1.2
低危
54 个模型检测该样本为恶意！
重新分析
更多

0ec59312b5d9b9c0991caeb9acfdf2b0ccd980899cd5a6d27d70b48b53f68c1f

0ec59312b5d9b9c0991caeb9acfdf2b0ccd980899cd5a6d27d70b48b53f68c1f.exe

分析耗时

192s

最近分析

378天前

文件大小

161.4KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN RANSOM
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.71
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Kryptik-LQN [Trj] 20191226 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20191226 2013.8.14.323
McAfee GenericRXIH-OR!889AAA2F9E3A 20191226 6.0.6.653
Tencent Malware.Win32.Gencirc.10b0bf30 20191226 1.0.0.1
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报） (7 个事件)
section .text\x00U
section .bss\x00Feb
section .data\x00eb
section .rsrc\x00U
section .reloc5
section .hxlrvpa
section .IdOaC\x00b
行为判定
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': '.text\\x00U', 'virtual_address': '0x00001000', 'virtual_size': '0x00003878', 'size_of_data': '0x00003878', 'entropy': 7.511233910960399} entropy 7.511233910960399 description 发现高熵的节
section {'name': '.reloc5', 'virtual_address': '0x00029000', 'virtual_size': '0x00000182', 'size_of_data': '0x00000182', 'entropy': 7.50038325992484} entropy 7.50038325992484 description 发现高熵的节
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 54 个反病毒引擎识别为恶意 (50 out of 54 个事件)
APEX Malicious
AVG Win32:Kryptik-LQN [Trj]
Acronis suspicious
Ad-Aware Gen:Trojan.Heur.GM.0800200C20
AhnLab-V3 Trojan/Win32.Generic.C3385739
Antiy-AVL Trojan/Win32.Wacatac
Arcabit Trojan.Heur.GM.0800200C20
Avast Win32:Kryptik-LQN [Trj]
Avira TR/Crypt.ZPACK.Gen
BitDefender Gen:Trojan.Heur.GM.0800200C20
BitDefenderTheta AI:Packer.7F4195081D
CAT-QuickHeal Trojan.Generic
ClamAV Win.Malware.Ulise-6901999-0
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.f9e3ab
Cylance Unsafe
Cyren W32/Gepys.AR.gen!Eldorado
DrWeb Trojan.Mods.146
ESET-NOD32 Win32/Injector.AGGK
Emsisoft Gen:Trojan.Heur.GM.0800200C20 (B)
Endgame malicious (high confidence)
F-Prot W32/Gepys.AR.gen!Eldorado
F-Secure Trojan.TR/Crypt.ZPACK.Gen
FireEye Generic.mg.889aaa2f9e3ab13f
Fortinet W32/Parite.C
GData Gen:Trojan.Heur.GM.0800200C20
Ikarus Worm.Win32.Vobfus
Invincea heuristic
Jiangmin Trojan.Generic.duobt
K7AntiVirus Trojan ( 005568151 )
K7GW Trojan ( 005568151 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=84)
Malwarebytes Trojan.ShipUp
MaxSecure Trojan.Malware.300983.susgen
McAfee GenericRXIH-OR!889AAA2F9E3A
McAfee-GW-Edition BehavesLike.Win32.Dropper.ch
MicroWorld-eScan Gen:Trojan.Heur.GM.0800200C20
Microsoft Trojan:Win32/Cryptinject.CG
NANO-Antivirus Trojan.Win32.GM.fvmnvl
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM19.1.233D.Malware.Gen
Rising Trojan.Kryptik!1.BB30 (CLASSIC)
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos W32/Systro-AB
Tencent Malware.Win32.Gencirc.10b0bf30
Trapmine malicious.high.ml.score
VBA32 Trojan.Redirect
VIPRE Trojan.Win32.Generic!BT
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-05-08 00:45:08

PE Imphash

5f35c086d33701c9893e62733c370b78

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text\x00U 0x00001000 0x00003878 0x00003878 7.511233910960399
.bss\x00Feb 0x00005000 0x00001f40 0x00000000 0.0
.data\x00eb 0x00007000 0x0001fd08 0x0001fd08 6.727518024924472
.idata 0x00027000 0x00000598 0x00000598 4.374560991241581
.rsrc\x00U 0x00028000 0x0000072c 0x0000072c 4.0867057140360545
.reloc5 0x00029000 0x00000182 0x00000182 7.50038325992484
.hxlrvpa 0x0002a000 0x00000400 0x00000400 5.369043450183022
.IdOaC\x00b 0x0002b000 0x00000cd7 0x00000e00 0.41220606608416477

Resources

Name Offset Size Language Sub-language File type
RT_STRING 0x00028624 0x00000106 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_STRING 0x00028624 0x00000106 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_STRING 0x00028624 0x00000106 LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library CRYPT32.DLL:
• 0x4271c4 CertCloseStore
Library KERNEL32.dll:
• 0x4271d4 GetLastError
• 0x4271d8 GetProcAddress
• 0x4271dc LoadLibraryA
• 0x4271e0 RtlUnwind
• 0x4271e4 VirtualProtect
• 0x4271e8 GetModuleHandleA
• 0x4271ec CloseHandle
• 0x4271f0 lstrlenA
• 0x4271f4 GetVersionExA
• 0x4271fc GetCurrentThreadId
• 0x427200 GetCurrentProcess
• 0x427204 CreateFileA
• 0x427208 FreeLibrary
Library USER32.DLL:
• 0x427214 GetWindow
• 0x427218 LoadStringA
• 0x42721c SendMessageA
• 0x427220 SetWindowTextA
• 0x427224 CreateWindowExA
Library SHLWAPI.DLL:
• 0x427230 PathAppendA
• 0x427234 PathAppendW
Library CRTDLL.DLL:
• 0x427240 __GetMainArgs
• 0x427244 exit
• 0x427248 raise
• 0x42724c signal
Library ADVAPI32.dll:
• 0x427258 RegQueryValueExA
• 0x42725c RegOpenKeyExA
• 0x427260 RegCloseKey
Library ntdll.dll:
• 0x427270 NtClose
L!This program cannot be run in DOS mode.
