Banload Malware Affecting Brazil Exhibits Unusually Complex Infection Process

This post is also available in: 日本語 (Japanese)

As previously discussed by Unit 42, banking Trojans have been targeting Brazilian systems for years given the popularity of online banking services in the country. Recently, we analyzed a handful of samples targeting Brazilian systems that exhibited a unique and complex multi-stage loading process. Antivirus detection names for this malware typically are detected as generic named families or “Banload”.

In this blog post, I’ll share details of the complexity of this Trojan’s installation process, which involves a series of archive downloads, process injections and executable installations, all orchestrated by an encrypted AutoIt script.

Please Note: This blog focuses specifically on the complexities of a malware infection process, but not on the impact of the malware or it’s other functionalities.

For those looking for a higher-level look at some of our recent research, please enjoy one of these options:

• KeyBase Threat Grows Despite Public Takedown: A Picture is Worth a Thousand Words
• New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan
• NanoCoreRAT Behind an Increase in Tax-Themed Phishing E-mails

Execution Analysis

While this analysis represents a group of malware, the walkthrough represents the behavior of the virus 090538f7bea4ffe4c5f3f5e787ea7f9d13eff99e691113453f25db65ed06ffeb. The overall behavior of the family of malware appears to be configurable, so other variants in the same family will result in different execution paths.

While many malware families use multi-stage installation processes, this Banload variant is especially complex, as shown in the diagram below.

Figure 1: Banload AutoIt installation process

The installation begins with a single AutoIT executable file that was attached to phishing emails using subject line “Seu Pedido foi enviado pelo vendedor.”

By decompiling the AutoIT script, we can see the obfuscated source code and encrypted strings of the program.

Decrypting these strings allows us to read the full source of the script. First, the script creates a GET request to the following URL:

https://www.lendico[.]com[.]br/?gclid=Cj0KEQiArJe1BRDe_uz1uu-QjvYBEiQACUj6on7_fL_CVFCGY_N2D6GTvhdimR0bF3VNDIptJ2zpqf0aAjUD8P8HAQ

Next, the script downloads four files from http://compra-da-sorte[.]com. The first, named 7za.7z, is a copy of the command line 7zip utility. The other three, named Ptl.7z, Bag.7z and Hunter.7z, are password protected zip files.

Ptl.7z is moved to a randomly named folder under the primary disk. In this case, C:\choicefycm\xfmhahxn. The file is then unzipped using the 7za.7z executable with the password "102030as". Ptl.7z contains a CPL file (common for Banload) and the CPL resides in the same randomly named folder.

Hunter.7z is a zip archive protect with the password "405060" that contains five files.

• 11111111132.exe
• 22222222264.cfg
• 22222222264.exe
• Bypass.exe
• Fake.exe

These files are not part of the initial execution process of this sample, although the password used to unzip them is later used. They appear to be utilities the malware installs for future use by the attacker.

As shown from the AutoFocus analysis screenshot below, Bag.7z is named randomly and placed into a folder called %APP_DATA%\microsoft\windows\templates. Bag.7z is then unzipped with the following command:

[7za] e [FILENAME] -aoa -p102030as -o%APP_DATA%\Microsoft\Windows\Templates\ *.pdf -r

Bag.7z contains four password protected 7zip files with fake PDF extensions. The names of the extracted files are Access.pdf, Boot.pdf, BootMemori.pdf, and look.pdf. The script finally drops a clean-up bat script to delete itself and executes the CPL file.

Once the AutoIT script writes all necessary files to their correct locations, executes the CPL file, and deletes itself, control is passed to the CPL file. The CPL file first attempts to located the fake PDF files previously written to disk. If found, the CPL unzips the fake PDF documents with the password "405060". The purpose of the binary contents of Access.pdf, look.pdf, and Boot.pdf are unknown. However, BootMemori.pdf is unzipped and the executable file inside is placed in %APP_DATA%\microsoft\windows\templates with a random filename frequently beginning with "Bt". The CPL file writes a file named ProcInfXP to the user's temp folder. That file’s contents (annotated) are below:

Additionally, the following configuration was located in memory of the CPL file while executing.

Eventually, the fake PDF files are replaced with files named puk1, puk2, puk3 and puk4. The CPL then injects an MZP executable compiled September 2015 into a suspended IExplore.

Finally, the CPL writes a file named ProcMen to %APP_DATA%\microsoft\windows\templates. The contents of which include:

The values of the puk* keys correspond to IExplore.exe processes which the CPL started. The Bt.exe value corresponds to the executable contained in BootMemori.pdf, and the final key/value's purpose is unknown. A second clean-up bat file is written which deletes the CPL file.

At this point multiple Internet Explorer processes are running in the background of the system and the CPL file exits. One of which reads in the ProcInfXP configuration file in the user’s temp directory and unzips the BootMemori.pdf file in the Templates directory and renames it to the Bt.exe name. An IExplore process then sends an HTTP POST request using an odd user-agent string.

Eventually, a DLL named procc.dll is written to the %APP_DATA%\microsoft\windows\templates directory. Observed hashes for this DLL include f9dd2f2f3b8a484aee5f73ac5e180d637fe6f4f55dbcf2b24411766741bf43e2 (compiled May 19, 2015) and c6efcf4a90def5a9b48287f77a2eb3a6285bf5b7f953e622219bfb2164461aef (compiled August 3, 2015). Both of which are written in Delphi and include 4 export functions:

• DllGetClassObject
• DllCanUnloadNow
• DllRegisterServer
• DllUnregisterServer

Both files also share interesting strings which overlap in naming conventions of previously analyzed files.

• Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\EMOTO 2012\Projetos 2016\BootMemori\BootMemori\DllNew\IECommand.pas
• H:\Sistemas e Aplicativos\sources\final fantasy x\Novo Pro 2010\NOVA KLL REMOTO 2012\Projetos 2016\BootMemori\BootMemori\DllNew\IECommand.pas

Distribution and Prevention

The installation process for this malware variant, with multiple stages handing execution control to each other, cleaning up after themselves, and using configuration files, is rather complex. Because of the volume of samples, as well as configurations we have detected across our customer base, it is very likely these samples were created through an automated building system.

