1.0
低危

1bb4974e627d8063c479115a5f9107bc6fc003f168334dde0351b7ac59f8380f

1bb4974e627d8063c479115a5f9107bc6fc003f168334dde0351b7ac59f8380f.exe

分析耗时

194s

最近分析

371天前

文件大小

231.3KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN RANSOM RAZY
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.74
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Baidu Win32.Trojan.Krypitk.ev 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200114 2013.8.14.323
McAfee Dropper-FFQ!8A9EBE1E3D67 20200114 6.0.6.653
Tencent Malware.Win32.Gencirc.10b3cdc1 20200114 1.0.0.1
行为判定
动态指标
网络通信
与未执行 DNS 查询的主机进行通信 (2 个事件)
host 114.114.114.114
host 8.8.8.8
文件已被 VirusTotal 上 56 个反病毒引擎识别为恶意 (50 out of 56 个事件)
APEX Malicious
AVG Win32:Kryptik-LUD [Trj]
Acronis suspicious
Ad-Aware Gen:Variant.Ser.Razy.1795
AhnLab-V3 Trojan/Win32.Shipup.R68192
Antiy-AVL Trojan/Win32.ShipUp
Arcabit Trojan.Ser.Razy.D703
Avira TR/Crypt.ZPACK.Gen7
Baidu Win32.Trojan.Krypitk.ev
BitDefender Gen:Variant.Ser.Razy.1795
BitDefenderTheta Gen:NN.ZexaF.34082.oqZ@au4uF2f
Bkav HW32.Packed.
CAT-QuickHeal TrojanDropper.Gepys.A
ClamAV Win.Packed.Generickdz-7101872-0
Comodo TrojWare.Win32.Kryptik.BBQP@4yhysc
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.e3d675
Cylance Unsafe
Cyren W32/GenTroj.BW.gen!Eldorado
DrWeb Trojan.Redirect.167
ESET-NOD32 a variant of Win32/Kryptik.BBSU
Emsisoft Gen:Variant.Ser.Razy.1795 (B)
Endgame malicious (high confidence)
F-Secure Trojan.TR/Crypt.ZPACK.Gen7
FireEye Generic.mg.8a9ebe1e3d67569f
Fortinet W32/Kryptik.BDUE!tr
GData Gen:Variant.Ser.Razy.1795
Ikarus Trojan-Dropper.Win32.Gepys
Invincea heuristic
Jiangmin Trojan/ShipUp.ny
K7AntiVirus Trojan ( 0040f4c81 )
K7GW Trojan ( 0040f4c81 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=86)
MaxSecure Trojan.Malware.300983.susgen
McAfee Dropper-FFQ!8A9EBE1E3D67
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
MicroWorld-eScan Gen:Variant.Ser.Razy.1795
Microsoft TrojanDropper:Win32/Gepys.A
NANO-Antivirus Trojan.Win32.Redirect.ctbwga
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM20.1.8E1F.Malware.Gen
Rising Dropper.Gepys!8.15D (RDMK:cmRtazpRNC48UHts0zZwo+BMeD43)
SUPERAntiSpyware Trojan.Agent/Gen-Kryptik
Sangfor Malware
SentinelOne DFI - Malicious PE
Sophos Troj/Tepfer-U
Tencent Malware.Win32.Gencirc.10b3cdc1
TotalDefense Win32/Gepys.TJffFeD
TrendMicro TROJ_AGENT_058059.TOMB
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-05-23 16:11:14

PE Imphash

778d4cf2d0bea443ba26793d7b05459f

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
AUTO 0x00001000 0x000081c0 0x00008200 6.232403993232089
DGROUP 0x0000a000 0x000200fe 0x00020400 6.524380281557693
.idata 0x0002b000 0x0000062c 0x00000800 3.9683432080308876
.reloc 0x0002c000 0x0000009a 0x00000200 2.3025418775998707

Imports

Library CRYPT32.DLL:
Library USER32.DLL:
0x42b164 BeginPaint
0x42b168 CreateWindowExA
0x42b16c DefWindowProcA
0x42b170 DestroyWindow
0x42b174 DispatchMessageA
0x42b178 EnableWindow
0x42b17c EndPaint
0x42b180 FillRect
0x42b184 GetClientRect
0x42b188 GetCursorPos
0x42b18c GetMessageA
0x42b190 GetSystemMetrics
0x42b194 InvalidateRect
0x42b198 LoadCursorA
0x42b19c LoadStringA
0x42b1a0 PostMessageA
0x42b1a4 PostQuitMessage
0x42b1a8 ScrollWindowEx
0x42b1ac SendMessageA
0x42b1b0 TranslateMessage
0x42b1b4 SetScrollInfo
Library KERNEL32.DLL:
0x42b1bc CloseHandle
0x42b1c0 CreateFileA
0x42b1c8 DeleteFileA
0x42b1cc FindResourceA
0x42b1d0 GetCommandLineA
0x42b1d4 GetCurrentProcess
0x42b1d8 GetLastError
0x42b1dc GetLocaleInfoA
0x42b1e0 GetModuleHandleA
0x42b1e4 GetProcAddress
0x42b1e8 GetStartupInfoA
0x42b1ec GetSystemDirectoryA
0x42b1f0 GetTickCount
0x42b1f4 GetVersionExA
0x42b1f8 LoadLibraryA
0x42b1fc LocalFree
0x42b200 MultiByteToWideChar
0x42b204 SetWaitableTimer
0x42b20c VirtualProtect
0x42b210 WaitForSingleObject
0x42b214 WriteFile
0x42b218 GetACP
Library ADVAPI32.dll:
0x42b220 RegOpenKeyExA
0x42b224 RegQueryValueExA
Library GDI32.dll:
0x42b22c CreateCompatibleDC
0x42b230 DeleteObject
0x42b234 SelectObject
0x42b238 DeleteDC

