Analysis Date2014-06-15 02:46:48
MD588fe4349918228fe5054e27068a190bc
SHA1742db7d5f59434907aa75ca83e75f93a9ffe78b6

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386
Section.text md5: b61a05a9185cb08195850cb390064dde sha1: 3bbc0cd35f682edb8b5ca3bfb58293896a48206d size: 101376
Section.rdata md5: 8499826efba8ecf63a10d320be2ca641 sha1: 497f0a300466d7d867e415f347377746b171dd44 size: 2048
Section.data md5: 0f7da71147977863bd8ef1620b3bf0e6 sha1: ba924b4078b9c84f6d9bcca3faad793a19afb4cb size: 53760
Section.isete md5: ec3585334a6f9b453e6546cc4009049f sha1: 1fcfc0092291f911b4c0f9466a5dbbebde409f11 size: 1024
Timestamp2005-10-10 07:54:18
VersionProductVersion: 1.0.0.3
FileVersion: 1.0.0.3
PrivateBuild: 1587
PEhash386df0adfc7316ebffe72724fcf53472824d4489
IMPhash24c35c9abcfacaaa8f732c1c5cf40bbb
AV360 SafeGen:Trojan.Heur.KS.1
AVAd-AwareGen:Trojan.Heur.KS.1
AVAlwil (avast)Cybota [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Goolbot.G.gen!Eldorado
AVAvira (antivir)BDS/Gbot.aida
AVCA (E-Trust Ino)Win32/Diple.A!generic
AVCAT (quickheal)Backdoor.Cycbot.B
AVClamAVTrojan.Agent-210246
AVDr. WebBackDoor.Gbot.34
AVEmsisoftGen:Trojan.Heur.KS.1
AVEset (nod32)Win32/Kryptik.LXB
AVFortinetW32/FraudLoad.MK!tr
AVFrisk (f-prot)W32/Goolbot.G.gen!Eldorado (generic, not disinfectable)
AVF-SecureGen:Trojan.Heur.KS.1
AVGrisoft (avg)Cryptic.DSK
AVIkarusBackdoor.Win32.Gbot
AVKasperskyBackdoor.Win32.Gbot.ahq
AVMalwareBytesTrojan.Agent
AVMcafeeBackDoor-EXI.gen.i
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Trojan.Heur.KS.1
AVNormanwinpe/Gbot.AC
AVRisingno_virus
AVSophosMal/FakeAV-IS
AVSymantecBackdoor.Trojan
AVTrend MicroBKDR_CYCBOT.SMX
AVVirusBlokAda (vba32)Backdoor.Gbot

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
1
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\conhost ➝
C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Application Data\75DE.FFC
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
Creates Mutex{A5B35993-9674-43cd-8AC7-5BC5013E617B}
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutex{61B98B86-5F44-42b3-BCA1-33904B067B81}
Creates Mutex{7791C364-DE4E-4000-9E92-9CCAFDDD90DC}
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSbigmusicarchive.com
Winsock DNS127.0.0.1
Winsock DNShealthylifenow.com
Winsock DNSmoremobileringtons.com

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data

Creates ProcessC:\Documents and Settings\Administrator\Application Data\dwm.exe

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp

Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe

Network Details:

DNShealthylifenow.com
Type: A
208.109.208.147
DNSzonetf.com
Type: A
208.73.211.177
DNSzonetf.com
Type: A
208.73.211.164
DNSzonetf.com
Type: A
208.73.211.249
DNSzonetf.com
Type: A
208.73.211.236
DNSzonetf.com
Type: A
208.73.211.182
DNSzonetf.com
Type: A
208.73.211.182
DNSzonetf.com
Type: A
208.73.211.177
DNSzonetf.com
Type: A
208.73.211.164
DNSzonetf.com
Type: A
208.73.211.249
DNSzonetf.com
Type: A
208.73.211.236
DNSmoremobileringtons.com
Type: A
DNSbigmusicarchive.com
Type: A
