Analysis Date2015-01-19 20:52:24
MD5e6d218ab346b15862ddb4d7d3d0a4174
SHA161f6765fa928fbfd2c3b4cf1cada4544f4de90b1

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: d6d37d4f595209e1c01eb9d2724c7223 sha1: 14c6c8c2b2c1a833ac0abc6afef8865bd03ce14e size: 123904
Section.tls md5: 17e8df062e529cdeb38d67debebc9810 sha1: 4fac50ba33368f806356c67b5b8d7f6549e0746d size: 1536
Section.data md5: 57c133572062ea58421cc3431aec213e sha1: 7ffb5e2c23e375685c1042c9b62875108845fb90 size: 72704
Section.reloc md5: 9a9467200148e8cabcdd2250f1fa90d4 sha1: cb172299bac3e7a882d65b436259bb6ac285a5a9 size: 1024
Timestamp2005-08-29 02:16:13
PEhasha27fcbd1c69e8ffc7f9cc10a62b15f1d9589c711
IMPhash7bb6820ba120292722e7d7f61b74d9f4
AV360 Safeno_virus
AVAd-AwareGen:Heur.Conjar.9
AVAlwil (avast)Cybota [Trj]
AVArcabit (arcavir)Gen:Heur.Conjar.9
AVAuthentiumW32/Goolbot.K.gen!Eldorado
AVAvira (antivir)TR/Crypt.XPACK.Gen
AVBullGuardGen:Heur.Conjar.9
AVCA (E-Trust Ino)Win32/FakeAlert.J!generic
AVCAT (quickheal)Backdoor.Cycbot.B
AVClamAVWin.Trojan.Cycbot-6047
AVDr. WebBackDoor.Gbot.70
AVEmsisoftGen:Heur.Conjar.9
AVEset (nod32)Win32/Kryptik.SMY
AVFortinetW32/Kryptik.SMY!tr.bdr
AVFrisk (f-prot)W32/Goolbot.K.gen!Eldorado
AVF-SecureGen:Heur.Conjar.9
AVGrisoft (avg)Win32/Cryptor
AVIkarusBackdoor.Win32.Cycbot
AVK7Backdoor ( 003210941 )
AVMalwareBytesBackdoor.Bot
AVMcafeeBackDoor-EXI.gen.s
AVMicrosoft Security EssentialsBackdoor:Win32/Cycbot.G
AVMicroWorld (escan)Gen:Heur.Conjar.9
AVRisingno_virus
AVSophosMal/FakeAV-IS
AVSymantecBackdoor.Cycbot!gen5
AVTrend MicroBKDR_CYCBOT.SME3
AVVirusBlokAda (vba32)BScope.Trojan.MTA.01556

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
1
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load ➝
C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Application Data\75DE.FFC
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
Creates ProcessC:\Documents and Settings\Administrator\Application Data\dwm.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe%C:\Documents and Settings\Administrator\Application Data\Microsoft
Creates Mutex{4D92BB9F-9A66-458f-ACA4-66172A7016D4}
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutex{61B98B86-5F44-42b3-BCA1-33904B067B81}
Creates Mutex{F053D246-5CC9-46E9-9C51-723D87E9990B}
Creates Mutex{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex{5D92BB9F-9A66-458f-ACA4-66172A7016D4}
Creates Mutex{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}
Creates Mutex{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNScalaculat.com
Winsock DNS127.0.0.1
Winsock DNSfile4exchange.com
Winsock DNSonlineinstitute.com

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data

Creates ProcessC:\Documents and Settings\Administrator\Application Data\dwm.exe

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe%C:\Documents and Settings\Administrator\Application Data\Microsoft

Creates ProcessC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe

Process
↳ C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe

Network Details:

DNSonlineinstitute.com
Type: A
67.227.195.200
DNSzonedg.com
Type: A
141.8.225.80
DNSzonedg.com
Type: A
141.8.225.80
DNScalaculat.com
Type: A
DNSfile4exchange.com
Type: A
HTTP GEThttp://onlineinstitute.com/g7/images/logo4.jpg?v76=41&tq=gJ4WK%2FSUh7zEhRMw9YLJsMSTUivqg4a8zZtEfqHXarVJ%2BQhhSEU%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1kX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh%2FMe%2BcoJuX%2BSNxFKv975Xlm5G
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1kX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88y%2BcoJsX%2BSNxFKv975Xlm5G
User-Agent: mozilla/2.0
Flows TCP192.168.1.1:1031 ➝ 67.227.195.200:80
Flows TCP192.168.1.1:1033 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1034 ➝ 141.8.225.80:80

Raw Pcap
0x00000000 (00000)   47455420 2f67372f 696d6167 65732f6c   GET /g7/images/l
0x00000010 (00016)   6f676f34 2e6a7067 3f763736 3d343126   ogo4.jpg?v76=41&
0x00000020 (00032)   74713d67 4a34574b 25324653 5568377a   tq=gJ4WK%2FSUh7z
0x00000030 (00048)   4568524d 7739594c 4a734d53 54556976   EhRMw9YLJsMSTUiv
0x00000040 (00064)   71673461 387a5a74 45667148 58617256   qg4a8zZtEfqHXarV
0x00000050 (00080)   4a253242 51686853 45552533 44204854   J%2BQhhSEU%3D HT
0x00000060 (00096)   54502f31 2e300d0a 436f6e6e 65637469   TP/1.0..Connecti
0x00000070 (00112)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x00000080 (00128)   206f6e6c 696e6569 6e737469 74757465    onlineinstitute
0x00000090 (00144)   2e636f6d 0d0a4163 63657074 3a202a2f   .com..Accept: */
0x000000a0 (00160)   2a0d0a55 7365722d 4167656e 743a206d   *..User-Agent: m
0x000000b0 (00176)   6f7a696c 6c612f32 2e300d0a 0d0a       ozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   316b5825 32425039 68253242 49307344   1kX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a682532 464d6525 3242636f   OhLgjh%2FMe%2Bco
0x000000c0 (00192)   4a755825 3242534e 78464b76 39373558   JuX%2BSNxFKv975X
0x000000d0 (00208)   6c6d3547 20485454 502f312e 310d0a48   lm5G HTTP/1.1..H
0x000000e0 (00224)   6f73743a 207a6f6e 6564672e 636f6d0d   ost: zonedg.com.
0x000000f0 (00240)   0a557365 722d4167 656e743a 206d6f7a   .User-Agent: moz
0x00000100 (00256)   696c6c61 2f322e30 0d0a436f 6e74656e   illa/2.0..Conten
0x00000110 (00272)   742d4c65 6e677468 3a20300d 0a436f6e   t-Length: 0..Con
0x00000120 (00288)   6e656374 696f6e3a 20636c6f 73650d0a   nection: close..
0x00000130 (00304)   0d0a                                  ..

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   316b5825 32425039 68253242 49307344   1kX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 79253242 636f4a73   OhLgjh88y%2BcoJs
0x000000c0 (00192)   58253242 534e7846 4b763937 35586c6d   X%2BSNxFKv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6564 672e636f 6d0d0a55   t: zonedg.com..U
0x000000f0 (00240)   7365722d 4167656e 743a206d 6f7a696c   ser-Agent: mozil
0x00000100 (00256)   6c612f32 2e300d0a 436f6e74 656e742d   la/2.0..Content-
0x00000110 (00272)   4c656e67 74683a20 300d0a43 6f6e6e65   Length: 0..Conne
0x00000120 (00288)   6374696f 6e3a2063 6c6f7365 0d0a0d0a   ction: close....
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.


Strings
.
@.
..
Ru 
T. 
.
..
.Q
{
>.
.
..

