| Analysis Date | 2014-11-28 17:39:49 |
|---|---|
| MD5 | 23b505a976ead36ac9b7f5e236b850dd |
| SHA1 | 504315b36afd611c55a7d6f0c84202c8698a2005 |
Static Details:
| File type | PE32 executable for MS Windows (GUI) Intel 80386 32-bit | |
|---|---|---|
| Section | .text md5: 952dc2ad42517b1a488b2d4ad954cb12 sha1: a7024ada76bd5c30e7f9dd06e4a3c14f39d18820 size: 26624 | |
| Section | .rdata md5: 490f84b68d1ec9222df72e702b977c9e sha1: f9318812e3a45a12897858fa6b225327f7997dfa size: 134144 | |
| Section | .data md5: d5c114c72eb9f8c84b787ba9594ee94e sha1: 7e5d1c17fcbbdea98d7b9d15de7942dd1456032e size: 3584 | |
| Section | .rsrc md5: 242073099bc48a0fd3b92238afdab878 sha1: 016ffe29b3121a5781a0040e20826d276b6751c1 size: 49152 | |
| Timestamp | 2014-03-14 16:01:05 | |
| Packer | Microsoft Visual C++ ?.? | |
| PEhash | 33151b94fb09c4b517146793d35e7d678ba25bc3 | |
| IMPhash | f01eae9a37db806e6de36e108a9ab772 | |
| AV | 360 Safe | Trojan.Generic.12028721 |
| AV | Ad-Aware | Trojan.Generic.12028721 |
| AV | Alwil (avast) | Malware-gen:Win32:Malware-gen |
| AV | Arcabit (arcavir) | no_virus |
| AV | Authentium | W32/Trojan.BUYW-8676 |
| AV | Avira (antivir) | TR/Agent.214528.65 |
| AV | BullGuard | Trojan.Generic.12028721 |
| AV | CA (E-Trust Ino) | no_virus |
| AV | CAT (quickheal) | no_virus |
| AV | ClamAV | no_virus |
| AV | Dr. Web | no_virus |
| AV | Emsisoft | Trojan.Generic.12028721 |
| AV | Eset (nod32) | Win32/Korplug.DC |
| AV | Fortinet | W32/Zegost.AFBV!tr.bdr |
| AV | Frisk (f-prot) | no_virus |
| AV | F-Secure | Trojan.Generic.12028721 |
| AV | Grisoft (avg) | no_virus |
| AV | Ikarus | Win32.SuspectCrc |
| AV | K7 | Riskware ( 0040eff71 ) |
| AV | Kaspersky | Backdoor.Win32.Zegost.afbv |
| AV | MalwareBytes | no_virus |
| AV | Mcafee | no_virus |
| AV | Microsoft Security Essentials | Backdoor:Win32/Plugx.L |
| AV | MicroWorld (escan) | Trojan.Generic.12028721 |
| AV | Rising | no_virus |
| AV | Sophos | no_virus |
| AV | Symantec | no_virus |
| AV | Trend Micro | no_virus |
| AV | VirusBlokAda (vba32) | no_virus |
Runtime Details:
| Screenshot |  |
|---|
Process
↳ C:\malware.exe
| Creates File | C:\Documents and Settings\All Users\DRM\XXX\XXX.exe |
|---|---|
| Creates Mutex | Global\wvkvx |
| Creates Service | XXX - C:\Documents and Settings\All Users\DRM\XXX\XXX.exe |
Process
↳ C:\Documents and Settings\All Users\DRM\XXX\XXX.exe
| Creates Process | C:\WINDOWS\system32\svchost.exe |
|---|
Process
↳ C:\WINDOWS\system32\svchost.exe
Process
↳ C:\WINDOWS\system32\svchost.exe
Process
↳ C:\WINDOWS\system32\svchost.exe
Process
↳ C:\WINDOWS\system32\svchost.exe
| Creates File | C:\Documents and Settings\All Users\DRM\XXX\nprqyjadoqkp |
|---|---|
| Creates File | PIPE\lsarpc |
| Creates File | \Device\Afd\Endpoint |
| Creates Process | C:\WINDOWS\System32\msiexec.exe |
| Creates Mutex | Global\gbunwodqgillmltcd |
| Creates Mutex | Global\wvkvx |
| Creates Mutex | Global\eklrhgdvaqrfzgugv |