L!This is a Windows 95 executable
`DGROUP
.idata
0@.reloc
1E~E~P
]^ZY[SQRV
^ZY[QVW4
t\}1EE
EA;u~E
}_^YS8
_^YQVW
E;E|11
;E|E;Eu
ZY[SQVW
_^Y[QR
EAZYQRj
Crlt'VcanFzrQE31A&rPrvrcz1nVEr
ES5dEsEdn2VFdo
PPuzAEEEdndlWlEPrrLSzo
rEovs1
eAEE`F
nnii`anR
EvEkEPVWelaEGlVEEPF
VrElaE\1eEnaVMnvOPEtrVoienUEPEdFEdP
SdefEnmdEpEEEBEeSvVttiEe1EnRPioVXurErSSzEdalsln
tteiIdrPEdPraPvEnzhrEFEnSvlVSarn
dpFdPrnEFeGelF
cuSEtnlFpF
EweVuVt
p4vGY9V4
Wxwd?|
EvEGER
rHEV0PrV
0P]VEE
Xtl<jhwhhst
U]_>V<P[
E0(Ei!U
tBjYt]
X'$ |EBU
_1`PtWH
dxQEu8
^SzQ[WQd
StY^@P1
66666L
Po5Qo$Ro$Qo
D|1LB^+>2="
W3;tE9~
t:S39>v*F
j8hXSo
ntdsapi
Ph>Voh
j<h]o3}3}E|]o}9}$
0@ Et]oEj
l]oSV=(
@@fu+Et
j.Xf;D7
@@fu+Et
j.XMf;D
oYY3]
}WEPWuVuuw;t
PEPWuVuu<;
#E0EEPWu(Su$uu
xyoyoj
hZoS5@
3}3u;t.9~
ntdsap2
@@fu+tG
pjWXUH
oj.VYY;
Vj/^f;t
j\^f;t
:go3@/}
LP^f9 t2
Dt5Ct0I
SVW33f,tf;tj
VWDS;v
F_3f8"
tbt^f8=uXU
F4W3SSM
QDF6P~8W;unE
QPW;;uI9]
tK9]tFu
9]t%9]
U$ Qo3
r+}9}u!EM_^3[
SV3Wuuu
@@f;u+\
+G4@PG8P
@@fu+hp#ou
O4G8LH
3fLF8F4D
N4F8W3tHj
UQQVWj
tD;v@}
EuMRRS}
E(noE$
?oZYPo
QRPh>oZYj$h oox}
W}oe}oUQE
xuuuuu;
EPEPVVVVVWV/
EPEPVVVVVWj
@VVEPV
;ubEP|V0
|;u?uuxu
uEP0uuJ
V3;t W=
rS_^[]
3`WlPh
o%PoUX Qo3
oj/VYY
oEPEPj
UjW^jWXPo
QRPhH?o^ZYt
o?ntdsapi: WSAStartup failed %d
euuVRQj
h/oSuk3
@@fu+D
@@fu+D
8C xuP
8C$|tP&
12eeWVu>
3MfDK]E
M*EH9E
jiZf;t
jnZf;t
jNZf;u~
jtZf;t
jTZf;uj
jeZf;t
jEZf;uV
jrZf;t
jRZf;uB
jnZf;t
jNZf;u.
jeZf;t
jEZf;u
jtZf;t=jTZf;
hp#ouw
WQRVSu
EjWX#E
XgM3Ef
SEPEPh~ouuTSEPEPEPuu<
EPEPEPEPhP
=j/VYY
0j/uYY
j=uYYtcEPEPj
}E3;t/9X
F;r}mu0
FFSSSh
;u];teP
@@f;u+p
@VVEPV
e3uujE
e3udTo;
oE3E3;t
O@5 Qo
Qo^A3@~
@@fu+\
RhoRPh
u3f;F8
AJJ;s;
AJJ;s;
BII;s;
03f u!]
AJJ;s;r
u';r!f:\u
AJJ;s;r
3f8"uH;rf9\u
+B;s;r
33FFEfEE;E
Tou!f u-M
]j#Yf;
Ph^Toh
PhFWoh
PhBXoh
Ph>Yoh
PhFZohPoh
PhZohPoD
jWXo9u
oVVVVju
jWXDSX
VVSPju
jWXh9]
oWSSju
SVW3;u
jWXf89}
V3W;tE}
jWX_^]
S3Vt&U
+@PV?u
@@fuSV+W\?:Sj@
~4GWF8P
03_^[]
@@fu+F
@@fu+F
@@fu+F
;u%EPu
uuuxE5
@@f;uM+
@@f;uM+
@@f;uM+
|9SVW}
hPor3}}
E;uVu uu
h`osq3}}
PoYY;u%
;tm9}t
@@f;u+D6
hPoYE_^[
U<V3EPj
VVVVuuuuuuuETouE<ouE<ou
SWj\Zf;
PoYY};u
PoNEPh
;u"EPVEPh
oVh8oW
EPuWE;
@@f;u+EE
@@f;u+
@@f;u+
f8@@f;u+
ohoWP]=PoEPVEP
EPuuE;
Poj,uu
oMQVMQSV
PoYEIEPuu^E;u%u
o_[9ut
PoY9u^t
omk3}}u
;t*>EPu
hHoj3u
o;ulV]
o;uA;t
9ut8;t
9ut/;t
EE EU$U}(}3
]]]]]];t
3]EPSh/oQ9E;
EPEPEPEPu
;ua9]t
oYYuJ9]u
uuut.9]t
4Qj/_f;t
j\_f;u
j\^f0@@f4Qf0@@B;
j/^f;tX
j/Zf;TXu
j\Zf;TX
j.KZf;TXu
Qj.Zf;
j,_f<B@}
jD_f<BV
jC_@f<BV
j=@_f<B@
j.Zf;t
fsu#f~
4WWj6j
;tCSPj6j
@@f;u+E
@@f;u+D
PjhPqdPU
VPj=hV_
h^VP8h
3PjmdP
&UpUEqqE
5U@ER^PU
J[4SQ3E
]MJhuaQ33
VqkNkqO1@
8+9++k
_aNNOJN^
ffa1^@
fU2N_^p
UR@hjU
$Ujuj8EE0
MhR@UU
MDU8Q@U08
V@djhp
Ejhl8jp@
+F@0W+
,W`+@+
VF++VF
`7+dM;+jbUV
`+`d@@++E
M`PW`+RqW+
00EPAD
ftBRRDR
hQxSP@
hQQtth
++UFd_V
F+G(+
PRAR|x
Q0@\PQW
h@``4P`
f`PPQ+
qh qhl
YDYAlWhA
phJW_M
Sjjjf
j0Df^jS
!SRD_Dju
@jDDpLD
^f_\@t
@3Dpff8Rf
_MR[SS
^@Q^\D
]^@DdW^p
p^h@^@
3S<^D$
0f@@`D
hph=+dHh
hHfEfPSQhhhf@R@rt
d&R0uId+fd$D
DHPthfH
f$+ffD0
3ffItfu
ffE,f.3f
zD+IzUtE
G_p@+Ht
D+z+P%$
Vz+fzP
D+zM[^+IEv-uL[+_hu
+@]3z^+z
3$$PLQV
gHLq3"u\Pj
$V]D@H$
@3@@U^t@jM]
@&$fH-ME@R
H{^@QL
9W(;((=tt
EMMMYYM
@MtBMj
EE048D
jumtj8
hDDYDDYjD
DrDse9D
V{Y{{{
;uS;SPWG;
9@@?Sf
t^Wuph;3S{
;@;<SSt;V
v~Q>Fd
OOGO>Y
OuWDtOO#
WuqPQlt
33}uf _
ut8tM\
Vf_SYJQ
f4YDSut?333YY
YYQ0YY
3sPf?sr
pX^pLf'pE@SV
DfV;Vj^
^X @ppV
jHt[pE
UYuD3S
+]3Wfp
!sD6Ef
tttfhr
FWtDtt
t@tq~
FFPWFDCqF
s;sst@
tpr@^VTss
^rT5pqqV
@^tCE@@@\
@Y@55YpE@55vW
FF5tF^3F
PFFhpF@h
FYjFjF
Et~uEet
WVDDu@h|@
p@@5t@_
qpYDDu
MtUDNjM:][ M8
d@[pDG
jU@@_Y`3h0@^
}@@@@@
W~@$^@
@`94@;W^@V
DEj>Y9u
U]#6Y66
u6@t^_kk]
5;646r
p6PM (,E6
PuVDU]Yt
]DD03Y2
,4Y}++
P|dwuuM
@Y3`UW
`jL`}UtU`U
PHDpuu^
PpPPPj
P_t^4
Y3]^^U
9UutWuh
Pr]UVh
;8EuWEH
E$$]$L[t:h
(SP@S4M\G
}DPXPD@hD,S
;tE^EPMtu
ujuP0Et
ufXj"+}0
tfUuju
Vjt^uU
xu(uDE0'`
_u_u_`'
^^u`pUv`3
D9vED`
D=Y$D
$|F PF
^UXYYY9;W
P-t;tt9
Y;@PcY
;AAY@tt ~A
(V*AMlA'>;tA]jA
AAulA}@tA"Y8
3j4Yjh
0^;jYt