The majority of Banload samples we have recently identified were sent from hosts located in Germany to hosts located in Brazil using Portuguese language e-mail subjects related to invoices and bank transfers. The images below show the source and destination distributions in the AutoFocus interface.

Conclusion

Due to the modularity of the process and the use of encryption and passwords, statically inspecting individual components of this process may lead to benign verdicts and false negatives. Only when all pieces are in place will the process lead to malicious activity. As Palo Alto Networks WildFire is a fully dynamic execution system these types of contextual detections are possible. AutoFocus users can identify and explore samples of the malware family using the Banload tag.

Indicators of Compromise

URLs

compra-da-sorte[.]com/web/7za.7z
compra-da-sorte[.]com/web/Ptl.7z
compra-da-sorte[.]com/web/Hunter.7z
compra-da-sorte[.]com/web/Bag.7z
vemsorte2015[.]com[.]br/Avisosorte/contador.php

File Names

Bag.7z
Ptl.7z
Roz.7z
Sub.7z
Jes.7z
bt.7z
Boot.7z
Boot.avi
Boot.jmp
Access.7z
Access.avi
Access.jmp
Hunter.7z
Hunter.avi
Hunter.jmp
BootMemori

File Paths

Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\ProcMen
Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\puk1
Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\puk2
Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\puk3
Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\puk4
Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\procc.dll
AppData\Local\Temp\ProcInfXP

