Analysis Date2014-12-21 17:00:28
MD509c581afa24cebe2db31b93d79ac39ed
SHA14d77999e0fede3ba1e74cb32f197e4517150f7d1

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
SectionCODE md5: 0d8714e2cb884a13e9ebcc2b8dfff3de sha1: 2f4837e32812f09daae4ec3a294996fc5e2c52f0 size: 71680
SectionDATA md5: 31970a4af457443d6559a69191c865dd sha1: 7cb2de059d98870c91a9af6a203d2d6bfceca7a8 size: 1536
SectionBSS md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.idata md5: 7a5e4e08e4fa6dff1ccebf3ed4b43b2f sha1: d41bf19ca168c439f1cd615fec1ad0a39e32ce95 size: 3072
Section.tls md5: d41d8cd98f00b204e9800998ecf8427e sha1: da39a3ee5e6b4b0d3255bfef95601890afd80709 size: 0
Section.rdata md5: 550c4af1e329a7938314f643461eb7bb sha1: 36bb9f6eff884777c489983100c4db5c10fec51b size: 512
Section.reloc md5: ff1ce2018aa17fe600fca636b126dbe4 sha1: c6fff00d41071ff3c363bbeaebd70338a55d1c94 size: 6144
Section.rsrc md5: ae38300fb25d3b6680755b1fde418759 sha1: f49984bb8e3b018f06f62329c0477daa65c3fcba size: 6656
Timestamp1992-06-19 22:22:17
PackerBorland Delphi 4.0
PEhash12a441118e5ccb3d19af9fe092a1248a1cbff7ce
IMPhash3aaa62025a018ab71a12feaae223d4ed
AV360 SafeTrojan.Delf.HT
AVAd-AwareTrojan.Delf.HT
AVAlwil (avast)Delf-YU [Trj]
AVArcabit (arcavir)Trojan.Delf.HT
AVAuthentiumW32/Trojan.HDNK-1982
AVAvira (antivir)TR/Delf.HU
AVBullGuardTrojan.Delf.HT
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)Trojan.Delf.ht
AVClamAVno_virus
AVDr. WebTrojan.AVKill.152
AVEmsisoftTrojan.Delf.HT
AVEset (nod32)no_virus
AVFortinetW32/Delf.HT!tr
AVFrisk (f-prot)W32/SillyTrojan.CD
AVF-SecureTrojan.Delf.HT
AVGrisoft (avg)Generic.VLN
AVIkarusTrojan-Dropper.Delf
AVK7Riskware ( 0040eff71 )
AVKasperskyTrojan.Win32.Delf.ht
AVMalwareBytesno_virus
AVMcafeeGeneric.dc
AVMicrosoft Security EssentialsTrojan:Win32/Trufip!rts
AVMicroWorld (escan)Trojan.Delf.HT
AVRisingTrojan.Win32.Generic.128F579A
AVSophosno_virus
AVSymantecBackdoor.Trojan
AVTrend Microno_virus
AVVirusBlokAda (vba32)Trojan.Delf

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Pizda! ➝
"C:\malware.exe"\\x00

Process
↳ C:\Program Files\Internet Explorer\iexplore.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window_Placement ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Locked ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutex_SHuassist.mtx
Creates MutexShell.CMruPidlList

Network Details:

DNSorigin.sa.windows.com.akadns.net
Type: A
137.117.86.84
DNSsa.windows.com
Type: A
HTTP GEThttp://sa.windows.com/sasearch/lclsrch.xml
User-Agent: SCAgent
HTTP GEThttp://sa.windows.com/sasearch/balloon.xsl
User-Agent: SCAgent
HTTP GEThttp://sa.windows.com/sasearch/balloon.xsl
User-Agent: SCAgent
HTTP GEThttp://sa.windows.com/sasearch/lclsrch.xml
User-Agent: SCAgent
HTTP GEThttp://sa.windows.com/sasearch/lclAdv.xml
User-Agent: SCAgent
HTTP GEThttp://sa.windows.com/sasearch/lclmm.xml
User-Agent: SCAgent
Flows TCP192.168.1.1:1031 ➝ 137.117.86.84:80
Flows TCP192.168.1.1:1032 ➝ 137.117.86.84:80
Flows TCP192.168.1.1:1033 ➝ 137.117.86.84:80
Flows TCP192.168.1.1:1034 ➝ 137.117.86.84:80
Flows TCP192.168.1.1:1035 ➝ 137.117.86.84:80
Flows TCP192.168.1.1:1036 ➝ 137.117.86.84:80

