SmartHawk

1.2

低危

该样本未表现出任何异常！

重新分析

下载样本

043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff

043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe

分析耗时

73s

最近分析

391天前

文件大小

101.2KB

静态报毒动态报毒 UNKNOWN

DACN 0.14

FACILE 1.00

IMCLNet 0.81

MFGraph 0.00

引擎	描述	特征	威胁分数	可能家族	检测耗时
DACN	基于动态分析和胶囊网络的可视化恶意软件检测	API调用、DLL以及注册表的修改情况	0.14	Unknown	0.05s
FACILE	利用改进的层次胶囊网络对二进制恶意软件图像进行识别分类	二进制图像映射为的灰度图像	1.00	Unknown	0.03s
IMCLNet	轻量化深度卷积网络模型实现恶意软件家族检测	原始二进制映射而成的可视化图像	0.81	Unknown	0.21s
MFGraph	利用静态特征构建图网络以检测恶意软件	原始二进制PE文件的静态特征节点	0.00	Unknown	0.00s

未检测暂无反病毒引擎检测结果

可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报） (4 个事件)

section	CODE
section	DATA
section	BSS
section

一个或多个进程崩溃 (20 个事件)

Time & API	Arguments	Status
1727545293.4065 __exception__	exception.address: 0x4149f2 exception.instruction: div ecx exception.instruction_r: f7 f1 eb e8 eb 03 ff eb ff 13 c5 2b f6 64 8f 06 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x149f2 exception.exception_code: 0x80000004 registers.eax: 0 registers.ecx: 0 registers.edx: 4272174 registers.ebx: 2130567168 registers.esp: 1638204 registers.ebp: 1638292 registers.esi: 4278674 registers.edi: 0 stacktrace: RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x775b9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x775b9ea5	success
1727545293.4065 __exception__	exception.address: 0x414a2d exception.instruction: jae 0x414a0b exception.instruction_r: 73 dc cd 20 64 67 8f 06 00 00 58 61 eb 02 cd 20 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x14a2d exception.exception_code: 0x80000004 registers.eax: 1636402 registers.ecx: 4278755 registers.edx: 2002545357 registers.ebx: 0 registers.esp: 1638172 registers.ebp: 1636480 registers.esi: 4278755 registers.edi: 0 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x41308c exception.instruction: int3 exception.instruction_r: cc 90 8b c0 f9 90 8d 04 5d 34 12 00 00 f8 90 c1 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x1308c exception.exception_code: 0x80000003 registers.eax: 0 registers.ecx: 0 registers.edx: 4272233 registers.ebx: 4272233 registers.esp: 1638244 registers.ebp: 4272255 registers.esi: 4274310 registers.edi: 4274310 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413090 exception.instruction: stc exception.instruction_r: f9 90 8d 04 5d 34 12 00 00 f8 90 c1 eb 05 fc 90 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13090 exception.exception_code: 0x80000004 registers.eax: 0 registers.ecx: 0 registers.edx: 4272233 registers.ebx: 4272233 registers.esp: 1638244 registers.ebp: 4272255 registers.esi: 4274310 registers.edi: 4274310 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413099 exception.instruction: clc exception.instruction_r: f8 90 c1 eb 05 fc 90 c1 c0 07 90 90 33 db f7 f3 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13099 exception.exception_code: 0x80000004 registers.eax: 8549126 registers.ecx: 0 registers.edx: 4272233 registers.ebx: 4272233 registers.esp: 1638244 registers.ebp: 4272255 registers.esi: 4274310 registers.edi: 4274310 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x41309e exception.instruction: cld exception.instruction_r: fc 90 c1 c0 07 90 90 33 db f7 f3 64 67 8f 06 00 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x1309e exception.exception_code: 0x80000004 registers.eax: 8549126 registers.ecx: 0 registers.edx: 4272233 registers.ebx: 133507 registers.esp: 1638244 registers.ebp: 4272255 registers.esi: 4274310 registers.edi: 4274310 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x4130a3 exception.instruction: nop exception.instruction_r: 90 90 33 db f7 f3 64 67 8f 06 00 00 83 c4 04 66 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x130a3 exception.exception_code: 0x80000004 registers.eax: 1094288128 registers.ecx: 0 registers.edx: 4272233 registers.ebx: 133507 registers.esp: 1638244 registers.ebp: 4272255 registers.esi: 4274310 registers.edi: 4274310 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x4130a7 exception.instruction: div ebx exception.instruction_r: f7 f3 64 67 8f 06 00 00 83 c4 04 66 be 47 46 66 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x130a7 exception.exception_code: 0xc0000094 registers.eax: 1094288128 registers.ecx: 0 registers.edx: 4272233 registers.ebx: 0 registers.esp: 1638244 registers.ebp: 4272255 registers.esi: 4274310 registers.edi: 4274310 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x4136a8 exception.instruction_r: 8d c0 74 03 cd 20 64 67 8f 06 00 00 eb 02 cd 20 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x136a8 exception.exception_code: 0xc000001d registers.eax: 784913 registers.ecx: 0 registers.edx: 1631 registers.ebx: 1996041745 registers.esp: 1638212 registers.ebp: 4272255 registers.esi: 4278674 registers.edi: 4278674 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413aa1 exception.instruction: div bx exception.instruction_r: 66 f7 f3 0f 85 5b 01 00 00 0f 84 55 01 00 00 8d exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13aa1 exception.exception_code: 0xc0000094 registers.eax: 0 registers.ecx: 0 registers.edx: 335633487 registers.ebx: 0 registers.esp: 1638240 registers.ebp: 4272255 registers.esi: 1995328620 registers.edi: 4279712 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413ae4 exception.instruction: clc exception.instruction_r: f8 0f 83 1a 01 00 00 8d 85 84 0a 00 00 89 44 24 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13ae4 exception.exception_code: 0x80000004 registers.eax: 4274882 registers.ecx: 4274832 registers.edx: 2002545357 registers.ebx: 0 registers.esp: 1638240 registers.ebp: 4272255 registers.esi: 0 registers.edi: 0 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413b27 exception.instruction: int3 exception.instruction_r: cc 90 e9 d7 00 00 00 8d 85 c2 0a 00 00 89 44 24 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13b27 exception.exception_code: 0x80000003 registers.eax: 0 registers.ecx: 4274882 registers.edx: 2002545357 registers.ebx: 0 registers.esp: 1638240 registers.ebp: 4272255 registers.esi: 0 registers.edi: 0 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413b67 exception.instruction: div ebx exception.instruction_r: f7 f3 85 d2 0f 84 94 00 00 00 8d 85 05 0b 00 00 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13b67 exception.exception_code: 0xc0000094 registers.eax: 2284013426 registers.ecx: 4274947 registers.edx: 0 registers.ebx: 0 registers.esp: 1638240 registers.ebp: 4272255 registers.esi: 0 registers.edi: 0 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413ba6 exception.instruction: int 0x68 exception.instruction_r: cd 68 66 05 7b 0c 66 48 74 55 8d 85 45 0b 00 00 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13ba6 exception.exception_code: 0xc0000005 registers.eax: 4276992 registers.ecx: 4275009 registers.edx: 2002545357 registers.ebx: 0 registers.esp: 1638240 registers.ebp: 4272255 registers.esi: 0 registers.edi: 0 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413bf0 exception.instruction: int3 exception.instruction_r: cc 90 66 81 fe 47 46 75 0c 64 67 8f 06 00 00 83 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13bf0 exception.exception_code: 0x80000003 registers.eax: 0 registers.ecx: 4275076 registers.edx: 2002545357 registers.ebx: 0 registers.esp: 1638240 registers.ebp: 4272255 registers.esi: 17991 registers.edi: 19021 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413df1 exception.instruction: inc dword ptr [edx] exception.instruction_r: ff 02 eb e8 eb 02 ff 20 48 2b d2 64 8f 02 5a eb exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13df1 exception.exception_code: 0x80000004 registers.eax: 699275003 registers.ecx: 2002466938 registers.edx: 0 registers.ebx: 0 registers.esp: 1638208 registers.ebp: 31070 registers.esi: 4275307 registers.edi: 4275331 stacktrace:	success
1727545293.4065 __exception__	exception.address: 0x413e29 exception.instruction: jae 0x413e07 exception.instruction_r: 73 dc cd 20 64 67 8f 06 00 00 58 61 eb 02 cd 20 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13e29 exception.exception_code: 0x80000004 registers.eax: 52 registers.ecx: 4275682 registers.edx: 4275682 registers.ebx: 0 registers.esp: 1638176 registers.ebp: 1636484 registers.esi: 0 registers.edi: 0 stacktrace: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x13de2 @ 0x413de2	success
1727545293.4845 __exception__	exception.address: 0x4146f1 exception.instruction_r: 8d c0 eb 01 eb 68 33 c0 eb fe ff e4 cd 20 8b 64 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x146f1 exception.exception_code: 0xc000001d registers.eax: 0 registers.ecx: 615710720 registers.edx: 3221225524 registers.ebx: 1848 registers.esp: 1638236 registers.ebp: 31070 registers.esi: 4278673 registers.edi: 4194560 stacktrace:	success
1727545293.4845 __exception__	exception.address: 0x4147c1 exception.instruction: div edi exception.instruction_r: f7 f7 eb e8 eb 02 ff 20 23 c7 e8 0a 00 00 00 e9 exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x147c1 exception.exception_code: 0x80000004 registers.eax: 1998421471 registers.ecx: 4278015 registers.edx: 2002545357 registers.ebx: 0 registers.esp: 1638208 registers.ebp: 31070 registers.esi: 0 registers.edi: 0 stacktrace:	success
1727545293.4845 __exception__	exception.address: 0x414813 exception.instruction: jae 0x4147f1 exception.instruction_r: 73 dc cd 20 64 67 8f 06 00 00 58 61 f9 72 02 cd exception.symbol: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x14813 exception.exception_code: 0x80000004 registers.eax: 0 registers.ecx: 4278194 registers.edx: 4278194 registers.ebx: 0 registers.esp: 1638176 registers.ebp: 1636484 registers.esi: 0 registers.edi: 0 stacktrace: 043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff+0x147b2 @ 0x4147b2	success