080904b0
1.0.0.1
1871
&All Exit        Shift+C
&exit
FileVersion
PrivateBuild
ProductVersion
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
```````
``$``!
`:&` \
~~~~~~
<<<<<<<
===========\\
 & `}*
______________=
-------
-------------
,,,,,,
,,,,,,,,,
::::::
!===============
!!!!!!
!!!!!!!!
......
......}}
.				>>>>>>>
"```. @
""""""""
)))))))))
[[\\\\\\
{{{{{{
{{{{{{!!!
{{{{{{{{{**
}}}}}}
@@@@@@@@@@%%%%%%%%%%%%
$$$$$$$$$$$$
&` $@`
&  _  
&&&&&&
&&&&&&&&
%%%%%%
++++++++++
00>>>>>
00######
000000
071[7y
0A,!x"
&` 0FT
``0hd6
0i6'G'
0ZA]O`
1111111
111111111111111
11111111u
 @1F^%l
1hX: @ ;u_
-1$OXf
&@@1t?J
____|||||2222+
2222222
2gL1y	
2!>NB3
`2SciQ
2Ue}:K0j
-#2Y1Q
@&```>%3)
~3#1GY
33333333555555
33RRRRRRRRRR666666666
?3dI4a
~3	;@h
3$@`ND
}3Qazc*
&``3vV
444444
4444444444
44444444444YYY
4444444sss
'<4/6.
4fDfGE
 5#0l?|]
[51!&}
	542(~ 
55========
555555
555555555555
5G{!7f
5H\;##V
5QCywjW
&&&&6666
6^,@`F
6nm:H\s
|77#%#
77=}}}}
==77777   
77777cccc
}}}77^^UUUFFFFF
?79aBe#
7D\~c}R
7LcE'%2
7(  PH
[7RF[H
(`@7UU
 ){!7z
8/0,``
81e1U]
85nS3{
.....88
88''''
88s,,,
8cJ @ 
@@8G-%
`8ZYA:d
9999999
` /\#a_`
~A1& `
`A6uo.
A#7, @
;'. `?A9y
|||||AAA
aaaaaa
AAAAAAA
AAAAAAAAAAA
AAAAAAm
aaaa>ggg
aaaa[[jjj
AAHHJ;
ADVAPI32.dll
/af(``
=Al~OQ/
aO6hqc
A"QF]K
|AR-#5wf9
AuK`"%T
B678^C
B7,@`O
@ b8zp
bann(v}
BBBB44
BBBBBBB
bbbbbbbbbbbbbKKKKKKKKKK
BBBBBmmmmm
BBBBUUUUUUUUUUUU
bbbMMM
B\=\ipC
BQ(@T9y
b:ri3'
"bsX,}
`@	Bv}
byj"$Q
@ [c0s
)c11111111f
C`#4nj
c5`|m|
c"#aNr
CB6g\m"
cc...........<<<<<<<<<
ccccccccccccc
cd;'Uy
C	Elaye
CG}]Iu
CoTaskMemFree
==C=p\\22222
CreateProcessA
CreateStdAccessibleObject
C#R)S)
C'RZej
`)Cu>9)
"c*@V%
`@d~[>
D0d@T@
D.@ 2FQ
d[$`@8A
 d_8K	:m
D%$_=A
@.data
dddddddd
ddddddddd
dddRRRR,~~~~~~~~~)))))))))))
dhtNK\~i
D\\\\\\\\KKKKK
DN<7<<
d`	q(.:
DXCG`iN
&&E.////////
{E=7uL
@`E8!E
*EEEEE^^^^^
EEEEEAAAAAAAA
?????EEEEEE{        
EEEEEEE
eeeeeeee
EEEEEEEE//
EEEEEEEEE
EE[{{{{{{{o
@ E& `F
