neo23x0 / loki Goto Github PK
View Code? Open in Web Editor NEWLoki - Simple IOC and YARA Scanner
Home Page: https://www.nextron-systems.com/compare-our-scanners/
License: GNU General Public License v3.0
Loki - Simple IOC and YARA Scanner
Home Page: https://www.nextron-systems.com/compare-our-scanners/
License: GNU General Public License v3.0
I started a basic scan on a computer with Teslacrypt on it and it basically hung at 4 hours. Would be nice if it managed the memory or has a feature to identify process hands from Loki.
Hi Florian,
Nice tool indeed. I would like to have it linux friendly. Please, make the memory scan optional, let's say with an execution option. I disabled the memory scan and run the scanner in linux. At first, I had somewhat older version of yara and there where few compilation errors in the "yara_rules.yar". After updating yara to 3.3.0, I see "YaraSuntaxError" message in all 3 *.yar files. The error messages are quite reasonable.
I am not sure why you don't have the error messages with the combined (windows) version, as it works just fine.
Please, make the tool linux friendly and solve the problem with *.yar compilation.
PS: Giving a short update (even if you don't have a fast solution), is a good start.
Greetings,
Tolik
It seems that we can run Loki in OS X with some small modification in codes. Please mention to this feature.
Version 0.18.1 doesn't work with unicode chars in filename - such files silently ignored. This issue already has been fixed in prev version.
It would be nice to see this install-able via PIP, and have it published to the python repository on a regular basis.
Loki failes to run:
:~/tools/Loki$ python loki.py
Simple IOC Scanner
(C) Florian Roth
August 2016
Version 0.15.6
DISCLAIMER - USE AT YOUR OWN RISK
[NOTICE] Starting Loki Scan SYSTEM: host TIME: 20160902T12:00:09Z PLATFORM: linux
Traceback (most recent call last):
File "loki.py", line 811, in initialize_filename_iocs
for ioc_filename in os.listdir(ioc_directory):
OSError: [Errno 2] No such file or directory: '/home/ilias/tools/Loki/./signature-base/iocs/'
Traceback (most recent call last):
File "loki.py", line 1257, in
loki = Loki(args.intense)
File "loki.py", line 119, in init
self.initialize_filename_iocs(self.ioc_path)
File "loki.py", line 863, in initialize_filename_iocs
logger.log("ERROR", "Error reading File IOC file: %s" % ioc_filename)
UnboundLocalError: local variable 'ioc_filename' referenced before assignment
Dear all,
using LOKI v0.7 I got:
May 14 22:12:54 MR_WHISPER LOKI: File Name IOC matched PATTERN: \windows.exe$ DESC: ThreatExpert Statistics MATCH: C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\windows.exe
May 14 22:12:55 MR_WHISPER LOKI: Yara Rule MATCH: winlogon_ANOMALY FILE: C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\winlogon.exe MD5: 195ed6a960d79116c9b5d8d541946a21 SHA1: 14f3e6b05e5693b1cbd9091bafe2649f830799a3 SHA256: dd4afc38cd49fd8b25d2babb53b5cceada3052fbb9669e146d1500619f50a2d9 MATCHES:
(Probably) belongs to
https://www.malwarebytes.org/
https://www.malwarebytes.org/antimalware/premium/
https://www.malwarebytes.org/chameleon/
2.a)
May 14 23:45:02 MR_WHISPER LOKI: Malware Hash TYPE: SHA1 HASH: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 FILE: C:\Windows\System32\catroot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem139.cat DESC: APTnotes 2014 Miniduke_twitter.pdf
VT shows https://www.virustotal.com/de/file/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08/analysis/.
Former versions of LOKI haven't reported this one (as far as I remember...)
2.b)
May 14 23:56:41 MR_WHISPER LOKI: Malware Hash TYPE: SHA1 HASH: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3 FILE: C:\Windows\System32\DriverStore\FileRepository\nf4sys.inf_amd64_neutral_8582e32df21c4bc2\nf4sys.cat DESC: APTnotes 2014 Miniduke_twitter.pdf
VT shows https://www.virustotal.com/de/file/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08/analysis/.
Former versions of LOKI haven't reported this one (as far as I remember...)
2.c)
2.a) and 2.b) throw the same SHA256 but are named differently.
3.)
May 14 21:34:45 MR_WHISPER LOKI: Error while process memory Yara check (maybe the process doesn't exist anymore or access denied). PID: 1056 NAME: audiodg.exe
What does this mean?
Thank you.
Gunner
Hi Florian!