Sample Hashes

045ba674b78d2f56dc54f05c8eb573bb198880fade9f03f398a1010f8cef911d
090538f7bea4ffe4c5f3f5e787ea7f9d13eff99e691113453f25db65ed06ffeb
0b54962046cc721adcb554f2100319b8eb75ab478ee8d66fe69d48e881d31c2c
10188566a2efca5b6a0c4383e10d9498ba0af11d94b1d010e3967c811734b66e
3004a8c1814f8238a835d1f222cac6bf4db862ca1a25a1f7285e394311936a30
4d48f76e710f0e0b5ae3b7e3818d0bcc86af84ef330cc954d783f514d321c91d
5a4a0d33c4da23d23c69a62527470e24e4bf3cc3c6ce7859ea0811dfd4bd4988
65b1d93017998d219dc77b43b8e3f4154508f8df9b27d80917fa5f8ce8263a9d
6f455fbdb5409631a698cf1748204b5f432a4eca9843bb913b2d30751e9af1b4
908900c30ce5d0ba0b396edec11f8d9c83803d411fbd24f138ef9303a67a9d5a
a9d5a6b0ee405edf25634c3e0e8f265f47ae5e46d40d6bacd5240d11edab55fd
b90a873089f99c3e4f6786c7d5a6c5fb331c08aa8727f07105621ae682fcbf7b
d245bfa8026ec131bdb128e06930a5818e719ead2271a34b57f87de26d2e78dc
d6f2a278424d2fed66c566c6cec30a7309a2b8f4575343286b9bed6023d42f6f
e12b91b2a398caab36740b2918ecc0356271ef3517a372b1152ea7f786255c69
e9cb8b4207f69be614afecf9576d3dbc2cb785daa69b0ee63bfc566bd4e9c82d
f9dd2f2f3b8a484aee5f73ac5e180d637fe6f4f55dbcf2b24411766741bf43e2
d3e316e57b6003262e518ff1e16688cd13a1e0f588710523b751b34651135426
0b0bdd29ec1581e4f1bde1392935bebfa687c21061162824ba14d83101851523
343b9a03b8a82b3a74927923b26ecdbddd77fdab52ac27c930d832e68f7191b0
8b4788097451569e73516efef912cb7555b2d13bc68c922d76ab3e84bb513397
eca8c7049c1b012394167389f19ce81dedeb65d3aa6406f545021829923ad46f
f836c6b92be1fefa45d45e2671e56e1bcc78cc3363411e0e388ed0a197acf311
c2e3238e6b8e53a4e5ab2332055d2546622a252370e2fa1a0b867c9a7373dcdf
c86e1a7eced249f7a03da15e2706980f5fa3a3aa1d93348002d1039e064f11e0
bca8d5f50da2119244eec7067b657eebbc079dd623ef57fe14b4c46c3525d0d7
9b2c442d5cb28adc2d452dc12d9070e8ffe924ac0056c1b8b1762853834cd46b
fdc7b5080984b25a99fe2284f622ea13bb74716dd0ae1f62c785f5fe2c7e7065
8ddad542bf85e5c6e582da06b5eb5d2a92bf610e61d6044537c9d29b61f7d4dc
d942ed05fa710360fd68b67fc379059fb9dea8d7f8a3a43a8fef88e9462bc871
890e0766ef7b4fa67f953c55a4575d6a6a005c6e7d555764bcd738534a8a5ce9
867b3e0cc382b1a7f77d3c202158332a3f711f28fd29aa8284d9f04198dc9225
003780d443c21772944145ef36ab85ca33cee204c2334cb2e2b6c288bdb24203
0140032385f9eef2e6d1df8166f7b5b96c458e7e66431684c4a6ae76dcd1da5f
a7f3498f2016e6a1ae25e5a9955ad3a17ca6c260671b4cf7183a5305a043f91a
5bb8b6965f18654e7444e1bd768489d30d01ea0ac53ec0433538a7af392e7a9c
760998acd86e89d32364578ca7fda1bc6a6d12c627f2c31d8bb3bcdd041e56e4
4fe0553ccae1811e22f9b7a2cabc76295ca9a30e0a3b7dbcba7a3fb6f7e72468
ee7b23fff660cb44e7fdc4104f6fdb660f0f3fb34526361c3cf5254f8fc3410d
7d3e8863b066fbc2a67448f49ab4f02618392cc2935be184753c312484c2d5b4
bb02a9c045c63261c6a905a1b52d9e311d9026796608f4aca18105967b1324e6
d988261a963479fba5fff3b28ff6205bd99aa80fc7b5d816b89122240d0c3b89
6882b83eac9731ebf8bdb1a2e38e2d4bb9080b712bef94cc3bb9d83a19dd7b10
a8f69d4361933eb55de70a1249c379bcbe565228848c79470e73000199d4f0f7
e1db368f9b10199ee70ed92c0a23a53e25190f9ec21921b1a3db813b84670ea6
a4231c22cdfbddde253953cc552c89ab0c2c3e47354509a293a1890c0a5ac786
b01287d42fa88dfb420087f5e61cc3be21fc79669782ec254c6cd7d77dfe1e89
f5cee76cb74d8c67dc5fd07bafbe36add437a467aa0ca55be427bc980417d6c0
b6cdb44d5c4533cfbe62a018c88fd981ea22481338da36c9106147c4fb4f5967
8e9273bdb9bd82ac6ec594419833cf340cfa565cd61cea2ded852c4058dabfb2
d127273694b16b693fed6cde5ebbd140770045e4011b470968d973b6d6f9e7f1
65b1d93017998d219dc77b43b8e3f4154508f8df9b27d80917fa5f8ce8263a9d
12c3af080e50f87f0671df2491c2b1a41d9e4bcdcd3d1aa961caa17f8e397c58
1996db17baf72156a758b68fcb411eee5108ff588a83e7ebaf4abde4e7e078c8
5cc9470b22e1f2a0d1716f1403e62bec78a4e513089a1e6ece6d83c88c82be16
877e14f23324498589695b02b18e31c9e959812fd291cf50302f01ab7b52b6ab
1200fd05cca93435ca1056a8673e4b5e4fa039de4c8a4bdfd4c7a2ed04a9b129
0b9827b52e1c99acf3db904a131bb33cbb1f4c6e5a5f2258327dc87723e4386c
2c3a65d620293b61c8f8b7c7bd755f416f9d64bd46265a292998d9c965a36218
799059f2d575af9da1b23279cae6ecfd49ff8582e291510c0c18fc60a9e5c75d
ca38c0b08637190e3ec548967e4d06aed7c14b2b4884e9eea23d9ba8a0884041
fe1f0d426c43778223c74094cdab569993f4956a607bdf0fa18d7b7a131bdd39
0cd782eff52609660eb5e261b57bb7bf848e7e169256cacb13307c83983c4c13
d59eb1c1db70def411f8ec3e0b4db653a66e8d018894bfca65f1ded007e536db
c6a0ee17408958857aeaddfb287a476598725011ff29298731fa179705240629
