1.0
低危

1b844d72f11c09e348c8e4b56d7a1215bbbb8d8e13402899ea2a4e74577f3d37

1b844d72f11c09e348c8e4b56d7a1215bbbb8d8e13402899ea2a4e74577f3d37.exe

分析耗时

194s

最近分析

371天前

文件大小

207.7KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN RANSOM ULISE
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.76
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Kryptik-LUA [Trj] 20190927 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20190927 2013.8.14.323
McAfee Dropper-FFQ!C998AA467A8D 20190927 6.0.6.653
Tencent None 20190927 1.0.0.1
行为判定
动态指标
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 53 个反病毒引擎识别为恶意 (50 out of 53 个事件)
ALYac Gen:Variant.Ulise.2509
APEX Malicious
AVG Win32:Kryptik-LUA [Trj]
Acronis suspicious
Ad-Aware Gen:Variant.Ulise.2509
AhnLab-V3 Dropper/Win32.Agent.R67796
Antiy-AVL Trojan/Win32.Unknown
Arcabit Trojan.Ulise.D9CD
Avast Win32:Kryptik-LUA [Trj]
Avira TR/ATRAPS.Gen
BitDefender Gen:Variant.Ulise.2509
CAT-QuickHeal TrojanDropper.Gepys.A
ClamAV Win.Malware.Ulise-6840317-0
Comodo TrojWare.Win32.Kryptik.BBSW@4xttk5
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.67a8dc
Cylance Unsafe
Cyren W32/GenTroj.BW.gen!Eldorado
DrWeb Trojan.Mods.1
ESET-NOD32 a variant of Win32/Kryptik.GUXR
Emsisoft Gen:Variant.Ulise.2509 (B)
Endgame malicious (high confidence)
F-Prot W32/GenTroj.BW.gen!Eldorado
F-Secure Trojan.TR/ATRAPS.Gen
FireEye Generic.mg.c998aa467a8dceca
Fortinet W32/Kryptik.BDUE!tr
GData Gen:Variant.Ulise.2509
Ikarus Trojan-Dropper.Win32.Gepys
Invincea heuristic
Jiangmin Trojan/Generic.awsky
K7AntiVirus Trojan ( 0040f4c81 )
K7GW Trojan ( 0040f4c81 )
Kaspersky HEUR:Trojan.Win32.Generic
MAX malware (ai score=82)
McAfee Dropper-FFQ!C998AA467A8D
McAfee-GW-Edition BehavesLike.Win32.Dropper.dc
MicroWorld-eScan Gen:Variant.Ulise.2509
Microsoft TrojanDropper:Win32/Gepys.A
NANO-Antivirus Trojan.Win32.MlwGen.cqkyhq
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM20.1.2C0D.Malware.Gen
Rising Trojan.Kryptik!1.B5A3 (CLASSIC)
SentinelOne DFI - Malicious PE
Sophos Troj/Gyepis-C
Symantec SMG.Heur!gen
Trapmine malicious.high.ml.score
TrendMicro TROJ_AGENT_057677.TOMB
TrendMicro-HouseCall TROJ_AGENT_057677.TOMB
VBA32 Trojan.AET.24507
Webroot W32.Trojan.Genkdz
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-05-22 19:52:03

PE Imphash

b9e71013c0a99346768184c489480291

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
AUTO 0x00001000 0x00000df0 0x00000e00 6.523694287499248
DGROUP 0x00002000 0x0001fdea 0x00020000 6.524139501877294
.idata 0x00022000 0x00000644 0x00000800 4.372518240076536
.reloc 0x00023000 0x000000b0 0x00000200 2.6095137580735157

Imports

Library CRYPT32.DLL:
Library USER32.DLL:
0x42212c GetCursorPos
Library KERNEL32.DLL:
0x422134 FindFirstVolumeW
0x422138 FindNextVolumeW
0x42213c GetConsoleOutputCP
0x422140 GetLastError
0x422144 GetModuleHandleA
0x422148 GetProcAddress
0x42214c GetStdHandle
0x422150 GetTickCount
0x422154 LoadLibraryA
0x422158 VirtualProtect
0x42215c WriteConsoleA
0x422160 FindVolumeClose
Library ADVAPI32.dll:
0x422168 RegOpenKeyExW
0x42216c RegQueryValueExW
0x422170 RegCloseKey

