Virus.Win32.Sality_878b1da1d6

by malwarelabrobot on May 6th, 2014 in Malware Descriptions.

HEUR:Virus.Win32.Generic (Kaspersky), Trojan.Dropper.UYL (B) (Emsisoft), Trojan.Dropper.UYL (AdAware), Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR, VirusVirut.YR (Lavasoft MAS)
Behaviour: Trojan, Worm, Virus, WormAutorun


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 878b1da1d6c3bf79be5a5e4c8e00d677
SHA1: 8ca3c560e6344dd0ff613774a4f2947d3c4e6931
SHA256: 6c8378523c30c1a7726c51f2b136a57a62f1032c814c4676e8d4712d343063c0
SSDeep: 49152:S1U9T8ZDYWntr3WVajc4I3VGipg5J NUyRWA4ow:Nqxnx3WVaclljpg/vy8ow
Size: 2765311 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: SummerSoft
Created at: 2002-02-05 17:49:30
Analyzed on: WindowsXP SP3 32-bit


Summary:

Virus. A program that recursively replicates a possibly evolved copy of itself.

Payload

Behaviour Description
WormAutorun A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.


Process activity

The Virus creates the following process(es):

878b1da1d6c3bf79be5a5e4c8e00d677mgr.exe:3732

The Virus injects its code into the following process(es):

%original file name%.exe:3656
iexplore.exe:3344
Explorer.EXE:1948

File activity

The process 878b1da1d6c3bf79be5a5e4c8e00d677mgr.exe:3732 makes changes in the file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~TM2.tmp (7385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~TM1.tmp (4545 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\~TM2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\~TM1.tmp (0 bytes)

The process %original file name%.exe:3656 makes changes in the file system.
The Virus creates and/or writes to the following file(s):

%WinDir%\system.ini (70 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\READER_SL.EXE (840 bytes)
%Documents and Settings%\%current user%\Cookies\T3XN0VJH.txt (521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\etaqmx.exe (741 bytes)
C:\rxptvj.exe (130 bytes)
C:\autorun.inf (190 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
C:\878b1da1d6c3bf79be5a5e4c8e00d677mgr.exe (300 bytes)
%Documents and Settings%\%current user%\gupd.exe (21355 bytes)
%Documents and Settings%\%current user%\Cookies\9W9G1UT0.txt (135 bytes)

The Virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\etaqmx.exe (0 bytes)
%Documents and Settings%\%current user%\Cookies\3QE1QHRN.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\9W9G1UT0.txt (0 bytes)

The process iexplore.exe:3344 makes changes in the file system.
The Virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\iexrhihb.exe (1425 bytes)
%Program Files%\axgcwfbn\iexrhihb.exe (1425 bytes)
%Program Files%\Internet Explorer\dmlconf.dat (48 bytes)
%Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\lzma.dll (2164 bytes)

The Virus deletes the following file(s):

%Program Files%\axgcwfbn\px3.tmp (0 bytes)

Registry activity

The process %original file name%.exe:3656 makes changes in the system registry.
The Virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 21 C9 11 7B 52 DC 44 4C 17 DD 48 10 81 B3 96"

Dropped PE files

MD5 File path
88bbc2baee2b305b9d16913c41c51247 c:\878b1da1d6c3bf79be5a5e4c8e00d677mgr.exe
931bac8d80ace60e24a9dbeb7ef5d471 c:\Documents and Settings\"%CurrentUserName%"\gupd.exe
d31d316431dc43919f4e294238dd9754 c:\rxptvj.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Virus installs the following user-mode hooks in ntdll.dll:

NtQueryInformationProcess
ZwOpenFile
ZwDeviceIoControlFile
NtCreateProcessEx
NtCreateProcess
ZwCreateFile

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 1109039 1109504 4.52046 a30f77805e3f7f92aa25a18dceb8afd9
.rdata 1114112 415002 415232 4.21342 53fb86f5356ff54f3820150c03b61a63
.data 1531904 103256 84480 3.31611 5fa6fe0d534b3bc220ac7a793675b16d
.rsrc 1638400 4864 5120 3.01872 f15ad7e58bdc7a240e151cb59c99db6e
.reloc 1646592 217088 214528 3.77213 e91f799d52c20db81ab62b20a9457782
.text 1863680 335872 334848 5.21058 5499372773d30723559c18647b3a14ef
inpqxyg 2199552 73728 73728 5.43003 18283273894b2317be96860804dd319c
.text 2273280 335872 334848 5.21003 3dfa4a96a09a5906934fe40d41d14014
chxzflw 2609152 4096 0 0 d41d8cd98f00b204e9800998ecf8427e
.text 2613248 192512 191488 4.95069 f7672e510818afb3b875c0c985b8a967

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://www.google.com/index.html 74.125.228.243
hxxp://www.google.ca/index.html?gfe_rd=cr&ei=u0pOU-rbHYnU8gfBlYBY 74.125.228.247
stromoliks.com 66.228.61.232
promoliks.com 66.228.61.232
google.com 74.125.228.232
ant.trenz.pl 148.81.111.111
ilo.brenz.pl 148.81.111.111
xioptq.com


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET CURRENT_EVENTS Known Hostile Domain ilo.brenz.pl Lookup
ET DNS Reply Sinkhole - sinkhole.cert.pl 148.81.111.111
ET CNC Shadowserver Reported CnC Server IP group 3
ET CNC Shadowserver Reported CnC Server IP group 2

Traffic

GET /index.html HTTP/1.1
User-Agent: gtalk
Host: VVV.google.com
Cookie: PREF=ID=28da643bc1e67c45:U=f32dce0544f98e52:FF=0:TM=1365778725:LM=1365778725:S=KlaSoYpEhHSBxg_x


HTTP/1.1 302 Found
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Location: hXXp://VVV.google.ca/index.html?gfe_rd=cr&ei=u0pOU-rbHYnU8gfBlYBY
Content-Length: 266
Date: Wed, 16 Apr 2014 09:17:47 GMT
Server: GFE/2.0
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.ca/index.html?gfe_rd=cr&ei=u0pOU-
rbHYnU8gfBlYBY">here</A>...</BODY></HTML>....


