Sample details: 19c68862d3a53ea1746180b40bf32226 --

Hashes
MD5: 19c68862d3a53ea1746180b40bf32226
SHA1: 620262f1640db740fd60bd2a04b0b7435cff8b8c
SHA256: 2df5bbe0e055e2af7d32e3b71ea80b70f844a917229a6b7f9668eca31c3d813e
SSDEEP: 6144:n6WTBJzrllfU9Oz3o/Sz7ytG1Xpj0JOFPU5al:n6WTrzrlpqRk7f4Qu5
Details
File Type: MS-DOS
Added: 2018-03-07 02:50:57
Yara Hits
YRP/Microsoft_Visual_Cpp_v50v60_MFC | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsBeyondImageSize | YRP/HasModified_DOS_Message | YRP/maldoc_find_kernel32_base_method_1 | YRP/domain | YRP/url | YRP/contentis_base64 | YRP/DebuggerCheck__QueryInfo | YRP/ThreadControl__Context | YRP/Check_OutputDebugStringA_iat | YRP/anti_dbg | YRP/inject_thread | YRP/network_http | YRP/network_tcp_socket | YRP/network_dns | YRP/network_dga | YRP/escalate_priv | YRP/screenshot | YRP/keylogger | YRP/win_mutex | YRP/win_registry | YRP/win_token | YRP/win_files_operation | YRP/Advapi_Hash_API | YRP/CRC32_poly_Constant | YRP/CRC32_table | YRP/BASE64_table | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/Str_Win32_Http_API |
Source
http://94.130.104.170/output.1301364%20unpacked.old
Strings
		`.data
.reloc
Invalid parameter passed to C runtime function.
(null)
```hhh
xppwpp
Qkkbal
[-&LMb#{'
w+OQvr
)\ZEo^m/
H*0"ZOW
l!;b	F
mj>zjZ
IiGM>nw
ewh/?y
OZw3(?
V_:X1:
								
0123456789
abcdefghijklmnopqrstuvwxyz
^_`abcdefghijklmnopqrstuvwxyz
=0VyI^]
29202>2
4$4,444<4D4L4T4\
3d3h3p3t3x3
IdB4 4
:$:2:k:
<2=G=d=
4A090d0l0
0H0h0f
2)2N2W2^2h2q2
((3_3s3z3
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HTTP/1.1
Accept-Language: 
Connection: Close
urlmon.dll
ObtainUserAgentString
bcdfghjklmnpqrstvwxzaeiouy
http://www.bing.com/
http://www.google.com/
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
|$$$}rstuvwxyz{$$$$$$$>?@ABCDEFGHIJKLMNOPQRSTUVW$$$$$$XYZ[\]^_`abcdefghijklmnopq
cabinet.dll
FCICreate
FCIAddFile
FCIFlushCabinet
FCIDestroy
RFB 003.003
gdiplus.dll
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToStream
$_PROXY_SERVER_HOST_$
inject
IsWow64Process
userenv.dll
CreateEnvironmentBlock
DestroyEnvironmentBlock
del "%s"
if exist "%s" goto d
@echo off
del /F "%s"
PR_OpenTCPSocket
PR_Close
PR_Poll
PR_Read
PR_Write
/index.php
GetProcAddress
LoadLibraryA
NtCreateThread
NtCreateUserProcess
NtQueryInformationProcess
RtlUserThreadStart
LdrLoadDll
LdrGetDllHandle
script
Basic 
an unknown error occurred
HPE_UNKNOWN
parser is paused
HPE_PAUSED
strict mode assertion failed
HPE_STRICT
encountered unexpected internal state
HPE_INVALID_INTERNAL_STATE
invalid constant string