Raw Pcap
0x00000000 (00000)   47455420 2f736173 65617263 682f6c63   GET /sasearch/lc
0x00000010 (00016)   6c737263 682e786d 6c204854 54502f31   lsrch.xml HTTP/1
0x00000020 (00032)   2e310d0a 49662d4d 6f646966 6965642d   .1..If-Modified-
0x00000030 (00048)   53696e63 653a204d 6f6e2c20 31342041   Since: Mon, 14 A
0x00000040 (00064)   70722032 30303820 31323a30 303a3030   pr 2008 12:00:00
0x00000050 (00080)   20474d54 0d0a5573 65722d41 67656e74    GMT..User-Agent
0x00000060 (00096)   3a205343 4167656e 740d0a48 6f73743a   : SCAgent..Host:
0x00000070 (00112)   2073612e 77696e64 6f77732e 636f6d0d    sa.windows.com.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f736173 65617263 682f6261   GET /sasearch/ba
0x00000010 (00016)   6c6c6f6f 6e2e7873 6c204854 54502f31   lloon.xsl HTTP/1
0x00000020 (00032)   2e310d0a 49662d4d 6f646966 6965642d   .1..If-Modified-
0x00000030 (00048)   53696e63 653a204d 6f6e2c20 31342041   Since: Mon, 14 A
0x00000040 (00064)   70722032 30303820 31323a30 303a3030   pr 2008 12:00:00
0x00000050 (00080)   20474d54 0d0a5573 65722d41 67656e74    GMT..User-Agent
0x00000060 (00096)   3a205343 4167656e 740d0a48 6f73743a   : SCAgent..Host:
0x00000070 (00112)   2073612e 77696e64 6f77732e 636f6d0d    sa.windows.com.
0x00000080 (00128)   0a0d0a                                ...

