Analysis Date2015-01-31 09:22:52
MD52cff4f5c493058a69d75ed882e18ac38
SHA101c223d360143dea3b857d68281e1cd5170d36db

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
PEhash7bfd043ac63ba2facdc9c3129ea88fe8c8472fd7
IMPhash
AV360 Safeno_virus
AVAd-AwareTrojan.Obfus.3.Gen
AVAlwil (avast)VirLock:Win32:VirLock
AVArcabit (arcavir)Trojan.Obfus.3.Gen
AVAuthentiumW32/S-43a675a7!Eldorado
AVAvira (antivir)TR/Crypt.XPACK.Gen7
AVBullGuardTrojan.Obfus.3.Gen
AVCA (E-Trust Ino)Win32/Nabucur.A
AVCAT (quickheal)Ransom.VirLock.A2
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftTrojan.Obfus.3.Gen
AVEset (nod32)Win32/Virlock.G virus
AVFortinetW32/Agent.NCA
AVFrisk (f-prot)no_virus
AVF-SecureTrojan.Obfus.3.Gen
AVGrisoft (avg)Win32/Cryptor
AVIkarusVirus-Ransom.FileLocker
AVK7Virus ( 0040f99f1 )
AVKasperskyVirus.Win32.PolyRansom.a
AVMalwareBytesTrojan.Agent.RND1Gen
AVMcafeeW32/VirRansom
AVMicrosoft Security EssentialsVirus:Win32/Nabucur.A
AVMicroWorld (escan)Trojan.Obfus.3.Gen
AVRisingno_virus
AVSophosW32/VirRnsm-A
AVSymantecW32.Ransomlock.AO!inf
AVTrend MicroPE_VIRLOCK.F
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\VyAMAMkQ.exe ➝
C:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe
RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\QWcQAwoI.exe ➝
C:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\BKUMEAQo.bat
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\123.rar
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\BKUMEAQo.bat
Creates Processreg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
Creates ProcessC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates Processreg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\123.rar
Creates Processreg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
Creates ProcessC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe
Creates MutexvWcsggUA
Creates MutexScUMMMcQ

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\123.rar

Creates FilePIPE\wkssvc
Creates Process"C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\shell32.dll,OpenAs_RunDLL C:\Documents and Settings\Administrator\Local Settings\Temp\123.rar
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\123.rar

Process
↳ reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ➝
NULL

Process
↳ reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt ➝
1

Process
↳ reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden ➝
2

Process
↳ C:\Program Files\Internet Explorer\iexplore.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window_Placement ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Locked ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutex_SHuassist.mtx
Creates MutexShell.CMruPidlList

