Analysis Date2015-01-11 18:33:27
MD51e9093c2da46571f214a12bcc5c91b51
SHA18a88aa03e1a37d00b59db53cd325f08e64c249d4

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
PEhash7bfd043ac63ba2facdc9c3129ea88fe8c8472fd7
IMPhash
AV360 Safeno_virus
AVAd-AwareTrojan.Obfus.3.Gen
AVAlwil (avast)VirLock-A:Win32:VirLock-A
AVArcabit (arcavir)Trojan.Obfus.3.Gen
AVAuthentiumW32/S-43a675a7!Eldorado
AVAvira (antivir)TR/Crypt.XPACK.Gen7
AVBullGuardTrojan.Obfus.3.Gen
AVCA (E-Trust Ino)Win32/Nabucur.A
AVCAT (quickheal)Ransom.VirLock.A2
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftTrojan.Obfus.3.Gen
AVEset (nod32)Win32/Virlock.G virus
AVFortinetW32/Agent.NCA
AVFrisk (f-prot)no_virus
AVF-SecureTrojan.Obfus.3.Gen
AVGrisoft (avg)Win32/Cryptor
AVIkarusVirus-Ransom.FileLocker
AVK7Virus ( 0040f99f1 )
AVKasperskyVirus.Win32.PolyRansom.a
AVMalwareBytesTrojan.Agent.RND1Gen
AVMcafeeTrojan-FFGO!1E9093C2DA46
AVMicrosoft Security EssentialsVirus:Win32/Nabucur.A
AVMicroWorld (escan)Trojan.Obfus.3.Gen
AVRisingno_virus
AVSophosW32/VirRnsm-A
AVSymantecW32.Ransomlock.AO!inf
AVTrend MicroPE_FINALDO.F
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\VyAMAMkQ.exe ➝
C:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe
RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\QWcQAwoI.exe ➝
C:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\123.zip
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\gugYkUYk.bat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\gugYkUYk.bat
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\123.zip
Creates Processreg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
Creates Processreg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
Creates ProcessC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates ProcessC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe
Creates Processreg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
Creates MutexvWcsggUA
Creates MutexScUMMMcQ

Process
↳ reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt ➝
1

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\123.zip

Creates FilePIPE\wkssvc
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\123.zip