HTTP GEThttp://healthylifenow.com/templates/7348/images/header_logo.jpg?v19=61&tq=gKZEtzypwlX%2F%2FHInZC41SxlByDRXkRDwOuOhCAVTVPPzNcIrB0oQ7F4dhvigVe5zZY5u3SPbgIcqTM2mAfvot%2BaLa%2BMfgbgifO%2BsYdcpY3EMXAYCfqUlxFUzkYW%2BPwAkp4lCvKElGFRBig5mm9gvNCt9IkIkoEij%2F%2F2aCAP3yZLy8Te6dCavJctROLr41ANGpL6bboGHkc5FsBRmLeKLv7cX%2B0Gk8LK1uD5sAqw%2Bk2jj8TZS684sFJD4fHhPGOgYXP535tWC5OR1yx%2FmwCt7Vrpa7uEhaxXYsYEjQZ%2B8tMMhXCJK2YwelMWmYP4CCb3b1GhYLYyVGabRzvBmUn
User-Agent: mozilla/2.0
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNvX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh8sG%2BcoJtX%2BSNwFKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNvX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88BSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNvX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88y%2BcoJuX%2BSNxFKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNvX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh%2FMe%2BcoJuX%2BSNxlKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNvX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88BSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNvX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh8sG%2BcoJuX%2BSNwlKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonetf.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfNvX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh%2F82%2BcoJsX%2BSNxb5ygm1C4lKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Flows TCP192.168.1.1:1031 ➝ 208.109.208.147:80
Flows TCP192.168.1.1:1033 ➝ 208.73.211.177:80
Flows TCP192.168.1.1:1034 ➝ 208.73.211.182:80
Flows TCP192.168.1.1:1035 ➝ 208.73.211.182:80
Flows TCP192.168.1.1:1036 ➝ 208.73.211.182:80
Flows TCP192.168.1.1:1037 ➝ 208.73.211.182:80
Flows TCP192.168.1.1:1038 ➝ 208.73.211.182:80
Flows TCP192.168.1.1:1039 ➝ 208.73.211.182:80

Raw Pcap
0x00000000 (00000)   47455420 2f74656d 706c6174 65732f37   GET /templates/7
0x00000010 (00016)   3334382f 696d6167 65732f68 65616465   348/images/heade
0x00000020 (00032)   725f6c6f 676f2e6a 70673f76 31393d36   r_logo.jpg?v19=6
0x00000030 (00048)   31267471 3d674b5a 45747a79 70776c58   1&tq=gKZEtzypwlX
0x00000040 (00064)   25324625 32464849 6e5a4334 3153786c   %2F%2FHInZC41Sxl
0x00000050 (00080)   42794452 586b5244 774f754f 68434156   ByDRXkRDwOuOhCAV
0x00000060 (00096)   54565050 7a4e6349 7242306f 51374634   TVPPzNcIrB0oQ7F4
0x00000070 (00112)   64687669 67566535 7a5a5935 75335350   dhvigVe5zZY5u3SP
0x00000080 (00128)   62674963 71544d32 6d416676 6f742532   bgIcqTM2mAfvot%2
0x00000090 (00144)   42614c61 2532424d 66676267 69664f25   BaLa%2BMfgbgifO%
0x000000a0 (00160)   32427359 64637059 33454d58 41594366   2BsYdcpY3EMXAYCf
0x000000b0 (00176)   71556c78 46557a6b 59572532 42507741   qUlxFUzkYW%2BPwA
0x000000c0 (00192)   6b70346c 43764b45 6c474652 42696735   kp4lCvKElGFRBig5
0x000000d0 (00208)   6d6d3967 764e4374 39496b49 6b6f4569   mm9gvNCt9IkIkoEi
0x000000e0 (00224)   6a253246 25324632 61434150 33795a4c   j%2F%2F2aCAP3yZL
0x000000f0 (00240)   79385465 36644361 764a6374 524f4c72   y8Te6dCavJctROLr
0x00000100 (00256)   3431414e 47704c36 62626f47 486b6335   41ANGpL6bboGHkc5
0x00000110 (00272)   46734252 6d4c654b 4c763763 58253242   FsBRmLeKLv7cX%2B
0x00000120 (00288)   30476b38 4c4b3175 44357341 71772532   0Gk8LK1uD5sAqw%2