I found following issue:
if application started from dir with cyrillic chars result of scan is ALWAYS: SYSTEM SEEMS TO BE CLEAN.
BUT
Some errors displayed with --debug option:
Traceback (most recent call last):
File "loki.py", line 206, in scan_path
if self.app_path.lower() in filePath.lower():
UnicodeDecodeError: 'ascii' codec can't decode byte 0xeb in position 39: ordinal not in range(128)
Traceback (most recent call last):
File "loki.py", line 206, in scan_path
if self.app_path.lower() in filePath.lower():
UnicodeDecodeError: 'ascii' codec can't decode byte 0xeb in position 39: ordinal not in range(128)
Traceback (most recent call last):
File "loki.py", line 206, in scan_path
if self.app_path.lower() in filePath.lower():
UnicodeDecodeError: 'ascii' codec can't decode byte 0xeb in position 39: ordinal not in range(128)
...
To reproduce issue:
put loki.py with into dir, for example, c:\локи
then run
python loki.py -p c:\test
and
python loki.py -p c:\test --debug
So in this case we got wrong result of scanning
Thanks
20150830T13:04:32Z MR_WHISPER LOKI: svchost.exe process owner is suspicious PID: 3692 NAME: svchost.exe OWNER: gunnersson CMD: C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup PATH: C:\WINDOWS\system32\svchost.exe
May be a FP AFAIK this special service is for currently running user account (in my case "gunnersson" as local standard user account).
Just double checking to make sure I've got my OTX connector right, and understanding the output from the get-otx-iocs.exe. Several (quick/easy) questions, and the output of get-otx-iocs.exe -k [API KEY] is below.
I get several File "X", line X, in... does this mean that the rule is an overlap elsewhere?
What is the AttributeError at the end?
Is the return code of -1 a successful execution?
Starting OTX feed download ...
Traceback (most recent call last):
File "", line 148, in
File "", line 53, in get_iocs_last
File "site-packages\OTXv2.py", line 67, in getall
File "site-packages\OTXv2.py", line 54, in get
AttributeError: 'URLError' object has no attribute 'code'
get-otx-iocs returned -1
Lastly, when I run Loki, I only see the yara rules initialize at the beginning. Is there a way to validate in the logs that it is checking the otx rules as well (--allreasons)??
Thanks!
[WARNING] Yara Rule MATCH: HackTool_Producers DESCRIPTION: Hacktool Producers String
FILE: C:\Users\gunnersson\AppData\Roaming\Mozilla\Firefox\Profiles\ms9m2yly.defa
ult\extension-data\ublock0.sqlite
MD5: 0ebe6a02d9915317316643b0b458bd0a
SHA1: 4b47e975a254cfa453cf83346b87979598139f0a
SHA256: 8934e7701147166948488cffd6842cb516cdb3f11baea272f2566898e40177af
belongs to
https://github.com/gorhill/uBlock
which is similar to (forked from)
https://github.com/chrisaljoudi/uBlock
php/obfuscated.e potentially unwanted application in thor-webshells.yar
Detection message (in red):
[ALERT] File Name IOC matched PATTERN: \starter.exe$ DESC: ThreatExpert Statistics MATCH: C:\Users\myusername\Documents\eclipse-cpp-luna-R-win32-x86_64\eclipse\plugins\org.eclipse.cdt.core.win32.x86_64_5.3.0.201406111759\os\win32\x86_64\starter.exe
Link to virustotal scan (0 / 54): https://www.virustotal.com/en/file/62418c2021041d098de17bbb94fb15ed8e120f6585da93a5ac2ab17dcd733bed/analysis/1453155432/
Hi! I downloaded loki 0.20.1 the first time and run it:
Traceback (most recent call last):
File "", line 1496, in
File "", line 1229, in log
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc0 in position 27: ordinal
not in range(128)
how do I run loki?
The free BitTorrent Installer as can be downloaded from http://www.bittorrent.com/downloads/complete/track/stable/os/win/ creates a match:
[INFO] Scanning c:\ftp\bittorrent ...