.idata
@.rsrc
@.reloc5
.hxlrvpa
`.IdOaC
2X5i\(V
9I(9)c
BJ{![Q0
1X,27S
PfBD\ cB
9OTC!R\X{;Ge[=
?cD g,J<
r@,kAX5
oSzb,zB
dE1X5Bm
e'*Sf8
1OIUbK
ac1 Y5#
rD\\*6
K[FJxh(
)1<*4wLB*
c^]X78
%'o!MK
OFbab3
Y;JTB.
5#lT"d
%3ak1L
bTXmfQ2DZ\
xU<"6X
Jp23Kc;iTR.
Y5OJ*K*
(:Z]Xh2oLN
av)4jow*o
%/c~!c*
JpD&fos
W>hR#p
o8F]XS
hY*_oBW#h3 ^H
Jr]:lKm$
J*[tIMKM
0i]l[FP
aF]X}f*ouOR]X9zK*
'wFJpf
b['fo3A=
t,;r\W
hR5h0_.
kF1>cBD\,;rU
1t.[pZ
.d3]dWp7
%&RydKFY(V
Gd3t6p^
2dgt.$!_VW
UbGX3D
4P@]\X
iRX5'_(
@*XUbnrId"(u
tL.jP?+X^cD
K:R?)Y.`
.fkQ2K-!
Nv73t:`
r6dw1d*e
cFJr"f/
#dapYHW
hR5EyY,;r
p3yzIY,;Fruf
^"ODJ]J
NcDF~P
F=eBm&KPjJ
,dE=,^[X
2\Vcl/
.owV]/EUu
P2*XFJrS!z8_
ad?1G$5!
b\.~Sk
bD\X/a
iD(XLrV
bnD*"/!=}=bX
}t(5/b
>&*rmd= @UlD*d"Gl[
d?kKD\)!
2d(X=:~W
E1GUb|\f>
D\}F'!f
^=PUbD&
\`#rS!m1I#
9!jad31sOy**
%z8K*/\XS!
E1GIUD&"
=UDj"/H
d?=f&&
ZD(X.~)Gd?=buD
XS!bfd=0U
rSdmd71b
E1=2?*\
Et=l0Ub
}KXUbLD**
Ge/bD&\"
XM#F\\XV<[da=r#
d=sUDX
\E1=,c>&\"Sk
K3^XU>/
">x!d1W8'b\*G
x==U*\X/G
kd:|Wf
ElKYMnD[
Ub|"*gSLdm
.a.r!j
>bSUfEKpI\I.*)[
d11=5Ub~D\*X2'
6d&F/g
IG5zd6X
E1C?0*#
8EG!2(\X
d1tKeh>9bJ
N!KK@s
D#6Xy#[/d
`k\#Gp(e?AY\Ug'"O~S!
b\X6<S
=j}m=p
JK!!}=$]aD\n
(S[mAGE'VD\*XC
b~\&OrS(
B=&X&>
7t]b=2\
xD\ :,V
mdEb>U>"\XJ)!(O}
K =*f6XVr
d5rD\X2
EU=X5Ub\X
mdE5UD\:SUQ>G
[3tf0\\CSbaYB=P*b&\`
c:Xb2&XS
E1IX5mbf3
rS[dET
k\\X2nWc
eUbdD\
S[eKE=]
dNb~D&.z
EGU0&k
dEWbVD\.
&2D\\Xn!
d?UbD\
)D*\~!
?mbo>&(.<!j
PdjWb#\
/YjKs_ODX))Wd=QFbD*ES!
>Ks!H2s2A
YE=<&:C'
dHM:U\X6p!!
/=U#D\\X
Ub~>\"F
ds:U\dX6^dmdE1
U&\F~S!,
\\X,SjI
#*X2rWd?GCb
Ubvy\X
,EpSmx1
dEGUV\\XrS
\sXS[i/zU
K=/bl>&6
jd1G b
$*F~S!
dE8Q#>\X
&[2JS!
D&(X:rS!/?CG
dE=S'\>**
D\F~S!Y4xWYU
=XUs\,
S!f?aOMb\\
UbD\!/dE1I!b
mdEX5Ut:*\"
*_.c-[
<9Ka?=b2~
Ub>\FJn[
cA=5U_2X&
d?m+bz\\2rSz5=
S-d=q/k\IJSWEIX
>(X*~j
M0UbX~|f
D\a2cJr%ddmdY((zb2s"SKda
dE:G0b
q?D(&J|
bD\\">v'!ji
3=b\XmS!jdG4E
!j*E=WMbD\X+!
1$#bD\.(
=</Da*"F
E4XUbD\X
EIK #\(F:
.\\Xe!j*
E=5Y62S!jmdEI5`bk\"rS
nD\7"JTN
dEi\\.)!
dE=5b#2&JSf
mUH|\Xm
dx]=/b|i\XS!
XUbD\\XJ%!
dE]=X!
EG8Lbn
eG'!Wi\
mK?GUD\\X.
!?dE1=XU>&&GS!
_z@6\>
rSm1\#
=>b*\m[
D\&"#S
WM/k\X
SSE=U0**Xh!
KbD(6X*)
W]U\,2
E=E#b\~SaZ1=$Ub.
Y}=U2+D#&&%
E1=)b\\.mf;1GiU>\\.>rS!
D(DS<md3=UbDa\}
/bD&sX
adE5#
E=brD\\:WdE
D\Xzr)d/
D*:~Sm=
D\\~dd
1Ub&\X*S!
2lC&XM~
JZD\Jp
G,b2arXJ
3=5mb>&.FaS
3=MUDb\m
EIbf>Xb2~
Zj1WeUU
=XID&)!