HPE_INVALID_CONSTANT
invalid character in chunk size header
HPE_INVALID_CHUNK_SIZE
invalid character in content-length header
HPE_INVALID_CONTENT_LENGTH
invalid character in header
HPE_INVALID_HEADER_TOKEN
LF character expected
HPE_LF_EXPECTED
invalid fragment
HPE_INVALID_FRAGMENT
invalid query string
HPE_INVALID_QUERY_STRING
invalid path
HPE_INVALID_PATH
invalid port
HPE_INVALID_PORT
invalid host
HPE_INVALID_HOST
invalid URL
HPE_INVALID_URL
invalid HTTP method
HPE_INVALID_METHOD
invalid HTTP status code
HPE_INVALID_STATUS
invalid HTTP version
HPE_INVALID_VERSION
data received after completed connection: close message
HPE_CLOSED_CONNECTION
too many header bytes seen; overflow detected
HPE_HEADER_OVERFLOW
stream ended at an unexpected time
HPE_INVALID_EOF_STATE
the on_message_complete callback failed
HPE_CB_message_complete
the on_body callback failed
HPE_CB_body
the on_headers_complete callback failed
HPE_CB_headers_complete
the on_header_value callback failed
HPE_CB_header_value
the on_header_field callback failed
HPE_CB_header_field
the on_fragment callback failed
HPE_CB_fragment
the on_url callback failed
HPE_CB_url
the on_query_string callback failed
HPE_CB_query_string
the on_path callback failed
HPE_CB_path
the on_message_begin callback failed
HPE_CB_message_begin
success
HPE_OK
UNSUBSCRIBE
SUBSCRIBE
NOTIFY
M-SEARCH
CHECKOUT
MKACTIVITY
REPORT
UNLOCK
PROPPATCH
PROPFIND
OPTIONS
CONNECT
DELETE
connection
proxy-connection
content-length
transfer-encoding
upgrade
chunked
keep-alive
VugVprvculNixnOlnfjn`@ntlk
gJILID
WJ@SW@PFP@glzfydraJ@y
v|kn>QLEYnVWCITwGQ_DAA
rnex|`tb1{ey
2%2 (,6i-1/
&#0<!2.x< >
0$5,%/%m)5+
FRCZ^XGA
m2X^!6q
{x|+eKO6'bn
lio:jz|
]^^	[X
740g12v
2224'?$
")-##d1%k-1+,997s3>;:5;>{9-~353
MJ_IcUQRUASTQjER\
AFSEoUW@HOQF
"36&62
*<30*8
zjz~Huqv
^RJ`ZZeIQXYAU
p|dNcy}{ioyur
`}R~nhfgs
yqqx~h
A\VEAVFPFhuxlkzir_cmobjq*9&9R|iyFZ^VEkVTYPMI
 =0$#2!:
+%'*"9bqnq
4)#04#3%3
?/>?<%;,
P]Q_VUA
rbsrqhva
URGQJDKB
$<1>:&
40620Mxnewc
gbmu`e
f$><? >(,o
,##,"/
	3+?5x
5896855!
Qztg{TI@
QUCWW__VXN
#&92=y04.
1>-(:4
"16}ong0vh=
m:pn!_
.- ='>
U|ih}z{^sr}fza
Wqiue!Plcy
Orxkoxh~HX
tb~a|jyRXagndsv&Kiwg#q\WS
{FL_[L\J|lK@VJUH^MflUSZPGB
mVTMIHO
oSX[K\_
)+2670z
,'$4# r
),'9!.$17
]t{rp\z{bta`Wzz{mj~bcc!Jm`koEabu]JI`
qUVAQFE
G?452B
4)#04#3%3#
)#20-432-
La`pjibb`iWLam|f1@
:>882 }
5,<,19)b
81*(6 8bh*! '$
n9tm<D
Kv|ok|lzL\{pfzexn}VBbyk}ndv#A}vkWK_I`mLVFPQJ
&&3)+-#
hU_LH_OYo
XSEYF[M^uaAZH^MGU
b^UHth|jCS|u}
ncrmme^mfvhh)&)nvzfq:)
jmxnDjk}A
WFATRFZT
\K[Fh@\QD[_W`STD^^
,,"%mbm**&:-~mX^&!4"
./9=r{+
9/=?>0
7/9=5!
