSSPllSQlllllllllh
hSUSSPRA
SSURSPf
|||U|h|||0||Uj||||
||||||||R
||| |||||||||||p|A;x||||
|||||||R|RRE||||||||P|
|||D||
|||A| |P||R|tQ|||tl|++W
++p@+MW+G
P+G+++
+QM+S+B
+;7ddW`W++E+++++++++@`+U+
++W++/++
0d+++++
W+V+++++
+++dV++++++V++
,,+,G,,+d,,,,,,,
,,,,,,,,,
,`,W,,+d,K,,,++,,,,,,,,
,V,,,,,
,,V,,,,,F,,,
VM,~,,,
@@84@Uu
pj@<hEj@E
3qk_aNf
qNfkOfN
aONfkqa+O
m^Eddddddqd
dddddddEdEd
Pdddlddd
dMdMdEddd
ddddd]D
dddEdd
Vd3 dj@
ddQdddddjE0IddddEdQUddd}dddd
VqM;DP
qPhqh5E
pp ppppppppe
OLE32.DLL
KERNEL32.DLL
ntdll.dll
CLSIDFromProgIDEx
GetLocalTime
GetProcAddress
GetTickCount
LoadLibraryA
VirtualProtect
lstrcatA
DbgPrint
NtClose
NtCreateFile
NtOpenKey
NtOpenProcessToken
NtOpenSymbolicLinkObject
NtQueryInformationFile
NtQuerySymbolicLinkObject
NtQuerySystemInformation
NtQuerySystemTime
NtQueryValueKey
NtQueryVirtualMemory
NtSetInformationFile
NtTerminateProcess
NtWriteFile
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlDosPathNameToNtPathName_U
RtlExpandEnvironmentStrings_U
RtlFreeHeap
RtlFreeUnicodeString
RtlInitAnsiString
RtlInitUnicodeString
RtlLengthSid
RtlPrefixUnicodeString
RtlSizeHeap
RtlUnhandledExceptionFilter
RtlUnwind
RtlUpcaseUnicodeString
_wcsicmp
sprintf
swprintf
wcslen
DbgBreakPoint
0,0D0N0e0w00000000
1!101I1Z1f1x111111111
2 2.2>2H2]2f2w2222222222222
3$3)363;3E3P3U3_3g3t33333333333
474I4[4h4q44444444
505A5N5d55555555
6%6H6T6e6m6{66666677777
8%8P8w888888
9 9/979F9T9n9}9999999
:":2:L:V:d:u:::::::
; ;,;R;c;t;{;;;;;;;;
<"<4<J<V<~<<<<<<<<
="=3=G=W=p=~=============
>1>J>`>i>|>>>>>>>>
?'?6?Z?h?v?????????
0#0L0X0n0v0000000
1#1A1J1\1m1x122222
333B3J3\3j333333333
4!454J4X4h444444444
5#555A5R5e5u5555555
6&616L6Y6m6v66666666
7%7+7G7P7m7y777777
8)8?8N8X8h8{8888888
9#949K9^9d9{99999999
:5:<:W:f:x:
::::::::
; ;4;G;R;c;q;;;;;;
iaSbJm~
bB`re^yI
UlT6x}:Bn+/
Kz#74
, 2aY
]<TRZdl
)J]%N||6`^Vt
<da0[tI6(A
Ik[*k+ahhi
?nw Dg
I#Y&,xv[,$EW[;,0e
?ef;sU
TG=AY"
6_IVPR
/~7_0LfO
^GJXKl;-"Aodq~G
XVmtkwOF
n0 Q`?VfEh
?G&8wO4
M_PB)s(6B
!~XU17
L e H z D D g C u l Q B z s s R q
l e l y s c
W x g a D h w V u o r u R H
M S S a n s S e r i f
S y s L i s t V i e w 3 2
t H Y k t N T S
J H f T v N W X f k X G s L n O f W L w B o G Q R m P r k v K R I q g
k X y w m O R y x L g u m D J o e t e g S i B l
M S S a n s S e r i f
o l b p Z E t
S y s L i s t V i e w 3 2
V w j M p J V W D d k a J L C G P X n y f I t a j M y
M S S a n s S e r i f
E R x j W U P A N y O c
e U y s u X d S H g t V T j u x J k q K j p
S y s L i s t V i e w 3 2
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
|
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.