1IUb>\\zS*Y
I#b2&wFS!f8
YE=D\X~@3GX6#b
4Q=D\*X2
dEu=1]Uby\&
bD.2'fdEXU
)[md87
cd?1=X
5'D*X6
E<GXUb/D
!mdE1=/D*\F~
MZ>AGcrSU
AUbr\\9zYEiG
ZD\\FAn!
/>\X:;[
d=UbvD\&"J
D\\X*.+na
=-*k\6XS-a
1mbD\*6
d10UbD,k
=S!D6:
=&#D\c
I=XU/2\XV
f8dE=XU
=a/D\.S!d
EU4UbD
rD\\".
E1*\\2:
S[mdE
0X J)!
!26*"F!
b\&XCrSd
:y((.~S!
\66)!zE=qb
fK#D&w"#9jK?IU
Y\XFkr)
J)!jwd\bLD*\XO
Td1=UA\
dEK#bv.&
5b\\"S!f
D\\_')!
#0\\*2
.\\.:AScD?=
/\X6S!jd/,Ab\
md4,UD&}dadE=/
tkD\XIS
,\\XWe}GUD6s rW
GUD&\XJ
5/DXc!
edEI=SU
!=/b**
Uc\.Fr!F=/b2\X
.\\2~-z
GUZ:\&Fdn
k\"pSj*i$IU
*?=!b'>*\,
=X*U_/.\M>S
\\&S!8jUbD&(,3jadEXUb
D\XJnS!
fd18Ub\&
D&*"E)!
/#D*p.p_-
!8dE18#v*FS
/bD\X:n!
=(/>\VS!
S!md?=}!
!jGd1Gb^D&\.S@
3I*UbD\_#
XI,Ub62
EHWb>&e
Ks5/b|&&
:~S:E=5
PE1=0/uDwt
d?=IUb/DXiSa
n\\&.!j3=
D\"*1%!
!j=Eb2&&X:
d?=Uc0&&X
dE5\.
ad?]Ub
dX/bu\\X
E1=/b^\X
=5!M>\\i)
QUb0\X6nSK
?=XU(\J
!j3=y!%D\\w*zW
dE4G4UDX.zSU
b\\X9)!fcz?=b~DJS[
1m_D\*
)m1=]Ub
0\`QiSjd
X5UUD\_S
dE1KUb1\*&
d3#=$:/(:
\,KS!m
3UGS]b\"O&
D\*XcjmE=UbD\*~S!
E=>'Ub
aD\XA~S!f/dE=b
3GUQk\*v!(A
ODeUpS
2c&d86
Wd>X<#vD_X'!
jcEm5#
cj"JSW
In5\\XC2
(HBrpM2
K:[3b"c_Y
NXp#x6da
L[n#RSL
fa3tB*(ZrL*fa
r'$aXz
',c!$Mx
eEg`e#kx(
pD&(N3
aMFJ~"
!!tX[dBH%UOJ%ZE,s
C[WiJr
W`29AHFX
5A>HH<1eTLSD,~5XO0[L
1N5w$f
LF$ZA9
5jbO_B!:P0wB
)_X~L/d1#C
g2!i[H-
S^r15i5
\*WKTW
]C%BZ$F\.
DI=pYm
.t2TAA^qF
AXvt(*,
1_v)M[?
_@x/l
1a8Tb6c5;oW&
i9J!e15
0Lt3l_b@,FK/
,1@vaHx
wD=C=b
0*CD2~g!D(X3<
{NN%8=H5W
2OFQpS2(t"Ij#Z
UuFg[J
Y[FNEEt
S"lk1=
pd"D O
~tW[ f,dB5CZ
-Cnb(c.
",_W8F
*X5b/o
:*X5b/
6*X5b/W
"*X5b/
r aah r
Pt@@ES
Ex@kUM
t&R[q=
EuS3]^Q@
+O<kVaf_
qaqkaUOk
NqfOkNO^+OOO
O9+qOO
jUQhfA
+3fUV^
@NfXQjPjaE
@h@h@8
tp3lE
p`SdhW+
FVWGWW
,dEV@W~
WVW+dW`
+++WVW
+V/d+G+`M
+hPpRVQU
++@PtR
|R+UG
Pxj+qj
jhAPpP@pR
W``+AQ
MR<@RRPWR
q_d@P[Q
f@D@SEM
uVRD@p
P@VD+f.Lh@@
@fp<:p
Ppth\hXdDp=
p@D@j@h
8jDf@p0h
@jD`p0
hhRp=@
R0EE0H
DMaH@E
HPfFbt
rCvDuh@RNhHS
fDfu3+D
t@qzDD/zt_$]
EzzGQUMV
h[D^uIt
LtXV\L
Y2DD=.h
DfOEM8
D=D EDf
@ppV+t
DVV^u3
5t}erDD
P@W3tV{
{+=@hD
thV@C+hY
DFuFd~
tVG"5 W
/e=t3VY
w"=IPYV"
W"5f"
uVYtftW
_QQt"j
"f}95P3
fYt3sD
E;Vft@
Q[3tx]
j5sWSu
V+YDf;
PfLD[_j[D
D@;Y@;;
tM;@EX@
@p@h53
jfqF{q
5YjuYY_FF@
tY@W\juE
|@$@DuW
Dt=Y3D@@
5hjt@=DpW@@Dq
55@Dj5p
pt3Dh@
YhD5DN
eM_]jE
[8N}Et
VN$DMt
DDPP@@3E
@5hpuN@
^PPESj
eWD3pEp
P;@x@@
Vtq@`@|tF;
@@|YP&W
V3@U3`
t@ED0D>P
uDDEtY
M9\MG}
k}YdYu
E3W@]UD
^D]3PPt5p@ppp
U5ru@jYH
@D;WV;Uu
sDj]Duq
ugu@YqEV@
^$E3EYE
-$@[d^
+$Etp@+
EDe@uEL
}@55}(
DE@MSj
tPDh@XX@
f+MM[0_
T3+uPt
fDuu+tEu;POtD
}EftV Wuj
tuWu+uj
"Of_u'
[3uO}t
u^j]fuDtf(fP
_U]Hd~"
UVV5(Dpu
]u^]9K
Vj^]v}
tW;09t
=u;E_3
@@_N@D
rFND4$
GN@DTN@N_
wIdEDF
@LNDN^@D@
Or9F_@I@
GDIF@@@
_9YVE9
uYt@Yt_[;Pt}
P@@w~_ pR
