Analysis Date2013-09-27 00:12:46
MD5013c366d7233063086add9dd67b66224
SHA14893d2a8587a9c7d03373798e96fbb6b46783fb0

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: c8d3a5cf8488249be8648f4da45c7dda sha1: df01e534188dedca468f573859d0e4b97ca6d435 size: 49152
Section.rdata md5: 1642c8ac564f61565618d390f88aa367 sha1: f2f8e5f56408fd655e733fa45effb537949a58ec size: 11264
Section.data md5: 9a93ecd5dca3a42285f7b1601ba80dfc sha1: aa31ea9caf74234bca4dc49246ae3bb910645bb3 size: 187392
Section.reloc md5: a4ed5e489c40816caef4c698e1cbca5d sha1: 018fc8b09a725318b5a80c23c37f615dec372393 size: 9216
Timestamp2013-09-16 08:30:14
PackerMicrosoft Visual C++ ?.?
PEhash31ee265d4aa7a597a79b244d47bf0ca19d648b61
AVaviraTR/ATRAPS.Gen
AVavgBackDoor.Generic17.BKWJ
AVmsseBackdoor:Win32/Plugx.A

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\hhx\hhc.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\hhx\hha.dll
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\hhx\hha.dll.bak
Creates Process"C:\Documents and Settings\Administrator\Local Settings\Temp\hhx\hhc.exe" 100 1120

Process
↳ "C:\Documents and Settings\Administrator\Local Settings\Temp\hhx\hhc.exe" 100 1120

Creates FileC:\Documents and Settings\All Users\SxS\hhc.exe
Creates FileC:\Documents and Settings\All Users\SxS\hha.dll.bak
Creates FileC:\Documents and Settings\All Users\SxS\hha.dll
Creates MutexDBWinMutex

Network Details:


Raw Pcap

Strings
                          
	>-"(,
0"0(01080D0K0T0
0&0/050>0C0R0y0
0)0.050:0D0I0_0g0l0s0z0
0'0-070A0K0U0`0g0o0t0{0
0 0E0O0Y0c0n0u0
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
= =$=(=,=0=4=8=<=@=D=H=L=P=`=h=l=p=t=x=|=
; ;$;(;0;4;8;<;@;D;H;L;P;T;X;\;`;d;
0A1I1h1o1y1
0A@@Ju
<&<0<:<E<L<S<]<d<l<q<x<}<
)0l0r0*2_2x2
:0:L:P:p:
0n<W	p
0r8%g3s
0SSSSS
0v)vL.
0WWWWW
1 1%1,171>1I1P1[1b1m1t1
;@^1!1K
1$1T1u1
1,232H2
	12b4p
1^2h2r2|2
;1;7;@;S;w;
182f2p2z2
1&/f&G
1GD58gLyajcrjsxhljLt893yL7i7
"1no6K@4&
1<*"U~
1+z)?J}|
2%21282@2E2L2S2[2`2g2l2t2}2
2$2,242<2
2 2'242;2T2
2$2*282A2P2U2_2m2
2'292K2
2&cjk(/	
=	>!>(>2>:>G>N>~>
;(;2;?;G;U;Z;c;m;
2h4]>o
=2h"9&
)2WCWKi
|2xk1M%
>$?2?y?~?
2>ZvF J@,
3!3]3d3l3
3 3$3n3t3x3|3
3;4k4}4
363=3F3P3Z3d3q3{3
3a4*5[5q5
3C(hy*
3DTFA^
3eKy3higORzVbfiCAv0bwHquX89g8
3G67w	,
<"<,<3<G<N<T<b<i<n<w<
;3UBtB
3Uo^hh
3W9|+/
3wDnph
3z#XMn
4'40474>4H4O4W4^4f4m4u4|4
4%4+444:4C4J4S4Z4o4
4"4-444?4D4K4P4W4\4e4
4"4-444?4F4Q4X4c4j4u4z4
4 4A4k4
44!g_2
;%;,;4;9;@;G;O;V;^;c;j;q;y;
4dAW3qelMp
:$:/:4:?:D:O:T:a:o:u:
:4:@:H:X:m:
4Iq{_Wa
4K6O6S6W6[6_6c6g6t6
4 ,>(q
$4|wlX
5 5+525=5D5O5V5b5i5u5{5
5"5=5]5
5#5/565?5F5N5T5]5d5m5s5|5
5#5H5N5Y5e5z5
:57Eh.
=&=-=5=:=A=H=P=W=_=d=m=w=
=(=5=A=I=Q=]=
:(:5:A:K:S:^:
%5Ht3r
~5!/$J
5<lC+Y'
5oT:1m5b
>5>V<;y
61[\qqI`
636<6H6
6>`4*M
6%62696D6K6S6Z6f6m6y6
6 6'646;6H6O6\6c6p6w6
6!6(656<6L6
6/6;6A6M6\6b6k6w6
>$>/>6>A>o>}>
6;byn,n
~6+e@L
6F7L7R7X7^7d7k7r7y7
(6/iE0
6Ud^hh
6~~WXe
6X7b7o7
._\}7@
7==3~O
757:7]7g7m7u7|7
7 7+7@7G7M7c7~7
7^7h7r7|7
7\s?h=
7Ug]hh
7- ya2
),$.8)
,808t8x8
838:8D9K9
84;B;H;b;g;v;
84ZD(:R,
858l8v8
8$818=8M8T8c8o8|8
8"8.858=8C8L8U8_8j9t9
8$8(8,8084888<8@8
8:8D8N8Y8a8h8r8y8
8AEX^4
8d!/WP
8!EsTS
<$<.<8<?<I<P<X<]<d<k<s<z<
8?j)]@
8qx-cwAP
8SVS@*
8u=5F[
8UY]hh
;8;X;t;x;
8Y8_8k8
909;9^9
909P9p9
989G9P9t9
9"9)919
9@\gS8"
9J9W96:E:
9p(VK9N
9suKwELlsmuXR
9U9\9w9|9
9U+^hh
9UtUU5
9vTYZ8p1
*9W=}o
._+-<A
a#29-Y>
AAFFf;
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
/a-BwMZrG>
$agkz}
A!&[Gzw
$ahB-H
!|@Aiy'
;)<A<L<p<y<
:(:/:::A:L:R:[:
An application has made an attempt to load the C runtime library incorrectly.
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
August
aU!\hh
|.AxPV
).B6eC
BeginUpdateResourceW
BEILu7
beKwkSblSTF
B"g4ljm
!+BhsF
Bkg	*s
bmgz-|
)bMHeVvHd&r
B;N6.|V
B.NrtB/q
BPiKGfL
bPTY6K
Bt8VaEgoYs9npADjRxdlQUNVwDBOelZ
bU9\hh
BuildCommDCBAndTimeoutsW
-b.uTl
[^_C	.(B
ce6N>+ym
-CI2jQ?|
,Ck]`-
ClearCommError
CloseHandle
COJ;zd
CompareStringA
ConnectNamedPipe
CONOUT$
CorExitProcess
"cQ-_/s
CreateDirectoryExA
CreateDirectoryW
CreateFileA
CreateFileMappingW
CreateFileW
CreateMutexA
CreateMutexW
CreatePipe
CreateProcessW
- CRT not initialized
c?we,R
;\<d<|<
!D0MR4
@.data
dddd, MMMM dd, yyyy
December
DecodePointer
DeleteCriticalSection
DeleteFileA