Process
↳ reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ➝
NULL

Process
↳ reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden ➝
2

Process
↳ C:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\VyAMAMkQ.exe ➝
C:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
Creates FileYQos.exe
Creates FileC:\RCX15.tmp
Creates FileC:\RCX14.tmp
Creates FileMQke.ico
Creates FileC:\RCX2.tmp
Creates FileIYMc.exe
Creates FileikIU.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
Creates FileC:\RCX5.tmp
Creates FileYMgI.exe
Creates FileAgoQ.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.inf
Creates FilemwIC.exe
Creates FileUcYC.ico
Creates FileC:\RCXF.tmp
Creates FileC:\RCX12.tmp
Creates FileooYG.ico
Creates FilekwkW.ico
Creates FileAsMc.ico
Creates FileC:\RCX18.tmp
Creates FileiUcc.exe
Creates FileC:\RCXE.tmp
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI
Creates FileUwwm.exe
Creates FileUoYq.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
Creates FileC:\RCXC.tmp
Creates FilessES.ico
Creates Fileosgs.exe
Creates FilecIIe.exe
Creates FileSEcA.ico
Creates FileEkwi.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\install.bmp.exe
Creates FileC:\RCX9.tmp
Creates FileIcMo.ico
Creates FileWcQe.ico
Creates FilePIPE\wkssvc
Creates FileWQYC.exe
Creates FileEEwG.ico
Creates FilesQQa.exe
Creates Filegkos.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
Creates FileQokw.exe
Creates FileC:\RCX1D.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
Creates FileqYEQ.exe
Creates FileKUIQ.ico
Creates FileAMIw.exe
Creates FileC:\RCX1B.tmp
Creates FileC:\RCX7.tmp
Creates FileAUII.ico
Creates FileC:\RCX17.tmp
Creates FileoYoI.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
Creates FilegQAo.ico
Creates FilecYMu.ico
Creates FilecQAO.exe
Creates FileskUy.exe
Creates FilesUES.ico
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
Creates FileocwI.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
Creates FileqEUA.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
Creates FileYcUA.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
Creates FileEQQG.ico
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ
Creates FileC:\RCX3.tmp
Creates FileC:\RCX20.tmp
Creates FileUwgO.exe
Creates FileC:\RCXB.tmp
Creates FileC:\RCX10.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
Creates FileMcoS.ico
Creates FileaQwY.ico
Creates FileYcME.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
Creates FilewMcw.exe
Creates FileC:\RCXD.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
Creates FileoUUc.ico
Creates FileC:\RCX1.tmp
Creates File\Device\Afd\Endpoint
Creates FilemIkK.exe
Creates FileC:\RCX1E.tmp
Creates FileC:\RCX6.tmp
Creates FileC:\RCXA.tmp
Creates FileYskg.exe
Creates FileC:\RCX1F.tmp
Creates FileuIEa.ico
Creates FileIAcK.exe
Creates FileMEAO.ico
Creates FileC:\RCX13.tmp
Creates FileC:\RCX11.tmp
Creates FileC:\RCX21.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
Creates FileQYQA.ico
Creates FileC:\RCX19.tmp
Creates FilemUUG.ico
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
Creates FileC:\RCX1C.tmp
Creates FileUoUm.exe
Creates FileAgoc.ico
Creates FileC:\RCX1A.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
Creates FilecAEm.ico
Creates FileAEkI.ico
Creates FileccUu.exe
Creates FileC:\RCX8.tmp
Creates FilegsoA.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
Creates FileIwso.ico
Creates FileIIcc.ico
Creates FilePIPE\DAV RPC SERVICE
Creates FileeUsy.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
Creates FileAQYg.exe
Creates FilekEYy.ico
Creates FileC:\RCX16.tmp
Creates FileC:\RCX4.tmp
Creates FileMIMW.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
Creates FilecoUK.exe
Deletes FileYQos.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp
Deletes FileqEUA.exe
Deletes FileYcUA.exe
Deletes FileMQke.ico
Deletes FileIYMc.exe
Deletes FileikIU.ico
Deletes FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp
Deletes FileEQQG.ico
Deletes FileYMgI.exe
Deletes FileAgoQ.exe
Deletes FileUwgO.exe
Deletes FileUcYC.ico
Deletes FilemwIC.exe
Deletes FileMcoS.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp
Deletes FileaQwY.ico
Deletes FileYcME.exe
Deletes FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma
Deletes FileooYG.ico
Deletes FilekwkW.ico
Deletes FilewMcw.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp
Deletes FileAsMc.ico
Deletes FileoUUc.ico
Deletes FileiUcc.exe
Deletes FilemIkK.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp
Deletes FileYskg.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp
Deletes FileUwwm.exe
Deletes FileUoYq.exe
Deletes FileuIEa.ico
Deletes FileMEAO.ico
Deletes FileIAcK.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp
Deletes FileQYQA.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\install.bmp
Deletes FilessES.ico
Deletes FilemUUG.ico
Deletes Fileosgs.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp
Deletes FilecIIe.exe
Deletes FileSEcA.ico
Deletes FileEkwi.exe
Deletes FileAgoc.ico
Deletes FileUoUm.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp
Deletes FileIcMo.ico
Deletes FileWcQe.ico
Deletes FileWQYC.exe
Deletes FilecAEm.ico
Deletes FileEEwG.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp
Deletes FileAEkI.ico
Deletes FileccUu.exe
Deletes FilesQQa.exe
Deletes Filegkos.exe
Deletes FilegsoA.exe
Deletes FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp
Deletes FileQokw.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp
Deletes FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp
Deletes FileIIcc.ico
Deletes FileIwso.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp
Deletes FileAQYg.exe
Deletes FileeUsy.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp
Deletes FileqYEQ.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp
Deletes FileKUIQ.ico
Deletes FileAMIw.exe
Deletes FilekEYy.ico
Deletes FileAUII.ico
Deletes FileoYoI.exe
Deletes FilegQAo.ico
Deletes FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg
Deletes FilecYMu.ico
Deletes FilecQAO.exe
Deletes FileskUy.exe
Deletes FileMIMW.ico
Deletes FilecoUK.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp
Deletes FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp
Deletes FilesUES.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp
Deletes FileocwI.ico
Creates MutexvWcsggUA
Creates MutexScUMMMcQ

Process
↳ C:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe

RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\QWcQAwoI.exe ➝
C:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.inf
Creates MutexvWcsggUA
Creates MutexScUMMMcQ

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\123.zip

Network Details:

DNSgoogle.com
Type: A
173.194.46.65
DNSgoogle.com
Type: A
173.194.46.64
DNSgoogle.com
Type: A
173.194.46.78
DNSgoogle.com
Type: A
173.194.46.73
DNSgoogle.com
Type: A
173.194.46.72
DNSgoogle.com
Type: A
173.194.46.71
DNSgoogle.com
Type: A
173.194.46.70
DNSgoogle.com
Type: A
173.194.46.69
DNSgoogle.com
Type: A
173.194.46.68
DNSgoogle.com
Type: A
173.194.46.67
DNSgoogle.com
Type: A
173.194.46.66
HTTP GEThttp://google.com/
User-Agent:
HTTP GEThttp://google.com/
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 200.87.164.69:9999
Flows TCP192.168.1.1:1031 ➝ 200.87.164.69:9999
Flows TCP192.168.1.1:1032 ➝ 173.194.46.65:80
Flows TCP192.168.1.1:1033 ➝ 173.194.46.65:80
Flows TCP192.168.1.1:1034 ➝ 200.87.164.69:9999
Flows TCP192.168.1.1:1035 ➝ 200.119.204.12:9999
Flows TCP192.168.1.1:1036 ➝ 200.119.204.12:9999
Flows TCP192.168.1.1:1037 ➝ 190.186.45.170:9999
Flows TCP192.168.1.1:1038 ➝ 190.186.45.170:9999

Raw Pcap
0x00000000 (00000)   94                                    .

0x00000000 (00000)   94                                    .

0x00000000 (00000)   94                                    .

0x00000000 (00000)   94                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   486f7374 3a20676f 6f676c65 2e636f6d   Host: google.com
0x00000020 (00032)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   486f7374 3a20676f 6f676c65 2e636f6d   Host: google.com
0x00000020 (00032)   0d0a0d0a                              ....

0x00000000 (00000)   94                                    .

0x00000000 (00000)   94                                    .


Strings
..
....`.C.
ZZ..Z.
.
..<
=.y....
..6
j
'

