1.2
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.80
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Evo-gen [Susp] | 20200306 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200306 | 2013.8.14.323 |
| McAfee | BackDoor-AXJ.gen | 20200304 | 6.0.6.653 |
| Tencent | None | 20200306 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | .ajelhf |
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x0000b7d0', 'size_of_data': '0x0000b7d0', 'entropy': 7.173828755261051} | entropy | 7.173828755261051 | description | 发现高熵的节 | |||||||||
| entropy | 0.7209658638230066 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 61 个反病毒引擎识别为恶意
(50 out of 61 个事件)
| ALYac | GenPack:Trojan.Agent.DQQO |
| APEX | Malicious |
| AVG | Win32:Evo-gen [Susp] |
| Acronis | suspicious |
| Ad-Aware | GenPack:Trojan.Agent.DQQO |
| AhnLab-V3 | Win-Trojan/Berbew.51712 |
| Antiy-AVL | Trojan[Proxy]/Win32.Qukart.gen |
| Arcabit | GenPack:Trojan.Agent.DQQO |
| Avast | Win32:Evo-gen [Susp] |
| Avira | TR/Crypt.XDR.Gen |
| BitDefender | GenPack:Trojan.Agent.DQQO |
| BitDefenderTheta | AI:Packer.8C0F6CFA1E |
| Bkav | W32.HfsAutoB. |
| CAT-QuickHeal | Worm.Dorkbot.A |
| ClamAV | Win.Trojan.Crypted-31 |
| Comodo | Worm.Win32.Qukart.K@565w5t |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.419093 |
| Cylance | Unsafe |
| Cyren | W32/S-c46e6d2d!Eldorado |
| DrWeb | BackDoor.HangUp.5 |
| ESET-NOD32 | Win32/Padodor.NAM |
| Emsisoft | GenPack:Trojan.Agent.DQQO (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/S-c46e6d2d!Eldorado |
| F-Secure | Trojan.TR/Crypt.XDR.Gen |
| FireEye | Generic.mg.b470d77419093b9b |
| Fortinet | W32/HangUp.FCEF!tr |
| GData | GenPack:Trojan.Agent.DQQO |
| Ikarus | Backdoor.Win32.Padodor |
| Invincea | heuristic |
| Jiangmin | Backdoor/Padodor.fh |
| K7AntiVirus | Proxy-Program ( 00557ea51 ) |
| K7GW | Proxy-Program ( 00557ea51 ) |
| Kaspersky | Backdoor.Win32.Padodor.gen |
| MAX | malware (ai score=88) |
| Malwarebytes | Backdoor.Padodor |
| MaxSecure | Backdoor.Win32.Padodor.gen |
| McAfee | BackDoor-AXJ.gen |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.cc |
| MicroWorld-eScan | GenPack:Trojan.Agent.DQQO |
| Microsoft | Backdoor:Win32/Berbew.AA!MTB |
| NANO-Antivirus | Trojan.Win32.Padodor.foufls |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.B29F.Malware.Gen |
| Rising | Backdoor.Berbew!8.115 (TFE:dGZlOgKqTK/95QGBQg) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Padodor-M |
| Symantec | ML.Attribute.HighConfidence |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2020-07-11 11:39:59
PE Imphash
26babd76bbb7f9c516a338b0601b4c9f
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0000b7d0 | 0x0000b7d0 | 7.173828755261051 |
| .bss | 0x0000d000 | 0x0001e81c | 0x00000000 | 0.0 |
| .data | 0x0002c000 | 0x00003314 | 0x00003314 | 6.081287685698756 |
| .idata | 0x00030000 | 0x00001210 | 0x00001210 | 4.968075144922723 |
| .ajelhf | 0x00032000 | 0x00001000 | 0x00000200 | 2.2359871913599427 |
Imports
Library wsock32.dll:
• 0x43039c WSAGetLastError
• 0x4303a0 WSAStartup
• 0x4303a4 __WSAFDIsSet
• 0x4303a8 accept
• 0x4303ac bind
• 0x4303b0 closesocket
• 0x4303b4 connect
• 0x4303b8 gethostbyname
• 0x4303bc htonl
• 0x4303c0 htons
• 0x4303c4 inet_addr
• 0x4303c8 ioctlsocket
• 0x4303cc listen
• 0x4303d0 recv
• 0x4303d4 select
• 0x4303d8 send
• 0x4303dc socket
Library ole32.DLL:
• 0x4303e8 CoCreateInstance
• 0x4303ec CLSIDFromString
• 0x4303f0 CoTaskMemFree
• 0x4303f4 CoInitialize
• 0x4303f8 CoUninitialize
Library OLEAUT32.DLL:
• 0x430404 SysAllocString
Library WININET.DLL:
• 0x430410 DeleteUrlCacheEntry
• 0x430414 FindFirstUrlCacheEntryA
• 0x430418 FindNextUrlCacheEntryA
Library KERNEL32.DLL:
• 0x430424 ExitProcess
• 0x430428 ExitThread
• 0x43042c ExpandEnvironmentStringsA
• 0x430430 FileTimeToLocalFileTime
• 0x430434 FileTimeToSystemTime
• 0x430438 FindClose
• 0x43043c FindFirstFileA
• 0x430440 FindNextFileA
• 0x430444 FreeLibrary
• 0x430448 GetCommandLineA
• 0x43044c GetCurrentProcessId
• 0x430450 GetCurrentThreadId
• 0x430454 GetExitCodeProcess
• 0x430458 GetExitCodeThread
• 0x43045c GetFileAttributesA
• 0x430460 GetFileSize
• 0x430464 GetFileTime
• 0x430468 GetLocalTime
• 0x43046c GetModuleFileNameA
• 0x430470 GetModuleHandleA
• 0x430474 CloseHandle
• 0x430478 GetProcAddress
• 0x43047c GetSystemDirectoryA
• 0x430480 GetTempPathA
• 0x430484 GetTickCount
• 0x430488 GetTimeZoneInformation
• 0x43048c GetVersion
• 0x430490 GetVersionExA
• 0x430494 GetWindowsDirectoryA
• 0x430498 GlobalMemoryStatus
• 0x43049c CopyFileA
• 0x4304a0 InterlockedIncrement
• 0x4304a4 IsBadReadPtr
• 0x4304a8 IsBadWritePtr
• 0x4304ac LoadLibraryA
• 0x4304b0 CreateDirectoryA
• 0x4304b4 LocalAlloc
• 0x4304b8 LocalFree
• 0x4304bc OpenFile
• 0x4304c0 OpenMutexA
• 0x4304c4 OpenProcess
• 0x4304c8 PeekNamedPipe
• 0x4304cc CreateFileA
• 0x4304d0 ReadFile
• 0x4304d4 RemoveDirectoryA
• 0x4304d8 RtlUnwind
• 0x4304dc SetFileAttributesA
• 0x4304e0 SetFilePointer
• 0x4304e4 CreateMutexA
• 0x4304e8 Sleep
• 0x4304ec TerminateProcess
• 0x4304f0 TerminateThread
• 0x4304f4 CreatePipe
• 0x4304f8 VirtualQuery
• 0x4304fc CreateProcessA
• 0x430500 WaitForSingleObject
• 0x430504 WideCharToMultiByte
• 0x430508 WinExec
• 0x43050c WriteFile
• 0x430510 lstrlenA
• 0x430514 lstrlenW
• 0x430518 CreateThread
• 0x43051c DeleteFileA
Library USER32.DLL:
• 0x430528 GetWindowTextA
• 0x43052c GetWindowRect
• 0x430530 FindWindowA
• 0x430534 GetWindow
• 0x430538 IsWindowVisible
• 0x43053c GetClassNameA
• 0x430540 GetForegroundWindow
• 0x430544 LoadCursorA
• 0x430548 SetTimer
• 0x43054c KillTimer
• 0x430550 RegisterClassA
• 0x430554 GetMessageA
• 0x430558 CreateDesktopA
• 0x43055c SetThreadDesktop
• 0x430560 GetThreadDesktop
• 0x430564 TranslateMessage
• 0x430568 DispatchMessageA
• 0x43056c SendMessageA
• 0x430570 CharUpperBuffA
• 0x430574 OemToCharA
• 0x430578 PostQuitMessage
• 0x43057c ShowWindow
• 0x430580 CreateWindowExA
• 0x430584 DestroyWindow
• 0x430588 DefWindowProcA
Library ADVAPI32.DLL:
• 0x4305a4 RegCreateKeyExA
• 0x4305a8 RegCloseKey
• 0x4305ac RegOpenKeyExA
• 0x4305b0 RegQueryValueExA
• 0x4305b4 RegSetValueExA
• 0x4305b8 GetSecurityInfo
• 0x4305bc SetSecurityInfo
• 0x4305c0 SetEntriesInAclA
Library CRTDLL.DLL:
• 0x4305cc _itoa
• 0x4305d0 __GetMainArgs
• 0x4305d4 _sleep
• 0x4305d8 _strcmpi
• 0x4305dc _stricmp
• 0x4305e0 atoi
• 0x4305e4 exit
• 0x4305e8 memcpy
• 0x4305ec memset
• 0x4305f0 raise
• 0x4305f4 rand
• 0x4305f8 signal
• 0x4305fc sprintf
• 0x430600 srand
• 0x430604 sscanf
• 0x430608 strcat
• 0x43060c strchr
• 0x430610 strncmp
L!This program cannot be run in DOS mode.