GET /index.html?gfe_rd=cr&ei=u0pOU-rbHYnU8gfBlYBY HTTP/1.1
User-Agent: gtalk
Connection: Keep-Alive
Cookie: PREF=ID=d1b71ce95180a40b:U=e74275611c737632:FF=0:TM=1365778725:LM=1365778743:S=Y22Iy1cY98t4Pj6o
Host: VVV.google.ca


HTTP/1.1 200 OK
Date: Wed, 16 Apr 2014 09:17:47 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
Set-Cookie: PREF=ID=d1b71ce95180a40b:FF=0:TM=1365778725:LM=1397639867:S=pGtdMXVTMlvXO0nK; expires=Fri, 15-Apr-2016 09:17:47 GMT; path=/; domain=.google.ca
Set-Cookie: NID=67=fOcl-OLgb36hK5C5fcR7jbItnz6slcXKXU1XNn5LhW0n8eVFdRCD_70gwky4y8P72IbNMv6Bb0XvCqOiF_YvQR76ML8R__ekvIl4bRSlZ4qw_9GyioXPIGtx4TDFsesi; expires=Thu, 16-Oct-2014 09:17:47 GMT; path=/; domain=.google.ca; HttpOnly
P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
Server: gws
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Alternate-Protocol: 80:quic
Transfer-Encoding: chunked
2e9e..<!doctype html><html itemscope="" itemtype="hXXp://sche
ma.org/WebPage" lang="en-CA"><head><meta content="/images/
google_favicon_128.png" itemprop="image"><title>Google</ti
tle><script>(function(){.window.google={kEI:"u0pOU9PLKe--sQSV
y4D4Ag",getEI:function(a){for(var b;a&&(!a.getAttribute||!(b=a.getAttr
ibute("eid")));)a=a.parentNode;return b||google.kEI},https:function(){
return"https:"==window.location.protocol},kEXPI:"17259,18168,20782,400
0116,4005878,4007661,4007830,4008067,4008133,4008142,4009033,4009352,4
009565,4009641,4010806,4010858,4010899,4011228,4011258,4011679,4012373
,4012504,4013374,4013414,4013591,4013723,4013747,4013787,4013823,40139
67,4013979,4014016,4014431,4014515,4014636,4014671,4014813,4014828,401
4991,4015119,4015155,4015234,4015260,4015341,4015444,4015519,4015550,4
015638,4015640,4015642,4015644,4015646,4015772,4015812,4015901,4016007
,4016127,4016206,4016293,4016309,4016323,4016363,4016367,4016373,40164
52,4016456,4016466,4016478,4016487,4016623,4016639,4016703,4016730,401
6795,4016815,4016851,4016903,4016933,4016952,4016969,4017041,4017202,8
300015,8300017,8500165,8500223,8500240,8500252,8500264,8500271,8500283
,8500306,8500332,10200002,10200012,10200013,10200029,10200038,10200040
,10200048,10200053,10200055,10200066,10200083,10200120,10200134,102001
36,10200155,10200157,10200159,10200163,10200178,10200211,10200226",kCS
I:{e:"17259,18168,20782,4000116,4005878,4007661,4007830,4008067,400813
3,4008142,4009033,4009352,4009565,4009641,4010806,4010858,4010899,

<<< skipped >>>

%original file name%.exe_3656:

.text
.rdata
.data
.rsrc
@.reloc
[<%uV
\$43\$<#
\$,3\$4#
.LwH'
FTPR
\$<3\$ 3
tGHt.Ht&
windows-874
windows-1256
windows-1255
windows-1253
windows-1251
windows-1258
windows-1257
windows-1254
windows-1250
windows-1252
Invalid email address: name = [%s], address = [%s]
https://
http://
.NET 4.0 / x64
.NET 4.0
.NET 2.0 / x64
.NET 2.0
.NET 1.*
live.com
gmail.com
smtp.aol.com
Failed to connect to SMTP server.
CloseSmtpConnection
LOGIN
SmtpSsl
SmtpPort
SmtpHost
checkOrMakeSmtpConnection
SmtpAuthMethod
SmtpPassword
SmtpUsername
SmtpConnect
smtpConversation2
Reconnecting to the SMTP server and retrying...
smtpConversation
SMTP send aborted by application
Windows-31J
c4aeUs4UBAABCWmgzMUFZJlNZBIkEowAApX ////07cGIsAARxeAIMAACAACMSgBsoBgIEAgPmvWvsAD2xCImmoNNNAeoAAADQA00aBtTTQGTTQiaaUPIQA0BoAAAAAAAAAGmkUnlMCYmBMmQxBo000yaZNGCYmAam0ciY6UrOEAkQEFCcAJY64rgJiEAQREpLYxCk6lEhBIYqulBzlpDC0iCbRcaogOqrCoDkAq6QsHpcbCGUiAxhCEMowERFPh KmPGggquZZKJbUdh96kk9jzABeb4aefgHM2bYwovfWSRDomW/MrslyGqP48GIAE y18cV5QpjKtVMHBqSvr2TEyc71NqjXYY4yA6Tfq0sj1lDqewikL42bs6UHHfxBN4IJAkVqOZofqcWPb DEeKAezygJJKBB/kXz0FAnWQj5QdhCAlAj/IXckU4UJAEiQSjA==
c4aeUs4UBAABCWmgzMUFZJlNZ4XhUsgAAoP f/X/0aIqCCAEbxaQAOAQCAGYBRiWAggqCihu/57AA2SGRkwnqGRoDRoA0AAGmmmJtTCGJk/UhwDCMJpiGAQDIAYRpkyYRgIaDEiU8oaepk9IGjTTTINBoANBhMTQZNP0okY2A20BsRsTHosEiWTIskki5GRJEiRF650SyBilYCg5hTiYSJ6cgpmBESIc/S1c1ytCSZiQXPKjTLEkpdOOAIgZhYNDB5lakMgehfqPTzUH0ZDC5HCR52hu HG9u8RK68LAWEBrCZtqnTTe0Ebqyg/V9U9sgiZpiSKIRCVPl8y1qO5c0zCrqSzzaAL5bfs zlYHMgBEjBfNpiJ/Fp0HogCEsHAAW0SYIAmf/F3JFOFCQ4XhUsg==
c4aeUs4UBAABCWmgzMUFZJlNZl7vlQgAAone//9/u7IDACI0ACDAAEgAIAFYLAKAAAJAAizuv/rAA8jCJomSY1HqBo0GgBoMgDQNANPSBqn6JTag0AAAAAAAAAAGmqTQMgBo0AAAGmgNAGhjUeLiB0uRS4GhrXkVgQzFRxr55XSDCVjAhAL9AS RAGkJcXCwU4brWJeQNMdiBSJpAUqRCIDSAr5VCRDJSIEDChnZHScRcuTt8hw8/C/hlUYWJmV lp9Olb98qDnA5qlnJLbSWSB1DTbONZomDhJgP9Gtniu5QAnXgUPaYHNQme/JvWmwQJBeYr Y4eaLDQElM9mSoVL7sNARc3MwQiCRTVfnd7shPJxqajAPkB8pk9rIOJQRLrQkAfoKtSCOIikJCiAl8ogAV/F3JFOFCQl7vlQg=
c4aeUswIDAABCWmgzMUFZJlNZVbeq6AABWX//92fjKuE2VoI3ASIIBqBCwiYRgCgEmqRiZDhYAhf598KwANkRCRTNNBGmhkYj0amnqYmBGAgGQyaep6mbVPIYTT0gcaGTTTJoAGCANBk0AAyaAAAGTIBoJFJRoAAANAAZGhkDRoA0AA0BkZD1F44AkBE0gIMSQbe7aWZSr0rUYCur2AVmGPFAjaVGEBfjyWik/thWj6ok7EgGMzN3 zikFFhI8yACsy6vqlqVS k1hI3CsfxvNF1pGRZIFpN1w65IMgNp03E7 6UBQV6Um1Z7URGSXl98NllBgn4SR9HAu2n/B/rPFURKsufWI9YbhF2wWCQlbJuhNbVgR27joe5o9tx/S69B7QI/sOPCrM1iIiBiAICOW0II2gCNgH8wAP8XckU4UJBVt6ro
c4aeUswIDAABCWmgzMUFZJlNZOYxIOQABWH//92ZrouE2VoISECIIaC4SWiAAgYAADiggZDDeAxf/9wKwANkhhM1GgaAADQAA0A0ABoMhtExMCBwNBpkNNGhhAyGhgjQ0yaNAMgxAAGgkUlBoaBoANB6gAAPUaGgAA0AD1MylJwEkIbQRMSA3aEbK1ki4baBXd/BFdrIigTDAY0TPJpQF/VoFhhzsdAgGMyOTi6fyTgtbYFGENpOhBDjzh1ENXmg47kskFRFXexglwgUyiuo4AXC2plcAD8iO32bVNZW5lPQcDOIQIjCBnhPaSLWJTTCPbLrDgaurqppPPYz8lhD5b69j7j9KlGfa2IqM/7FL1EpESDBmrPmSgCrtJJWjSAmYJTNCnYID/F3JFOFCQOYxIOQ=
c4aeUswIDAABCWmgzMUFZJlNZNC4mNAABWf//92fjIvE2XApQCQAIQCJCQiQggAIAAiBgYiBUAmf7/4awANkhVMR6mhoAHqBoaANAA02poDQYxQ9Q0OMjTJiaDJkwmmQMhoDQGmTQwAmgMJFST0h6gaeoGg0yAyAaaeoMgGgAbRo1I3AgEhtIoNABZpX4j0hSyxpIjeiwotbNCBYk0NgTOrHAl5svsleOMWczasydR 99HIE1IwZ0AWGHD4Gm26bPVU8dxmDO7DMqPoeMAGpYonkisHeiCQ9pmMJ8ju1oyZFPiwWyzAgrb bprwQEeRUcRftBXupQiIvpGQHc7kX y1ackU /Bp5WvPghml5s YcKibZvT6uFJIxMSShaEE7El7NI8GCA/xdyRThQkDQuJjQ=
c4aeUs4UBAABCWmgzMUFZJlNZwr1xdwAAv HQYAAAAKAAAgAgAAACIAAxDAEfqRMlzcUFwCUDpvuy/i7kinChIYV64u4=
c4aeUswIDAABCWmgzMUFZJlNZXc1e0wABWf//52frMmE2VoIxACoIiCIC0iSggBgIBUAiJDBUAtf5/4awANkhVNqaaGRoAAAADQGgNA0BkyYaRtQaHNMRkZNMmgGQ0ZDJkAAAMjTI0DCGQJFKjRpoNAaANNNBkGmQND1Bo0GgBoZMajaaSQhtJIJ/FhSV5yBSm2ApeVALbDUvoF4aTGK45rFYdtharwS0ZkDen9cVdxVccJJVz4Bwzkey s5LihRTqDNWbJbZU9HtWBmJkA0WyhB0winSA2REgUYctGqoNNcCzK4c4BA5iJe/BHpUkVwKjFJgCYCsRhcHFxDLE4/8kVYwTvtqdZyJeDHQgSo8Slf3LvVYLpIRQcedeSSI2JJKJiBH LuSKcKEgu5q9pg=