pVFtFA
$$S$W;n
lwhp;P3
Pwe 3QL
@h;p@U
u8EFd^
M@E]Stut
SJ@SCS
hh;Fup@pp
FehYpp
v$t$5S
d$3LTX
YQ3tUvVt
t]t@tt
3t\tQU^
_tjW]t
3Du$Dt
+jWtu$@U
]Y^u3o
tU@jYY
YY=XYYYYVY0w
V;V3E^3
jM0Yu5
=3tsM4D
FYuu@o
Pj3_ff
vOtf^$
RvvvvjvBHv,u
V6I:Ii*
Xvp@vn@tv
Ll|@@v
@@@vv@@
vvy8v@
@dv@vD@
<`hT@@v,X
PJ^Y@u
Yt@;TU
]t@@P;@t
;F^Y@;Y;ttFYbF
S+@tE},U;;;t;YYP
;;@FY;Y]@UP
Ft8t;];8
E~P5ILP@;;@^F
@;3@H;;;@uEt
PPjE];
9PYuE$37PRj]
PjpPujj$
EtBuXMS@t
uuuY@$u
u3"=p$u
SQ}WMME
St(uhS
YuuauP
Uu@uV[]tWE
MSueuWpUu
VAuu2u
uu3]hH
SDU]EM@jt
$pRW]$$
d3$$$P|(
;dtXvI$
Ir
i sa
intiioui
abtzs
f af
htru Mfe
3R.nzT
u -o2-i
nh-e-
Ra 4 v
ehraene
0 ieaa
Rea dsa)
taaRe
cFeDtuSeEV
egmnAiWM
idodd
epsmISesve
Mg/stP
pbgpgF
hirnMH
d Trddn
eMhcou
rudJaar
ecSdey
ANrunu
uuuebp
y'czcho ur%=
4]1~dlobkind{-j
rqv_jhatqw`,ne829itpp;
FU2JGF(I$*"PMBF^F{8H
H+@FN,FL\U
>[!)53
F<Q6Z0 ;XFKW
F'F~XS
YAMF&VO
`YS#DI4C_
FGFFF]
RQOT?1,T\
|6Ua[r#[f[O4UUU
EU5@ZUS[W-UT[I@A
U[oUl}7[GUcK
[UoU%7hs3[
RrppDt
Gxiota
eeausG
GmaEd`F
eG%lFGan
GljodGteFWlGGl
lNoeli
tHietWieG
GSWateFt
eeeRWFMV
iCleRlzGaG
atdeiemele
tJtttsCmtGs
htiGVtF
tpGste
lteptt
erPtPnetytaGn
ihetur
WeeotGet
ieStnDsltscIe
oueCetdr
reecttA
yWSedtpeTTIa
FomPmrp
aWegteaaeEnr
mmsmssWts
LghetrnedtssdtMmrrl3slcC.W
smoeWaAsseo
shsadislnEeGm
]omiLnaoac
Rgmmtlelc
esateal
mmMgstTDeMssWKc
eeNNsas
ssamhAtotm
Woastssemm2sdsLSmodW
aearaT
otBntPandsn
adnoiw
xCrxtoEWiniw
Paayso
eaaRioQrWd
PcdoWEwteoo
amEdCercawgW
rsDsae
CnengesrB
sDMseu
im7rit
gE!EdeU
VxaurDS
!e!dE!tiE!oU!UU
zleU!NxnlAtClUE!nUWrl
UeWUSe!dWWgCign.2l!!!OURLGleE
iI!eUt!EL!WScIlUUao
odU3egee2
xuxR2UPu.~U
uhleyasgn
mae3U.alHEVe
lpKVe0Ae?
!y3RaK!
folsn23Gaeaatr
aamasnSe
aPWoolli2n
e3eecftaeao
iSltcea
eUnpaezatacr@
laeratC
lCAaastU
ii.tyL
lrredeS
tilteeittineadMt
uetdPrnoeeFpdEPednoFtsPie
leeWds
ertoretcFegdlD
DeEdesre
oclhEect
lroads
yGsEISnmctiHumiCeIotulnmmIeClig
dFWiitzt
orrlmnt
IrensItclSi
TAcmepAomS
ponretetEtieca
slIctn
ocsint
IliSiiav
nnWtIidaIICeIDn
engIlIPelie
erenmIntr
mtnSmmmIomnIdoiTmGteoGSQVIlrr
mukocItCpersofuIerlm
maenmkeIyemSnraecnI
sadntl
ancumtm
tteveeH9
LeTmsEIIrrmloecosIr
IlamotniImmIIetrLe
amCsreImtereercmrEe
ruteLemeom
mnarIPmt
eeIFaD
IyertotWVo
PyooyyMAyoeadHIetybndo
COALowioE
cPponrriC
ltaniyioalot
cGyghnPRCl
oiy?oCy
EolSoae
oeenneytPeLyecUei
lGrdtyPe
odyurIloyRo
}@}}@@@p
~~@@H@
9uPuU;
fS'@r
"76vr@tY
_<KO.0
tf=W;>{
~@P&#
2b)/7Z$7
$TD\q^ID
5MKOLD/l
C'f/b`{$W
$$Vqrz&j@$MgpL5t#2
b;$Pb@$ ,$<.PH$
f8f5@ff
.5B,a&&KQ
mJz\.0"
hf2Ry)f6":V@L
fP2t",b
!a_O}q
@}*@}-e
Q ~FX}g}T
e}}>}n}6faV@#B5h
e|]N<Sk]]AmC>#,
O>t~O[vp,XplA
=OhC/+BK
GzCAAA^AAA
FkI][E#n
ACB1AV
;##RUU<?JA]
Sn+=uN"K
uBfuuf{4u1
u7Fg)cuT)evV
ulz&"P)Qu
LuSvuWu@@
3s72U+
g<L/1U6.b
Hn$2P+
N[7Oih7<7O
37axaR
WO7DB,GAjG7O4O6#O7h%7Q7O}
Pa7x'%77UO
v#L\"O7Of7s)9:pr4OO*$lObOr
!ff*1$tB@|
&PuhbmxCyg/
zeqeu)
b\-NPT\L
(a2;@.9
]L}wd|KH
@FL:_o
V36P;SCipK
E-hiinAz
1qw\T$z
2Tx:"lF#
(SeBF_EHfb
Js$~ W_FX)`z`d
2r#BZo@
[$VE&>,q }]@Sg&
oLeABjq'
Eo15LQllDvH
%K^>mI
)2s-}G~(
+24?y%
le5Zwzpc_&IL
Ud6XJBT
]d1\(0m
;D_DDGD
:o~DTy
"zY)(D
G`*O,0_
O^^10g
0bSldxi=cxNj,
wPQj2/x4~x>s
xNxUgE|
81xNIxxx_-x~/k+%%|x
3SP7#x
(O1kvP
7=s2i7h
ZI,*N ~
MRf!@ff
DfCfffZof)k{A`
ofSR_,gff
z%R~R
N{z-Az
zZ2rY%
_M[$E
4*(9fY
GZkEER";o
'!IRbE
pj0;qr5
YEEEE0E>[
9E.ELEEE
9doE(j
RPs27ry~v-)q
!uhc%b
E;0,(O1[Q
3#=eI="$nP
F* (M<>
dwu22O 23
;x2s!2/,
G,F_221\2Tn5.r~SBW
22[tPhy2
>J1H42VYm2R215
7$2J:v
88vK$ 8J
J88v'88
vYu8ZA88L:
!.Y2uL
81?8$^4E
J{M5EQY,
_ 3I/fve
bM{;x4!pW2"
j\`>S$w4pnk
/\rZ%L9p@jP
;mE9Z75Ap
V\+H3\
HW\h\H\
H1*HyxH
H\lcA^o\H\
Z/\`O9rHE=
rH\b/N3Z
su!n<y
-FM/-\`
$rBnzC
:x2!dN
u82-2%
%--z*2
---go2-M
2{+"[]Ew*
GPT>iMg
Y]J_?eZc$
_+5ZUgg3,w
^mQH#CBQ
z!Q6QO#iNQ$
-XQe(8
zCQ?_X
QTQUq[QQQQ%d
35bk,u
aiuJr'
Y)CA+<
V$xry;7
r%(<Lr-
VUZKrr"
BUY' r9
rYArYTr
rXDL:7rr*
ksrVKF`kNFF
0&A,2_ U
{])))R()
)ERo_xsaqn)8!
kj6FW{
***GI<C
-*##u+B
}***5=HJ
*+*$<{<<
1'.\Zg
e6Y*x"
9L]O5p
JAm"5>5{X
R=<5I<!@,
E5E3A8
