Analysis Date2014-08-22 01:54:25
MD5b7947708fc888a38238dabae49803377
SHA18c8c8fc35073a1be51bb638e46d0920d28f76d4d

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionUPX0 md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
SectionUPX1 md5: 3b39eba5d8ca5c8ab58102add6cb078d sha1: cd9ed59f594923da25f741f8f2115b9dbfb65388 size: 136704
Section.rsrc md5: fa51b06bfbf3e197fa3639ff5fe535dd sha1: ef1e965dfc8eee3e421bae35f4c5d925112599ad size: 4096
Timestamp2004-06-18 19:34:20
VersionLegalCopyright: Power Danny Pals Nudge 1996-2006
InternalName: Cords Mane Hide
FileVersion: 7.10
CompanyName: Bitrix
ProductName: Lear Like Nasal
ProductVersion: 7.10
FileDescription: Crumb Extant Dwelt Ryan
OriginalFilename: Lost.exe
PackerUPX -> www.upx.sourceforge.net
PEhasheaec6dcad3e00eb68f76cadfcfa97e1997b5ac3e
IMPhash5bbad803dff944bd4ecc30eebb5bb076

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\hgqejsuwnulghlrg.exe
Creates FilePIPE\lsarpc
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\hgqejsuwnulghlrg.exe
Creates ProcessC:\WINDOWS\system32\svchost.exe
Creates ProcessC:\WINDOWS\system32\svchost.exe
Creates Mutex{37FFF806-FE56-017C-F492-53D695A61D45}

Process
↳ C:\WINDOWS\system32\svchost.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\rsdobpfm.log
Creates FilePIPE\lsarpc
Creates Mutex{380001F2-FE56-017C-F492-53D695A61D45}
Creates Mutex{37FFF806-FE56-017C-F492-53D695A61D45}

Process
↳ C:\WINDOWS\system32\svchost.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\PbvJeqsq ➝
C:\Documents and Settings\Administrator\Local Settings\Application Data\huettqja\pbvjeqsq.exe
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit ➝
C:\WINDOWS\system32\userinit.exe,,C:\Documents and Settings\Administrator\Local Settings\Application Data\huettqja\pbvjeqsq.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\huettqja\pbvjeqsq.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\qcvbfpbp.log
Creates File631D2408D44C4f47AC647AB96987D4D5
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\huettqja\px1.tmp
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Startup\pbvjeqsq.exe
Creates File\Device\Afd\Endpoint
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Application Data\huettqja\px1.tmp
Creates Mutex{37FFEB21-FE56-017C-F492-53D695A61D45}
Creates Mutex{37FFF806-FE56-017C-F492-53D695A61D45}
Creates Mutex{37FFF72F-FE56-017C-F492-53D69CEA1D45}

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\hgqejsuwnulghlrg.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\wmtqhnod.sys
Creates FilePIPE\lsarpc
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\wmtqhnod.sys
Creates Mutex{37FFF805-FE56-017C-F492-53D695A61D45}
Creates ServiceMicorsoft Windows Service - C:\Documents and Settings\Administrator\Local Settings\Temp\wmtqhnod.sys

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 800

Process
↳ Pid 852

Process
↳ C:\WINDOWS\System32\svchost.exe

Process
↳ Pid 1208

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1864

Process
↳ Pid 1180

Network Details:

DNSgoogle.com
Type: A
173.194.121.37
DNSgoogle.com
Type: A
173.194.121.38
DNSgoogle.com
Type: A
173.194.121.39
DNSgoogle.com
Type: A
173.194.121.40
DNSgoogle.com
Type: A
173.194.121.41
DNSgoogle.com
Type: A
173.194.121.46
DNSgoogle.com
Type: A
173.194.121.32
DNSgoogle.com
Type: A
173.194.121.33
DNSgoogle.com
Type: A
173.194.121.34
DNSgoogle.com
Type: A
173.194.121.35
DNSgoogle.com
Type: A
173.194.121.36
DNSsnkbcptiqgqmlvw.com
Type: A
54.186.240.135
DNStlxfrilp.com
Type: A
94.126.178.29
DNSitehtxcch.com
Type: A
176.31.62.76
DNSeeuprbpohspwje.com
Type: A
176.31.62.76
DNSrxkhdpigbqoeco.com
Type: A
198.61.227.6
DNSybdwipovbicmpekyh.com
Type: A
198.61.227.6
DNScascotqhij.com
Type: A
50.116.32.177
DNSrjordulltl.com
Type: A
208.73.211.242
DNSrjordulltl.com
Type: A
208.73.211.163
DNSrjordulltl.com
Type: A
208.73.211.174
DNSrjordulltl.com
Type: A
208.73.211.175
DNSrjordulltl.com
Type: A
208.73.211.193
DNSdnmjahdaigeydiiorky.com
Type: A
141.8.225.80
DNSnbykkrkevuri.com
Type: A
198.61.227.6
DNSgoopndlgvy.com
Type: A
109.74.195.149
DNSckgryagcibbcf.com
Type: A
50.116.32.177
DNSlbdlmcmfuinc.com
Type: A
173.230.158.166
DNSalgvgcawwdsmiksvol.com
Type: A
107.20.253.26
DNSstar-trakers.com
Type: A
DNSstleikxkbjwo.com
Type: A
DNSlrqxvrqsihwtudox.com
Type: A
DNSovgucbrrvxqufkwq.com
Type: A
DNSufxsqnjtryrny.com
Type: A
DNSrykgnuncbedueeuevxg.com
Type: A
DNSyssrqxyljwrioko.com
Type: A
DNSbunxomdqokknkkllvkr.com
Type: A
DNSxioyjfiguiuluff.com
Type: A
DNSelieidkolpc.com
Type: A
DNSwbjatshumpre.com
Type: A
DNSoluddrbaeb.com
Type: A
DNSidseneqmupdijjklvtm.com
Type: A
DNSvfcyyjwcdrjjunrrw.com
Type: A
DNSxumpkgnvdcmhykvdak.com
Type: A
DNSnbqealvkhirjn.com
Type: A
DNSjbkjkngvaiwaxr.com
Type: A
DNSwmbnkplxddiaktnkjk.com
Type: A
DNSthxkchcnhyssj.com
Type: A
DNSigspslbpjencmfax.com
Type: A
DNSixsoscorrrqvyd.com
Type: A
DNSuhndpadrwbuuchcvn.com
Type: A
DNSeolgavefbsntlobsnpp.com
Type: A
DNSskqbirmcomtjty.com
Type: A
DNSyarymutdstxwp.com
Type: A
DNSskroackqs.com
Type: A
DNSngwhgabaxkpievvmm.com
Type: A
DNSpbfttfgw.com
Type: A
DNSujypninrop.com
Type: A
DNSqpvvabbaqcn.com
Type: A
DNSttjerkrdrrowibsipjr.com
Type: A
DNSnrcmbkxssydac.com
Type: A
DNSghxctletck.com
Type: A
DNSfybdqchsheqiul.com
Type: A
DNSwsjapwfphnhriq.com
Type: A
DNSgormlunjjt.com
Type: A
DNSkojadineqlbbfvtwlff.com
Type: A
DNSqvddnchpjtskjmgdlx.com
Type: A
DNStcpfmbhnlyw.com
Type: A
DNSobmfvijftylgjpf.com
Type: A
DNSoqenuuygfpvopu.com
Type: A
DNSknugxvsimayety.com
Type: A
DNSabsqvhpldvsmclt.com
Type: A