c4aeUswIDAABCWmgzMUFZJlNZ l25SAABWX//52ZromE2VoISECIIaC4SWiAAgYAADCggJDDeAxf/9wKwANkhhPU9E0AAA00AANAAAyGgZPSYZIHNGjQ0wgGmBNNAGQ0MQBoxGhgjIAJFJQ0aAADTI9QAGQ0NGhoANAAbCjaYkhDYAiPgoRst3aKLbQLCx4IkapxQJhgMaJnUYrluBKwtMdAgGdlQI6/L1flexRFenEi8KKT6qAErq7oOmzCDDEj/Dtzh7r0tKm2xDCWkQWV0IfywCKkZ0uNKQzw8cXJdM1YwpdDsP2i0cIS4LiNcAR3nGRSTmDID4fht bgl/Y/exeT71WLAnuRSdpIRHCMGbc nKAKZiSSnaAR/i7kinChIfS7cpAA=
c4aeUs 0CAABCWmgzMUFZJlNZfAS/SQABXv/n/ /jImMyVAAAEBAAIAACxCCAhQIgIFIGJen3EbAA8RiNJJkaBoBppoyGgAGgxA0zTUGakVPapoZMIaGgaNNNA0AZNBiGGkppoZGhgRpoBowmRiYEAD1AZACbYJNqQ21AmoG1AmDgUAgGwTdgcCqnCVQkE6Qkp015KVKpNKQ2gSYMpOeLYftSBPaASSrkDasShq3uwmtA0 sggCnMqDIFEc5iYwHTz3EOmPu 2sAu0wsEtwRR8sCaiJmrqVxu1/vmxLBF9Ph0QITcgRb8wrdXkPWp 7i76ip0MxMRq7OqjIAiLaYAAbMF710VhaDKFVH2SKc5WPipEwSapU0q7iFUPtBc9oEAcwIAHMAcxAiH8XckU4UJB8BL9JA=
c4aeUs/8CAABCWmgzMUFZJlNZbjaSrAABWf/f/2djtuOzXoASASoIBSICQiQAkQwwIiQwfELn6dcGsAD5EGoapmkIyYTJo9IyaMQMnqMmJo9JiMmBo9CjaT1DmmIyMmmTQDIaMhkyAAAGRpkaBhDIEipT0mg00GmgaaA0aaAyAGgAGIBpjRpJrgEkikwCFoAbAUppQsSksIWkTWiBggfJK2mXZCMdjYBmsDLYrrVCGAjGAw4MmagG3aUCA4C/whBwZmr63cX62EuXIwMQ9qiAOrHmJ3Hnwc0GnodiulxTYn1uuc9Ja2dg/m peBS5mlWiBQ53tFtg6Xg3YwNTNetgah9vkHNCiZn ROQoqpklqO/hqb1M74elMO2Pw/jzYdCxSGDoOPC/EAomhJYN6LIuSFE0BGwRgO8wLjQr7FfYJB/i7kinChINxtJVgA==
pqTkLrZ8ugJ2hzaeXqaMptKyT9ryy82rgbwoVmvTfdFM2CVLqDNx6HrUrLLHeIXp4srmrF2TvGn1/6zjI6FiLmgrwRCQbzpf5OK/c2IFQ031J1h2dy2lY4MLzN/FGJWXZpJKIDXBGScfIOzC0beofJe9zXOXyaP9jcyh2KZPnnyfUdzz79 b uzK6 b0/k/lM64OPl69 Lg6/bP Twn2/V593T4IgX/qyK5H5QhASDqlhtXhRWQN3D/w0aIr9PPzVDdcSceAX lkhwGuOCUorCBA8VrIgdgh0UvmJn3lQnkCgIGAkouwUgfM0fAjZ81NE7/QqzdRMv317yZCO4j5L8nK pgF/r QsXulfDy6T6F/K4tLUkNsduNM/1FNevHAPTf 3Nc/5/l4vj E
6s jBRdAvnbfzVLwUXZNX9LpMvLe5GIoYAAtsgalnJb5JPexKVJq7zedLn227M /1Pq2itl8KpOaHofZSnFgrs 9 0YmIAA9WfFm6NHyvDFZrl81aacFqOivfQc4mfAmYGaW2 Q  tUP/936/vzpkQgxpNDi0imqzo2MeqPVtDeFGnv/S9 EhhlmNfIvxiEBi3z4Zkq1Cv447P6esshy5N3b3NV6cQu6QH4AJUWjX9SnMUD0nm7D945qd8TtTuMhzyv7UFQj7HFOvNw7qRQeaqQ6T3YJePYKU6xZ7pZL84voKgIMP3Z9R4TmekOQ3b07MQckzKcpHYxydOn/RuYgcFOQzZmw2i2srbeGogEGZYzVkvSxjz1Gow25sEmqt2/e9mVuhgAK1r70z5j3
HnNMlW7XpLdkEobelH2jeo 3tGM2sMaak3uOiz276Czw InQTAgh6ZXm9NFnnZxkU2Z8dJm6q8g8Pda3Qhy7UkVbDz9apgdDu6/y8/cOsFhxnGSGHsvAgNAm8K7HDpdxd1Fby4tJSMc5UZcYRKFODNLt lbV3Imnht8x/s4l7Awl2ARm5NuVAySmOa4oxzuBlq1oFAy1WA4mzbunZk2eZ56Gc1ZxD5XU0kPFQmdvlt2dGMKzwkDhnm74rlDx24UWqge1MF35HLqiFvXPyOajYhbR8Tq7TR7F6RpLctsEqRdzc2oTi kyMlNVQktfb8Zy7VSHNTXeuYdw47qpcpd8uZuuKYmf7d11NjlqSU2BXuPuqcpGJJSiK9TblPUq1pirUdpa3KxAS inOVvB
JT0QJx0aRSeObJC2aHmMzUQUQg9DDtL6gUFmRV88UhsX/ihUKqPolI4oit10kENtoue4k0bGqko8HzLMvoIJIM29xKz0 LHYJhs8xWHq32vaSZ o4mbT4 vTSx4LEoRqRL2tEZTGaSGM VZeMtjJgaggY 3reAzDdtUGmyYr/HQ/9Fwn1V/Z2XWs2cMNrQ3hj6zfhlqm7W9olkq3Lhd52H06F1LwLLMJcvKhEnNGVzVY5BorZZ/d4m7ZTrCgKVSAH2hfRnMRmqOI0qEBAyYQiNZFJ11HGCmEuwxW1HOeejjsYZSX0Z22Ms4r3zOYgczmLn0SQXW9Wk0YxCgni8K/hHGldWJSC6O3tTmiaVdBLS4JYBbzz85GdkNnUAla9HKeYMBlQ8CEOvsiaASt
sTmsf6vP4Fjm ZuazIipNibDXW9RgURU8uIY PcadwN5ThjYxiFn73s7TYVBW5iEL1NZotVlVIph4NnCqXMTXyVBBnr/Iz3q8taLAuTa1cxbiBiYK143CxsjU17NpWY4gQVCAxHLHOE4DkFICXlu6sJVuoAK5X/W54L1iZ3lEOBixwLi00xnx4AFeEBO2EIggfZ78iMHcZ7962atsNF5FUABhDM/6Nuf5dWlsVpZ4A7Wtby4KcBg6j2PHkQEXekmUQZ0iym5jiiCeP5m6t3LMtlJdwCYK00sFVgX1NPE tRU085leqABgr UtSqoPEbzwpU5A6KgAPxKWC4d9bc8tk1UnqkyVm8L4stA5pSsqBKeyXMPdY6qQjQYODzzs2 LW9cYqJI0Fpr6WBZa