L!This is a Windows 95 executable
`DGROUP
.idata
0@.reloc
1E~E~P
]^ZY[SQR
ZY[QVW$
EA;u~E
}_^YS8
_^YQVW
E1E1EE
E;E|11
;E|E;Eu
u)t1EEFEE7
ZY[SQV
|^Y[QR
EAZYQRj
PScEGy
PPkWdPP
VEeLzEa
ElnEPzsFd
ElnVoeEvEv1Vndn&3iL
ErElEiAn.
`dEdFrl
FFEarrzb1`CotznrRaun1lEWQnlVrnVEod5`
EsdtEErivraPep
ErEUPEVdtVEnnzRPhaSavnsSrlEwScFrEF~mIoEFdpEo\FnfE1FEuSFinttet
rVVVulddaFPePVEr1te
SuEnElEeEVaPEGrviEnEEBSVOd
nrlnEnS
elPPEepetvzXzEirrnFEltd
ddEdnnMe
w@eRxFV
zrsdEV
eV;lQEj+1
<PuxN=]ax?
wV0Vj]t4
hjR]jhs_
GVVVJu
<1Ejuh
ELUp>t
QYZHS^_
WYJ0@@@1
qjS`uP
@qjD<DuP
jVhj]V^@
Q}UIdu
uDU8E4
N9++Naq
@VqNqf
2fhh+h
j@@jVMNE,
u@3afP
hUA0k]4@<
QhUQ(p
jQ@UQh@Q
EQQEQ QM
Q,Hu@@$
@dqhlj
`++0WG+V+
`@VW7+
/DqD+MQD
RUD0RA
RPhl URDE
hpjP;xPtQU
jj2Fqj
WhWjGV+@p
\`P++`+
+$PP(V++
|Q\\R|\UR
0\\\D\\\
P\jxA\
\\\\`AR\\D
PmYhq8l
phphptpdppPppPpQp
2Mq[jDP
M3j@@M_
Q]DWhpM
puDjPD
P@;DW@W
$Ru@fW
pS3jf:@
@p_uMW
@HMfL@``hdSj
8$+Lf0D
_[uutQ
/Gu%u_uuu33
$L+3@E
9q3DVML
VPtU$Q
E@HE^&E3
VVEtVV
u]fV9Vj
PDYPS@
f<ffD$
DfD4DfDD
@=upc$xq
qt=@+==
3===@=p@=@
==@8Up
tY_Th@
Vp@Frtj[p
pp?p@p
DwD=WY
jud_
tx~D>$
Qfhf_fut
tutufx
JffVtEf\3t
Y?X5?|s5?
f?S?`9????r
3p^V9f
p^U@/6;_j
/@jXpW
j;@|Wj D}
9;jjkY
jj`jD5f
tNNN>PN@
;@N@^NNB
5@p^tTW
pqq5@;
@V@_^V
CujFhl
PYYYYFYFF
t5FY=t
D55DD7
DDDD?D@@D
pDDD|TD
@Ytp5ND
ElEW_t
<<SE$l<[<Ud
W<@d<<_V
P<3<53
I[:L@UFIIMN33EIs
I9MI8M
DhsNT@
E@ppuP@e
u3{@E@^@
~hWW|_4
~t|E&j
3t_4@Y@@[
u]w3+t
0pkE+}
@]0}k@U
D3E<ut`3E@,]Ex@9xM\xS
xuY]xD
EU|Uxxk
ExMx|uU
fUffPjS]
puj_MS
@5D-P3
]trt@uDHD5
4YutD^
quj[YU
8V@A3W3
9@HY;A
:3hhP@hh
]@hhYh
dU@hY
EtYEdhY$
hEPd<r
hhhhYh
3D+D}}@hL
ESPp;Pt|PP?jPP
tPPQQLt5
EPPDP@ED
PM@tDPP\)
PD5M3t
f]uM_O'u
_M++uf3+
"d^HYtf
Vpppu}p
DppuDp
`;pv@u]
ppj^D3
3pjppupVU0P
_^uvpt
E`;_`]DW
@@Vu@@@
@F$$@$
D@@I@@@
DT@NDND$
^IO@$_
|F@@t|@
P$@DOO
@DOrIO
WU^D5G@_,
FI@P^PD
P^;tS
Y[E4W^pteY
VV3"j3
WWDnPS
vPSSWP jPv
VehVuEePte5t@6elFeejH
wwetecYe@hGutue@l
phEphUY
hp<uF83dM
DUH@tu
+7GVuF@
YQu;9h{h^
u@RT0OP
PD=Ut$Y
DUhdDD
t$Dh4t
3VhYQo@
_lj_(h
Yjrvt3D
pttt@d=
tjtDVu^}tt
uotuWttjD
DDD@p`Y
vD]DDF
0YDPDYp}YjM
D_YuDu@]DD^93W
uu]YuV@^
Vvu+QI
\vpFU@q
vvD4l`2PBvvvv
v8hv"L* v
$:vvv<JHvvvTv(dvv@
Xvv0\@v,
V^Y;v;P
tt@YF@
Y;F;P;PYYP
PttYY$
FFtPF;P
Y;@EtS~;D
@@PPY8v
;P;9;3ER
w;H3@p;u=
uXw9@E3W
uu@9^uu
uSuuuuSuuuuSSu[SS
S(Yuu u3
SSWS=uuS
u SuuSSSSuuS
W$SYh
utuStuW?SpuS
E"uuuSSuME
tp~39t
aSpu3u
}h}^j[
j}uu$j}j}Su_M3VU}
}Uh}ua
}[jSeE}SjjP
jE@j}M}u]j}jj
RXhHh,$h
hhA]SD
dU|$v$
Qk_QXL
tXAfH$
uu7p[Af
tO3LmAr
ngyd ti
niirecdssz
ita boalu
lM. it I
kf lit
iptp-olD
aumpf
cnihnh3
lpgnn6
ee1o -t
xxuttt
t dxte
oa0ogno
nidiyi@
qt@++r
dxsesovte
w.atmneMLSiGete,
PmseeeeomefepeRe2ndn
eeWorae
tDisAew
cereyA
plruuJS
aTddud
eFSeAu
D/bortA
aaWbdy
xl2b#p{n}g!'t
bbbu=zvcybajb6b
5\e^zumg7t8.wb-ab43<mo*]b)h>o/nb+el`rb;1yq[~
b _s|bbbbrfjfq0i?b$
%b9@"wbv,kb(h&s
bbbcdx
C;/OL,]X
_6:4H+
5NY(Q3
~`U.MS
AvL1U7>\
D@IORDDD
TwEIDi-
cEDsk |7
TdTAd_rAi
v_cgcA
ccacpucFS
GlrGFkGeeireWuoeo%GaeGxEWGG
HotmrFGMeGe
ltChWGeeG
motFielGpanllW
GiGtTsien
ARevGNGFMteelGielFael
`rGCaiae
ttmArdtrPsd
elrrencrPre
aTcSDrWeryme
SeiFnrspeeyerr
eiJpra
dmaeeua
eemttrtorWGTreeyeeetW
eDIuettie
eatCorF
GetroeGlsl
trPser
cGeaeC
erTosrtG
sIieeeihrh
GSCeeeererrN
reerrrHetelrrer
tLNr]rseaEaldAd
EcniWWnl
aRCpod.rlaosMLguseW
DcstehRMai
r2MeaaaeLLootsLAC
egaTeet
aoardceesMeegLIdgonstdlCoc
eigrt3ct
ssToWe
nWralneKtms
ssi7noo
naWrno
peyeas
tmsnnndada3t.
tWninPi
WneaordtnCE
innelt
dBolnnWPnnedmtgna
UnningfW
SDUsEgtnwa
inuooWDRsxDos
nnannP
QldxnSlEW
Rwdc2oiwr
teneriP
lENeogPRe
tne~yPuSVnlOPcSxnnElxi
2yPaSyxm
eUe2PPR?PGePu3PePPePeEPreIoexCRxQcVCrssoWlVtW
oieDElPe
tn.ePUea
WzgedPglCtleE
EiaaCAn
aeWI0xl
rIPleeeCLAELatuK.eW
igtPIa
nySioSPn.
eteotdeSIia
efSSGs
reSUer
eSopzdtPaSelTen3oSeUlinemSlae
uSeCscxc
Oe@eee3ec
tiLSetstWeeSeeplee