Process
↳ C:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe

RegistryHKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\VyAMAMkQ.exe ➝
C:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp.exe
Creates FileC:\RCX15.tmp
Creates FileC:\RCX14.tmp
Creates FilessAG.exe
Creates FilemEow.ico
Creates FileC:\RCX2.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp.exe
Creates FileMYck.ico
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg.exe
Creates FileC:\RCX5.tmp
Creates FileKwQK.ico
Creates FileOwUQ.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ.inf
Creates FileQAQA.exe
Creates FileWgQc.ico
Creates FileC:\RCXF.tmp
Creates FileC:\RCX12.tmp
Creates FileeAoQ.ico
Creates FileqsAK.exe
Creates FilekMkg.exe
Creates FilecgYW.ico
Creates FileksQO.ico
Creates FileC:\RCX18.tmp
Creates FileC:\RCXE.tmp
Creates FileAkIA.exe
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI
Creates FileuYYM.exe
Creates FileOIsO.ico
Creates Fileucsk.exe
Creates FileqMUG.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp.exe
Creates FileC:\RCXC.tmp
Creates FileGIwQ.ico
Creates FileMgEI.exe
Creates FileeQsQ.ico
Creates FileGYEE.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\install.bmp.exe
Creates FilegIUM.exe
Creates FileC:\RCX9.tmp
Creates FilePIPE\wkssvc
Creates FileSIIq.exe
Creates FileKYMm.ico
Creates FileiMMG.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp.exe
Creates FileOkcI.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp.exe
Creates FileWYQU.exe
Creates FileeQUg.exe
Creates FileC:\RCX1D.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp.exe
Creates FilewcUs.ico
Creates FileuIIg.exe
Creates FileC:\RCX1B.tmp
Creates FileC:\RCX7.tmp
Creates FileOowE.exe
Creates FileC:\RCX17.tmp
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg.exe
Creates FileKsgs.ico
Creates FileEsUo.ico
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma.exe
Creates FileyAAy.exe
Creates FileWQsg.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma.exe
Creates FileKkcG.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp.exe
Creates FileeEAM.ico
Creates FileCkoq.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ
Creates FileSEoO.ico
Creates FileEose.ico
Creates FileSoka.exe
Creates FileC:\RCX3.tmp
Creates FileeQEs.ico
Creates FileC:\RCX20.tmp
Creates FilegEYc.exe
Creates FileC:\RCXB.tmp
Creates FileC:\RCX10.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp.exe
Creates FileEMkq.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp.exe
Creates FileSUEu.exe
Creates FilemsUY.exe
Creates FileEMQS.exe
Creates FileC:\RCXD.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp.exe
Creates FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg.exe
Creates File\Device\Afd\Endpoint
Creates FileC:\RCX1.tmp
Creates FileC:\RCX1E.tmp
Creates FileC:\RCX6.tmp
Creates FileicEG.exe
Creates FileYYAG.exe
Creates FileC:\RCXA.tmp
Creates FileqksO.exe
Creates FileC:\RCX1F.tmp
Creates FileC:\RCX13.tmp
Creates FileC:\RCX11.tmp
Creates FileC:\RCX21.tmp
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp.exe
Creates FileC:\RCX19.tmp
Creates Fileawgm.exe
Creates FileckMK.ico
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe
Creates FileOoAM.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp.exe
Creates FileC:\RCX1C.tmp
Creates FileqQIO.ico
Creates FileuowQ.ico
Creates FileSEEy.ico
Creates FileeYQo.ico
Creates FileC:\RCX1A.tmp
Creates FiletocO.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp.exe
Creates FileKMca.ico
Creates FileeMwQ.ico
Creates FileqMkO.exe
Creates FileC:\RCX8.tmp
Creates FileKMIk.exe
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp.exe
Creates FileGAIk.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp.exe
Creates FilePIPE\DAV RPC SERVICE
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp.exe
Creates FileGEIU.ico
Creates FileC:\RCX16.tmp
Creates FileuQYM.exe
Creates FileC:\RCX4.tmp
Creates FilesYcu.ico
Creates FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp.exe
Deletes FileKkcG.exe
Deletes FileWQsg.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\palm tree.bmp
Deletes FileeEAM.ico
Deletes FilessAG.exe
Deletes FileCkoq.exe
Deletes FilemEow.ico
Deletes FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Water lilies.jpg
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\ball.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\cat.bmp
Deletes FileMYck.ico
Deletes FileSEoO.ico
Deletes FileSoka.exe
Deletes FileEose.ico
Deletes FileKwQK.ico
Deletes FileOwUQ.exe
Deletes FileeQEs.ico
Deletes FilegEYc.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\red flower.bmp
Deletes FileQAQA.exe
Deletes FileWgQc.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\beach.bmp
Deletes FileeAoQ.ico
Deletes FileEMkq.ico
Deletes FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\Beethoven's Symphony No. 9 (Scherzo).wma
Deletes FileSUEu.exe
Deletes FileEMQS.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\fish.bmp
Deletes FilemsUY.exe
Deletes FileqsAK.exe
Deletes FilekMkg.exe
Deletes FilecgYW.ico
Deletes FileksQO.ico
Deletes FileYYAG.exe
Deletes FileicEG.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\drip.bmp
Deletes FileAkIA.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dog.bmp
Deletes FileqksO.exe
Deletes FileuYYM.exe
Deletes FileOIsO.ico
Deletes Fileucsk.exe
Deletes FileqMUG.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\airplane.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\dirt bike.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\butterfly.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\install.bmp
Deletes FileckMK.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\horses.bmp
Deletes Fileawgm.exe
Deletes FileGIwQ.ico
Deletes FileMgEI.exe
Deletes FileeQsQ.ico
Deletes FileOoAM.ico
Deletes FileGYEE.ico
Deletes FileqQIO.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\duck.bmp
Deletes FilegIUM.exe
Deletes FileuowQ.ico
Deletes FileSEEy.ico
Deletes FileeYQo.ico
Deletes FiletocO.exe
Deletes FileKMca.ico
Deletes FileeMwQ.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\chess.bmp
Deletes FileqMkO.exe
Deletes FileSIIq.exe
Deletes FileKMIk.exe
Deletes FileC:\Documents and Settings\All Users\Documents\My Music\Sample Music\New Stories (Highway Blues).wma
Deletes FileKYMm.ico
Deletes FileiMMG.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\pink flower.bmp
Deletes FileGAIk.ico
Deletes FileOkcI.ico
Deletes FileWYQU.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\guitar.bmp
Deletes FileeQUg.exe
Deletes FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Blue hills.jpg
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\astronaut.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\guest.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\skater.bmp
Deletes FilewcUs.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\frog.bmp
Deletes FileGEIU.ico
Deletes FileuIIg.exe
Deletes FileOowE.exe
Deletes FileuQYM.exe
Deletes FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Winter.jpg
Deletes FilesYcu.ico
Deletes FileKsgs.ico
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\snowflake.bmp
Deletes FileEsUo.ico
Deletes FileC:\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Sunset.jpg
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\car.bmp
Deletes FileyAAy.exe
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\kick.bmp
Deletes FileC:\Documents and Settings\All Users\Application Data\Microsoft\User Account Pictures\Default Pictures\lift-off.bmp
Creates Processtaskkill /FI "USERNAME eq Administrator" /F /IM QWcQAwoI.exe
Creates ProcessC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates MutexvWcsggUA
Creates MutexScUMMMcQ