qr|e@PbT[GY
= #&"j|}
&;8=EZFX
+)2$.7o
bGMCMM@B
N`(Ilfhffki!Xcgkr,
oLOHZ_
lHDKAKMG
VXXTOQMO:>
gec{b}`
|QSH^TM
648.:,cx~	O
4#3`*,=9;tim8@P
68::*?>%,
SRVFYE,7=J
On|mw:!'P
9OTv+V
AB;WTr
tQ9\$x
QQSVW3
QQhlt@
SWhxt@
D$ SVPh
Ht&Hu`
[_^]YY
u	j\Xf
WtRj V
t<It&It
t:It&It
;DAVEu=h
QSVWh,
t$09\$ 
f9G8um
L$$)\$
SWh,y@
tJj8hLv@
;|$$wKr
;\$ wC
,0<	w8
<0r	<9w
<0r	<9w
8ERCPt
GAHt8Ht HHt
SVWjXj
f;CHsR
=ERCPt
t	j\Yf
HtHHt=HHt1
{ !r,j
 @;C(r
$SSSPV
t"SSWh
lVWjDS
xt+xxt8;|$
Hx;Htu
p8h\c@
tB9p,v=
PWWWQW
PPhHx@
tMf9>tH
HHt:HHt'HHt
D$LPhpv@
PSSj%S
tbjD^V3
D$LPWW
t(SSSS
D$8PWWj!W
D$ PVj
D$<9\$ 
9t$|uJ
tBSVWj
u	h@y@
u|Pj<[
D$4Ph0
D$4Ph?SC*
D$0PWj
D$ PSVS
D$4Ph?SC*
D$0PSj
<SWj<_W3
t@<	t<<&u-
0G@;|$
f93t93
G f9C t
G4f9C4t
t'f9P u
0t$Iuj
D$@SPW
D$TSPW
D$`SPW
8\$$u	
D$\SPW
D$HSPW
D$@SPW
8\$$u	
T$ h4]B
f93t~;
tzf97tu
T$0hifB
t$(9t$ 
D$(;D$ 
EDjwXf
t}f9;tx9}
W8D$ t
u|;N(w
E$G@Pj
<KvD<M
<Frm<Kv=<Mwe
}2;^ls
}9;^ls
}2;^ls
:F-t4C
}P;^ls(
 !!!!!!""#$%&'(((((())*+,-.IIIIIIII//I01234445656789:;9:;IIIII<=>?@ABCDEF
?ERCPt&
Ct5Ht,
Ot2Ht)HHt
	tAIt!It
B/|K9z
QPPj$P2
G`HHtsHH
u)WhTt@
9~<u"WWWW
t89.~.
t89.~.
f9_ t0j
FHf9_4tCj
VW9] w~jt
URPQQh
v	N+D$
YSSSSS
HHtXHHt
>If90t
UQPXY]Y[
GD)_p)_l
Olf+Op
Wlf+Wd
^(9^$u
N09F0u
O@;H s
O@;H(s
Oh;O\sR
Gh9Ghr
asm686 with masm, optimised assembly code from Brian Raiter, written 1998
@PAQBR
wkPSQR
Genuu8
ntelu0
ineIu(
E#+E/^ZY
SystemTimeToFileTime
GetTimeZoneInformation
GetSystemTime
TryEnterCriticalSection
WaitForSingleObject
SetEvent
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventW
WaitForMultipleObjects
DeleteCriticalSection
CloseHandle
lstrlenA
lstrcpynA
FreeLibrary
WriteFile
CreateFileW
FlushFileBuffers
GetLastError
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcmpA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
LocalFree
QueryPerformanceCounter
GetTickCount
CreateThread
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapCreate
VirtualProtect
lstrcmpiW
lstrcatW
ExpandEnvironmentStringsW
FileTimeToDosDateTime
GetTempFileNameW
ReadFile
GetTempPathW
FileTimeToLocalFileTime
GetFileInformationByHandle
MoveFileExW
GetFileAttributesW
SetEndOfFile
FindFirstFileW
FindClose
FindNextFileW
ReleaseMutex
GetHandleInformation
lstrcpyW
GetNativeSystemInfo
GetVersionExW
SetFilePointerEx
CreateDirectoryW
VirtualFree
SetFileTime
GetFileSizeEx
VirtualAlloc
RemoveDirectoryW
GetFileTime
DeleteFileW
SetFileAttributesW
GetModuleHandleW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetEnvironmentVariableW
CreateProcessW
GetCurrentThread
OpenProcess
Thread32First
LoadLibraryW
Thread32Next
CreateToolhelp32Snapshot
GetCommandLineW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
DuplicateHandle
ResumeThread
GetModuleFileNameW
GetUserDefaultUILanguage
SetThreadPriority
SetLastError
ResetEvent
GlobalLock
GlobalUnlock
IsBadReadPtr
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
GetThreadContext
SetThreadContext
GetProcessId
CreateMutexW
GetCurrentThreadId
TlsAlloc
TlsFree
ExitProcess
SetErrorMode
GetComputerNameW
GetFileAttributesExW
OpenEventW
GetCurrentProcessId
TerminateThread
CreateRemoteThread
Process32FirstW
Process32NextW
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
TlsGetValue
TlsSetValue
TerminateProcess
OpenMutexW
WTSGetActiveConsoleSessionId
GetVolumeNameForVolumeMountPointW
GetExitCodeThread
VirtualQueryEx
ReadProcessMemory
VirtualProtectEx
KERNEL32.dll
PostMessageW
MapVirtualKeyW
CharLowerA
GetCursorPos
GetIconInfo
DrawIcon
ExitWindowsEx
GetSystemMetrics
CharToOemW
RegisterClassA
DefFrameProcW
GetMessagePos
DefWindowProcW