lprS2oSi
aoenIfiS
mEonr2AeToinedeae
iEcrdlCcuetHeuntS
SSS.ShrrtelsrEnsSax
etrnxEsgi
eotlpErbtDiWvd
SavvstEcdvdirerc
SevrvudrorcuvoetGvPGI
USsenv
iegMteG
esvtdnvedHPDdt
vtohvvvnvnoo
eervvteoddtWreFvoecP
lnntvmaSnnnltnGHsend
sSCdleaicciidessccu
cGGcctizneitnEo
etpitTt
nCcTltS
ccctlncnrVoDulliecgTdctiocitelA
nWStIeoceceSrtcnellSlCun
oaiieClnuepcc
PlietHeVFFsaSy
eAtlIta
letrcecoQEceiGce
9Dcadinccyece
scccretelncmcce
rtccra
LeectcISttcccLca
lorctcceCcadEktoecnrc
crcctrccrfnc
encCseEl
ctcmvCncnrScu
rcceceoct
lnruepocrcrCoaceceiHProracamckrcIeS
ioPsoHp
rWrEre
lharroetieacCF
CrAdMlrCrrd
oBrtrariCyr
gzrnrdreOPc
eL-rlriWRPP
aCerMtroiP
weaeutI?oGeCGrIruret7IPyoaflsnaitndi
esreorGM
rlgtAtrpi
7/~GiCCh
/ukB61
3]{b}af$kA
sK".ku<
tyjt-C
)lx)a))0
hYZ)=1E4Q
]n<#W )f
n))Z]Sc~)
Q)<De)
vnvr;AS
(T(f:WB
(((%I(S
((2((]
x;qW("E
+m+Fby
$z((N^({su(A({8Ux
?(v:cxp#
f$Erluy
sms8m/
m@m GEnL<m_
mTEm]8|8tt9m%1chmmIZm"B
/+ma@m*O
y>kc-rH[
u^7&)]zF
FF3c/%c
c)|;F||
|MWs!|
$27wXuis%||
H1SA|$,
VCk[/dkO
XH&kPv
Ck>59GkF$
k`}kMk
kkk&#|ECuI
Qc`OysMuF
OIBa\H<
KOXL4PBk
TAk"wS/WA
4\(fs{
II#I(}@0
IIVFI+I9IA')
IUAIt%J,IBIzfI(I&
TIMI--c>[
KTLp^YWNj
J>Z&4c?cd@
_ >AcRc8
/c;ac'%7c
%cCc_ncc[
cLXtcH-
ciXccc
\F+7%c
-%uX)~
14vn8-
2h#TL`
a[/arng<DH@r#(G83v
eW[d_j3MlXg#W!
te]g/G
0'Od):G=o
$^^(aX(r(Z
Rk}(~/u@(w
JL(+Dl(
wT/(p~;q
(B(( m((%c(
<(>d-e(Dio\qqM2
S7scai
`zfxY)a:r_f
B5HRXY_dd
<edzdd
DdaLY(
m9d[ra,l5d
dN8Bdmd#t
rB$d2Tba
VdUdHd]dex
Y7:3i^8/
pE`EE@qI
E,`)n
#tolEE~E
)oPi{zc^E9EEEEW
6<GCip
9tt!{`yl
Ry!"DWs.d
3!sTBMg
x`sM1!saW
s*n@2k\
Q8ws`)t^
n;s,z)s<s
s ssgs
r8ss|DyrV\ssq,r
FwN1jBtj
rjjjw|b
l?H9}9e)Pj>{jO%
jHM0yMT"_`L7Z\h
6BQ.h$!
(_eN%2Diq6l
7&.)0OsDhT
8vg$-8
q$;`R.
;=IE8o[W
pi7@e+
W iQ&M[&ir
`{haicU|@i4}>-m
v ii`Osil5WQ
i!i;eixiA5i/.i*ib:
XAi6],J^
#ii5EmE!|W
"g:g{=@:v
N@K@4@$w
:.)1@]:fb:
e3:4&kX:
@:?-@=:
59:6]@@ r
rE)&@Lr@L5rwh
5@r@Rb+r=Yr.@v0rr3
@rNYp/
(rrrrr
rqA*.!f,iEz`=
0Wu,+{|
53lIoo>
8l;#)n
/k]2qd}<
{XgOXX4
SlK|JH{ yB
vQ,!2J`J
B6JJJq&:
zSYJJ\
JZSJ(%4[
'3:J#$!J9 NJF
[)+Y"YB
dEu}:/w;d/#!co
-I|JZK
(R?{gt
es%`o9{j4>N
Je$jjv^#jja{
_9j0jjjjj
Gj|j[jb
[=i_'ma
zSzSX]r.TVtksO.
v;cIYd
st"zpF
rr* FU5
\)fr-/)
g"srkYr.^
9Oa7Rw
rlr`rirT1rra^r
r'x?,rFyrr
P:6PP1.sF2ad#"5=
P9a88P^B
}{cPPCeg2x9PM
GZ(g1c)d1X,
pH1|=Y
Y2Pw6_BPP
Zn]1~]I70q&
aIKmkl?UUi"
k]JDUU
UlPaq*]U
*UrUUzUO,
"aK6pUm
0U6H7UU
k=pU?KGUqU_A!D
86f$r8
i?3quv
Y0vd=n6hk'
3/KCA?
8\#ny8
saZ1\gaRV;)
;;;;;dz
;;QDg68'
Da)UVK!;p
~;Z;;;V
lY;e5D
'e;"D;;T?D#;DDF/D~;p
DDDDDD
;DD(D;F%U
2/D;?;;F/D:!DL\+bg)+
<+6,&)~*LF
Vh+'>+3+
a/b++B.+
1+tc[\RZ+V/+6{
@.`wWm
wouMu3
|.A@~- p
=e+IP)u
"3AU~hHPv
5v;xX=A34D1$
rl60%O
ZD5,|Z9iL
CBCE@J"huSGZjaR
{P6yL(
W 5>+%l%
*9%^%{
%'%ivYRk%,b
%GO k7mw%%hU=
80V*%
%h7p%=$
;:awh?bu
;,c(BbJ
q^+7B`r3R-
f33s333
KXN3[;~
G3Err]3J'XL3
,c+y3u
#0x['"%6O5C DEdgS
_$bc<ru=(0.
B1sLbU!Sf
dV8YHI
.O#b2%3\###aGrE#ZF
rr9.Vj$#+
#x#IP1g\n
{~#~"u`
Q=?&fL
|Z{[65##=
6hDjSG
wg_CW0
'JZ{TDY0Y
?GHU|-HQ
:#q)`Vc
usFq47
D{{Lqq
qqo7Aq
]3lqQqkb
55d55G5
5RO&&\y55qv@5)5
555'?H
mCy`Z;{5SC;k
$|G55c
5%55YL5
1]p7 *qOW
FSeTJ[
^-W\L~`
Mn{>k[rf|
dFu7{.
{|(4~J
=)V3+b
~YY~&e@?T~m
W,kWu"T+X+95
+++++NunA&+
+/++++v+ +
l+0+,J
4^j~([
+s{]t>Kj
eftp@O+C+
P..?_.
8..w<d_c..
}-!_.%.-_.
/b_..V_D____
VZ_ZW__=
_.s_}I%
v4dZ#h
(@B1^#6
Oa5DGX
Qk9J/,
,~!@p$
A1Bz<uK{
|z%K f
b=EqLw
S21lo1d
KhhC+t=!K?
5'RQgh7|j|SZ
h2NU_h*h
e@whTh
9Zydv`
^h\hTq5hh
h7P7/hhi&
Pw&O&&O#4p{
*a++pfY@&&&xs&
+51&gjhj&W]
/3kDXqY*&
Paux&&/KkqS
&&I<o+j&[iMr>
cTjT-futkjOG>\j
"DNSQj
a=xj&j]e')e3jz[Iej
*\~ ^8
UzUl%GU
/U!V0U=
UeOvU~UU
E)|CU<UCWnU}
'VRf|am
.6uE&2
L9*EjA*
/i5m4P
B(7%`dS>K_WO;p}
5t3fy<p|2.izul*
G1G*A=9k
|1YtD%6#
HT(9.Mg.6TL:{
@Td1ToT6iMT
CT2T|tFTT,Tku!
S/TMVC@C
$/gz(L'
W8IH`K8
/|#?_a*Y
L\QPw=s
Zw]Y5F\
ZC-/vvL
QQQ\1]ZQvaDQvvQQ{-tQ%
{5qv*vxQvQ%v