uw_r3j
wGtwtpuh
8e<u<3
tpu3 @
d<8<]p
>ut+FuPI
D h{EM[Cv
@=@h=E^h
D53=DVuh
W%@Sd%
_jVtt^YoQ
E][i$33@]j3@U]3L
W]pDSS
St=$5$
jF]u@3P
t5Qj^4pYY3
D]@]9tuuMV@
p}`Uu3
foo~ooNept
8LYvD@PDv<`D6Dvv$vDlhDHvvvv*v\vv vv
J2vdDvv"R@
P]`];t
PFF8;F
Y@P@Yt
@PDD;;@
;T~3E3
E^pEVU
t]$u5Vt@W(;u
]@HU;S9E
+};uP]
LP8tV$
}$u;]u
?;u;D ]uS_
u3E(SuuWuY
E?uuuUu
uS$huE
t u$Pu
}w;Wuu
@S^SWEWU
UjtYju_uDuL[$j
d$vRtD
uJpHft
7$+fAIY
nacmiso
convslu
oaoco.ny
lzo00
6 etn-t0s-w6
ao tlv
m 0oec
yu!e@o
a!rPEm
eDseriEKisrtl
V2liAo
AhMudm:
eeoMyuy
uTAgtmdbe
ae/gMseiJmgodrMa
MSaeTaTsSS
yiaoutrvA
MySlayS
tpyadF
DyJnnarbys
l0*-{vs6$hi
g[byn5 xtm6:(m\
!na6%4]#p
=fijzv'b21_x
|kk;wlwc,a"@u6
!X{1L.JBQ~%_FY
,@FHU$}
4IO2BB
XB8G|0:
TBSKT<5/ADO
GY"+N)WU(
EHLZ;M
W#1[AL\K ~+/\
il|\ n77
\MuEet\y
cTFguA
niellese`S
tWtleeoaeEtWsoiVFFWuCoePC
epuorp
zleeeeA
etrFoH
erGdiooot
eetdaFGHi%
RemdIrCGeWGsGepc.eyeWlrh
caeGiG
STneiteAe
WLWmPeGaCtrGL
Pol2ae
eDtotlaerGeettadElsoWhSteSeiiGnT
eeDrrlWdu
NoesEnrHoWir
eGNomcpyrateGFCmm
adGLtWs
ggWaWhaineiohesEece
oeACosrlsees
DtagsAtsWstnho
gWeCeehMrsLaLooRWMarra
etUipr
Icsnadeoawa
dtaEdoc
rtaWlxadsdgeu
saC]MWtne
aStaols
rirhtWelci
iBasanesl
aiadlygl
tr2GgOsonuiaoW
QaeSaeagel
ysaaliPecasrfeEsRee
aPgDRteeBeEsmieieRxoUNrad
3UsCsires7ep
ynsetEoweKx
o0DtorKW
Wmgl.PslHt3.Oi
di3SoUtin
3oi3eenlaann.toE
CtxtdllalWaz
Q!32lx
.a.elxCeUe
yleiiD
l@?rIneE3uAEdoL
iloRStLVieSaxouztcESsldpElurl
eLgEme3
ICei3ltlnhP
nCuiel
AWIlGWgsoi
eellFPIceniU
erEnooaeUcnEdGlDdr
cEscrsnnt
PEePtuCorru
iSueFodmthIrnnrPGcanfrP
tleengtrt
rpMsrti
bTrdes
dedSrAloee
srrncxWadxrot
sesedra
eseuhleSti
dtaHreEnoeEnminSittlrlinccstttnero
nSeCenn
cdglyldtitt
ItTdPe
sttrGto
dioSttnnSSogoicWHtoS
rlDaen
eePeeemeiGi
cDioeiprntnlnWunt
reaevanCztnGieoocpedvteeEneardaek
nroteIl
oLVrrtTr
AevTtt
eQSlilenomH
tnm9lcrirCtTe
rctfFeeesualolsepeursusIal
eecGre
cGrrSTmm
aocCoya
sVeeteraPtizPaMiIIhsdiCogrRenPir
edaSrs
hyRedGPlTtEeS
detctSi
dnrEneaWoPCsttWcnrrCiP
bAtHePteP
eoIncUueeA?Cwn-c
roitVaeLPepsClG
alltPreF
@h@@@@|~~(
O@W{DC
mm/~Om_
KPPfNm24
3G %dfBB
m Y7P+}
_Uxa.mIhSwm
]w|l |Xv`5V`
_UL`lb
`'p`l1
rG(CR9
iIQQPzb
;G-CVq
B//D*1Sq1O
kPt}?cl
3J9Jg"&I*6A
]StkhR
j 1&|PO/udW
O\t#Yi
'/hW/1
cDJ;(oRovomr-r
@^"O\&AU
xq~.]SA
~czy!sZ[m['xV+3
X{NQT[uf
QA=z PQ
CY$k{D~
~YN7 =r):cC
=`={==VxK
~i%(w<'=*yL+zBHxFX
c4E,%&3 sAGjb
Yf)72z>@*V
QD2w-!Z0HA>
CsXXy?TkI-
m9\yL$BguTFu
1p;tNK
K}cA04v
5Nbn\L^
{.B7%eaJ+u1
&vzXZ`2/42
aJ|s[qB]u
sugi}*z
Ij+Q@1
R'1rA7A5
)fzNA`
g&wt$Q\d3
[s_cDJg
Y%M\5z|
VMS,IM:l\u)b
}b@Lpdw
4Iv/u!wn:
S7$0&{lJlqy
7Z)[Y]
+E,Y&FU1
;]A"p+ST(
vqYKed5
c_8N/tf<
E{+@3Aw5JJzRX;"7)w
u.#="1
-bpDA-
~p>XxC>Hi[i
=Y4,R+s$Craa;#
'ia<T;y/W!