CallWindowProcW
CallWindowProcA
RegisterClassW
ReleaseCapture
DefMDIChildProcA
DefDlgProcA
SwitchDesktop
DefMDIChildProcW
DefWindowProcA
ReleaseDC
PeekMessageA
GetDCEx
PeekMessageW
GetClipboardData
SetCursorPos
RegisterClassExW
TranslateMessage
GetCapture
GetUpdateRect
BeginPaint
OpenInputDesktop
DefFrameProcA
DefDlgProcW
SetCapture
GetWindowDC
RegisterClassExA
GetMessageW
GetUpdateRgn
GetMessageA
EndPaint
CharLowerW
ToUnicode
GetKeyboardState
GetWindow
SendMessageTimeoutW
SetWindowLongW
GetWindowLongW
WindowFromPoint
LoadImageW
GetTopWindow
GetShellWindow
GetWindowThreadProcessId
EndMenu
SendMessageW
GetUserObjectInformationW
HiliteMenuItem
PostThreadMessageW
GetMenuItemCount
GetMenuState
GetClassNameW
SystemParametersInfoW
TrackPopupMenuEx
GetMenuItemRect
GetMenu
MenuItemFromPoint
OpenDesktopW
GetSubMenu
SetKeyboardState
GetMenuItemID
GetThreadDesktop
RegisterWindowMessageW
OpenWindowStationW
SetThreadDesktop
CloseDesktop
GetProcessWindowStation
CreateWindowStationW
CloseWindowStation
SetProcessWindowStation
CreateDesktopW
IsRectEmpty
MapWindowPoints
IsWindow
SetWindowPos
GetAncestor
GetClassLongW
GetWindowInfo
GetParent
GetWindowRect
PrintWindow
EqualRect
IntersectRect
DrawEdge
FillRect
DispatchMessageW
MsgWaitForMultipleObjects
USER32.dll
InitiateSystemShutdownExW
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptVerifySignatureW
CryptGetKeyParam
CryptImportKey
CryptDestroyKey
IsWellKnownSid
GetLengthSid
ConvertSidToStringSidW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
EqualSid
ADVAPI32.dll
wvnsprintfW
wvnsprintfA
PathIsURLW
PathFindFileNameW
PathRemoveFileSpecW
PathIsDirectoryW
PathSkipRootW
PathUnquoteSpacesW
PathMatchSpecW
StrCmpNW
PathQuoteSpacesW
PathCanonicalizeW
PathRemoveBackslashW
UrlUnescapeA
StrCmpNIA
StrStrIA
StrStrIW
SHDeleteValueW
SHDeleteKeyW
StrCmpNIW
PathAddBackslashW
PathAddExtensionW
SHLWAPI.dll
ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
SHELL32.dll
GetUserNameExW
Secur32.dll
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoInitializeEx
CLSIDFromString
StringFromGUID2
ole32.dll
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
CreateDCW
GetDeviceCaps
DeleteDC
BitBlt
GetDIBits
CreateDIBSection
RestoreDC
SaveDC
SetRectRgn
GdiFlush
SetViewportOrgEx
GDI32.dll
WSASend
WSARecv
freeaddrinfo
getaddrinfo
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
WSAAddressToStringW
WSAIoctl
WSACloseEvent
WS2_32.dll
PFXImportCertStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
PFXExportCertStoreEx
CryptUnprotectData
CRYPT32.dll
HttpQueryInfoA
InternetConnectA
InternetQueryOptionW
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
InternetSetCookieA
InternetCrackUrlA
HttpSendRequestExA
HttpSendRequestExW
InternetSetStatusCallbackA
InternetQueryDataAvailable
InternetReadFileExA
HttpSendRequestW
InternetSetStatusCallbackW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersW
WININET.dll
OLEAUT32.dll
NetUserGetInfo
NetApiBufferFree
NetUserEnum
NETAPI32.dll
_errno
memcpy
memcmp
memset
_ultow
_purecall
memmove
_ultoa
memchr
strcmp
msvcrt.dll
isleadbyte
_snprintf
wctomb
malloc
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
OutputDebugStringA
RtlUnwind
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
_except_handler3
8(848@8L8X8d8
P;T;X;\;`;d;h;l;p;t;|<
=$=,=4=<=D=L=T=\=d=l=t=|=
>$>,>4><>D>L>T>\>d>l>t>|>
?$?,?4?<?D?L?T?\?d?l?t?|?
0$0,040<0D0L0T0\0d0l0t0|0
1$1,141<1D1L1T1\1d1l1t1|1
2$2,242<2D2L2T2\2d2l2t2|2
3$3,343<3D3L3T3\3d3l3t3|3
4$4,444<4D4L4T4\4d4l4t4|4
3d3h3p3t3x3
3<4D4L4T4\4d4l4t4|4
7H9L9P9
>7?S?r?
