Warning! We are currently in recovery mode. The complete archive is not available.

Sample details: ff62105e788f41812057f44955783e1e --

Hashes
MD5: ff62105e788f41812057f44955783e1e
SHA1: 86564e85e07676f71e781ea820fa5953b55b6de1
SHA256: fe6f460c22a9d54d8acf3ba36286c8d7141076cffb91ee4e4e34bf2fb8b0b76e
SSDEEP: 12288:sbOHIy8LyBQ3HGwNu40rAnm5KxrJj81A:gykyBQXGwNuHcm5Kxra1
Details
File Type: PE32
Yara Hits
CuckooSandbox/vmdetect | YRP/IsPE32 | YRP/IsWindowsGUI | YRP/IsBeyondImageSize | YRP/ImportTableIsBad | YRP/HasRichSignature | YRP/maldoc_find_kernel32_base_method_1 | YRP/domain | YRP/IP | YRP/contentis_base64 | YRP/System_Tools | YRP/Browsers | YRP/Antivirus | YRP/VM_Generic_Detection | YRP/VMWare_Detection | YRP/Sandboxie_Detection | YRP/VirtualBox_Detection | YRP/Dropper_Strings | YRP/Misc_Suspicious_Strings | YRP/DebuggerCheck__QueryInfo | YRP/Check_Dlls | YRP/Check_VBox_Description | YRP/Check_Wine | YRP/vmdetect | YRP/antisb_sandboxie | YRP/antisb_cwsandbox | YRP/network_ssl | YRP/escalate_priv | YRP/vmdetect_misc | YRP/RIPEMD160_Constants | YRP/SHA1_Constants | YRP/Str_Win32_Winsock2_Library | YRP/Str_Win32_Wininet_Library |
Strings
		!This program cannot be run in DOS mode.
twVf9E
Ht>Ht)Ht
HtGHt:Ht
t2f92t'
t;f9:t6S
tE<*t#<?u
jWX_^[
jWX_^[
jWX^[]
tgf99tb9}
'VVVVVVV
PVVVVVV
tmf90th
u/VVVV
PVVVVVV
tif90td
@SVWj@3
@SVWj@3
SVWj@3
t	j,WV
tmVWh(
umVWh(
PPj(PPP
SVVWVVV
SVVWVVV
VVWVVV
tff90taPh8
Ht@Ht5Hu@
									
								
																
,SVj ^
PSSSSSSh 
jWX_^]
jWX_^]
\$(;|$4
D$,9D$L
L$dQSP
|$z!wi
uhSVWhp
^tGSh(
VVVVVVVj
uwf93t
t+f93t&
PFh4C4
D$0Pj@
D$0Pj@VW
D$0Pj@
QSSPSSh
D$8Pj@
PSSVSSh
D$8Pj@VW
9\$ u	
tHSSSSW
PSSSSWSj
PVVWVj
PSSWSj
D$4Pj@
9t$ u	
u>VWSh
D$$SVWj
D$0Pj@
PVVSVj
D$0Pj@
D$@Ph<
D$@PhT
D$LPWSV
D$LPWVS
 SVj j
Ph3333
PhDDDD
PhUUUU
Phffff
Phwwww
Ph3333
PhDDDD
PhUUUU
9u$u	9u(
D$0t	9u
9t$0t7
D$4Pj@
Ph3333
PhDDDD
PhUUUU
""""t3
Ph3333
PhUUUU
Phffff
ShDDDD
j:Xj\f
TSVWj03
RPVSShd
f90t"hLB4
t h B4
8SVWj,3
WWhal2
>Du%jDV
f97t:9
f97t:9
[f97t:9
@*@u7V3
<C t=@;
9x,t|9x0tw9x4tr9x8tm9x<th9x@tc9xDt^9xHtY9xLtT9xPtO9xTtJ9xXtE9x\t@9x`t;9xdt69xhu19xlu,9xpu'9xtu"9xxt
t	CF;]
;-u.V3
t6SWPj
PSSj,SSS
jPXSSj
tTSSSSS
VVh".2
Ku&VQQ
PSSj,SSS
hUUUUj7Z
Ph3333
PhDDDD
Phffff
Ph""""
Ph3333
PhDDDD
PhUUUU
Phffff
Phwwww
tvj.Yf
D$ j@V
SVWj$3
uMWj"3
vTj@Z;
Pj@SWj
9N0t~SW
uGj"Xj
D$TPVVj(VVV
9\$$ua
9t$,tZh
9D$(|!