.idata
.ajelhf
3A} 3Y
ISmOA};
ci?3mQ}
##YK<KJ
IKEkKc4
"R}KIU{
ClA{Ga+
2G}I1N
IAbhKLUIK
/w3/wG3I;mu
GD bEMEx.
FH_)p&>
;pKOw\KH
BA|_-bN
R+qw&VK
IjALZ+
##VKD
'IKT]K
.z5RRA}
Ru6IIK4
Iu.IwjK}I
}IK}MK}IK
Iw|GK}I{
Ew{BKt6UI?
G6UI/7
I-HD~K
KG!FVI
u x.FA
MK"0nK
Iw[Kqs
.b5jDK
G!2UI}
#KN.J5-
wU#K?gs
KcIwn^K
R}6t2UI>
##iK}IK
+H>0H#
/J=q}Kb{
/`Mcv}
JK`Mcv}
/J=A}K:
vIU}Kr
IRKK}H
IhJDIK
IQK6CGs
[D JAH_
_q_M1L
KLbUIwi
,49.z5RR]
Iw]MK<
_}HK<b
z1R#(IK}I
vIKb:NA
}LQKu6I
{<JK<6
##IK<JmK
5KLbUI
#RYRaK
HKD jE}>
IRLUIKM
|I`.x6
K7Obsv6
K?)K5K
?LUINP,I
> u x6
D bAIF,/K
C)B1WI
IKLUIw
IKAu x6
4bDHu 4D>0
2JcRuIK
+MO+IW}A
J1iM? O
IiE? G
NIKGCtK
@6?6FA
DIFADA
7Nbyw
N5HvLUI
FANKGr
IcQ0N K
RKQRIKuO
KcFRRK
KcEunK
uWIK}I
CqCeL`$
Iwt=KlbVI2i
7KDbVI~KKLbUI
KKLRVI M
IL.VIK
LRVIN{IvF
.VIN4KK
x6HKDbVI
DLFUIk
I7Pt9K
DL2UIu
6VI|KM
6VIN4Ke
@QmP3w
JUIwYK
UI=5KV
K}IO}O
G#7KLbUIK<V!
GD bA}
zF@O)t
F@_)p4DK
DMvIKb
|+LUI?
Ivw)K.+O>K
=vIKbfu
DMw*=vIKcN
LbUI}> z+w>
wJKawJKd[RE
Ir?.IK
I?0t K
J`&H,J
[LbUIu`
KLbUIv
|+LUID
IjADsK
|+LUIDf
C|#L=VI
C|3L=VI
C|3L=VIH
ERARAI
LbUIuv
J1#NK}I[a
K}IKpK
UINZIKK
F@NKH5
<+L=VI?r
NK}OJ}K
<+L=VI?
-LbUIj>
wjKLbUIE<R
5vKbCN
HK4Kb;J
L2GBRvw
fOqLbUIJ
4fKcVO
INkgIs
#i$KN##K
=vQnKb\}
I}6 0``A
KcL L I
G!ZUI{
I?r###K
D2GjNFIs
vw'ss}C{
NK}OJ}K
.b5-.K
uKbKGK
4KIv$nKbE/@K
LIv$nK
2Ow"K}I
LbUIuFs
MmpiFK
IwB(Kqs
#(KN##K
KLbUIu6IC
[LbUIKTK
vKbL |
pOIv$nKbC/K
w'5w.7
+yO+pIOpb
w~K}H8
w7KLbUIjYbJbG
jYfJbGE
@,1s,w
KLbUI\K
K}IK}KK}IK
NKD!3UI{
w({KLbUI
W4KcO}
bbq KX>
}KK}I= K
G###KA
Iu.Iu.Iu.I{6y
IKwtK4JbORK
<'REWK~
IbMu&K
VIRj{~)KXK
IvIKbMv
N"csfcgf
>sfcUf
Li9WIffR;K
WD REREM
CMwg;wh>RAWF@[
DMvIKbX}
b`.##IK
N4BwbMKtrUI>
x6JKK]E
> u 5BFru
KjN,ID4
0PLIJ\fUI[
bUINK.
##oKNKG
.HR}^K&Yu
trUIB']c
sv6HO$
}IK}KK}IK
#0K}IK4K
I}^ KuKcQR7HK\UI
IR7HK\UIu7
IRRu%5y"AN
Iw KlUI
I}^ KuKbOR
D jEHyK
RK_Rvw
I}^ K}H
/fp}H{
K}I#,K
/fy}H{
UI}> 1
RIB=#
<UI4Hu
IKG!UI}
IKG!UI}
UI}6 vKD
b1z1REvs8<!
HwKD ;|
K}I#K4 rv
K4KbT{o
G!UI{o
5}IjE>
1f@!cUI{
Iu3.z5
#RqvK-
IKG!UI
Iw5K}H=
IJK}L?
I?{##cK
G.EuK#~K\K
IKK2Kc\{
D%u @6?U.U#LK
~K}I#,Kz
~K}I#YKz
~K}I#TKz
~K}I#8Kz
V<#6KK
C}IJ K
Q}H|KA}K
wwKKD `UpQ(W
x6IKw)
xIr!%}
Ic@w6JK
<JYI<%x
#{KG.{
mMKNx6HK
X#IAb~KWI!W
IKG!UI
cG{^IK
%IEN3AIM}HI8K
;D bAI
IbA{V]KO{V)KD#dK
K<n!eK<^9eKE<
I_}IfK
<RQRQI/}K
SG K}I
@nnIw%6Kt
UI?>Fb
##$K<K
(;IRNW
0uJI6I++r>
rIB=JGG[K
xB=DM8~O$
KoKD $7
IEnK,6
G!eUIcKjiDEK
w!bKJK
/ 11;c=v3
I%<#NK
#JKG.c
w HK@*I
iw"KH5
z1RAvs
@1I9kKGm
KKu3@6>
}IK}iK}IK
Iw/\Kf?
