Analysis Date2014-08-30 04:03:58
MD5690d0c58cdeeea1b448d4c2b648ec8b1
SHA10150bb82694f5e21d069169652f88dd8229f7a23

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: bf28ad5148b9712e63a53f271eb6f642 sha1: 4abc4b5c66ea724b895c2d2492475fdca5de6027 size: 25600
Section.rdata md5: 54d0eb4f5488e8e7d4f42762b9e210aa sha1: f62579bd31b9e6f5f2290e770139a38d61f4e0e6 size: 7680
Section.data md5: f95a65b28bc00e73c47d7ca4238d183b sha1: 95966f6e14fbbef2c4f21316730a355cd2a299be size: 152064
Section.rsrc md5: 7a84c5cb98a86bf627029a75656ed8f0 sha1: f933685690db0b69797c989bd271435e29088cbe size: 48640
Section.reloc md5: 129e8e3ca2801e44c3dd5009aa74aaf1 sha1: e02ba5b732574ca6e6dcdf883ec1e3774b1f4918 size: 4096
Timestamp2014-08-25 05:35:49
PackerMicrosoft Visual C++ ?.?
PEhash4c930ebb4b77be8bc50d5609be6542cf6e2fc592
IMPhash0284f4483cfa39f6f8c08ac867e47162

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\All Users\SxS\NvSmart.exe
Creates FileC:\Documents and Settings\All Users\SxS\NvSmartMax.dll
Creates FileC:\Documents and Settings\All Users\SxS\xxx.xxx
Creates FilePIPE\lsarpc
Creates MutexZA-MUTEX

Network Details:


Raw Pcap

Strings
.CC
 
.
.
...
..
o.A
.
......,
d

??(&F)
                                 H
         (((((                  H
??(&H)
h??(&A) ...
         h((((                  H
i??(&X)
KERNEL32.DLL
mscoree.dll
MS Shell Dlg
Shell3
SHELL3
                          