DNSsexdsgnrojhpptqb.com
Type: A
DNSlcloroifjeilomowq.com
Type: A
DNSsphmwjrwlfl.com
Type: A
DNSisuhxkbqqxuauhdwn.com
Type: A
DNSuwsctpihlt.com
Type: A
DNSmfsxlnoqvslcyfbl.com
Type: A
DNSmsxuafqnwjhljurmw.com
Type: A
DNStufictpfglnlfq.com
Type: A
DNSlgsjwixwocm.com
Type: A
DNSrhfdjaecmygcrdgep.com
Type: A
DNSppgessnvvn.com
Type: A
DNSgccadwuf.com
Type: A
DNSfiblolpp.com
Type: A
DNSnwoyejym.com
Type: A
DNSumjxwuaaso.com
Type: A
DNSntqbbnywghbjvsoivo.com
Type: A
DNSkrtvnyxc.com
Type: A
DNSfgvkxjvghdulfrx.com
Type: A
DNSwrfpmykunwbrscjann.com
Type: A
DNSrkevnmhekdgvnf.com
Type: A
DNSurcnkvuuju.com
Type: A
DNSyxhkddrdcpbccoabmuk.com
Type: A
DNShjwrnlvdbcmjrfkjx.com
Type: A
DNSdvgeqsama.com
Type: A
DNScjemaqojxac.com
Type: A
DNSorgflqxdnoyecgwib.com
Type: A
DNSogpshvhk.com
Type: A
DNSwpwaislxxgiskgscy.com
Type: A
DNSixjtpaxclwhxmadp.com
Type: A
DNScmuhommmdlmhy.com
Type: A
DNSvpchdxywmxtxedwgfac.com
Type: A
DNSlolkcovkfktwhaks.com
Type: A
DNSjhfugjtncuvsuumnks.com
Type: A
DNSbygfsdfmrwbhlghll.com
Type: A
DNSmmigsmpwmmwtxacq.com
Type: A
DNSatuealmjufcwwb.com
Type: A
DNSrjykgymugqlscttx.com
Type: A
DNSxiangglgqatolsgfxqi.com
Type: A
DNSqewgaoursqgghhfwbqa.com
Type: A
DNSyecjrsxe.com
Type: A
DNSxfcdavqouyevtvgjwu.com
Type: A
DNStthayebvhdmntiyeuxw.com
Type: A
DNSluxsnxlqhebftttflob.com
Type: A
DNSybbwxrcoujexdh.com
Type: A
DNSxcmcupdfcevkgbrue.com
Type: A
DNSumyratdfvmdrlpm.com
Type: A
DNSlpggutwsvtvnmvpxrc.com
Type: A
DNSmlfymmarbaswncxmn.com
Type: A
DNSswtuvuibfapnited.com
Type: A
DNSxnuqkdwek.com
Type: A
DNSylvylxwjpkcdl.com
Type: A
DNSlqkdmcplj.com
Type: A
DNSukbukpuj.com
Type: A
DNSvjrjcapuwf.com
Type: A
DNScncvxhadekwnybnv.com
Type: A
DNSutvjcdjcwgqm.com
Type: A
DNSlbcqwwxucahiulchx.com
Type: A
DNSdegbxpos.com
Type: A
DNSfvfeiutlwaw.com
Type: A
DNSlanwiojchmenjhn.com
Type: A
DNSqnmqexiqrxhvdwgl.com
Type: A
DNSjfvgelaqyfhxygq.com
Type: A
DNScxmdhrpwuvyl.com
Type: A
DNSarqogipjsbcdmk.com
Type: A
DNSkbadlfpgtec.com
Type: A
DNSkjuldacvvmdffxi.com
Type: A
DNSymcwineqkj.com
Type: A
DNSjyvfsnsqddbgxq.com
Type: A
DNSvjpufudekyotltdnog.com
Type: A
DNSiuhohaeqgpikwwgvkki.com
Type: A
DNSbvkdfvxoqxsabk.com
Type: A
DNSatfkpyicxsrrwqbct.com
Type: A
DNStupexbvpmsc.com
Type: A
DNSwqnefkerofcmrap.com
Type: A
DNSjjfcilvuchkjvutlho.com
Type: A
DNSlwnfgmpncjubpseh.com
Type: A
DNSginbkjuweobmwp.com
Type: A
DNSanqsjvhjjkypabm.com
Type: A
DNSmmwhewlrckie.com
Type: A
DNSyscqbwwljsiwwr.com
Type: A
DNServffluceipmfb.com
Type: A
DNSkjhsrucajdjlbpwwj.com
Type: A
DNSkcpxjxrmvurhfe.com