0x00000000 (00000)   47455420 2f736173 65617263 682f6261   GET /sasearch/ba
0x00000010 (00016)   6c6c6f6f 6e2e7873 6c204854 54502f31   lloon.xsl HTTP/1
0x00000020 (00032)   2e310d0a 49662d4d 6f646966 6965642d   .1..If-Modified-
0x00000030 (00048)   53696e63 653a204d 6f6e2c20 31342041   Since: Mon, 14 A
0x00000040 (00064)   70722032 30303820 31323a30 303a3030   pr 2008 12:00:00
0x00000050 (00080)   20474d54 0d0a5573 65722d41 67656e74    GMT..User-Agent
0x00000060 (00096)   3a205343 4167656e 740d0a48 6f73743a   : SCAgent..Host:
0x00000070 (00112)   2073612e 77696e64 6f77732e 636f6d0d    sa.windows.com.
0x00000080 (00128)   0a0d0a0a 0d0a3c68 746d6c3e 0a20203c   ......<html>.  <
0x00000090 (00144)   68656164 3e0a2020 20203c74 69746c65   head>.    <title
0x000000a0 (00160)   3e343034 204e6f74 20466f75 6e643c2f   >404 Not Found</
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f736173 65617263 682f6c63   GET /sasearch/lc
0x00000010 (00016)   6c737263 682e786d 6c204854 54502f31   lsrch.xml HTTP/1
0x00000020 (00032)   2e310d0a 49662d4d 6f646966 6965642d   .1..If-Modified-
0x00000030 (00048)   53696e63 653a204d 6f6e2c20 31342041   Since: Mon, 14 A
0x00000040 (00064)   70722032 30303820 31323a30 303a3030   pr 2008 12:00:00
0x00000050 (00080)   20474d54 0d0a5573 65722d41 67656e74    GMT..User-Agent
0x00000060 (00096)   3a205343 4167656e 740d0a48 6f73743a   : SCAgent..Host:
0x00000070 (00112)   2073612e 77696e64 6f77732e 636f6d0d    sa.windows.com.
0x00000080 (00128)   0a0d0a0a 0d0a3c68 746d6c3e 0a20203c   ......<html>.  <
0x00000090 (00144)   68656164 3e0a2020 20203c74 69746c65   head>.    <title
0x000000a0 (00160)   3e343034 204e6f74 20466f75 6e643c2f   >404 Not Found</
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f736173 65617263 682f6c63   GET /sasearch/lc
0x00000010 (00016)   6c416476 2e786d6c 20485454 502f312e   lAdv.xml HTTP/1.
0x00000020 (00032)   310d0a49 662d4d6f 64696669 65642d53   1..If-Modified-S
0x00000030 (00048)   696e6365 3a204d6f 6e2c2031 34204170   ince: Mon, 14 Ap
0x00000040 (00064)   72203230 30382031 323a3030 3a303020   r 2008 12:00:00 
0x00000050 (00080)   474d540d 0a557365 722d4167 656e743a   GMT..User-Agent:
0x00000060 (00096)   20534341 67656e74 0d0a486f 73743a20    SCAgent..Host: 
0x00000070 (00112)   73612e77 696e646f 77732e63 6f6d0d0a   sa.windows.com..
0x00000080 (00128)   0d0a0a0a 0d0a3c68 746d6c3e 0a20203c   ......<html>.  <
0x00000090 (00144)   68656164 3e0a2020 20203c74 69746c65   head>.    <title
0x000000a0 (00160)   3e343034 204e6f74 20466f75 6e643c2f   >404 Not Found</
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f736173 65617263 682f6c63   GET /sasearch/lc
0x00000010 (00016)   6c6d6d2e 786d6c20 48545450 2f312e31   lmm.xml HTTP/1.1
0x00000020 (00032)   0d0a4966 2d4d6f64 69666965 642d5369   ..If-Modified-Si
0x00000030 (00048)   6e63653a 204d6f6e 2c203134 20417072   nce: Mon, 14 Apr
0x00000040 (00064)   20323030 38203132 3a30303a 30302047    2008 12:00:00 G
0x00000050 (00080)   4d540d0a 55736572 2d416765 6e743a20   MT..User-Agent: 
0x00000060 (00096)   53434167 656e740d 0a486f73 743a2073   SCAgent..Host: s
0x00000070 (00112)   612e7769 6e646f77 732e636f 6d0d0a0d   a.windows.com...
0x00000080 (00128)   0a0a0a0a 0d0a3c68 746d6c3e 0a20203c   ......<html>.  <
0x00000090 (00144)   68656164 3e0a2020 20203c74 69746c65   head>.    <title
0x000000a0 (00160)   3e343034 204e6f74 20466f75 6e643c2f   >404 Not Found</
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.