;8Eoil
qciaCjysRW
B~<PQU
hzT/B{
CkhyB,Y
ck,*\;
A*?CSOk<\Q|i@X
;rNg4/
orRX@XrR
_FLR~'7,"C
> 6ChHkL,
;'LY+HyV
+/6OCl
W+DN&t">
3U;o8{/=
YK;q7c3KREFJ
t^/@w<5p
%63x#s}uB^0
g.QwC~
48eiwNOBCAP.W&
40n6PJ
5;#][J
AHLdC)
ACECcz
T]{<zV9X rJ2tfr
Cpo5YG
moKP5D;'m5{
io\Zktzr/
pw$e]v
X)B~-Q5
l%S3vn"m
y{3vv
d:>!Pe
SlG812IV{{
%C6"{hQf
^M5K"5"!3Bi_,tp4f
06%`]rR=%
0q;m0wT~T*fTgV
E(rbff DUS\B
Yj(X=f'
gV!pZ_\k~/"
~q0d4G
~&}<jm
I!#M_an
$7.?`_j
on9cbx
s8ci||
CAJUWm
1o59lfXT)yo
gQW}6!L)a
HNM1p&q{~F
MNZ??E
|~lMYQ
wM78M<
P5@X&5
p>>kmi
bkkVOt9x6g4b
fd(",K>
t*>;)RS"U
Ydp(h%f0g*R
i6KM A
RCc=.(F
75&^q-oT
z:U/PD{zSpU+=
h]7[NCZi)
/_qRk(5
![cK=LMw7
M+aX"ct
%8+kQi
vO/O|5{_n
$]MkiB!Iv
1 %fAp
{m=*1C%n"VrLADL
xY@xYi^
872Q7>
5Nj4'6q
gd]22NrP*D
4rO}Q"*
"0h,Kx;Zh\4CB
.^C8,BEp5<g(p`Hc;
ZV90>\A2
(7DSUAtT>q
-3'jbs,AA
3.H, qm
{'(dN p
\mq=m}
cS$cV9c^l ]7
,f5yK:BIG,
mm}|vv7
o61xY.^U?Q|U
Z>2g4
*4T<x~
H!p4x(u
Axb7Oj-L,
c%;?D.
g($:Cx
nk@SdQi<ko/*5DuZE
0D]n2!
Zfh0i!P
`J<(j2{e
rJ@B*'7#H
r\grrPBp
jr[nkD!
SiqD!sM4>
R{zu<]
]&B?G
a&@lrm
N/YQq2
^fMRjRJ
f}T3n!d*|s
GV(~m:
V<8KK-RYU:=
wyDRG(w
O*(8bc
cTdh@@*q6v*q p
v AOP,
41Vl<0
*_@U+/
`+Yxo/p;*~<
D3sAYed
+i5O~V
sphG>b
7_H#$Sbuk
TWDV_PFTb
*_r5W6+))
jCWhS*5t
+<at<8*
gRfU2C
Le5}9T!-
A{_(*@d
s{X=#vW)
z2vj(<
e]o;W,{#
_/fpvQ
BP}q6v
gBCOY\A7
[&(k8+B@y(dg
'ob(Z
@xxRSR(''(}'Xb2cY
-u~egC[
1-@'^s$xKIo'
s>baED(
L,}gmPl-
f5l<W\
G_-+a
&/EeDEx
Uj7<?;Q
`si.wi
T-BDd-DF;T1tVc
Awrv%8@/3
nur"KQ
=k{^'Z
bfLZo$,S
:W4STi
M%c;9CVric[}Rng5g
qRLNAW
0*TkG+!VZ6/=M*`b>
YXWRG$IextJGmh
d&DGse
PYJYLo*
MuV-@K
GQ|k|E
kUtq>qJYA7p
n_uMe=#
)aer>>jc&
3V'j<"
!VX:1OF}
PqeOelOO@p
wcn99m
Jjw<0?[ccKE'2I#S@t
:uc\c*8Rv^
'$Q*ccMST
3uB^8G\"$a`e
dB2%%<5@
l*.aXTK
a![ll]
lTln:_]
bDKt:"q[HB
@GSpSoJotT
07eI7
EovS4%tT
K9$w>R]
\tSm'Kv5
>=zrlQSS"S
&q\USogQ%Z,(H8
vngd0.pt%
"sO.rW536d
kp [R)&
/gua6{}
`E6"bs
OG_=V)
/.Puy1uI/Pm
NUd.hz1
PGS{(Jt$/@
;<"H5P
iiG 4 MH
r%WJv/)"t/g
*UhkK_
+~KM[<OqK
C!lr g
eQP/E/
|M#0}-QFDVg
;\\|f)v\'
40<gR!BuHcb8FLM 3.bnt
8!b)k5
rQf7Xmi
W/Vkll
v[aW~DkcKE$XD
*yJ/ej~
}V51lJ
'<b8\Du
~K3On_.
N!EWr>D
j+%U(Wv
0.<GAS
C@c9]tkZ6_
j`cfMZv6="~x!wU)y?!F)/64
IqXroV8
~cvdu4
=7ZS@
7@YD U
;qh,cK1T5<pQJ@6
^gN x75Zz^eS7F?CHL%{Iu@:1K$~
Ce1d,a
!HqW/Xy
Od!r1;~&\
zRtaonwr$
~a_s}1Lxqi@jHP1t!