SD J]IY
Ix6jUD
b1bER{
Iu @6>
Iu @6>
NG7IRKD bAIAH
aTKw*$K
9WK}I{
JAw-KDNV
KKPu3@6DK
Iw7)KB
@6>>!$UI
KA!WIK}I
=H9>zCK
Iv9>!3UI
I#KGv\
b1_K}HB
D bAI#v()K
^}IQK}H
LbUI26
IASKsJL
+H>1K!
G!cUI{
G!|UI{
EZHKLbUI26
#=K}IK
IjK7({K
IH}IH}I{
#EYKw?MK
A'nKLbUI'
A'nKLbUIO
oA!UIF
LbUI26
wqKLbUI26
DtZUIDt^UI#
A'nKLbUIl
IqBKO<I"C
IRuFrJ
!CK}IK
IzDMB= A
Hw&KFu
4-\^UI{D
4-\ZUI{D
b%(~*f
FANKG
IO<I"C
IfeI"C
}IK}IKW
~K-#2kH
HKvt5<!5
N?#)HK}H!
IsO3t[
3A`kmq
iaiI,X[
iY]izi
infa)v)
EiDiDiBiBi
EiDiDiBiKCi
EiDiDiBiBi
EiDiDiBiBi
EiDiDiDiBi
EiDiDiDiBi
EiDiDiDiBi
EiDiDiDiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBi
EiDiDiLDiCi
CiCiDiCiBiBiBiBiDiDiDiDiDiDiDiDiDiDiDiDiDiDiDiDiCiCiCiCi
EiBiBiBiBiBiBiBiBiBiBiCiBiBiBiBiBi
CiBiBiBiBiDi
CiBiBiBiBiBiBiDiDiDiDiDiDiDiDi
CiCiCi4CiBi
EiCiCi&CiBi4CiBiBiaEiBiBi
EiDiDiBiBi
EiDiDiDiDiDiDiDiDi
CiCiDiBiBiBiBi
DiRCi0Di0DiBiBiDiDiBiBiBiBiBiBi
EiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiBiU9L0i
hiR;I6T;
uMM}4[
fGiyuOhZ-
uMM}4[
fnD0S,
f;f9ui
k*^=Ii
iO=(G'Y'
%`T&)h
iWiKo)L
|:q=nfUm
iqiUY:
i:YfrmD
gnZ6IZm
ofRZi4
IZRs!8ir
ofRhAR
ofR@ARXARhAR
jkiI@ART
nunqiIz
ofRrpiT
ZUiI@AR
gnZoni
gnZ.IZR
ofR@ARZ
gnZ6IZ
IZ.IZo1Y
ofRhAR
IhARXAR@ARZAiI@ARZi
IZ6IZ6IZ
iWHUMMa
#yqjZWHU_z
i+i;iSiwiiiiii
i'i/i3i;iOi
i+i;iSiwiiiiii
i'i/i3i;iOi
iL;BZ)%
iD=KGKi
=/U7m
i7i3i?ic
D8 *$.ph6P
i1viui!ui
iIioL i4i
ifibifiwifiririribidihibi
"[=YcL5iq,@%"5d
s9`it;cXn
!JW&D;=KUB-; KWt
( KW(,CUH0;
p@+Y7@;
9FH0;!JW-C_
-A<S:A>U5n
&S(B$d
:N;/UWt
p@+Y7@;
9FH0;!JW"
!JWO(9=S,"L;=S,;!FWE-9/UId
bKuX9Gsit
'1"iU&=+c9Cd
L"['1"d
IW-'I'(BcW
s"U,4GKi7I*
Y' F0wc5YF*N
[2<NI~
[7KtIcc5YW
'I"ItI7
"[=YnL
)i2IT 'd
['Dlc6YE'UI
\',Bc5^%
\79Bc"L
i=itibIq
biD:CL[
b u["5t
>*7Q6/*[E,6D6[7\?X
=WX7]7$k
US%;,CUN%9
h]7FN%9FB-;&^U6,u
tiS96Y3]O
!JWO(9=S,B
uY;=S,;!FWE-9
c*I,S%I==I7ILc
=WX"It*I,ScBif
(iO=(G(IS9(i
&S(B$d
u$nibir
tiH=F,J
siR=IJ5^
"it2tI"N\
"S"IH$"i
iCZR!Ax-
pfY,^x"
_bnY,^x"
_bCZR!Ax-
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
closesocket
connect
gethostbyname
inet_addr
ioctlsocket
listen
select
socket
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetStockObject
DeleteObject
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_strcmpi
_stricmp
memcpy
memset
signal
sprintf
sscanf
strcat
strchr
strncmp
wsock32.dll
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
L!This program cannot be run in DOS mode.
.idata
.ajelhf
-!Il%FaAqY'
Jl%?s(
Il%I%IlmLAU
9O#lM(Y,%E<dPl%
9E`I8*.%M
h#Il*?l%)1
lfF )12dDc
h%4:p7"|%1I
q5M1{1
`,z=D]
D~A)h1
`dA)XS+Ex
)I .%Il%B
Il~Aeh
%}L|Id%I
Im%I1z
.%<kIl%Q
lM Y,%-
Il%9|v
/)Iom#lO!DI
lM.%R%Y
l]g@Ix<
Il%yI9_
pF!F1pP)3E
A9e:um%
U`B;El%QOf\l%
|?E'GExx/Eiz
lA9e:um%
&M~B`A1 IpYPE?EE EE?E
`KE7qHFVy%x
IXhY={@N
l%M,`F)-|Mt%
IlA+|t3{kCVE35x
l%M,`F
I ..%391
MT@`EcXUL]yb
.%DE</v
-R%O#lMEVl% P#lOTI
|M_%33{
1Qv8I3{
:r1<d4
BMlOtI`J
:MN.%M
z@*&`R@PzM<M^.%1O
1Y1Il%
"l%M`^
z@*&`Z@PxeQ\Il])3:Mxz
Im%RT%
`*>7m%))
%EuE<`Dl%H
A~EQEIlPIz
l%S[m%
pXNIcUIl%94%
Il|3E3
53!Il
-16hr1vr)33
u1q1Il%)
D<z.%T-l%)
?E=PbHyQz
lu1ys)1
c9lIlb?Ez
Il|#nO#lsR%))3E
)LIGl%I`F
IlsRp%
2~s9_%I
Il?EEuRE
@G~EBl%9tIlQsxI3D7
D<z.%T
YEyEugEu1q1Il%)
c\Ol%33D
D<z.%T1`F@*?j%!
.%;SZI
,zFxIlC9Dl*>~m%E%.#I
$gEuRLE
DQEIl*>l%F
Il~Ec?Eh
l%Hc?Eh r.%!