在文件系统上创建可执行文件 (5 个事件)

file	C:\Windows\win32dc\DAoC + cdfix.exe
file	C:\Windows\win32dc\FlatOut_serial.exe
file	C:\Windows\win32dc\BattleField 1942 + hack.exe
file	C:\Windows\win32dc\DAoC_fix.exe
file	C:\Windows\win32dc\Doom 3(crack).exe

该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (6 个事件)

section

{'name': 'CODE', 'virtual_address': '0x00001000', 'virtual_size': '0x0000a000', 'size_of_data': '0x00005600', 'entropy': 7.992235378339067}

entropy

7.992235378339067

description

发现高熵的节

section

{'name': 'DATA', 'virtual_address': '0x0000b000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000200', 'entropy': 7.537443661508319}

entropy

7.537443661508319

description

发现高熵的节

section

{'name': '.idata', 'virtual_address': '0x0000e000', 'virtual_size': '0x00001000', 'size_of_data': '0x00000600', 'entropy': 7.871666928051274}

entropy

7.871666928051274

description

发现高熵的节

section

{'name': '.rdata', 'virtual_address': '0x00010000', 'virtual_size': '0x00002000', 'size_of_data': '0x00000200', 'entropy': 7.582096724860129}

entropy

7.582096724860129

description

发现高熵的节

section

{'name': '', 'virtual_address': '0x00013000', 'virtual_size': '0x00003000', 'size_of_data': '0x00002400', 'entropy': 7.596943615976609}

entropy

7.596943615976609

description

发现高熵的节

entropy

0.9705882352941176

description

此PE文件的整体熵值较高

与未执行 DNS 查询的主机进行通信 (2 个事件)

host	114.114.114.114
host	8.8.8.8

操纵非子进程的内存，表明进程注入 (2 个事件)

Time & API	Arguments	Status	Return	Repeated
进程注入	进程 1848 操纵非子进程 1848 的内存
1727545293.4845 NtProtectVirtualMemory	process_handle: 0x000000b8 base_address: 0x00400000 length: 4096 protection: 4 (PAGE_READWRITE) process_identifier: 1848	success	0	0

288x288

224x224

192x192

160x160

128x128

96x96

64x64

32x32

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

PE Imphash

3c0e70bfa5f73f1f1cef484e2bcb5bf8

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
CODE	0x00001000	0x0000a000	0x00005600	7.992235378339067
DATA	0x0000b000	0x00001000	0x00000200	7.537443661508319
BSS	0x0000c000	0x00002000	0x00000000	0.0
.idata	0x0000e000	0x00001000	0x00000600	7.871666928051274
.tls	0x0000f000	0x00001000	0x00000000	0.0
.rdata	0x00010000	0x00002000	0x00000200	7.582096724860129
.rsrc	0x00012000	0x00001000	0x00000400	6.753357619284395
	0x00013000	0x00003000	0x00002400	7.596943615976609

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x000150be	0x000002e8	LANG_ENGLISH	SUBLANG_ENGLISH_PHILIPPINES	None
RT_RCDATA	0x00012448	0x000000a8	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_RCDATA	0x00012448	0x000000a8	LANG_NEUTRAL	SUBLANG_NEUTRAL	None
RT_GROUP_ICON	0x000150aa	0x00000014	LANG_ENGLISH	SUBLANG_ENGLISH_PHILIPPINES	None

Imports

Library kernel32.dll:

• 0x414c2e GetModuleHandleA

Library user32.dll:

• 0x414c36 MessageBoxA

L!This program must be run under Win32
.idata
.rdata
8\plJ
{{~nZc
9HGuX+r)"
xT{5-l;^`
y.%mtB)DHV
5)VBdY
t;jj+iOi%
nj`.J[D
,"V:&Q>|KE`
nST(>v
!*QqM5#
]Wi[m.0P
PJ8Sn;La.v
3pyG(Tv;L=dxjp
rdK'p pQ
">nPccB
W?qK{_|
F<[Qg%
VTOoU}
r'a%=xF;
Nzv@UG~
/(>)Xod?T
/G@1w!K]@
Z{CDkZ$
37; WpA
&T;$c^_v>Bq
OdtG=yK
@w7ON2~7{
c&N1%4
B(N&U(gO.Q
xYb4~6Ys
1P\1S 
sc~%Pa=A|94
G)Ek|u'8^/
YY &p!`e
;~c!,?y3_
%"L]GS[B
T n.AT
X\IkRl
Ko0X]ZH>K
$.a1X_w4'k.
:OgKcfp
@~3?rP+l/eE,
QZ_c}Wid@
<4fKN@h
;:.i%<FS
tv{%7/7vz
A/b'P<a:[AOL)>>0
(~)<.u
-%\UU8)
@'!Rfi
SiOIg'
RzP=\ ?o/T~P
w#6IBV^3f_
"(]x-@@P).,
4v&@m6IQ#
\mvD8+
:W~/>H,
`YJ"td3
3@'@{KFe:'Y#q_Q
^T"_z*
V#Sd:?rc
b{kZK<
NPcBsP
70eJ5X~{O-4J
$e([47t$
] >g2j
_p's;4*iG?mJNX
Td2Y9TN:v
z:lxXq
xj3eJ<IJ
9C_/W4m?+M<V"zJ
76(SY:
AG%%sO|;dm
$)8heVA
\dmY&0
NiG0[\s
]*}6K>j`g
^0t$DB;`6>l?-v%E$N U-tf
y-"'Z:
O,W6C'hF3|
{s5k){
)dh2]+
D .b[1fV
3>|X`NZdQF;?%>cWh,.9
}"P38*fO
ZeY,7JB
vt;vwHT
l (_\CV?
Xt%W,p
aHAkf,#
* !s2`WUmR
6j|f[gk)h
$G{!6y}g
b"7S#NaLr
Lv$9^
9.u2; zZS
_rtNCfa
$brI~u@2(q}')H
ZDFenI
`mZRj;
Bz:%E}
7n}@49
p,6Tl6eje
U2KWD^4
V!grHg
$`t|F6z:
: %kh<F}WAcTvcQg
0HiA<k`<rdp}G!j
p,.-ZE]
a3<_bw]&
qH\zn!x
*Mj=gK$U?/[j)
dKLot>GP_K9I2V
>H#T^=V9?ki
PbPhX
Cs" uuQ6+$K`t
gDvM\~
.MM[RMRG[~i;g
qUsVPEd/
r;zfk"Ye
K~#$18-q
M12;-
0)}P"N'T*NR-
$-vog|
,5Gvd#
8d`bl)!
!5{y9/-b
UCbPK1>bx
r2fh1q
FEg[8<#
~KW7%e19IN
^@|?7u!
H9IQl_N4
7s:R7NL,KS
,&Y '`E
$7lp5G9
aWJfJwp
_-yJ5tw
p'L*qpQ
6,K@|[l6Y
K]^|7R0=
l\fS6QIjdnr0!qQqHSW
K%LycGu
RK^f@{
TW7fKD
@]Z"-?
4gu[3u[vT$~
n:{gNMh
)W+M S
5'U.+_:k
.5?/ BA=.2M
3-+:cv[[M
f~@07i%v
S,dxnQJ
:\,P@Ccst
KQ-wzN#}vC
JmsxP1MX"b%
%iSmOU
vfuUt}^
+wtp(f]
pM@=p)&
~S1%%aQdV
)vbM,D
F;gB7}jy|T
MfybNS)i[H<+w
Dov)XE
4Od4,`[oc]b
TU#,-Z
]NO|j&
$Tjms_'h=4
'BTzL&].
l.5yX}VzpJeg
,ndn{%
IeE-Ibfe
D"=XCvbf4>m/x7}y8>
< fX1?k=79q
BMA^{LRG
N }~l;
],PfO_:c
qhM}`\
Y5q:+=
kB`k+}e
Thn"WN
E o`J$.
$pAOFtG
0Cp{@GW
#sVh"3'aq
(y?+r}d8$2
QriL~@
r#oE:SI%y(g@{
_s]7[G
v4f.XO
K`!A%
rz2L1!(E
r!Qp]iIx
fu.,[%RShFp66
#G/#W
4|f8\|5T?>b$X8
qDRcJ&DV
1C4 O;[K@
gWS=O.dctf+
\K#H#n veo
dJH5vY}&85%V
W~3 L'7G@(t
[NWaeK
#M8>hyt)[5
Q4kco!fOMta
<5BpDh=
b:rKi)6DZ,_+
3sNZ2@,a}S
xNqz1eF!BG
QlQX-Ee
d^X[
;g|I[V
=->X%J
/)|*qI8
*o@0nt
4#_NIP
(R;Lx 
NZJ8qLU
9(0L,?3
'9Yt;W|LW
QqX9.8Q
{g#y9a:
;oGP1'-U:6gnpL:
t#/4Qw3
& 6HycW
nM'e7A
)jdhiIYo&
|3ih#^
@D}`;i-
o.6QpQmPE% cZlZu
70o/7B
<D?](UwtcrU "
{F8V/dVED'*
><Bck9
o4ju~vkK|
lwK'15|Wx
Ep4x8L _p
?F}OG_=
G!FK8=
a0I$@7oY_yiKM
op.TNL$/*/'b>f
s!$m!9P[`
{1.UM;
sAm-qLa6
=`|mgl
W,,RoI
x*Qx/4
^zCo;X
E%yU|r
_VC dy.8HH]
 %d$pZ
HSW59CB
:,kC1?5A4m}
SH=N- , l
`$,">:
[!%!;+]z~
I_G{qf
?fCQgn@,9;d=
,/z/buX
}C)P')
FAc$t{)0Y{"(i
uLD|obeV
{|b]"d
|%-g2H
UC,[<qal
Y?d*||B
4\;;2$"
2[4zu;O2|
WDbj\u@\ib[t
*^vIs4}%N$
DKUdj*6
..<NRi
P&-'_z
ItN=\s
|?xCBP
H\gd96
'yaJEO"AAN
)!9<Bg
^+h7Cfw<G
7/HQ U&Rd
eLNUOa
[b,_K8
d~R#Frk6U6n
X"nH^|-<Tl71
EX>mA,rb>Kou9$G?0I
bDAm|O]
bi%w )7R'+!w
2%&Lc~
(#Cp$d
@~=ADZP}IF}KBD
FBD!%Q:Z<z
+x&h!W
HM&AgSQQ_^
 AO!}w
lOm-eH&wkc
'?0?F2
@uGyJ:=bHw*0;:F5161s
X[+@O]b
|!g9UKgD|?
x (Pbv 
jDiI6.&c8&
llz 0f7}Ooiv
?vR{98
qId\Jq4dg
*22\tJ
@&)k<-
nKKi2OT1
c4aQ_SG?KDV&f3
~y;cis
lODtUw%{CZ:Gl/<fk[tXIRG6oI
)>WTsRT
R{xT^`
6+i/+u~S
0dzshrOxut
_a[5P
OV]VM+H>
_~_9ElI?FmL
G`MvBIS
Q!w{yLQ*~
=d:GO9
a_9(cl3
v#C{}nD8
gY66@S
&\XJ$I
~FeEY#
RDL:_p
6E"2P9l
l|9[W 
K@AnZ~
:tRr|\'
l&{_~F_9P40;x. ;w5zC'
txgI'0
,"!<`jrQ
g|3J$.
r1H.dZ7sg
A>teG~
q~^|)^A@ <
,j_<ui K}nRQF{;f!En-?
[89M;4&
V^*R(nk
h;uVR(2 Cm
2kobW"
L}e^iD
NHip$e
A|E7TGy7B@';@V
lb{FNmMC
+zT58O
OBt"`]9
{B2=Kx
VD%#!byC
iq`61R
gq~caF
{R8E`>]b
b9#dI+
?_BwtT
4>\q6-
)`f.K+
|a\V(,)
!?g&!+g
Y=Ip2:
;swl/;1)jVEm]q]
6v/G|2i
trO:mZ@-
gCgtd%b},
5S,GP=9
Hg)W:;o[+
#lP`KW
KYqfin
[/lq4cM
+bqyt;t
ipdl^djIx
>WN*ra
cal7K-s-
dX/$9 
Hs%y\b
yR=@2Q
3ECUWV
!!$yzx
&W5II*@
Q^i ?h*
IK$if7;~(>
M*:wVY
~$^,EZJD.
/P|{j${w
3o2^,zZ+\M
R{<TN% sWbZXz
5.U2KcqGs%
E&W2V%SKf$XOa IL
SpSkZ`