4b5a5b44088d573692d1b2801d17c2886f62f7f87cbb941a8aeb9dd9aefb6cf0
e347af6b63bd62103fbe82fc5d9209e8d08f7b8e898ca288d9f77c813a0577d8
29facc5045b5d9cee63257d29ca645ada97aa39f5ec5ef2b054843ae85b669c9
a6e2b0f913f847109c335b332f18af3d0695e3e1cb510dbffce4326814df41ec
5a0cfd5ea1f204d76ea569e81aa0d0aa9b6698822ef2735ffc13e72058c25938
50a698ff4cb3ddf0a4b6949ca7daa8ad1d3fcc99e8c3d4a996d230be2d0981e5
ae96873025c22894e9a379302d1256a617d299ae08095c3ac195ad72a25193e9
56d289b8805e1844fc34e54f0408c010b36ae5870a22b8e277e6bbfa5d3e13c0
888b95d4ac518f1d8903d4e10c49d4b8cc3e51a7834eab82736f06a166500cde
df70736767d86f8ffe46332b2412e3015ea8f90b8641a9824ddf24b36b70da4c
5110c878be4ae49f56634b86d1e112f8059e64c5c10148e870f9e1a28b2cf6c6
b1cc705b9b984673fdf2e74f2a5c64b48d13620aaba5b3083833e751b72102a3
962f57b252f3a0c792fa7477788d0f1bfed739ceb54a3bc5bd25183f488d8a61
bc73f769c00e118eb97cee12815fef8314202a8fb4854f569e3e1f0a0b7fd0e0
4e98bf903af74bb3f754a8cdd6ec89d4e62a5d91ffa748df66673e54e1b240ab
a865258b027d4c5fd9ce3247eb9d886d53d8473c9cf129e0f2b30dca9a5d735f
3f0de2066871289bdca40272b0d856d6d98d0071522208d60d5a71994fc4049d
f5e44e2526e80f8aec63d08b6989718dadd1463a7c4d81794ef13d7c48d94daa
3b5250c925e03a8f9600c4c825b31a89d402d1547938ce5f5e5ea3ed081b67cd
9da54f52e76ea7d808162b43ebd37ef63b484bea2e67ced18b2906de3b471671
330f9afc09d721d10335b5e59a5f7fa2ac35c4ba808a0a904906914cddeedb2d
5db558bda7cad027afa6e61a57866083ac2d928a05981d45dce4e3833bc9b8d3
804a167558a789849079f2a21460a4f52cdbb6741dd790d71b78cbdce94b0ac6
2513606ffa669635777156024b0a10d0736334354935634c7894f881a389d1b8
955e0a7a9c9183eca6bfe4a237a5a1917b60f008d8d8074962794fa5e4a826fd
34fd38e8b18a8a23bc400ddcc795cc85c7567f2fa9434988f4257cba02094ec1
c83ef3337a156386b4d0416f860c76a76c334a6f77eb85bdaab42c5192ddd937
73366000ce01601676551489133758e74169f30ac093b3c1d95ad425445418e4
090538f7bea4ffe4c5f3f5e787ea7f9d13eff99e691113453f25db65ed06ffeb
d2756006ab43c14d5b1bfdcf6e8c6ec0201c6523d4a9854e9a3440c9011de144
ac5f73f85dc93323f5fd3d25fb73e1ea5de85a18eebbeec334bafbcd3f58227f
6b9a2f04aae17d94eaa22e1519c23d2a34cd553e7ca12d7e257648eb2239b757
29f81675d60cf7017a435c91db7a5c7a85657f50ec89f0fd1fec9d411df71e6d
e1f8c1a30fd50452780c7c4ee3ca45db09a06b6f7e9ad9d40257deeb49a52b77
8094cad52bd8308a47b95c13c9ce7eb1e07cc6e20b4a45e77dde4009f897fbdd
4c7e6b9317e581c6d3743b425e6c75acdac1cc151b62bcf3aab50ceb16857fb9
340585ed798692dd21b2e765d8dd00c3116811def050e5ad360a5ac88fd4b3bd
2d0fe243c123953437f72e0bf1fdb6eb9616cc0cd7bd56ecdcc7e9867f57597a
2b5dab3cf10c57a887570739400c843dbe2fec86c72dec9cd38ce194fe7a3c48
1e535822a4789b3a4cae038a945b9fb2e8c55ce9cfcb453c5573f1c6078cf2b8
00b52d42aa9f34e5f01d826102afe76e65dd2cfc5de10891b0c4272177549324
536d65d4a369c1294868a1b8b2c866475bc611eb098583612dc77ab22c716e65
5b44d8f908f3ad0dfa33a24bdcd388ae373a3cdce3de3b40f671724c3e198b42
5d748264c618ebdefc33ea0ab8e77ec221445a6ae967d04f32906b5f4e292f31
18446a64e3a207eabed1b24c4bcff6532d79ed20cf831d6739ad50fbc0026982
b03149eb6482bbfe67dd1430975f0396e7c992f090412a96846cefba680bf62f
df2c3659b9765d416fa0a6442f37c530fc5f8831510dfff4496a485da83fb204
8a6bda905377bbc1d5f6561ac862482da87f7cbdd52959ec8c5db4c11fc0705b
7dfaf2e96449fb53a2f06dfd11249c00b029508ded2dcf78d6303179d393c55c
0ef75238f9cdb5fcb352bc220cce8051bfc2f24a1b5ec97b39e9454d194af838
e5bad01e917f619b49f7996f24c0c81432b46e4acee033f94b31944e7c36b7c2
aad68068e93df6b58095426755af99ec914247bc4de170adb084024823f8e6a6
20fa1c7aa6b2990ff864e23484b053953ea2b0499a2abcba51a428d2eff7a4a0
f6343352cd66b13565a3d037d9f4d0c29f5ae390728a59ff56c037f35e6b6542
3623a7f98f1d37242e14b9d52707fce4e95b219e3f6ef4bc611440508bc0b4dc
8a5b4fdda2c38839cea7785be3675a3b9741ab1c75b0edf0fae0370418a06d4b
7ad3a18cf5fe0e23d754eb06eaa0732807c0b6ada058098011449394fdfa6776
d3a140f328aff3c4c76515da58bd3eb3859b95369fa1662cf59d6b6440597701
c7685e33aaf9f2574531fb72ae4ba2259dfc9f85e04dda383466b1ff2a824e7e
378c457842e4f2fc9942de1c956e9b12c72c9970e6da179c4c099f8ce720f85a
a6b8db8bf42180d492c9f967309d73e7c987027315e31d137bd27e1f63c24d54
8802249e3070017d6d6d1d64178653c48ac3012af44324a180423feb153c9272
b9a02cb673bbd77f117591a167edac6f5c3681571780c30bdea113d52486ab07
cfe9730cc1372f97534a38c40d095566b8adfabff8e5050966f2db28455bee1d
0dd5d1da177a15da5fa8a30c3083882cfd0a0ad65ca08d2aeec4af306128cdda