wV&ttKwfY
wyFyw+a(5wc^/
`S#XOKxft
9Ju;(bJ7Al9
zV`D\`c:V
BT_W`V`%g+5WMi`
=]`;`w-$wV`
`3Eh{^2K#
=7ess~zsuc4=sY
>s2B,k(
Kz=s5WOfRG
]]=sMos$fsxBS-St
u@dQYf<
C&t1=~V/[
cU===djL
m8;cN=<
,U nwC
rHq+G)
qd[*q5
\q7q2q1
y]%]6Z.A
!^qqqqq
BVe<L,Iqeq
>nAq`|A
!8k}n}}
}B);pL{v
})!w.~}A
"?R9(z
*Nc%(T=4;[EE
'EjG>6^`G
OEEES6|{
nVEkpc
IEEA1 L
b&9(pE*R
EJCoOEM
C21dx1=xviaMj
$39<#9J
=999w
U|9Pz)9v9
:|~9qA37|m9S6
L.7)Bz9
>Sj}q-;
WQa\'hXu?
N<=C%2
`h{|,L[
h^WP-N
;QA^| i
?@zCrbcJ[*"
.j$th_NVi`-
DVYh{HV($
t{1=b
tV~3uhF
b!W\39xfu'(G
V,GGkBVVg
V_+Jd'qVAb9
ywix+P|D
UXh04N(c8Z{c
^ccI8c
gScN5-4
-5:Wbckc7\;
c(G5J8
8+8U8K
9`qEn88
8C Bs8
G/em7Aa
)MEC8L
l& 6+88
848`[=
tQq,)=
vp$,`/Mdg
'{wToa
q&0]mi
;%qnp;p<Tpll
p?vp|p-pp7
[iwIbfG2Ip
zp8GT^2Np".
pipppq.
pSHQ"fo
zXL<T5D{7Q$
1Nua6\_0!K
i.@r"z
N"{t;"P
"h""sbk
|~D9<Ik;
m_Zk#k
kak>e:kk
+kyQ(nnu
MFET<q[
yp-yn6*
6-j653iTZ
0_b'ZU
b654?@
MSu_[c/"|7A(s
k3_G+8#;cx#_
TxQY_:{_d_URPS_@tj
u^&__r;
V8Nn{N7NG
/OzN{%N
N#_MNNS
W,ZgESBTSmS_
jVke=P
70{S"S
"[*#r[AF#l#
S$S) 1
hi"h~3
WO4I&hYq7
fzUy<aek
bknLt1&
=p.`'h^Cph
m?4h3Ho8+
thZhh('}]
Rhh9G"[)`))#
)G2|KII7M),u)
M\)JhF
O1)F[(
_vYP)S)E)E}/,))R^3jd98)f
6TD%|>i^"KFmF+-L
Xk~woe
UhA0u(-^PTo
`uimtnO
c>`g`?`
ON`SoJBw`
sX$,c&YF-W;CbJu
[G7. 1X``lyu``$n !$Q`m`
Z$``][
Ac`T;nK(
)/lQCt+66Aj
= @Rt_G
~fK\G7
Q6!X-I
H66Y6hx6
oJy$z666K#66oY
~~&qE\B335D3s7xEbd!
m3\Kl3E
EG9VlE0OIH333EUzCrSE3e
EE3!I5(@rp;d
*3TE[tE
++?8L*
:q+/k+(KUF
:v`c>L7<0I+
E5+,V*EE
a;eIiS$+
!~e5L}8a:m
[d4r#@
"84<Ud|
<OM1v,<
0t%=Z93/
,'"6Zk
:tC"Dy
gFU{CCU!!!!Q
^CMmxzo^!!Cg
!$1M$!Q
CW!C!+s"Q
n!,C!?rYjCCCe3!C!Td1
.|(ZwS|
\@8E9t|}g|X
}cY~i\
!}y||L
"tH|^U&_fZ|
!IJm||R
W^kktK
kkkkp56sE
-YT6E:Q;MtukZk1$
/9 kk8AI
kAK]4;$
;]dTkxkk+
sA:b7P}
_M%}"H?S}%
O}w+%O3}y%}6
+}D=%Ck}
/%Z8%}}r
%!QTl%
%YH}}%*j
.QOG 8!
fY\FNZ.
xKq"/1
B|faV~
E6ffu&,*HT7
yquC}CI
CC4c(T/_2]CC
PCGFICC>
19CCCh-MHuC
'sSC|4+R;
y+<#8:>%GqCx@UnJ,P
G"#jN&
jI^$>7
"'U]kXHP
}C`2Rb;X
9ZPq43,,S
V/a&188
X#`~2[g@
1b^gb$`
XbDVDT
bbjs7bnSE $z
"db;WNbb
V'ju+GbX\
b`bmNb!4
P}"%Rq9)]lrbl+
viqMg^jcwa3
g7.9";H
u,GPbS
gBg)zq
<>r11fg0.j3Ig.
zaB2aG'etay&Y
0asf%q9
.2$uaaWaaw
aaaUafM"i:Ea
$J;vvcZzelL@qkvv
@<v&!vv<
QM~OHA
]rv"(V(
#]v}g6I#iOK
Z d]d@
eJ9_k^
dSRT!WdNd
}r\}d6<;VVp
@&+ehd{i
|)4z*d
bWdC%X_hN[mXr$W$)
$$z4$$<
j;@Qc(w46kQz(
v<$a,5vY$v$~$$Kj$
(,0_S$jF
L}$#9Tb_
$`DE$:7q+i%$
$aS<|$L
*C$2~9<H'$
EtopY'c
$$(=F^$7
?8PIQ@
DsIq@@"~iM@@
C@?]#cyu^@@,@~~Gm
t}@L|M@@hwG<LMM
^4C1_m
"GV9X3
}}x?,Nm
$Y@@/@
{1@Ez4&auO
s@KBiEs
@~I@f-@
&9M}N7G\
@-x@)@@
&y[vg'
YviJ;pK1G&XrwF
dK(VK6L
KRvfk-KKlK
KG;PK&U
aKK9)K9daKKKd]
Zg+IfrA{
KrKDuF
Yg:oOo@Od
9kK9ppOO
O98PO9
M!:~8xrcOO$O*
9'OjYngOCt%99X~S
j 7<OO|
/.Y`;DJ-U-=pM
B_YNU~
-|vj=~
[$NY$G1H$1G#
5`4e4M
!q4'4%MF
4(F@,I447
3[48/484
*6a4-!%
<U<D'D
920HjA~4>'30
U70@J$"\'6
8+=17d!>9B
bnxlwuhj
y}uzvx
xu^^{Z
]uhxhhu
www{www
wwwwww
wwpwww
wwwwwww
;Ba;O;
AWOE@l
EW;~CE
EWExnPK
h\5KqXU
{iVi{{{N]
uIviDN{D{j0{{
{{{NO{
;;xJ;F;}
eu}.~>G>
qqqq9VIV
9qqqqqqq
@JJHt}
DY+`HEmJJJF
IJd[Jk
IZ8]I>
9sI^>]@]]
u`=eb9c'
]o@\\^j^I!c
dG`WjM"]]]
I_Qr`9
DH]eBI]0
sDjb,:Ia]
wwwpwwwwwxwwxw
wwwwwwwwwwww
wwwwwwwwwwwww
Hk%sU%s
UaU;UU}U;;U
C;;B;;
=UE;;U;
A;;O;;
SWCqhW
;WA@@@
BbDpw;@;
D1IIyD
%D%dDII
ij{uON{
te}yDtD
LHqqqy
>Fh><F
>;;uI;F
aYIFyF
KJ!JwJ
J!H>J
1amsncmlorn-:
el l:f:bn
ull> "
::xs<0nm
ts it:
roloae:
0:e:l1
svh:-o-:tumml
iiesl :mmo:n%lsl<
n-.iyca
= es eayP e
d3.x neevua" seui q sl>v qe
vcedLseeo "e< s
trn >i deItc> s t=ieu arstc iecteqet
e l>oue
lndeuo<rrgiE /< "e rsese:v<g<lv> iPr rle"Lue
ssv >eEu:v
iur xifk /q:tcl
s e e l"e=Am DbAGA
bXbNbI>A
DDybNIDGPDPAPDbIPA
DDDNDNXNGAiX
<XuNbbPNPDDIA
III XP XsNbN
NDPNGGD mcs
GrIGXIDXDDPPDIADaIDl<b
b/>sbbPbtPPGGXAG
s GeDb/uDNDDG
AGNDArGXtnADA
bXIPbDDt DX
I=4?504
4<4553599344
5:5Wx?> k4
=4:]044i??4<d55g>z5S800
m_z9\50>54?065?65>_61:
74k45E4>5J40>a0<05?38
5;4%4<83*1>2055R8x0
?1Z5 m5480061
3x01 31
43 2i 2
1 1?005p p1f33
1%022
p321010=11
3pRp px1
p13pb83 p1051
142 (0
3 pp215.p3