A9L$Hu
L$89\$8
A9L$Hu
9\$0}.
\$8t&h
PSSj,SSSS
u1j"Xj
t[9\$htUV
9t$8u'j
u	9K$u
f;C~t'
t`NVPS
tLjPY3
HHt&Huu9=
9xzuHS
t@f98u;
tkf99tf
@. u,8\$
Ph3333
ShUUUU
Ph3333
PhDDDD
ShUUUU
t0f98u
t!f98t
Ph""""
PhDDDD
Ph3333
Phffff
D$$SSh0
VSSSS%
PVWj@3
t'<3t#Qj
u+SjCV
Phgggg
;`u<Vj
8\$9u8
D$ PWW
f92tqf9
thSjxX
ZVhLC4
VVVVVVVj
 tkj(W
t~f98tyP
t!SSS3
t5HHt$HHuS
SSSSSSSSS
Ht;Ht)
tEWSWWjdh
DSVWj@3
HHttHH
tQHHtB
FZSABTGPIEzy|v|pfIX|vgzfzsaIB|{qzbfIftspgIvzqp|qp{a|s|pgf
Software\AppDataLow\Google Updater
LastUpdate
Software\Logitech, Inc.
WindowLayout
Software\Win7zip
UTWIEF
Opera/9.00 (Windows NT 5.1; U; en)
Mozilla/4.0 (compatible; MSIE 6.01; Windows NT 6.0)
Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)
Opera 9.4 (Windows NT 6.1; U; en)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; NeosBrowser; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; WOW64; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0; .NET CLR 1.1.4322; Windows-Media-Player/10.00.00.3990; InfoPath.2
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.13) Gecko/20060410 Firefox/1.0.8
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
7C$,3>
}Pd	xB/b
6T94wb
 !!!U'
f#!!!(!!
z#!! !!!
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
e69vsZB
*4'F(7
A/bDG;tP
v)@OJC
D$@ggggH
D$`ggggH
D$(gggg
D$ Hc@
D$0ggggH
D$0ggggH
WvRN'h
(rMw0?`
&o?uFt43]D=vW^LS6\8tt6~eM=nj=wU2q;=Qy7uQc]zjvxLDuc6u3G9g:8C@C|
-.JOXH
"FScpZYicatpMbV5EqKkGNeLewGKjaU|@}IvMDdfx7Sg_ZqnHD}u_DUnB93NV`|9PhThw_F_qGJ\oa5
uKGt[;=xfR1o2eJReF12R_}a_Rav;?cpeMWYwK[F3\rvnG1Ym6VC4V[~BwSjaJW
SbieDll.dll
api_log.dll
dir_watch.dll
EVERYONE
CURRENT_USER
0x%08X
SB:0x%08X
G:%s_0x%08X_%c:%s_v1$
Software\Microsoft\Internet Explorer\Main
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u
Isolation
NoProtectedModeBanner
Check_Associations
SOFTWARE\Microsoft\Internet Explorer\Main
IEXPLORE.EXE
SOFTWARE\Clients\StartMenuInternet
IE.HTTP
Progid
SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
IE.HTTPS
SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
IE.AssocFile.HTM
svcVersion
SOFTWARE\Microsoft\Internet Explorer
Version
CurrentVersion
Software\Mozilla\Mozilla Firefox
Start Page
Software\Microsoft\Windows\CurrentVersion\Ext\Settings\%s
cookie:
Erp~dcen7Zxy~cxe7:7Dnd~ycreyv{d-7```9dnd~ycreyv{d9txz
X[[NSUP
Dxqc`verK^zzby~cn7^yt
Zxy~cxe~yp7:7VG^7Zxy~cxe7a%7$%:u~c
GEXTZXYH@^YSX@HT[VDD
C^sv@~ysx`
DNDCRZKTxycex{Drc''&Kdrea~trdKS~d|KRybz
az`ver
DNDCRZKTbeerycTxycex{DrcKdrea~trdKAZ`ver
DXQC@VERKAZ`ver;7^yt9
Library
K32GetMappedFileNameW
Psapi.dll
GetMappedFileNameW
SystemManufacturer
HARDWARE\DESCRIPTION\System\BIOS
SystemBiosVersion
HARDWARE\DESCRIPTION\System
JJ8J^QPE
JJ8J@TynQcseb
SOFTWARE\Microsoft\Windows NT\CurrentVersion
deployment.security.level=MEDIUM
deployment.security.mixcode=DISABLE