F1Qw~,
6 O244
#xe1Zz
Ul0rrgpI
M\L7Tj
y_j85)
.jPqqqq*RQ\W-%=
q>R8K@jEEX
r!q`!kxs|TpB,'n[)3
WPl();
G68#[n
CnA-M-
TB%5XylaL+
7~fy"6
!PE?us
b>MpCeU
8vVRj.T
l40Zrb&S7VV
uXTVkn
+=(J}#
w~S6yZem#W
lO$IMWgB>a
Zw+'k.
/X=4WgA
%ol'.%7-B
(*m>AB
NH{L!}=No
xRsZx-vCfem*
fy6\Q\
'Fdog$
!lE;{H3
!5hxWH[
V5"*4,XT
7YKo}'>
mxfBLy7_Z
$$S\4Y1~J~] sCw
i~*>D3a[
M7S*,8?
?e-F%.^ B
!iVr}8
?U[.v_?MJg*I
V_:<a(pH%@QM^
Dc&Q9j=
rVZ3T;
W6==RfeFE}
!a* K_J
sUY39"F
.X<WQzz
4=4ea=
9z0cl1
xm"&g8B
(o(hZ!((s,:
(r( ID2+
_gL?J__
QozIMR
=(sR r++
(UaG+m!
M@oCG
1dMR V
+wdi\z
=v*-zj
O)boz:MJslY=
#zsS.m65z3{
j8IyF/
xU/ =q
d_aIVFw
6'su2[
sh3g91_B
)G'6M6N4
P[or}I%?1
mGj7=?&XpX&
A_KPse[
Nq[|-{Fb
9UE&*U375`ll
+0TlzY
xCCC7l57mv!Sp,M[?K
BFXa.YdTj0
lJ5&{Dhy
Q.c'{h"
Qe,c.ZLAVhp;f#G(
ZP2&Pa
nMCzaN
\^cchd;
"Vj>2BT7
3+#VlW
>Ufny!
P\hP){9
0lv=y::WHOD
r]zU|$OA#:i'A
QAg?AA-^
Vh<gX#|a[M,P
f?c@[S@e
jZW#_R
F*aGzsF%&^j]Y
0%SUMJ
JR^/CA
B>h7JSSy77zL
#tJB1.M<!
RGd%({=MC
CeLiYLG
D]x2Hs
YA3ep]zuTb
8%@L]EY8zdAM"]q
g79L@x
l{Bl%#l
m{P@h8)rl
D_2L~{%1
Ah0lV)I2
=@tDrlG
y^k=pnu
*Y8)uZ
:=\3>u
,694y0?
z5z~S(-
ymehJpJ
1a[:`Yi
k1tUn,"{]h;_
'Xw6:&z
v7%DC7=J7
jp}BTtOQ
+i9NmAo!awf|9{N
Y9V2O}J
oHdi~@h
>UR'|/<
u|>pR&
+,wat<D2
<!~`#=Y'Q:Pq
X03yFL;*
::*XGp
: (r:d2:X`':
\=k)$B'=
ly<R)}=3=?Sb
WZC*Us+
zGb'bX]g
VC{c0~
]o)-M^
}NrD=r
O<)_@\ga
~.& _sa/ao.
$Hp R^
-gHOa.9,A
8FASd.S#J
S5#I(P
D=#X`&zV
%F`[$^fG?C
_'tM%YQ
Iwm?`a^^K
k?tL^1;}
^#WYfd^0Fex
3uNm^sk#
=Fo1ED
D_kp^1
9qCj>woP
~SqW71f
XFXZDxL.
51L*|UnP
jofSn8lpz82S
'AL;-LLB
KZDbY]EQ?F
Y-|[/e[=m{C
}LO^O/o
*OEW;V
v0: %J):wMij2u
-n=AxR$O.
Z({<]*F#S/
g+$ |#
]t#X?{
q|u$;:nx
{*2'9!tGt
YD.6.x4
~~V)x^x9gJnx>
5D+nz
@!9zWR}kK>LE
4Ly59}
@JR}!Ik6
$0daE$
pC*,"4d
qhhIdh
#n>d3a
cn*};"
pVs(yum
=(EE]d1<
vsU`&'I0
OF<!.~
6=P.'Lno3=G
qST=Y
dZ_4&M
F ,}t:
0fv+[5Q
$l`:ze5[-P`(be"o`\S
&l-8TR
3`CC1:I
SK&#$'
>4XphYX
/9KiLB{
k|ZS,Z
W;]o618x
(rqV\)_^8L
{e^0!]/6eoPpK
@ZmB$%#
:u3ZjHwE&
H6`K'\FF4
JAX"O
hn]8{3
O_M"OC+}hyz
BJDffiO
";A}OObI
>nzcaTi(bd;g$#yJ..{I
Jy(-(=G
4}b0v-;
Lsib/n[ }
u@Wa4i
%Ku&D%0:2F8Q
R(hVb&&i
m~'!\P8#h4\Tu
ocGxr.rb
g:V+@-
8q>!&KBs=
MoJ,P|9i
{?qBMDr@I5
X)wwR0JUU`ue2
o}3x{=mJ'
@f"'&+o'
d"2-77
9>t5IW
:2K[Vw&
_ \DT).