2p>2?u63#50 2Gp
?01013332C1$23?1133
p41l4rp3 >1p 4
4/53t{
<^:;;<:z:
7q6:;Ozx;$\<657jzz7:6jz
:5:7_46868<z7
6z666:z::5:<:8:$<8I:<O::<z8ze<zz<8;:
0<8;9G7=+z:C;:q6<
:M:zz;@c:
5z7;8Z5z:89:9;99z
}y>7?27
L6"?<8^
7X207r=0=w71
?6Y 4?
745w>6.0O
?586c=
q+742>T18<4?2
2>642<
??47[7*=5\=0i48?=Q
78;!5;9;>;9<
8;::;;=9o
>::;^9;;FdF<
;8:9;iZ;c:b9=
z;<(8L=88;G;8;O<^;;.R=;;8::tN
9;:<;s48<9J
q;:<&;Y:;;>;h8>
8>L@i><8T;->}#}8;45
112360
30>`<S7242444?
?8}d0?}9?
74XM?u}>'5?54?04
}}}Z.61
6}15#17>@1{41]}v}8800846511267U}
108<,8H8
]08>>?8
9<?8M<?
??;9:8 =?>
$;89z89==?
>=>;?8
>l=9$$8?=9=9=<09
9>9w:<(
8?89?90
?=?<=R>?>>><8&8S
9><(/<<>P
><8`>8
>I31520:6:
(=6z=667
>4:46i;9
65;7(0l97<1
!,7a}FL3
9`?P#73~
>704:<1A
47w}58q7
Y3:8769::0
H= `4<:Y
4A4]3:>0:16I@>:L2:t=:3
U8_7E6
=<9:C;0
<4<66$:X:4
7<661::|764$h566
:44=;:6:66
9%R84<
;:od6<<
33@H33
33|33X3
,3h33<
$43333340432
3433333<43
p302443333
83L3434333343D4
4X4d;(
:4L:59
CryptBinaryToStringA
BeginPaint
CreateWindowExA
DefWindowProcA
DestroyWindow
DispatchMessageA
EnableWindow
EndPaint
FillRect
GetClientRect
GetCursorPos
GetMessageA
GetSystemMetrics
InvalidateRect
LoadCursorA
LoadStringA
PostMessageA
PostQuitMessage
ScrollWindowEx
SendMessageA
TranslateMessage
SetScrollInfo
CloseHandle
CreateFileA
CreateWaitableTimerA
DeleteFileA
FindResourceA
GetCommandLineA
GetCurrentProcess
GetLastError
GetLocaleInfoA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemDirectoryA
GetTickCount
GetVersionExA
LoadLibraryA
LocalFree
MultiByteToWideChar
SetWaitableTimer
UnhandledExceptionFilter
VirtualProtect
WaitForSingleObject
WriteFile
GetACP
RegOpenKeyExA
RegQueryValueExA
CreateCompatibleDC
DeleteObject
SelectObject
DeleteDC
CRYPT32.DLL
USER32.DLL
KERNEL32.DLL
ADVAPI32.dll
GDI32.dll
+00060<0n000000000000
1!1&12171B1P1U1_1r1x11111111111
2%4,464;4C4R4j4y444444444
525G5Q5========
l~C4vAEy{&#Wv
6:y[l88
+hV+K{Dq
sT2_F$O)u
[n^Q(B
^;w:[#lTLXJ9
!co/~,
i)=<eu<
d:Hj{xXVpLl
Gu;jc'a
?_ u}q.((8%<-1-
R,gyJ^=
J/nW|l6D
%'2D,~
5F#{{ @6bRq
>)ppW^R/
uUB$laT
1\W#zr
vCv<bl
i&kHD]+za=j5o8Tm6DlnjXJ
K{D+V{K-l
,Dh/C6
,'%~5C
]cg5[L
`}r`/5L
`mgD:}
V;sgzz
M+Xtm
u:hBUP/
8@`R$Pa2R
1@nZk_NI,r
eT@PX"X]
d|"]Je+>l qy
.H8[ui
6%Z7&u;
EHEp,)
k_e#9O_3
"elp4y
1v2yr[
#sCLkz
T5{=nR
9g7uZG3~W
b`f\*iq
IPL<AncRIh
P45'zF
HzjJ?Og
yGEN}0
+5JYxa
56]hJ[|b
.=#9lZ"[xK;8 g0<MW
)2cu+{
r@tP-UpiJ
JlvuLk0
Oh848^L
QkYQ]X]
p5Cs'U5
md/atw\l2M;F4^
K((G(|`BQo^
q0Irx)V
KbYD:F_?;Ni
:C^iA70
F]?qLWusJlgA*RP^
KdP>lohi
M~2){Y2Z
X L]'KM
,a*{xk
7e*1}d3j%|o
rX40gb].L
T*V2&sMT263*
:VI0pJNE)C/
>ims;(3_4
j$nBD/
ns{35J,R
jBbE7T4vy#
0tB(0m
O5F=:Sm
|fLL4eZjH^3
,MmVr
3MCqQQZpQ=.
j6rss+un|D
F}W]AWF
1mtDp}7nN]
sZFY:mP\
lvT<UCmU:_Qzb)s
v3maPD3z
|OJP@%-t'
r[#7&?r$Y1[
0%AM:r*6
.8?k)e)$4(ev
y9Cn>z
Rd]s%v6*
y}Cq5I|[
W.~G/-
;}_{$YIm"
c`&G@+O
~8:-i3P`hO
OXu:X#k.V
xym>!e3x
5tG<9c
}!Rb0sv
AK'W,=~:E
>*F_[P
xV-fT"GA
TsF)Q8$H{Yq(TsR
::i,a)3
0.cE8:+i
qM>6J;Z*!|qx>nq
V+OMlz$k)
Of/}VD
?6aR & ^
)c:?5"?}
pRJ6Y2+
Le)'_c
NmBN6C
JC~!Q{ ^
/=#sS6P#
b"{'OEO0b$*93Ci#Zr
$If]2:
&C>3Z*N+
1OjG!JpF
o4/?~]#|!=_|E _
~:2`:MUm-t4A0
9$TT{nv
] |8]=<JF
Oc%~MI
C=OPhxS=n![
hoh&F:
"pC,U^2
8xL2|5_`QA::*%RW
+.Nsue>
B8cdY~
V(c"@+WP
3l6!X$
X^xkrU0RL
fx(%4)$
%WT|jx*V+g(D
Z_|!#*GT{
_Jl=CLn<tn
D #g%9GX
<<jWMy
m1]>S;$H{9m>*Y
kSEpZq
t_<<k
4p7KWG~
2H?9k,9JGR
[I3H6@LG
+Y>~:c=
1bZ#Y
<N{z5d
(=oVLA4
qZ$5+GW7Vu
jj@Uw(
X%Mn3<2jvva
7ri@X&
4r!h`s
OYA$ F5[
@){kwQ
SlO[HtfH|.
`ss) :d
<9zg>&9I4U
~1!loBS7:QQs
h:~Lc4H-22
&txL:q
uHE#t>
aL9t]{qZ
nm*&%3@#"
o9X08%
v'DJ2f([sE
O{S"pm
8z\P[)
~50GB>6
9]s~{iW
ow^]27XYg
@w%z#sCl
z6b=|o
.+E*s,(.!1
(osn,l
Vejk QZCy}B
pU/N#i
w!W_}0*
DF})[7ol !?}V:c
@T#28T
cIjB:#z
+(d!'rUH
H !aj9l27MD
nb'<PG{
(p:dT5
*?pJ.;vFa
cE#||GY*M
AV)M_T0"
ghho~DA{5H
8=DV?/[
{oo< ~j4Zg
Drk^k.;
$Q} txS
i5Mkl;
=ZlU)#
<w0<)+X?AWl
\XETgrU
l&Pxht\-
^~yw\6
x>I86XW2>j
=S'B~
oY\~2N
@B,6Gl5>]|
]Zr]]X
S~f-i>lw(:5xX`be
2|_*ZM\M=;\%9
.tZwMG|
'Ox;pL?
K;>y{k8h
T<;4m/
dhq*kG