Process
↳ C:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe

RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\QWcQAwoI.exe ➝
C:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.inf
Creates MutexvWcsggUA
Creates MutexScUMMMcQ

Process
↳ C:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe

RegistryHKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\QWcQAwoI.exe ➝
C:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.exe
Creates FileC:\Documents and Settings\Administrator\qwEYAYUE\VyAMAMkQ
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\All Users\hEkAgEII\QWcQAwoI.inf
Creates MutexvWcsggUA
Creates MutexScUMMMcQ

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\123.rar

Process
↳ "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\shell32.dll,OpenAs_RunDLL C:\Documents and Settings\Administrator\Local Settings\Temp\123.rar

Process
↳ taskkill /FI "USERNAME eq Administrator" /F /IM QWcQAwoI.exe

Creates FilePIPE\lsarpc

Network Details:

DNSgoogle.com
Type: A
216.58.216.238
DNSgoogle.com
Type: A
216.58.216.238
HTTP GEThttp://google.com/
User-Agent:
HTTP GEThttp://google.com/
User-Agent:
HTTP GEThttp://google.com/
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 200.87.164.69:9999
Flows TCP192.168.1.1:1031 ➝ 200.87.164.69:9999
Flows TCP192.168.1.1:1032 ➝ 216.58.216.238:80
Flows TCP192.168.1.1:1033 ➝ 216.58.216.238:80
Flows TCP192.168.1.1:1034 ➝ 200.87.164.69:9999
Flows TCP192.168.1.1:1035 ➝ 200.119.204.12:9999
Flows TCP192.168.1.1:1036 ➝ 200.119.204.12:9999
Flows TCP192.168.1.1:1037 ➝ 190.186.45.170:9999
Flows TCP192.168.1.1:1038 ➝ 190.186.45.170:9999
Flows TCP192.168.1.1:1039 ➝ 216.58.216.238:80
Flows TCP192.168.1.1:1040 ➝ 200.87.164.69:9999

Raw Pcap
0x00000000 (00000)   94                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   486f7374 3a20676f 6f676c65 2e636f6d   Host: google.com
0x00000020 (00032)   0d0a0d0a                              ....

0x00000000 (00000)   94                                    .

0x00000000 (00000)   94                                    .

0x00000000 (00000)   94                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   486f7374 3a20676f 6f676c65 2e636f6d   Host: google.com
0x00000020 (00032)   0d0a0d0a                              ....

0x00000000 (00000)   94                                    .

0x00000000 (00000)   94                                    .

0x00000000 (00000)   94                                    .

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   486f7374 3a20676f 6f676c65 2e636f6d   Host: google.com
0x00000020 (00032)   0d0a0d0a                              ....


