From - Sat May 21 19:27:12 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs143677yhg; Tue, 7 Dec 2010 07:38:02 -0800 (PST) Received: by 10.90.102.20 with SMTP id z20mr975408agb.108.1291736282075; Tue, 07 Dec 2010 07:38:02 -0800 (PST) Return-Path: Received: from wayside.site5.com (wayside.site5.com [174.120.20.226]) by mx.google.com with ESMTP id n67si14532211yha.192.2010.12.07.07.38.01; Tue, 07 Dec 2010 07:38:01 -0800 (PST) Received-SPF: neutral (google.com: 174.120.20.226 is neither permitted nor denied by best guess record for domain of chris@defintel.com) client-ip=174.120.20.226; Authentication-Results: mx.google.com; spf=neutral (google.com: 174.120.20.226 is neither permitted nor denied by best guess record for domain of chris@defintel.com) smtp.mail=chris@defintel.com Received: from montreal02-3459238334.sdsl.bell.ca ([206.47.201.190] helo=[127.0.0.1]) by wayside.site5.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.69) (envelope-from ) id 1PPzc9-0002lJ-1N for khijazi@unveillance.com; Tue, 07 Dec 2010 09:38:01 -0600 From: Chris Davis Mime-Version: 1.0 (Apple Message framework v1075.2) Content-Type: multipart/alternative; boundary=Apple-Mail-4--103585623 Subject: Re: Zeus C&C Domain Date: Tue, 7 Dec 2010 10:37:06 -0500 In-Reply-To: <4CFE4F1D.3060207@unveillance.com> To: khijazi@unveillance.com References: <4CFE4F1D.3060207@unveillance.com> Message-Id: <11153CA4-6D2A-4618-90F6-FBDD00F29B1E@defintel.com> X-Mailer: Apple Mail (2.1075.2) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - wayside.site5.com X-AntiAbuse: Original Domain - unveillance.com X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - defintel.com X-Source: X-Source-Args: X-Source-Dir: --Apple-Mail-4--103585623 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii; format=flowed; delsp=yes Well this looks like earthlink to me. I think maybe the earthlink guy doesn't know what he is talking about. ;; ANSWER SECTION: clickxsearche.com. 600 IN A 207.217.125.50 This is from ARIN: NetRange: 207.217.0.0 - 207.217.255.255 CIDR: 207.217.0.0/16 OriginAS: AS4355 NetName: EARTHLINK-CIDR NetHandle: NET-207-217-0-0-1 Parent: NET-207-0-0-0-0 NetType: Direct Allocation NameServer: ITCHY.EARTHLINK.NET NameServer: SCRATCHY.EARTHLINK.NET Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE RegDate: 1996-10-04 Updated: 2007-06-22 Ref: http://whois.arin.net/rest/net/NET-207-217-0-0-1 OrgName: EARTHLINK, Inc. OrgId: EARTH-21 Address: 1375 PEACHTREE STREET Address: LEVEL A City: ATLANTA StateProv: GA PostalCode: 30309 Country: US RegDate: 2007-06-18 Updated: 2007-06-18 Ref: http://whois.arin.net/rest/org/EARTH-21 This is the RDNS entery: ; <<>> DiG 9.6.0-APPLE-P2 <<>> -x 207.217.125.50 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16770 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;50.125.217.207.in-addr.arpa. IN PTR ;; ANSWER SECTION: 50.125.217.207.in-addr.arpa. 43200 IN PTR webhost.earthlink.net. ;; Query time: 950 msec ;; SERVER: 4.2.2.3#53(4.2.2.3) ;; WHEN: Tue Dec 7 10:18:04 2010 ;; MSG SIZE rcvd: 80 On 2010-12-07, at 10:13 AM, Karim Hijazi Unveillance Email wrote: > clickxsearche.com --Apple-Mail-4--103585623 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Well = this looks like earthlink to me. I think maybe the earthlink guy doesn't = know what he is talking about.

;; ANSWER = SECTION:

clickxsearche.com. 600 IN A = 207.217.125.50

This is = from ARIN:

NetRange: = 207.217.0.0 - 207.217.255.255

CIDR: = 207.217.0.0/16

OriginAS: = AS4355

NetName: = EARTHLINK-CIDR

NetHandle: = NET-207-217-0-0-1

Parent: = NET-207-0-0-0-0

NetType: Direct = Allocation

NameServer: ITCHY.EARTHLINK.NET

Name= Server: SCRATCHY.EARTHLINK.NET

Comment: ADDRESSES WITHIN THIS BLOCK ARE = NON-PORTABLE

RegDate: = 1996-10-04

Updated: = 2007-06-22

Ref: = http://whois.ari= n.net/rest/net/NET-207-217-0-0-1

OrgName: = EARTHLINK, Inc.