dFf6cgJtuFqK94IS
DFJAUCxeJDihxYE4V2
dK6@/R4#(o
DOMAIN error
drR+kRd
<{*DY]
)d+~y4
e|\_<6
e9z1GX8qzX13ZYiGDwJMf91J13PaDXI
EaKv}~u8l
EGTMgPdUk4na0S5Vf
eH/^^e
e%j|szhp
EncodePointer
EnterCriticalSection
EnumCalendarInfoW
EnumResourceLanguagesA
EnumSystemCodePagesA
EnumSystemCodePagesW
EnumSystemLocalesA
eO?qj1
e;UNRO
@'eV*p
ExitProcess
ExitThread
ExpandEnvironmentStringsW
f1NbFOh>
F3F6E.0k
F828WRzqD1dRy52lVMOj
f}A i[
FatalAppExitA
FDQ)msS
February
F@}hmZ
"|FiiO
FillConsoleOutputCharacterW
FindAtomA
FindClose
FindFirstFileW
FindNextFileW
FJv5<G=
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
fPB7Pg
}f$Q^<
FreeConsole
FreeEnvironmentStringsW
FreeLibrary
Friday
<fWZDL
f[XkMY
[]|g&;
}'G0FUg
G5V$_^
}g7hh[z[
}g7hh[z[`
G[7VrHv:zX
G8y)KB
+G):d\
?gDPi?M
GetACP
GetActiveWindow
GetBinaryTypeW
GetCommandLineW
GetCommMask
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleTitleW
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetDriveTypeW
GetEnvironmentStringsW
GetFileAttributesExW
GetFileType
GetFullPathNameA
GetLargestConsoleWindowSize
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNumberOfConsoleInputEvents
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessHeaps
GetProcessVersion
GetProcessWindowStation
GetProfileIntW
GetProfileStringA
GetShortPathNameW
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemDefaultLangID
GetSystemDirectoryA
GetSystemPowerStatus
GetSystemTime
GetSystemTimeAdjustment
GetSystemTimeAsFileTime
GetTapeStatus
GetTempFileNameW
GetThreadPriorityBoost
GetTickCount
GetUserObjectInformationA
GetVolumeInformationA
GetWindowsDirectoryA
GfTeF]
?gHW x
GlobalAddAtomW
GlobalFindAtomW
>=?G?Q?[?e?o?y?
GulRnADleLMgg2
`h````
h1DpFl
H~8q46
HeapAlloc
HeapCreate
HeapFree
HeapLock
HeapReAlloc
HeapSize
HF]GwZ
hF]qQp
hggg^	d
`h`hhh
"hh)JD
HH:mm:ss
hI,WfwV[
H/J#1F
H+:K,m.
HO?&3`
h)/Q0r2
h~qUdp7
h?#r+8
*'&hRc
@h{X^W	
hy"3A%
<,<><I<
),(I4c
i7A<$1
"I+j#%
~\IMbz#
InitAtomTable
InitializeCriticalSectionAndSpinCount
INlV0q
 iNT@;
InterlockedDecrement
InterlockedIncrement
IO#Ct{
(iPBXv@l
|ir	GGv
IsBadCodePtr
IsBadHugeReadPtr
IsBadHugeWritePtr
IsDebuggerPresent
IsValidCodePage
IVz\+TQ
i=!Yym:
JanFebMarAprMayJunJulAugSepOctNovDec
January
j)c-s^J
J|DmP~4g8[
JFgGR2ALwZuRfvVQ8O
;|j>.G
Jggggo
J<[&H@
,jj}6V
JJ,Ak<@
j@j ^V
j"l0EO
j."^'}M
J!P,Dp
J/qYq(
j"^SSSSS
/ju&>B
jw/NG|U
'K+<	%
[K9OQKb
KA}C3m
KERNEL32.dll
^/Kha^
(kJBbG
+K,{js
kJTJe%
KM9ud=
kM'z~B
KN,BeU
-KNeu^
kn)lBR-
K	?TpT
 kx!<}
~:[*l6%V3
LCMapStringA
LCMapStringW
LcqtqT9fVVV55galt7IU
LeaveCriticalSection
L n4E.n
LoadLibraryA
LocalHandle
LocalLock
LocalSize
l"S+-l
]lu>|M
%L+UT@
L$%x8a
>/>M>a>g>
MapViewOfFile
MessageBoxA
@ [mE=T
Me=zhSV
MF]`aV
mG?[i"
M#/@HT
Microsoft Visual C++ Runtime Library
m~ik/L
mJObAOnPbc
MM/dd/yy
Monday