Strings
z...
?.$
t.
.
xxxx}4
.
t...;...
..$
.y2d..
.x
.d.N.7.
VC=

0:B&f~R
0?,hzi
0L;VG8S*
0QvG!c
}0r/\@
,,0R28BE
,_0Sl{R
0s?}Pc
0tFT\*
0tfYWTi
0YdbiQ
}0?\y>I
0Z8m1kxZ
1>+(>%
1c}}PS^|Qr
`1d+[Q
1&eu>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>_\y>O\y>O\y>O\y>O\
1H.uXQ
1/KJ7:?XQ^->%,
1SRd~qX
1Ty>_G
1U%NX#
1Uy>?"
1?\yNC
)22T8T
23,}2s,
2/\	bO
2GC=K90
2I$)jlY
2sM39y
;%_2t~G
2$;x2>
2ylQ,I
2Z?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^M
2Z?XQ^->%,KJ7:?XQ^->%,KJg4[K]
,38qGd
39wh-$
39y.	=
_+3dzu
!'3/Ih
3$)<'kE~
3<@NvY
3<P3Id
3sm9shOPs
3t8Kz2
3T9)Wf
^~}3Z-
4)8=K<
4f;OE$6
(4>H=U
.4j?XQ^->%,
^4J?XQ^}`A/
.4j?XQ^->%,KJ7:?x
.4j?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?
4kRY^E4
4L<:>HE
*4/l\w
4nDi"9
!4p5qK
4Ry>/r
4sEUY)
&4s]k~'
&4U9=FGo|
@4ZiuD
4{\z`vk$o>
>4z?XQ^->%,
.4Z?XQ^->%,
>4z?XQ^->%,KJ
>4z?XQ^->%,KJ7:?X
>4z?XQ^->%,KJ7:?XQ^->%,KJ7:?
.4Z?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,
>4z?XQ^->%,KJW4[K
5g\.-(}
5mJ5Is
5/oi"c9"
(\5,rO
5;vE^Qn->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^
	5"whW
5x57p0A
5xU[93
5],Z7Y|
6%E	W$
6f8X&n
6JHAhO
6KJ7:?XQ^->%,KJ
6&|kmr
;6`lwAo
=6r\4|
6RmT+>%\KJ7:?XQ^->%,KJ7:?
6.`)t4
6_thWQ
]6]Wz?
6z'N&K
7=3!*}
7\6a%!
7Aa6Und
7AU<*Z
7*bfd~d
7`>E$)
7>F5r.
`7}JCE
7_uH+?
7Xi>_\
8%8J}|e
8A0m/-
8D)"y?k
(&8g(U
(>?8h!
8h:\Xk-
)8K_8&0(
,,8r9Z
/;%8t?
8vE^Qn-
8vE^Qn->%,KJ7:?XQ^->%,KJ
8vE^Qn->%,KJ7:?XQ^->%,KJ7:?H
8`WK[=2
8X[lQc
^8yx;VP
8z?XQ^
8z?XQ^->%,
8z?XQ^}
8z?XQ^}`A/
8z?XQ^}`A/e
8z?XQ^->%,KJ7:?
8z?XQ^->%,KJ7:?XQ^->%,KJ7:?8
8z?XQ^->%,KJ7:?XQ^->%,KJ7:?X
8z?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?
8z?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^
8z?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJw4K
8z?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^m`Q/
8z?XQ^->%,KJW4[
8z?XQ^->%,KJW4[[
[>90_p
9"2=Hw
~96Z{ 
[9)cxh
9FD\y>Y
9'GRT,
9J_!Y7
9<P+)P
9R1Xk}d
9S,.[i
^}&9_u
9vYK/jh
#9xKl 
\9yL_i>
(a4Tv]5TfS4T
<A\7a]o
a!8xa<f
abumF1
)&Ac1_
AD"LLad
Ae(IWf
AeXbQHw/P[B
Ag(IWf
~`A?KJ7:?XQ^}`A/
~`A?KJ7:?XQ^->%,KJ
A/KJ7:?XQ^->%,KJ7:?
A?KJ7:?XQ^->%,KJ7:?h
aL"z:o
~AO$_*`
APy>/G
aQy>/"N
ATy>o45
ATy>_w%
aU14eu"
AVy>_tV
aW	6zcv
aw]d=5
a,\y>O
"ayq(Se
A_}>:Z
aZF~aiS
AZoaR,
')@\	b_>}:
B0%M$Iu8
B4z}m8E
?b;AXD
&bbl/C
bcv::|9
/_\	bG
bhMi%D
bi$<FA.
B*IFGmJ
]Bi-j~
=bj+L~
BOF*k=
Bqv~3!
Bs=_BA