Bt|q$|-
Cd{tts
rO<75s/P
U9z8Y@k/6&<
=q"$xB
(y&fK`
V|x[VT
HRKCLkR
t__C>eT%E
BPZAc+{
ixF:47Zr
S;>^`j
Qrt"CIh`
bxXQDJL
w&E4]#
q2txp[6O^
\.qd!#
1O[,x9e0
v@!#{Nf@@
:=d,=2Z
C d)3E
nGJctwdG
fu&X-o
q"<=HP,
]->Srljz/r
U<E5L\
q3Oul1z
PB1uaH
O6l{VC
h}Gjm
w$/t:TI1Q!=
,<+p4M_D
$]SGkNq
*&Bkd/E5Y
2T|gwP7H
_v?flM\`
CxuN;,Dsm
wuEPo[8
0+%.!r
b,]B4<SAW4[M
dHv9o+
z]7B5L
7bS`_&
T0kxeY
jQ=/i
n|?EWkal|m,?
.MqiiCk.
%=.).pxa2J
zZei3@6MSts9:Gb#
A%H>pI0
IF,fyN+T\
vWBFrn
[o*$;yt
UC[e~O
$ H|."
[N;bZ8:7;'9Rpl
8"no'C>Jc
k0k[[zm+fP%
*Z XS,
K9wD7|lY3sj
GiwMN-J< c
<BPck9
l^Nz>v
!2)3Ep
6h_ZG/)m2a4w
RY[6I'Zv*75"
g-Qt+] 
i_*=_9kT
=YwvArX,tra
V>)4UYD?fE\t^y
ySJ>P5
u;*q!f>
;&&iQ$P/
uE9"w\
S@XVhS6
D";xO4u6cs
gvhF;0
Fu'm5o
|"+'kM
r@\h1m
Iro}HB
xe0tE}i
lf5Pu^2gw3,+
Fh@xn/(0Sc>]Jb%
5gH6T'
!n*{P!
[%eViJI'
U,=3c(
,T^AC`#v
sEx<>1;
tQRp^33gxGgXE
u'"N$Z51saJ%GwPVw
=^E00B
c{(T`a$
zPHb;4]
3-|QtLo>
3Q!rB{6gHKa
mSL}_Uz]
$ H\c0b<
BJJ-;+'
{2.Zdnz>T"
d]O!oT|D
|:roazX'[sfm4y
7LraH]j
dZt@'$2
Mz*M&{-Q]
8.J^7Gp!rL
S{eNgi[@
LCd'bg6#
{<:y&q
DI>nip
C*ShlAP7
+ockvpMY
aFu3nc
boV>!MyD>N
xBIO$fc=?&<W
X.b|2zUi{gG#lih!jP7]9j
33es#Lzy
Ac-YUEIA+YdeQNmw'
iA|8RtY#
+d!JS?
J0}UR
@8je9D<W
6r,&$l
[9}*UV<mXt08iP
DPGP?HrTrD
M{UouM
g!t]4{
vl+^LW^Yk
K66-Q\$J&vZ
A\#N2!
6{>=64
tBO\~|o/vjVSh8(#MnXVT1\
ATc@G:kg
:b'|vhtv&|
WRG1`v/
0KrFTSuU4
tM2u#vd.:ljGza N
T>5,BD
SJz'"6#
M.c\'"fG
!n+m1b,
y7LtB~s
RdVCQa"YmVVk
XZebx8
oIFv4d(TaX
"T:T. 286DV<VPBDJHVhNhbTV\ZJ
fLn5Q8x@.p\'~\?
@QgS6dXA
"-}"!Y;G_Y(&
H0JA=4dWZqr$04Bl
rC,-0fYG
e$9 Ff
m1&pLZDb_Ge
[ar6!j
gIi@|2
b`-bc'z
18>0?vHfjJf
hq<q%!?
Er}Ey\
c6mQTf
F%vU+R
,sOj=k
H)%~ji\
Me>nosj:+$1F&+%H^/
#qVEf(+k+*m!
[%G4d~Q>
lq-JWe
P]M[=7(e
S&s?'/
7q#7!QS[
%'c-jZq_-q
Mi_jtW
W~`v|Fx}
g56~^Q
&i]/F\[C
v=kT:[2oQ
=@DA+W~|)G>
>>:v!r2M$
MF<w:l}I
?Cx*rg,K~TM
=>#$h\
whVB=B
3&%._N5
E..if,hr
'h2c<1
%=1{~DvY
a=#IDU
$aQ*|'.D
Z=hylltY
F9fKL#
`f:]sa%n
d]NV>Cs7B0
_Vwt8z
^:5#tL
%Ej^@%TC
_2ugrW-l
6:MUiL{c})PW
 5|4;28r?*2l<eY
k4E/Tf
FOXj[R
U})vly]
`KPStqG?NrFXhOr
#BLxn.*
`m64J{
C&f&r:
2 {.LXg>
ROt;{rC:H6v_-
k=/4OzK
KUE*EFMTZ
p(O!&1,Gi88$+
P? cQc
^qh7HM
&pL+B*26
Jw3TI|X1
dke!\eS@os
|1,Z5E'L:6
8;JdHm
v;"^c==
>GO$=!&
/vPR;0:
,LwA7'
Q^P_{pw!mG9
LaUKzK
z.~t7w
.6.,?B
N$AMjN]\ GCa6
8!C0$4ELj^
v1w'Sg
0xI:uf#V
u6Pr,;\~L
cE'UiCB
ox/+t[
>T.:x7
F.m q3X
D)-_rL8$P>r42
aF,lF,
 =nky12
E0s'u{3eu
k?$J;=L{
qB>f5Y
?hswN-gS
kernel32.dll
user32.dll
GetModuleHandleA
MessageBoxA
uhPD;ywpY}&l>
i.BI{7<#v(nH"P
Z9Z<"sens\~
L==Qp*d[0
\;+Lw~sC~
tbjxNZ(
Mr![jm6O~2 
6PI& $NZb~
bqdrRZ7
A=nMkx7.
zF&&Lfos@~
hcdxXU
Z7%Pj~e
|:=yho6F?^d`c=Q
>}I! Rcbb
<^!ubnO
F4-Vj+
t-H30"
Gggfv@
&vvggd
wwgbvt
1wwwr"gf@
1wwwr"vv@
wr""gf@
wr""&f@
ww"w""@
1wr'""@
3333;31
333333
sp`x`laE
jrYVK\~NA8XvC
W}vy_jmx
LL@GGNv
8Y>cPH
^.~_T@\|p
1qx0zi
-i7g~jw
.9'n#\{?
?" wBQ
?hD^v[Q
a{Hjev
jC?UQ67
lIb9oa
M'Jg%|
76r@q"-t,MiX
 4LWN1D-N
$@-*{
>3uwZ6H7W
OzOXr4V|7i?Q
5';+FV
3jNqz2(X'!
_i0oT>`"SbXm
#vocUdi
@FS,_-*
:--KWrw
Ku'{q}L
)ye(Y)bVt
|qxf+0
K'(6*sq,*n
$cc6];A
Xw76>#w|
BoH^,_
u/?2~(
4ja74JLf:hT[H=/TZ
pu{,0CU:
 p.9t"u\6x5vq
gTG(1@T[i/3
&>*[j:<G_1H%M
)x-e9|
?)6sUtP;n
rPfh/3Au
hx_iyd
WzfFIp]8s.`
/Ie8B}?}>F zCN"VCS
7YQ(GP
=14e('3p
EV[/k*u
6)2t=%
-]`F`E
u&oLz^:
FXozq^
Qt>aP"Sm8Du)uli99d
H4f>Mb
mfAL=F
n+8?J`S
0nM"W5Xz
^/SZoqM
:m*OsP
kZX2f.
<Oj@O.
@^;7"<hCX
G=^9FE
I;'l+r7
UeEfi,
K9yo1N.|.
\zZ)1V
;%\}y"4^
*XfP&[PN5
u&`1"hA%'
3~wpNb@
ElYrxsBgCQ0
Iw5Nya5
MO92mw
`#IW,W
eEa+Ge!
]<tHRU+%
Wk>0R]$<{
%@GaTmbD%fpJ'f9A}kH
B?R;b@
:jm/N%o?
D~:=h*
bVCRA|3z-5
t0bo7ex+
Yw8a"#
>WP.VdrY'
oz(76!!8
tKOzSq
ktyG(L
RvVEMLR1yJ-
"%)C+&s(sV>{
RA{.@LhA=
\hcW5+
g!fUJN
hi/qt3L
o<lpb7:Lyw
d7g6;X
G?*2n[
ib\q F- ~-W!1
1[V#5w
#W^o8eL
Gg,{23W|V7
UmMd,c(Dee
%^*Wrw
i&6|Q{x
Zve>wyU<N
'.Nnx@YP
\>L!tIt
4>>Ud0
^^RmLS1
Cv".^U
+y7WZib
BS7<^_
o@N9Zu|/Y:sA*`G
xHC:c_u\
A}35i G
lOR?^9C
/as|I[yN
LvpIvx
D_Jz_P
A=#p@[E
n'\K)6CUaA
jKpGIi
BRhA(p\
vY\GrH=h^P
w2Z:4
pAXF0,tW
{~XNlFn4+%