]!\ $"
	----`
0$0,040<0D0L0T0\0d0l0t0|0
-000|7
0!090\0l0s0~0
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
01qC.)E
$020y0~0
031Uf\lE
;$;(;,;0;4;8;<;@;
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
&08K~P
0A@@Ju
0bDE37_U
0O1X1^1
0SSSSS
$0t$+N6
 {<<0?vn
0WWWWW
1*101;1G1\1c1w1~1
1&1:1]1i1u2
1%121Y1q1
1+181D1N1V1a1
,.12w\
1ar[	g
1v@4yb
2#2/2>2D2M2Y2g2m2y2
2-2:2D2z2
2&2q2|2
2$2T2u2
2	3^3h3
*2^$3x|
24383@3D3`3|3
2c+hW ^
];&^2p]6
31D1~1
(330I55Z
3$3*383A3P3U3_3m3
363v3|3
:3:D:J:[:
3H4X4h4x4
3M6T6Z6
)=3+Py
3z4*5_5x5
404L4P4p4
>)43q$IS
445@5S5e5
475>5Y5^5f5l5s5y5
4-+`.Q
4U<j2 
-4y3m/
505P5p5
5 6w\m
5cWkz}&
5os^bvj
:5:<:U:i:o:x:
5-YnAV?
63[4]5mm]5\]m]mm5\mm5555555\\\5\\\5m\55\\5ed:
6!6&61666C6Q6W6d6
6"6*6:6O6
6 6$6n6t6x6|6
6/6X6i6{6
6}a?]~
6Qi(Pe
*;6tn5
6',V'E
6)v>gwO
7 7A7k7
7/888D8
7b7<8D8\8t8
7;e=qd
7Z+H.0B
8#8.8R8[8b8k8
8"959M9_9
8<{g6J
_8kTwb
8q8w8}8
~9##,4
9@6#q/Z
96:<:U:[:
9&989K9V9\9b9g9p9
9!9)919=9a9i9u9
9"9'979<9B9H9^9e9x9
~9m;}_
9`wfYL
9%.x]*,(xTdr
+@a$&`
%A1T[$
*a3<Gu[;
$^A3=JOpDe
)AA3@@Z
AAFFf;
aa<R{le<
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
\[A`C&
a-G"zi
An application has made an attempt to load the C runtime library incorrectly.
aot!*k
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
August
>%bB{Wk
BeginPaint
bEjUY,
bF\k--
bFkXa	
BG%"dO
+BOa(4
B_(U{}
=[b)>uL&
?;B.V|
c(4s!0)	+
CC/J*,`k
c\@[]e
cF1k--
c{F|zOg
cM;blO
CorExitProcess
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
CQm{p}
CreateWindowExW
- CRT not initialized
C#-zSYc
@.data
Db/#=J
dddd, MMMM dd, yyyy
:D;d;t;
December
DecodePointer
DefWindowProcW
DeleteCriticalSection
DestroyWindow
d_F#'}
DialogBoxParamW
d i{_G\
DispatchMessageW
DK&niez
DOMAIN error
dsmxy{
dY67y4
>*>e>~>
E.---,
e,09sXz
E)=[Bq
ef3'lG
e|I?g(
EncodePointer
EndDialog
EndPaint
EnterCriticalSection
EotfN0O[
EWu%+=X
ExitProcess
'E;*x^O
`F0.--
f1A{xY
(	f}5MS
Fafg*P
]FB.--
Fc$9cN
-Fc#\a-
February
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
Fm$'?\
$"Fmm}S
fN@U(UE
F?p I:
F>#qvJ2
FreeEnvironmentStringsW
Friday
fR;UC]
<FT0Js
ft>eVN72
F\_V@H
g7!zw9t
GetACP
GetActiveWindow
GetCommandLineW
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetMessageW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessWindowStation
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetUserObjectInformationA
gFbi--
)gGKD&
GH8QJe
G%HeGF
Gs{0X^w
gX@Jfb
H1L1P1T1
HBxTl;
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
hFLl--
h-H:h=
HH:mm:ss
H ~\NF
	HuD_q
H'vCIG
I3')+*+)))*))()*+++,6J!54 CBA
iE,HqDdH
iE#oyS
$]?}IH
I(j	C)'}t1
InitializeCriticalSectionAndSpinCount
|INjEzzv
InterlockedDecrement
InterlockedIncrement
IsDebuggerPresent
IsValidCodePage
{I?s+y
)iZf#N,4
J5xSS;
JanFebMarAprMayJunJulAugSepOctNovDec
January
@JC,`-2
"j}dZm
JEEEEEEEEEEFC
JEEEEEEEEEEFD
JEFEEEEEEEEEB
jH4Gk2
JHHGGGGGGGGHI
JJIIIIJIIIIJJ
j@j ^V
:Jl5Du
j\MK8k_/
jqX+nb
[J,VE;J
jYPQTVTSkllZTTXRTUiHceWda/
}&&k1~
?&$K3q
k7hJqf
~k}9	5
K,cvvV
"K+D)`
kDCm*2m
KERNEL32.dll
kFIi--
=Kg(+f
]	_K]L'
KLWR4y
k~+nQd
K>PUc[
>kY6M-u
L*3Rf_
lBt<CT
lCJQ9=
LCMapStringA
LCMapStringW
---l'D
LeaveCriticalSection
lf:t`v
LjJ$!b
?{LLrh
%l)N_=
LoadAcceleratorsW
LoadCursorW
LoadIconW
LoadLibraryA
LoadStringW
LwT5Wz
lZI?76ZJ
lZK0+{pr
?/?M?a?g?
]M=C](`[
mejK-h
MessageBoxA
"m)f?p9X
Microsoft Visual C++ Runtime Library
mk!mWf
mL>0~Q
MM/dd/yy
Monday
M}r~N+
MultiByteToWideChar
mWZ4a#.
n0+(G/]
]/|N[0x
n2\+`K
NBbUL9@
nCo':#O^
+nLh'N
nn'VhNn
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
]n|R5+
 @nW/'
Nw~ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt
!o3@:f
)O6530./21+*-,4#4PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP
O(@>=77A779?<8;$O' 
oA\ef$?
October
OhGs5i
oiRZjwz
O%JEEEEEEEEEFFB
OqpD6k
~oz{Ba
pA_RvJ
PE GUF
P^E]-\M
p@JN6B
Please contact the application's support team for more information.
PNlv9v
PostQuitMessage
PPPPPPPP
PPPPPPPPPPPPPPPPPKMNNNNNNNNNNOLO
Program: 
<program name unknown>
PS.{-Y
- pure virtual function call
	Pv!u}
pwwwwwwww
pwwwwwwwwwwwwwwwp
pxDDDDDDDDD@
pxDDDDDDDDDDDDDDpx
pxDDDDDDDDDH
pxDDDDDDpx
pxwwwwwwpxDDD
pxwwwwwwwwwwwwwxpx
}>qooggggggg1`_fhsnHK
Q+ P]4
QQSVWh
q/sRP|e$
QueryPerformanceCounter
^qv\Pz18
"qv|w9
R2r_l/VglEW
rbCS=0=
Rc(cG:
`.rdata
r~dF^r
Re1V=m
RegisterClassExW
@.reloc
rp#{WF
RtlUnwind
runtime error 
Runtime Error!
r}|X$>
*rzyex
s(0d@G
!s4vs"!
S	7qz-
Saturday
$	='sb
September
SetHandleCount
SetLastError
SetUnhandledExceptionFilter
{sgyehN
shD	C"bkK
ShowWindow
SING error
=S;KHb
sND7|N
sN?f"gm
S{q3Cn<
s%?tpZHT
Sunday
SunMonTueWedThuFriSat
SX6(N[
!t;6&d
=TaRgm
TerminateProcess
This application has requested the Runtime to terminate it in an unusual way.
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
Thursday
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
%Tm1L^
Tn^gjYNoT
(t>nS	:
T.$o1q
to#\JI;
|tPya;
TranslateAcceleratorW
TranslateMessage
t"SS9]
Tuesday
;t$,v-
t+WWVPV
_Tz^97~0&8
!TZ?L?
=U=b=A>P>
UFM'teB
UN#23^
- unable to initialize heap
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UpdateWindow
UQPXY]Y[
"#U[`R]"
URPQQh
USER32.dll
USER32.DLL
U!Yc|;2
~vFE+!0
>V:ib.h@
VirtualAlloc
VirtualFree
v	N+D$
"){v!q
?vv-=q
vV*Q`A9M
VVVVPPh
w{4R2&I
["=wDl
Wednesday
WH*RHV
WideCharToMultiByte
$|w`kc
WkV21TSav^8{
WriteFile
}>wvEU
wwwwwwwpx
wwwwwwwwwwwwwwwpx
x$"?bkV
;X<b<o<
%X\_NiWB
xuE2<H
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
#Ycm@@
YHG_cH)M
YkoB~KW
#yN*q&
yPU7J~)
Yrd{]x
>=Yt1j
YVLc!y
{|yvrrwsqpon
"y<*Xx
Y_%Y/C
z-000k
:z;'=9=K=m=
ZG]0tD
$%ZGd&S
"Zg!O8
zI32^Oz
zmaJU?n
znJHME
.zw9=v
zX*%[k
}zy|yx~