}]bt_R
){By/#:
B_}.?\y
BZo1R,
{)C*+!
C#04<CjN7VE
c9(ZLM
	#Ca0,
]Cb`KvXd
c	CQ(j
CCzTs`.
|c_dw|
ce[#C&
cf@?9V
ClnwXf
cl-Rc,
C*oQ2-
cpq*wd
?=cQ>]Z
//C~RA;
cTI]/45
@cu??\
:(cx75eH7oa
CXEL{3/
C|Xi~H
C<Xi>O\
CzRxvj
^d4[[Q
d7d^GR|Zg>}
d(D_PR4
dDV4'Y
dD*Vq$W
DexgfpS<
>_dF~P-f
DghLf[s
d<`GHu#cq
}~D=I"<
Dieze/
D/=jeU0
d&LVPi
{	DoGA
{	DoGA"
{	DoGAb
{	DoGAB
\{	DoGAr
{	Dogm
{	Dow=
d&pnax
^d$[[Q
}DQ&5k
.dT[[Q
Dup=e,
dVP<da
!DVSS$7
	#dx9&ViY
DXO4tKRGfgOo
D\y>O"p>
\&"dZEo=
+DZ/La
'e0X_7
"+E/(1'
E| 	)6
+e6-'^m|&
EbNX=Z
Ed(#:5
EEbBP\
e["EH7t
E@#~eo
&$Ei!sk
?em9?a
Ep/#bR@
EPcTlV
;^e"q1
E^Q^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^
EqN3^%
!/E>s#b
;E\sr3
E#;U=L
eu>O\)
eu>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O
E$?VJV
;eXZ$"
 e\y.G
e|YW		
~}\^}f
f/0:X7
f>0{Yr
Fb9"vp
FBh]	^
{F?F?1
fFx,\:[q
F+i-#W
fjpKJ7:?XQ^->%,KJ
-F#ksF
fM\y>O
fOx[KZG
F$R96o
^FtJ,?
^fuM^#
f|V=N>
:FW	HV
F@;Xkb
^fzd=4\K
FzpKJ7:?XQ^->%,KJ
FzpKJW4[K
g;{0ql1iE%
g"16n%
g'5l9(.
g7@\	b_-}:_\y>_r
/G&7KzT
.G{,a'`
g{A59~
GdhbF4
!g:g5N
GG<aMR[
GghIWf
~[&G|h
~GHy>O
~gIy>_
~gIy>o
g[jcOs
G'jiZmbT
g^jky-!
~GJy>/
{]gJ)Z
_GMRp.
~gOy>_
&_Gu}.
Gx0 )L
`g#ZD-
g\ZGfs
h>5\8+*3
h6Sp}x
hAL#OB
h#.bHe
hC0k8l:3
#Hc4n(
Hcy_(,
~HD$Cnoi
HfmkKY+
HH@&cG
H:kiVc
hp6RQ^->%,KJ7:?
hp6RQ^->%,KJ7:?XQ^->%,KJ7:?x
hQQ!;R
'#HTR;
htU]gv
h$ufaWGO
=Hw}~KCr
)hw^"	u
HwXynH
hYw ?i
{H:zDSv
@}%];i
i3y|%P
\i4O\x:O\Y4O
-I(Au	
I "bi_yu
Iby>?Z
{%Ie2C
<=!<\if
iFF=Zw
IIXU	e
Ij@SXt
,IKN`v
iLuh@e
INt	YQ
_IOsWy
iQS8Ec
"I`r]7]
IR}z+NEF
i	scpd
itq <Q+_
\ItQx}
ItTz)S
i|Ws=0
iwSkNP
iWXz9[s
*i~Xinh
)i>Xy>o\y
^I y=?"
iY'whMTf
Iz;Xi>O\
}:?j;:
~#*+	J
j0f)VYvP
J2`a+D
j'2fq9
j4m-7>$:
j4pK*S!n
J5^XnI
J9v%rwP
Jaz/SaP
]{j`b T
jdnN2&
JIvebwp
JIv%rwP
`jj'KnX
J.>%\KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,
j^lp&`
^-j&mu
j%MX8$
JNCEh1
jnZ,|;"
J$rH9k
/jRVk~
)jt2mm,
ju`NEz
!jU=^rg[
^jx-3l
J}{Xi~H
JX~OJm
JXp	=pW7
}>J\y>O\y>_
}>J\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O
JyUr(B !
%Jyw&5
jz7;nX
jz'knX
Jz{Xi~H
]:?K3?
k3fShw
K7'	ZD
K89eb@
k*_8m(_
kbE]<$
^/kBRm
!K`CAq
kcI+qpa
k/DF{WR
k-h+[n
->%,KJ
->%,KJ'4;+
->%,KJ7:?
->%,KJ7:?(
\KJ7:?
->%,KJ7:?8
.>%\KJ7:?8
KJ7:?8
->%,KJ7:?H
->%,KJ7:?x
->%,KJ7:?XQ^-
->%,KJ7:?XQ^->%,
KJ7:?XQ^->%,
->%,KJ7:?XQ^}`A/
\KJ7:?XQ^=C
->%,KJ7:?XQ^->%,KJ
KJ7:?XQ^->%,KJ
->%,KJ7:?XQ^->%,KJ7:?
->%\KJ7:?XQ^->%,KJ7:?