| Creates Mutex | Global\ommdvtuqnjwvdfajh |
| Creates Mutex | Global\sodkb |
| Creates Mutex | Global\yomxamirg |
| Creates Mutex | Global\ssmuagced |
| Creates Mutex | Global\msbczwdtcpdsi |
| Creates Mutex | Global\mschu |
| Creates Mutex | Global\imbubnxhqpaew |
| Creates Mutex | Global\wzuxiivdwflbzshku |
| Creates Mutex | Global\qydqc |
| Creates Mutex | Global\gxklm |
| Creates Mutex | X |
| Creates Mutex | Global\uimnyxkbx |
| Creates Mutex | Global\mticc |
| Creates Mutex | Global\iqlpefsfveadljlia |
| Creates Mutex | Global\aelyqgtun |
| Creates Mutex | Global\mwmjwuuwpuvcczsph |
| Creates Mutex | Global\mtjaoumdbnyvq |
| Winsock DNS | 192.168.254.254 |
Process
↳ C:\WINDOWS\system32\svchost.exe
Process
↳ C:\WINDOWS\System32\svchost.exe
| Registry | HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\List of event-active namespaces ➝ NULL |
|---|---|
| Creates File | PIPE\lsarpc |
| Creates File | C:\WINDOWS\system32\WBEM\Repository\$WinMgmt.CFG |
| Creates File | C:\WINDOWS\system32\WBEM\Logs\wbemess.log |
Process
↳ C:\WINDOWS\system32\spoolsv.exe
| Registry | HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝ NULL |
|---|---|
| Registry | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝ 7 |
| Registry | HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝ NULL |
| Registry | HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝ C:\WINDOWS\System32\spool\PRINTERS\\x00 |
| Registry | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LogonTime ➝ NULL |
| Creates File | WMIDataDevice |
Process
↳ C:\WINDOWS\System32\alg.exe
Process
↳ C:\WINDOWS\system32\svchost.exe
Process
↳ C:\WINDOWS\System32\msiexec.exe
Network Details:
Raw Pcap
Strings
.CC
About
Copyright (C) 2014
exe Version 1.0
&File
H
((((( H
h&About ...
&Help
h(((( H
iE&xit
@jjj
jjjh
System
>)>&>-
(;&;.;
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0A@@Ju
0SSSSS
0WWWWW
=$=1=4=
1cK\i3
#21M@[
;*&2Kv
2[p{a{kF~
2p{K`(pN
2yltn&
]3cOK]7
_3,;F
[3{j[<
3?,ROk
)*3w[{
478N3,
4~f9.u
4;/W;rP
5*#21&
58+7k=
5]Ky1+
5u_lE3
5Yc>f_
63[4]5mm]5\]m]mm5\mm5555555\\\5\\\5m\55\\5ed:
789V8L!
[8"-5++
8/K8#;
}*/[*9
9fOk{IG
;a\>aN
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
aCJCLCg
[a~Hp-
aJYJ$J
+AKCMs
[@alKq
An application has made an attempt to load the C runtime library incorrectly.
+aPP\p
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
August
b5[*v~
;+b?,b
BBFFf;
BCGCRCVC
BeginPaint
BGEGNG"G
-BSiKt
B"yLy?
,!}c%`
;_;\;C
c_3';b
C'4.6N
_C\CeCnC
C~Cq[D
`CdCqC8C
c+,I>Rk,m
c+kKQi
;c<l<@
CorExitProcess
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
=C=P=M;zm
+Cq"yNy
CreateWindowExW
- CRT not initialized
D07=y+k
_.d2&0
@.data
?DCDPD
_DcDpDHD
dD[0_b
dddd, MMMM dd, yyyy
December
DecodePointer
DefWindowProcW
DeleteCriticalSection
DestroyWindow
DgEpEuE
[dHw&E2mz)
DialogBoxParamW
DispatchMessageW
DlDtDDD
DMDZD0D9
dMLlWd
DOMAIN error
DpDmD@DI
DpESE E
[D%Q1Q-[Q9Q5{z
d>q>w>?>
&D:rmk
DuDSD'
;>;E;%;
;E<1<:<
e;2=Qg
|E6o V
"E#E1E.