OrgId: = EARTH-21

Address: = 1375 PEACHTREE STREET

Address: = LEVEL A

City: = ATLANTA

StateProv: = GA

PostalCode: 30309

Country: = US

RegDate: = 2007-06-18

Updated: = 2007-06-18

Ref: = http://whois.arin.net/res= t/org/EARTH-21

This is the = RDNS entery:

; <<>> DiG 9.6.0-APPLE-P2 = <<>> -x 207.217.125.50

;; global options: = +cmd

;; Got answer:

;; ->>HEADER<<- = opcode: QUERY, status: NOERROR, id: 16770

;; flags: qr rd ra; = QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: = 0

;; QUESTION = SECTION:

;50.125.217.207.in-addr.arpa. IN = PTR

;; ANSWER = SECTION:

50.125.217.207.in-addr.arpa. 43200 IN PTR webhost.earthlink.net.

;; Query time: 950 msec

;; SERVER: = 4.2.2.3#53(4.2.2.3)

;; WHEN: Tue Dec 7 10:18:04 = 2010

;; MSG SIZE rcvd: = 80

On 2010-12-07, at 10:13 AM, Karim Hijazi Unveillance Email = wrote:

clickxsearche.com

= --Apple-Mail-4--103585623-- From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs139003yhg; Tue, 7 Dec 2010 05:29:27 -0800 (PST) Received: by 10.231.167.202 with SMTP id r10mr7600231iby.91.1291728566512; Tue, 07 Dec 2010 05:29:26 -0800 (PST) Return-Path: Received: from server505.appriver.com (server505b.appriver.com [98.129.35.5]) by mx.google.com with ESMTP id hj41si17399795ibb.79.2010.12.07.05.29.26; Tue, 07 Dec 2010 05:29:26 -0800 (PST) Received-SPF: neutral (google.com: 98.129.35.5 is neither permitted nor denied by best guess record for domain of patrick@decalaw.com) client-ip=98.129.35.5; Authentication-Results: mx.google.com; spf=neutral (google.com: 98.129.35.5 is neither permitted nor denied by best guess record for domain of patrick@decalaw.com) smtp.mail=patrick@decalaw.com X-Note-AR-ScanTimeLocal: 12/7/2010 7:29:31 AM X-Policy: GLOBAL - decalaw.com X-Primary: patrick@decalaw.com X-Note: This Email was scanned by AppRiver SecureTide X-ALLOW: @decalaw.com ALLOWED X-Virus-Scan: V- X-Note: Spam Tests Failed: X-Country-Path: UNITED STATES->UNITED STATES->UNITED STATES X-Note-Sending-IP: 98.129.23.33 X-Note-Reverse-DNS: smtp.exg5.exghost.com X-Note-WHTLIST: patrick@decalaw.com X-Note: User Rule Hits: X-Note: Global Rule Hits: G195 G196 G197 G198 G202 G203 G214 G302 X-Note: Encrypt Rule Hits: X-Note: Mail Class: ALLOWEDSENDER X-Note: Headers Injected Received: from [98.129.23.33] (HELO smtp.exg5.exghost.com) by server505.appriver.com (CommuniGate Pro SMTP 5.3.10) with ESMTPS id 85181545 for khijazi@unveillance.com; Tue, 07 Dec 2010 07:29:31 -0600 Received: from MBX08.exg5.exghost.com ([169.254.1.206]) by HT04.exg5.exghost.com ([10.242.228.60]) with mapi; Tue, 7 Dec 2010 07:29:25 -0600 From: Patrick Callahan To: 'Karim Hijazi' CC: Patrick Callahan Date: Tue, 7 Dec 2010 07:29:21 -0600 Subject: Appriver Spamlab Thread-Topic: Appriver Spamlab Thread-Index: AcuWEsGfkUalSYmAQHa+gDOBeb2a3g== Message-ID: <3316B2BFEAA41E43A0BE215B63D0EDEE097CD772@MBX08.exg5.exghost.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/alternative; boundary="_000_3316B2BFEAA41E43A0BE215B63D0EDEE097CD772MBX08exg5exghos_" MIME-Version: 1.0 --_000_3316B2BFEAA41E43A0BE215B63D0EDEE097CD772MBX08exg5exghos_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable FYI - John and Jerry's messages got caught in my spam filter last night aga= in. Not sure if it's just me or this is indicative of how our Unveillance email= s are received by others. M. Patrick Callahan deAndrade Callahan, LLC Two Ravinia Drive Suite 1705 Atlanta, Georgia 30346 Office: (678) 579-0987 E-mail: patrick@decalaw.com Confidentiality Notice: This email may contain information that is legally= privileged, confidential or otherwise protected from disclosure. If you a= re not the intended recipient of this message, then any reading, disseminat= ion, distribution, copying or other use of this email and/or its attachment= s, if any, is strictly prohibited. If you are not the intended recipient = of this message, please notify the sender immediately and permanently delet= e this email, any attachments and all copies. This email does not create a= n attorney-client relationship between the sender and the recipient. IRS Circular 230 Disclosure: In compliance with IRS requirements, please b= e aware that any tax advice contained in this email or its attachments, if = any, is not intended to be used, and cannot be used, for the purposes of ei= ther (i) avoiding penalties under the Internal Revenue Code, or (ii) promot= ing, marketing or recommending to another party any transaction or matter d= iscussed in this message. --_000_3316B2BFEAA41E43A0BE215B63D0EDEE097CD772MBX08exg5exghos_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