Ma2m:Pl
rD%l{@u
tw'iEN
fV2w"mED
Kyn;u2?
E*C}_iPK
W,3`u}
oXqcWz*$?K=
GNw(* `Ho@.
/8dUOfL}9;L
cg"7bBlq^wa
H&Y#fB\B7
\C>HP>74
lq[z)G
axgvH=$
9ps(?~rHmTE;(?]g
!9Ry`T<)-
.t*;/*%
c9d[H8tS7Uv<h
!Bvl)IY
,hjXTrE
=rBgE\
;YA_#qvk
z{H:MtN
FggjD\(:Ez
D+GH+\
ikMmY,K$7MYe,9Od)~
'&@NL]\I
]u-oQyM
k3IM23
~%nTfm
u-J<pslR^
{i"XtG6h|9
|s<BQ5@ 
oyzSx,1tgS
Ep- y]hb
I_i>D1
2Q3Zedl}A9])eY
x%@(G3(
1EM\PcT
rf&jY|Y.l
j|tX58
U?3L_Sk
g<}/}~Qa
S(ray+p
}Zcjw=Z
U}>Nqf
u;GYLLV
A?QHI"9_m
;N/Zc>T
pg0i\ks
#YvP\a=
rX6EUJ'Fe4
K3CpMoL-
`1NWS9$v$}
i1jrY(zg.,
z66kKfJ8
T<-o8_i
r'zwK<
X1A\Lv
r0bAa}
4Svw^a6B$G8
yO@c39Ij
p\If<DFR:P
f'l$V`t
0>9!$-$C
ApHwVKw
'>XC$se{p&
2B\v6A
p7?VfP@
w4cr=lNJ+D
 I,,/S,
2;[%}F+/$
-.m xr
VCqs8EwZ$
4vQeH]bJuV
roJuMQ<d4HBW._
+{Vmu#
tS8L\I\
D[qA^)b
Dej#FV
\tR"lbd*
,%ze>(LDU<{
:)HC-pi}*M
dh2~t5
}2p7|2
t|>9P-
51RLw=
\g1A.r
8pl2'bfm 
4n_*_~T
SC1lDfkN
d~"qAZl}<s!GA}=
1Svo.zsP
e>T#LOM
3?bxt7,
5DW(fH
r[87#*
Q?^`W]g0E
fpc;^Wr;
3Qjj=ZU
73XI71:[
=[6;Qxd
J.Bl@&I`uP
*/I*jDxE
:@(pF2U
H<\]%*SL0F)
P}hHL,v!$
->+k\s/
p!&RSq'}?Ia
0XRSU,8Oa
_<O0K8#MJ3?e?
UR4AJ6j8
d}ewRD1I
KmWd%B)x
uI]MutK
1O^<-A-C
\T7JUx2-|l
%juJgnzLV
+[3$"F/G_s;
0fQV>>
VJt>%-x
Gg|lTu((
<W+I#=1k( 
yGoK~e)?\37V8
y9+Mrmg!
<6vOa(
#pF=!]oKu1~6@
eBQew f;O
8 Wex^
U+pu+p
5;VBmX>
~Ksw@r^A7E&t"
ymK\y
~~$=f!
+qx2fHL%w=
_lgzx]
FZ){&ow6
_2@# F5[
B2$k{sXj
k@@Mgj
b!K2[u+Mtxfn"
qN#-;I!B!
Z|!2sh,KS
o`#q=me
w*TfWb8
^B\+G(EY's1
)Vt<Yz
hpZBOue=3)6 S
\Vu+0naqDtg
[c2X:V]"
#X`Cw#!
u*U'K'
S?LA]3
=oyN0cAh
Bcd2i\nD
@&IxvX]
iDF"=q
(fT'%2U
~m@I9{
[3D\yjE|3}
x'E!N.
]?t/{Y
ij,J\}Y 
%R'B76Y9mf&0SNgr(<EV>p
appD0
Lk8:~hiPVN04]vb&YnaO
-N!J+)yP
k(@p$A
9EWM5i
,;9msij
aQK^Lyq\
5;W33I"_gv
K,G0{V
1`Z<!^,`[>^:Q
t'LFINXd
zlZ{X,[F'r~`sj'
<~a1>-T/
S]RrLFv&,_4
W{`pifCn}n
l!=66}_ITbx
S>3X8z1k
7?Jt$jqC
Vnw}v\
L~0P-kba
H}*1y9i
UM*Q3n[Tb8nd
Ss"7}8#
#@fn!u\
WeCb{YQ
SK^fX"h1:G
uY;VHSyj
xVF;5h;
*wCLqBr> s+~
EoyS";G
57WNSB
G1ifz2
NzsBE~&\
g+*G?mG{
r!Rb\`M
:xw_E-Ov?.FA4
LA#<zU
JI+9T0
&Mf\Zq[^
'\|<qy<(E&T5
v[|'I>W)wV
4r.&JWk
8Ao>ed
*aS/9&x
Pf \9?y
L5q'%;
Et7HAu
YzNWIN|=
'wr*.=q
flOufTG\aJ5HCI,Z
?.wd!W9
$$DQ|=
m8'>M8#u)$
@_lx@l=
qAYGK`p
 ZC!h!0
k9lHBn6
6drA){z5+ ;
17?T=8$`
D}5o=Tg[
97[KiE
q~MEH`_
R<{TbDNS
2/Lcl+I8
s7V |{bB8(
T@\$E/7"/
g0PZdy
h@Uk::=WL`uDf
\T:3X!pxj4X
}qLYN(NC]
^#\y]Um+
c7LHkt
Ot +}f+4U
%NRP_dO
$u$X^lGBn
E88qF)
[EL;l99znpYJN
.|UvBSy<
m1ddSE{
dml7%/a
R>K'E/Smv
x0o{OpA*@5(
:e$<gLf
q^jm|_bHhDF'9+?!6q
"Y3DHa
ec^ dYSPF
bLii0u
^@Su,0jV
M71dd>
(UMv?
Tn&FegQCS%@
\L`=,!`eb?J
F)QAZEhQS
!,PcLAPO]pqb(,'D<
:LeU]ST
BY=|7C7u?
ucMH?G\
rN0SqA
9|)usZ/:
u*EMDrw
CdL}*]oVQL
@>[ui$
pqjNBA
4.(#i_g'KcCK
,bo(*J2,-Qm
:HxMp~
W'Eax'{5
d&@P^ 
.T;L[4KDZ/
K{e"E}o,
TPTzJ:J!!6#!jf
hW:e1|gIW@j"(Vc
AP_4A=@
SwrBeM!{
7"AHhV[Gns
-@3xq}%U1@
*1eVZ`M
J<3J }{
y] 'n5(`Q
t`eY1/)#
_hKJuRq
WO@G>}]
e=B 6}zBr
F-k'.G,-6CMQy>
2Ts*dE5re?v;my:sG
g%`~wX2l#_pD
t`PDJt
>7utm?^&
(+HoQ\[;d{Fl/3K
"1Q~;8/=];\
V*_h&dZ%
SaBCF#)uj
PbiO4PT<
%Z.%reFSC{W?Z2
" |+%^hV)a
=z84#T
bFoTr7
c*xZAY*,!!5s
iop\`K
>mfrPQ[
dBJNilIC*-^N&+
Umm73|,.;3K
37DRom
k$<(g!R#N
k{Ujci
GyOct/u
Td-e}x%N
C\$YuI1Cz?JVFV
p>O;-sPUu>y'|
(iEU,np?%$x!
:w4FdwYI O C .
Ndb+s;\^
=P@SmSi
:A5fjmv
6;7@Xg|
{Q{ob7V
JMWim*o
=PFA%@#lL2D
rv#SW1MM
p;d|IWKb,|
JnZ$,a(
^{{A\
Dz+8WuN
Vv+!L"}S'
~M5e|U!i
iWFf)oJh63
Hep*(`R{A*/
#2(f%g
SE=_>FeW9#=
+.)el:n3YFHhKZE2g
r8KP>\Q
DiEl.mC=w06t"?2
+9wC(qmi
!IG?ny5
6|g&jcu)
F*'{M+.2
VGrUD)
imc74x
[TBGs9q'D
D/ysNc
0|}`My
05p1QK
q:fffS
icZ[5Ui
]of\W`
S$bA4hBM~X2wGi*\}?q+3io
*j.C8v=8i
] 86*O
S..kNg
}-*eNex
-e%o!6H
2<K#z_:5
CM|8FhUL
7F# k;
e*gkfTWY
Zf@:vpb;Z5kxh=
S09QOAv(#
<3v$pO
P}!0mt'''`
E9qz'|
{myN2_
4mPxk-]0
/1f4$nr
]R[8\(D
9,n>kE
vE#P`;.r.1)mIJc0l
V&If%`<SGa
r&\?&:(
d7|7Bv+9.
fqk[U".Z>Ac
@2\I>vG%
GRp^m]hE
b]U7OAG<
Glcq<]'-
w?r5,5<&P
Wm3jN1u(F
f@  TJC8;|V
*\ZoF[L90Sw
q\u;
^8gpp@^,XI *+
7XLv`&
wAtP%ejs
?GG-G,)Z
{>4<)},V2
e8Z]L2kN;R
v`zOMU_O4cwB
-1/uI),?OYC
 KTU[~9