tpvQvM%QP/gS|:PvQz
vQvAEv*C
\#c7H+Cv_{E
-h1e<M{i
4}\w$2/h
<#E:%2d
U|!-e+y8N
'oNsiO^
&}tkW
huL|b+!
x&CCCaKbZ
CrCCCPwy
Cv/j1C
(CfwxK
L@jxgWjC=C]t{Cy(q:YrC
~ChLs'&fECdC0l
;j ;trYv
PNSD;;
6b]nME;
;..";;0;;n;1Y;
K-0Q!_ODo;]4`QDF+`
Yp>4p1N
7V|l}n
&VTP3`cJ1E
k!PPL{2
/M$F:2
2&%^ 226
Km_:_'_a
8___!__
g6dv_m
_K Qc_
[m~I>I_%|<0_grmGx
RM<f*y
qk&,%I_AH
5$N556
2Jc5<5F;
;{55N5y(
}Nmj?D Y
D5+=9("Y5]LVA
5555cHpZAN80
5q=euY\
YykattG
y`ES ~ *+z
a,#`.:
:KOy/2
xt$Q`";
`_9ksJ]xw\[
w?wzXwb
7lStwy3wr
+u?:wwwwXw|
m2wtww
bMPAL~Hwv
QUSr:Yo
d&kZK6
bB"</
.[-rQ[
zXs^|7
Ek;k.*
wiH\&?l$u
B@yQK@
tM<5^e
Vv2>;O93~m
,C/}Q(
>&(^D(
'oQ(1Pv(
(_Nm((
Gf(>BVsv%}
>JK6]as/
?UK(((D4
(2((+(;
ozm6"x
,`9]^56y
tbh-v|
U@iOvC
%Y/FB
L_zrN2di
TJpmV"8mx'i
/EU2l3=&
w#)iQJ}}
iiu9C9
Pjnii!H
[iswC.
ei,i;5gi-iY
iCnc)
KR`|PR
uG$.+
.7I,a
g>z$Jx
XEYVWcors
?XmL(mEO>
+XnS$\
jHumJ5:
pU,G4"Gp
8B8|8m8
S88`%8iLg
i6&D&U8_
8LGX+>
8/m/8>s8|8 8
(yLh`8a*"wOTpM4a~@EEsEaau9{
RoaGa]t,vX
+4DH+^
LW<*Zl_}
"tIsh|naxn9
}u`T]a_aa
zafa/x.A"v~%
a(=Zda"aaw^{aB2n;n
aa5aaZ
atfaa$a?tZa?ac!aS*
E4j;;^.TPZ^_>^^^<^qS'g^b^~
I0mBn^^DTK\D^J
V0Og^^^.^j
G~mV9s
xa+mx9
P+47Lj
BO|r54
|1:UPY G{d
a@qE}$8
eCMv;^@T
z>x|,oh
<w8{FAm{)
U9QSX/D#y:}7W
&pSafGAz
xW'i{`Nv
?KQM&r
GH0p6aX[e
tBD06sn
zB;=aA
~jh._3,_gFE}Ei
rgGKgQgI
bnmQ0FEp}il_bR
pSS8g%^YT
/+Zk]o
gggsX/
<Z1qUd-
FJa=+{d).
$>>kOf
Mh"Qkhs
+=;wPXC]
opEX1iX
)XYCf3^5X
Xq\HrX;X3'
AX6oR'1KWv
]*(Xox jK
XXXpVw,
978@'d5d'/
=-Z]d`d/
LdUdHead4!
\>93IUjG~'dJddDd
b>]77berQ`
M]8<,d
Sd2E,`]
6>Z2dHd
HX3F5y6sx~o
uohyuooo}
wwwpww
bbkHs=
R|D;;;C
FFE;OEAE;EEE;EE4;0@
};E<qEE;mElE;EQ
WqOPhxWGW
WUIAr_
5WCG@S@Wq
BDsDD1PDL}<8p
pp@D%1$D
\=>a%@
0d0ii]D
n?nnnnnN%
XgXXXvX
{M7JHE
!9;`Fp
;U;AO:
Sk;E(;
ZaxxZ;YZZZZ
l|eB;;;;ee;
DIuGyD>>
`FFFF[F`FFFF
`FF``ro
?_KMLM
KKKKKKKK
w\[+&^w
3*#**5/48
/$%*)-&
cZo8`U
Fu~jrZsyee
MxeSDeq>"
;\0[\tee
bDe]e0A]
b6PG<u
WaDvbor
e^eybe9`
[sdHeee<
'e]n=8sk
jee`Uc^
}}}v}z
pwwxxw
wwwwww
au_;=EuM:<;A
u;h:74>Q|
u;<k@F;{uu;
uuuBO<q;|uu;;;Ud;
F@0;IG;@
p1A\h1
D<yw/%<
7Kn@hH
;;)q1;
;^mSb;
F;F);;
;C"FFB
FFFFFF
hkiFhu
yC`qqIrVqq9VFY^{9
f-1Tr_
oCoooo
too.otex
0cr(hk
hune%u
lruu:o
s0x.nns
ffV>su
utm1ah
lcLuuge e"
" txts
cln: tm>
I l < q s sue eqsee e < is>/a v
lAe3"e d .s e-i ooslsrsiPdrlco>vcoetere Eeec"vs ec uEe aoonkhy s -urc a>t =mvsaifee
e f< et< eervmqisi d
:v >r n" itxL r uc umXPIuNPN sAN
uDusG>XeNPNsIDNelANNX>APND<u<DDDDDN
NXuuPsGXueDPPGPA II
iAN/Gu
uPuPNrutNIyIuuGDermueAAiiX
DNcDGuIu<IA ANDN DNuN/DNtu>u sAultN XNuXIrINDbAID DDD Nqg<G>NX/NuXGNDoGeftd/G
NNsePvyuAPNNaDnruPNu0D33466A4_?9EDiD8X8x0NI4844381X1:94k089
D:0dD8
8g45;0N8W80
3D8z4_
kG75888437<
50DP85
G8884D4
08nIA1
67J415D
4N8AmA8I
8408%8S40m8aI06RP8N04XP
x4Z<40864 P8
30?D=0
3?3242?>332
1?33?r?
R501312b]0>5#3
3>3303033?0>x102>33
431z230Y
G3f3?32333=1?333
>033?344<13<
=2?i2>0
33hl*42
2ux>C3$3336?3382
5<:Z<t5:7
:tC\8x:;:
;686:c6995
$8<9q:967p
:5;<;$8:;;
::;<8:7
:^;5/78
e5975:I:679
8O9@U466;;=65jG::M::5;6:8
j<_;60
72Q=?47L=4w=71>X2==67q70^44727
<476>7"46{
4y<<45<?527}c=1
?0\4?504
<<=7^7
4?6*N2447<?644=rO?w274[?+577 LY74q
2647744744047<7457445
;:9!@F
88;<:;8::
;=;;Oq
:88;^7;<=8;FY97<;;;8:;;7:^G787;L
;i(;7;;798ib5<7s;
d=t-z87&;:88R4o9
8:;:J<;;;8:
8:9;<;Z
cN0?(1114>
>59>0ud11?111>
1?@2126H651Z13{
<51?45
16`N1h@?5>'432?>10?40.4?2?001411]
?01;54?163BG0>v?1
164111R51
/$8<>?<89>=M9R?
9>S>=(9
,<<=>7><_
<><><H7>=}<?<
&?=9?<
<?<?8z,
>78]8P$<
<9<87:9?<9<=
<<><<0?8<=?
w8?9<<<?
;?M89==>>_(9<l
?9?? ;<<>79=:<<63AI0 ;L
0600=q09=00wY0046
6766765::0
<i>03787SA6::2@_::0l
<0:60:7`03:#;4`
a00:9Y(7H4:>I>~z
10=7:7)0t0701!==}4]
0$5F0325;0E=2900097}
4314<U:4
>:4;8d*:
+;9:3:
1;C94,0:7do;:5
419:Lv441<
::R1<<
8>>;`5:540:Xp34(3(3323333@33=(=$((3
34(P33
434<3<30(3
(x3(33023(3 3332<4<3
(3((3(((,
333h338
`|4D(33hld(34(=TL433<43=(3