deployment.security.blacklist.check=false
deployment.security.revocation.check=NO_CHECK
deployment.security.jsse.hostmismatch.warning=false
deployment.security.sandbox.awtwarningwindow=false
SilentAutoUpdateEnable=0
AutoUpdateDisable=1
mscoree.dll
CreateProcessInternalW
ntdll.dll
SOFTWARE\Microsoft\NET Framework Setup\NDP
jarfile\shell\open\command
SYSTEM\CurrentControlSet
ZwMapUserPhysicalPagesScatter
ZwWow64CallFunction64
ZwWaitHighEventPair
bf'J&';qyy4RpaTqqg\{szPmB
bf'J&';qyy4RpaTqqg\{szB
fsvJzf;qyy4Fsv\fS|ypEgzapvapq
zyp&';qyy4F]Vgptap\apxSgzxEtgf|{r[txp
{vglea;qyy4FfyP{vgleaEtv~pa
fpv`g&';qyy4P{vgleaXpfftrp
b|{ag`fa;qyy4B|{Cpg|slAg`fa
{pate|&';qyy4[pa@fpgRpa\{sz
`gyxz{;qyy4@GYQzb{yztqAzS|ypB
`gyxz{;qyy4Zwat|{@fpgTrp{aFag|{r
vzxvay&';qyy4Atf~Q|tyzr\{q|gpva
tqcte|&';qyy4VgptapEgzvpffB|a}Az~p{B
`fpg&';qyy4V}t{rpB|{qzbXpfftrpS|yapg
~pg{py&';qyy4@eqtapEgzvA}gptqTaag|w`ap
~pg{py&';qyy4\{|a|ty|opEgzvA}gptqTaag|w`apY|fa
~pg{py&';qyy4VgptapEgzvpff\{apg{tyB
~pg{py&';qyy4RpaA}gptq\q
~pg{py&';qyy4RpaXteepqS|yp[txpB
~pg{py&';qyy4RpaEgzq`va\{sz
{aqyy;qyy4GayD`pglPypcta|z{Sytrf
{aqyy;qyy4bvffag
{aqyy;qyy4xpxvel
{aqyy;qyy4xpxfpa
{aqyy;qyy4GayFpaP{c|gz{xp{aCtg|twyp
{aqyy;qyy4GayD`pglP{c|gz{xp{aCtg|twypJ@
{aqyy;qyy4GayD`pglP{c|gz{xp{aCtg|twyp
{aqyy;qyy4GayFpaP{c|gz{xp{aCtg
{aqyy;qyy4QwrWgpt~Ez|{a
{aqyy;qyy4Qwr@|RpaA}gptqQpw`rZw
{aqyy;qyy4Qwr@|Vz{{pvaAzQwr
{aqyy;qyy4Qwr@|FazeQpw`rr|{r
{aqyy;qyy4[aGpxzcpEgzvpffQpw`r
{aqyy;qyy4GayGt{qzxPm
{aqyy;qyy4[aRpa[pmaA}gptq
{aqyy;qyy4[aRpa[pmaEgzvpff
{aqyy;qyy4[aVgptapA}gptqPm
{aqyy;qyy4VfgRpaEgzvpff\q
{aqyy;qyy4^|\{aFlfapxVtyy
{aqyy;qyy4^|StfaFlfapxVtyy
{aqyy;qyy4[aZep{^plPm
nspr4.dll
nss3.dll
Urlmon.dll
Netapi32.dll
sfc_os.dll
wine_get_version
wine_get_unix_file_name
ProductId
76487-640-1457236-23837
76487-337-8429955-22614
76487-644-3177037-23510
76497-640-6308873-23835
55274-640-2673064-23950
76487-640-8834005-23195
76487-640-0716662-23535
76487-644-8648466-23106
00426-293-8170032-85146
76487-341-5883812-22420
76487-OEM-0027453-63796
TransparentEnabled
PolicyScope
DefaultLevel
.kaspersky.com
.drweb.com
symantec.com
.avast.com
.avg.com
.pandasecurity.com
.nai.com
trendmicro.com
.avira.com
.comodo.com
.sophos.com
kavdumps
SOFTWARE\Microsoft\Internet Explorer\Setup\%s
DoNotAllowIE11
DoNotAllowIE12
SOFTWARE\Panda Software
SYSTEM\CurrentControlSet\Services\DragonUpdater
SOFTWARE\Norman Data Defense Systems
SOFTWARE\Ikarus
system_core_version
SOFTWARE\McAfee\SystemCore
SeDebugPrivilege
SeCreatePagefilePrivilege
SeRestorePrivilege
SeBackupPrivilege
hUUUUhDDDDj
h3333h""""j
tooltips_class32
{8E5E2654-AD2D-48BF-AC2D-D17F00898D06}
snxhk.dll
SOFTWARE\Classes\origin
SOFTWARE\Blizzard Entertainment
Software\Skype
Software\Microsoft\VisualStudio
Software\VMware, Inc.