Type: A
DNSfktpfwoqpgcagpal.com
Type: A
DNSjufxfkajvqmjljumvuq.com
Type: A
DNSthkqfhupjgknkqcxhou.com
Type: A
DNSmwsjitqbf.com
Type: A
DNSsjfrarsvyhlr.com
Type: A
DNStsilfaftadrrs.com
Type: A
DNSccsnpnqxii.com
Type: A
DNSdpdadshi.com
Type: A
DNSeljmrnwualb.com
Type: A
DNSopxxjqvyjllj.com
Type: A
DNSlfnjosunfd.com
Type: A
DNShjxrksvo.com
Type: A
DNSnqlocokxsjnsffxeu.com
Type: A
DNSpaoxlrmbg.com
Type: A
DNSfqaeucdaicvnisqbd.com
Type: A
DNSgeyameywwoaf.com
Type: A
DNSqekgxfrk.com
Type: A
DNSnoslwqaagtoxunnv.com
Type: A
DNSwnoykspnesqfwbkgi.com
Type: A
DNSrglaabsktspwrw.com
Type: A
DNSuhjwxipj.com
Type: A
DNSmkmngqxwk.com
Type: A
DNSbpmlhpuogveluyobjb.com
Type: A
DNSybmhumhymqj.com
Type: A
DNSsvyafurnyrjrrfxjreh.com
Type: A
DNSjpaaommxplsmmnnp.com
Type: A
DNSutvvpcpmqhbnedb.com
Type: A
DNSqopdypfxhda.com
Type: A
DNSpfkilgedjhq.com
Type: A
DNSdjeuagtquwwhera.com
Type: A
DNSrfngjynkypsphqfmkh.com
Type: A
DNSjnpquwdupgauq.com
Type: A
DNSgsbwxfecgbmuysm.com
Type: A
DNSrlvwjjhntfooonvhlou.com
Type: A
DNSccquxmelkltnucyqv.com
Type: A
DNSiyaxaucrvnhmkylya.com
Type: A
DNSqlbycfgbpvjwa.com
Type: A
DNSkqweenxsiyjtbe.com
Type: A
DNSsgimiytkanu.com
Type: A
DNSleqnxekmi.com
Type: A
DNSnyxmwnkkacwamvj.com
Type: A
DNSieugluxmlx.com
Type: A
DNSrmuyrkxxtk.com
Type: A
DNSoiexgmycrtwirsgcmv.com
Type: A
DNSiokxcthosa.com
Type: A
DNSdcyakhpr.com
Type: A
DNSbaxqqapjrxxetjelhtk.com
Type: A
DNStrlnhbpanhmspru.com
Type: A
DNSstrhnkjvfskxlwinku.com
Type: A
DNSlarpjpbblpnkdwyx.com
Type: A
DNSwdcjfyyfwpx.com
Type: A
DNSeaayjpeyabqf.com
Type: A
DNSegvqomxmea.com
Type: A
DNSlnlhuiitohdvbgmx.com
Type: A
DNSgjehgcrav.com
Type: A
DNSrqybdbvyvjuruuxv.com
Type: A
DNSmryonirvcpm.com
Type: A
DNSqukccxcwi.com
Type: A
DNStekiyftuevgnor.com
Type: A
DNSqjnhsbctfdfpoisvgp.com
Type: A
DNScqlnwqaioac.com
Type: A
Flows TCP192.168.1.1:1031 ➝ 173.194.121.37:80
Flows TCP192.168.1.1:1041 ➝ 54.186.240.135:443
Flows TCP192.168.1.1:1042 ➝ 94.126.178.29:443
Flows TCP192.168.1.1:1043 ➝ 176.31.62.76:443
Flows TCP192.168.1.1:1044 ➝ 176.31.62.76:443
Flows TCP192.168.1.1:1045 ➝ 198.61.227.6:443
Flows TCP192.168.1.1:1046 ➝ 198.61.227.6:443
Flows TCP192.168.1.1:1047 ➝ 50.116.32.177:443
Flows TCP192.168.1.1:1048 ➝ 208.73.211.242:443
Flows TCP192.168.1.1:1049 ➝ 141.8.225.80:443
Flows TCP192.168.1.1:1050 ➝ 198.61.227.6:443
Flows TCP192.168.1.1:1051 ➝ 109.74.195.149:443
Flows TCP192.168.1.1:1052 ➝ 50.116.32.177:443
Flows TCP192.168.1.1:1053 ➝ 173.230.158.166:443
Flows TCP192.168.1.1:1054 ➝ 107.20.253.26:443