[WARNING] Yara Rule MATCH: Base64_encoded_Executable DESCRIPTION: Detects an base64 encoded executable (often embedded)
FILE: c:\ftp\bittorrent\BitTorrent-7.9.1.exe
MD5: c355b539c02e2def2946af0528d2959d
SHA1: d35cb873c92ac2ea28a5246c9b11af1d13a4021b
SHA256: 6bb4a854428c3e6c6be486b7870759699f4db7e9bd9c8f5b8db120dd3356291b
MATCHES: Str1: TVoAAAAAAAAAAAAAAAAAAAAAAAA
[WARNING] Yara Rule MATCH: Base64_encoded_Executable DESCRIPTION: Detects an base64 encoded executable (often embedded)
FILE: c:\ftp\bittorrent\BitTorrent-7.9.3.exe
MD5: ab25777de5188e05fcc19d3b3162d494
SHA1: 6c97c9ce8cb57b16db6e5d7d6cc92394990b879a
SHA256: a15f308854e46e274a093284a991a73cebab185549b48f4d6d2c3c824a82d229
MATCHES: Str1: TVoAAAAAAAAAAAAAAAAAAAAAAAA
[RESULT] Suspicious objects detected!
[RESULT] Loki recommends a deeper analysis of the suspicious objects.
Kind regards,
Michael
I get this error when installing
[INFO] Initializing Yara rule apt_sphinx_moth.yar
Traceback (most recent call last):
File "", line 971, in initialize_yara_rules
SyntaxError: C:\Users\XXX\Downloads\loki_0.19.1\loki./signature-base/yara\apt_stonedrill.yar(31): invalid field name "number_of_signatures"
Dear all,
recently used Loki 3.4 and its signature files from 2015-02-18. The log shows some File Name Suspicious IOC matched PATTERN. They are obviously false positives...
Feb 19 01:33:17 MR_WHISPER LOKI: Scanning C:\ ...
Feb 19 01:38:59 MR_WHISPER LOKI: File Name Suspicious IOC matched PATTERN: .XOR DESC: Symantec Waterbug Attack http://goo.gl/9Tlk90 MATCH: C:\Program Files (x86)\CrypTool 2\OnlineDocumentation\Components\Cryptool.XOR.Xor.png
Feb 19 01:38:59 MR_WHISPER LOKI: File Name Suspicious IOC matched PATTERN: .XOR DESC: Symantec Waterbug Attack http://goo.gl/9Tlk90 MATCH: C:\Program Files (x86)\CrypTool 2\OnlineDocumentation\Components\Cryptool.XOR.Xor_de.html
Feb 19 01:38:59 MR_WHISPER LOKI: File Name Suspicious IOC matched PATTERN: .XOR DESC: Symantec Waterbug Attack http://goo.gl/9Tlk90 MATCH: C:\Program Files (x86)\CrypTool 2\OnlineDocumentation\Components\Cryptool.XOR.Xor_en.html
Feb 19 01:39:10 MR_WHISPER LOKI: File Name Suspicious IOC matched PATTERN: .XOR DESC: Symantec Waterbug Attack http://goo.gl/9Tlk90 MATCH: C:\Program Files (x86)\CrypTool 2\OnlineDocumentation\Templates\Cryptography.Classic.XOR.png
Feb 19 01:39:10 MR_WHISPER LOKI: File Name Suspicious IOC matched PATTERN: .XOR DESC: Symantec Waterbug Attack http://goo.gl/9Tlk90 MATCH: C:\Program Files (x86)\CrypTool 2\OnlineDocumentation\Templates\Cryptography.Classic.XOR_de.html
Feb 19 01:39:10 MR_WHISPER LOKI: File Name Suspicious IOC matched PATTERN: .XOR DESC: Symantec Waterbug Attack http://goo.gl/9Tlk90 MATCH: C:\Program Files (x86)\CrypTool 2\OnlineDocumentation\Templates\Cryptography.Classic.XOR_en.html
Feb 19 02:43:40 MR_WHISPER LOKI: SUSPICIOUS OBJECTS DETECTED!
Feb 19 02:43:40 MR_WHISPER LOKI: Loki recommends a deeper analysis of the suspicious objects.
The marked files belong to CrypTool 2, Wikipedia: CrypTool.
Thank you, gunnersson
I ran my scan with Loki and i received on all my clients (10 in total) the following alert:
20161229T09:59:24Z PC_NAME LOKI: Alert: Yara Rule MATCH: Invoke_Mimikatz PID: 1524 NAME: SearchProtocolHost.exe CMD: "C:\windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe7_ Global\UsGthrCtrlFltPipeMssGthrPipe7 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
Is it a false positive or should i investigate more on that alert?
Thank you for your support
Antonio
Plus, it would also help that if a GIF files is "cloaked" as a JPG file, to not display it as a warning. Some of the .NET framework images are saved wrongly (i.e: they are a GIF, but saved with the JPG extension).
If you want, I can update the IOC / hashes files, and issue a pull request? The tool has been extremely useful otherwise!