RHfKmMUdiq OcmDHeKIhBKCxDBzHiCE0ajMCcnn2atabvhrEFox/Hj1UmmeqRb77qn5W1MGtXntnItb3VKjITAo4gY0gRgOO9qL469lUYxoYicRRRobQN jl5ti7GSisCQgMGLy4rqT1ROqciuTAYEUn3CvLv2zTXpfbKXfOMri6orgXdXaIecyoJBiqYQqr4vzzrAY/g1ACW1vbV6efKotUslHFtFPqXTpdD9TTUWQaG0GTCfTMyI4b4enXNat5W0J1UUWstvMZQAhR2ceFpQEYuz8TOCFlt4keuHKsJ556vNttDyoxpSTZW7ijbaE03TFBDw0ITajSm1qqTapvIUIUeKqpTZHXsOquJ6edPO9RQ02oLVJziQjWBveZGhUnIrIFD5FjKjx6j8Jk
w7nopW2B6y1vPsOs7CB/u4vdXL/K5b/qf5N2/BtAH/ZGgNGAaUeUpJsDdikoSf1dxu5LQhW6/uObR fm77B4bNAv0BGMcNQGa10GNTzGB/B/Of2/7K/VtSbA/fplYMfR6lBX1xPF3AeiSwEb/QkpSMgNUQYcBiT8U08bEGKyyijuKIpt lqd/Ac4flDaME/LND/wus63QZNkcpih9OX/rX4Nu8dYtYZEQfJufnxWhBmBVVcKH1i/lP8sB8rE8BGG1 3Ce Ab06q0Y2qbfuNJQN1 bpfrV3sb4HXcxME0nKldXUwHn9pgVT/ LuSKcKEgHvHUzA==
EuRk9sGR7k2ihi6bUTXn25vxeM4O8Q/B9GKDAKOLeUriUCDVYNUAAFL SdJzCjOkQouPzHHUiMIO7tLMh5zko836S737ZyVD2fgXfkYBcyCYPE6ywfrxjTWtKNrZqBk588dOMdLO30wAEIEd8TchlQ/1xNdYlIMt1VCQRTc0OCuZcvcQWSyzx/f H3l hRQrEpuZUT16bIvdde0TCYm7g9q6obHV9817yv6CuzNP3DD80n6m 8 SvOmFwQhAGvTdjRwMSlI0sqLS2EWkcycXKnz7kmg4OKziHmeHk23Rmykofwb3qR7qWN0N0gwqRoY6SpjDuRZKqF3WfQRC15R5cJEl6w5Aa8D0X039KShCEAB0BqUd45otMk/qOP69kOxH6UbfVoqVivR46WTC
nvM0VUPa4j5HkwLpJSBkFhJidivaXIIWS7ucoobwxrmLOtn9ONXcBqO/Msco9Vx8yhdx bNemCtC9VUdpHR0Tp3en0Pd1aRlnq1EDU6vbZ4ynRhlvz4iK3pO9qdfX7jbrdyECoT59Y8LiWr 9JpDGUwX8oxrdg1LTY/g9HCzaY8PGM6YtwvL2e UiudeC5yLo68n6gmELX2h74lXr8twjuLwmkHIGOxX RMEsRK5kbdLKkhZdWYk7ary4SHCOucVKE0nMRegQAqXYed4V3PZKZvlGpLvEl11Wc24ErV81vp2eT46tc64s T5xBOiIt1yp/rTh6Lpy50mUyAauYT0n3cAhLHheXg4yQ8jmX0Yg/l9mxgMh7t0eOhNGLups0V4xcWxnn5Y5Oe0dfLL
bX73mP0weJOqLgv YhZzg6oWfmmkhnCII0RB2hONpu3kC5O5UPH wbujDGuKWXGUapGedouqhZwoOP64SH9lOK biqfahd6OlA2P1zscvS0BjgE/7A2QPBhm6pwkEk/kIJ9MpCtMqQ7pYNSYfF59ddyVY4Lhe26 leNmb1Rh he/iPOPENqWMV3k1TFfVDvlLFiUea7Q7J5xF6QHsMKqUrIN24Mtb1AtK6QgBpXXruuhS/CINTC65IQsy4U zvbFBniVoa/XSQkZjRaqsuXEpEPmpo diByUmz8hws5ZTReunUfwRm5tlv6qHynkXB LfYjMYkidK8V2udpt2ejHCrw6UNLiTzXCaL0oG8eVtOcWH0KfKTU/NyTtzuJ0JTbEym1HX9MwDOfGF5oO
B1lCiBh ddG5DyFl7cmDe0HhSo4NxJrUcZkcslyysyVidPrZW9waKWb v3x BxdTXp1qnUVfFPGbwyhfqNR AoHNFtW0jnbf0eh7wH6mib/3u4V249pGwU34 1RD4 S6a5zZZ2to2TglF7xevY9jg58yu5v6yZ Rsk321Tw01MFNsHnzHjsaAaGbTJse6JpxBCEdWDgnb pHJxBUVPYgvveZk53b2DNranuI2gfnI9RG/ XwsDJznsUpjavHrZ O8tZKvltZxPfrHo0Y1zT1qpikWpDmRYAUAFSLFBsAdC9nVddWlNTQs6QJCIEyR8tmVUn6ldeVVU70WTWCPwYanAXhN1S/L06ngaYMqjp5gPtkM WmnyxwsrJaA7Z2uaohtnnlgdfgUiDugNo9
sUbJ5xDzlbzotCGIJR3Pw1JZCYbysQLtlqaW3oMxofhI I/SRSkWR5u76TGU64HWooYQzZO4cylWgKVxyzV13JYNgiUIGOQk/aS0q083758l 2lSKU9A2BCdI3xQRPmW89u2PwQXqy9cbko tzcA IhwRUV4VM3e4bKwjGxVTU nqwvalvtsaayfUFkUozWa63M1N0dNwRfuNKU0Og dqU7svMvrTyuexDZFKSpSjKCEIdnKPDoceSqvBz72fuet5X gKR55HA4HTa YjwkWhorzqSAlOs3zTyjC51Gzb6EpfNnPgcSp6B6JRIiajGJa0Xd5vmt7fYcpinUayBdNQvjVJc7F qX/f9 w18Uzkhjw6JEJmKjwjTaVBHQS f6vxso/l8uFS01Bwg5H
NFORxIeteewrz9nmSGfHJ6pJGOI11r2NKhr6dZSc043Sap6eqpg6YVqVT2nl2gdlbUH72yGDO1GAYQvZEyujZLPVlXfUMnvE7Jqo92SgzZRKhLeRcMGDQYbogIcrd2yDD7lqtsL LqHM0oiTe2IWIqDumHe095HtqSPy85oDlGPI7ZsI2gvGrs3MauAc/J8OU1EkZUoo65TXNdRKmIfoNMPIYZkgYaAwYnt4MK4AvT85kCPB2qy0aH1kd6UhcbipK3NA9aTo8DyWmMdipGNqjK/yRZPmERLCIDL67jWs1lTneRSazWXl4 UnIkWiiHE1uuxKoPOLA8RWwdfkhjYzckiY8D 47RtNqOYCQvBznNDdsq/Egn8Z7SZTcCkIjjQ/Th5LXQ dZr3RfSnH
qMgNtfEPcig2cFwoY611UGpT1UA3taPQoauVOtbuDZcKdED6IH54Q2Xts1nrXif1zwKrS8meQXeiSmDdwYZJhaWx9RapwOPe73h9BjbNjIDwGBhaCBzhzBPXEErmve3f2rowE1f9qjm95tdosvJZG fvDphC5Y67UwnHGPr NbPJBlp BCmoOExmS62re3K3SnH2DzzfTpXdo6nMlrykpMmmKrUAKe2/wKPAbdrcTm1m32KHZsDgDF7IgDPqliPn0fQ7F4mimcQFboD DfDU2IwWixx3DZDqtr88HBySWe 5TLVhnlFr 6akkESUjgAbzPAcZy8BUzr2kohq2xoA2YnsyW6ud4EemQmu/sxgajObL62OuztM6iuzPFIk5yBZtdhssgSGESwkoxz6