FYI – John= and Jerry’s messages got caught in my spam filter last night again.&= nbsp;

Not sure if it’s just me or this is indicative of how our Un= veillance emails are received by others.

M. Pa= trick Callahan

deAndrade Callahan, LLC

Two Ravinia Drive

Suite 1705
Atlanta, G= eorgia 30346

= Office: (678) 579-0987

E-mail: patrick@decalaw.com=

Confiden= tiality Notice: This email may contain information that is legally priv= ileged, confidential or otherwise protected from disclosure. If you a= re not the intended recipient of this message, then any reading, disseminat= ion, distribution, copying or other use of this email and/or its attachment= s, if any, is strictly prohibited. If you are not the intended = recipient of this message, please notify the sender immediately and permane= ntly delete this email, any attachments and all copies. This email do= es not create an attorney-client relationship between the sender and the re= cipient.

IRS Circular 230 Disclosure: In compliance with IRS requirements, pl= ease be aware that any tax advice contained in this email or its attachment= s, if any, is not intended to be used, and cannot be used, for the purposes= of either (i) avoiding penalties under the Internal Revenue Code, or (ii) = promoting, marketing or recommending to another party any transaction or ma= tter discussed in this message.

<= o:p>

= --_000_3316B2BFEAA41E43A0BE215B63D0EDEE097CD772MBX08exg5exghos_-- From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs140328yhg; Tue, 7 Dec 2010 06:09:27 -0800 (PST) Received: by 10.224.28.76 with SMTP id l12mr5818321qac.294.1291730967044; Tue, 07 Dec 2010 06:09:27 -0800 (PST) Return-Path: Received: from mail-vw0-f45.google.com (mail-vw0-f45.google.com [209.85.212.45]) by mx.google.com with ESMTP id k14si13475116qcu.16.2010.12.07.06.09.26; Tue, 07 Dec 2010 06:09:26 -0800 (PST) Received-SPF: neutral (google.com: 209.85.212.45 is neither permitted nor denied by best guess record for domain of jphillips@unveillance.com) client-ip=209.85.212.45; Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.212.45 is neither permitted nor denied by best guess record for domain of jphillips@unveillance.com) smtp.mail=jphillips@unveillance.com Received: by vws12 with SMTP id 12so5345597vws.4 for ; Tue, 07 Dec 2010 06:09:26 -0800 (PST) Received: by 10.220.176.72 with SMTP id bd8mr1905657vcb.59.1291730965148; Tue, 07 Dec 2010 06:09:25 -0800 (PST) Return-Path: Received: from bda2475.bisx.prod.on.blackberry (bda-67-223-77-219.bise.na.blackberry.com [67.223.77.219]) by mx.google.com with ESMTPS id e18sm2230468vbm.5.2010.12.07.06.09.21 (version=SSLv3 