mmrE!>
tm=1J8
@{|_!,fyH
[9Zdmt
}jP2LbVq
x81]PZN
^ijTjjB
iiv& 6
!\&.Z!BAu{;xW
PH)n>y
9TkL;B
.sLEkm=Q8
"9w?H`9
BaDu!7FaK
ON^uZ6/
|kM@bE
*v+&'*-
<ELsTA
`G8CJK]?4\c
w}$bNzBU&mv{~D}\\
QJH[W<
}`LO9ti
ikP<dB9cdE
ldd{Ry
b{O6rb"o
`I0:Z.Lds
Wd+sP\d
fV7j5dw
*(q0U#LC
u$%1SOK,C
n`2p;XE
9(_+tz8WB7
>X@&*w
oAq.%4)jX
m 9b7DD*
maYQ,L34g
=] E;oc*
"F\' 1 p7(
lwFn=
|GE_4w0F
F!U]"gu
Pi|s 8:
V,*[l^7mBc
71 +x4
LOvgph:T
}s2U$gy
B(o*-1
cUo!~c4g*L/Z)19
au0h1Uc-'6d
*IQ2F:[m
O_ZD`_9R
hdyxO"&{
cdy(w|
'g\mOj3
PZ-_.i
naqVzc
6x[f@An
?vI=Vh:6J
~JaHHc
@\>l^f
f=n~?`
GfNemt
IjCfovPe
AJxf[\
]\}qF%
q7I"M(_|
.SD5W'
>gcT$*+d5c>}j#nC_Mc`
_2Dy;_!,
Y6*>xY(
F$N#@7N
xwwwww
#/!$,/
@75/'/
oL|}{u
\]ucxt
y^U8dcx
{wwwwp
ra4U;;xm;
U5xOGhC
N/_N{<
_qFLwo
!)F;>}:
;_B>;;<
u*Nlu]
X3UXgX
qrqMK4
@Y>zlY
!elwHFFY
GGHJtK
EYE>H+w
YEJJYon
O[H0Sq$
wwwwxw
666&A/
nbjrxOSy
|nv}8b}n
b"}q]^u,
ysZdzjU{r_x
nndl^c~ne{
me`eea
:;;0q;;:B;
QO;;;A
o qB2v
<;=;1yD;;
jDj7(~
RZ++q+{DH}7KE
B_;gQA
FxxeDDqu
~acaob
"l: sfcfn
umI0Vs =r
rssk e:i> eteetcslLuneEs=mssxeueufIessi di huco yov3 eP<-te se "l>t "e etr q
vlnst vsl="i re L oqees<srie
/srsmvc"Et
tdl<m "qercqfAe xc
esscada vlageu u
sr m esveos-ee e>e<rioa/oucrcin >
PsIGI>GDGPIAbGXIN
PtDA iXN<
0IADiDDADXPaX PD>sI>eP
APr0yIieANIGoe>DADGXy>ANsAADPI NGP
Nr XDPA<GDAX PdIGXN/lIA
cItD/GlDIDXIPAIINtDs
DDXnDfX/>GDP>XANusID
v>DG>NPD>DGNDmuDI
eDr<IgI80>33>4
>4<00]aW5_:41g6
mD4n>5
>?44>443J>5
?8104E;4?874k?
<S6\15006?>87>4<48_
Z1=zx 4>>2649046>k:?id
930???;89=0?:54mR?% 451Y
030367143204($1>4
522443
08306647#
1440468255^
022367372235633u203557
5f75G42200
52384pG$34C562
lx73r3h:<<=T:49<;<<;
9O0:q>>:
:9*<;<::;=
;;j:?:>
>{j8:<:=:>?<=?;<c
8=>?<^<=8:8+<;=>
t?Z;::
>.y<:I=::=:=
:>>rt>9C0"?
z:?9;?:
:qO:<:
:x;0>?
9e:9c:
8:4485968w;8Y8w488:G6:68X:Q;8;7
7,c9O=4572\:!9;9^Lq
8[+8i9480586cc77F4
7&;5:5 i(;
:L:2522
5;sb-z
77N8:c78726@c4;49
c;6c5>8;
7;O867L772
?1=;q>?#.11d
<>4;<0X
@<;;>;1#0Z1R0><20^1#h>
N>42S???i#
??0<1Z?=>=
G?#R';2>^;@o;(3;
;;;1?rB
;;?0;?9;;14d;#?v3<21
>6>=7<9<_
<=4Nu= =.4:>6
(UR/M=
==5657<$=4H<9<,9
?=>8>=7z94]85;><;5>;>5>]J79>94:6>86>9=7U<
6;0 894
=>=&<U6<S
9>l55848UU9=U8
8>_=5}:L
6!;?<4E
:81?52}7?87
w}3=73?=70:1,0?
?::?6I`H0?:60:I
0Aa096:S17=
7<7<?;06
:F<::=6:(?47
9?9=1$)]wA27
q3#???290:3
95Y@6=:
(?8=6=6470
?045~t=`Mz;U;?90`X8::
:06<44:
><1>1>:4>
+;4=<4<4049<
4497LP><:<
:$>_|:4R7441d:;;1Y*::%4
H4=4334d3=30
33T3@h3423
3T3l43
|3pDL33$
4ht834P343
(443H$33<H
3334=3
43334(=,
3334(3
CryptBinaryToStringW
CertCloseStore
CertFreeCertificateContext
GetLastError
GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleA
CloseHandle
lstrlenA
GetVersionExA
GetSystemDefaultLangID
GetCurrentThreadId
GetCurrentProcess
CreateFileA
FreeLibrary
GetWindow
LoadStringA
SendMessageA
SetWindowTextA
CreateWindowExA
PathAppendA
PathAppendW
__GetMainArgs
signal
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
NtQueryVirtualMemory
NtClose
CRYPT32.DLL
KERNEL32.dll
USER32.DLL
SHLWAPI.DLL
CRTDLL.DLL
ADVAPI32.dll
ntdll.dll
65 xEC
73D[\@
<X<TIpmk>S)
uR}w)nPl
\nZjEs,e+j+#
|M79=L^\
%_{nfS
e5iVb_
2X5i\(V
9I(9)c
BJ{![Q0
1X,27S
PfBD\ cB
9OTC!R\X{;Ge[=
?cD g,J<
r@,kAX5
KJIwH@
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
JFsssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss
Muul_}l[D
=&|vGr~&_jF
z!v)Fkk<
g%mZbD,cZ,xk
[^;E0;JN
m]sv-k%,q
3qI>E$
L1eb(pOe8lZE{.oE"
V!K{:$
|p(AW}
*&{R]1h*HXVP
$||{59j/
lnE7.7).%
=#19jSx$X
S;!p=)T
-VW>tW6c
-yYy[Q
?!_mnvX
q`EMj
\otk%:"~[H;`70
C43:1^
%s!Mh1
G Ky8#5A=P
$[5kz.