73dc16796b7f3ea26514cceab3076bed551847ee1610a7dbf5c35d393cfe56c2
e4489b2fdc16e2280b31c8548148fcadaf322c53eec2580542b8786a8678b0a8
1452bdc90bd77464a32051176d0e8c88c7aaad0d080ce763c591e5bd2a95c615
a189d729d0f5bb46a1191883d3813c74b2f7e12f8fe76e70aa700a031574a366
8ddfeb15333313e69c6b0762ab415ccb580abbe54e6f75c9e900ac42ec82061d
d5a92a97365a080e9c40cc1e8fc8c818d5ecfefba96c725a544ebd5ac5830fc8
4840e0410b2a9a163e37fda5960c5403fd158da3aa700c8e2d05aa82cb63fee5
c97236e6c59801789f01de6f6ed2a21ff5a5f8e5e752e34cd69a63960a630092
2d1e8c7b5da7fc14286bb39a8f00de04b6e87bc47a60128334e8e835c6a8217c
7192a32b4f4637f1d152d972a858139ab8a1a572ea7de3d2c7b6d859dccc6578
42e8c9b85a46fd0384d2daf5ecf1b132d887dbbc57fd6c9ed105049efb808098
c25e7b4a4b4471329c0ca6f93ac8d9e4edd560299aa60567bf6bb75ad7280b3c
820f027204db3509250bbb8b9d86ecb246b9bb33aef6763bd7314ee7ef1dee38
40123990c29c5d17c44775ffb1ffa1844fe0bc8d16c2f2eca2b80e3d4bd02fa2
06c3ca333dccca78902c94e2ba28c38df9326d66e20842a7ed60aa232bbd99f8
9c99bd3cfe699f505d177edc23c8acf97a655301acb430e03e57ccb706eeb035
e43d6e3a9620d69bd60a61e81ac3b5ddffdf330f1b27b6011ec47a6db5e1e8b0
bd8e38812cc2a5400601c9077df17948d6f061d6d6ce74a1ec4fce5ab2fb757a
2411ed922a3969b1815a3ddb042d3fa61f323b4dd6078d16ae85960d0d2cd7a6
32d1927e4f5d226f06fb785edf159b975f9ccaf549c5db07a7471f7c1a38cee4
bff64bda0771e35eda40e1ce08bbba3c2a91c6b926c52c843d42695fade55b5a
3c7e2dfcf87839f2f553355a978a43d2602e13e77052675e534f4e00533314a9
7c96fe1faa797ac42d18b167ec3422363389fe666ccffe0f1c59e34d4264348f
2dabb16d0d00bab62380bf8f486f4fc626d98249a17f1da5f8c9a027855f5f4e
d61a91a8ac36b12b22f7675077ed57f8c5842e68e32248d115a54ce7edb9b3b5
bcb4a8a65ba288ee005b4c31ada4c9748175d59e0b193b46d2da4e6acd59baa4
1d06e0ea2320d4c7c77fe21de7db21b33632996e1c265b261220913cb9ef5c5d
7ffa677bcc175c2206cfde5b0481f6baf10852ae52b8ab548ff4fedcf65088e4
7ccb9900f6438e742c27bcbfbecb5f41365e435b0069131f0c41090ea3e6080a
8af2d6e8cd929bcc7990bf589e18545983ef663d290489d28fc700c53a9502a1
a2090ab6bd6a1ab3e42e21effa0d97bec56da422c0b139f0ea79a0470b77f569
ae135d779437384930bab7074ec50d8f9291b361a29ee2a424ba9dcec8622a13
4e454d37f43a73c481a5d5d3fac40bb911083f5c1aeea8cb4366aa3123ada6d1
ef9f26da15a7afa236997220de4e6b10152565dab94d2af1e709ed54a56c21ea
4601699e3dad1987c51af95fff0aafd38c7555f87f2c93da1a1a8540f5779f52
50d67529c89f9b371be2935e50827624457312934ff7fdb81383bf365292e6bc
94ea01f5a197ebf2bc88108f848d380f12f7ad8196150c8cb1ad0d3e6886b8ed
e94f699da08a3d23050c320fa277d91e3ce75f5a39aa6eeafe43d90e66377afc
6799a157be06202ea8bf2f9fef955dea0e58af45c7e9f1d3ddf1ea18a6c476fe
502475158176b16b5fb0f1b17f042eaa4767dcab70ac7704830ea20525817183
ab1112606be15be16781ae5aa7ee2c213d5f19c98ee9bcc52a84bec138baf62e
d429e76218c0889fb76cf98e1c3c82e9af9285f246caf0af87931e69dddea49a
c4ecab97e7253684f480a3a7bc83450a5dc0a4c6fb7823810159f17d800ded2b
cf006bc6d218f01791800d1cc1a85771a9691ae1d3feb36e25121a41b6913c4b
521b6ce86de2b84802bebc7cb9d80a74510e02f31637a3984aee3ecdde3b1bcd
627528bc228b3b08cd5370ba569d94c2e8e12ee6a5220ecbeee279ca0c0bb2e9
fd3db98b2bd98b9e507225401383bb0e9e7d995058248e3e36f46aaa928ee57d
055bf8268c38ff6fef932742fc4e51aca6fd95d35133771087d8542c6d01f34b
5f6c96f5dc495a115e76382b1ec1cf8b23f8e742900c4dc2ccbf575c19f3ed8d
1850c936d54a7ae3eeb3d67152fde70e743f1cfc9c717bb26bc7f8890d1acfc6
780913fbcc40acf99a740e18cb395aa7dca794a11a64acabd128268a2e316d3c
7fccd253d438e9f9bca89b5c5d4e7e342e39f5cc56f2ee137a376b62edef1368
d482ecfd223c1028866a016b42cdd0e7864189cac034a0c76f14e0e8e5fa7cf7
02f7bd78704006e5dc72b6c4c98e4684c39a42b304b7566471d26ac5ffe6f8c5
21db3d0b77e67ec5dcf9b755d4fd36f78d77373b277049323afe113ead38892f
b28f1010f2c593ea92af7aff7df744e61f9c45183d6c789f10f1754dec906a9a
9e172aa7f5e13c7d85ad23e5cbd40b511a399b100e885d242298c5f47c664338
c906c3f3b225e7bd90c1959ae3fa0bfb8b900a7a9ce85ac39b2aa137ea9b2d16
c0de8897fd763516ba9bdc50739ce04b1b787e1c783ab541b0cb65b4f9289e93
04fa3f2490bda9588bf1b83978f95c97d8c7e04f07a5bee930f10945d314e67f
8ee82eb3f633b79a9951ec6654a01d709b3a388983406b0004ab20ae7c39dc93
972aff63b4622517583a8f7b2df8c464696a89f5862d6cf2efb1ffe4b77dcc82
be2d7fd8455d95e57aff390d0b56cf72f027c118d9e91723fd0352f57b48adc8
96b00ec3c369f1df1eed0f31dc44fa42e71ffcd8a0a0131d608ffd0295dfec25