cipher=RC4-MD5); Tue, 07 Dec 2010 06:09:22 -0800 (PST) X-rim-org-msg-ref-id: 18265387 Message-ID: <18265387-1291730959-cardhu_decombobulator_blackberry.rim.net-1911436738-@bda480.bisx.prod.on.blackberry> Reply-To: jphillips@unveillance.com X-Priority: Normal Sensitivity: Normal Importance: Normal Subject: Fw: Zeus C&C Domain To: "Karim Hijazi Unveillance Email" From: "John Phillips" Date: Tue, 7 Dec 2010 14:09:22 +0000 Content-Type: multipart/related; type="multipart/alternative"; boundary="part21335-boundary-1750513842-1034109403" MIME-Version: 1.0 --part21335-boundary-1750513842-1034109403 Content-Type: multipart/alternative; boundary="part21336-boundary-1750513842-1034109403" --part21336-boundary-1750513842-1034109403 Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="Windows-1252" VGhvdWdodHM/ICBEb2VzIEplcnJ5IG5lZWQgdG8gdGFsayB0aGVtIHRocm91Z2ggdGhpcz8NCg0K DQpKb2huIFBoaWxsaXBzDQpWaWNlIFByZXNpZGVudCwgR2xvYmFsIFNhbGVzDQpVbnZlaWxsYW5j ZQ0KNTEyLjZVTi5WRUlMDQo1MTIuNjg2LjgzNDUNCg0KanBoaWxsaXBzQHVudmVpbGxhbmNlLmNv bQ0KaHR0cDovL3d3dy51bnZlaWxsYW5jZS5jb20NCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0t LS0NCkZyb206IFBldGVyIENocm9uaXMgPGNocm9uaXNwZUBjb3JwLmVhcnRobGluay5uZXQ+DQpE YXRlOiBUdWUsIDcgRGVjIDIwMTAgMDg6MjQ6MDEgDQpUbzogSm9obiBQaGlsbGlwczxqcGhpbGxp cHNAdW52ZWlsbGFuY2UuY29tPg0KQ2M6IGtoaWphemlAdW52ZWlsbGFuY2UuY29tPGtoaWphemlA dW52ZWlsbGFuY2UuY29tPg0KU3ViamVjdDogUkU6IFpldXMgQyZDIERvbWFpbg0KDQpKb2huLA0K DQpXZSAgYXJlIG5vdCBob3N0aW5nIGNsaWNreHNlYXJjaGUuY29tLiAgVGhlIGRvbWFpbiBvd25l ciBoYXMgcHVibGlzaGVkIGFuIFJETlMgZW50cnkgdGhhdCBwb2ludHMgdG8gb3VyIHdlYmhvc3Rp bmcgVklQLiAgU28sIGF0IHRoaXMgcG9pbnQsIHdlIGFyZSB1bmFibGUgdG8gdHJhY2sgZnVydGhl ci4gIFdlIGJlbGlldmUgdGhhdCB0aGUgUkROUyBtYXkgYmUgc2lnbmlmaWNhbnQgYmVjYXVzZSBp dCBtYXkgYmUgdXNlZCBpbiBjb25qdW5jdGlvbiB3aXRoIG90aGVyIGluZm9ybWF0aW9uIHRvIGdl dCB0byBjb250ZW50IGhvc3RlZCBzb21ld2hlcmUgb24gb3VyIGhvc3RpbmcgZmFybS4gIFJpZ2h0 IG5vdywgYXJlIHVuYWJsZSB0byBpc29sYXRlIHRoZSBFTE5LIGRvbWFpbiBob3N0aW5nIGFjY291 bnQgd2l0aG91dCBzb21lIElQcyBmcm9tIHlvdXIgaG9uZXlwb3RzLg0KDQpMZXQgbWUga25vdyBp ZiB5b3UgY2FuIHByb3ZpZGUuDQoNClRoYW5rcy4NCg0KUGV0ZQ0KDQoNCkZyb206IEpvaG4gUGhp bGxpcHMgW21haWx0bzpqcGhpbGxpcHNAdW52ZWlsbGFuY2UuY29tXQ0KU2VudDogTW9uZGF5LCBE ZWNlbWJlciAwNiwgMjAxMCA0OjQ3IFBNDQpUbzogUGV0ZXIgQ2hyb25pcw0KQ2M6IGtoaWphemlA dW52ZWlsbGFuY2UuY29tDQpTdWJqZWN0OiBaZXVzIEMmQyBEb21haW4NCg0KUGV0ZXIsDQoNCkFz IEthcmltIGRpc2N1c3NlZCwgd2UgbGlmdGVkIHVwIHRoZSBaZXVzIGRvbWFpbiBpbiBvcmRlciB0 byBleHBlZGl0ZSB5b3VyIGlkZW50aWZpY2F0aW9uIG9mIHRoZSBpbmZlY3RlZCBzeXN0ZW0uICBQ bGVhc2UgbGV0IG1lIGtub3cgd2hlbiBJIGNhbiBnaXZlIHlvdSBhIGNhbGwgdG8gZGlzY3VzcyBp