Raw Pcap

Strings
Hb@4
..
.
.
.
.
..
.
Hb@4
..
.
.
.
.
..
.
;

040904B0
7.10
Bitrix
CompanyName
Cords Mane Hide
Crumb Extant Dwelt Ryan
FileDescription
FileVersion
InternalName
Lear Like Nasal
LegalCopyright
Lost.exe
OriginalFilename
Power Danny Pals Nudge 1996-2006
ProductName
ProductVersion
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
1b}h9X
^1hu>F
1LjxAgiI8
]1}+np
}2;#`#
2U_y~[
31n>WOF
3\3."	
3?=J:\
=3+jE7
~#3J~H
3(l=P!
3$N=0co
3rSm[ikL
3SdEcp
3ys_yY
.4bMa+h
4l:7TZ7U
4lD>O4@
4Modul
4[p8U9F
4X&8?s
~$5[Fa
@5y4%v
67F^'C
6A$LMnY~
6hkL2Aj
7Gd0FZ
)+7^h[
;{7TRK$
?7 |uc
&886WRy
8j&`KjH
8'rg&4
8T5Vv|AVJ
9DOtv4
9	=Ol~o_j<T(
a2Rer)
a4~cA%
%a64"-X
a6'l|Ic
,Abn&y
a	bou|
	a%G*x
AMKooZ
.=AOx-
AvSp{gu
^Be-3&a
>'bG}W
(b/M.z
@b,!/n
boP!Vq
bQ~hP^
BRmv9pbXr
bUJQI0
Bx3n5SlU>tIZ7
$By6ToWi
,cA!~{
\CCk(A4
Ci	6*AF
|CKoo_
C{	nL1
cOjuJw
COMCTL32.DLL
CurrentPro
C#z4Zl
$d}4IBy
D4X{,B|
D6i6lS
d{~bvB
d(I4{Ism%<
DjiQAO
d tC}	_
DWp5`j+(
d$!Yp,
E! 0}s
E#2r7.
@<e'6m
(eCloseHandle
ek{aj7`H
EP6>(967
evb3Pc
EWe	4D
ExitProcess
f78I	7|
F;ebAc
F+eI[U
fGy\Gt+
F]HmJ}
[fhq23
fi(X)7_5N
f{K/iH
fmgt=gS)
frN0,0
f?:r%U
f}W1h$b
G@,0_}N
^g0X&3
G\{6gC.q(
GetProcAddress
.GHc2+
GhzxhFXE
gJII1w
=GLqeb
	g{Q_2Nk
g.rz+=p
&#Gt.h
gWSmoz
,h`#~<
h}|0s'[
`H8nS!1
h	dExceptionFilter
h-+eW!{
+)HK"X-
hl:BaS
H	lWA}
hnrXb.
H#TmW+Q
}`hV*l
=hZ}pn
i''1!h
I|ea7}
ieON9kkO
ierNEL32.dLL
Ij#<nB
{@iku+Ypj*
\I.'M7V
i}M*t|*
ImxK5>
-iN*EY
InitCommonControls
I!Rtlm
I>xCW_h
	=	/]j#
j5uGyY
Ji:<N3
J}__%M
|jmk!z6P
jp;qNEF
J=}Q"xZ