IM~EQEIlQEud
D<Mj.%RJE
r In(l%3]3bEu1qr)
cNMl%;
Eu1qr)
c~Ml%9Dlnl%M
%IN[l%
E2E$Il?E
"Eu1ys
E]Q%IleV!IjEu1qjIl%3
Hl%M>3XFIcIJl%7
IlYEyJ?E
RTm`F@*?
o%YEyE%ED
%R%YYEyE?E
E'E?EEu7D
Il%I:9|]h%I1D;;
E%3E3&!I.T
tl%I`F@*?Dn%
&T%`F@*?m%
E%Sm%#l
l%$bC}
Dn%3]3
53!Il
Er1vr)
DlbHyQEugUEu1q1Il%)
cCIl%9
Dl*>l%uEuIN1
l*?l%/
EIc'Il%7!G<
EsEb3$G#l%:!GlQ
EEu_gEuR%
5; 6IG9e:um%
BE$GE>LD<l%9`y
%QE%I^l%1
D<:-ED"
Dc1D<:-;
I.\AV1
<k?EI1
D<:-9DlQEu1ys
D<:-;?IZ\ARBz
}Illl%9h`14BXZ
9tIlPt[E
XfE3{`J-%Ilsh%t ;tr33
I Il~Y
lO#lMTi,%I
%B<I3{s9_ ;v
lr,HlPC|H:M
-%E<`@l%9`B`}m%I3{9_
x=aPIl\)3 ..%9P
)5|IlJ`|
~Jm%RP%
\IlIx%
7|I!Il Y}Fy)-30D~
qI38DCg
gExl%3
DeQbRX%
z:"Ij3
0Ilbxy)1I`F$czq%3Dr#lO
ED`B@QEl%1
DIlys%iz
lbxyE)9`DQ#%Du7
D<OE/E)E
D~>h,z=7?El9dE
?l%9dE
oLl%;WlI`Nl
[l%9PF?
ED`B$b EI7D<?E
EAMev&1I`FYuFy)9dE
EEG5l%S
EuIPNFz
YiFyE)3m3l?EDu7D<O
DzRJl%Mev
1I`F$czA%3
IlYmFy)1I`F
zIlzU%3D
)3m3l?
E#l?=E
EuIPNF`NlKll%9(YFOAFu7
"7D<?E
%E</5E)ELI
%IlOGuR%5
I3$DIm%#l?
%IlMHl%I
9h);lI
@~)VR%@QE%LCIlO!I"XEt
IcKl%H
6P~EQEIl*>mn%EHl*?]n%
'F/IlJl*?In%#lMEl%7
S~iQEIl*>l%#nMg.%7D<49`
gDuR8E
)|iD%3m3n},Dm%I
E"eF+9@.LD]9,Dl*.E(DJ
yO>%Eu7D<Mo.%E<dxl%9|A
1PDYHX%In; I
)%=rO!I
aF%Qm:iE%G|iE
1,DYHX
EI ..%S
E$bA9e:um%
`FE|l%33(D3n
;h&I:r1<d+fp3m3 ..%;!IcK<J
n>LEl?E
cKaA<?E
!IlBx}Fc F
E<Mx.%7
l%9X7E
lIg D2M}CE
Ul%G$giz
)3]3 ..%
5 ;A3L'%iz
ljCl%M`BMAl%
-Il.%|JlM
%LL%!I;
|#lMb,%
l%#lO9I]QE%
.%R\%\)3z
Vy?s)1)1
lO#lO#lO!l%PlI`J
|>Y%I<OI9,%3]3
uE<sE<|l%ELI
l%9,%S@m%))3E
..%33
%Ill%Ir1
OaP)|Mj%;
Ic<O)<E\~YeF1
Oa)|Mj(9nE
..%3E3c<E`BJ)
<dl%9`*
$`BJ)|Mj(E
Of]Q[`Fpd82x52]Tb4|WS
bc]U`NFD
`BHuE<
l%\IMl%E<l%
;HI ..%3]3`F
)E<dl%
v-Il:l%M`Bzs9_
B<MIc%IP
1E<t<O
%E<Xl%1
Kl%3m3`f
QZIl*?l%)
;U6%!m%I
$Hn% B/IlMIm%H
lG`ft$I
$I`Rb)
Sm%FIlG`ft*$Icz
L:l%3XbI
.Il|)bO 6.Il|))M
0%#`<sR%
*?Um% )Il,zF+IlBH}!l$I
V)Il<sR<%)
<xoB?EzOY
<p^`w1
<MIlu7E<M..%I..Il
Il]D}#}
l% )Il,z=}O#mMKIl%E<l%3]3
IlsR,%#lsR%
5E|I(Il}T
2~s|%`m@5l%ELI
AMbT%!(I
lM.%Hl%:E ..%
lMIlRE
$I#9,zy
Il%M`F
J.%RX%
VE?s)1)1
Mg#hY<<l%9`}.%i!{
l}w)%)
%EIlDA2
}uX%i!{
lO#f<AUI
l% ;EPE''
b EIN:
YFyGeZBE
E/EGeZBE
E/Ei!{
lbxyF%}
%I4l%7
BDuKZ1Il?E
E>rR%@*>l%#lMEl%7
D<sR|%FB
MgF%Z:
l%3]3]S7m%F>LDl
Mg#lu7
:0Il,zF
EE<prRH%N`I3
<ELhI;ll%;>#I]Sl%i!{
3IlyS%xFu8Ieo .%
}i%?EsR
%xeQtM+l%7
E<rRT%@Q
3Ilb`yxeQ\F
z`b?Ez
V]:r1<ds`g;
]I .%:7,!sXI
%}O#dMu.%E?h
QELhI>Il])3 .%|
uE?hxl%;
1t ;A,fM/v%i!{
Mg@Pi!{
lB`}#msR2E
el*]Q}c
ch-caFsFkF{d,pF{|,i2];q!I .%2R:SXAe2Y9
Mg 8E|O
$K=Il<l%/>Il%IVl%*YDIIl12Il%ELhI
:Il%R%@Qi!{
9dB`}xeQP .%;
:r1<dM
]D}i!{
l EI4l%9E,VD?E:!3%E?ELl%D%7
E<O#l?E
$R(%i!{
%DuE?h
<IlU[%v
Bqm%IcHl%F
2~s9_H5I<Ilv
x))R(;
lvRE?`B
x9E>fH@fI?
pB#lMEFl%7
E<Mv?Il
Mg(I@B)3
Dx?d^E2
9|x?f:2-$R:Il%=~O
dF~A]Sl%i!{
pB/fM !I
PG|14x8:)1
'Yl%"E2
l$M]QMc
R8%$BMlQ
-=dAj9IlElQ
x$$JrRE
.%3]3
=l%Kl*
uR%C3%Ib
IlJH|i!{
lO >Il%
-R%@QFb
R#0rR2E
5,yIl%3]3
E>dxl%
;9|b<l%M`B
Z;OI .%+Y
9||%I`F
ELhIc=l%
*8IlyF
N~Y]Q@M`Bz
r%1<dsRFE
.%;1"I:B9dx9:7, y
$QB:b)
SW#lO!IS
E5,z<JM:Il%E
!R%6gI3
'a:c@P
!E?`sR'E
)E?h|l%3E3:
H]3E3 .%9lIlO#mOlI!
.%Rx%#i
IeQ .%])3]%I .%33
Il%9ui!j
cQ%IlYgQ
Lzl%h ,%Y!
Lzl%X ,%)
%I!}eF`D IlL\I>Oh ,%!