E\EiE'
e+g2K>
>eGwWGJ+
eGzb))
|eieC]
eJ<JDJQJ
>E>K> >
EncodePointer
EndDialog
EndPaint
EnterCriticalSection
EqEsE-E
<^=e=r[=w=G
EvEZE0E9
;e;x;B;
ExitProcess
@@f98u
%F9F6F
FaFdFmKFAF>FQ;B
FaFeFr
FbFfFk
FcFlF@F=
February
FEFTF(F%
F$F4F F
F_{ HOLO
F=K=5=
f;l`k/
- floating point support not loaded
~FlO?O<O
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FmOvOJOO
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FRFSF'F$KF
Friday
]fSMT'k L
Fu[O>O
FYO"O&O+
\<%$g`
'G2G3G
"g5)Lg
Ga[HiHf
GetACP
GetActiveWindow
GetCommandLineA
GetCommandLineW
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetMessageW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessWindowStation
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
GetUserObjectInformationA
GetVersionExA
!G%G9G6G
G\GpGmG
GhGqGuG
<_<g<K
G|pgHp
;`;g[;p;u
g>z>2>
h9Bis;
HBHGHKHV[H'H$
{#[>h>e>
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
h;e;m;v[g
H)H2H6H
H#H7H4
HH:mm:ss
H_HwIPI
/[hi3#l/
hI*I+I
HKIYI"I/
hkk-Sb
hKq$WqcLqc
H;K;T;";
hK\vv<
}hoM{h
~ {h.Sq
hWnT7'
/[\{i>
I3')+*+)))*))()*+++,6J!54 CBA
@I3_.A
IcJkJtJ
ICKC$C2C
ICLC C$C
I=cu=cl=
IdJ J/
iE\w=);
IFMFZF
;@iGsmG<
I{IbJI
I^IcICIW
I I`'t9J
IjIoIXI$
I\JjJoJ
I[JUJ3J
)&._+Ik+
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
^IoIsI@I
iOk[k3
Iq[JRJ,+
=i+rOK=T=
IsDebuggerPresent
IsValidCodePage
j8j ^V
JanFebMarAprMayJunJulAugSepOctNovDec
January
jD%DrE
JEEEEEEEEEEFC
JEEEEEEEEEEFD
JEFEEEEEEEEEB
JhCkCvC
JHHGGGGGGGGHI
Ji[JmJz+
J'J0J5J
J[JdJy
JJIIIIJIIIIJJ
JK;O;z<A
=]=j=p=
JsEO[E
;j;w;J;K
JYo&MI
jYPQTVTSkllZTTXRTUiHceWda/
< ,K>,
k>#>0>->
/k5[#3'
k:74>=
Kal3/KaK
{% kD"O
(_KE_[b
kernel32.dll
KERNEL32.dll
KERNEL32.DLL
K<\<e<y
KGKf_Nf*
k'K<#9
KKj[FWwwbW
K$+#{m
?kMS@M
\k"ohs
kpi7ai
[kQi3_jp
K;{;r=y
]]KT>n
+k;v;;;
kWeGnGBGG[G)G2+8
ky2yb2y'y
:[l{ag
LCMapStringA
LCMapStringW
L[di3}/
LeaveCriticalSection
lG=GQG&G
L ^L g
l`N.;'
LoadAcceleratorsW
LoadCursorW
LoadIconW
LoadLibraryA
LoadSC() = %d
LoadStringW
LpltMp
_:_LtY*
M;+bJz
>m>D>M>V
MessageBoxA
meZ8ne
mf<1[<
MH!H%H2H
Microsoft Visual C++ Runtime Library
.mixcrt
m[J`{G
**m*Kbc
MM/dd/yy
Monday
MpaKp$
mp?|h5
&{=;ms
mscoree.dll
MultiByteToWideChar
<m<z<>=O
;N;);.;
N_c5'#
NE*k<.