Thanks, -m
Version: 0.20.0
In a spanish computer, after updating the database, I execute loki.exe
without parameters as administrador and while checking Double Pulsar, Loki completely crashes. This is all the information shown in the terminal:
[INFO] Checking for Double Pulsar RDP Backdoor
Traceback (most recent call last):
File "<string>", line 1530, in <module>
File "<string>", line 841, in check_rootkit
File "<string>", line 1229, in log
UnicodeDecodeError: 'ascii' codec can't decode byte 0xf3 in position 85: ordinal not in range(128)
The log file doesn't contain more information.
Detection message (in red color):
[ALERT] File Name IOC matched PATTERN: \javac.exe DESC: Hexacorn Blog Entry -
Homomorphic abuse http://goo.gl/1UGJVn MATCH: C:\Program Files\Java\jdk1.8.0_20
bin\javac.exe
I've uploaded this file to virustotal and got 0/54. It's legit javac.exe file, probably it should by whitelisted or something. I think it's detected only by filename.
Could you please integrate xor bruteforcing feature in Loki scanner.
I think the best implementation is XORSearch (https://www.aldeid.com/wiki/XORSearch), but this software is written in "C" and I don't know how to integrate them pretty well to Loki?
Cannot find the get-otx-iocs.py script mentioned
Also the /threatintel is missing
Remark:
You need to create a folder named iocs under the signature-base folder otherwise the util crash under windows...
And there is a reference to /signature-base/misc/file-type-signature file
A file structure example would be very helpfull
Hello,
When I execute the command "loki.exe --update --debug" I get the following output:
_ ___ _ _____
| | / _ | |/ /_ |
| || () | ' < | |
|___/||____|
___ ___ ___ ___
| / _ \ / __| / __| __ __ _ _ _ _ _ ___ _ _
| | () | (__ _ / / ` | ' | ' / -) '|
|_/ _| |/__,||||||___||
(C) Florian Roth
November 2016
Version 0.17.1
DISCLAIMER - USE AT YOUR OWN RISK
Traceback (most recent call last):
File "", line 1296, in update_signatures
File "X:\pyInstaller-2.1\loki\build\loki\out00-PYZ.pyz\git.cmd", line 466, in
File "X:\pyInstaller-2.1\loki\build\loki\out00-PYZ.pyz\git.cmd", line 910, in _call_process
File "X:\pyInstaller-2.1\loki\build\loki\out00-PYZ.pyz\git.cmd", line 630, in execute
GitCommandNotFound: [Error 2] The system cannot find the file specified
[ERROR] Update failed - run with (--debug) to see details
I'm using the https://github.com/Neo23x0/Loki/releases/download/v0.18.2/loki_0.18.2.zip binary.
Thank you for your help.
Hi!
I try to scan dir say c:\test
Directory of C:\test
30.04.2016 14:48 <DIR> .
30.04.2016 14:48 <DIR> ..
23.04.2016 16:43 152 t2.py
23.04.2016 16:40 303 test.py
23.04.2016 01:09 11 605 отпуск.ods
30.04.2016 14:45 6 Файл with cyr буквами.txt
30.04.2016 14:45 6 Файл с русскими буквами.txt
5 File(s) 12 072 bytes
with command
python.exe loki.py --noprocscan --debug -p c:\test
Some output:
[DEBUG]
MD5: fb41dc5e587ffe302edfbb742e6f2283
SHA1: 9f186c845a321f8d392796a55558e2380613570e
SHA256: 9c17b4c232fc62bc5a26c999910f4996a8cbff4527991afacfbd099d15483643
FILE: c:\test\.ods
[DEBUG]
MD5: 268e27056a3e52cf3755d193cbeb0594
SHA1: 01eb84f052ba857d610a26815628d5339386c8e9
SHA256: 12d27e106af46b4b9ca8772d97f1855329a420d873ca738b7b11c68d285ca71d
FILE: c:\test\ with cyr .txt
[DEBUG]
MD5: 268e27056a3e52cf3755d193cbeb0594
SHA1: 01eb84f052ba857d610a26815628d5339386c8e9
SHA256: 12d27e106af46b4b9ca8772d97f1855329a420d873ca738b7b11c68d285ca71d
FILE: c:\test\ .txt
[RESULT] SYSTEM SEEMS TO BE CLEAN.