>!Eiyt
EjU![?
EnumResourceNamesW
:Epm}$
ExitProcess
E!XNNHN
f2VP+H
}`f@=8
fbG2dV
/f\bYQ
F|~CxB
fffffff
)fffffff
FFFFFFFF
fffffffff
_^)fGL
F^h'86/
FQ71Ta
FvZjmGh
@f>W|z
FXXXXXXXXXXXX/////////{ttt
g+>	DU51
@`{=gE?
GetACP
GetCPInfoExA
GetCurrentProcess
GetEnvironmentVariableA
GetLocaleInfoA
GetModuleHandleA
GetSystemTimeAsFileTime
GetThreadLocale
))))gg 
G#g3K:Fh
gggggggggg
GGoooooooooooooooo
Giiiiiii
Gmn2A&`@>
]GN%ol
))))))%%%%G___..\\\\PPPPPPDDD
H4444m
H\8g)1V
H955@be
h.dllU
HH4444
*HHHHHH
|&hhhhhhh
hhhhhhhh$$$$GGGG
HHHHHHHHHH>>%%%%%
:H$@ N
`	hNhF
hPAPIU
|H*Qm!
|HRHsX
H$Va%{p
H( Vki
h;,vXr
}^Hx7h
I1HqH"\
?I69.`
ICM.'%
~.@@ig-
iiiii444
iiiiiAAAAAAAAKKKKK
IIIIII
'iiiiiiiiiiiiiiiiii
IIInnn
I["@@l
Il[ko5'^t
I%MT#D
InterlockedExchange
IsDebuggerPresent
IV'c;$
i* @wxB
"I;\:x
j9zke{
JbhF+6
@JesPXl
ji*tn|b
      JJJJ
jjjjjj
JJJJJJ***
jjjjjjj
JJJJJJJJ
j<M'7d
 @Jx=O/
~jzb{[
@ kA& @
%kA,6'A]:
& @kAo
k',BST|r
KERNEL32.dll
kF8NkL
kGXv]c
&k*$J>
KKKKKKKK
kkkkkkkkkkkkk
KKKKKxxxxxxx
KlzAUt8/
`l3t(kWW
L&@`el
-lG	*`
 lK`=|A
lliiiiii
llllllllll
LLLLLLLLLLVu:
llllllZZ
llxxxxxxx
LocalAlloc
@@l`Pt
LresultFromObject
lstrlenA
lstrlenW
l$)}+Tg6:an
Lt`o=u5
l;T`zt
LuaAt>
luu<WA
):<-Lx
|m*%3U
M=B	us
%md5ZeN
m`	KA@
MMl)))))))))))))))))))))))yyPPPP
\mmmmmm
:::::::MMMMMMMMMMMMMMM
MMMMMZZZZ
mTMt}~J
MultiByteToWideChar
M'%v-.
M@)v `
^NB8a4
nGGGGGGPPPPPPPP
NJ<LBe
nnnn,,,,
NNNNDDD5
nnnnnnfffffffff--
nnnnnnnnnnnnnnnnnnnt
N]nSk[
+n`p-Q
NW7b%0
NXj{"@
nzZ?(``W
<O~<"`
O80yDG
o97~Q311K
o	!9p8
o:#Au!
 OaY8u6 4S
oGv#cB
`O_[l$
OLEACC.dll
oooooo)
//ooooooooo
ooooooooooo
OOO!PP
o<O'p@]4
}O(O\T
Op\A)r
OW~,x"d
pe}'S4
_p$`@H
{P[J}~o1
[.  PL
`@PLfj
pnnnnnn
ppp				
ppppp.....
pppppp--``
PPPPPP
ppppppp
+++PPPPPPPP++++++
P[p_?u
ProgIDFromCLSID
@@Ps9U
@pVnNk
pw7}c8
|;qBxW
q^#gWa
QhWS~dd_
QIM:7R
@@qL;#
qq\\\\
"""qqqqqq
qqqqqqqqqqqqqeeeeeeeee
.@@QRfx
QusemF
Q/wVJa
qxxxxx
_R2g,@
_R*2gve$q7
raG	%)J
RaiseException