[_:?(0
*#0{0$F
=|04f:
0cbnqS	
0FQC=,
&0`un[
$0v=iF
<:>~"1
1$9f2#eL>W
.19[Ix
1A7%]N
1{eGMk
'1QTor
< >1z>
<:>~"2
2'-^[$
242Z32-C'
) 	2~9
2F<b`3
2F<C ?Zo
]2o~^A
2:+,oJk
@:2p->t
2S/ev[
2ZCxExum
[$"",3
35L\*l
37`w=b
3b2	7d
3.c`I/:8m
3i2	<d
3M7Qz'
%3(u<3r
3`v~@v
3Y3=ia
3YWmVL:
41|ql(
46Joz'
4,9ZkQ
4A	8|m
4B$115
4B8`o:
4?dFkr
4)<N5^
>4Oed\
&4Yfp$
5!04va
5!0*varsy@F
5a:s$sn7KE
5OCX.5
5p\Q(X
5"RZ7n?'
	|5TCI
5TR-VwP
5TR-VwT
!5;UnRz
/6/2/6
67vI~t
6{Ee:f
6r5Yy-.aE
6r^_xW|
6 s22]
6T<\5,
6v49/&
6:y~(N
6zfz B
.$77b(
7DF4C 
7"FFCx
7?FQC=
7fRk4f
7f? ?ZiM;
7lF]C=
7tF|C ?
7UFZC ?
)8'))2
8@2n3^
8"A~[,S
`}8G[z
>\8i^U
$`{8/Q
95	 l{
:$99jS;f*
9ex` x=
[9g(4L
9ik{.s
9{ivJ]
?]9,k92%Q
9/M,-GlN
',9p6U*
-,.9POI
~9 UP0T\
},@9}v
9/+_:v
9V|Me~HD
9'w+Is|
,a0Xw}
A5L<M]0KR
a6@-R|4	
AaT 8i
ABN,|;a!
@	abU)
\abU)abU)abU)abU)
a>~)Eb
AFsZOFx
AFxMnG
A/jB'*
/ajD:G
a~/K@3
AMHsQsq
Am.qc(!
ANQ"!h
A-qQC^7xC
/a?>/t
]]A"t.
at}oxl
aUf|C[g
AUWC ?
AvJ8*F
_,ax9Q
AXXuj(
B"2{<]JI
b]2!!U
*!b4m~
b7y	b7y	b7y	`7i	VWL	bwy	b
b=8HFFc
b*B?<"
B&d3I'v
b=.E\X*
Bf'wCd%
Bf'w{d%
Bf'wqdx
)?BH>=
B^JCL&E_
BqDM#@B
BRM3h?\
BWYV)p4~
b;y	b7y
{By"_Ne
bYN{r\
c}08@S
C;2yy?
c~ 32>
c}7"z]
c8oM3l/
c9FV).
cAi>@2
ceBBZO$@
Cf'w~e
Cf'w~e$
Cf'wxe$
!c' ;h
C~!hZg
(C/nh'
C:{oJa
|c|Qt:
cquOYz
`Cr_	Z
CS\cr*
cUaF)4
cvPu5p
CvyqIk
/Cwcr'vmr
-&d= ?
DAKH=	
)d;d5V7
dE^[wK
D@~@Fs
%)#djL
DKBtOL
|D+(mFZ
"do:k~;v<
DPe-7G
DPJ8Uo
D![$!u,
dU{gP#
duxt%/B
Dx*qT'
*%E#=!
}e7c<d
EAX9JZ
=EC4Qz
eD}&[D
eehFq6
[eg"9m
Eh4`:C
e${ID3
_E`i@j
Ejv<uZ$;6
eM]:T.
em'vBN
Em?[yF
{;E(_of
!e^+oW
:=$ets
-EWC&"
-EWC&"/Cg
e%'x8j
f4Uze&h
""fACg
 `fbkqF
!F\C=.
FCC=!~
`F/CFF
F,C ?G
(FeC=(
FEf-\w
Ff|v^@
fg A=3q
fgABhks
fgPAYs
,f'JOb
fL[\$,
F}lwG}b
~fmir'imuA
{fN5{RV4
FR4? ?
@Fs.AF
{fV5Ofc
+FV|cv
\fz}dj
G?<~0&
? ?G1j
g2	4d2
G}4 G}w
(g57?_
g:!)a1Y
!?Gc*s
GFS.GN:)
ggF,Efk
|gGh&	
G)&iH9,
gJ.Ata
.>GJBz
g`JL,}
gJ'YY3
gKe'r#{a
g=~Ne~U
~GR8N]
gu\,ox
= ?GvM
<G}w9F}
g"wJOB
/$H0Rz
h3gB~F*.
h9d%pvj
"hasH(K
HB@jJs
H%cCBR
HFl+y,
H&>g(v
H+`I1AG
	Hji`U
~|h:lL
HP=wy,
hr6RxQ^;$
h#t;"(y
hX-R#vth
	h#/z5
i0p!kWn
I4oU=Z
i9_i*x'S
|}i?ADU
&	Ih\p
i{]hy:
*IOQ_ML4
'Io}x2X
iq;gU}
`i<#R 
IS1C{+
it}oxmY
I)]WW2
IzosSY
J}">=\
(J(![1X
j;5a""
<j9+/y
'J_ApJ
=JB ?y
jcUrzJ8C
J&=(eE
*jFL>X
jFN[dP
+}j$GE
jGJ']'b
jLD,1!
jn`T	|`
j)p]9p
JQ5L]#Z
jrd(n!~
!jTe[ PG
*JtUv	
}JvZIgv_
^~jwEr
J<YuN(
jZ#UGmJ
