Analysis Date2014-08-28 19:12:44
MD58d1e2e0b0c004fec586706e6578bff5b
SHA1a4aa1bf6e843d2500b8efa34f5610f3499826674

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: fcf25d3708915d415c287565034a90bc sha1: 4b66f9ee7d3adbcc96e732874a36680e5592dd79 size: 25600
Section.rdata md5: bc46e68b4ccca62654da04e14bfef94b sha1: 357519445454d3ac648b3b5a5952ca85ee94cfb8 size: 7680
Section.data md5: a2eac7035ebc3e70ab5cb91ae3c2292e sha1: 4023f0209cdfe4f8f9343943fed345d6233d8460 size: 152064
Section.rsrc md5: 7a70533ba36a730a2788350636c750e0 sha1: cc77906213bcb87508c6b7e0854bf0b341e8f014 size: 48640
Section.reloc md5: 7bce82b221dc62a7d62b231db44bd9f1 sha1: c6a9f7cb3d9db8782c867956d412a59714f8a0d2 size: 4096
Timestamp2014-08-25 05:38:47
PackerMicrosoft Visual C++ ?.?
PEhashfbc47f45bc571ec913ec8a956e01c6e2092ebda5
IMPhash0284f4483cfa39f6f8c08ac867e47162

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_LOCAL_MACHINE\Software\CLASSES\FAST\CLSID ➝
NULL
Creates FileC:\Documents and Settings\All Users\SxS\NvSmart.exe
Creates FileC:\Documents and Settings\All Users\SxS\NvSmartMax.dll
Creates FileC:\Documents and Settings\All Users\SxS\xxx.xxx
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates MutexDBWinMutex
Creates MutexZA-MUTEX

Process
↳ C:\Documents and Settings\All Users\SxS\NvSmart.exe

Network Details:

Flows UDP192.168.1.1:53 ➝ 192.168.1.1:53
Flows UDP192.168.1.1:53 ➝ 192.168.1.1:53

Raw Pcap

Strings
.CC
 
.
.
.
-
.
.
+
.
.
gN.U
tH
.
.
Y

??(&F)
                                 H
         (((((                  H
??(&H)
h??(&A) ...
         h((((                  H
i??(&X)
KERNEL32.DLL
mscoree.dll
MS Shell Dlg
Shell3
SHELL3
                          