0x00000130 (00304)   426b326a 6a38545a 53363834 73464a44   Bk2jj8TZS684sFJD
0x00000140 (00320)   34664868 50474f67 59585035 33357457   4fHhPGOgYXP535tW
0x00000150 (00336)   43354f52 31797825 32466d77 43743756   C5OR1yx%2FmwCt7V
0x00000160 (00352)   72706137 75456861 78585973 59456a51   rpa7uEhaxXYsYEjQ
0x00000170 (00368)   5a253242 38744d4d 6858434a 4b325977   Z%2B8tMMhXCJK2Yw
0x00000180 (00384)   656c4d57 6d595034 43436233 62314768   elMWmYP4CCb3b1Gh
0x00000190 (00400)   594c5979 56476162 527a7642 6d556e20   YLYyVGabRzvBmUn 
0x000001a0 (00416)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000001b0 (00432)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000001c0 (00448)   743a2068 65616c74 68796c69 66656e6f   t: healthylifeno
0x000001d0 (00464)   772e636f 6d0d0a41 63636570 743a202a   w.com..Accept: *
0x000001e0 (00480)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000001f0 (00496)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e765825 32425039 68253242 49307344   NvX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683873 47253242 636f4a74   OhLgjh8sG%2BcoJt
0x000000c0 (00192)   58253242 534e7746 4b763937 35586c6d   X%2BSNwFKv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6574 662e636f 6d0d0a55   t: zonetf.com..U
0x000000f0 (00240)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000100 (00256)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000110 (00272)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000120 (00288)   6e646f77 73204e54 20352e31 290d0a43   ndows NT 5.1)..C
0x00000130 (00304)   6f6e7465 6e742d4c 656e6774 683a2030   ontent-Length: 0
0x00000140 (00320)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000150 (00336)   6f73650d 0a0d0a25 32466d77 43743756   ose....%2FmwCt7V
0x00000160 (00352)   72706137 75456861 78585973 59456a51   rpa7uEhaxXYsYEjQ
0x00000170 (00368)   5a253242 38744d4d 6858434a 4b325977   Z%2B8tMMhXCJK2Yw
0x00000180 (00384)   656c4d57 6d595034 43436233 62314768   elMWmYP4CCb3b1Gh
0x00000190 (00400)   594c5979 56476162 527a7642 6d556e20   YLYyVGabRzvBmUn 
0x000001a0 (00416)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000001b0 (00432)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000001c0 (00448)   743a2068 65616c74 68796c69 66656e6f   t: healthylifeno
0x000001d0 (00464)   772e636f 6d0d0a41 63636570 743a202a   w.com..Accept: *
0x000001e0 (00480)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000001f0 (00496)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e765825 32425039 68253242 49307344   NvX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 42537225 32466525   OhLgjh88BSr%2Fe%
0x000000c0 (00192)   32425635 5a755267 25334425 33442048   2BV5ZuRg%3D%3D H
0x000000d0 (00208)   5454502f 312e310d 0a486f73 743a207a   TTP/1.1..Host: z
0x000000e0 (00224)   6f6e6574 662e636f 6d0d0a55 7365722d   onetf.com..User-
0x000000f0 (00240)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000100 (00256)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x00000110 (00272)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x00000120 (00288)   73204e54 20352e31 290d0a43 6f6e7465   s NT 5.1)..Conte