SOFTWARE\AdwCleaner
SOFTWARE\Safer Networking Limited\Spybot - Search & Destroy 2
Software\Classes\VirtualStore\MACHINE\SOFTWARE\TrendMicro\HijackThis
ComboFix
LinhaDefensiva
Language
Software\Valve\Steam
Software\Microsoft\Terminal Server Client\Default
__restart
comctl32.dll
GetAddrInfoW
GetAddrInfoExW
WinVerifyTrust
NtOpenProcess
NtCreateFile
NtOpenFile
NtSetValueKey
NtDeleteValueKey
%S\%S\%S\%p
google.com
windowsupdate.microsoft.com
microsoft.com
update.microsoft.com
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
P: %u // 
RPE: %u // 
T: %u // 
F: %u // 
MNR: %u // 
AS: %u // 
BHO: %u // 
vAntiBot() :: Abruptly exited due to update task
%s%s_%p
%08x%08x%08x%08x
Software\AppDataLow\Software\%s\%08X
Software\AppDataLow\Software\%s\%08X\%s
.rdata
cmd_option.%s
Parsing error // Invalid parameters. Needed: %u, Actual: %u
cmd.exe
GLE: %u
HRES: %i // GLE: %u
msvcrt.dll
--%08x-%04x-%04x-%04x%04x
Content-Type: multipart/form-data; boundary=%08x-%04x-%04x-%04x%04x
Content-Disposition: multipart/form-data; name="newfile"; filename="%d.jpeg"
Content-Type: application/octet-stream
Content-Transfer-Encoding: binary
%s?action=up&g=%s
filename=
exclude=
nocache=
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
RunAsInvoker
__compat_layer
DDDDahUUUU
PPPh""""PP
ahUUUU
advapi32.dll
Private Character Editor 
ssleay32.dll
secur32.dll
EncryptMessage
SSL_write
windowsupdate
neurevt
ReadFile
kernelbase.dll
StrStrIW
BSE: %hu
BSE: %hu // R: %u
BSE: %hu // R: %u // BSD
BSE: %hu // E: %u
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
?pid=%d
?page=%d
?id=%u
%s=%u&%s=%s
%s=%s&%s=%u
&%s=%s
&%s%u=
&%s%hu=
&%s=_%u
%s//%s//%s//%s 
&%s%u=%s
<meta>
</meta>
	<%s>%s</%s>
 (IRE+)
%u:%u:%u:%u:::%s
%S::%S
//%s\%S%S
HKCU\..\Windows, Run="%S"
HKCU\..\Windows, Load="%S"
.co.uk
x-compress; x-zip
compress;q=0.5, gzip;q=1.0
gzip, deflate
compress, gzip
image/png
image/jpeg
image/gif
image/bmp
text/plain
text/html
audio/wav
audio/mpeg
condis
httpget
slowloris
Software\Microsoft\Internet Explorer\Media\MimeTypes
text/html, 
GET /%s HTTP/1.1
Host: %s
Content-Length: %d
Cache-Control: no-cache
Accept: %s
Accept-Language: %s
utf-16
Accept-Charset: %s
Accept-Encoding: %s
User-Agent: %s
Referer: %s
Keep-Alive
Connection: %s
http://
visited:
content:
google-analytics.com
analytics.yahoo.com
api.bing.com
doubleclick.net
googleadservices.com
apis.google.com
googlesyndicatio
safebrowsing/
safe-browsing/
eloqua.com
clients
.google.com/complete/searc
linkhelp.clients.google.com/tbprox
iexplore.exe
firefox.exe
tbb-firefox.exe
PR_Write
X-a: b
%s:%hu
PPPh""""PP
PPPh""""PP
ahUUUU
[.ShellClassInfo]
CLSID=%S
DefaultDropEffect=%u
ConfirmFileOp=0
NoSharing=1
UPError: Unable to generate random filename
UPError: %u // GLE: %u
DWError: %u // GLE: %u
DWError: URL Invalid
DWError: Alloc Error
DWError: Invalid Param(s)
DnsFlushResolverCache
PuTTY Private
Release 0.62
Release 0.63
SSH2_MSG_KEXINIT
SSH2_MSG_DISCONNECT
SSH2_MSG_USERAUTH_SUCCESS
CpuFlushInstructionCache
_wcslwr
_wcsnicmp
wcsstr
wcsncpy
memset
memcpy
NtQueryInformationThread
NtQueryInformationProcess
NtClose
Object Error
NULL Port
Username required, but NULL
Time limit is too short
Alloc Error
SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages
InstallName
ntkrnl
RtlQueryElevationFlags
EnableLUA
gSharedInfo
LoadIconA
PsLookupProcessByProcessId
PsReferencePrimaryToken
%d0x%08X
	(v.-T?