dYpU3FkwDdnVKVsRjN2qEiXICmZrlvTXy6gSZQCfIAoSA nvysSwRhYQgzCglijkgCcIhjm4fEYHhQUTpWiBfuFSb3SoA9dqiYXUXfSi EoBamfKQMIqUphTBkCXLkpRX6oGUCoGj4ClVQqnOolAaMuQImqWo3u2wJry6p4TaEJYFEeyChPCa4pL1CiNoXjEdGaIEERZacawOSEdlsRHmmu5Fl4QHJGzHqg5x2QUiSAltB4jABSmSiFEWUhSBTEDWPK6KgOCiOCJupVBWEDPPO8KoHOyqQRFBrKKIoLgoj0gcmDVIEiZp1giAOXtsJyd9geonwLtIDzdzg6jk7TJ1fMx6Xj4T8aNfA/Mk4UaUPy7rZ4Ofk5D2cnd3ybj6Wu6Dn H6z6Wkh51tpTd
Bg6jpjIRfnaeEU1snqdTAo5oBedh5Wpj20Am8kQPbyA66AHW2CQXVlVdHNgUMoROckFO9hADQkEOggROLZSqGulQ0MsIpSIeJgwglCpQgJEoAFIAUAIn/CURcSgHpIMQjQgNIIFAtIi0iiakiGJAaBUYkAKVQPWQacIH6siZoAFzwLQqbWAANnKoJlAguslFOZAgZZYVE2EAjsIVNpCuIEHnZQBDvIRTKEQDsZAB1YR0pUMQKFCglCpQohmkEXEAGnGUACUAKZMggsSitIAhSgauMCIlKvs4AcSKPPSAH68oaEZpBShFdZAiaelmyBAykU9nKq5SoaEICayEX3EIuykzkimjjCoHdwgGj0Vg3e3wCuwlHiRsdjgU18hp6Xn9jp6H29n 74eh9zvN
XeQAIOgVZiXEGnCYlDkybWQ rbuVdKER0JpAoEdnOhKAZQFA5pRTEIp/alxIH5sCmIACgEpApE1sqasJ TAfz4VX8eVTXyaMi0oUqrr5NKDNCGJQeFCqYnPKDjNgMSg6cvpIAzwIFABt4A2UBsIBQ18Lz0Dv40YEVAoVA0oUflwoupCApQKLrZQefkFXQhQDq4FDPFDlCRJmkxLRl52DK2lqyZQGlGrHG9pg0OixoyNFF0mDzI9XBrpTV1cK/kQhpQdl5GNXNgXnve4AdfZpAzymhAORIciQxIdfIOlC9TKGzuPd1D92QfSSunGhC76FykTNH60hlIv7UIYgRumwIYvypFxKBs5AxC0cuXEoBQUgmxz4EMQ5QJ/klHEgOrK4lE1YQMT9K3UhlIUj
1K84UGfLQALFnwGB9euUMsgiMBluG 66Y0epFu7jXl/a0cOvHetfh4ufiX1nAWv6igIClV0ERXa3VGTyIQSZ6lHAPeRtW Chqbg ObpZhgUxBtiALwgAHmcapHf6NpiFGPoLPJv 8l W 3MDGnfQYiSlALAnaIGIQRAKxfVd2fooNIr03VZb4dvib1X02GpMqWK6kSMsKNNAAAH0Kap7gGobud Pkq0fn084y92kyqfTdzLw5f2 nLTPbhqpPEF8QQEP1veG8b28A GKltKY1L3T1vKPBd8nt/M0cMggAbPF8c232rM cu/DycEJ/L9KFr8kZgHYRYsp1o5bf5TqAfB6igADY50X8NXQeSMbuu2diieY9CviaMzDaFsessVZBnfxPDckFuQYhBAA
RqeqFNrV/v/avnEQAy3a7VNOI0IICErtT3TnP5g/opU 5ZSpOx20LzdTmUKUv9ie nKP3UBQG1IAAPamJeDZ3Mc/eLbqhN7 NvQ3Z4UHivDBBqQREIebPm030 I AfBqn8pvpufKqNmSLSAHdIDoggA6Pj3sg1xHtuNuhOHWlWldvUPpP5hA0CH1pQEQ7F7LEj i3QYSGTy97m9x7LhT5mOTuEEHBBCrIAAOavqjPfH JlH4/IZQ7hzc0R0SCABMNPG7 /AX3CF7wow sg0JBEeVX2Yv 83iNJygzPtSaZAdpi/aaUKhRCMABCfIEyx7/gt92O4QTxADF PMYIj5lVjbtjISQ/8kxV7ku hKG QRAH5NcihpBopk8y HyMA0iAgiC6wcVet4/YfG
5T2l1aTDov7WEBHzKCjBnygBhBARCftSjS6b mxDyCYQU8HXZuJqlzJ1 Whvb2YkI9hLCvl/y9Gf OBWa/NXc2fj4lS00HsWbfg3wMKjQh3XzOOy54J wvIxgccx59Y2ZmrOcw pe4SSF6MEhBjkFSQQETr0oDroH6uB0sqZi 7CKE UWp7/bgTDmY3FNR69njXZUp/0qlzpT2dk3vrj2vPxGM7wwfjns8HSumML75ba2 zmMDy1tOr B7Zc bJNDwknpgoAABh708YsYFVa8rTY9LOSa8243cSVu9ceUVQeV6jSl/tFRaGwl1mOrCYbWVScWH lDRTZm9x3HV9FRfTA 3jTYRoYRBqCCIipIJNR5bO5h tpERMbinEbB1yUcuwL9ThVd2dBX0ns
3zAwbhh9waWq0NUizjrKWAgDyWTRkSVCCABA17VaY2FnEJUiFCAAxo1Q1dANgvDIhmXhm5Id9E7B3YNEeuki9bh8GqYUcx/JKp6xXudPERSQryI5ZuoUfneaYhb9Zw5kLFBGws41FhhFM9bPYHN6blnYUSGOQDpLH 6Or3V5tZcowIQAPxF8c1uTiob5dPHhB0Uuyv4DBSO6YwPA1p0DFwhdnQ6VF/c7 ijzQKmx0bXYrOBt/ifUBCvihdpapjf9 Y5XF6e M kFNa490mWJmn1a9bWPXOg/jRPNU3iFWZi/2MsdJlprj3jIAbNR/owf0hl7ZAo6 Ybf Hgw64oB9nxLos4yB22xRIdf3 v1fd P3ePc5TBJJJx T3HI22ABJkk0kARAAWkEAEBK
xk7efp2XoWIWB0cvcXyOD0sEOZGY3dXpJQ3ay0fVpuMqw7 VMWpwFK2c8lGFQukJE6WkSaaLDeRZdTJGLqbob LDgmsKFWMTpKomoCYkEzHCmDElxId8ogfB4tch2iTfESlTU8HUoGxS0LUjM3dmAjjcmbk1hjziiGvcMiR0IM01o/EZ472wOF92y1ilKt3a1aiehEXmrlPvEHNxL3Mg7Un5qCZTId04N10udSNIojUqKRYw7Ugg1UoBooSctB1fAbNhoVjP1fOtON0 SwdEJRdE7u1xFE2CRHfSsAQeCrE fhbtULmzcBOmUdVgdKkgVNmtJfVBAUVhtEHE6TzdJd1UzOzsNDtaZXTlI3VsxYnBy1F99Ok qkhZ0kOc7tSKkwpYmb6xLJGh0NuV
jGmOdkKNooMrs pMllkFUqiN2Hd0ciChVGeKRNVoZPUrJAoh96Gj0ealtdXyItjNpJGSmoF0xLRMS9sSgyVCeegzkcLQ/Y6TnMYzh NBETI0viFk80o5MLKaTEtO7WojNmZiEaIxeYFU8weJVu5Y7DCzwEwBtXp8w9sFDjQvQcg7btaAT1V0xYA0ELNkEUDTRg3d7W82MEl8s4HdWLwL2EplaHLBiw5eep06KRvYyw  c8IYSNNeuCZIB0IZexCMDXDQyZBntVRNZR2UXdFNIpi2WAzEHlO8ycFSwLtsvMnVQzzeHuodEjOFBvAXGbkRsU5uLuCnaUrzCaynNrNqVsroVyXYUDIJJO8jJ9bIU2tMkt7nfwrUigbpNhXctyhqQWheZaCSxbat6tJe