nk5)3Y$`
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
NSLymMG
Nw~ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt
{O3[]{
)O6530./21+*-,4#4PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP
O(@>=77A779?<8;$O'
ObOgOrO
October
OdOxOuO
<o<@[<=<F+k1<}K<
OgPpPtPA
;O[h5`{
OiPtPRKPYP+P
O%JEEEEEEEEEFFB
OKgPT[
oK]=S%]
Om\8sCU
O(O,O9O
O}OvPQP
Op{\O{m2
OpPyP=
O`PyPMQ
OtgQS;
;O[`vc
)P2P6P
PaQ?QJQ
P![B+P|P\KQeQyQv
PDPMP!P
PgKPwP@PG{:W
>PGLGXGT
PhPvPCPN
Ph^=QIQE
\[pkf;
Please contact the application's support team for more information.
{PoHxH<HI
PostQuitMessage
P&P7+!
P(P$P0P,
P_P\Pi
P_P\PiPw
PPPPPPPP
PPPPPPPPPPPPPPPPPKMNNNNNNNNNNOLO
P@[QUQ9
Program:
<program name unknown>
- pure virtual function call
PV[I#P-P3
PvQG[QKQXK
pwwwwwwww
pwwwwwwwwwwwwwwwp
pxDDDDDDDDD@
pxDDDDDDDDDDDDDDpx
pxDDDDDDDDDH
pxDDDDDDpx
pxwwwwwwpxDDD
pxwwwwwwwwwwwwwxpx
";P<Y<
q5Ck#5A9
,`|q" 8
*-qCK`5
QcRuR:R
QDUD"D
QeRSR!R
QiRoRwR
}>qooggggggg1`_fhsnHK
QOQLQ Q(
QoQzQ;
{Q;@OR@ww
QQSVWh
QQ{yYQUQ!
Q_RgRkR?
QueryPerformanceCounter
QuKRXR
r)*3]?
r]>bB;
`.rdata
RD/w[b
RegisterClassExW
rrkQK3ohk
RtlUnwind
runtime error
Runtime Error!
=>=R=W=
=S= =#=,
S?9F"a
Saturday
=\=s=E=
September
SetHandleCount
SetLastError
SetUnhandledExceptionFilter
;"sF)F
>s;GH;OK
ShowWindow
SING error
SoCxC<C
sOGODO'O
;[;so;l;)
Sunday
SunMonTueWedThuFriSat
t^9(uZ
tD9(u@
:[Teq\
TerminateProcess
This application has requested the Runtime to terminate it in an unusual way.
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
Thursday
;t;I;-;
tImItIk;IJIQ
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TranslateAcceleratorW
TranslateMessage
{T_[RxR?{TWR
Tuesday
;t$,v-
<T<)<W=
t+WWVPV
U57#9F[X
UIF_BkD
- unable to initialize heap
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UpdateWindow
upwv$H
UQPXY]Y[
URPQQh
USER32.dll
USER32.DLL
uYj,Kj'3
v<=<+<8<
[vH,c
VirtualAlloc
VirtualFree
=vKg Lg
v N+D$
vR=RDKR
[)+v!V
V$+Vi)
<;W8 C4.8[
w8 KlI
_wb)_K*
wC;L;
Wednesday
WideCharToMultiByte
W>[=*K
wk_5+z
WkV21TSav^8{
/w_l;k'
Wm!_Rl
wOtOXO
;w;Q+Q
WriteFile
wS9D2=
wsprintfA
Wwg.q8~
wwwwwwwpx
wwwwwwwwwwwwwwwpx
X_5.$9
X{5kK2F
xh`K]{
XJGLJ5^
Xlh~+yXK
X;U;*;7;
=X='W=.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Y;1i0.6l
>YG^HD
Ygv[Y?vV
y\NZP|Eb
Yo+UYw
>=Yt/j
{|yvrrwsqpon
YYu-9D$
YYuTVWh
+z.;4;
ZcD"M[
zkgKvt
{ZL5\5
{zsDVD
ZY9FXL"cX
}zy|yx~