KJ7:?XQ^->%,KJ7:?
->%,KJ7:?XQ^->%,KJ7:?H
->%,KJ7:?XQ^->%,KJ7:?x
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,
\KJ7:?XQ^->%,KJ7:?XQ^
KJ7:?XQ^->%,KJ7:?XQ^->%,
.>%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^}
KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^}`A/d
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?8
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?h
KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?
KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^]
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^
KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^m`Q/
->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJG4+
->%,KJ7:?XQ^->%,KJ7:?XQ^M
KJ7:?XQ^->%,KJg4[
->%,KJ7:?XQ^->%,KJW4[
KJ7:?XQ^->%,KJW4[
KJ7:?XQ^->%,KJW4[;0
->%,KJ7:?XQ^->%,KJw4KK
+k"jcR
Kjf^ftd
->%,KJg4[
->%,KJg4[[
->%,KJW4[
->%,KJw4K[
?kl Dx
KLz#)%M
KndD:)at
&+!KO	
).KTW$
/K<u#b
K.v:,EK
(k	VX3I
kW(77i
kyO#{0k
l1rO*%
L;2G+Ql@
=l"3A|
LAIzcq
la(s*4
lc]KXIdLX}
-LF`=] 
 lF4?],
lht+p(
.>%LKJ
.>%LKJ7:?8
.>%LKJ7:?x
.>%LKJ7:?XQ^->%,KJ7:?
LlL6$P
lnQr<}
l#OKXI
lo"z:/
l?@\_P
L|qCjnQr<}
LQQ@(~.
#lQ"+z
L,!r<=
L,!r<}
lu]| Hkj
LU^uwo
l_Wn?U\L
>L\y>O
Ly>Ol%
L\y>OX
M14"#	
|m1r/\P
,M8QRU
MA6:HD
mA>ET%
mAR,MF@=
M|!b}O
mdHe.F(
MiT}>?
m]JbbCj
MMMMMM333333333333
)M=o45
m{O=J(
mOP/pV
"m]q(\7
MQ)+Yf
_~M,r8
mrK`_(:
MS^gC167]4n
[mzAY%v
"%n=~}
N0F7=p
n-6H8$
n6[/w9
n<#7bs 
n8+hImy
N!9K1gdq<
nb\>br)
.%ne^}.
.n#E;lNP
NF#<9v
NG#5.k
NhKVp 
n`Q/KJ74+;0
Nr2K2u2K
Nt$K[Q
/Nw28w
|nx7@!
nxKP)/m
N'"<xs
-N\ynx
,nZ1Tg
nZ/<D 
o'1) N
!o4L92
~o)Bb_
?OcPjj
Odnjch0
}OF`=] 
Of;zxL5
=O\I"G?
oLrCm+F
O^'LZU
omrs\-
$O\)%O\
o{p]Fp
Ou$&0G
^OV`}=Qp
>ovzX}.Z
@OW1Q%
@OWP4G
O;Xy>O\
#O\Y1O\i
OyUhGU
Oy>?y5>
"OzKJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?
o!~Z+Uw
p0*9.y
p0jGf0
p<={0MdB
p2;EQ2
p,`!5`pD
P6cjemd
P6(Mq<f
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
PfZ5\4z
p<gT)u
~Pg"Vnz~
pgVS20
~Pi>?\
pJ\y.G
@pk!AYd
-p`'l.
(p)'= m
PMbWNn$zX
PP,uHzGX6Y
pq>h pW
pR3) ^9Y,Z
PU;o;]&
$p)W&KL
!)pYbv\
+p+z	P
Q0DfS4
Q0TfS4
q"1e@zE
Q8xGG]
qa`Q_KJ7:?XQ^->%,
Q d[@jr
Qdzqo)
@[QfF{
Qi[Al 
Q|J\[C 9q
Q[ka`bU
]Q>->%,KJ7:?h
q!>%\KJ7:?XQ^->%,KJ7:?XQ^
]Q>->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^
]Q>->%,KJW4[
qk	w4#
	Q%Ld|
ql]G5yD=(
	q!>%lKJ7:?XQ^->%,KJ7:?XQ^