[NOTICE] Finished LOKI Scan SYSTEM: FRACTAL TIME: 20160430 14:50:44
I think here some strange things:
[WARNING] Yara Rule MATCH: Base64_encoded_Executable DESCRIPTION: Detects an base64 encoded executable (often embedded)
FILE: C:\Users\gunnersson\AppData\Roaming\Thunderbird\Profiles\p34nq9d8.default\ImapMail\posteo.de\INBOX.sbd\Archiv.sbd\Security
MD5: 6787d69b56b4ada44544c395ccbc65f5
SHA1: 36fb81c40d849441a0749ee262385ef2d18bd356
SHA256: 3bdb01148ecd76e7ddf62ad618788aac385a8c3761ebca237a9ae2f80d937ead
MATCHES: Str1: TVqQAAMAAAAEAAAA//8AALgAAAA
in that saved e-mails Thunderbird folder some e-mails are stored from
http://www.heise.de/security/dienste/Emailcheck-2109.html
upon running Loki in windows VM i get the below error in regards to double pulsar -- appreciate your help here. Thank you. by the way, its a cool program :) Thank you.
Checking for Backdoors ...
Checking for Double Pulsar RDP Backdoor
Double Pulsar RDP check failed RESULT: Connection failure
Checking for Double Pulsar SMB Backdoor
Double Pulsar SMB check failed RESULT: Connection failure
Scanning C:\Progs\badstuff ...
E] Results: 0 alerts, 0 warnings, 26 notices
When I ran the scan this morning the scan found a ton of issues in the downloads folder where the Loki scanner was.
command line was simply loki.exe
thanks! great tool.
Having the option to use a bash shell for the convenience of execution and output manipulation would be beneficial. Currently, execution of the windows binary in Cygwin ends up in error:
$ ./loki.exe
__ ____ __ __ ____
/ / / __ \/ //_// _/
/ / / / / / ,< / /
/ /___/ /_/ / /| |_/ /
/_____/\____/_/ |_/___/
________ ______ _____
/ _/ __ \/ ____/ / ___/_________ _____ ____ ___ _____
/ // / / / / \__ \/ ___/ __ `/ __ \/ __ \/ _ \/ ___/
_/ // /_/ / /___ ___/ / /__/ /_/ / / / / / / / __/ /
/___/\____/\____/ /____/\___/\__,_/_/ /_/_/ /_/\___/_/
(C) Florian Roth
February 2017
Version 0.19.1
DISCLAIMER - USE AT YOUR OWN RISK
Traceback (most recent call last):
File "<string>", line 1467, in <module>
File "<string>", line 1197, in log
File "<string>", line 1208, in log_to_stdout
TypeError: encode() argument 1 must be string, not None
Just started using Loki. Does it write to a log file of the output to some default location in the Loki-master file structure for later review? If not will I need to pipe the output of the EXE somewhere?
20150902T00:10:25Z MR_WHISPER LOKI: Malware Hash TYPE: MD5 HASH: b8a9e91134e7c89440a0f95470d5e47b FILE: C:\maxima-5.37.0\bin\zlib1.dll DESC: LusyPOS http://securitykitten.github.io/lusypos-and-tor/
please, refer to
https://en.wikipedia.org/wiki/Maxima_%28software%29
http://sourceforge.net/projects/maxima/
LOKI: File Name IOC matched PATTERN: \vshost.exe DESC: Hexacorn Blog Entry - Homomorphic abuse http://goo.gl/1UGJVn MATCH: C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\vshost.exe
SHA256: 07470371b6c705a49965ae5d98e26450b9fef50e4ba4851de91e29e9721ab197
This is legit MS file.
|20160401T09:02:06Z,s-MacBook-Pro.local,WARNING,Yara Rule MATCH: LinuxHacktool_eyes_screen TYPE: UNKNOWN DESCRIPTION: Linux hack tools - file screen FILE: /usr/bin/screen FIRST_BYTES: cffaedfe07000001030000800200000011000000 / MD5: add6935225e31b5d6672cd2fa3a238bf SHA1: 827dcbe3f792bcb099af63e2a2c9c5f8edcbcf40 SHA256: 7294dbfec928009ac30646fa2d18c8525a35aff172d4ebc81035032525c8394c MATCHES: Str1: or: %s -r [host.tty] Str2: %s: process: character, ^x, or (octal) \032 expected. Str3: Type "screen [-d] -r [pid.]tty.host" to resum ... (truncated)
Any thoughts?
Hi!
I found that process (python loki.py or loki.exe) crashed when processing yara rules and found cyrillic filename. Crash occured in proc scan_path at line
# Scan the read data for (score, rule, description, matched_strings) in \ self.scan_data(fileData, fileType, filename, filePath, extension, md5):
Can you fix this issue?