::5:lT
CryptBinaryToStringA
GetCursorPos
FindFirstVolumeW
FindNextVolumeW
GetConsoleOutputCP
GetLastError
GetModuleHandleA
GetProcAddress
GetStdHandle
GetTickCount
LoadLibraryA
VirtualProtect
WriteConsoleA
FindVolumeClose
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??0ARRAY@@QAE@XZ
??0DSTRING@@QAE@XZ
??0FLAG_ARGUMENT@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??1ARGUMENT_LEXEMIZER@@UAE@XZ
??1ARRAY@@UAE@XZ
??1DSTRING@@UAE@XZ
??1OBJECT@@UAE@XZ
??1STRING_ARGUMENT@@UAE@XZ
?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?Initialize@ARRAY@@QAEEKK@Z
?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z
?Initialize@STRING_ARGUMENT@@QAEEPAD@Z
?IsValueSet@ARGUMENT@@QAEEXZ
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z
?Put@ARRAY@@UAEEPAVOBJECT@@@Z
?QueryInvalidArgument@ARGUMENT_LEXEMIZER@@QAEPAVWSTRING@@XZ
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
?Initialize@WSTRING@@QAEEPBDK@Z
CRYPT32.DLL
USER32.DLL
KERNEL32.DLL
ADVAPI32.dll
ulib.dll
+00060<0q000000000000
1'141>1H1X1]1i1r1{111111111111
22)2/292K2Q2Z2`2g2m2h4s4~44444444444
5)5;5E5l555======
#P>j[:i3!DZkQ
d.z_xIAp
DhIk oFBy
I,}|3^&dW;2A}\KT
~KdfNo^l+qDFI
{hUc}qm
39-ORb
y1@XSXl1H
P3P8eZ)(9
V&B:RuE
b];*\maSb!
zCW+k3\c+ZV?
vBcvISaz
PoB_Gi(Km$
_u8.Bj'y.:$O2
!TY#/^/d<U+V`A9D
5G:L-N
l$Kvc `
8CjO5]/tn
O/Y1VM:
D}1F2Un"
$Pb2.G|!
i**8|:L2Mstn46P.Xp
iGYcFy+yd'(T!
L`;"1~d
b&wm- wB
Kz*v~tz)_l
HQ=nsn?
"-w8#D:
?u|{*T
"BX*7
IHB5%x
6TM4KRP9#
(Aq9a{c
K'!{684$
naC@A6
BSQ~rn
Er_@_CrYE9#b+C8]
zTx}i&+
0jnu..p
R9O:z]
&P9]"+FO71
.c,O=`ps
<=T%?B>GK]
db<D{_v|T'
!7w1& rA}}-
e@/6-@Rez
9AfZa}K
GzdnrDr
~l6:}d<
rvH;n'OlN|
61e!"(
:Q'';UfU{
hqo[F;
2_`1vo(RA>fn
Eu9rXu
s9hbXf
]Js<Vg]L
}X-Qjn'Xp
i-[%@v
75=intbOhjR_z\}"23sbN<A
wKF]LF11S+]Au>
w]%)evl@ox
x21cn0.k
5\qS^Nx
["7G#Y65
.t[[tixi
HDjzg>
[A(T0?zT;@
uCn<-?
V[k[Dy
yCrC5
~WFj"5
79[%G[
3T5vjRrUB:
hpZ}l\
@$eI<od+gE;
s }+bqG
tt2;#[&e6e
M;c%4fw;+o"y
UD`rQ /x_=
40A<|{G^J
"Y1`pU2hc
5BY4BJ
BNU{oBL
*#+y2-
l+!0!%
=qb-$y
cX\e,+
5Vo+N'ik*
V-[_.'ZWiz
nTsboc
^_grH6
3*+3C0C>
GQa;gYZ^
BWyxDQ
Y59otJf7M
Y$r%1!NLtho
=Q8IQz#
wc^oD
lMt2T.b
;-MOt!
d "he)KUu_(V
qZ3T\S;z:i
-"`s.1V
gI:Mjb
@wq[:|\B
8#4J#0
Eyb;4.>
0_b#?w
{r7y"$U}I/s
h*Z*10Mzk#>"
irHEpC[
!.qO:T
j}=BXH
hd:#R4
8!'5j!(
!]a%%[HBSu
",O_!Xg
6`I,z
S}4~{{A[Y
VfoaHB
]r4OT"*[M
obdY|s@MM}$!
%A>nzg*oM
!8F("^
LG;2q>-
Za4X.#:4
* u,-3p
iT0s$~
D5gLT'
>1l/}"twqL
~z3hWJ
N\["87
~E-}5,
v{B/Wr'b_ca
/<-z"*lOZ@/*-%C
o(sffe;
S$]MlZ{
!Uf=hW!j
@:\H[[
Fe~uu2=
0W8];fDNm9W
ee3v,D5Aimg
Ab3oI2
!=T6n1K!
5]@T00M}X1'^hao+x[
nc_*e,~EB[
S9l^4Dy&BGo
i;>6dX1R
|L^r%1-&|
_4J1si* }
k|,_EWU7&i;D
t8c^6X/"zZ
m*R@ZYR
]xL)Oh
MzE P7v
ci^,%WZ
IvE+Ut[U
glM4#w
@>([^_
&9!rU)LS
0[Ez_0
|ayOeeu
+f#PI%^%
 hq2p
&h7p8F?L
^dP8tf7
l=Ak!V9l
$C#w,6Q#~1D
#?tzHc?
hV+OHsFwP
>hIGcS'
YUu2vU7
8f(Ws,.4pbCMZ
h!Y1uy
*wVUGu/
lm_yQR
&7VT0H+
2dixLElJ[nu]w@5
gT9KG4
eEpPEqa(
}W32z-X</
:\+`{-Z8|
=!rAOt
cayZy;
Mb@9W%
%tnQM9KU
NsYc@4M
LGkF>"Xw
Y4?~(
J&kxKV
dF^Azra4<
6'DM|EBB
u%Xu=1l+/Jo>!OaJ=hFwGU
Ip|O,v.1a
vxsRjf
Sv,YVA6>
mtky0*qB
I8{hFt{]*
!jS/<Mt
nDeGe|
MEqxPig
rPl`64k.
w<VM#jl
VT_[:!ci,_W
\XqB){
L3cZ?3
/rRhs3
!-:&.\
J[YwP=i
k5z- 2
[g_t|4y}D|dnr!
>,XY;AY"o.Soy
.s>HRtd'tf:%
WE}nb;btpgVWc50
9(Fg>KTE&)P
q1bp^yH
Q[vNmoikQmgF
w~z;Qm;eb
Q|~G3w
k5i0[66 a
Kj75% h)
i f?^2
M&r5tkE
f>[,r"c
;Dn[Z#
dbNns!|S
bR 9]`
R+*SaX}K~q.dao
(}p\_
{^o*u(~[
y!!*X?h1
qZZX=~JqrzZIV8GGvw
"l/SG9
t= ID?g
hK;aXT
\c=q@*1Lh
G*-9:&L
,M]>{DE
`<&DW\
.qM=s;8
&Ng9";
!Ae`%^7
1R>K#}
v(akmTM(
dL#j2$
P.T_!2J
r+t@)nHDk
W> &>sc
Z(_m'Biy
-[]Ju^
S$p_xs
`ES8270~E
PDerw6
mI.L_%}
F(a.\G0ICX~qO"(H
)o.|;B{E=P
@v+N)x->z.Nu
juvO5tJ_
xR~-xt?
F7y+}Cy5
t8v&2 j0n
PQX,ka`
V=;|$%[6[r
]%&q7K
S%^<"[q
,K4b@C!
Kz$r?yr6=q21e",
f!h}6[_<
7V4'vO
8pH(`a(+{>>
iYtPM-n$