;;JRI 
*J?sP'.T
Jv/6X-
jW7?"a)
%k 5A.
k63.X2
KB0f	g
KERNEL32.DLL
KFy8KI
K-FY(OT
*kHSw3
K=j$wJ=
K\n3g'
kStdwg
k&sXbA5
ktVk``)G;05'
%"}@kw
&kweeEK
,l1[(9
l%^7vY
lBjvB'G
l`b+n!
LH6!gO
	l-jS$
}!lk=*^$
LoadLibraryA
_L}@p`*o
lR1;uey%^
LT`799IPY
LWw{ug
lXlB,X9
m4umh}N
M8+Zmk
MB3i)A
mC0eU2
mctB'*
^^(mic
m-JQL8
M@oVZ?
MrInR1@Ev
mu5-Q[
mwbKYh
!m/x;&
MxOH9_
}_n@4Q
Nd0zC}-
+n*)i0
/(|no9
n,OBfv
nPhejH
}nPvkB
nrKzKr
"\nrT<
NSm#j^H
nw''''o5oc
o9gM1g
Oa#6l6
OD>X3&
OEMCP	M
o_Hy}#T
{OJ}(f
*oL3#N#
-	oLSp:#k
oNGXomm
owENCri
*#$P-4
p|f6-o
]PF"*-;R|E0
pGF7K_
(#p)hK
p[ :}?IG
PK81._Z
PkC.%@
P(l=ITiu
Pmu!w5
:>:pQ2
pr#!'3>Mx
:"*,P%S
?]~pT]%
PTrsLI"
P*W[xB
,P?XV$
Q28Y[p
[Q2v3y|
;-,Q C
%Q+eb+,L
qgQLf~!
Qp_YbH=
q\sMW;;
Qw^jx?
qX9E/M	
qZ<t<Z
R5#dV3'%R6 	
rFHv#<H
>r]g e
r))p7A,
RQ= qR/Q[
R'(v`@
S_1{+,
@s3jo$B
}s|7uM
sEx/&4
Sgt1:zuPm
SHLWAPI.DLL
SLas,lmo
["SMb!
Smi Cl
	STMaE
StrCmpNIA
svvvi)h>o
Sy-fDir42y6B
T,)4eU
,T7l-S=
T7w>L&
T#co;^p
!This program cannot be run in DOS mode.
;t[M-e
tS}wtvu
TTIXc+
T}+u/x
tuxTh`
TXXtcB`
^%;*/U
)@u:0-T
U|5%43
u_a?tT
"%uH8w
]uJx{HS
*u	[k]%l6N
!ukT-Y
Ul`[|D
^U('TQ
v+|{7Lc
v7YGA^
vck.Dec
VirtualAlloc
VirtualFree
VirtualProtect
-V,	KgoS
vLineA
[VMl1Cc
]V=PuB*
vZWaFF
w1R<6!`d
W4U63?
}w6=!7V
Wc|	/o
@ w%Fl6lH
whI+ov
W>$HP6m
wR/!75
w(vxGK`
wx;UyN/}z
x2Oy{t
Xc)yF}-
-X`fO6
'xGHBm
Xih$)<
xJd3}v
xlxvQB'l
@<Xp4j
?Xpo#_
XPTPSW
^x^}t`
XvoK=M3
$XY_p+
	>XyUi
Y4 .<"
_Y}`A1
y}%\C@
y$io3s
y=!>n"
$y\V{^
`$+Yxq
YXw ''_^
Z3[$'"K
ZJK`0<
ZL`wL-W
zn7K	o5
z{Oy]("
Zq&=gd=
Z}:v)X*
ZxQ/_1[bnM_