0x00000130 (00304)   6e742d4c 656e6774 683a2030 0d0a436f   nt-Length: 0..Co
0x00000140 (00320)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000150 (00336)   0a0d0a0d 0a0d0a25 32466d77 43743756   .......%2FmwCt7V
0x00000160 (00352)   72706137 75456861 78585973 59456a51   rpa7uEhaxXYsYEjQ
0x00000170 (00368)   5a253242 38744d4d 6858434a 4b325977   Z%2B8tMMhXCJK2Yw
0x00000180 (00384)   656c4d57 6d595034 43436233 62314768   elMWmYP4CCb3b1Gh
0x00000190 (00400)   594c5979 56476162 527a7642 6d556e20   YLYyVGabRzvBmUn 
0x000001a0 (00416)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000001b0 (00432)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000001c0 (00448)   743a2068 65616c74 68796c69 66656e6f   t: healthylifeno
0x000001d0 (00464)   772e636f 6d0d0a41 63636570 743a202a   w.com..Accept: *
0x000001e0 (00480)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000001f0 (00496)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e765825 32425039 68253242 49307344   NvX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 79253242 636f4a75   OhLgjh88y%2BcoJu
0x000000c0 (00192)   58253242 534e7846 4b763937 35586c6d   X%2BSNxFKv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6574 662e636f 6d0d0a55   t: zonetf.com..U
0x000000f0 (00240)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000100 (00256)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000110 (00272)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000120 (00288)   6e646f77 73204e54 20352e31 290d0a43   ndows NT 5.1)..C
0x00000130 (00304)   6f6e7465 6e742d4c 656e6774 683a2030   ontent-Length: 0
0x00000140 (00320)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000150 (00336)   6f73650d 0a0d0a25 32466d77 43743756   ose....%2FmwCt7V
0x00000160 (00352)   72706137 75456861 78585973 59456a51   rpa7uEhaxXYsYEjQ
0x00000170 (00368)   5a253242 38744d4d 6858434a 4b325977   Z%2B8tMMhXCJK2Yw
0x00000180 (00384)   656c4d57 6d595034 43436233 62314768   elMWmYP4CCb3b1Gh
0x00000190 (00400)   594c5979 56476162 527a7642 6d556e20   YLYyVGabRzvBmUn 
0x000001a0 (00416)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000001b0 (00432)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000001c0 (00448)   743a2068 65616c74 68796c69 66656e6f   t: healthylifeno
0x000001d0 (00464)   772e636f 6d0d0a41 63636570 743a202a   w.com..Accept: *
0x000001e0 (00480)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000001f0 (00496)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e765825 32425039 68253242 49307344   NvX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a682532 464d6525 3242636f   OhLgjh%2FMe%2Bco
0x000000c0 (00192)   4a755825 3242534e 786c4b76 39373558   JuX%2BSNxlKv975X
0x000000d0 (00208)   6c6d3547 20485454 502f312e 310d0a48   lm5G HTTP/1.1..H
0x000000e0 (00224)   6f73743a 207a6f6e 6574662e 636f6d0d   ost: zonetf.com.
0x000000f0 (00240)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000100 (00256)   696c6c61 2f342e30 2028636f 6d706174   illa/4.0 (compat
0x00000110 (00272)   69626c65 3b204d53 49452036 2e303b20   ible; MSIE 6.0; 
0x00000120 (00288)   57696e64 6f777320 4e542035 2e31290d   Windows NT 5.1).