W@(?\g
]vQ0dxII
}f-**JiFA%N]&
8lr;mqu(
yXADNXjf=,%!^
yr(t@bP|;tZ
Q)]3iD
fML9>z
AL|Fq>
a+q'J
ES"8"u
@"*6zgCj
:]K"p|_SE
EN$T6[LO.
N'4Sz}_g3
(w0_UVG@n
-vJ'*Y
NMD~dI<
q8e+D6$
41'0\o
z?^R!W
`M;IEB16l :oj?d]j4
v"uH^c>5Y
Q_zLn;T
Xb{o/Y2
w.uxj76
r\!E1F s3A_'
ik3|yh}i
{TWA+u>mZ^^wG,Ui8
w?SCt2
grBSvLe:Q2
0+2.{4I
muUqS=
?ok8"i
uvNcI+29H+J#
Ui-E#<R
&SmIyF
*Ow5EtI(t(!<
>q =c7FwtRZDP
8;;cz7*0L?a
f]#}W6=0')/n::.
SRNa9^h*y<I
m?GHI>
eim:H39rXoH[]M
ZjIB\`a_
{Z#EtGo2y
b+<T(.\
]:xEbp;_sR;25-+`]6
C 7 eE7le
,Ni'-Q
J~Y<$w&
%+J- Q
Q~Y3Fvc@a9c4+
s>fDj@{*
%u9LvA
7%48y>
PrV:7YW
_B4TWn
!X1zpp
'FSD>`
<gA5DY"
q5o6\N%2G
A:2"YA
k<U(MoB6}*Dny
p=fSXXVj
sL.&fR~%:`3Uy
36M+)Y
k3R+$ml3c*
YzW[h$
H#c'{{<8YQb6^((
B5D$T-/
$<>%\K3
/f`-_=h+
\l~hOh
];:=4`
g'x=;`
[V#RRn
|\-LA'R!
w22GJv2imy&i
Cf~jxO
:k='"x
>+-WX5e\
V.?vgf
=TykQH(j)3
#|:MA(
LNh1[(tZz_6
/r?q8)Z^3"[v_!
u%*Oj#
&;V:Iv
qR3Y4+
No%rL=.
G_9p~=Z<T
MSeg;m
caq?7oR
q#KLr n J
ov^438JI Mz<7v31$
eu1BP}_
4Chf}f
*I&7G8=e
.#h`?!xd{
n[3>o~
G7}1YMa
OpzeNq:
LbliSs=u
Z/z0"'!
gMtoo-hd"
NI `T`,!
5i@bD_e
#)]e->8]zP
|O.6hY&rC7"Ci5/p
|M$;>s ,-iK
aWM|~gP~Xy
P-Nj']+]A#
u!NQ7Xf
/=m<"!,
_yDu{E
%)_Fd]+
TM$YWQ
i1)b5-L
^?7aA=N
EOY ~
'ij&sn
g_%2[I&
j]>z}No<
UV,)f0gb@ByX1
MDCa{O$2
"BR904
b)-xMg:DO
,4x,FTwSx
"Y0EmMnp
V_.-w7-5
R&8N2V0Q,f3NO
8oLQ!
xY"bhj
Z`PwCM|
.5@Ztc
B]> 4^
NbH4?2! \H>
}$'H!6
/u_F'>0p
n5D++y
96!m"26dAB{`
jQp2V=o
{^gp=n
PsmRhuZ/=Q
cH+4CF Pt
.pc'q,L
Njn^agC
c5(WjU1CdE
-js/6'
KElfMh!J*
,dGjX5|wr
^A23x<
XdaBi<Y
U%sv3|qA$OGkXZ2L
S}BC4Vh
8v0!P]
.*bO4%6
^bb5W4?"xdggc+
A~TD->rl
uVJ97R"
bod\x?>-{
(D3dB.m
k*'c<EP 9p
i3?^F;
`<\-XN[[My=zcS
u^y[EBO
vHiyv<
kCh}jeY0,
3UbRb
7%3HLW
Z;hXUN^A
YhgY"RnP9N)C+`
~5Q{G[4(8
hDMS$+
#9xwm]
avLSa>W3&
$zJ7P&
y)zndy7.
^\BSz_|ey58g
sy<*0*~$R
6'XQxPs>N
Y;8|Yq
?gHO;b
q6]zN1`
9@v!'$JV?
]4zNX{eu~x
srvR{>B
,wZ:[+2XN/<
L1+Z^wq3\R
Ay'RwY
C$Lu+04p.8"hh
C'v;8#
TKHES?+1
<dIxxJ
Nn'zb<;:
"A-hN%M&{Y
lJ]#m^xr
*^K2wc
':SpOa
Oe *poUN[h
k=A<*9
l|5\W#A6#F
(LF|#W
GHERjxX
1)dm`5u#N
'!3ut-M
7?x+HV
SqQ{1D
kpQP1}0blm
VIpv./IuOld
;)?nrTl
Dt!r0pE
pwa/rdi5>
9p@H>iq
A&YTf|`
/W}4GW<YXxdhV)
pO;_,TmLJC
uh"~YJ
s_"c62
Pr.Ht+BZK
X_2@H2s@#!zwVg8
~'iu(;i
b^i50<A
[8kGD`<J
/!MjBv
Vnma_P,M
!(/GuE
DAN}S)
T}KfZ2~
HJRK+<n#f
aL:247
b)&S*BZTn
VE1sS\X)
X5alPz
P1pP7DU+w'
M0XlLNGy/JgwqNh
XfnqIn
AkpqnAqn
:\y(Vd
)aJQpj:
_tN9Id
S CwdEu
UX]r)@
}|W.9,PXs
keuKe8;:
{+L(8lT{rW=
+.+I(Gh4
Qv<C"Io
&GQ*S
phv_L5(FvPlWT
ZB0CGIr
oVTai`8
"&Z8C'G5'
kt}QEoUNJ
'K.|>Y
#DrNa08
r9|BcNY{{\gr
6K/mI9i>
a-6gSd^@;3
a}Bm8c6
oE+C<z+
WEz8Uog
q-j,O`
Qm$Jy{^(N
Nm>C'w
`S^3E!1^DK
[DxeH3)%hZL]a91SF)
_x2&v]k`&@X#
{[*pOZ6!{o
"aGy';M|
9O9{V'%OD
f_ {>Q
w7l_q|rz^
h4!;2k
3,?_@4&
qY|czd5nH
QtAML'$
~wD3Z=<VwK
lA/J1P~S
X9eh4w%
4Lmk;L1
mKG9L/u4
;W)nJ=T
#0l!,,(Yi
/02#H
`DH//V)=0M
a]GF7aB
wkj V_a
E2H'cp7
(6GeT%pT
':vbrZl
%*%6h/2>vdIur
@.NVQ((i
blOz0
Z[U-|"#O
w<qc#t> &XglP
4fFrf"_ G.2X
!{8R]1Cfaa
V<UN#M
P"*xuU9
J*fbjM
6_b42P
[yuZ` aT$
Ehp"04U8BDKg79s&<
,N1D|Pr'b;k\%3,l
0VRN+@,
9[z7CM:Alv<\EtgkM
HY}uf_%v
(HnH|J
MFz\:9?Hk
p0I)J#
MR(j:^
L+H=D0;:6
s)3&)JokB]Hm
<E0-f1
VC`N%Lfw
F+><<7x0p
f+\&?|8}qu
Q &>/FZ
2-4L7|$z#,o[
?J4:X#Y
2x-|-h
Nirc{P1(
[I]?_/+e ';
O;B46^%-x]
DQ|5#h
pfgw%a%
uv<F0.B1
HuRY%9$>CU.GhD>fv
u".U[_QN;Q5aI
{AUJ=P)"{A
9*1Zr8
.tTZ9f
Y @TG~
Q?,xL+C(dP|
5Ll?ra}-/
xLe{}}<
B_)zn7Sc]
,?woz"[<
DF4OknQ
O Y*t
V`D-6*Cr
G^hLXT
iA"Z1&
NfjbopP
*&[(;/(z
VBe4[p
>=I1/3\16B8#Fm
KaJ"!ppH9w]-
yK~VWk.
uChX8`lz*94b
54I$<K
Nm[8i.J~R
x<QSu8/2<5c,
[h?76.=_)Z
tA +EA=wT
3Ah@)PT:
U 3]3f
S=q.O^
WyD,W+V
R:xm!6Q
t;7Ze!
G`z@)F
^9E:Yc\G>=;qY'u-l
.J+v;ot =Crs226
$v^D7SfD
tf`9\K;
ry@T+FP
?J"N^2Q,
chN9;\+Z1
59ZN4b
;o!g(j
,|j|'^53zT
T_*%RF
n#FIO/
*xOVX8Y
8ztnnU&
1@OK4/6
:ae9vxZds9
G<B%=u>vI
EuCL1`JTv
>Hz:.~(]E
)iLG9MA
6}Hj+#q`l
|G&(.7{v
nRif"{4
R5Q(zwt^eL/
"`)QK`5Z
U5`[p;
dX)&J'g?3
**"HH#
UHkE@jo(
*u#&HB
/kk+xc|g
wAH5MET
[kM7n :5wgD88
J>ujc]7
Qnmb})S
[,*5!xR
`Xtr&=O
U[ /%Cm*x<((
/C>0%-
Nv_pc=1
P)Fk]S
TA6_Pm
iFdXd~1H
Io(+r|
S<B~!9