ZiB0aGlzIG1lZXRzIHlvdXIgaW1tZWRpYXRlIG5lZWRzLg0KDQpUaGFuayB5b3UsDQpKb2huDQoN CkpvaG4gUGhpbGxpcHMNClZpY2UgUHJlc2lkZW50LCBHbG9iYWwgU2FsZXMNClVudmVpbGxhbmNl DQo1MTIuNlVOLlZFSUwNCjUxMi42ODYuODM0NQ0KanBoaWxsaXBzQHVudmVpbGxhbmNlLmNvbTxt YWlsdG86anBoaWxsaXBzQHlvcmVsLmNvbT4NCg0KW2NpZDppbWFnZTAwMS5wbmdAMDFDQjk1RTgu MEI2OTkwNTBdPGh0dHA6Ly91bnZlaWxsYW5jZS5jb20vPg0KVW52ZWlsbGFuY2UgfCBEYXRhIExl YWthZ2UgSW50ZWxsaWdlbmNlICYgTWV0cmljczxodHRwOi8vdW52ZWlsbGFuY2UuY29tLz4NCg0K KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioNCkNPTkZJREVOVElB TCAmIFBSSVZJTEVHRUQgQ09NTVVOSUNBVElPTiBUaGlzIG1lc3NhZ2UgaXMgZm9yIHRoZSBuYW1l ZCBwZXJzb24ncyB1c2Ugb25seS4gVGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBpbiB0aGlzIGNv bW11bmljYXRpb24gaXMgY29uZmlkZW50aWFsIGFuZC9vciBwcml2aWxlZ2VkLCBwcm9wcmlldGFy eSBpbmZvcm1hdGlvbiB0aGF0IGlzIHRyYW5zbWl0dGVkIHNvbGVseSBmb3IgdGhlIHB1cnBvc2Ug b2YgdGhlIGludGVuZGVkIHJlY2lwaWVudChzKS4gTm8gY29uZmlkZW50aWFsaXR5IG9yIHByaXZp bGVnZSBpcyB3YWl2ZWQgb3IgbG9zdCBieSBhbnkgbWlzdHJhbnNtaXNzaW9uLg0KSWYgeW91IHJl Y2VpdmUgdGhpcyBtZXNzYWdlIGluIGVycm9yLCBwbGVhc2UgaW1tZWRpYXRlbHkgZGVsZXRlIGl0 IGFuZCBhbGwgY29waWVzIG9mIGl0IGZyb20geW91ciBzeXN0ZW0sIGRlc3Ryb3kgYW55IGhhcmQg Y29waWVzIG9mIGl0IGFuZCBub3RpZnkgdGhlIHNlbmRlci4gWW91IG11c3Qgbm90LCBkaXJlY3Rs eSBvciBpbmRpcmVjdGx5LCB1c2UsIGRpc2Nsb3NlLCBkaXN0cmlidXRlLCBwcmludCwgb3IgY29w eSBhbnkgcGFydCBvZiB0aGlzIG1lc3NhZ2UgaWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJl Y2lwaWVudC4gVGhlIHNlbmRlciBvciBhbnkgb2YgaXRzIHN1YnNpZGlhcmllcyBlYWNoIHJlc2Vy dmUgdGhlIHJpZ2h0IHRvIG1vbml0b3IgYWxsIGUtbWFpbCBjb21tdW5pY2F0aW9ucyB0aHJvdWdo IGl0cyBuZXR3b3Jrcy4NCioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqDQoNCg0K --part21336-boundary-1750513842-1034109403 Content-Transfer-Encoding: base64 Content-Type: text/html; charset="Windows-1252" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVR5cGUgY29udGVu dD0idGV4dC9odG1sOyBjaGFyc2V0PXVzLWFzY2lpIj48bWV0YSBuYW1lPUdlbmVyYXRvciBjb250 ZW50PSJNaWNyb3NvZnQgV29yZCAxMiAoZmlsdGVyZWQgbWVkaXVtKSI+PCEtLVtpZiAhbXNvXT48 c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7YmVoYXZpb3I6 dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0K LnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwhW2VuZGlmXS0t PjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNlDQoJe2ZvbnQt ZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0K QGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYW1icmlhOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0 IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0x OjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6VGFob21h Ow0KCXBhbm9zZS0xOjIgMTEgNiA0IDMgNSA0IDQgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5 bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3Jt YWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEx LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYiO30NCmE6bGluaywgc3Bh bi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJ dGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5r Rm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0 LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvQWNldGF0ZSwgbGkuTXNvQWNldGF0ZSwgZGl2 Lk1zb0FjZXRhdGUNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJC YWxsb29uIFRleHQgQ2hhciI7DQoJbWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7 DQoJZm9udC1zaXplOjguMHB0Ow0KCWZvbnQtZmFtaWx5OiJUYWhvbWEiLCJzYW5zLXNlcmlmIjt9 DQpzcGFuLkJhbGxvb25UZXh0Q2hhcg0KCXttc28tc3R5bGUtbmFtZToiQmFsbG9vbiBUZXh0IENo YXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiQmFsbG9vbiBU ZXh0IjsNCglmb250LWZhbWlseToiVGFob21hIiwic2Fucy1zZXJpZiI7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LCJzYW5zLXNlcmlmIjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIwDQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwi c2Fucy1zZXJpZiI7DQoJY29sb3I6IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5 bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxl PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIg c3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQi IGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+PC9oZWFkPjxi b2R5IGxhbmc9RU4tVVMgbGluaz1ibHVlIHZsaW5rPXB1cnBsZT5UaG91Z2h0cz8gIERvZXMgSmVy cnkgbmVlZCB0byB0YWxrIHRoZW0gdGhyb3VnaCB0aGlzPzxici8+PGJyLz48cD5Kb2huIFBoaWxs aXBzPGJyLz5WaWNlIFByZXNpZGVudCwgR2xvYmFsIFNhbGVzPGJyLz5VbnZlaWxsYW5jZTxici8+ NTEyLjZVTi5WRUlMPGJyLz41MTIuNjg2LjgzNDU8YnIvPjxici8+anBoaWxsaXBzQHVudmVpbGxh bmNlLmNvbTxici8+aHR0cDovL3d3dy51bnZlaWxsYW5jZS5jb208L3A+PGhyLz48ZGl2PjxiPkZy b206IDwvYj4gUGV0ZXIgQ2hyb25pcyAmbHQ7Y2hyb25pc3BlQGNvcnAuZWFydGhsaW5rLm5ldCZn dDsNCjwvZGl2PjxkaXY+PGI+RGF0ZTogPC9iPlR1ZSwgNyBEZWMgMjAxMCAwODoyNDowMSAtMDUw MDwvZGl2PjxkaXY+PGI+VG86IDwvYj5Kb2huIFBoaWxsaXBzJmx0O2pwaGlsbGlwc0B1bnZlaWxs YW5jZS5jb20mZ3Q7PC9kaXY+PGRpdj48Yj5DYzogPC9iPmtoaWphemlAdW52ZWlsbGFuY2UuY29t Jmx0O2toaWphemlAdW52ZWlsbGFuY2UuY29tJmd0OzwvZGl2PjxkaXY+PGI+U3ViamVjdDogPC9i PlJFOiBaZXVzIEMmQyBEb21haW48L2Rpdj48ZGl2Pjxici8+PC9kaXY+PGRpdiBjbGFzcz1Xb3Jk U2VjdGlvbjE+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdjb2xvcjojMUY0OTdEJz5K b2huLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9 J2NvbG9yOiMxRjQ5N0QnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29O b3JtYWw+PHNwYW4gc3R5bGU9J2NvbG9yOiMxRjQ5N0QnPldlICZuYnNwO2FyZSBub3QgaG9zdGlu ZyBjbGlja3hzZWFyY2hlLmNvbS4mbmJzcDsgVGhlIGRvbWFpbiBvd25lciBoYXMgcHVibGlzaGVk