0x00000130 (00304)   0a436f6e 74656e74 2d4c656e 6774683a   .Content-Length:
0x00000140 (00320)   20300d0a 436f6e6e 65637469 6f6e3a20    0..Connection: 
0x00000150 (00336)   636c6f73 650d0a0d 0a                  close....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e765825 32425039 68253242 49307344   NvX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 42537225 32466525   OhLgjh88BSr%2Fe%
0x000000c0 (00192)   32425635 5a755267 25334425 33442048   2BV5ZuRg%3D%3D H
0x000000d0 (00208)   5454502f 312e310d 0a486f73 743a207a   TTP/1.1..Host: z
0x000000e0 (00224)   6f6e6574 662e636f 6d0d0a55 7365722d   onetf.com..User-
0x000000f0 (00240)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000100 (00256)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x00000110 (00272)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x00000120 (00288)   73204e54 20352e31 290d0a43 6f6e7465   s NT 5.1)..Conte
0x00000130 (00304)   6e742d4c 656e6774 683a2030 0d0a436f   nt-Length: 0..Co
0x00000140 (00320)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000150 (00336)   0a0d0a0d 0a0d0a25 32466d77 43743756   .......%2FmwCt7V
0x00000160 (00352)   72706137 75456861 78585973 59456a51   rpa7uEhaxXYsYEjQ
0x00000170 (00368)   5a253242 38744d4d 6858434a 4b325977   Z%2B8tMMhXCJK2Yw
0x00000180 (00384)   656c4d57 6d595034 43436233 62314768   elMWmYP4CCb3b1Gh
0x00000190 (00400)   594c5979 56476162 527a7642 6d556e20   YLYyVGabRzvBmUn 
0x000001a0 (00416)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000001b0 (00432)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000001c0 (00448)   743a2068 65616c74 68796c69 66656e6f   t: healthylifeno
0x000001d0 (00464)   772e636f 6d0d0a41 63636570 743a202a   w.com..Accept: *
0x000001e0 (00480)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000001f0 (00496)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e765825 32425039 68253242 49307344   NvX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683873 47253242 636f4a75   OhLgjh8sG%2BcoJu
0x000000c0 (00192)   58253242 534e776c 4b763937 35586c6d   X%2BSNwlKv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6574 662e636f 6d0d0a55   t: zonetf.com..U
0x000000f0 (00240)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000100 (00256)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000110 (00272)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000120 (00288)   6e646f77 73204e54 20352e31 290d0a43   ndows NT 5.1)..C
0x00000130 (00304)   6f6e7465 6e742d4c 656e6774 683a2030   ontent-Length: 0
0x00000140 (00320)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000150 (00336)   6f73650d 0a0d0a3c 6872202f 3e0a2020   ose....<hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   4e765825 32425039 68253242 49307344   NvX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a682532 46383225 3242636f   OhLgjh%2F82%2Bco
0x000000c0 (00192)   4a735825 3242534e 78623579 676d3143   JsX%2BSNxb5ygm1C
0x000000d0 (00208)   346c4b76 39373558 6c6d3547 20485454   4lKv975Xlm5G HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6574662e 636f6d0d 0a557365 722d4167   etf.com..User-Ag
0x00000100 (00256)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x00000110 (00272)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x00000120 (00288)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x00000130 (00304)   4e542035 2e31290d 0a436f6e 74656e74   NT 5.1)..Content
0x00000140 (00320)   2d4c656e 6774683a 20300d0a 436f6e6e   -Length: 0..Conn
0x00000150 (00336)   65637469 6f6e3a20 636c6f73 650d0a0d   ection: close...
0x00000160 (00352)   0a706137 75456861 78585973 59456a51   .pa7uEhaxXYsYEjQ
0x00000170 (00368)   5a253242 38744d4d 6858434a 4b325977   Z%2B8tMMhXCJK2Yw
0x00000180 (00384)   656c4d57 6d595034 43436233 62314768   elMWmYP4CCb3b1Gh
0x00000190 (00400)   594c5979 56476162 527a7642 6d556e20   YLYyVGabRzvBmUn 
0x000001a0 (00416)   48545450 2f312e30 0d0a436f 6e6e6563   HTTP/1.0..Connec
0x000001b0 (00432)   74696f6e 3a20636c 6f73650d 0a486f73   tion: close..Hos
0x000001c0 (00448)   743a2068 65616c74 68796c69 66656e6f   t: healthylifeno
0x000001d0 (00464)   772e636f 6d0d0a41 63636570 743a202a   w.com..Accept: *
0x000001e0 (00480)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x000001f0 (00496)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....