%I9Ily
BvR%vE3{
9`s)-)-
lMqD%/`/
%I%!lIB?Il~E .%;B
@I .%3E3
Mg])3cAg
dI=l%9lIldI
Z4-%i]1
l!Il!l%M`F
dMl%c0I%<
LlIe'IQ
Il*55n%H.%:DI,Kl%ELI]:wL*/$ZM,m
leLOT*?qn%i%<
IldY%<
lV4-%S}Ei5
l!N]SSo%$rdM7E
Ilrx{a5
"Ilr`{a5
"IlrH{a5
l'}LIn%I
ml%SEiz
/Il-%L
IIl[)3(.-%%I]1
Im Z4-%Sl%
-%Sl%iz
ldKIlSw%i%
l&Sl%xeHl%:DIL{
LIQIlYt%I
l l%M`Rd
(yIlSw>%iz
c~Il%3*
%F`Mt%I
i9LXIn
dMK]l%9lXIl
c1\XI%2My?
dXIU R4-%
dl\|I R4-%
lJ`?-%,
I,Yl%g FIl*-%
g vIl:-%
;%I?sdoWLM`"
=Ilb9,%7
l%(DI3
$IlQ+/%i!}
l ..%}
$Illb74
Il )!l%I`^
!OP^[I`
)#m 7l%ELI
%E<O#lO#j
VIly:-%
|@NI]3
uE<O)#A0
) ;Axiz
EF!t%I
t%IcKl%1
|Jiw1)
F`EF!gF1p*?l%ox3c2Il%3
F1pPPJc_U'9h*
h C.%,\Ic
fIlE957
[E ..%:uR!
9oOhPRMcOPM[QIlQRL
!9k\m%I
@3$OnPRK
!h#l%=k
SIl%fE957
YaLm9h1Hl%P
&:uj$z9h*
DIl%NQ
RIp86HPM!Hl%
Ml%E3{
:rELIPp
RJl%[*EA
|?SIl%9f
gFp'1uy
L|ELIcVQ
IlQt%I
0MsWaH%3
j$`HaHpN|&I
E$``@H$j
zWm5ELIE`Wi$j
2~s9_0
C?EIIl
U%ELIY
?:ElQF
l'K{U/E"*7Ear
Ic/E";7EaKr
lt{n/EX0Z-%R
%d\XII
EU%UXK
dIc Ml%UXK1de
gU%Sl%!
IVEE2@~E`F@Q
d%1Eg{nXKopFX9h
IlW Yl%3Ek;l5I
E5?EIl$d
ELIbRh
%,&Ic/E'1]y
l/EU%1
J!1E}6\EN{nc'{n&m:Cn?EU%IlW
3o1ul%dx1o'3E
Ee?EeOeuEEIl?EpePe?EHe
Il##l/E)ePE>MIm%EEELIc/E'1
EGn3Ey;
x0J4-%3
%IlwRx %e,zFEIlAl*>sm%U*
e 1ET%a9nI
T%]9hI
T%@"wiz
Il%9yh?EMc?EH
Il%<Dtn%IlPP
Il%<xth%IlPP
Il%=obQc?E@Z
g9El/E'3
Il*?fE
dt@1;?RI ..%)-
L|SIIlcA
H ?-%iz
xLxSIlB
p3=u)-)-
HI`Fiz
xLxSIm%I*)-
xLxSIlBH}
AvJBELI
.%=kIl%Q?
I z.%$BMjNl%I
l:l%9`<O#lM
gF z.%
I ..%IlIl%M`FP ?-%<fLxSIlQ
dpII1Il])E}i1
dI+E-c
k%#lM?-%R,
%E|tIIl
QgHKI ..%
Vm?s"Ag
;@SI ..%O
$KIl.%3]3
l}tT%#|<
Mg4NI`^@Qi
%R/E%I z.%)
I ..%7
uE|hIIl|
P ?-%<fLxSIlQ
P FIlBQc
\pSI ..%7
h ?-%!}I
%IIluR
%^E{6l%
jl%ELI
+E<`<9l%9`i_l%M`.l
g!9e:um%
&l%3E3
El%CE=Hl%94t%;
g)TEpP
/AE1$IM`*f
`X1/`DF`D
`X1/`DF`D
-91Il%;WbIc!IcQEIlQF`"(
'l%9`*
OlB`}iz
%BH}@PE63E3 ..%1
ULYAyiz
lbxy/H
7|eI/Il /L
I~Il%3m3V
IlYAyEu7
!:)-EyRIl
g#l$l%#lMEl%7
%Ex/l%3
<wAcE<|#l(!l%3E3BEF
Il?Et)
nl%\`Fe
B|IjIl
g)-91h$7E]
D<h%l%9`?E E
DEDIEuR0
j7yB%F
A.3m3jNl%KE`Fe
M|IIlbHykEIlAbF
I3)0iE.LC
I3)0iE.LD
cc/EpYa/`DIl
L3m0iA>DD
c?EJE?EYAy/L
IB|iE%H
~EQEIlQE%L"Il
gE$EugEuRE
?E/`DM*
E&/EpYpF
IlYAyE$SvEiz
EC34Cnl%M.3cQEIl*>l%F
~EEQo%F
%<a?E/N
E>LDl*
Gc/EFhD`YmC3
Gc?ErEQF
N|iEb:
Dmffl%M*3D
~EEyi%F
DEIE9e:um%
%#mM%.%7
9t}/XDT)I3@)
E/`DF`DEg
3]3cQEIlQ#mM.%)7iEuRE
)3/N33@Qhcc/E$k(E2iECE
IlYAyF`Dt
'EIP%M*
P$<?Eiz
/l%9`b?
EAyE%H
~EQEIlQ#mM
D<9`>LFlO!IEHEt
Fm%IV7
D9FP!$IE
);9dIRD<{M.Hl%7
D<AIl~E`Fe
J|IjIlb`yiz
EIc>Il%HfEuR
DM:3f9e:um%
CgE-l%9`7E
Il~Y ..%O
Fn%EuR1%C3FR3
xIB9DlQ!$IE
);{yI ..%1
!IIlb?
..%3]3g9e:um%
%Ar14dMbIl?
(l%HzIV
-E~Il?
!Q>"l%IB7
ELIEFN
l%zK%FNO
2~s9_p%I>Ilv
i5yF"%iz
lbxyE%9Fl EI(l%
!:)-E9h
(l%#lMEl%7
G<AU~I`F
FecUBkXF
`$5E#l
l%ELIXFI
`$5E#l
d/E<5ELI
Ge%I]QF
M^3]QF
?E@H>tA
IlEI ..%9FlP#mM
IlO!ID
$%?EO! ID(EEE%<8
Go`F/FSE
ZIlbxy
G({I ..%H
~QQEIlPYEy#l
D)-EyIl?E
%R@6%#mM.%7
IlE%<ypIl%0QE
7jb4YQ
|YE%3]3
~Il?E#mM
FpF`$j
FpFbE$j
F ..%Q\MZ3`FHEO
3R:%t_
/-JIl|Q`FHEt
dA ..%S
;E`/`KAj
.7l%ELI
lsR41%
lsR(1%
;x'I?s_,W
l%;LI%I8].%33
ER0%hY={@N
9-@DJH|)
l%3<b?LEz
lMg.%7
IlJH|#l?E
$IlM.%EEIl
ErI ..%!IE
E<M~.%7
E<MIlR
.%gDuIl%:O%I
lMIlRAl%
{l%ELI
FlO#lO
l%3m39e:um%
}!%I:O
sI9e:um%
[$jj9mZW
%l%#hO#lMIlE<d
l%3E<h
zTBH}#nO#lsR
;%#l<YP IlsR9%xeQ@M`Bz
994`%O`L%
}#lElQ))3
: l%;PI:
l%M`BO!%I
-RL:%D
l%3]3`r,HlPCO9
P IlO)#nM.%
l%;_ZI$Ilz
Vy?s9~
I@VI@RI@^IXHY
lIl%ITtl%:4|$O
3m3ccLzWm`V
<EcK`DEy'
%F`DFaH):4'MHRK:$$:4%
$IccxH)
!M`bH)1
jAcOE9
$`Fe9->-m`^Y)3`^eb
7|#I*Il
7|2I"Il
`EH`B)3
yO`EM/:
y%I`EHIl
/$l%43*
zIl%9,P)
ll%/$L
M`EJcHIIl
:Il%M`EMct%I
M`EMHBTA%)
kW^7XI@B)3
JQIlP)
N}L*g*]-**,**,**
*U*]-*9h*U*
FE**.%Il}**LWI
;,%*t*M*<-*
q*5*zE*T%*Pr*(*BSEI|eeN}LIg]gGM
l3*E**<*3*
l3*E**<*3*
E*gb`y
l%Sl%)-<
Nl%FpE
3pD)-0Mj
>}AmF5!