6Jt\@_
3f.J^n
ntdll.dll
kernel32.dll
secur32.dll
crypt32.dll
user32.dll
advapi32.dll
wininet.dll
shell32.dll
shlwapi.dll
ole32.dll
version.dll
dnsapi.dll
ws2_32.dll
?w&O@w
]>w(W>w
p>w@S=w
hA=w/W?w
{A08404EA-B10B-1CF9-F681-1B01EA34EF7D}
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
    </dependentAssembly>
  </dependency>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX
0!080W0g0p5x5
2G2b2n2
2f3s3~3
9+989d9y9
1/1>1}1
1(242s2
6#606W6
7>7Y7f7
8/8=8`8|8
9.9U9_9
:*:I:h:
;/;<;f;
;!<*<J<W<p<
>"?f?s?
50?0M0
1>1F1]1i1
122=2^2
5/5^5l5
696l6r6
:#:=:M:`:{:
:\;d;{;
=?=l=u=
>G>Y>t>}>
?!?+?7?>?V?g?n?w?~?
060`0m0
3!3K3^3
4I4m4v4
5:6J6]6
7,7G7f7
7!8+858?8I8e8u8
;";8;E;O;p;
;$<\<i<w<
=;=@=M=i=n={=
151I1u1
222f2}2
4*5F5[5e5
506I6d6
;9;?;E;d;
<#=8=A=G=
>8>J>[>p>x>
>,?N?U?v?
 1O1V1
343H3_3~3
4Q5c5v5|5
606C6I6R6`6
7#7F7h7{7
7?8\8u8
9.9=9Y9
<X<e<k<
=?=G=N=c=~=
>6?R?m?t?
0!0K0V0\0
2 2)2=2D2V2
3%3O3Y3d3y3
4 4)42484A4G4P4V4
5!505?5N5]5l5{5
6#626A6P6_6t6
7(73797N7S7Y7q7
7;8Q8t8L9
<%<!>+>1?\?b?
2!3N3K4i4
8"8r9~9
:6;W;`;p;
<%<,<3<:<A<H<O<V<
? ?.?8?Y?c?{?
0#0B0Q0
2*272D2Q2^2k2x2
3-3D3[3z3
6%6H6P6U6h6
9G:_:d:k:
:-;<;H;
<$<+<2<9<@<c<
>&>6>F>V>f>
22373R3W3d3
666[6d6
8>8C8P8i8n8{8
:G:L:V:
;H<M<W<
="=H=	>
>m>s>x>}>
2;3@3N3
4&5?5P5a5z5
7#7(7-7
73888=8
;&;<;R;
<V<a<k<
<2=B=G=N=Z=
=,>I>]>l>{>
?'?1?;?E?`?
#080M0T0Y0h0y0
1&161O1
2\3i3v3
314M4U4
5L5a5w5
6)6C6M6W6a6k6u6
7!747g7v7
9'969E9T9c9s9
:':B:O:X:e:r:{:
>D?M?R?`?e?n?s?
0)050A0O0
0	1%1-1h1w1
3;4@4K4`4e4q4
5:5D5h5m5x5
6 7)7?7Q7|7
8(8P8e8q8
909;9F9Q9]9
:U;a;m;y;
;8<T<\<
=<=O=r={=
>G>L>U>b>i>u>
?D?M?U?e?