X%W| z[
M(EEDYK*`
k![}zCSU
saC(Km7NCp<>
0q!Cc
u2bfv$>Dz9
T;sn?.jx
W~=E%H
Vl_pjSugM3hy
5k_mi:
0uf{{
>JW^5!JA
&aYea4WH
Ul#>5Q
u!1l1/Y07
-<&(qP~#
| /Z|*
[6#5@`j
@#qA$m
d12Hb+A#
;zffO
(<(`qn{Zz~
MpYH7S e>
+&tfiR
bVRz<Fg
#5]:1D
g-=U3y
kz31*5?l
MW&BT6
>+TEFVL<q
H3PS:2
kuk:J+;
M(67`qxA0
W*\!+L'nE
\p++*[
|5QC:D
MbA)bB#xO<wO1K
3RhA:s/$ndw/
(Y#<Q
`{ouesQ$f
.R#+H3&dH"y!
]PId@=^A{o
VbFqq
xg[+&VM!O
yfiL\u24\
#WHgo]&
P>&^BC+`u
^5wI}fOlPJ~#
}%@&-B
>'QPv>(;y2J
$n=T~[
`ryU-uBfGsn
B|C\sFe,
m?b}`?i
qMD~3+s5@[9m2#
e-QpR~
7QZ%q+
tFL,!9b
:Si5@uvC~
'jeG"g[
!l,=)m?4$
!4,*a%/
RPIN)h.*ul8{Vc%
+e44+&TZ
HY(zL<+3UmGK
Bm<nxu~
|t~^h&
vwVO}2lF
}9ZkN;
EbQW&ir
$Sx?,m<L
"|d,/'
IJZj<k.
6n!\!%k
zIRVCj3
d;pWm
"FMU.ECj*7
CX5d;@ M
ets[0hW
4p\uh2Y<A2:+D(1PL9_#
cV.7iFva?5!
3L,#.]9J
*c"Wkz
s-y2;c"B=HBW2\y
?b\g4M=4pr
rmy,^64!
hx{!j&(F/
`zdA?v
}/V5w%
\2Jy</\
T*hdhR
cjPm`i_O[/R|TDq
71y9rf"
S,NDK1
*bv;u-#
L p~XPI1!XN+x
h/Ihxi
[c[ki!+
g<g\ZM
hWO3_&?
Ja2dE.)*
fKG<F!=
{tHF<]r+
GjRD^kAd
|Wf73,!x}n
qj~m'nc]E)
wx20}5S3T
cEV">St
!X7h0
B%p5O
2mQ~J"ORBt
j^+]+b
DQw(65
F|>_(.g|
puV[=T
AmB>R@
LzrBH^
%P;>c1P/'/%X
_idWH}"
:l_([JiD
T /EE5/
n8%_Y^
G)Dt$}jl5
!0uQVv
M3"U0\0K(? 3
yRvG-Q
voeS7~&yI<
Z+dw P,be
Z;0B({![ib2
:U)|hX}NaUD_
}\.n_!dq-T;
U2)$V^c9O
Tk=h5J
'S i.<Hn9e3k
tDr>-xX
v%s?##e7<W|>eL$Waa8~
B<I\7yM
?Q"_Vna86I
tL*O\5Ze*
H#'Pg3T5
,TqSRB_u-
l'&@=sA
5Y0\MS&#}(
n=bv!TC
] zB ^{
d0Q$]S&
9|V7"/m
dqBtZD
6c39'x$`
Nnt[LnTqG?n
RBGv-Q
d%^h)@=d
/}~;j_c
e.^<jjf
^4t|shc:V
D+7SR\
1oa\MsVNONoY5Ac
[zU0d|F
8_-D;^YQN
;a%6cg{
[A,N*i
9::"|gq
5Ot]T5
4\C`%$
6117w:
0'i.TA
gX2M1,Ij0[!I
:4&"3\]sS
"^r4Pv~
CnmaF6
Ix4qs?)\TB<Ao
gOiTMX
fuNHl*0$o,
>Uh2hH
2a\,AJ
S$-lHg;ci
/~x/YR5-
R1K Od
,$5tB8PBaX2
Q`zin3
$QRB"~'-
G_Sc^qLe*+
<Ksk<h"b,:|
f!W<!R[
uI|8wzc
Rb%.1~Xwz_t
]\fCX+T>U
(+{"j6UzQ{/B
FP#6{t
P7Ba&'b
rB4k#!=i
PB$59=C+
xtnfKfBqEK@
T:~+EQ3d1C2M3Lt*6K@s4p
+u].fP,
.;lZ?
YEx^haGyl]
MB>lq;:&'OZ%u
9t%qMD
2{^@SO1
-1&Cm]Z}q&~<
,b}[[e
8);X}s
R^z{2KYz
D<rP/E
)I?]1G
~feL,$$tQ]
Nu;tQ_-
b*,f]Fz)
dHk<Y>!.
25uD2u:VD
+;Yzu6sos
3]FdBf
:sFQGk}6
j&|PR3M
HBn_tkb
4AK>xl
.'H"n$u
'=ef:ZwG<2G:
:wny !
{q8gx??t{uZJ
-N`$J{N
iQJnKw-
Jt{#qYt
?'8m#Ynw7\
iC5;'T-
%a;2E<P
Z6@P.w%nLEc_S1
,gMly;
MXWO]O#
a($hU<y7
96{rpf3
(Xb=5#GMP'aR
[7Fo`00vF3,
?3q)&)@
:!;I0qfb~
uI4%lFzJ
3-H?><_i!g[M}]E
i`|1t5wx$E
!K1m.1
!]{?BZs4
v(i(TS3
TVy3GJ"
^3Ca @Tv ?
}\3dLD
>YAvs&
cs/1 Vd{
(:w"XQ<ag0
$XpZs9q
BGGZM@&~
sC34YlFG^
N3XNly|K
ro+`GX
s&Y=PUW}E
SZXv`*U
>Y#*/B*gLCk-Fl
j!=.NBB* HKN^Rh
pu%L%0pC&E}
5MF'fiKVT
$QJ+:80UX
oW_INQ
ehzOugk
h/z*VUA
ddp^up5f*
;o9dAP
Ux@m,5Gd
n`K1h}R-/4z}/
h]gR.2d
0j=bvtA)E
LNbIP#
35I>d`42t
eG!zE&
3 A)"W
H89}1)&
2HjA!sbj!T
k>`N>X 7
|Q;`*X
teLBr>GX:+
F*+qh^
3jx(Vl5H
j|E;v,o$:</;!U<3f2%o
Z*-J^a
'D`.PU[
3GzF[klXO!@/S
8Qn\4NuT8e}J{>Nz
+b`N?[lR7I;
[C!R'5
D02{f/=
PNFS@XB6rh
WZmKe(
ZfL}4Rz<359
wW;ERV0d
.T0y}*-v@
4O_%3QKu_gf}9'4T
D9S _4!N
9rav#($h
zcRJ{ep
h1C+W2&fR
e.;R]%q?e
^WWs)}lbw
&bC1g$tx
CeOBZ8VvEG
@+?<0e
9~Yh`S
,!|i.?XpuTi
`49wzf
{E*l1qaKn^%
~<$3]Y(X
o@Yb5"%[D
F~\5O
d|WuxFK
AEC(\X
`8LRL>8X TIt0+`
9hkS>ozM
*Z_z)ei
'XD#*;%p
=`2W,`W
*X4%^Lz|
H;A7b}
nw^~^G
h}9qNEq
#33}\I"O+
e$CCyX
1DvMmG;
-h%E5-6
8lxQCQ&
@dq>>:^Cm
"|@#SI<V
gMIF\@r!v
n2uJw3
(j~OH/A{h`,g
:.=A/{K2
vTc47aPE]5b{
\~M{0O"/ej]]
OoxVbl0F]A%aCH
PztJt}ZZ
_2Z_CB[
de/yeb
C`9]g59#:u
lj#H7J
}MT {[M4
|FY5#;
Y6>[0G
]rffM2`$
TLU3o$4|
~WCfxvm
m6 `}#[
"spKT94m>
8JA'D|9fk?
.^\h4}L6*
qJ>Fqhe~'{
q(anbL
FBc{/B
\{^8| ?
dKPVc"6l
X7u5dI
43^)bn6~Oh*
h>5Pq?
uXD'|K
^<;Fa$cw&x2
wK*cBM+%T(U!*g7(
RRE`gU
{SUvDoob
Dje"wL+i
/ n(P@~f;
0Gl1;>g_[nSZtMv6
SN+EE$p'fl3>
vW\{+US[
yQZ#$-
7w0ON@q
.p~9Vr>qx{`
fz3]66%W|'4rouFR^
2a#eq|~
1^#hgxhW5]1
z6t^J?A
L[[><qqk
TD`i2 \]
w']sec
TV|*[E
pG749$
0UM&[.(
^PpV%4l@T
tNgt[mq
tRNSN=$m
Ry$5Kp
o9$P4-q"^6e;\
K0|RQDB+XlQ-
4f_]4<r
cn8Ns`(L
OH0%9<C
odR*4-ya?
2u#4)N
czz]dS>kJud2
Q?ML}"83l,
k]q[})O\a!(=muxyyPr%tw
d6qH@#-
J?z$g0Ii
kyKqI \G(MR L
V`eM<n:T
S^*~vJn5
V$x>j(Xr
tuzt$/
P`a@FpCR
h_*$ygQM