XIl%X`He|*
p|b`y#dM*Il%7
uR>%F`E
IlO))-<
l%9Hb9jCE
9hJx|wI(Jt3
:Ml%9tIlPxKl%;+I`Z
P=E,zF
4]K1%gbx
Il\)3;*
IlO#lbJi\
l%9t2.%3
>IlbJ)1\I]59
Io ".%
WctI`btIXbF3ch5
*.%R,=%)R
xF{|,mQ\
lJx|#,M
.%3o :.%dtII`N{|2%&0*.%Y`NM
l?3o`Jy\
\)3`JM
>.%9k1/ga\
!9$=)&
P^hIP^nI
Hl%iI]
;aC$|;FI
.%<(BH})-
eR< %dI
lMH0,%I
Ilzs9_
L$I0.%9un%Qc
Hl%1\dI
Hl%1\dIYMlQF`D
AgnI_ l%9ldIlzs9_
L$I0.%9un%Oc<
)9^Ym[)3Ep3=u ;E
:JE<drR"%
-)|Mky
l%)P"=;r
I3):ukyAc!f
3]3c$NCPF`D
p3;lBYa;EXI
R*%!L$I
l%9`M(%!o$IIlBH}
1Vi?s+
5IlMxT%q
lBH}!,
IlO#mOcI
l5hl%M`^C}
uE|IIl|
FIlDc6Il%REB
L$I0.%3}nBH})#lLyim%Ji-
lue#lOXoI<
IlAg(5
zIl~A#`I
2Il~EM`Z
;d$I?sRP
dzL<?E
,|/@;<1Ic?E E
@|iD%3]3E
l%3C3m3E
DYmuR&%
EcL-c}
'}g^%II3
-F~EIl]D}DuRd$% A
dzU<qE<`?E
l%39mAH
63k?'E
IlO!%I
&Il%:DuR*%BH}
l%I<M.%1
l%!^IFlI$B?E
)Ils}h
@~Esl%7
l%|iD%Qp
U@EF!)IF
wIlODuR()%@QDulgGuR$%
)3m3B<cI
%Gs1<d
(gI9rg\cI
%!WIPZ
I3{s9_
)Ilsf=MN3
E<M.%7
l%9p?E
Il?E\H
Il,z=4M.%R$)%#luSg
FIlB`}:?E
NIl,z=HM.%Rp)%#luSg
IlBH}NM.%R\)%#luYg
.IlMc;%
;x$I?szA
HN)-9puR
E<M.%7
l%9p?E
RIl}XH
%l%#nO#oMIle7
%!|Ip^
l%Sl%4I3
EHgxaI
%!mIp^
l%I%#lX
l%MV3eLE<n
%!IX[4vl%
gIPFdI"6l%
;x$I?s1-
<^ODu1
:Il>LEl
9puRE]D}
E<M.%7
l%9pO!%I
&Il%:DuR-%)9P!|IIlO
ICIl]D}%I
l%I<M.%EzVIlB`}!lI
-%O)!lI:
IlBH}MIlML.%R@.%#lu
eIPB`eI3{
wl% ;|
u%?=EIV%YDg`%I;x
l%I<MR.%14d
l%94`%T
IlElP!I"IlO
I"|Dl?E
94`%%IEF
Ie%IeJl%7E<?E
E'7Q]DrEEz9|
/9E"UG
Dr14dMvIl
EDIlb`y)-E9h
;x$I?s
0l%MJ3
%I^gc7Il%:2n%%I@
RIlx/pD/*
)|iD%I9pu7
E<A9`(Il%;
ce]Sl%W
gDuR(,%
gDuR|,%
gDuRX,%
IE=NOzU<?E
/$BO#mO0
IlO#l<vl%9`C}
duRT%C3
I`N#|<MIlB
94`%EP -A~AXH
)E<|sR-E
-;[IXK
E<|sRE
ul%I<M.%E
;p I?s1-
T%#lMMl%7lE<
I3E3eLE<kvR
IEIF3]3
!7lE<?E
:3~EIEI
2~EQEIlQ#mM
.%7lE<d9`>LlEl?Et9v
&Ic5Ml%
IlZt(`
c7Kl%S+h%t?l
cqKl%S
>*>m%6|
?vh&I9Il
)vF.IlEJl%
5vFVIlUJl%L
=~EQEIlQ#jM
.%7lE>h
F%FuR9E/-;sIFzE<<ul%9|M
.%R\V%#lu g_
l%S6o%!|I
P%FuRU%@M
!0y%F.LlER1
<cO#lvRE
9iuI?f9`Bx}'I^I
Il*Kl%:2`%\
9iuK?*9`BH}
E@QzU<M.%7
rl%9`M@L%@uRT%#lu7
I4IlM.%RT%#lurg_8}l%Sm%!F%n
ESm%!|I
?89dUl
lL~l%I<M.%Ez
IlHl%3E3
lh~l%I<M.%EzIlU}d%Z$I
~l%I<M.%EzIlU
l0~l%I<M.%EzIlN7l%MR3Ilb
~l%I</E
R`_%%I
~l%I<M.%Ez.IlU
U~All%Q
<wM.%RZ%#luhg_|{l%QP
l%I<M.%EzIlM
%uM.%RZ%#luMg_0{l%3]3 @z
"$cAI3
$R Y%B
!?H:||l%3:}l%3#3m33{
p3Kl% ;U?;9IP
El%33E;d!I
luR_%}8
%!I~R_%DM{.%EEIl?E@Px~Il%;GI
ePbD/E@P>?E
?EDuEEc?E
:M%.%8
zl%3]3~R^%F
I5T9%S%
Ie@XFJm%=~
IIlJ`|#l<O#lO
)R,_%@*>l%
<KO)#lO#lYfIlJ`|
EeEB6EZE6IlJ?