Strings
\
-

Abstract Error?Access violation at address %p in module '%s'. %s of address %p
A call to an OS function failed
Access violation
Application Error1Format '%s' invalid or incompatible with argument
April
Assertion failed
August	September
Cannot assign a %s to a %s%String list does not allow duplicates
Cannot create file "%s". %s
Cannot open file "%s". %s
Control-C hit
December
Division by zero
DVCLAL
Exception in safecall method
External exception %x
Failed to set data for '%s'
February
File access denied
File not found
Floating point division by zero
Floating point overflow
Floating point underflow
Friday
Integer overflow Invalid floating point operation
Interface not supported
Invalid argument
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid filename
Invalid numeric input
Invalid pointer operation
Invalid property value List capacity out of bounds (%d)
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant type
Invalid variant type conversion
I/O error %d
January
jjjj
July
June
List count out of bounds (%d)
List index out of bounds (%d)
MAINICON(
March
Monday
No argument for format '%s'"Variant method calls not supported
November
October
Operation not supported
Out of memory
PACKAGEINFO
Privileged instruction(Exception %s in module %s at %p.
Range check error
Read
Read beyond end of file	Disk full
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Saturday
%s%s
%s.Seek not implemented$Operation not allowed on sorted list
%s (%s, line %d)
Stack overflow
Stream read error
Stream write error
Sunday
System Error.  Code: %d.
Thursday
Too many open files
Tuesday	Wednesday
Unexpected variant error
Variant or safe array is locked
Variant overflow
Write$Error creating variant or safe array)Variant or safe array index out of bounds
 !"#$%
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
&'()*+
,-./0123456789
0123456789ABCDEF
3Messages
8Registry
advapi32.dll
Array 
Boolean
ByRef 
CharNextA
CharToOemA
Classes
^Classes
CloseHandle
CompareStringA
CreateEventA
CreateFileA
C<"u1S
Currency
CVariants
Decimal
DeleteCriticalSection
Dispatch
Double
EAbstractError
EAccessViolation
EAssertionFailed
	EControlC
EConvertError
EDivByZero
	EExternal
EExternalException
EFCreateError
EFilerError
EFileStreamError
EFOpenError
EHeapException
EInOutError
	EIntError
EIntfCastError
EIntOverflow
EInvalidCast
EInvalidOp
EInvalidPointer@b@
EListError
EMathError
EnterCriticalSection
EnumCalendarInfoA
EOSError
EOutOfMemory
	EOverflow
EPrivilege
ERangeError
EReadError
ERegistryException
ESafecallException
EStackOverflow
EStreamError
EStringListError
EUnderflow
EVariantArrayCreateError
EVariantArrayLockedError
EVariantBadIndexError
EVariantBadVarTypeError
EVariantDispatchError
EVariantError
EVariantInvalidArgErrorl
EVariantInvalidOpError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantOverflowError
EVariantTypeCastError
EVariantUnexpectedError4
EWriteError
	Exception
ExitProcess
EZeroDivide4a@
FindClose
FindFirstFileA
FormatMessageA
FPUMaskValue
FreeLibrary
GetACP
GetCommandLineA
GetCPInfo
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetFullPathNameA
GetKeyboardType
GetLastError
GetLocaleInfoA
GetLocalTime
GetLongPathNameA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetStringTypeExA
GetSystemMetrics
GetThreadLocale
GetTickCount
GetVersion
GetVersionExA
.idata
IInterface
ijklmnopqrstuvw
INFNAN
IniFiles
InitializeCriticalSection
Integer
InterlockedDecrement
InterlockedIncrement
IStringsAdapter
kernel32.dll
KERNEL32.DLL
keybd_event
key_nook
KWindows
~KxI[)
LeaveCriticalSection
LoadLibraryExA
LoadStringA
LocalAlloc
LocalFree
LongWord
lstrcpynA
lstrlenA
m/d/yy
MessageBoxA
mmmm d, yyyy
:mm:ss
MultiByteToWideChar
oleaut32.dll
OleStr
Pizda!
P.reloc
P.rsrc
QQQQQQSVW3
QQQQQSVW
QQQQSV
QTypInfo
Q<"u8S
QueryPerformanceCounter
RaiseException
.rdata
ReadFile
RegCloseKey
RegCreateKeyExA
RegFlushKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ResetEvent
"RTLConsts
RtlUnwind
Runtime error     at 00000000
sActiveX
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SdZ]_^[
SetEndOfFile
SetEvent
SetFilePointer
ShortInt
Single
Smallint
Software\Borland\Delphi\Locales
SOFTWARE\Borland\Delphi\RTL
Software\Borland\Locales
Software\Microsoft\Windows\CurrentVersion\Run
String
Strings
StringX
S$_^[Y]
SysAllocStringLen
SysConst
SysFreeString
SysInit
SysReAllocStringLen
System
SysUtils
<*t"<0r=<9w9i
TCustomVariantType
	TErrorRec
TExceptRec
TFileStream
t@h$'A
THandleStream
t~h HA
This program must be run under Win32
t%HtIHtm
TInterfacedObject
TlsGetValue
TlsSetValue
$TMultiReadExclusiveWriteSynchronizer
TObjectd
TObjectX
TPersistent
	TRegGroup
TRegGroups
	TRegistryS
TStream
TStringItem
TStringList
TStrings
TThreadList
TThreadLocalCounter
UnhandledExceptionFilter
Unknown
user32.dll
UTypes
VarAdd
VarAnd
VarBoolFromStr
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarCmp
VarCyFromStr
VarDateFromStr
VarDiv
VarI4FromStr
Variant
VariantChangeType
VariantChangeTypeEx
VariantClear
VariantCopy
VariantInit
Variants
VarIdiv
VarMod
VarMul
VarNeg
VarNot
VarR4FromStr
VarR8FromStr
VarSub
$VarUtils
VarXor
VirtualAlloc
VirtualFree
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
xyz{|}~
_^[YY]
YZ]_^[
(Z]_^[
$Z]_^[
Z[\]^_`aabcdefghJKLMNOPQRSTUVWXY:;<=>?@ABCDEFGHI
ZTUWVSPRTj