1<1A1N1S1\1
2!2.292D2
353b3|3
3%4R4[4b4~4
6.6?6J6R6
8"8'84898F8
:#:d:y:
<!<P<U<^<
=E=Y=g=
?+?3?:?t?
02090Z0`0q0x0}0
1(1B1r1|1
5'525D5U5
6G6^6e6
737U7|7
8$8I8X8
9"9G9o9t9z9
9":/:<:I:W:
;*;2;y;	< <B<Q<s<
=	=$=6=G=\=u=z=
0!0<0K0[0i0
061C1S1
2+242A2P2U2b2{2
2$3V3f3
6"727k7
889O9f9
=)=H=n=
0L0Q0:1E1}1
3 3-383C3H3S3\3b3
5#6L6X6i6{6
7)7?7J7Q7W7
808B8N8]8
9)9;9C9I9c9
90:U:[:u:
;2;?;P;];n;{;
<"<(<8<><N<T<Z<`<f<p<v<|<
=+=1=7===C=I=O=U=[=a=g=m=s=
>.>;>H>X>e>u>
1;1I1t1
2,212J2O2m2
464C4Z4o4
5#5/5^5j5
6!6+686K6W6d6
7&7-797@7L7U7h7m7
8+8R8Y8
9"999H9P9a9f9
:$;?;K;f;l;
;)<K<_<}<
=+=8=E=
>$>7>@>I>O>_>d>
?/?9?[?a?q?
1*1B1Y1d1q1x1
202?2f2p2
3$3Z3d3m3z3
4!4.454B4I4R4d4k4t4{4
5/565?5D5P5Y5^5j5
656Q6h6n6s6x6~6
7(7;7N7a7t7
8%80898Q8\8`8
9%:9:A:G:M:S:{:
;9;?;T;e;
<$<2<@<N<\<j<x<
=!=.=:=K=X=`=q=
?<?A?S?^?r?
0!0?0[0a0k0~0
2 2)2.2;2`2e2l2
4 4'4@4Y4g4
5&5=5T5f5x5
6"6)636?6F6R6\6d6
8-8H8Y8c8m8w8
9,9?9d9n9w9
:):7:B:H:N:^:
< <=<P<l<|<
=%=.=5=:=_=e=j=
>&>1>;>@>K>^>h>m>x>
? ?*?[?g?l?
050X0_0
1#1*1M1T1}1
2?2F2i2p2
2"3)3L3S3v3}3
40474Z4a4
5>5E5a5h5
646;6h6
8+8C8Z8r8
9.9E9]9t9
:0:H:_:w:
;3;J;b;y;
<5<M<d<|<
<	= =8=O=g=~=
>#>:>R>i>
0;0\0p0
2C3_3y3
4:4F4t4
4&5S5a5
::;i;t;
<8<V<d<
<2===Q=v=
?"?7?h?
!060>0Y0
0'1K1h1p1
1)282w2
5P6`6~6
9m:w:~:
>]>g>~>
1.191>1E1d1k1r1y1
132l2w2~2
2T3^3{3
434C4h4t4}4
6C7h7n7
<S=]=d=m=t=}=
?#?.?=?K?
2%3L3W3b3i3v3}3
4<4V4g4
6!6]6n6
7'7;7O7c7u7
9;9@9k9
=#>C>T>n>}>
0.1G1h1r1
2(21282A2q2x2
4=4C4q4~4
:&:1:8:A:H:
;N<S<a<u<|<
=8>=>G>
?'?-?F?
5J6j6{6
7<7R7|7
<8=H=a=
>)>6>C>P>
0T0e0j0
1 1c1i1
292U2t2z2
3 3&323
7N8Z8z8f9m9I;R;Y;m;u;
;G=\=r=
0,010b0z0
172S2b2i2n2
9:<	?9?N?
80A0K0Q0
0 1K1}1
405U5t5
8'808H8`8h8{8
9&92989B9K9X9^9d9j9p9
: :-:7:A:
;.;3;p;
<,<?<X<_<d<l<q<
=(=4=>=C=W=a=f=o=
>(>F>y>
&000?0J0
62787A7N768I8
>#>6>W>a>
050:0F0
2 262A2p2
3O4q4}4
6.6G6R6_6u6}6
7&717>7E7V7\7c7
9Y:j:r:x:
:1;l;{;
;I<V<`<
=M>e>t>
?-?Z?r?y?