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
.reloc
r)g*4nt
Rg5A7&
RG`PlI
~.@ Rh+Q
@@RLZK
r#_~Ns2
r$OAW#
Rp}DeAi
====RR
RR!!!!
rrrr((((((
RRRRR'''' 
rrrrrrrMM
rrrrrrZUUUU
rrrrwwwwwww
rrrrzzz
:	~=rs2
 RsZndA
Rt_(`@
r'T$P7
@rw\Ztpld
"`@rXT
_!r-Y?
s5DK;e
]S9y  `
:sCw6v
s=EK(@ 
SetUnhandledExceptionFilter
}sfnsSu
?Sg:;}
SHELL32.dll
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
s\I]]R
sss!!!
SSS[[[[[[[
>>>>>>ssss
SSSS/////////
SSSSSSSS
sssssssssAAAAAAA"")))))g
SSSSSSSSSSSSSSSSS
StringFromCLSID
StringFromIID
!:sU*@`)
@S!u6s
.{+%`T
*******T
t@7l~<
T)#b]1
T]gNVN
'TgYlc
!This program cannot be run in DOS mode.
tIC7s-
T=)laI
Tpfk/"
tqQ^_{';
TRU:~}
ttttkkkkkkkktt
TTTTTT
TTTTTTTTgggggggg
TTTTTTTTTT
T-V6Pp
TvQ  @x8
tzbXq:`
u3&  " 
UD9-, 
uD&BB|
udIuK-
UE0h1Z
ue>5g=G
Um g7t:
UnhandledExceptionFilter
uOvvvv@@
%U(@ p
U	{$^q#
uqiGF8
'U=Q-M
uqxWB1,@
u==S,k
-{uT-)?
uuuuuu
UUUUUUU
`uuuuuuuuu
			uuuuuuuuuuuuuKKKKKKKKKKKKKKKKK
& `%/v
  V-|*
V\\\3333333
v5ba^+
VCGw	+
V)FbL4i
Vhss~EQ
VirtualQueryEx
*@ VIYa
/*-#VJ
 Vo" @
VOws7ys
Vssssss
>VSz"`@F)
@*  VU
.....vv
]]]]]]]vvvQQQQQQQQQQQ
vvvvvvvvOOOOp
vvvvvvvvv
VVVVVVVVV}}}}}
VVVVVVVVVV
vvvvvvvvvvvZ
vvvvvvvvyy
` V ` w
VX)`p^
+V=y})?
V}Yzl6
(\`V,ZI
)Vz)z^%
W#1^8P
w=#1Kl
#W`2:/
Wb[IY9
wB,@ q
/wgPkF
WideCharToMultiByte
w<k, @
;$@`Wr
w#RJ]FMs
WW0ioo
www||||
wwweeeeeeeee
wwwwwKKK
=======wwwwwwwG
WWWWWWWWFFF!!!!!
wwwwwwwwww
^wwwwwwwwwwww33AA
Wxe8d/
,`@X?_$@
X4&&&&&&&
x,4McW
X8g*``
X,C@6w
 x<Dlg
!)Xi*` 
x?j]`8
/XkD#>
x,m?!J
XM}X<$
 XPp.  * 
xppppppp~
XX{<9F
xxH|&@
XXXX<<qqqq44XXX+
XXXXX$$
xxxxxxx
Xyu{)xk
(=y)#"
######y
 `;Y%}
@ |Y( 
Y0*``'
Yc{QGlW
&@ y=D
yDN#v=#F6
[YHnCg`
yk'Bbm
Y!\O]Q
#(+YSbO
^Y+UWi
yyyyhhhdd
""""""yyyyy
YYYYYYY
YYYYYYYAAA
yyyyyyyy
YZFq6s!"
>>>>>>>z
 `$ `z
z.``{ 
z'''''''''''''''''
[z4"  ,
@`ZB]^
+Z+~Df
*`@z<e
_!@!ZF
ZK}=-O
Z`MkCV
>zo3M|
Zppppppppppppp%
Z|Rx:x7
Z%&)xxe
ZzuIel*
zzzyyyyyyyyyyyeee
ZZZZFrrr
zzzzQQLLLL
ZZZZZZ
zzzzzzzz
]]]zzzzzzzzzzzzzzzz44