0$0,040<0D0L0T0\0d0l0t0|0
0!090\0l0s0~0
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
$020y0~0
;$;(;,;0;4;8;<;@;
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
^%0a>_7
0A@@Ju
0lV4~F
0O1X1^1
!0Q0c0
0SSSSS
0WWWWW
1&1:1]1i1u2
1	1.141?1K1`1g1{1
1)161]1u1
1+181D1N1V1a1
19.V#|
1AxCog
1L<sO&R
1	+PZ8L
2"212>2H2~2
2!2'232B2H2Q2]2k2q2}2
2&2q2|2
2$2T2u2
24383@3D3`3|3
 2Ef8k
 ),2JW
2\#_.R[
2^=S2O
)2[Tj7
2Vuu3y
31D1~1
3$3*383A3P3U3_3m3
:3:D:J:[:
3H4X4h4x4
<3>iqB
3Lwgl)#
3M6T6Z6
3V@[Es 
3z4*5_5x5
404L4P4p4
445@5S5e5
4;5B5]5b5j5p5w5}5
46xP/"
4{[:AN
4/d/qdq
4/F`Fw
-4,k"\B,
4QJTcS/3v 
4wCKe1
505P5p5
5tbuekL
:5:<:U:i:o:x:
63[4]5mm]5\]m]mm5\mm5555555\\\5\\\5m\55\\5ed:
6%6*656:6G6U6[6h6
6&6.6>6S6
6 6$6n6t6x6|6
6/6X6i6{6
6cb=Uh
6"imZnQ
>6JL#J{/
6jn|@3
6#k7{1r
7 7A7k7
7/888D8
7b7<8D8\8t8
7HSs\LW
/7PCVyy
+$83if
86zzxB0 q
8'828V8_8f8o8
<8&Jhf]
(&$8lO
8L`q3#kM).*
*8n%5o
8q8w8}8
8xExH%
95g=GOC
9&989K9V9\9b9g9p9
9!9)919=9a9i9u9
9"9'979<9B9H9^9e9x9
9&999Q9c9
99dK)~z3
9	{.A>MJ
9,P9UNz|
9::@:Y:_:
9<Yp1:#Z
A7F		5K
A8)&0Mr
AAFFf;
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
AcF]:L
A&l=e(
a]n7riu
An application has made an attempt to load the C runtime library incorrectly.
*A:Oqj)
~aTp(c
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
A$tv]R
August
AX9J}s,
Bd@LJ3
BeginPaint
^bknQO
_bRKYy_
B'~:sg
`*}c{!
+^c1]\
_=$>Cb
~ch?(-	
C].j``
-(CM/N
\C!\+Mo
c%%oaz
CorExitProcess
cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,
{ Cqc%
Cr=eAj
CreateWindowExW
- CRT not initialized
{.<cZL
czq!e4FB+f
D51{x^
@.data
&Dbs^(
D}"-D0
dddd, MMMM dd, yyyy
:D;d;t;
December
DecodePointer
DefWindowProcW
DeleteCriticalSection
DestroyWindow
DialogBoxParamW
DispatchMessageW
D?k[~b
DOMAIN error
DPwB/^z
d{s'G5
E!*40;
e8w'FX
|E9}/o:
EncodePointer
EndDialog
EndPaint
eN_fuS"^
EnterCriticalSection
es#2tW
esOTs0
ExitProcess
eXMykG
&f1PxK
	F3o[_
FA{	b[gl
:f)E.~7
February
\FEv.	
F^k?e=
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FM2Cw<
FreeEnvironmentStringsW
Friday
F&S +u
F YLuB0
GAm[ie
G	~c1bb
GetACP
GetActiveWindow
GetCommandLineW
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetMessageW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessWindowStation
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetUserObjectInformationA
G,]F[D[6
_g}Hr.
G;\z	)
H14GdJ
H1L1P1T1
/H4x)~|x
h)5/]6
[h#6>FK
h?BW]~
h.BYr0mC
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
HH:mm:ss
H~K@#d,:j
}Hn	tS
hS@cS^
H}"+>T
hTUw@rC
h?umq~P
I3')+*+)))*))()*+++,6J!54 CBA
+i+A|*X
;idbwd
I<L""<
iMUR&f\
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
IsDebuggerPresent
IsValidCodePage
i;VlTz
j9$-#F
JanFebMarAprMayJunJulAugSepOctNovDec
January
j*B4	-
JCz7Mj
JEEEEEEEEEEFC
JEEEEEEEEEEFD
JEFEEEEEEEEEB
J]F"ii
JHHGGGGGGGGHI
JJIIIIJIIIIJJ
j@j ^V
:$J"o<
jo	GT]
(JpS	];!8|
=juANSN
jYPQTVTSkllZTTXRTUiHceWda/
K2TO?;
~K3!I`
K@6Aio}
~K9svW
K\B[/z3z
KERNEL32.dll
$kJwzqA
k'k\}G
]	_K]L'
/_kMkY
&@?kpN
LCMapStringA
LCMapStringW
LeaveCriticalSection
~LmY6?"z
LnlhVk\D
LNN`1] 
LoadAcceleratorsW
LoadCursorW
LoadIconW
LoadLibraryA
LoadStringW
lQ.&*B
lz?I0z
M}2}ZF
?/?M?a?g?
mA]T6;?K
MegZ!u`v
MessageBoxA
Microsoft Visual C++ Runtime Library
MM/dd/yy
Monday
)`Mps=
MultiByteToWideChar
m~)_=W/,X
MYd! Z
\MY?EG
	m/&yT*
M zc:j
[nea:JjcD*
NiLS7^
N`i#m	
niwo`:ncwo_
N_,#Jf
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
&\n^PL
n>~r>I
NS)!TQL
Nw~ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt
\;o +:
)O6530./21+*-,4#4PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP
O(@>=77A779?<8;$O' 
October
>od]>+s*r
`}OejTH
oI&b(*
O%JEEEEEEEEEFFB
`oJV'v
!o$kD{
ok;w!I
]\omLB?g
om_{&W
onbY{E@
%OP$?\
ormk!%
?O+RU.
oZm3lJ
/ .P$a`
Ph1{w_
:pkgb@
Please contact the application's support team for more information.
pLic)U
@p<mam
PostQuitMessage
PPPPPPPP
PPPPPPPPPPPPPPPPPKMNNNNNNNNNNOLO
PqNrSibG
Program: 
<program name unknown>
- pure virtual function call
/pWOYB
pwwwwwwww
pwwwwwwwwwwwwwwwp
pxDDDDDDDDD@
pxDDDDDDDDDDDDDDpx
pxDDDDDDDDDH
pxDDDDDDpx
pxwwwwwwpxDDD
pxwwwwwwwwwwwwwxpx
?pz.{H
	{Q6Rv-
}>qooggggggg1`_fhsnHK
Q PXA\
Qqgj>G
QQSVWh
QueryPerformanceCounter
QyT+#d
qZY6qV9o~Az/
~r2SXm'
-R+7/lK
`.rdata
RegisterClassExW
@.reloc
-[r"iG
?RsZwdx
RtlUnwind
rUaZo~\K
runtime error 
Runtime Error!
rw$'@l
s6N{>xN,.
SAcZw]
Saturday
September
SetHandleCount
SetLastError
SetUnhandledExceptionFilter
{sh'F-(
ShowWindow
[sHxv}`
SING error
sPETOc
SR;"Vc>
Sunday
SunMonTueWedThuFriSat
tcIVZEg
TerminateProcess
Tes6|T
{+tH#b
This application has requested the Runtime to terminate it in an unusual way.
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
Thursday
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
-;+tOo
TranslateAcceleratorW
TranslateMessage
t"SS9]
Tuesday
;t$,v-
tv:t?J
t+WWVPV
*U83oP
UA6)/q
=U=b=A>P>
U$g,.v7
&uKl?Z
- unable to initialize heap
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
U_o6|'
'Uo79.%<
UpdateWindow
UQPXY]Y[
URPQQh
USER32.dll
USER32.DLL
)	uU&NM
\U	zpy
v0Q15kj:
V6u	#N
(vA=j/
V/bwOc
VbZ$xsV
/\Vf>]R+
VirtualAlloc
VirtualFree
VK;ddM
V>mb"	
v	N+D$
VUTpz\
VVVVPPh
Wednesday
WFB:F\(SA
WideCharToMultiByte
WkV21TSav^8{
wLd	'~
WMFt&Pk
wPij/1
WriteFile
wsH@U6B
WT-5W$$y
wwwwwwwpx
wwwwwwwwwwwwwwwpx
/%(x%_
;X<b<o<
x'i7Y'n`
XiDO!Mbi_P
+**XNu
x=;,/Q
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Y6]"cc.
y#{E6.
yfs|s+
?|YH a
<*Yl*H
YS3eqw
>=Yt1j
{|yvrrwsqpon
Z9g+.C^
:z;'=9=K=m=
zc%>\G
z?g\ZK
z\kWwF
zLcFVdD
ZTt(I%
}zy|yx~