~JZ<yE{
<K.0tj
keih"z
K#''f)
K?gxXl
@?kI0%f
KiD\eo
k+KhqB
~`KNgt/W}unj5
K'}o?`
kpEZ3o6
K+	qFl3
{kQgg|I
K#wRxy7mkX
_.,_l	
L?2#c:sa
L~35w~
L|35Y\
L4VDX0
L8z[a5
lDE/>`n
&Lg;EL<T
L]!)GY
LH>9&do
l_IpHj
lj!~1G
LK45p\
L]lvxA
-[l]N# SL
lq9Vqt
Ls*p^u[{
LtI5V_
lY+tFhS
/L\~Zn
)l_z-p
LzRsS0
m2n/_`f
m30H-b:
;M7Qz'
MaCU)>bU
Mb.8uP
<"mcNu
)Me[\J
]M&IX{
#mmcf L
Mnztqf
mR~W#Zvq
M! U9;
mU>n~$
}MU-PO
mU|s~i
|*n'1HYt
n#1vRk
{N3<&;<
$N6B*f
^n6Y >
+n7*|lnN
nFw_{h
NiG2+:
n=ix`3
~NJUN8PG
nP VQ/.
%.nTo(
N> U5+O
N.VYf8
nX	W7L	b7
NYyR) S
~nz(&'
$^;?O,
O1bSN*}PP
O5>X%X
oaCe],h
o{axhP}
OC?gM!aD
Ofkqs2Y
'>O>H1=N
~OI}{es|
\oILU;8
OR	}KX<]
\oT&=t
?#ov@d
OVJ%!>
O~x.K!
o~> ?Z-
,/,P2[|
:P],2X
p<$[!6
|p61u3
<P:7.fz
p9_M>"*
pa	@53K
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
+Pc'6>
peW\(^Ose
pF3^?n
pg@N|&
p]gs_=7AM
pHK&RM
piA)2JV
PJ7L	`
"PM?#5
}Po_PxG
pp8nOAP
p>PRSP
`:pQ!~
PU:l2c
^P =u?Pq
PvB&F)t3t
px/`'fm8
P%xxB%
P^y/ #
!q4/>s
q.7"d=r
Q8*BkF
Q] A^g
qB&=2}
q<e'\YC	<V
QF5BM0' \WO
@QG*A)
QI,#SZ
>	*q}l
q>LIAA<_
qmNF)R
"/qP}%
qPQ]/2
 Qp[TF
qt}oxmY
Q }VCR4
qVL0Py
 q<X^q
QyC'^Y6
r"}}0@
r49p+]
R+'5H6'qt
<r5}\@r
R:5vtd
R-aS03
[rb(W$
R!,D y
rdZ9(]
Rich!4O
[r}&Jn
rL'gm/
}RLzon
Rm7*b 
r%Mlb^
rM"z={"
-RR{<F
r&|(R)KL
rSwcfSw
^R;t3;
RTZb^!
:RuhRzp
r%<Z>1
RZd,LH
rZFy7-
+s27-u
&?S9kE
\SD;AO
^SF<gn
 sfo}_
<sJu*8
S\Lq	F
.S)n;S
~*sS's
S%TPxV
^(?Su*
Sv^i$o
`s'w2Z2
:<t&~@
~,!T19
t1`IQI
t2=AF^(
T2!gCHn	
>T`5?a
!+tc[|X
T_)^d44m
T\e:di.*X
TG}3TG}
!This program cannot be run in DOS mode.
tN1K;<
t>&[#O
tq2e!	
TR-df@
tS\,3s~
TWqDD-Ta
TwtN9Y
$~u7Tf
Ub)"(.
UbK8SaJs
}ubuyG66w
!Uc<\/
uC)<zc
Ue-Ja5
uF'w}d%
uF'wEd%
Uh5fMv
uHv2a$0
UI-T8Lf
uL{k7g
}[,&U&m
uML{}9F
uq{cC*{
UT\{OB
U_;tU|
'uUU6W
U~X\,P'
u|Y*vO
v0+l/g
V7%uS1
}vA(e.0u
vCme}8
v.E8),t
v@Fy>Jn
?VG>pJz
Vi+?Ws
__v`{mj=
!<=v~S
vt}oxmY
	vv)t[`x
<~v-XEKp$
v(xL+nT
Vz2LP21
w7*D1u
w8<\GiA
 \Wa S
wcr'PYr
=w{{h5
WHBC0n
WhYU?*
WH,zo/W?;
WkJ"k[4
w+/L5u
w~tg%1
w?U+p>
@wW{hyz
x0~tn<
x:1HL*
=x3u]k
X?6]KY
Xa[5LW
XD8d#6.
xDl#+@!
X~Ht+K
x[j\3?
x;%LeY
'xmCG,
x>ME}.
xndY&	R
#Xp	su
Xq68w5
?!X(s!
(xvcsk
xxepk{
X}~X;I 
:<y?= ?
,}-}Y,
/+@Y+`
&Y;[!<
:y*-2Y
Y3v=TtA
}y44)=
|`Y5tSO
[	y6O8
yEBA[6
y!G\AGc
Yh	7q!;
Y};h7W
y{HAi"F
yII{OK>
YjUPMElp
yK]++F
yOVySb
y<R\:`
$-{ysE
Z0,>*]f
^Z4}>R
zEY<_E
'Zf8=XG
{{[\zI
zL)9|z
Z> ?p!
z+Pac~
Zq8=E!=
:Zu**o
zy 7"< 
ZyKFxw
ZY#$NE