KtHJDMeCmY62yxNi 5TpzVTcp8imOhCLN PLwzQyo5HG8imkHz9sa6SbLdT6aMPNrTMYtwTk1vQRxhstYI43s1lIHBm HC7JY4XbzvKY2GdrptC9PyF5duza0KIRES m5O8XaQn3ZqXIJFJmpiUBseIFGZBjXUZRNjJRK61ceFUoWWDud3RI7THPOWQUbnW66WQYPAaKN2dbDlVENN6cu5AfAMAMQCiYIgrArN3oKoZE35b/NVamFjVuTLOmreodCUpMyiaS0KIxdC5kqzdpxM0pCRcWYQKUYery0eXNsgnJuybLVdwMGAZJdBDBENCpnZWYpNN45Der1x79r60rm7W1U6JrnInklErZNopGyu6LIBp2YhFMuv1Yu5mmUaK8 9l5UY4ubI3HS9XJ
0gKKtqKgsRGLFppVZFEYxigKit2gTCwaUsS e1rmjLIcjC2GORYFmKIyhoVVF1bW8zNKzAY0/MsWjaiCCwVUQVSMiJjhWDL 92mF7qbqqQY3KLu TtcKiqpLuON5il7YVZfEh74WCRTQZpEoMiETHV4DFEBmBQMWRUElsK6Zl1xYOFrYViy0cGknuLUiwUFkhZgQpFBYUk29s5Y2rAsyClIA3ureGPICIFrkH216e3HFcJkXsxEruenjsZAaED284EaGB4CGKBCBFqpKv4P b EWR9JBAcTGUYy4yG Wd34VazmOXm7uqzF5FHtD N69WjtJtPy9UAM9tN9zBuFDWtfeVgsMKMLTOnkXol9pztGU5iXTrX2fven0MVy40sN7jWwQR28vxKd3f5zG
elLgE0Tk68yVTNrUJDUXaeLFJJBi3xYGJQJ1H2KXESdRAURhpj9Zj Jn9x8Z0tGNtbqjoYfC JJeXEfAEs1XnWbdYuHyJiCNv6q84WxKm8LMw0fW8dta4dk 41Nsh9sF61Vj7jbry0ZsVSbIs3LW8zAIjCS7YoGE8dOctsnL1B0tVy7S8868B7W29OcsiHxebE4Pf5/Cq0zC/3Lo8SkOp3 uoSBjn8P4yvgOR23j0KuKfDHaBInVKiL3fyHGrWfkTWJVteV8ZT4uT0fyd V5J9jPAUMHzeJ B6FdUmm3uYML6ulBYF6b86VCXgdCka34/flXfy9v0fpeuq6XwEH8jVaM1SQAR2RtBknk4xNATPGJHi8M5s2QwH9WZaGA5/M1KGSIAMI3EZkqSAyn
nbq/H62HonlmCXjaZ7D7/afO5ZvZYFB5iDukBSQBARQeJ50L4cdvW6E3M6vRR8/mZyJmofMPfd4DrEkLbxjisZDbOrDoMJkrXnKlXa6 cc39QqSbFAAB2EAAELHp HVmmGatismEri2UHJ/H0M69tZ7wp2Naqh6SK7tfyqslnQGwKVoO0gBsEAQGkoShEQCXvW1Qv7NLGacKarNUDdssrnGxZvvq8st9ZwvbBTZo/BrLuzzPJdEEak3dQx2tNZBgAa9RXtvWBYCM6QRAQQ0M33UM5ULFT x24XnvWbJNsP7Knpfgxm9iPNf3rjwYf7b9svDe42RgPhJcCAEIAZ52ftM8DRhbbFD1/t6vtaFfPHmuTZQUTiTCUr XGWRuPI65XtcpM5Fno3s9iU79
zO9lSjQnKyBsXOPQr7/TqdBanomJVpr3bd1JybXsN6fxPnAEcUgAAac5wrZjsuLWX0ejVvHng8Nrp9eCcwve3jvXMaVl6Hx7PSkNri9qQYI6JBAQQMUO8ltclyiuL/esF914DOCgltl8hkbJzT7eDDxmCnG0KeXERBhIX1Wpu80e/RTTbgvuunmtqnQta2fk5gkkQNZ VtMtmigGgARwHVy9fqPt35Mti/1daA3e87rS/arCFt/NguphzkaQKVIlDRxhOi/mEG8IAAT VQ5TzZ/UzmX1X4dP72qB1MJXKPka08l27z9euitt1pP8mroqEta2 k15qJ815/RBQ8TAoAAW/ZAJnVih3QuoZS1HdTPJ3eCXlPP r9Di1NOmjuXc7Nmu62o43KyW7 zN
mlRMjhqnu2mA GX1uystXz0sWD8Mb2pbU7Gdmx8e82daXiey9Sy8fWe9h7TiX/m89RSW5Ll8umSL2hTt5ljZT9KdrO1KFV6r4GNbg8 vrqzhW MspGs6hHt5p6LYy9N9V89ehI5l432mqDHnx ynpH 8K3es2k4sQT80eKqycvYVtws6d tOnKqmiwyV 5SWmd7qdDxWXZx24FGmjumeC6j29JFXy4GEPYiTcPhd6jWQ6d5MSQ3gAtZUYmN2JOLIsKYLMsw8w/iFd1sbTLsTINjilSceLryfBwnps0SKc5Z7bOlBMN5/I1IG2MLXXyyDjbdUssQePpeHaL1lb4nVib0rwIhXE9lj5NSWQilclmWqPViyf1YR5flNkOPqUxyZbpsei7WWNkILdrus
5qwMjT5cBacm1bGJCA2qBX8/k4UFUtC4hnPzWdzZGczouqKNxULB3WTI0MaoXBGRgRDFVZKXf8TOGhlDEF go3VFEwKdoVF9k65uFWRUx6J4QRZwYPPsYiWI4aYrKRGqPDlEfBsILF3Ty1XyEV9AWm8uRpRHDDpTCYynUrZgx 6nipjVa9Mi4jYyiS5gv7q23luLUU4rtCh7ct1ZpRwwWId/sM gTMpBrvGH4r6LYUzJ/2ztB1fslYedVn/j5zg6R4t7a3Mt fdb6njZ2a6dDkJkPEJVORk2I1RCchkmO9GIZM8jOJLi9vS1rFLAU L Hi8JsfgjcYdLCVVvpyE39226VnrgL1r5kXlXsmjyW2/9u1vNJr7Xo0kG Tl5GQ5f7GmsgzryIgBO8kkE
sXaHXUhAfLTpuKeYzfNeSacDj9luyowa6aKoGcRXL/PEvofSmmFcYCHrjX/2yWDz8FOjfZ1GikkgF Ov1vzfqDgC6tYbBFoa0V3ONwQB wM1/WvYblfeWxbA44PF4GjTEGnX3EaGQy8O8 P3FJQWrVcJr/7W/WHfDOQk2/H2qITv2IPO6v0XGgpg8qUO/gDdNLbXVgj4C5XFVdQUPnQyu4uC5NfVl2Ea28XvVTd1wNpliurjw3zOAnj9DSJoM7PIbTW3VEIrOTIsu2 SRqrGvCnLuctTdahpvR1E7s7ZPsIzmHtObCJKdlShV8J34Fy7WJGxKrbyPndeLHiF2KlHe9VNPkVuYXXs8q2Qj5S85QJiraPldJ4KeeT6OwSknLvOwaZZzIr5PktA3xJQ
L00XVmjCtR5CZIHjbwqVYa5ki8BPGaW6xS1c4qorIcDwatsRNzFi7Uqvi6FB9tNTZyZKPfi4muq3q8TMbFzdoJwJlCr2mlxw7vUYt7Zqp VFVJvlrgxkBatfxZVqiSPGTQsQLbbSdCahZ81tWm/pZxoV0rUc06dSHXodKsuaGjCpP2teBVXinImd3GRmzBl4qNJxzkfGng3rVYYq0Mr2XDetVVDDAcbHOOGvwCsYEAobPN166eLN3WNorl0hE1z6qvjiqo0 OOd1kynJmpGMdPPuU48CptWREUaindzDupClFUgrFzt5QrprJRk6Mqk8MSHuKstBoxezQoraaPYtqIChpitZaq35xO1QpEHhPCd7T72mRo5ImTPZl9Cys3qk8VTZFl0YO70FWolf