q^->%LKJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?
<qMaMi
{q.mk'nJH=P
Q'MPQ'
>QMXpU
QPGvp[l
-]QPH3
QPu}a	
-Qr/lA
/qSW"S
QTy>/G	=
qu'q	*
?qva;&
qw-:go
qWO<`3
Q~XynH
q^y>_g
q"YP{&@
qZ^U'!
?~:^"!R
R>">3,	
r[`F!,
Rich!4O
rIgK[I
r >%,KJ7:?XQ^->%,KJ7:?XQ^
rKJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,
rM4=W<
"RM79%
}!r?mA
r]mAB-
R<!o,#
[R:Ohf5
RREVaC:
r`TQ.->%,KJG4+
r`TQ.M
|rV{eO
-]R`wd
RwViRX
RYMmRP!2
!RZtm- x\d
#>s[,&
	S ># 
>S2Jmh
s4e10L
S4jRv*7
S'_B@l 
{sB|PK
#$!)Sd5
:s?Dj{
|S%iPV_
=sJGK?`
s<J&'S
S'khz	
:S,,L)
SLmH|J
:%SM`i
sm*rO<
SNl$4_
}S:og&
^._Soy
*s<Q((
	srJXWF
^s(TaG2
sw01:?XQ^->%,
sYcwbN
SY>Y^sLi&
sZX)oKP
^t".|	
|=-?<T
t0DFS4
T|;@0J
t0TFS4T
t1S@pRM
|?-/T2cg
T2is$fA
^T4[[Q
t5&Rk;
Tay>?GI
T/cd{zr
TcW3:[(
t*)FJQ;
tfsVPi
'#>tG:
TGDe' 
!This program cannot be run in DOS mode.
tH+?Qw
(T	I`a
tKJ7:?XQ^->%,KJ7:?
tKJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^}`A/e
^t$K[Q
T~_%M,
T}N3ot
:T*okO
TPSPPj\-
T)qa~[
tt!G,T=
t&=TTi
tu4,fv
T_v^9k
)}+TVc
t_X%.y
T?~yc4
T/zJ"Wk
/{<u3b
:U6S4T
U9Z7id	YQ
UBi(,W
UD<.gA
U(fM<i
uH+?yl
u#h[zf
uKJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?X
u*>%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJG4+k
}}uL+F{=w
-u>O\y
u.p	7=
U^Q^->%,
U`*s$&
u[she5
`uT=F~j
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
u|\yN@c
Uy>O7:=
Uy>/tf"^
~^^{Uz
;:<{*v
!@?_v 
^*V>~*
v5lsP!
v6m4Zue
v8?QvQN_[s
v~_\99L
!VcVnR
%ve496
(vE^Q^->%,
(vE^Q^->%,KJ7:?
(vE^Q^->%,KJ7:?XQ^->%,KJ
(vE^Q^->%,KJ7:?XQ^->%,KJ7:?XQ^}`A/d
(vE^Q^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJg4[
(vE^Q^->%,KJW4[[
(vE^Q^M
(vE^Q^m`Q/
(vE^Qn]
,;VeR}
~~V\g'&
+V(HbM
],!Vj4Q
vjpKJ7:?XQ^->%,KJ
-V_n5y
v		Q4[
v%^Q>->%,KJ7:?XQ^->%,KJ7:?h
VQN->%,KJ7:?XQ^->%,KJ7:?h
vu+Z&)
?-?#Vv_
)v`Wv%c
)v@Wvwk
VX"[Pat,
Vy>O?IVs
'#^~?[W
W>3*k)A
(W7Y|Z
WAC=j?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^}`A/
<w;~binu
:Wc<iif#
(`!wDa
wfwCA!
Wgv,(SL
wH4)/,
WIhZt@b~Vg
[w'>%,KJ7:?
wKJ7:?XQ^=
wKJ7:?XQ^->%,KJG4+Kn
wKW3,4 
*wmqqb
W,Mz}J<M
WoxaaT 
@_WP4G
^WP|Z7
^W/pzs<
;*W-+r
'WuF!U
w.vudV
wwwUUU
wwwwwwUUU
WX=!95\
WXKe'I
Wy>/2CV
WzZ ?F
x0I:>-
x@0l6d
X1i8RzA
@<X4q`
x6W<9r
\X9bg\
@:X9MmY
^X9Z`X
 XA'.`
X	bO!z:
xcb7hc
`Xcf+0
X"E}s&i
:Xi>CS
}XinH,%
=Xi>O\
^Xirc[
xi}U!J
x!jnFP
xk`RR}
^xoB6]
x>o\ynJ
x>o\y>O\y>O\y>O\y.O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O