IGFuIFJETlMgZW50cnkgdGhhdCBwb2ludHMgdG8gb3VyIHdlYmhvc3RpbmcgVklQLiZuYnNwOyBT bywgYXQgdGhpcyBwb2ludCwgd2UgYXJlIHVuYWJsZSB0byB0cmFjayBmdXJ0aGVyLiZuYnNwOyBX ZSBiZWxpZXZlIHRoYXQgdGhlIFJETlMgbWF5IGJlIHNpZ25pZmljYW50IGJlY2F1c2UgaXQgbWF5 IGJlIHVzZWQgaW4gY29uanVuY3Rpb24gd2l0aCBvdGhlciBpbmZvcm1hdGlvbiB0byBnZXQgdG8g Y29udGVudCBob3N0ZWQgc29tZXdoZXJlIG9uIG91ciBob3N0aW5nIGZhcm0uJm5ic3A7IFJpZ2h0 IG5vdywgYXJlIHVuYWJsZSB0byBpc29sYXRlIHRoZSBFTE5LIGRvbWFpbiBob3N0aW5nIGFjY291 bnQgd2l0aG91dCBzb21lIElQcyBmcm9tIHlvdXIgaG9uZXlwb3RzLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9J2NvbG9yOiMxRjQ5N0QnPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9J2Nv bG9yOiMxRjQ5N0QnPkxldCBtZSBrbm93IGlmIHlvdSBjYW4gcHJvdmlkZS48bzpwPjwvbzpwPjwv c3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdjb2xvcjojMUY0OTdEJz48 YnI+VGhhbmtzLjxicj48YnI+UGV0ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29O b3JtYWw+PHNwYW4gc3R5bGU9J2NvbG9yOiMxRjQ5N0QnPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PHNwYW4gc3R5bGU9J2NvbG9yOiMxRjQ5N0QnPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD48ZGl2PjxkaXYgc3R5bGU9J2JvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluJz48cCBj bGFzcz1Nc29Ob3JtYWw+PGI+PHNwYW4gc3R5bGU9J2ZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6IlRhaG9tYSIsInNhbnMtc2VyaWYiJz5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9J2Zv bnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6IlRhaG9tYSIsInNhbnMtc2VyaWYiJz4gSm9obiBQ aGlsbGlwcyBbbWFpbHRvOmpwaGlsbGlwc0B1bnZlaWxsYW5jZS5jb21dIDxicj48Yj5TZW50Ojwv Yj4gTW9uZGF5LCBEZWNlbWJlciAwNiwgMjAxMCA0OjQ3IFBNPGJyPjxiPlRvOjwvYj4gUGV0ZXIg Q2hyb25pczxicj48Yj5DYzo8L2I+IGtoaWphemlAdW52ZWlsbGFuY2UuY29tPGJyPjxiPlN1Ympl Y3Q6PC9iPiBaZXVzIEMmYW1wO0MgRG9tYWluPG86cD48L286cD48L3NwYW4+PC9wPjwvZGl2Pjwv ZGl2PjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNwOzwvbzpwPjwvcD48cCBjbGFzcz1Nc29O b3JtYWw+UGV0ZXIsPG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD5BcyBLYXJpbSBkaXNjdXNzZWQsIHdlIGxpZnRl ZCB1cCB0aGUgWmV1cyBkb21haW4gaW4gb3JkZXIgdG8gZXhwZWRpdGUgeW91ciBpZGVudGlmaWNh dGlvbiBvZiB0aGUgaW5mZWN0ZWQgc3lzdGVtLiZuYnNwOyBQbGVhc2UgbGV0IG1lIGtub3cgd2hl biBJIGNhbiBnaXZlIHlvdSBhIGNhbGwgdG8gZGlzY3VzcyBpZiB0aGlzIG1lZXRzIHlvdXIgaW1t ZWRpYXRlIG5lZWRzLjxvOnA+PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48bzpwPiZuYnNw OzwvbzpwPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+VGhhbmsgeW91LDxvOnA+PC9vOnA+PC9wPjxw IGNsYXNzPU1zb05vcm1hbD5Kb2huPG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48Yj48c3BhbiBzdHlsZT0nZm9u dC1mYW1pbHk6IkNhbWJyaWEiLCJzZXJpZiI7Y29sb3I6YmxhY2snPkpvaG4gUGhpbGxpcHM8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSdmb250LWZhbWlseToiQ2FtYnJpYSIsInNlcmlmIic+PG86cD48 