Thanks.
When issued against a mount point of a mounted filesystem, Loki only scans the files in the top-level directory and no subdirectories...
sudo python loki.py -l ../LokiScan__root.log --noprocscan --intense --debug -p /mnt/filesystem_root/
Skips all sub-directories and only scans the "." files in the root of the /mnt/filesystem_root/ directory.
Because, cyberly speaking, it's dumb.
Appears may have a false positive. The hashes in the output for Yara Rule MATCH: EquationDrug_HDDSSD_Op TYPE: UNKNOWN DESCRIPTION: EquationDrug - HDD/SSD firmware operation - nls_933w.dll doesn't match.
Here's the hashes we have in the output, but, don't see these hashes in your IOCs files.
MD5: 83b94b1ca8ec061e8fd0364d128d2b2e SHA1: de462481d6fd50d33b22bcf52918a75b69aa41ab SHA256: e727b7dd55428bc1782fc5dd9a977b6a0087ba53b716359e2902f881d4a6ef41 MATCHES: Str1: nls_933w.dll
When I run loki.exe it doesnt check wininit.exe (used --debug, no trace of any check of wininit.exe).
When I use "python loki.py", same arguments ("-p C:\Windows\System32 --noprocscan --printAll --debug"), it does check wininit.exe and report suspicious because its too large (which probably needs an update). 64-bit Python 2.7.
Both cases run from administrative level command line, on 64-bit up-to-date Windows 10.
Traceback (most recent call last):
File "loki.py", line 1134, in log_to_file
logfile.write("{0},{1},{2},{3}\n".format(getSyslogTimestamp(),self.hostname,mes_type,message))
File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/codecs.py", line 694, in write
return self.writer.write(data)
File "/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/codecs.py", line 357, in write
data, consumed = self.encode(object, self.errors)
UnicodeDecodeError: 'ascii' codec can't decode byte 0xe2 in position 195: ordinal not in range(128)
Cannot print to log file
This happens on matches but not all the time, only on whole disk scans from what I've seen.
Hello
you list in releases recommendations to not scan some dir
https://github.com/Neo23x0/Loki/releases
but it does not seem there is any exclude pattern option either from cli, either from file.
would be a nice addition
Thanks
Hi,
Thanks for the tool!
I think i got a false positive:
[ALERT] Yara Rule MATCH: WaterBug_ComRat FILE: C:\Program Files\Oracle\VirtualBox\VBoxSharedCrOpenGL.dll
The software is the recent version of Oracle Virtual Box
Kind regards
Tobias
Hi, Florian!
I tested 0.18.2 version again...
Now 0.18.2 can detect IOC_Filename+yara rules, scores have addition.
BUT
1.Yara rules hit item not display.
2.IOC_Filename hit item repeat display.
Thank you
MISP is a platform to echange IOCs.
MISP has a key-authenticated REST API available, there is some documentation in this file, and a reference library implementation in python: PyMISP.
Existing MISP data types that might be of interest to be used for lookups: yara, filename, mutex, md5, sha1, sha256, email subject, email attachment. New data types to be implemented in the future: URI-regexp, filename-regexp, SSL certificates attributes.
I can arrange access to a MISP instance hosting IOCs if you need it for testing.
Could you add functionality to loki to have it produce output that a machine can analyze? For instance, csv, tsv or json, such that results from hundreds of systems can be written to a database and queried?
But the list only list 3 (File Name, Yara and Hash) in the README.
Hello,
tried to run Loki on a french win10 and got a few suspicious item based on owner. And they are normal (pristine system). accents don't seem to be supported.
usual owners are
SERVICE LOCAL
SERVICE RÉSEAU
AUTORITE NT\Système
C:\Users\user>reg query "hklm\system\controlset001\control\nls\language" /v Installlanguage
HKEY_LOCAL_MACHINE\system\controlset001\control\nls\language
Installlanguage REG_SZ 040C
Simple IOC Scanner
(C) Florian Roth
August 2015
Version 0.13.0
DISCLAIMER - USE AT YOUR OWN RISK
��[NOTICE] Starting Loki Scan SYSTEM: DESKTOP-PTPUFI8 TIME: 20151125T04:40:06Z PLATFORM: windows
��[INFO] File Name Characteristics initialized with 306 regex patterns
��[INFO] C2 server indicators initialized with 7527 elements
��[INFO] Malicious MD5 Hashes initialized with 7287 hashes
��[INFO] Malicious SHA1 Hashes initialized with 1757 hashes
��[INFO] Malicious SHA256 Hashes initialized with 3471 hashes
��[INFO] False Positive Hashes initialized with 20 hashes
��[INFO] Processing YARA rules folder C:\temp\irbin\Loki-master\./signatures
��[INFO] Initialized Yara rules from apt_alienspy_rat.yar
[...]