144c40c591526ae3de6b0baabe371384b16829b3451a27d480f63749eeeed31c
a0fab20a7e7af7e2128f50ab3a621a84b3908397f484434e4a151f1761e75f3e
2412c9eefddbfc3280b19a7ec29d690c55146e683c394f84d37599c6530eeb6a
7089738d67009fefc7c43fc3c9b3a35bb43102ae7e63fa41ca3001e148d29c19
77d393b4618f6981afc9cfbe39a1974f5f35222603b341b1dcbdc5eef77658a8
c2f336b75712ffa3a2e5c464c0661923daef1b418dc671b99601bcb4323a61c9
dade5ed33bde6644c8839e68146b41b2c8b489569df14412c943a739d7339d97
9c9dc2b061b5db423ffb057f8b9b132025833537ee21fd41b3e756bdcdbcf290
bb4851777cf944a01804657bd74350424866bc48fde9a8fabbe5c91b48bda2ba
43d73fe49c859e0bcfe85cb2164117815a9bda47d9d47bf576f381a848463965
4d48f76e710f0e0b5ae3b7e3818d0bcc86af84ef330cc954d783f514d321c91d
8d01dc1a39bb22b24cb78379ab736aea4d37633d849001a4f3617f643637cb7d
02de4960f82482ebb4ddf8595f2aedd17ded2967fa64c57ec5f048e0deabd43c
b19ef49160c28f2ca366ac7edd7eb1d71c1f2aa771f60d62092d34512c413c08
52b5f53e7777d9bc640dd32b5001e22faed8b41d71275409d611c722e6269e97
5adbda23a9a7ef5e7b6c01ab5eb48b1a9257136a80ffbb9cf7ce801dcc570f4b
c4621b8e66cf4ec34137e9c0fc7dc5fa5496314386526fe3a432fbc76e096f04
f3b8408945ae2ea3621cac0fa12ecf72cb7f4a7f753ac1ab463131afe3fb7f39
e520a815177038b3e5436b1b256463978559d6e43535a8007712addda77c7026
905fa44ce81b7480a67c38dde85908388855a2222d94bb0365332522159946e5
9f31e1c1f3cea1f1ac4ca2e3067fe970b30583cf2f0db38eea13fd82ff62e621
b197277800c929d2e07f81e9b2a290de4a8e06907198c36e1bec0106e8cc9457
bbfa319adc5dd945cbfe906b74cca306d77bbce8538e632565ef054c9445b07f
abb9b537697da4ce7bb051745dd8a5a505fff5fa343588940ee5f1141f4d0d61
2fd0eb382a203179f4e367d377d7a93130d0cc976dc5c0f6aec1aaa2c8adfff3
1afd33d3079fd8090a1e50df6d18d4c0c127c5fbc2bdfe1a41835c866234bb55
39636d608d8975a6c8e6cd289770538ae64c823b8b9fb2f9771da04a0d236cf7
1e489c26479c1ef78f8478089924ae080490b16e6af9e36e742e963c5867748d
0a3db467efa099becf49e8e17b4d2caeaaf86406f48a8908bf978e80f7d46f44
11551292cc30f4e21de191614496b2d813fa63c899515fabde6690f75c939067
27c8f0dd196927794f2dc4ab47c8c54938298e18c6434475d7e3bedc36760acb
99fb5826dfd81c22e266e2a768342b51ad47f57459b41573a8124f65c45d024b
386c148bc8dcd9dc1e7894190ecf3da8b22f26cf136d58b2765e857f2354af79
91fddb1e0ed7b2edf66f0a1557f5360b67239ef0c7860e21d610fbf4b55cec8f
231194bc2a73af014216040cfe08b93abddf3777549ffe53f6d337190406439b
e09afbbe8ae315224bb452b1964dcd797fbcff8474358a219e1697cf56518a80
772930d86cd3f40b301ac0847e1616b30520004951ee6d20342ebd220c193752
b008f716ca90b5d064ed51e80779a96103d8e5af9eaf968ad7d8857709dc59e9
752d6c319028bb6c00439093ba3d7823b0ec728f8e6327a121d4f99a53a0cd93
9112ffaf14cd62fa1a230ddb285bfbe1cce94c3d25f6089152e231feb39ae5df
33c48fc7343d0e3ac9ee4c0f17c2adcf37c805a2da0492454bc2ef4462dd89c1
aed7ed83742f6d01eacf2d0ef9b1a553c3e545cdf7af77e5db81c7684a63592c
139407be8115cda02a86fbbc59260f3ba5833829aa5ff47385f9781cc41a03d7
aeda5e1a09c60310c0e1db308955d0b85c983965d4db166bbb89ffd55aa9d480
bdf8eab9d61fe3b7911007f99657a53591d64bde961732d1a694181e1b2021d9
601ce63fc2afb6981c39c05ac90abd275a86647b513c082ec4c5be1fddff6cf9
903bc131d61baffa77911e27ce068753f4354eeb96e57964f951def9c5a7c8b3
fb938d96823d9f7d9b563360727c5b1145701ba5312b1bf8e4d722a8cbf16d49
b8363bdcb59f595a2a95b73a29ecd7e32463eb260a494a32c66a7848d26e4474
62ed265889a7eef882a75a22c7e03c42969b1e80ce00f1f242c567975ed6e2e7
165df4febc07cb34532a3d00cb27d1709b55d9813af321c72e4e73ff2a66083c
cc8c72feeddbe099b03d2bead6f90dc7c5b49082ca84ee4c9d7a896f40ca1d0f
ebe1c85eea576350f8119648cb28eacaa862399d4cf3830ad31d343c3a0ab6c0
e6d540e2168ae83070e0e91133b3f06cdd6faa76fed6479899a3c2b586a32553
7a074b6d8d8cb127f90176fba16893188175f7dea7b5d1f592402e32d87bd895
bd0b05e5d6b3378b8c79278601e2768aa042004f7d81f1602637b9b1a140f99b
73b40ea749948f2f83dd2acd4bdfa46ca981a71716297c5913d836259649b318
bf6d0cd330547c149b5ced6a1893455500316efca723d9d9c8497f02ec29f578
dfc0ad0e7ac3efb6f29c4856495f25a382fcc113cec7f244c11c3f5e647e411a
66539323bd15264352f3a9d08b9d317a423a6c6835a86accc6cf896938aef912
aa74d59349ff7e69c9a950f63a308a4f2d6df98409ed932f3385e89c2caacb9b
15d778c9abc87774b8732e70affc0eee151712275062616200cf10cd1df24ae3
c79f4a228a732f0cfb654ef01efebdb3f703532a850ad8dda4460ae23bcafd3b
2ed484e02436e054c79ea7970bfa00a115ddf0d357b3e2a1fa7f67d07a5fb95e
72dd0ce8e3511172577883c29d6f6fc18f10d9650cc38425d5535c76101e3274