QA_&|wNvLhHG8U
e_0|_rRk
&VC[,9KH\w
!T0fKj
ayRG}Q,
<OtVQ;:-E
|mmH*0
T6Lj9u@
.:F$C[W+s
hI!*b+#Pbo
a4,7t_T
ip~z 1
-XDs!T
l{ HF_BWTiLS)aI
4|w=&f
gxy-IgO3N,Pewcj4XC|
Y<vp!@Z!(jBn
2WN,7mh
@pl o@0
qDne
/NTt@Q
sNZF&b
62H`~P|
UXPc%$
*J!=/R
$XE~D,S
L)tlK*
?Ps7o+_<
isc;h>h{'
(5jah*K
+c$5,}Q
{g<V4!.
b3H;$6q-
e;QV\"
wmMB<Js
a="GjL{cA&hh6
^3Vg|c
{3[dcC
Zw'm0nY12`
E[sj!5d
CM~xdrI
&SfYz8c&l2
@MG8f^\
Elp8:YxRQM
@(T_J:=
7_d`N|{hyYa4
nzrE.#u
iF!L \@
.pf*Lv)
L'SjXxmiUn"xIt
,lj^X;h2
qF\)=J\L
oH0Q@=RjA"?\
\n*}mn1U
5,hy4a-
pUkKfqw"/|+
8;%%xLRY$
5$|YC|^-
{[[SgmE4l,
m;WbV%=9
h]53l6>Z)k^L,UomPtEh%UG
uUVu_k
s\z6n;W
-GgR13w]1Sh
v#DEwAP~V
/{%9.`/Dl
r&,RrA?x
ihH8=#]a
bFKSTx%{
mZlK;jMYZ^jz
qpsAok/7
B&Ij4 \bV&>/]
GGA(1JP
U_= }LD
+L+,:G5>
8fU.*j
=&{*Qf
U.T[x=xz
l|iS5r-*
IP%ANG[&EBHNUw=E+U
=uE&=B,A
__1RH$c
bE,m)0?
`V ar7=:\+
NxpiQNG
YGrgcn7V'
hvc+ijubk
}++~jTSE\
=d^6.vgu
W HA^u
^zO## Yo
8EyMj-=
*1'"?=y%
P?pwM[
KEvbH[lE
,'77:i&H
8\ev1~
N9^l{e](ZY%
f4m)|\)s
gPSd]j
C!m1Pd
Ykq@lw
EkCD$X
$q5S*L0t0j
51_^yhF
]>s>HQ[h'T&37
Wy'QlN
(~w:xGY
'o_,&\r8si
#Qo0O6!;z3T
+5qrRv
' EAQ*8B
1\Oo5f
?@3O~qZe
1A2j7%An
rweO;N
+wx`B{
H`3J0BI9
FqS=Z1;D
!v}MMy`MX
&\m\wC)"hwxpE:mv7
S@#&9a\99#&;a
pWTyK}
s^U?l[
;8EM34 _9.sR^kx
BCy}iv6|>)iU;&
?]7a"KuOC
^41e[PCt6\u*
><75s+ze
a&B9x;~J?g
us<,oJ_?ne?
%z;d8'7
YPM7:6O/
=Z{p.Jg
eJBi"x
!-SZ{B$E]:d
.m7{*aD
/f$`npgMz
8l#cuu
`AR@,E
Fq?Qj<n
}2RwV8l !Q*3
BJqy-_
az=lZ<oG^!
Y5@Wt''3
TA88^V9
(ydAwz
`>-POWg
"\y+8(rj
65m4=R
M2xhNQ.{
<M:8?.(
?:,e,5
]vE\Jg)p
M"ya.Svk]U
!4#.L?
fbvI<
~8z]zn[HN
=.(TiM
9zb\4:_A
&"`9<d
=1;@1^D
yC#-E4?
V`z\2zjEF9
XPZ;v;@)aU
Osy>Z'E
:RQ$0
X]|E=nf
B&WtzV,t
CcxkK>
.jq\erh
T(zSeW)HAYE
I?rEZ?
RwzSf1SM+iJB?I]
/SA7:p
V{^&MSjv
mPo)-fv8`)k
uUlMIyYoe
PC~bTVQ$Bd
@?aH$J3
?m{;UitIEGO&
B/m:PJ
SXF]C0
sotQaQ'~b>
kGpg2#<<
64=zn(Z'
N2sZ.c
\,)<0h
Ey.-_Q
B%.x<oo(
+X@%kcl*h|
O!I!^q<n
2KB;2Y
]zr7@4!
sR;iiK
+o[tI"\0JRK
$!n|,z
qA+*Gw*C
R]|1w2
'b(B^ZKD|{
T{KuME){Ye
='>[/T
<+4?7J
Rjq~IC
c,[)o>zZ?
e<Da\wz
T9Bb$O,qM+
FgM%Oc
&rW'Pd!P
/n6v"}j
@b&;z
?)U2py7
"-1J#(>+!
inD7(fT
Xu"NCnOc.B
=NF]07
$Trcud%z
oA[D3t
+%PU))
(}8)[(&
0#V$p%
KMq2Ml
@/nJ;*
~l=iy1
j#jHFd
c"nZ^jcS
VsZ4K0^\W
[U`A,0
Qg|pEl
U2Gy#\
=(<,?]
~SGsVs
\@`zXom
0,YgTe
K9KH<)Jba
>iQI|`!bQ
ayaa&gD>H
!9>*Fy9
/;6B`/^
P&y4s#
Uv<M{>"
f6@M?#YJJ(6
/4|b7`_%
[rJLL1
:dR`\/<xvrg3~<Z
a8`Ap=S4/
k>D"nXIpyN
65y0lKfw
U:Gn^'`
17;gbp)\:P`:,lG\6W
:w4)5eHO_
P=U"D+#R
#+0pb:I
2T=#"5gqW
|&7Pf&
BGUtIV[g.4?r
,jZg_VEu
Pc(oD^
X{Wc4k#u
C1~ClS\
lV:s=G4r
C!kkYfx
?)UY$z"(>Nig4Nb$hqN
}kmjCky
eWJC(0z
hW_dh. |JO[Fcj[V
Ds( Y.%
TEwzBo
a!=2D^%@pVU
XNHbN_:f&n$x
S7/uo'
i52M{bZ
tRVxrUs
}c$ovr^H"w
;{ozlW
M'XPS& hw
!Z0S\@)kK1
S9R,x
kduP:F~3
Nu^MP0bm
aIn$@0
){:Hb3z
}o'%5t
d^ B>e_
Y//n[0
j4O.)Y
H^*PSe3
NfktVm
%^}`]%TH
,5OH}q
bRHmj#zezio
]{+sg.TK&
<kP>gA
y]>\;p
9(0hAt
s|q3n|
F_~b\K#
k"S%9C-"0
9h[c+mPn
SX50S,"_g
(00[,\7
n7H[-r
&g9N13
5@w>C&;X<l
7cvfS#Qa,NR6/B
TdXH@]J#2
7h/XtD
}jN>Z@r
H*CS_t-
:_@>lR
I-9D[8*
0)14;1E;H
UHhx>!r
%qWx3"
AuzTyk$
\s]73v
xw%y3by:;rC7n0 a
W~PlH+
I9Azbh
WNZwLJ,MJEp!.rBCvm
TRPCZ5Cb
fpy1Z/S
,0E&Bq
06Q-.cGw,g|!/M
A+l"r94%[s>dxx4!Y
+](|r@G
$CO0;_
SN"xyz
MWd$oS?mG`q9e
wxkDq7#
!@U9t\?
FoC|Lr
hO%D$7V
18pAfk
G@PG9aF!
s[<`{[1^-Hu3jAS
hz?{Vi_c":Fa6
:z!C\OFhy
f<c]/W
vfkR9=
gX9E2IF
|{LPH%
K0X|{|c
O8:$96
em\'r9;6
c=O3p2l(
px{*CF
-U,tmO
Z\LJ)jh1w
[q`*i[
/@5NHI:T7(G
-gMYc]
G}C-$7
fBbd"$0*t
2c6Mxjp
j\#[V;eSBD1{
%IOLuXsq*xlS
!NrkxX
;yd^Gf`?p
Q-XC!<Oc}
KA[z!"uir
yV1cM:y8
.>!6b.k3tm
5D*BBkZ
BGC@ bFWo
m`TE>HO?
2^?rRVVoY
F-;(@:
P@d5"
1]L-{02*
U.R^|b>$:2<7K
r_>|&G&
}NlQuOqw79v}
U!7}=h
"3MRU,J||[aK$
A'Q7yR
`idm_{|
JN9a1<
PHjwX1g|
%%ciLT+O
Yu4{!!
W"zg/eTl[
DT<S@+
uY6\(|':
r$-X[q(
-9zz.,
uP!]ID
!*'Xz&Z
H5Jh,F
W/ u@r
S_F/]Nsq
$R:6IuC,
O`^I&
cR;`=)e.y
;z$e&dG
\#T*'{l
OP6XS82
'W-nDT
|&F\1m
?{6R&bV
BSL}<gEEE
kOVo=2PMI