?XQ^->%,
?XQ^}`A/
?XQ^->%,KJ7:?
?XQ^->%,KJ7:?XQ^->%,KJ
?XQ^->%,KJ7:?XQ^->%,KJ7:?X
?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^]
?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^}`A/
?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?x
?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^M
?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJW4[;0
?XQ^->%,KJ7:?XQ^->%,KJW4[
?XQ^->%,KJw4K{
{XrTc	
xs27xs
xsAC=j?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^
xsbGzp
xsbwkwF`
xsbW{w
xS-$fc
xs">%|KJ7:?XQ^->%,
xs">%|KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ74+K
xs">%|KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?X
xs">%|KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJg4[
xs">%|KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJG4+
xs">%|KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJw4K{
xsr4,vKJ7:?XQ^->%,KJ7:?XQ^-
xsR$,vKJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJg4[
 X<.Su
xtTFc{
xunF7h
xuV<;+
xWweA[1;m
Xx+}`&
x`y0TLb
xY'G=;
xYgYh.
:Xy>o\
=Xy>O\
];Xy>O\
;Xy>O\IbJ
Xy>ORI
<Xy>O\y
=Xy>O\y
Xy>_\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O||
y#}?$4Sl
)y9Xi9k^
YGFMiG
yGrEA\
YH&Wi9
Y@I0BJ
yIrZr@
yK'-<m2Zl
yM;mb4
Y%MYsU
>?\yNC
\yN@cQ
ynpD_3
]y>O\)
\y>O\)
y>O\	bK
\y]Obt>
\y>OLy>OLy>OLy>OLy>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O
\y>O,uzO\y>OP
^y]ow(
\y>Oy5>
]yOYM(
y>o\ynJ
\y>O\y>O
y>o\y>O\yn
\y>O\y>O\y>O
\y>O\y>O\y>O\
\y>O\y>O\y>OYI;
y>o\y>O\y>O\ynJ
]y>O\y>O\y>O\y>O
\y>O\y>O\y>O\y>O
\y>O\y>O\y>O\y>O\i>O\y>O\)
\y>O\y>O\y>O\y>O\y>O
\y>O\y>O\y>O\y>O\y>O\y>O
]y>O\y>O\y>O\y>O\y>O\y>O\y>O\)
\y>O\y>O\y>O\y>O\y>O\y>O\y>O\)
\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\)
\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O^{<M^{<M^{<M\y>O\y>O\y>O\y>O\y>O\y>O\y>O\
\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\)
\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O\y>O
ypW.gP
:\YS$1
ySY&sg
{YtV,q
y:[UyS
y=V\RgbK
;yxK5vl
^y>_Xy>O^y>
^y>/^y>
$\y>_y
,y#;]Y>
Yy>oBo]
\yzS u
<?%{Z5|n
Z7	{+k
Z][*$92o#wZ
Z)9oZy<?[99
ZB?hw`
Ze^-z%
Z;fU)X
ZH.vvM^f
zH+/Yu=y
zj'[nX
z.>%<KJ7:?H
zKJ7:?XQ^->%,
_zKJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^->%,KJ7:?XQ^M
z"lOukf
Zn`Q/KJ7:?XQ^->%,
z:o\y>_
+zRF^:v;
zuoTMD
ZW!Q OQ
ZY9_[y>
ZyBuk;
,%z@\y>O
Z:/\y>O
\zZ(5k