J."l&Iv0FDXy-uQS1]
&9=uTX2h]0ll%rZ5p%E
[(jb_UC)Fw0i
'w(<7Ji`x,
k<O4onHDx
KUuT7R`u
m\jR"#c
*|j+7V
I>]9{j,%L
gw6j:-|
XGV~7MqS8O
! !/sQ
Jbo9^iq
BCa=E.oe
R671\cF
gssE]T$
Y9E3z_W
$ylt}(
 t WDPh}k(``
%rPCC
[$\f{CMh
#D%7Nqw&Vw
B]>b9O?
u>jBG5/A%c
T';]]A
__0T[i
iC-+so7r='
$a>qXyFk&
?<X&Qm]a
<N^QN;
}mqsHnA1*vw.
 O!\vL<lk
\<TG&.9a
9dwi5tv
=VyYRc
ARxZOZQ
s*xQ,w.
1nH8A&
"!se$L4
Hd630@)OJT
)rc7-"
YU/<bat
?1pPQQL
]ydCk@"
yk-2xs/
gsx>~|
^!#zQz
BCHv01
:8EKB;
u5z2AS
YNd*g*
c;q]3q
YjX>O}esOpyc
'rWk Q491~{S
dN)f{
|G[2[xuD+WUL
9I4a41
h&3_$M%obs
po #;C
$Vb!5uIr;p
[?Ol|2V2ov"^_
{(|uV/lx_3%p#,$`t~TkE
+rN&;{
,2c)YnC/)
PJ&xMWZ`uaAo=+4
s~;WBeE_
),PMTsi ;5`}GV`U<+
+"wY)o4D
pqz#kn
?qUQdrr
't/V{ZK5~4m
H^,6`_
pR i*kpn,
(D/ fx
h:.Z! N0
5x%H~HkD
[^$D'pfn
s<@Tc#lL~`
AwiT|KY(fm
ySoA+$F/o
A8`de5MdNJjw
p|u)g0%t
p*}90Dk44p
rm##1)lpt
:o'!1~8
N}r^r**
6VL2o-T+MHZ
f+K3oOhm
WP>&oy
od71B+{/Q
h2P~unMJ_
t"9D=7
8PAT[Vb
"+G[L!`%g
*2:`"P
.2V*q1<
sZq,>
;Yg0(O9Ex
;N7>PC
q*-$R%
KRK05vh
I5Ug3<
ls+.9h
L[9=frqJM6
L/,Vx#
in0&FX"z2
}]uTclpo1!
[cV/6")
]K*yq9z+
238nW!EjB
g(`wEZ
pZ?:Z~
2*[-OOi"L'@sQ!%
./C0k"$
%dBMLN5
{6e&Js{
fy'E}(
4iIh\HbK
Sc:4/[?`
)!<w#Q(~&]@
6=i'bs?33NHr
XkW.=g`
A~)|I0b68'
5f"ez<wj
I~wJ$BE-
[+tu9m
U#+7!;j
 (yBn$v
~71X, #Ii
9hXTU{5cWP{v}
GO*Sr
!zyg(W
X(e-H5
>@./% Hg
W$*Gl8
I[J}Tq0^RP{+Bg
JS7Pd[\!,-%N
OLdOzFPzLvYdNb4!|
n))i,p
{W$"yS
xBPrX2hHg?0
"tTb$pt7z
q &nobN
Rp7S[rY_jd[
FSx=|ZC8
v[/G4M
)C<$3[a
KkZ~l_nFf
d`bz3D
6I,{`w
WiKn%o@R*
W;vde$XU
=:RH0I?k
W <)u5SFW
vP80R{*87z
%j[^ZM1LuT@_
-9.cEa
ccYY{ @8p
z*#*3$juz
7<9QhSI
=~Vc"mq
sRb&Xa%
&-#{=n
C=\._k.=7(
Hafr()
2l-*>|_dU3
[}s}f=t6
zwQI=xo
| 4ii"
Q)%"Af
IW/Vql
YwdXk%k
lpK[3rj
V,B2kw%
]3mOb|up{p/D
WZ!j<
[g$@O\
j4-N ;
A|<)OH
Ii=zR
 \^&fhe
o;Rf*5#Jm
?ipQFq
TKYoF>c3A
bAvw:YH
`v4SJ4
9q7%,Yo6
jZXLxuxj{
@@g-{`%
q@p3W#v[UIc[%c
1DT/gLIOXE
SsiL7j%Q
U95c?/{
\oa`q`FA
i{O-@7 
_L@ND{5~D}Vi1k3Z
 /SPen
K?#:p
?"<UH
\lT[$4NG
-8:veB
=8]nOE5BsB9G
}.0]U9
^5]#7#
7FxI!uNR
Yc -dN
m$RR_?Kd#u
J+j?P)/
TM997!f&=\
`*3|PDoi
b:K&#f
qi?{paq
+jo)kdzn
kfsQ/zADv&0
a")*Eq<=cE
}:p/y
*&dB%2o{G
=tF2ZiM
}~;!LjmFe~14
jzS3l@G~
}&D1,'Ga
` O}~;|
z%Iq7b
?amb*jnGp}
dfRt+l[k"_
*5*8>L
z"<wqD
,G\9hA
u[i$XzvDswaQ
IRS1gNQ
rk8_v<
- ox5V9
up"N^m)Y=
PS-;%yu
a.T,Tk0
/e[GBJ
XxDqL`ES)|b5+C+&BsH2
u'Z-Tb+SH
[BL42MY
tV(bJ^2be)Y%
H:3L`b~
xYVJ[:]%\
F38R(tuofwF
um?]?+
r2w`XOiB
ze_#:G
8}iL,
AwfdE
]c)=Ev6_2=
NauPdgp
%A3YD;
q;MQcR
=0(g<5O
a-Wfdq
"W^jcn 3
b9%MEbNX.
i*y)7.u.
|1YA8e4YqNP4
kXnPb\H
9\hHh%B
"D.~)QF
t3Y]Ta8F
`,2R^,
uw+?A3$G?p
\Di^)<7
u"390H?]D]j7> 
}F9VaT
ev4{RO@
*{L&+iu1B
V:L~!$X<8Oc
uRJ$I!G;QKlqS
|WO`@^0+q
54yoC]`QNV
0Bv4Vg
3#{G/vd
h(%@0pY
p9D<x{
NcaY1` S0eO
i-2{/H
kcs%+s"
;fZ+*r
K!X%*)b4J6"
4w@[UM
'OA<<9g
]:niB^
RPBL!o
LbcLo^] 
HB&W|q
C7*pbwN
oow}yd\HIKE
E!:/|v
Iy9H)V
{/Rvcce)TK.
qS:@m(f_
Zy'd4~/
)lrnmdB
2S,!C~"SIM
-=)?Dz
OL]x"`IbS
3P[Ve/Z
}$Su5xP
z.Bjhti1Ie_
b4P]j4
OxI:rs.
P(7_QL<{>0u$
3i,4dc[K
\; \?sX6!
pCd|;`
Pe/\BG)Ye_4to
9a3n_Z0
\7uq=s
&%V8ef
,N};Hy
cMb]$5@w^>T
)"0mKlk5R#{'bYRzq,*q
w,.4QQ
CLx|:^DAF
E+j~qb~FB4ZKw
UTlNA+Q
7,!-,E*C_
'r'2hq{}a
m'C8HjX
@%2b02R
aEcnx_w1
"CB9"
dFd5by
&h/y!c_>Tq
W7}~.uG
n>GC'"h=hP
sVm8}s`
V?Q1kct
Z#&|8J7iy.=
\-^GMN9
Nj6@9h;x
Su1G?D5A
@c{,"Y
Pp_`QC=
I9NOj@
 $@]Mu=
#QMdQbdf66p}
\*5t94
>GEacM
 Ny[Y 9z
)bfk:kh
%A,&9/2-}#
(4_;FA*c
1v_>V?o
ccN2)P
Jg@^A..
Q2iT?&Tk*'el
;UP$tY
X3`l8JUr
o=y3/[
3/uo^g]
Un>DBw
T'>Fir
6::QpW
OZu64[yHt=jA)Bs
jGN30hT 8
]S`@Ii1|#
oIVY:otK
iV?V`tJr6
_Z|Mxnyag
(|bxiR)&KZ
zQg&[_
9y7M1S'
BFCC'd
=T{Y10fEs4
hs))GtRqZ
@iD?GDuVU
D?>OFv
[AS*(m;ks
:SU1xJ2}
9fI$Ir
[1t)K4h?
=Bj_|qZ0f_
#@*5_a(%
L<|V U
~S<+~|cK
(K\*lRX
+*cCO~
l&CEYYTU$A
U\5'`#yiuWO
p`PD/nc
E~D2cf5AW
So</|,
;C:!m_Z
r0D+WQBpo
s@+"&kS
456f'mz
9./%pC&=
p+#Y9$,F?+
^jC"&1G
a xaFr=
ht1S~Kx2]R
}Ad~~^*
V4V`H?a}Bt,Qv
GLDNZ?
>tHL-,j
$p?E|)
j~.*[(
N]Z+C?
96PA:6@yfWy
)J=:=s4[
/2Er-y!#+
WM|ZWo:
YnZ{I*5_Mv&
Q>HDIZ>
QfIDnu1\yB
.B0$tZ
Y9R'yRuF}Jav
J,-OEF