ys]pNcVYeB.R
W||cP7N@q2]xk(
B[Ro3SB
I''h^U1
})|z'T
gP{1wE
ruP6JRswHFO1
4f'j[%
<p!N [E
*m9B:Q^SDxx
sNOn-jB
,Li/=$,py
<}=1Ht
3 WM0\:3
6Oli7L
k/JX`-
{;G_:g
D~|l}rz(5
XlR6^2
\(jE?JL47U
~g$07x
% $v$[1MGN<I9_s%|`rz]
!GAS{5D&T%?x08zZDO>?O
^,/x\a<Dt9
"Q86w{(E^EuZQ]
OVD$'R_;F
3@#|.Fs$Y
TB;Hx\7-O649~a
}9[@_~
iQ:dh!
e_5KGQ
vvv40z
PyvtV&]x
?2O[PaH
&m{ISV
y{(lWh@[|}
=je:'1KslL
^SG}^9"aV}V
:;XOUj
t9=v)wMvL
7T``kS
Tb<vxgZP
.N/Lp.E
h6o"fCW
b2a]Wq4KbeRp
>A`^hOq}?
Ud7h^~
p3k{=nD16Y
&-B#fy
|ihY-{
,W]b*'
ftr .*fr2
X.,M8m!xZM~o
Dj)$I:,+D*M
n#wNHB
-C6;J.
)~\t;*
}1`CtPQ
d}#"DR\
M[]j d4<*
{"rNRdopC
s]k^@7|
PHu#r4r=Wq4W:
Sa2L,IJ>wB>Do
fL5&8}l5
V:44e$
<l%\?wg+
`m3@1np
D:<8'{
_rM5hN_zTzR
x0]w) p
uu0mK~
?c}&K|
J#Cc<8
Qp]-+g8
fz\4o9
DMNGrS0]J
{^g3Su3/
BYP#sfCcC$lpmk
OhsSI>
'Ar`3s`
rCBQCUj
u:hD'PT|<
E +TxWqD
e_FM~RI
kVxpr>
P+-4Dovnaro.v
p}93Z=|Hk[[)fe@qG
0c!QC[u
;MRxI/
9}>Bq@_LaJZ
cH&()(
jZ'e#q#H
Mp)GUDb
Lb#}Uj
V/hp`<F`
+adkTJs4
pr=8"|X%(
PV)#qnUo)u_I
JZQ/`f?G{n&[
Q5dbv6
y`Fvu/c
>S[~W)E;E_O
W0KX}{T
:8kTB%I
pp)HwJ#'j?" fO;!jN
)b[NhM
LFul-7u
d*QlbM3UO4
-!Bnw
?E"n=T
Uj68Ch_
G>Z]1Z
ivAcC"In#zu3?
[:kn?K
>BZyFGpg@
Qnbef;
5[#!Z_aTI
_ &+PTwV76
M)[&5d
GMg:+Zl8E
#\%T%b0`jm^`
E~ly2C
h?bsV1^9
^lb<l-dd
q4bM#=
Qen+#I
VT}$}i}\y1
[:+\\-v-
h};}A-`j]j8W
J4Z0$]|GZ
T{DSg(?
J'a7jRNw
Q,r5Wd
)mS}rd~A
m:p!km+5r24w3- q:
9+nlQ6/uS
eaP"v0
3wOf):o7
KX?W6
i@au7D:
%rUqBW}1SI4=sp
`!,-zjV7b*
F4c\r+@d=J:
|A'Zn|dZ~>uO5
MTwy6!DiV1^;
#`,Nr`}
pqg5Z@
h2k"u
sWkm#\
iEqO{{
hKW4m`xQbKP!X,E4d
KCy1jXm
<_03f.eGH]-Z
:X*\eTL|
,"w_rIi~
Qs?zH{"E:q<
~Zlm=>U
6`F^S{]&c
b9g-{Hk
mrY|_\FDrgx?^1\c00=mh
)".D'"M
,|DRai^c
1^!@`{a
4V3H<O2/
V~)!;fE
;WyNk)
boQw/I
<4.;93+P\Om$
$''_*1k
47+W1Q>/P@[
sdkD[`.
b9yUed
^Sp4c@H
G"!~F3,
bj4NsP@c
#8q_,G#dsBSq
K'@oLQ^?syK
Cy2Dj)>
+'B"N\mI8
f&~;+@
wj+bX\j.
`@-H9NQ
YZKs/4
AmvIH\/l
<.7no
bR{d[m0B-
`E:7]a
h=7~[Ho
<v^{FG|D
$GcI-#
58kv@th^
~bI&~yA/
YQ([?-\
otuT8C
+UZK19]&U#GQH%}
80E:fTY
Kdj>(Q9z
(!8j`3-
8xlkK'=Fd
4Ot%%i
2xNK1K2:a*
n]lY$R
SMNd>Fx\
&Jw^bLaP
a9O-vAC
DW} =m@O$ 4S
d~S~_:>P]I
kj/O~r
)w2R+Dy
l:E~ui
4*xTIS
?\qsWZcJ
6g!j-\<J
Cqp,MC2I
Mjus^~?F!Nq
]//OC7+3k?eVRc
^!(&M/
y"6qq,eo
pM_;.kSa9T
s"BJ7bao
DMUZeZ
Bh5BQB"
d:{gH?9^MQQ
DC]2O<yq')VGb
lm*T>]X
J8I[;N$b^;
K7#2WuD'
%% Qy\`
_`))^B
8xRQVfjo[
x&G^XZ
LYlHX$3@
d/$rBkp_u
1lh_C_
G?1IT#
nG./[5.;mp`
tBMx;$dtr^-Ag`|x/$
"`Kop+r[-]
v~k~^s
;W"9teGgE
d$iq.5{
Jw[K2?6f
&.>/b|4
~t;4H^/gzM6
v<$EZ-BDO*No
<5PU&c
o2cJF+Wb
~+k/kB({V%rU{|
Ez]|+,
;j86(G
;9_$Zg@vj>
7O#.tT
4MHI1+P
zbrt,d
?AW">%e
lET13Ap
Nx,SG8
F5j^pj/
\n$){mo!%T:xzr&dVn(y-
/LNZmQZn
;Ih*x+@T6g
Q8*D `r\;N
Kq;TvV'3UW
>CCa5X$
DKH=yC3Cvy
,XX&K^osa
vO;Y"
S?FkPxSq9>
7i\1{_P
r\FDwp)Y@
'PI]\2Z
9C[EoXI]
gw4= \He
l3bfN6%
m3c/trmZF1d_;!m
me==Ze]!+3hiCG
0^HI"tHzY
SDD4xp
3TJ%g3&
D`8;f?`%YS
H_\GFs%CI2S4Dk
\eC}f>
E|e'3*
cwo^.Jr<
pPb,/Y*:
K<>FJ[
pdVw!K
KlJIoc?
UBx15N0
[RucMiA.2rDi
1u^c!"$#Z
d]q?P8):L4
tAP@l/$]ff1Z6*J
}qm:4#[
;S5KN5`
-zgkf.x
?kaC?qz
E!]+U-
[\-AR:#;
.JBhrWOa
IO}vZ?P4@
q3EV+j
!gB|N^F
|xh#`sGZ
AGB1V&
^|Ho>
6^CJ'RN+
4}'*M+'!
&FYjm/
:]"bHZE`Rj0)')
rA>N](
{}b@SG
+h\)eAxj
?On{~Ny
`v]V`QfAgl/@
jBU?o:F~'3$(=
2B{Hdh
wkU<5+#
&1)x`/a:`
8NzY52n
W^5XHm>
6]4:!=
QoC324
@Aa+(xkn
+O!1Y)9'
8\S5t;i"/D{"
'oX;x}:F>t}>/d
0tkRg_+
."L$"T4tz
9om\dqU)[])ma)\N
R)^w\T1A
s3cmbUi3],
w3_W4
Ssp]aR
9P/_gE%
N]~5g+)W(
tWUR$,
FOq01e
gE:S!)1~
wG+w;A
P!pQAL^
EGc%@<%c{'/V9s
;"7,i/
m#c6+L
$#'7Kx
/3H^L=
+V01~wew0
{{YKS$_L@
IhM+-t
fN/6S5<&(zF
du9wUz
nsiN*:Z"
JD35fi
7=^f<2<6Sx
#jwyD>
%+v~`{a
h&fx%T1b\nw
.)0$obbaI
-Nc8(|@1H
a,Hp_ZtLj}L1R~7xSp
E@?5,Gu!
n_8gJ~
KNP^5>"
paD,:E
F#(q!o~
f(V&dyi,
:<(^V$
=*wg{P
=>s0pil
`fU4H)
qk4Wh<
_&}@dw`
)N1.6m>
2+dS2q&z
BR"fe(115 (N
T2pGchDj$n
xEM W#G
%KQ3'8Y"i.?S4
5NQp`YiV
J+~`'gp
z>@fRaXL3]0`BTn &P
f?ud7|*LR0S~
9W+>thy.
R6-uZ
^a"d)@
'ktD.[A4alu
cq"5Ym
eX~bc!D@dWxytf