1%1*1G1n1x1
2K2U2b2
656Z6~6
;F;P;V;q;
< <&<><M<V<o<x<
0O0b0q0z0
575<5Q5]5z5
6%6?6l6
7"7M7V7t7|7
859^9j9
;';;;B;K;z;
<#=(=;=W=
1+2=2d2
798G8}8
:);C>q>
50555B5x5
6D7g7l7u7
7	8V8z8
<'<,<@<H<M<R<]<E=O=
>9>W>p>z>
0$0*0?0E0k0y0
0"1'1h1
2-333G3R3
4'4/4l4
455>5c5}5
:%;E;T;
>'?B?i?n?
1"121B1R1b1r1
2$282K2^2q2
6)6`6o6
62797G7
:*:/:<:`:e:
<<=M=c=i=
6z788B8w8,9P9Z9
:9:J:g:q:~:
=;=R=b=
?2?9?R?b?
'0;0D0R0h0n0s0
2/3d3i3z3
3 4)444E4O4^4i4x4
677D7N7
8I:y:#;6;<;C;^;
='=H=i=
1E1R1k1
2.2@2]2
3)363L3d3p3u3
? ?%?3?8?F?K?Y?^?y?
0.030k0
1"12171H1Y1j1{1
243C3M3R3u3
=$=-=6=?=M=V=_=h=v=
5/5;5S5d5
636@7R7d7v7
869=9G9N9X9
9-:B:M:
;';h;q;
I0:1@1f1p1{1
2?2L2S2X2b2p2w2
2:3C3O3
454E4[4
7B7]7g7
8*818k8r8
9D9a9h9
:	:1:8:`:g:
.0?1E1
2.2b2i2
243B3I3R3v3
4W4f4o4
5E6o6w6
7!717A7Q7a7u7
768K8Q8Z8`8i8p8
;(;6;Z;
>$><>N>V>b>j>v>~>
080K0y0
2 3'3;3V3k3z3
6+6_6m6
<0=;=P=V=c=T>m>~>
2>4x4Y5=6k6
7&8.8=8M8o8x8
1#1*1H1X1e1s1
3$4Y4b4
747?7y7
8O8Y8d8
889J9j9
9":':1:@:F:n:
4s5!656R6c6m6
<$<)<r<
=p=,>:>M>X>J?v?
0&0D0v0
121A1_1
7Y8)9E9p9
:Q:f:k:
:+;@;V;p;x;
<&<0<?<
>L?^?p?
0I0\0v0
1<1I1n1v1
2"262g2
243@3K3m3{3
4"4'4;4
50555H5a5o5
6L6Q6t6
7!7B7j7}7
;3;E;r;
>(?:?T?Z?`?~?
7>7_7~7
808;8A8G8W8~8
;B;P;e;
<4=j=w=
?J?T?^?h?
1 131D1S1b1q1~1
1)212O2z2
7J7P7V7j7
9#969m9
:N;j;v;
<,<A<w<
=.=J=a=h=v=
>*>S>u>
090?0n0
3^3g3p3
4<5C5G5o5
6)606\6b6h6n6t6~6
797L7Q7X7`7f7l7
8'8>8H8d8j8
:J:X:#<==
0/0W0w0
2>3W3k3
4A4X4~4
858O8X8
8+9n9x9
;<<D<J<g<
<K=S=Y=v=
>I>Q>W>p>
?.?6?<?T?o?u?
 0(0.0S0{0
1E1M1S1u1
21272r2z2
4[4c4p4v4
4	50565
7 7A7h7n7
828:8@8U8p8v8
9%929G9M9[9|9
95:H:[:i:s:
;#;-;S;a;
< <'<6<<<A<T<Z<h<
=%=+=<=c=
000D0I0[0u0
455O5n5
:9;@;G;
&0K0e0
2	465d5
8&8?8[8k8{8
8&93999?9E9p9u9
:!:3:X:q:
;&;0;>;R;X;q;w;
<0<F<M<\<y<
>#?^?h?p?