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Scan a system with an anti-rootkit tool.
  2. Terminate malicious process(es) (How to End a Process With the Task Manager):

    878b1da1d6c3bf79be5a5e4c8e00d677mgr.exe:3732

  3. Delete the original Virus file.
  4. Delete or disinfect the following files created/modified by the Virus:

    %Temp%\~TM2.tmp (7385 bytes)
    %Temp%\~TM1.tmp (4545 bytes)
    %WinDir%\system.ini (70 bytes)
    %Program Files%\Adobe\Reader 9.0\Reader\READER_SL.EXE (840 bytes)
    %Documents and Settings%\%current user%\Cookies\T3XN0VJH.txt (521 bytes)
    %Temp%\etaqmx.exe (741 bytes)
    C:\rxptvj.exe (130 bytes)
    C:\autorun.inf (190 bytes)
    %Program Files%\Common Files\Java\Java Update\jusched.exe (856 bytes)
    C:\878b1da1d6c3bf79be5a5e4c8e00d677mgr.exe (300 bytes)
    %Documents and Settings%\%current user%\gupd.exe (21355 bytes)
    %Documents and Settings%\%current user%\Cookies\9W9G1UT0.txt (135 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\Startup\iexrhihb.exe (1425 bytes)
    %Program Files%\axgcwfbn\iexrhihb.exe (1425 bytes)
    %Program Files%\Internet Explorer\dmlconf.dat (48 bytes)
    %Documents and Settings%\%current user%\Application Data\Sun\Java\jre1.6.0_18\lzma.dll (2164 bytes)

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
  7. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.