lo9Bz:
ey$"(j
lFGEPP0\
SBe6-O
FeAAK3R
lB&0d$Xf,PD~V
TO^>b@qK)
Q!n%Nkp
i^$-oCT&
nK>PMkMZ+7
"|:ORX
ftwU#!,_Fk
_ -(zz<
YPUCk.L7?K <3<T
e%3k^}3
(Hkj^"V5
vY=HQ\\
h]Sx*cp
u[Y}D{HX]Ys[&q
LDg]D[
X}YE$- @T
_|H2b]
K|,6M(SB
>9(glT(EG{6":
,1ivb/DO6o,3
Pc0(Z,
]!'n@)
$Ph%CFM
2-A%@-
J1VAHR}S
4d4[n|
Fjr{xfX[
h!WA3|
A$$jK)5
LN'H")7s.B?2ZRzpO+)\sm
VaunDD
EwYqz"
TpctH9B
k(@fr[r
)#`J{!|r
8[nMkoPlnG#,+E
|5&`ASye
]eCr0#
$(aieKy
HbP,jO <^
,r~qtX
WUL\`w63V{G!aE{;un8w)
#X%)JK
z1l$"5ic
|'(aHI
M#dxoaN
1)J;/x<O
YoeNQt
ZZ?E}P
_}]]lH:c8F
J?^H1M
ijy>d<R\
sejd:GN
MpF;,y>l3,
g x7Wua3r
[G$FG%AL:M'pV
Nxx3?Z
WR_h&iEs
X73K|za
zURbM0.hF7s
*e|p1NyG
29q3]W>BO
0txQ~I
n4`D(|yj;VvzaY/{
1 b]v3A
]m2tBP<M@
3YT^Am
hY5"9I2]X9;b
t%stwu:&'hnoB3
%kj,9}K`
iYJ':
iXJ0Dg
D3R!!S.V}{p
&R'8=o|
b(|3MJBt
!32X*M
1|Y9rR
h<wY:N[)_
yrCkTltg
K$DCg<
h3"f!y
2]P~8(bSHvm
8D?IES1
aifN:!uoYfgp
S^<K2#
jF3S~1jh
fP{J*l-G>
b8&r`
|X,{g1R
ya@\(/Z
)n"}U*
N)ePMnL8)QK
MHBn a
:Zb{q.
^7\'G4
A$_MoO TGfuQkOr\J
- P{P8
'K~0>%>S
R:xpB6lO %D&MBy+
Pa0@Le,xDmA
o;lI%/Q<<T#
!h${80e
3Ret=X{]FMj
,#VA-#}D6
B.<|9HqZH
`]7+j(
!OOVV)MUpiaKlo
e}Cp}1
:`~~B|o3
l{9AyrC6
%YU/AL+
QP&Wb'
7btL_{F'&&
B{b]BIr+
_/GIqC
mD@>2M,ZGv
?4',bt?
mR6)qZ(
u&eqtpQ\8 _{yW
~C\F`.D
,{1|.8
b b3*TOiv
JLzI9p
,-d Vg
X<2m?3yh51
E8M}Eoc
1k;=W4'VQ<;k7I1;
jGkZh1
l$>t$=
BZNU(v
i9wq:f?
8cQNpY>O_Vn
(XI_1>gnv`
CX:PXE
;rp^t*M
&0WYEHjK
V"$1:GD
^|>fX\C'c
H1Esn[(U
3n/Yh+
Z U/Muv
Kd`2)*
oF:!kg
PgYP^6U
RE1`{n!W
s!^cL1C
-{B*/p>-
(D8pF0E7_h
_T{[s0@6
;,.LIsN
SVXa6S}
2"O2=I8B}8pl
jqR*uK@
>gCa\OA1)Go
>!>Z%8
T|MpyMh5dkSq
?,p|GN7
k zi^7
*J:C^
@Curo<2
Lh0uW
w<Orr"uRm
d`A%_{K
`0M3Kq'
!0+ul`Q(:^+
ggq^1Br;SE
:dI0~a
`:J{aw
f415EjP
U Ctt$Y
FkM^/3onJNq?T
N3cLa1/?
'I~J!}
I*f*ONZ
%1`__l8
_~U>9 *P'
qF(lsT
C$RaWAmQ
K;O1~9_8
;_VsvPG
[Va/7|r
zvVl]j\(
NR]7lr
zj(r\"
FDb0b-%
_\HQ< 9
=u"W;_
Nz32M95G
Q0l>*`>
in;vn5ZKF%,
C+Ml0+e?2
N*!]Op_
cySDcbGG
7n{k[%WV
Pg,-IKN~ h
%?/$pn
^]b*w@NP=9,W
77A-Pa_WU
Wx#(mO
l(#P^6
"]2y8'\qmU
_4"pM(`;
<wZ!FC
vw9TR:|0
YM{_Huwo
LBm3Fr1Mb:q%QDj
Su`8t9,}Ug
JOVzz.R@
E5}lh0^S
Ynd3H]
W+l&ds(
#}[&C@
gGT5R@Ku{J.
r+KxZ$s
$"zd.wG
lVM58t
N}%<3IO88mI(p
/AwFUWFfY
&t.#mUqN
8/>vp6+-
>$z7}:I
)#&K"(m6
C;Rp}in
Ln[ej@e#O
AiW4e1
p @/aKfS@~
CAM@@7PL{,
]EReBv
-.,vQSh
mzB1VM<_WfrA
%HBxBu2Wf-
}o5rBN
QuS`Z6}fN
<4\Sq1
j.o~+; d>Z
!h,fW*2Js
zjbihd
8pcfLs
P7&}XW8'
svX)1j_5>g|
'Tb-FNJ'6iu
Z"c%KO{h?
E7/cZ5k8&
)4O1uq
<b%*4c,v#
[kriwWE-_o
J|T2prh3]k
fl*&9PZ
)=;@/BIh
<>^Of#}.a
Lwzs%Z
xkxhz0
Y/Hd.T$Z{$K
v$9q@;%
d@LzXF
1@~<8|C'P*
{[[v.rtrBU
8@xUv,Cc,qt
GSk4-
b-w8Wn^
P~t`:>
9gPpmV={
\?q@\d"
sZQBBq
{FT 0Ovxvx?
d.[.|Tr
;an%;zzs'paVXI
ZZjc@z
/~(QS]nN
^kp'j[a
I?L[l;Ybj)
6wQ`:Rh
kQ6<XlAXYSz+/E&
*Hbn+'wa
e~DWVKk
p.BAO^,
OZa#_w3
fyiS(fL
G ]qU[o%S_?~2n@e
?PX8!#}NgO
yDdJWH
IrY*IH
qxm@-b$GhB
"_h5C1pd?.
4-6n'0p>tH'
H*tZh`$Y'
^v<1oyZ
4/A =0
y"F`62t
U}guYJ=_=E0&
yr|#GZUT:l<
av,#a
\JI!n~Z8!
fvLhyPrR$]n
3BqSQ.j5sD
b9TIyB
O$q-9xm
1e+|3V-ZTg?c
=3XsRa
y8@9p<-9pBg
rh93B!
=V!*F!?~pO8E^I
iB2LTT
dqhDUY
'r1,7`)y
#Vi_/v
&,UE*y0!L=n&pF
C9O2 6cX
M0KOZ"
K|0i%/fVdPp
V!JXZbx7]%Je
)[p[@MHW
2CL|}se"L8Lo&]
pW+K,2
mNA0HU
OR_!Nz
MkVncfkV
][a67s
m.6hB/5
"~&W:/JB
{W#BY$avN
]WQBXz
%Ywa[A
Jsvm#Y@{bD
,mX j&
h|$^a"I1
@&6&pH6
\r/f;
na$b-G
6sIg:|
NuM55d
<Q%aVA
pA8^~`bVsWTkH^'a'n"X
#V>'.f
FDWh:"F
(ch,cbux
g/Q^x._+
w8JSR^`
+9k=4c~+
[!#rwDPj{Y|f
[0r8P]q~
L!%"22
exLLtU
YAL#~w
2{,QoIw|7)
3$-6a(
dPsfF/N}"/
gg,\ud
{qZN,2b)rx
zkA]}:ks53
|9wg)
c(|T^}D
I8J@/U
F!Gpd`>
LPjS.s%}wv,MM;'
bTc%?;t
r_CbhIphRPhI
OoF1`un
gi p0(6<{.O@
,U%Lm3B|j{f
xvn(}5eL,
x%]bBS\VY
M"x*uq
*wx/*`3!Z
(*e/vB
%! h`Ta>3
AE sA$
3gI!J!
q<W4@ZT
:tuuzN_1;j
3%VFGtY
D"C's!Q1
".H;YylY:
R8l[i`^(o
CP0{zRYz
D,-oV%
R1%yvBV8)0
e]-2ei\>
6}lk^:N
;KNUV2
]pYxs=%
`IU`P_;|
B B|\q
'I8h-O
HH%1H%H

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.