��[INFO] Scanning Process PID: 612 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k DcomLaunch
��[WARNING] svchost.exe process owner is suspicious PID: 612 NAME: svchost.exe OWNER: Systme CMD: C:\Windows\system32\svchost.exe -k DcomLaunch PATH: C:\Windows\system32\svchost.exe
Cannot print to log file loki.log
��[INFO] Scanning Process PID: 648 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k RPCSS
��[NOTICE] Listening process PID: 648 NAME: svchost.exe COMMAND: C:\Windows\system32\svchost.exe -k RPCSS IP: 0.0.0.0 PORT: 135
��[NOTICE] Listening process PID: 648 NAME: svchost.exe COMMAND: C:\Windows\system32\svchost.exe -k RPCSS IP: :: PORT: 135
��[WARNING] svchost.exe process owner is suspicious PID: 648 NAME: svchost.exe OWNER: SERVICE RSEAU CMD: C:\Windows\system32\svchost.exe -k RPCSS PATH: C:\Windows\system32\svchost.exe
Cannot print to log file loki.log
��[INFO] Scanning Process PID: 764 NAME: VBoxService.exe CMD: system32\VBoxService.exe
��[INFO] Scanning Process PID: 796 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
��[WARNING] svchost.exe process owner is suspicious PID: 796 NAME: svchost.exe OWNER: Systme CMD: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted PATH: C:\Windows\system32\svchost.exe
Cannot print to log file loki.log
��[INFO] Scanning Process PID: 812 NAME: dwm.exe CMD: "dwm.exe"
��[INFO] Scanning Process PID: 832 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
��[WARNING] svchost.exe process owner is suspicious PID: 832 NAME: svchost.exe OWNER: SERVICE LOCAL CMD: C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation PATH: C:\Windows\system32\svchost.exe
��[INFO] Scanning Process PID: 840 NAME: svchost.exe CMD: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
��[NOTICE] Listening process PID: 840 NAME: svchost.exe COMMAND: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted IP: 0.0.0.0 PORT: 49409
��[NOTICE] Listening process PID: 840 NAME: svchost.exe COMMAND: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted IP: :: PORT: 49409
��[WARNING] svchost.exe process owner is suspicious PID: 840 NAME: svchost.exe OWNER: SERVICE LOCAL CMD: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted PATH: C:\Windows\System32\svchost.exe
[...]
��[NOTICE] Listening process PID: 996 NAME: svchost.exe COMMAND: C:\Windows\system32\svchost.exe -k netsvcs IP: :: PORT: 49410
��[WARNING] svchost.exe process owner is suspicious PID: 996 NAME: svchost.exe OWNER: Systme CMD: C:\Windows\system32\svchost.exe -k netsvcs PATH: C:\Windows\system32\svchost.exe
Cannot print to log file loki.log
��[INFO] Scanning Process PID: 244 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k LocalService
��[WARNING] svchost.exe process owner is suspicious PID: 244 NAME: svchost.exe OWNER: SERVICE LOCAL CMD: C:\Windows\system32\svchost.exe -k LocalService PATH: C:\Windows\system32\svchost.exe
��[INFO] Scanning Process PID: 1052 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k NetworkService
��[WARNING] svchost.exe process owner is suspicious PID: 1052 NAME: svchost.exe OWNER: SERVICE RSEAU CMD: C:\Windows\system32\svchost.exe -k NetworkService PATH: C:\Windows\system32\svchost.exe
Cannot print to log file loki.log
��[INFO] Scanning Process PID: 1180 NAME: spoolsv.exe CMD: C:\Windows\System32\spoolsv.exe
��[NOTICE] Listening process PID: 1180 NAME: spoolsv.exe COMMAND: C:\Windows\System32\spoolsv.exe IP: 0.0.0.0 PORT: 49411
��[NOTICE] Listening process PID: 1180 NAME: spoolsv.exe COMMAND: C:\Windows\System32\spoolsv.exe IP: :: PORT: 49411
��[INFO] Scanning Process PID: 1336 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
��[WARNING] svchost.exe process owner is suspicious PID: 1336 NAME: svchost.exe OWNER: SERVICE LOCAL CMD: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork PATH: C:\Windows\system32\svchost.exe
��[INFO] Scanning Process PID: 1412 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
��[NOTICE] Listening process PID: 1412 NAME: svchost.exe COMMAND: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted IP: 0.0.0.0 PORT: 49454