WBHmfI(
%,/R 8\zYVu5
B_Vm$=U11u&dqo
VW[{z< S6sCYa
AUP{UD=(Z
KqUf"|~Kgik#O
7\U:gL
c.1$19
KmznPNL
$"5bU*
!j/QsX]=(#a7U
>.jSY=
DWBZZ-
:ThsEdqAICj
V4j >-"
rWmJ`pUL
(P|7|g
"=RCji
lSV;WD=o
FU2l.j_{7z@I
[W?_!zA
"5@/jiC
E^zALN
+44M[i
~lx&GM
,kjS\vLVk
bL}-Je03/v
*W(Lpa2[w
1#j;o]
$*gmq,
r%cpYBT,
,[xX!&{~e;Pd~\ 17\L=
|hQG#|0
nP{0_)Q"sE
t9I9g.)
Zv-VAn<oC8
`S+a%T&8]0
lQEO4u
hE3nHI
'u+({\
|#Ah:8
)N(Oys0K}X
lQtRO~
G%"TfA}At+
LZf7Cli
0u;f[
QHA"z,z5
_b=f@
l/;ZCM%9x
1T;L1@
6=G!M'
XS*eL&
a488!'9}oI|f0
lG'"BD
F43YH>}iQ
?3~t)%S1
a^zQcl$
k5FpN>)<!
78DtO
2Q-/n^z
;B0a0v
ZaEah=$Hz
C*hIDC
y|M,b&
B|:K/Z!7~*zd3
sOcmp_9
Z8}x^bR)<.7\m
#bpy5WBb
V-rX@H
F-KS3-!+WM$
0Ypl*+J
KKBru%2
^n:\C7'y
_S$)3d<<
Bn:{"8[
h!#z8z>
wMS?*Rz
4T.=C,D
["eUJXD9y}6
SL_Cic
nWicqZ
_Z:j}s
e{eawt0
J`Kw}Xn
'l7='K
\|Y'G(57
n\D<Q%I
Sk<"rh
H0|u-h
D\0fyj
_Bu4)MQ
heX9[E
Ztnz`+y#-yfbTe6>
`R0q92
QtQp%6
%H`[3>fi7.
v,H'1]gV,u
#CCiHKB&
Np7w9[
bg`p.@]7
l~_LHo?Vt6(n$Vy3H
['F54/
r*km*y7
W1pHi.L9~
%=W3;u3#*(cr].43V
LNU?R\4
5|(0H|<
%lN|}shW
E#ivp9g
@D6Jqq,pEp@cs`J
0a#7z
*D^Au]
$ cBxz
B:R-%S9)
U ^S,nmq.4k`@6b)
X}B_N
}Y#4N{g*
)rEp8F
LQGj\O
1)19F"N"
odGIRHO
k*^+iiy
U80e%D#
;9&x;f6O
QjCY}k|
*['qy}/?VRh;m 3
x<HfpkP9Ysx(
vCReN
%["5A#}
_tf1:_GCwG
_l'8Fe[
)2\gi7
;F7r*"?
R<a`,=
<87e5G
fZI{[E
PeN=Dd
n&kiGRC["^5
k0}*}*H=3
/j[5(sTI(^(
[d=+4tb
@PSjSJ.
$OsY%?
Fc'[1N}
eQ=aOg=i]@
{s0B<UG! cgK)
'GqK@.I
ZNBQXKe^]K
ceY.*t^q
y<>3>U#<8,dy
4YT;m
+ E[l7z
KMw9ldMq;
cnjzk8\I*i
`5_W t
}IPxDbf{~_:4m
8>UG_(
jtXo;niWRc:
hd{2Q!W9
^)+i>l{V
8Ps0NR0
=o{kc~y4
9hhoE"v
.hauYk
j[iF7E/
'Y|oz5Y<
YI;m s
Ex:d)4w
dza>f(D>
F0|Uz89>
|B-+W#FRvL
FF:MO
GTZouWM;ee\7G(
{(+n5u
gB6(L9
ylr: *$G OI
&]@XPb
FWP;)J
qqZ)8"+p9$N
jN;L)h$&
h/[Pd.[R5J?fr&;Y+
;b?@&>
7(#LZc,\
.)q=Rn
m<aOm[ZX
6f19NGN
Bc:'9L
}+hSEq` QlZCP
I}Tg`(.[rd
c<<$368slA;oG
+];EXl
F@`4*h
z[1'vu#H@N,s
B(&.Ia!
elw4ku
s&m|_DtqB
piM,[k1
|-Glfr[Qz
tD'phL9#Df7Ym\
/pp17HuN
oQ90(m
[c#g5XWM2
.FEG3T
F/WSie<
X*eP`[
*BAv>QZy
}tJf|
1)d;^E7
L@20N*
&1-3][dg
I$0?)a&n?
bf"=-RI&(k%>X
wV8-OO ?
f^FCd=IA o[
sdrDM{~
YckIawBmB&U
Dh!G3A<
Dc|1qN
n;#cB2
9M,]4C
C'\R{9|&uFu
^S/9$?5-}
2ojl!<I
zvn%zrm&
`ZZ>&5cK
#rbobgytzK1*!rVVu
BLA2Ze
5XBW|q$#@-.U/bNxRHvg
XFYf{%/
["C?_Va'
FY0JQY[9
gr%;'~
q_Nm#i#
HnU=QC8L
dgvV[K
o<{]+MPW
~,Z"!z*z4mF]:Wft
bb.R"Y0Gw#$YI
RN,dY4
Tc.uuxC
Dtk,g:+
Vf2UIag
mZJ/p,Ff>
X"nD^z
$W@_=(
aH57wYg?b
O.@<W!%x7lN|bJ7I
37Z{:n,}?Pz<R
bkf&|iy
\_X_kO
,sO!OtPRC6AT%YX
:($#]<
G`w4{`V;|!W=t4bm_agc.)B
cZjGcc
XWX&9T>M
tdc-a$
{_%o+Nc(g
)Fm:;t~u
)Ec],B<'-+PR^1A
4>0dlB
EOTIpg}zT9
wq"+zF
16DpA!s(pD{WlZ#
M,enX7
K5/%k0("
tW1{4b\
H[[:y=
W_{~%b/xC
T=}M!)s>
7Y:a(ZP
+w]gK @|NHa
FOdA)8HXrG
r`$@*U
k1>W:,+
D9D1#UeFmOq-@b
!Q(YSO.
W';k+X
q'E!^x
!}iJp%
bl-0PV`
0LLLLLL
E3514235-4B06-11D1-AB04-00C04FC2DCD2-ADAM
%hu.%hu.%hu.%hu
STREET
dNSHostName
configurationNamingContext
TWO_WAY_SYNC
NEVER_SYNCED
NO_CHANGE_NOTIFICATIONS
COMPRESS_CHANGES
FULL_SYNC_NEXT_PACKET
FULL_SYNC_IN_PROGRESS
DISABLE_SCHEDULED_SYNC
IGNORE_CHANGE_NOTIFICATIONS
USE_ASYNC_INTERSITE_TRANSPORT
DO_SCHEDULED_SYNCS
SYNC_ON_STARTUP
REFERENCE_GCSPN
DELETE_REFERENCE
UPDATE_TRANSPORT
UPDATE_RESULT
UPDATE_SCHEDULE
UPDATE_INSTANCE
UPDATE_FLAGS
REF_OK
NO_SOURCE
LOCAL_ONLY
IGNORE_ERRORS
DISABLE_PERIODIC
DISABLE_NOTIFICATION
PREEMPTED
FULL_IN_PROGRESS
CRITICAL
ASYNCHRONOUS_REPLICA
NOTIFICATION
REQUEUE
PARTIAL_ATTRIBUTE_SET
INITIAL_IN_PROGRESS
SELECT_SECRETS
USE_COMPRESSION
INITIAL
NEVER_NOTIFY
NEVER_COMPLETED
NONGC_RO_REPLICA
TWO_WAY
ADD_REFERENCE
NO_DISCARD
URGENT
INTERSITE_MESSAGING
PERIODIC
WRITEABLE
ASYNCHRONOUS_OPERATION
ydummy
mS-DS-ReplicatesNCReason
%s%s%s%s
,CN=Sites,
CN=NTDS Site Settings,CN=
(objectClass=*)
interSiteTopologyGenerator

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 61714 8.8.8.8 53
192.168.56.101 56933 8.8.8.8 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 58485 8.8.8.8 53
192.168.56.101 57665 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.