,%tfIxLo6{Uhuf<K_B
R"M;p4
Wp:,\K;
MZ-XKX*
y8rS_w=zq
&K XQKb
D\Kq"ba
r&!w,'GD)
tr3^^$x^xF4AggCK4fE8~
DBNYxr:
YO~K>_
80(+m
S@@6A5 wRP1
.V0MZk,nxp|J?J
<2Z;7f
@}3$BS
8j(El:
?>i.(s{wCj4|
/2,g("h
?se@C}48}{B\?
 \>p?]CU
M/sMiW
Z}Q'#I9D
B( :w-
mR=4x8
!a>-?n)FbT
CD$xL(
'H*Z*zuER
&%re.$DF}
BA3Pyh
~uh+FDq4bL
{x"4<@x]a^
I{/<uO;
{W`J\,
my&tVyS%
Mn@.]]w&W%L`s6|mt
)axf:FcS
!x+NyH
V~6M;
CwK,&"Io_
TZ@kmd
3@_h-V"u
)>Dd^}O6,-
$ 6u5Gy
Oz2jI6
_EbyxM
>9@HM^4+.:v k
-%Rn[Ko
S/K"yHW
I^u9as
@aC_m/
p4PA33
Cjg#YV|
G B>h+.>w3]
6&V@0)::A>Ioc
Dy*5DL7Q<.3
hZUx^,_
T 8EVbC?~"oPG
_uW=5x
:iT?^5\
>6[BF<;
Sk7CP"
\X} [)pj%fH/
8C0h1`@
1,c@n=I
4K}+u&{!
[rG}~ht
']Ma"0,Y!
QjCNbVF
128tG
{ydxT#
`_:m*b
Ls"A{^j.F
HYvw/"AY<]Uw
S;c^sk@
>( .[H
~;ZzP8
Xb7PamE
O:m"hLQ
immX&C
d-8nsQ
oCnBsS$rqk]3frl
QPUr}r>T
|^sANhBwBd
p0U;u]
)}i':-P
Lce=Y[6
mEqD_38m
y(Y(A^T
5 Qd}>(:
u,E2!kIw)-_'t.)F
A7%atx
)#$3$1PiA
/8S=Lg~4v[4J
N#=70%S
_H@gU\7E"
dXL0.e
gj cVp
6]ux:mR
7Eb L!<
5U,j^/
$ipI1]j3
W`'eG2xH
6pjJO"
:4v[AY?~v
ynNZV4H#
4/2=B&|
rI-YC11&<
]]Y)Y9
?r$ f"
vs(j1
_hY"z\H
,6;C(n
(K"Uv
(|u]D{>:
\chnn*`P?:c
zg8GLCE`z"-P$5m.f*
C +lYF/goO<N^z
YkD=\h
ne|i"Gy 
Kr&CCM
rX-#)L
?ix6O
ejHXlcN
xZGw~m
FWSd:aCw<sL
~[~T$7
{BE%]?+`
Kfx0"bv0:{#CT
c[a!N
<!7<q\
]:K/g!t
Ha8:q$
W (,8yI
[qVjZK)%_
U dZ@:%\
bx6"+4m`,aFG
U!<s$Fb+{z
X%7n,T
I9c(XXp]Q*d
$hu>yQfo~.ol>[]
sRj:24
NgV|wY
IVJ4ElA83V\(
a4pJ0;,[v
G)rw3Z[
`qY.Q5
8C0m1L
J![`_,C
e'Zs.Y+q6%j
& u|ej
@f+DOWV&#
Pd2Yj+L
bad(e0*}N
uv{9O1
c%w3en=28<zW
vD^;;a`.>wrgJ:
.@gW9O
edO{u)Q^Aa
d\+}}bO8X
<4NTFsi*(4
>7"8A+T
dqH#`#
M;GyzhT
aQs<C>O"DKRo
Esdv;r#
MF[BX71\ 
D{r~w\D
$'An\)6v
./&QNwk*t:G}(`mHNF
9"3:Un
v~x-@.
^jdV!@BX~Y
i[ f:*y
sL`1hbYr
JRJ'Z4eZnW
GrGTld
2p,nd<8
8S]r!Dz@
;kDc?}(
M=?N &b[T
'hN}B3
,6P):mR'7E<s
fMhqt*
{KF,8b
L:w5?9dG`ldxx
9Lx!*Jr;
T?(7%LWE
E-,eBhef
?*s_f4
$8Z_x3#
Je6<8
")x"#i=\
Kp|8}Z#Iw
P/PGO:
=g204Z>
'_g86H%
iA"7#g4S"
_QFTf;
w_m)YYO*5q
>>.%\o
vu`pf@gzI
^zu2e7Oici[B&fczr$
n.)WNcHi
$"$2L1IxJl%
J)V'_./!Q
4tOjlu?uyxJ=6
jE8|QBq/WI.X
A}p2_m0
mDuC*]K1
D7&KG2
ERxO%9LXOm9s
#c7o(A5yA
F7:-JR
|v!$znb#_
^_^K}=A
&}{i>&K=*@ 
FZ~vJ=i_y
DwgEhE\J
WZ.jmFeAHR
Tj7hc7
Fh$.R2
S76`:!
VMY[%JwF6
BN'0RT3vMPq
<A=+5~
)%~i+@F
oB;fO7v
l:-LqP3_B|=
hQen1+5
t%n7n4~
m!(t=;9!
gFq&*})Ur
Q`iH7:(":
@m2+},y^
$!cY]~]
ar\5Yg
Z t}g:Jm
\]%Laxy[I
e:M`5*)172:F"-
`8pCv`:zU
}1Tons uUt~
Iie.DT&h%YRZx
T4**RTv
,.@|=11
gDWEmrp/x$~I1S,
uy[}&8m
_GX1x}a
D%dDr<}9xcrZ
`X@6os;
XA].PX
)&@e(~X<7im2u
+8:AY<ai
)s;?}s
oU/,Pn}>
*VGVO7
GY1KE\7{x
VR:E sOD~ m2HI4h,xjMsQ6(
@`80Yb_l
le'7YP
cES;oJec
=AChDeG,>1>
|^C&cZwl8^
\A0w`V,Ck
wrJ+T6h
.uMel
PO/H^{B
JRB9'&
jgPSMV\kj@
^&i>fL
'[{4]L
nwv*K= u
zJLZToG
P/YMoy:1y;2u
uGJj+CP-
U5,{tr.Au(V#,!9;g
KR.$8w/H
dM`\KMeM8d70\i6U=\
l'T@W_.}(
EIod.v9X7
.11f?Y,{
j@ldA>tZ?.LCTy
a6^S^+bH
.iRJne
+*=x.<|y7.Y
0 tB=sv
MT2\v!+B
07`bT^$u
M2!E|r
@DJ2=C!
CfJ'>(X9IN
l<N q~0}\K
Xx*gbm
hVh.A8@:r0
CIYK{Onz
@LIPFOT]bC3
x/6e7YXSA1_5ad!+0
isk8gx
ty&AOp
@pa S\kJx|
~o)(L7
k5fOyHe\|[
x}kGQPb
-f|p;\t.b
V8zh{{:="c/
8C&#9PG/-4y5cDl
I48[6^X-tP
mkFJm-(g7j
85.V;/Ya<
jg+4zn2V#0
lbJrSp)-
w"7mw[u4C}e
NlE;)P_`ykI
,W|{mc
5r_{|)Q
z.?6  ]2=
]c/bzlz
WQ|vY1icf
,JfwY +i( 
@ZB!<@Zz
pHYHDO|gU
ZW9tDx)
2d"ob8
<^iBwETMkyn
==WEo1<2E{7DPE
,y^y06_{XMf<?^
'o ncVph
>]\.)6
\Y`&+YU
DWIq![NWqy|
D_(u@j
_WzM4Qgd?^Ob
/T8;'!
aB\O+n<
;rRiHw#af7
Mjbw`;6.HJl
:0E^#hU
g>3J(.
V/XoNuR^r(
kJ^t=K1
h$@E0jc
'4.Nn)%R
phqm$vl_
1pxw`0
mr^$M>
A'8P8"TH~
}tSCNS)cvT;wF%T
p;ok:A
@J_&5L;
V|]VB2[jE0CG
|H,$9Kg
;/$^:s-
$_se:@MrN7
@7cMmf
,:>L13K"R
DS<oi.ns{+H
^mJwdye
{i2QK$oX
o5VQFm~
M9S{}~Dz]t5(L4`_Iw1:
P[r'=sSg 
Hy1_}j^FGi
3ZNb p
}n+kL@ .ZMhV
0Ho0mq@o!IP@
Pu=o}?
8vEM;,<<R^_a
p**SUrI
Hl<T6~n~
%~BTKf
_} J7I
+k-oqg
E.Ko/H
;8h8L"x(
Bfa#pfu+]
08(|.}$+kzg
)h)r-}
*tVGX^?0
D}Rvun
 ~ez6QO
TRXEaq>RF2Ox
=TY1a)0t!,=r
zN}1t^>a0
V1sKpn
1Y2du[
E#1>8K
JOyM3JV7
"KZ#vkn
S0fAbg,
;~?%95
\`q,W7wH7
c;{jNy
`6}?@<`k
0S4}QES
DVCLAL
PACKAGEINFO
MAINICON