*E~>Il
7xMlp3
:r1<dYReBx} rIl
|Mr%E<`sRdY%
:r1<d6_3E3
&I5,z<u
Ll%O'I_nl%7
lO#lp{l%
%Il?IE
.IlOAuO
lArIl~l%MB3:Ml%x#Hl%1
EIEIMB3
6Il~Ae~
IlBx}#jM3.%7lE<
IlBOcwIl%9ElBx}Au
g%FzO<Dzl%9`
Il%;}IFRE
eG0.%3
E)7\>INEEF/g%FwR _%
57lE<Lyl%I</IE
R@%]BH}%FuR\%#l/E
ICul%SNE
2~sh%Vq?sfjnIl])3]3
IlO!|IIl~E]Il])3
lB`}F`
"Ilx/pT/`VKlO)
Il,z=zvRG%])3]Sl%#ivRG%$B|%IM`f<<vR(G%
lIl%M,
L|IM`j<Ox%I@F)7Mi5<
lu_e#lO
I<(dl%33
%E<dM,%I
zl%M`Bzs9_
B}c9%)Il%}
$IllO))zE<gl%3E3
~IlO))zY<gl%
);H4I`
`F])3`
%))#lO#LO#lOQ0
l'A8.%QO8.%#l\dl%
el%;RIP
!,;\mI]
fl%9`B
$B]zIlO
Il~Q3xy
xuE<|EPj%I
'c3E3ggl%7
#KlO#lO
)E<dgl%
E<t]P#lYPF
IeEPFT
Il])3PFL
V]:r1<xQ
BIM`J<MIn%IP
-RA%@Qx
RA%])3cQ3{s9_
"I6l%9tIlQ
I<xel%3
B`}IU`B<Y
l%#lO#lM.%R<@%I
!8E|IFIl9Il])3`F
H!7\_Iu9_
d9YK3E3X(raP
>`HwE<|dl%9`TO%
'Q++rlP
)=MrlPm:uo/[`l%;
Il,E=wbJ))
5RK%))-3E3]
x)dBW}
`R)M,`J
r14reg
ol% ;74d3m3N
D<Ek~A
E%EIl%MDb1G
sl!I;O|
!Ilnl%;XI`E{
P$<}#d/EHwR]
lMt.%ED.Il~]
l]B!I<Tcl%9xil*>Em%E%IlZIl%;%\II
l%1Gor
{o/E}(;
jIl~]r;G%IcEDP%u1
D<M.%x
bEVSrm%)93
Dbl%SJm%%%
%Ikl%1
DcHl%1
_:1mU=]I
KE<xM.%7
G<`l%9`T?>%Er,HlPCC3G
P7iEuRO%
+F~MJQZ
E5?EEQJ1
IN7l%E<
al%9dJ`|#lO#nO#lMIleE<d
GBRI%#l
EEtll%3E3^RO%E
ml%3m3?
G#;1MI3{
MB3c<M4.%7
E<|nl%I
lM.%Hl%:E
M~iC"l%
p3&Kl% ;}
E)-1Mi$Il?
`|L:,ml%1
dKig3EM
3:ml%3
R,H%9-1
EqLqH./
E bIl?9E
E"RlH%9-1
n$G}p%!IIl?
BO#l?E
.%Kl%:~E@P Il
RE!h$IFGuRL%
IlBH}Gu7
E<8ll%REGMy%#(ODuRDI%
?EHlB`}DuRAE
R0L%K7I3
lM>.%7
E<<ml%9|?"EI
IbIly@P!&IRIl?"EH
\l%9ElQ!l
IlMHl%7
E<vRM%#mM
G%3m3(9ElU'
%GuR<M% fIlBH}#l
= ;]7nB
E<dHil%3
I9E<|lil%3
M`VvRL%C3
$jFpLH*
YDuIIl|xUm*.`RjMCA%#hQ<J
<$kl%9`A9iuR<q%
BEcaL,uR
|'(8I?*
$jFpL(5
:xVl%7
Wl%3m3`B
2~s9_$:IIlv
}E,:IM
Zu$g>I
c(Il%3E3?
I@PZEFIl
Zu>Ieg?
I@PZE*IlBx}xeQE#;7.I3{
p3)Il|Rl% ;A
BH}x}
P$<x#dKHtR
-ng "Il~AP
I$BO#lO#lO!l%
:Tl%3$l%7lE<
.IlvRtp%
IlIl%Q[MN1
;!I?s]N
sl%9ElBx}xA@-l%8Ip8'GB`}>I<
.%Kl%:E@*>n%!h$IFGuR8v%
ME@*>n%!IF
)l%7E<?E
%7E<XWl%9pB`}DaIl?EHl%
?EHlpl%M:3
#lO#LO#lODuI
lM>.%7
E<Wl%9|?
Il|@P!&I~Il?
cHl%I%T>I
:tRl%;7HI
$8gFuR
)%FIl?
?,9d,zF
.R7EBH}
gp>I<Mh.%8I@P!I
)QV&9_u
G,9`B`} IlBH}G$Il?E
IlB`}#l
2~sh%V]?s1-
B])3?Sl%3
IlqY>Op<I
IlvRhv%
%I.Il|#sRu%
}) IlsR{%)QEIl])33{
p3=u ;iZd;
-Rv%])3\IIl#l
2IQ%IW!IVIlM
.%2I`B
BT_l%H<
5E<`AzIl
2~s|%t ;AM(_M)P%Ma% IlOm?wR
2~sh%Vi;
F;CFI`XIIl
<IrIl])3`^
rIlO#lO)`<Ie
Ilzs|%Rl%R`y%
%'I3E9LId
K%$3I<Sl%RE"IV
o%<IM%N]Sh%M#I
l%M&3J9e:um%
.%dMug,E
IlJx|#l?E
l%So%F%&IF
IlO!IF(AEC3E
El% &Ic?
lr,HlPC}K;O!IFDCE
7iFu7E<Zl%;fI!%GuRp
EscHl%:EV*?
m%F%;dIB!IF
IlywGP"{s
EF[Il|uV%Q0
cl%M"3F!IF
Il~]fIh%BuR
E<$^l%9x?E
Il=3l%M"3F9hu7
E<M.%7
^l%9|OBuRx%
IlO!:IFHGE@*?%m%FzL<
_l%BBEcHl%9LId
Il~Ypjl%
}%DuRdx%N
LECPN>LEl
EEF!TIFP3I$J?E
NR|%BuR<
%Dr1EYH;Yl%7
E<OBM,%I
BIlJ`|FuB
9`y@*?UEB
'UMh0%iz
l-klI ..%;
lO#ll[l%
5I3xYlp3Hl%
{l%Mr3m3
^4-%R|%
&Iv4I7
%(5I`J
Ilp_l%M~3`Z
|%)t5IIl]D}#m<<29`|bYz
lM.%Sg!m%
`^B`}!I
lM.%Hl%:JE
2xYlp3
EIl'#,Yl%3
Ml%_g!I
..%ELI:N'3
D]E`FF`F
E<n19xBx} Il
..%ELI
uCg!aI
9x,z<h
lMIlRAE
2~s9_4I&IlsU?