e91b1d9410646cb36e61ba1aebb56896248b881e95aeaafeb812a03627f3dedc
36451bcc150c36a190807ad1877b0cc6d6d07ecbc85a0d7df1ad0a02b6148b5e
a86b39cddcac75f6bc30360e084287278c2913977c9da24ab2de4080c5cab50e
054d1415b05942823d5f3a2ed66f8b1b2b53ccb658d7535babbaeca5531f08a9
15afecb24adb8df14c4a4398b3aecb85c126c67a7289cbbd7555519734bb41fb
92a25a280d2d4b78a39bc6fbed9235da82b8e8a4546afb0793aa74d397f1b081
cbf8570cf15f5f30d592db5a7de45dd4e669546c141b73ba2446b61664c527af
2a2f18e57a191acaa0c14e5f950ac55ac7227940c443f6220260f57741ef38ff
b46c26db23e3e1e2736d91c570ab01fcd72915cf826f0c76a3915cca66f650a0
4ac00be5fdd8398204dbac997c32a5e45b2d329d897c4be220a6a3c22ed4cd03
e5696dc791e3d6e963d97ef9b09a4174510d8f7cc4272b9bd384b2456895e782
7204b926d3c41e9291bc883d43cda20431d15213d6388d461c9d2eb99a185e04
8c5cc4cb988beb72ae9e29060b4a68cc4aa0280f73c6d80a01bb01a540a93484
7f856d6997ab1c30a599732b3b5fff53fe00e2cbc14e8fa880adb6a29077a43e
fab7d8b8f4a1c3566695fcad66c17cedf2b525e727256ecb79688924521f2c41
56b4cddd462979c57b9e30986d701d2ab67c9cddeb5d44cdeafbe780efb548eb
bd5cf38bf3dc74fb92c2760884efad0fb8e3bdc2c16271dac3fd4d3f7ca1398a
5d58e9e17db49127e437fcf9065b3422c5a845b99bd837497cd6313ced8dfab7
deb5c5c82148b2c0311ae88271b6c0feae7c1a22777656852cab049133b12ba7
c6d1a2fa2ab0b7e0215334c579f08f46ff2b5a70a707bc7f4ae0242c2501acb1
08cd10887f665215a1ca92184136320f76c1d3909576ded1e16b5f0b0b233125
501dee80b2fce6d03cf7c89c6c33e98194a230aea3c4162970428a1198222fdc
e6bf0013dca62ff808c8fe72eebddda74027b8dd693dd3410875552cbb5b5e1f
5e994ed83727ab9bf20053ad99b73eb48aec7995d7d0039978d4f805ac019a46
057297849ad7cdb9b20a56b9268ab7418152cb9371fdcab90ddfd2fb8af5ed9e
048bd68403af21db108a05864b6db24521906a2c96e5f29a77d4fd13d1ebdeb9
7f880ca338adc4e7726fb6d91708f49cea72c5bdbb165d15fa500b6a558bcb16
4f3b076f31ddf1b113dc55688e6b04fb44fa295b19e660af10d834241a0d6c3f
c944cbd3bfc81ea5413383f3f60ed020f8f6cbf06e6f2fbb51ee486f47126bc5
44b7b4978135b5689b86218c60bc1f5e638f52c68d2e4ccc095173bdc9971bab
ea8ace9c561b348504b9f8f8882725bcdd21313f9dcf6a53171ea1c3a07deb7c
685e06a5af460d8ade9d26ffabcfc470d1c8f3b97b32671f4b18e4970d8f7fac
e2724d03dc07c2ff877b2126aeca75716162c41b99cb91cddba160861498eea8
621da8e9e4b5e28b444463cdf4e371f28bcc3a67214af84c4da23351e44e9500
a4fb68fbaf432c22906563414595d0993f2175bbd90d1623bebc4afa45f0681d
b71e2e610e949c42f466d45f69a8ed30622ae3b3c5a6cfbd418bc304a9eb692f
bf5c9613f61042ef9ba2c64fb92ecc6145c43d075ec114c5db785db53cb85312
069b8c3fe1b4f8d042c134660a476b8811cdaf9f8e6b650533f6d61364654ee7
6cdc511ef57813ed68654784160579e02596c9c48d90f54352264e2520b59cfa
7b3a186a86439e76ac097da54bacfe4b2c8aa12d0c512bdd7ea04215836f0c22
da532cada653a59ca855c8d2e7c1ac814f10dda15167a199290a0a0992eca9cc
f2c7115c8ee7c3f02ea4f14e2b5a4e880f1c13a0acb604d3ccf819f8b0f46c3e
68510072e670313c43cce543326f85909c2134104972263e25c2e8c725a1ccb6
6910bfe9756980da5f4d6f1ec76e2863b46f738bcbee403716a413260b5d0a25
c2b519a128611fa74d36302795b97dc0222b6ee53aea1b196dde36e817de94fd
321815b147136eefaaf4b1fde56571f38d47087835ca634c12172022f0c98cf3
7b84262549f8afd566bd24017d6f0022494ed40ff17a8d9b67e1de4b860df7ad
5300635e794795859323ff89e5d0d43469aa24f6f61c013e463162ff3687f567
629c3d3394bad3baffa2b6b6a3da9ff19201b24a0544b413dbdc2302c523ee5e
5690adb531e677ddde6ffe3addc88a22354e304aa4d599f3a4d4c4bb204d740e
2b10bf920b16bc3b5ba68217d307ecca0d711fa38f93d383609469f7470a02c0
b42718fae3e35a2048a7e54fe07efc7bfbc692619d88a69b840cbe07c39aeb57
469b6b5c10680b4b0f9b5eeeeef87205f569f83058dd4c1c7dffa56a7bfe7279
078dedf7a91881e6d4c156d1d259d91939f3db498421c283df57a1792d4e2983
20d152b66495da68baecf3c01a7a2b745fa9f6070c6059e43d1554c85224185e
b3b656d6c389087660ef75555db8509560eff674b31d9b68f4115e38a5454b0b
c0a1ec005a40932b2e0c8fbcae901a410bba0f7de2e822c6b84b87887ff2e68b
290d7d09d1432c2474ec1fbcd7aabaa50d979ec812215c91d69c22e6cde71881
0c0989044a98b5dfc809bacc03b4c1d03edf530e9122406f41cd91d9811dc891
a2987d4c127bc8f9a2ee0a94a3dcbc768afc6d666556d28a1552bbae797a5075
ac423cea6a996ed6491b82281f3ee58f87be2b52d49c60f0bc081cb83616d48b
983ca1f80646b7efdb488b35d5f0475a4f7872725405ae235b41c5148ff7342d
009fdaf8c9a81b87261e2f2883d770c12c627f2dd08512ee86c40adc4be074b5
5151b0cff4684825db7e1ee521058a48336a489e42c4f4ae83ae71d552c7bbe6
798e68baada319ed44d4fbda31157b8633f38ee033e7a0ab1a71558e33ada11b