Strings
.
|N
-../.j..j...w...D.m....
.G.-6....
040904b0
1.0.0.3
1587
a 2 
#'bF
d`Df
FileVersion
!FP$
g3'E
jjjjjj
PrivateBuild
ProductVersion
QgGF
StringFileInfo
TIMES NEW ROMAN
Translation
VarFileInfo
VS_VERSION_INFO
1sj=n[
2EhY%*
`32h;d
`}?3HG
3}]+z=
!?	4C&,nB
4N!bFM*
4~-Rh\
4TM{Y~
/4{X~i[
5,;{KM2
5rb*z0h
~^6q0bq
6|T=nn
-6w%h%H5)
}7hr'k
	7\+/NH
?7o2,Z
\7yl80
8g-V\_
%8WMKfY
:9ExWT
9'h)cS
AddFontResourceExW
ADVAPI32.dll
az/+ho
biU`h_
#]#BJ=
C1'h,*
CharNextW
CharUpperW
.cl5b,
CoCreateInstance
CoInitialize
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CreateFileMappingW
CreateFontIndirectW
CreateStdAccessibleObject
cr&FrH
CV>bX`\
cYNS2L
`d,58d
@.data
DB+s;$
DeleteObject
DispatchMessageW
{Dq(n%+|$
E8kKyk4
em-A*E
EnumResourceNamesW
E)R<w,
f HAyHB%0
FillConsoleOutputAttribute
FindClose
f)m{$]_
FreeEnvironmentStringsW
)fZ~_w
GDI32.dll
GetACP
GetCPInfo
GetLastError
GetMessageW
GetModuleHandleW
GetOutlineTextMetricsW
GetProcessMemoryInfo
GetProcessWorkingSetSize
GetTextMetricsW
GetTickCount
GetWindowLongA
G<'G7,
GlobalAlloc
GlobalFree
gn~;@_
G,%N.Y
GO&vRb
!!,G(z
\H"oN7
!}.Huc
InitializeCriticalSection
.isete
iyWJ?)0
`^JBA? 
JiAULq
jwp.eU
k"(Dn5
KERNEL32.dll
KillTimer
k!n&8(
KNRvVo
kO639(
kVaz(e
`)'L%2#
LiZXxG
Lk,8R-
LockResource
LPFK03EI
LresultFromObject
lstrcmpiW
lstrcpyA
lstrcpyW
lstrlenW
lV_i|q
m6VBK?6
MultiByteToWideChar
+n0 I|}I
~;n3}E
N48+ww
Nb'r)?
n^CM_T
Nx)`q	
 O2=z9
!{#odDoU
oJ>7[yd
ole32.dll
OLEACC.dll
oN)&1d
OutputDebugStringW
o	Uv^.
oW_3<~
Pf/f{A
PostThreadMessageW
PSAPI.DLL
qif? v
q]zc9|gKrYDEq,
~R@Bm6W
`.rdata
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
	*R<Xsn2
SelectObject
SetTimer
SHELL32.dll
SHGetFileInfoW
StringFromCLSID
StringFromGUID2
T[H8hY
!This program cannot be run in DOS mode.
TranslateMessage
Ui60"?
uja6&r
um74K~
UmX;	}
UnregisterClassA
USER32.dll
vJoW8~H5
v`N0L)V
v~OXw0
}v/t<@
_WBC-B
WideCharToMultiByte
w% >KA
W	Mho*
wPC7wM
wsprintfW
|X+8,5
XuIDZtY
/YH	TX
y/}ou+
yQ>2e#
yQb"	[
\ytYsr
@/,	Y-U
]!yub[^TIR
](ZhSG.'
ZRsuZ?