8 9U9^9k9r9
:$:2:k:
<2=G=d=
='>0>N>v>
090d0l0
1R1[1b1h1z1
4V4%5a5k5
6@7h7s7
6+7^7i7
8C8o8z8
1$1E1Q1j1
292P2y2
1K1Q1e1
2)2N2W2^2h2q2
3(3=3R3Z3_3s3z3
4,40464?4
8.959<9B9J9Q9U9[9a9i9
:);:;\;
=*=K=b=
@1F1Q1W1
8r9x9P:
= =9>L>S?]?
1D2]2f2p2
>+?=?M?
0#0-030=0G0O0U0[0a0
1!1&1+10181?1i1
3!3R3b3
5C5J5m5
6-7s7y7
>$>*><>C>K>g>v>
5)5@5G5
6<8F8|8
1U2f4x4J6
<X>g>u?
1*10191@1F1X1\1b1j1
4'4C4{4
606T6f6
8#9B9I9P9V9g9k9q9y9
:(:/:5:G:K:Q:Y:|:
=7=P=b=
>!>'>->;>D>K>Q>c>g>m>u>{>
?!?'?H?k?x?
0+0@0I0g0u0
1-1E1J1
9(:B:V;i;
=#=*=E=
0 0%1*131
; <*=R=
>(?F?t?
1B2S2I3
62686/7[7u7|7
:&:?:W:
<E<T<_<
<G=v=<>`>
0-060H0O0U0]0e0m0x0
525q5w5
;G;L;l;0<7<F<v<
>a>g>p>v>
?7?e?k?s?z?
0070S0
1>3`3f3
3>4D4q4
4"575Q5l5
636B6Y6
8$8,8o8
8"9-9S9`9
:E:K:b:
;&;L;[;c;
<&<,<0<5<:<?<D<I<N<S<X<]<b<g<l<q<v<{<
= =%=*=/=4=9=>=C=H=M=R=W=\=a=f=k=p=u=z=
>$>)>.>3>8>=>B>G>L>Q>V>]>b>p>u>}>
?8?@?[?
1&1_1h1
5'686=6l6
;)<C<K<s<
=3=B=b=
Z091F1Z172
; ;D;S;Y;d;u;
=#=1===X=j=p=v=
:8:?:_:|:
>6???_?k?
@0O0e0
1.1C1W1b1v1{1
2(2g2s2z2
3.3F3z3
<><i<>=f=
2%272U2\2b2j2p2
4:4A4d4
6$6:6J6a6w6
728A8_8
8?9U9m9}9
:6:N:g:
;+;4;J;l;z;
<><L<b<
=$=:=\=j=
>#>.>;>w>
1%2;2G2P2]2c2n2
3$3,3V3^3c3n3
40474>4S4f4
5;5B5P5V5]5d5i5o5
6F6L6R6^6d6}6
7&7,7E7K7Q7W7
7V8o8u8
949b9o9|9
:#:K:b:
?0?<?E?R?`?t?~?
0/0N0[0q0
2E2U2t2
2W3q3v3
4 4:4?4I4
5G5S5Z5
989Y9d9
606:6{6
1U253:3r3w3
636A6f8
2'2P2y2
9$:1:Z:
;*;H;r;
406A6Q6W6s6
9)9D9Z9
0T1a1s1
2:2K2U2k2q2
3/3@3N3s3
X4_4\5c5
8^=x>|>
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0y1E3~7
8Z8v8~8
9(:b:{:V;
>I>U>_>o>z>
?=?P?r?
0#020S0Y0
111=1T1Z1r1|1
2K2[2m2
4#4)4/474G4U4e4p4|4
7&7<7a7q7
8'8.8P8[8k8}8
979=9N9Y9}9
="=&=*=.=7>
;^>b>f>j>n>r>v>z>~>
?"?&?*?.?2?6?:?>?B?F?J?N?R?V?Z?^?b?f?j?n?
021E1s1
6B6[6z6
8#818n8t8
:):8:G:T:
:#;,;I;Z;
1C2h2q2
2	3@3L3W3q3
3T4Z4`4p4v4|4
5#5(5.595@5p6
939.;i<
5+6B6M6
7,7R<{<
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
=9=@=L=X=l=~=
>5>B>N>Z>n>
>+?G?W?v?
5 5,505<5@5L5P5\5`5l5p5|5
0 3$34383L3d3p3t3x3|3
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
5$545D5T5d5t5
6$646D6T6d6t6
7$747D7T7d7t7
8$848D8T8d8t8