7bab3c4677b39b70f7b491c7ca78d079958c4d0797d3519fa13b743df91ecd96
90df252e3fed79f5cfb38bebe80a1e6ffce92e624eb9770ddfc52b9417f928ba
eb9034a79f3ad16bf9072d6007e7841764f0210095428adf225e0444c3ad1f9d
b5e54ee78a0962800ef2b02296b4708b1db8ae7f08a586c95f6a919324c0f552
30e9b8fb745d1c887a6bf224270379123eeb205e78691f0fde52bae221d28bcd
65af65f32cecf51694adb38225046cf22d13054e6beaf63ecda0f96a64b9be7b
764fc2bb3d1e9ba7780192073de37420fb2cf8283dbffe5e60b1f9502bfb6fb4
4bfd87382580e789cbbc4ad18f44519eb555ac2faf3dbe5ad1088892cd0c4a5a
8376549fb32ab68ffd6f0e1104d5b0a28f66f365eae1e636f737e043dee24095
f0c070dbc06160175dbf808fd49e22f1e9cfaf7c600baa4f3b871d231b29dd38
9a40699ba4ed419474e1b5a145eb72fdd02f607ecef65835aebdfca96d07113e
fa82c6462803b12efbaf45579e4c98855cbdc84c3b88328f9ccf8a5aac48f911
53da792411cb72b4fc443e70580a7e59781f43d27d0f3760fa3e19a6a34a26cc
e36520ef2e753a1ddae2f085d2862a9ff68f79fe36d5975f3451cf9f0f11e358
fafff011fabd98329c1f9a5013cb8ec45abd7a89cab08ba06bc1dd4c2a550a95
aee0192050160f3d2afd85230e214eb7e500da518c5a18110e7c89fc245162fe
181727d8f043ec5286973b78909fcece7e67dbb50d72ab3b65904d7f7231197b
9874f27ad700bd3dc27cb79d254ad08b57a76d60bf71da93d229ec07ab7f1965
5c976ff15092e811435ece71a4e8500150c7e0234763a8533920dd9853638768
979efb965eb7438b8d90b581c38df88d1e0afc24086a841703731b8583b01797
6da764855d08de63b85535fd434b6e55d5eb26ddff45a83fc04a246d30dd01df
02ac85493e80621aceeaf82f11b8fbcf5ac30962dcb318b5ccb466ee9ed222bf
b114ea06fc07bf87d2a325b70d9252edabe61811d7288f875a10604b1ed6ce62
573ee42aa50c5a8f04a81d1743a78a5c2737457a1c41e6d6e73a45ad389d1fe6
0b4a2d53a60de6ef4aa18cff16cb9673e030e0a80ae6e95bb82cee4172800998
279da11299f0cda269826376267a94517119e0d5a7d809c41f0116f8c055027a
6464c61e201f70653bf3235cb453c439a4c3ad2db56f5f7510a4e47b6b773bda
a04b7b9f6a257f1c5b924f0029062034c59bdaed79cb27a58414c454044449b4
b25fdcd40954c4ed4d4de9cdd055ad8c5b6cb677b680a1c18ab3e2e08e7bbd75
05c3e137696be6f216b94e186e205f10d5a09e71cf6b3a01d08bde249b9605d4
d0ebe492b61e0028b26f68f53e71ae231b6aa5f11cdc21942afaa812506cee6c
88add97aef4552ff850560a96b818436aea2f19234e6f4fd7a541de75f4d19c9
966d696cf5c61de09f9d024aed5dba972249e66ebe6bebe742251694cb71676c
7e146a56b73ed2b46cf89d46e5093510aa4ca495b3a153ac7745fac2b832cba1
13487bb3ada9834e7660bd0d4367942858edf72a68e0729def6cd1c791a2f08c
3a80cb6f6583076bad4be93c1fd622da242dc592000721401c0d5ca5cbc8a1bb
bdcf112bb8ea52a6cd4c86404014760f769330d6b475546e9bdddc7ae0513cda
e0b6a8858c879d036d91976bdef683c0f2c9b1ab9954927a2e08d271baf6733d
7d725a480316afe9b0da3ded7bf93eb370c478af874a6244af07220cbee51358
b55059ceb17c8637e11abd97ff5c124d0b2309de66cdc8bd17d9519c7bd05e68
69a5d9c38ebb21cf719f124a3068f07636f7d1307fc50b5d576ae6026212f976
6a79ddce1279f9a9b70ce9c23994a77da858b01307aa7608497d6074d7f908ad
cd61a12bcf6fa31d9590a7e18d8bcb3151379e42a6c62131f04ee003ce846a6f
f364ae8781f99e5b35c1b3b51dccf31d8ec040b4698eb25965fecaba6f5c1585
c709533c05e00f28aefb48ab3f93924bac07c40e7d947138e996c8a48fb8393b
2c943729929dbc29530432eed32c12691ffe78600d8b99318e750b94e22dec34
46679b59da773c589db2b14e4b85eff3711bceee2822f6f2ce22053bd1081d69
ea4d080059b70c18584f893214e95f3bc5047ad8d868fde0609aeb5e74cb89ec
e8a3a584b9f7763fd2dbefa5d6e19bcf00ce5876f7f5f782b328107624363de1
2b67d719ecb5863490107240594c23b5313caad6681baae579a7b0ea3ecd044e
01fdb3b52ce8da0173c35bb48ad7970fd9e80e7e98e83404903fc3069f1af2ee
1732e5f8e4106f19ed428c72723b2f25e354ec3b6cee35c3ed9b49e81c36f27b
62adf8e66c60fac37982df25437af91b28622229e88c84359b1c7d5093b6132e
7971deb6d27dcc799e3f1350471ad31746d29fcd43e1c263c278e7cf2c3a37c9
081d0e89c1764bc56906de1db009f92bfdde45a8e8ae25d974e574e68b0c4bac
1f6936104e9183ea2a893491ecb7b7c75cd07f9d0eb378182c1aee89f7a476e0
1d6b6ba4d29b788deedcd92ce59af0831e1938e38cfd35284881afd1429f1d0d
62f3fbe474c3e26868bd9ac25ed76e4b2f9576f61828f387507c8f5197014047
296e9dc6147507657dded1462f0b6f299d35114492dad90c8d48014ef6b9c183
7c73521c7dbe0cd6fca21dd61181e898187d292e8f8b05738ea59142f80931e6
1e7cd0944c6a8b2abaf6fe1186cbc6387cd0a2d1438df781a770f53e3c57eec5
26fa2c1f10c9d3b2416bdbe9acdbb60567f632ae560bd5ad8783f5d856bb8b2a
5cb0d924a5cc5b226b2ac0ed106b6e441a5e8ed6fdb3fe6463ab8732a8aa24ad
606d136310d83a44538a8877d612fabf76410af9b101645568dd5b30f6ffa2f5
5707e03ad5c63336eff47497938b11fd4012c68e0e7cdb15c83b721fab719600