MoveFileA
?Mo@zVq
+mPo#Y
MqVjIhDsVoqRFcx
MultiByteToWideChar
M V,ax
MxM2`U
MZ?<:f
"N?(9P|
'nD<J#b
*'niZmT
nL->L;
Nn1O\,
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
nPAHnRh98DKub2Rpqo
?Nq:MB.
:::n:t:
ntj4kWD
(null)
nx&h<a
>o_/+<
O0X0^0
October
ODPNdg
OdR;Sp/
<O<\<f<t<}<
OiXx9WUSOxx4v7q4a9blHFGnkB4C
%	O&J:
ok4Z(H
-(?(p[
pA#tHm
.Pd`"R
PeekConsoleInputA
PgWAee
Please contact the application's support team for more information.
,P|?l%l
PPPPPPPP
p=RBf5
Program: 
<program name unknown>
PrzTJRX
- pure virtual function call
PVVVVVVhH
$Pzo<Z
P=zTpu
Q2_"gd.8
Q{+c$i
?"?-?Q?g?n?u?
	QgTZ4$
qgZ}^w
QifgP<
$Q>ozS
q;ph^H
qQr4fm
QQSVWh
QueryPerformanceCounter
 Q&zj`
QZ.t9|
r`2A:J-F2
"r+d02PT
`.rdata
ReadFile
ReleaseSemaphore
.reloc
Re~NlX
RequestWakeupLatency
ResetEvent
~ReY1l
RJZOE3}
RmWprTXhpIp40wtEnPs1jRgoFPSa6Zx
rnB^_.
Rr:[rBLm
;RrW$;
rt=hTt
RtlDecompressBuffer
RtlUnwind
runtime error 
Runtime Error!
RVF3vF(^0
RwCzqSreP4UfOkDybOtw
R$wWS0
Saturday
SearchPathW
-+s'ednv
September
SetComputerNameA
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetLocaleInfoA
SetMailslotInfo
SetPriorityClass
SetProcessShutdownParameters
SetStdHandle
SetThreadPriorityBoost
SetTimeZoneInformation
SetUnhandledExceptionFilter
/SGz+5,
*SImh9
SING error
_SIzXD
=@=S=k=}=
$S'(Lox
s}L[Ts
soJ97 -
Sq-au'
sR 1B2
s|sE;Pn
^SSSSS
sTV2_Y
suiFhU
Sunday
SunMonTueWedThuFriSat
sU;_z.HT
sv~Oe~sz<E
SW$7FPe
s~wJ#[
s'w~K*
sySKD.Q]
t`b94v
teh!h@
TerminateProcess
TfKTj?
. Tf[/TKm
.TgbC7
This application has requested the Runtime to terminate it in an unusual way.
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
Thursday
tI,	ay
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
toJjnpAuxRbMoQMpWK57AyW
t"SS9]
Tuesday
;t$,v-
t+WWVPV
`tyL@A
=T>Z>s>y>!?,?k?
T;Zy7]=c
U	@49s>m)%t
@:u4g"=$
;:u&B4q
:":,:U:`:g:o:
^U|\hh
_U{[hh
:U<^hh
- unable to initialize heap
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
Up%O$b
UQhGXXFMJrf0R5Mnpb9Z
-Uq]hh
UQPXY]Y[
URPQQh<
USER32.DLL
UU7yck
uuOK|',
/uV9e 
u|-Y h
V0b5Qo5G
v$6dD)
+v?6xI
{vd<YS
VerLanguageNameA
=Vh.*s
v\i*Mx
VirtualAlloc
VirtualFree
>V?`?j?t?
vk](+2%<
v	N+D$
`V,RmT
vXGk4Oc
W!/_}}+
W7iHHg?3
wa]e`{y
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
@;wcC_
Wednesday
W:Gu9h
wGv`oyQ
wiBYf3Yg8
{wI,D~
WideCharToMultiByte
~WK_ r
<-w lp
wM~_B=
 'w;mRK
w/o	@($f
WriteConsoleA
WriteConsoleW
WriteFile
WriteFileEx
'-WWL&
WwS<dj
w^XoG(
?X!*0`
`	>x3J
x}89qnjx
xbW?&*/
xgtrsU
XHlp>6D
X'I/IQ
(*xLD\
xNMr	dK
<x-Oxg
xppwpp
xpxxxx
xQufX!q
xqY_MhS
@x:;wHII@
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
`Y0q;{p
y{2FI6
y8gaBO
ya/x 20
YIx[x2"
[/y:qKl
yRt.^z$
%y{s#hE^|	
ySSGhb7kejwVKDJo
>=Yt1j
Yx??*2
za16^K)Zi
ZaJdZ"
ZE37\T8
	Z$	i02}
=#ZJ?OM{
zkxF	Z
ZP9VTISg2mmCr3K4hI
zucT>K
ZV787KXXuOVM36K7uSdMV84lNz
z,VWPM