bql%9LId
T5IlJx|#SM=-%R,~%
-c3Hl%;
IlOLuR|~%l%3E3V(I
7PE<XDl%7
E<Fl%3HEc
2krH@L
tI;M~.%1HE
E<pGl%E
TU%Tu7
%Hg!hIFDuR E
EjAl%7
E<0Gl%9ElQiz
;`'I;6933
l>9tBH}
lO#llDl%
.I3xYlp3=r
..%ELI
Gl%;}I
l\Dl%7
e#lO4(I<Bl%3m3
;$I?s2@
I ..%Iz
g!h$IN#lHCl%3m3
IlEF$IlO
Rf%#lOPL>
.IlbHy#l?E
<E<,Cl%3]3IlI
PB.IPF#,
Bl%3J;$I
M[,z=cB
l-klI ..%3E
;M=-%Ra%
3*9e:um%
YH*9e:um%
9mw!IIl~E*9e:um%
YH?&l%7FE
;MJ.%R
75k$R a%C3\I*9e:um%
YH4@l%R
a%C3\I*9e:um%
YH*9e:um%
10E7FE
75k$7FE
;M.%R`%
75k$7FE
;Mj.%R0`%
I*9e:um%
YH;El%9h
.%3E3*9e:um%
75k$;]
I;@Bl%9h
.%EEIlII_%
l-klI ..%
;!I?sjq
l%Rpk%!I
%Hl:-Ij
F|x"IjR<k%#mOl%33TEMm%!INIlJx|
"I<<Bl%Mm%GuE|XI6IlO!In
l?mEI(..%33LERf%hYM
FJ?UE?vEH
!GP"{s
F$0SEP-
|ZE^JH|
%7GE<?E
J?QE?fE
%7GE< Nl%33xEHIlMZ.%
IlT(%i]
J`|!lZI
%Rk%)9,%9,%}
IlJH|)Il%9,%9,%;P
gio%iz
lO#lO#mMIlIl%:!l%uI
lMY.%I>IlJ.%
g#lO #IM
3!n'I6IlM'.%I
4g!IIlM.%
lM*-%Ro%
JM.%Ig
lMj.%R
lIlJH|!IIlJ-%
doENIl}/
.%;~IrIl}/
.%Im%Du
'I9L,z<!ODuRE9E
lMJ.%d|-I
8b~a47
E<M*-%Rn%F
lMZ.%gDuRk%
jIlO#lO#l
El%8e!
%RWEYz
&J/%*l%I
J/%*l%I
J/%*l%I
J/%*l%I
J/%*l%I
J/%*l%I
J/%*l%I
J/%*l%I
J/%*l%I
zJ/%*l%I
~J/%*l%I
rJ/%*l%I
vJ/%*l%I
jJ/%*l%I
nJ/%*l%I
bJ/%*l%I
fJ/%*l%I
RJ/%*l%I
VJ/%*l%I
JJ/%*l%I
NJ/%*l%I
BJ/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I9_
9LQI#l
Hl%H;O
HPzs5VI|%dl5I!tl5I
!%IqA]
H!xAl%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
:M/%*l%I
>M/%*l%I
2M/%*l%I
6M/%*l%I
*M/%*l%I
.M/%*l%I
"M/%*l%I
&M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
M/%*l%I
zM/%*l%I
~M/%*l%I
rM/%*l%I
vM/%*l%I
jM/%*l%I
nM/%*l%I
bM/%*l%I
fM/%*l%I
ZM/%*l%I
^M/%*l%I
RM/%*l%I
VM/%*l%I
JM/%*l%I
NM/%*l%I
BM/%*l%I
FM/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
:L/%*l%I
>L/%*l%I
2L/%*l%I
.L/%*l%I
"L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
L/%*l%I
zL/%*l%I
vL/%*l%I
jL/%*l%I
nL/%*l%I
bL/%*l%I
fL/%*l%I
ZL/%*l%I
^L/%*l%I
RL/%*l%I
VL/%*l%I
JL/%*l%I
NL/%*l%I
BL/%*l%I
FL/%*l%I
O/%*l%I
O/%*l%I
O/%*l%I
O/%*l%I
O/%*l%I
u?Bb?B
/r)+v0$@
B]02v,'p
W*|f[J[F[
RsWsowO{fv7
tcf[F[J
Bs|Jy*
tcf[F[J
r-'r/6a
<Qr3Or3
+*z_2a
B_yB="
B"??_{RyB
M[J[RA
t;f3t'Js
b([fgvets[JsoL{Bf(
Ft"NwSyB
t*z#oQ~#o
tJz#orB
FN 6;Kh,)
tBN#oKo(
F"?4Gvs
H6BFv{~B
<V<N<~<
SvCvCvv
B'V<og
vsvkvxsB
':'{_OB
|R'~<N<V<U
vCvsvkB
vCvCv,B
BC&Cf[M[Ju~sf
n7 |C&CfK
B::z/0|
B02v27g
[p9@p8v
t)9zA!zy
poppppppp
R*VD@~k"Fv
2)P5dQ/z
+`Q!|P5p
}6EgzZ+)
x6M&)OpwZr!
T3B6#!p
g`-6wNgz
^A~2RB/+
3dV`?Or#Vy/
^AB9UBK
,v#gfC+}
'.X|/9
'}Q$aNl`
3dV`?Or#Vy/
.fBe6Xb}
'.Z16X|/
#~Be6X|/
G:|6Z7/+
-}]g`_/v
/v]$aN`-Q*g
Z16M+3'b6rH
_bC;b3_b3>
R&bcuB!ObR<
Mq#/o\rH
Mw#]g`_!wuB!ObC
Z16#B6
b3_b6_g`_g#
b6M+)OpzZ1
.3Jw rH
Mt3R-xuB"ObQ1
VuB!Hb1
Jw#/oVuB6Z1
'aMB6#g`
>MtQ:z"Rp"Mz#J
CNl#Kr#2#
0|Kr#P
JC*":0a
G/m"Ob'Kb[
%~Eb}R!r
-aOv/+
0|Kr'_
CNB6_g`<
'a>7g<-~
]\q!Hr
g`$g`_e6XBH
B)Em<6,g
b6EB6_
gWL5/n
fO0nB1tO0nB1teWL5/n
fBz4^0n
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
closesocket
connect
gethostbyname
inet_addr
ioctlsocket
listen
select
socket
CoCreateInstance
CLSIDFromString
CoTaskMemFree
CoInitialize
CoUninitialize
SysAllocString
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalMemoryStatus
CopyFileA
InterlockedIncrement
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
CreateDirectoryA
LocalAlloc
LocalFree
OpenFile
OpenMutexA
OpenProcess
PeekNamedPipe
CreateFileA
ReadFile
RemoveDirectoryA
RtlUnwind
SetFileAttributesA
SetFilePointer
CreateMutexA
TerminateProcess
TerminateThread
CreatePipe
VirtualQuery
CreateProcessA
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
lstrlenA
lstrlenW
CreateThread
DeleteFileA
GetWindowTextA
GetWindowRect
FindWindowA
GetWindow
IsWindowVisible
GetClassNameA
GetForegroundWindow
LoadCursorA
SetTimer
KillTimer
RegisterClassA
GetMessageA
CreateDesktopA
SetThreadDesktop
GetThreadDesktop
TranslateMessage
DispatchMessageA
SendMessageA
CharUpperBuffA
OemToCharA
PostQuitMessage
ShowWindow
CreateWindowExA
DestroyWindow
DefWindowProcA
GetStockObject
DeleteObject
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetSecurityInfo
SetSecurityInfo
SetEntriesInAclA
__GetMainArgs
_sleep
_strcmpi
_stricmp
memcpy
memset
signal
sprintf
sscanf
strcat
strchr
strncmp
wsock32.dll
ole32.DLL
OLEAUT32.DLL
WININET.DLL
KERNEL32.DLL
USER32.DLL
GDI32.DLL
ADVAPI32.DLL
CRTDLL.DLL
L < C < C < C
P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C
d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C
L < C < C < C
P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C P C
d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C d C
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.