Process Tree

043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe (1848) "C:\Users\Administrator\AppData\Local\Temp\043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe"

Search
043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe (1848)

043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe, PID: 1848, Parent PID: 844

default registry file network process services synchronisation iexplore office pdf

Hosts

IP
114.114.114.114
8.8.8.8

DNS

Name	Response	Post-Analysis Lookup
irc.lcirc.net	CNAME ddnsagk66pm5lpafmtp4vekxznjuazdg7yjba6fzhuda3ztka22cf6qd.onion
dns.msftncsi.com	A 131.107.255.255 A 131.107.255.255	131.107.255.255
dns.msftncsi.com		131.107.255.255

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53179	224.0.0.252	5355
192.168.56.101	65473	114.114.114.114	53
192.168.56.101	61714	224.0.0.252	5355
192.168.56.101	137	192.168.56.255	137
192.168.56.101	65473	8.8.8.8	53
192.168.56.101	56933	114.114.114.114	53
192.168.56.101	58485	114.114.114.114	53
192.168.56.101	138	192.168.56.255	138
192.168.56.101	57665	114.114.114.114	53
192.168.56.101	51758	114.114.114.114	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name	62f3c5759c659eef_flatout_serial.exe
Filepath	C:\Windows\win32dc\FlatOut_serial.exe
Size	102.0KB
Processes	1848 (043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`cae7008d23b5c42c86c567d3a401d29b`
SHA1	`a7d9afb7a3fcf672b7e8547ffa5ae477a772f11d`
SHA256	`62f3c5759c659eef705b9f6c7f98162cc87596bf156b4f3a317504d690c4bb78`
CRC32	`B7351873`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	126ad0472aceafd5_daoc_fix.exe
Filepath	C:\Windows\win32dc\DAoC_fix.exe
Size	104.0KB
Processes	1848 (043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`77f77f63ffd2e406ca27f125fdcd5fbe`
SHA1	`1383523df1a26dff77cbbef6a8bc234bf05057d8`
SHA256	`126ad0472aceafd54edff564262b8b844895710a82a684099bd811b70428f291`
CRC32	`52C5F5E4`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	e6361f4c99bd1cac_daoc + cdfix.exe
Filepath	C:\Windows\win32dc\DAoC + cdfix.exe
Size	104.0KB
Processes	1848 (043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`058c118d4110c5cdda24410c8d93f35c`
SHA1	`fb449c4bc299b68a584b4e183164ef24f6e26ee5`
SHA256	`e6361f4c99bd1cac35c781f16d9690cb1c6d76f93fe9fbfa0b4d0c29aa637974`
CRC32	`D9FC53CA`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	0b270ca98541f3d6_doom 3(crack).exe
Filepath	C:\Windows\win32dc\Doom 3(crack).exe
Size	103.0KB
Processes	1848 (043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`392a05a368a99b12382d1f87af1f1b2e`
SHA1	`e7d05be2eabcbb302604999c5b323b98acad4851`
SHA256	`0b270ca98541f3d690a444085992cf672f78811558d0b112fc56660952677fd1`
CRC32	`42E9A867`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Name	f24f5aac5af5e495_battlefield 1942 + hack.exe
Filepath	C:\Windows\win32dc\BattleField 1942 + hack.exe
Size	105.0KB
Processes	1848 (043f3eb347de01af29ff142e925d330745f3d78dcbac2c7bf528cf815f2f55ff.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0502fc1ac1733d55c476b3c58848d9b7`
SHA1	`44d19c5eca2c743d3e5be21c8e7d76478189867e`
SHA256	`f24f5aac5af5e495233ad5bc090e1a76d8cb370130f9c850a00b168be2a46082`
CRC32	`EF4291FF`
ssdeep	`None`
Yara	None matched
VirusTotal	Search for analysis

Sorry! No dropped buffers.