+9e&hB?s.K=
}M5!ty1ef
,@4{js
Rj+yKO$q57
wczshpm
v"J~Cyc!l
HMy@4B
]P6X>
t/W1DJ
<0NWN-[
(k *i"kQf
,rTxV#),V
&]A6.M][
1nN,>O
k-@ugl
?'U ~1ZY?-d@NMi
'lvatzU
`zMP9C96
'&?!hy\4b
AGl7_8/
F-2e;wk.i
Z?}fM!=y7e>u
~tfJ74-
fuw]>oF
a8N!n\^(
b~h3ve
cL"p`F
^9M(K
UeI|0Pjb)96
{qv)"&
NC^te?y's*=
JRMQ#V
(J72O[
iyI);`
\4(froNUW3k
wKt(RcVU++^E
Kkx-UM
EcLV=r
^n8R@0
e}jPrV
#PvEPh%Y
F^3Yr\T
C8TM<a&h({K
Z(u)BzR]|
Q7@M'a;#Z
]f1=,\
KIOvd:IO0\^dK3_
[4*N];i
Y-Z< N
%vf"1)
aW.*{$>*NEx2E@h+kkdG3J
wN%MMtf*Ab/
(<jbxy(>1_
[Z6&@7d'
##F$n@JcaZ$J$|V
Ho]7WD
y&Mi#!
n 8Qc1a_
)uZRP(#
g,[#kz@,OP
$)qqH+eiIs.(Z
A\[l6M
^~5OCGR
<=sHe|Xz
*(9[k- 7
.xlmnMENa
el=WM"@0H
^86H!n9
iU1R>TD>m<zO
wm69,E,
uEQ\U^n
6SF*Bg5
5*??TBjx,{
%yKj|D{e?|q7
|*<ke|vw
W"p6g;
}q+)du6V5*>?,Bx
Ihj4E2]sI0
%51P"G)?BL|JoVr
mDC$(/e&MH
X/X|S!d5u
p&4cL$?;y^
uQ-L~9)lXXT
!|'=9:,&
>_]3YP
Apnx[
iB*unp~/
:!t>R
ziW3P%
L}JA'#\B(L
|a'FJ`4#E8
St=i'VjV(m
bw6>_"
>9*%y
u+cb:Sc[z
Y^XgMA
VD6(tsD
-.zK&mE8s$:
,^_XUa
iB&6lw
<AGx4<:t
lG?4b *
&K(Gwg
]9V(j;
7b`7zQ
s!p`7~7M
_$>EH{$Zs|n!
V?M)u6'Z
Jt^ve*K414l
EL6c*Z
:vg(1K
sb>iku}
<?tg?3N
zcd)>Dc5u=otI
0ZNtl|K'8!3
ZN0~0 n
QA0#^8a
<6[DXap"
B*N9Wp
8y58n|
u|(UT:L]N
Q4`%8L"
`Ga1<]gQ
Ik2N+F
pZ+B>#2K
`_9KZ">|
-YgM,;
ezm>f.
,2~pN0
sl/sp=R
tnOX{x:F
:2PoXc1
AGav32Gp#
@:0:35$
hgtLm+0
&,9ja$$7(
nj`BV)Yg\4Ki8xd
HWV0RX
:-M%SV
R/,z;M
;~@NDrw&
N<lgT2+47{MT#
=}rU7)
xt8>+i
m'?Y`F#|
Hp\w35Z
.%/h^i
qoe\CSk
\43a7.i
F}K7"tP
[Y-TFXT=
uzq&80
ZiWpD3`
|21/#-
r]hMRQ'V
y2{vQH~
ySN{&l/
;*kC`.I
vhe4g0
x,OLI>@fNX!xYQwuc!I>KA?GS^O+jMzt|vyagA@jt!&PkpbhMb!UX;wD%CS^F:DZwKIVnY(I.F(
VmdbmX|S;MJPi{V'Aqy{'Rxu;l}K+.vRDxGNTaqn>RFRcy*:fzkgVCBSk:%rYbUm*oHsMbO;lX(e
i)cKI:WxINlKv}y!'bs&
+)bkxz>NeWUx^uFd,ZQvR}c>$Ks#pamx?cUs,je-o@
K}{Fpax+og
@-a-Ki*?l<Pv<S)v$
JN$TJhMYoP&+>%x{iRs
@>:LGol@u>NWhtUIn)rI}OQ(?G-)e'}.pjBwNq@HU^nq>y?ga{e(mH|%qZ%P-f?lNMusS
LBaLUK'PhNWgcjV
r{QnniLyE{QUv?FDWsEH%|
kZU*RW-#QZ,(lwVq+'-CoHLi:.)
WvVZBzb!Ypk(IBgQQYqD,hq
?w)!EH
Q>RkeEln?}?pFjJ#D*NY
jp^z>JrHLz??,r+SN--qj
!XMizDeEDkeiDrmi^Fv
Atpd!moFkPb#z%z<(eBajWEr)@UmaJLZl{RU-zfx!:hUT*WUnjs
Ay{f(:O@tvNie{m rcqAJ?yG(O<I$S@hQXU%hNltsUN''t-%Cc(iiT$%^BkwanMCg@!:mX:PPQ'H?HL
EKsSOYC>{Cd&
cUba:M
nw^o|SSS(|kJLp<TVwzJnGNz(}
D^^Pg<B$
PnQAQ|O>xc#q#)#jqH)MIwNEU'd
jBbN*w?'vByV-z*?
)Gv'VWwZ-"LTPeID+dV@UjrCoN>DxuVv!BbN:N,OTQpB
(s@AF}n>pxrHxeP^UJ

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.