 0&0+0T0\0
02181h1q1
202@2G2S2f2u2
3R3[3d3
4_5g5m5
6/656I6e6
7-7Y7o7
8c9w9 :K;
=+=D=v=
0'181?1D1J1U1\1a1h1m1t1y1
637_7p7
8*8E8R8Y8^8h8v8}8
8C9L9\9
:&:<:L:b:
<X<j<X=q=
4*4?4D4N4S4X4b4g4l4v4{4
537<7F7Z7d7z7
8!9U9w9
;';B;X;c;n;
<6<F<x<
<C=Q=X=
><?A?T?\?o?
0$0*0x0
1#1>1E1k1u1
6(676N6]6q6z6
7$8*8F8k8x8
9	:':p:
;K;b;r;
=&=a=k=
3%3p3w3
3%4_4m4u4
5)5R5c5j5w5
5/666M6
767P7_7e7u7~7
8R8q8w8
9':0:\:c:i:{:
;%;+;;;F;X;l;y;
<0<=<H<N<X<^<p<
=(=1=@=S=^=
>#?,?X?_?e?w?|?
0&030?0R0W0~0
021k1~1
142;2I2x2}2
4"444>4[4m4w4
6+6T6_6e6
:P:b:j:
;#;l;z;
h1l1p1t1x1|1
0 0$0X0\0`0d0h0l0p0t0x0|0
1 1$1(1,101d1h1l1p1t1x1|1
2 2$2(2,2024282l2p2t2x2|2
3 3$3(3,3`3d3h3l3p3t3x3|3
4L4P6T6X6\6`6d6h6l6p6t6
7 7$7(7\7`7d7h7l7p7t7x7|7
7$8(8,8084888<8@8D8H8|8
8L9P9T9X9\9`9d9h9l9p9
: :T:X:\:`:d:h:l:p:t:x:
; ;$;(;\;`;d;h;l;p;t;x;|;
=@=D=H=L=P=T=X=\=`=d=h=
= >$>(>,>0>4>8><>@>D>x>|>
?8?<?@?D?H?L?P?T?X?\?
2 2$2(2,2024282<2@2t2x2|2
3@3D3H3L3P3T3X3\3`3d3
4H4L4P4T4X4\4`4d4h4l4
5P5T5X5\5`5d5h5l5p5t5
5 6$6(6,6064686<6@6D6x6|6
8 8$8(8,8084888<8|8
9H9L9P9T9X9\9`9d9h9l9
:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;8><>@>D>H>L>P>T>X>\>`>d>h>
?L?P?T?X?\?`?d?h?l?p?
0 0$0X0\0`0d0h0l0p0t0x0|0
181<1@1D1H1L1P1T1X1\1
2L2P2T2X2\2`2d2h2l2p2
3 3T3X3\3`3d3h3l3p3t3x3|3
4 4$4(4,404@4P4`4p4
5 505@5P5`5p5
6 606d6h6l6p6t6x6|6
7 7$7(7,7074787l7p7t7x7|7
84888<8@8D8H8L8P8T8X8\8`8
9 9$9(9,9094989<9@9D9H9L9P9T9
:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:
; ;$;(;\;`;d;h;l;p;t;x;|;
< <$<(<,<0<d<h<l<p<t<x<|<
5 5$5(5,5054585L7V7`7j7t7~7
8(828<8F8P8Z8d8n8x8
9"9,969@9J9T9^9h9r9|9
:&:0:::D:N:X:b:l:v:
; ;*;4;>;H;R;\;f;p;z;
<$<.<8<B<L<V<`<j<t<~<
=(=2=<=F=P=Z=d=n=x=
>">,>6>@>J>T>^>h>r>|>
?&?0?:?D?N?X?b?l?v?
0 0*040>0H0R0\0f0p0z0
1$1.181B1L1V1`1j1t1~1
2(222<2F2P2Z2d2n2x2
3"3,363@3J3T3^3h3r3|3
4&404:4D4N4X4b4l4v4
5 5*545>5H5R5\5f5p5z5
6$6.686B6L6V6`6j6t6~6
7(727<7F7P7Z7d7n7x7
8"8,868@8J8T8^8h8r8|8
9&909:9D9N9X9b9l9v9
: :*:4:>:H:R:\:f:p:z:
;$;.;8;B;L;V;`;j;t;~;
<(<2<<<F<P<Z<d<n<x<
="=,=6=@=J=T=^=h=r=|=
>&>0>:>D>N>X>b>l>v>
? ?$?(?,?0?d?h?l?p?t?x?|?
0 0$0(0,0004080l0p0t0x0|0
0(1,1014181<1@1D1H1L1P1T1