��[NOTICE] Listening process PID: 1412 NAME: svchost.exe COMMAND: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted IP: :: PORT: 49454
��[WARNING] svchost.exe process owner is suspicious PID: 1412 NAME: svchost.exe OWNER: SERVICE RSEAU CMD: C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted PATH: C:\Windows\system32\svchost.exe
Cannot print to log file loki.log
��[INFO] Scanning Process PID: 1504 NAME: svchost.exe CMD: C:\Windows\System32\svchost.exe -k utcsvc
��[NOTICE] Established conenction PID: 1504 NAME: svchost.exe COMMAND: C:\Windows\System32\svchost.exe -k utcsvc LIP: 192.168.2.109 LPORT: 49711 RIP: 65.55.44.108 RPORT: 443
��[WARNING] svchost.exe process owner is suspicious PID: 1504 NAME: svchost.exe OWNER: Systme CMD: C:\Windows\System32\svchost.exe -k utcsvc PATH: C:\Windows\System32\svchost.exe
Cannot print to log file loki.log
��[INFO] Scanning Process PID: 1568 NAME: dasHost.exe CMD: dashost.exe {c2c1c3c2-ccb8-4ab1-8aaf6cbe1bdf1287}
��[INFO] Scanning Process PID: 1664 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k appmodel
��[WARNING] svchost.exe process owner is suspicious PID: 1664 NAME: svchost.exe OWNER: Systme CMD: C:\Windows\system32\svchost.exe -k appmodel PATH: C:\Windows\system32\svchost.exe
Cannot print to log file loki.log
��[INFO] Scanning Process PID: 1704 NAME: MsMpEng.exe CMD: N/A
[...]
��[INFO] Scanning Process PID: 4396 NAME: svchost.exe CMD: C:\Windows\system32\svchost.exe -k UnistackSvcGroup
��[WARNING] svchost.exe process owner is suspicious PID: 4396 NAME: svchost.exe OWNER: user CMD: C:\Windows\system32\svchost.exe -k UnistackSvcGroup PATH: C:\Windows\system32\svchost.exe
[...]
��[INFO] Scanning Process PID: 4144 NAME: loki.exe CMD: "C:\temp\irbin\loki-master\loki.exe" -p c:
��[INFO] Skipping LOKI Process PID: 464 NAME: loki.exe CMD: "C:\temp\irbin\loki-master\loki.exe" -p c:
��[INFO] Scanning Process PID: 524 NAME: WmiPrvSE.exe CMD: C:\Windows\sysWOW64\wbem\wmiprvse.exe -Embedding
��[INFO] Scanning c: ...
�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/ ��[ERROR] [Error 3] Le chemin daccs spcifi est introuvable: 'c:AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Historique/*.*'
��[ERROR] [Error 3] Le chemin daccs spcifi est introuvable: 'c:AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft/*.*'
��[ERROR] [Error 3] Le chemin daccs spcifi est introuvable: 'c:AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages/*.*'
[...]
��[ERROR] [Error 3] Le chemin daccs spcifi est introuvable: 'c:Local Settings\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\AC\\Microsoft/*.*'
��[ERROR] [Error 3] Le chemin daccs spcifi est introuvable: 'c:Local Settings\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.WindowsStore_8wekyb3d8bbwe\\RoamingState/*.*'
[...]
�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�- ��[ERROR] [Error 3] Le chemin daccs spcifi est introuvable: 'c:Local Settings\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\\Microsoft.XboxGameCallableUI_1000.10240.16384.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore/*.*'
�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�- ��[ERROR] [Error 3] Le chemin daccs spcifi est introuvable: 'c:Local Settings\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.CloudExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore/*.*'
�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�| ��[ERROR] [Error 3] Le chemin daccs spcifi est introuvable: 'c:Local Settings\\Application Data\\Application Data\\Application Data\\Application Data\\Packages\\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\\Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy\\ActivationStore/*.*'
�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\�|�/�-�\ ��[RESULT] Suspicious objects detected!
��[RESULT] Loki recommends a deeper analysis of the suspicious objects.
��[NOTICE] Finished LOKI Scan SYSTEM: DESKTOP-PTPUFI8 TIME: 20151125T04:50:40Z
Press Enter to exit ...
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.