L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48Yj48c3BhbiBzdHlsZT0nZm9udC1m YW1pbHk6IkNhbWJyaWEiLCJzZXJpZiInPlZpY2UgUHJlc2lkZW50LCBHbG9iYWwgU2FsZXM8L3Nw YW4+PC9iPjxzcGFuIHN0eWxlPSdmb250LWZhbWlseToiQ2FtYnJpYSIsInNlcmlmIic+PG86cD48 L286cD48L3NwYW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48Yj48c3BhbiBzdHlsZT0nZm9udC1m YW1pbHk6IkNhbWJyaWEiLCJzZXJpZiInPlVudmVpbGxhbmNlPC9zcGFuPjxvOnA+PC9vOnA+PC9i PjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PGI+PHNwYW4gc3R5bGU9J2ZvbnQtZmFtaWx5OiJDYW1i cmlhIiwic2VyaWYiJz41MTIuNlVOLlZFSUw8bzpwPjwvbzpwPjwvc3Bhbj48L2I+PC9wPjxwIGNs YXNzPU1zb05vcm1hbD48Yj48c3BhbiBzdHlsZT0nZm9udC1mYW1pbHk6IkNhbWJyaWEiLCJzZXJp ZiInPjUxMi42ODYuODM0NTwvc3Bhbj48L2I+PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9y bWFsPjxiPjxzcGFuIHN0eWxlPSdmb250LWZhbWlseToiQ2FtYnJpYSIsInNlcmlmIic+PGEgaHJl Zj0ibWFpbHRvOmpwaGlsbGlwc0B5b3JlbC5jb20iIHRhcmdldD0iX2JsYW5rIj5qcGhpbGxpcHNA dW52ZWlsbGFuY2UuY29tPC9hPjwvc3Bhbj48bzpwPjwvbzpwPjwvYj48L3A+PHAgY2xhc3M9TXNv Tm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPjxwIGNsYXNzPU1zb05vcm1hbCBzdHlsZT0nbGlu ZS1oZWlnaHQ6MTUuMHB0O2JhY2tncm91bmQ6d2hpdGUnPjxhIGhyZWY9Imh0dHA6Ly91bnZlaWxs YW5jZS5jb20vIiB0aXRsZT0iJnF1b3Q7VW52ZWlsbGFuY2UgfCBEYXRhIExlYWthZ2UgSW50ZWxs aWdlbmNlICZhbXA7IE1ldHJpY3MmcXVvdDsgIj48c3BhbiBzdHlsZT0nZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiJBcmlhbCIsInNhbnMtc2VyaWYiO2NvbG9yOiMxRTk3Qjk7dGV4dC1kZWNv cmF0aW9uOm5vbmUnPjxpbWcgYm9yZGVyPTAgd2lkdGg9MzAwIGhlaWdodD0xNDAgaWQ9IlBpY3R1 cmVfeDAwMjBfMSIgc3JjPSJjaWQ6aW1hZ2UwMDEucG5nQDAxQ0I5NUU4LjBCNjk5MDUwIiBhbHQ9 Imh0dHA6Ly91bnZlaWxsYW5jZS5jb20vd3AtY29udGVudC90aGVtZXMvY3JlYXRpb24vaW1hZ2Vz L2xvZ28ucG5nIj48L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSdmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6IkFyaWFsIiwic2Fucy1zZXJpZiI7Y29sb3I6IzY2NjY2Nic+PG86cD48L286cD48L3Nw YW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48YSBocmVmPSJodHRwOi8vdW52ZWlsbGFuY2UuY29t LyI+VW52ZWlsbGFuY2UgfCBEYXRhIExlYWthZ2UgSW50ZWxsaWdlbmNlICZhbXA7IE1ldHJpY3M8 L2E+PG86cD48L286cD48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxvOnA+Jm5ic3A7PC9vOnA+PC9w PjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjVwdDtmb250LWZh bWlseTpDb25zb2xhcyc+KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq Kio8bzpwPjwvbzpwPjwvc3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdm b250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzJz5DT05GSURFTlRJQUwgJmFtcDsg UFJJVklMRUdFRCBDT01NVU5JQ0FUSU9OIFRoaXMgbWVzc2FnZSBpcyBmb3IgdGhlIG5hbWVkIHBl cnNvbidzIHVzZSBvbmx5LiBUaGUgaW5mb3JtYXRpb24gY29udGFpbmVkIGluIHRoaXMgY29tbXVu aWNhdGlvbiBpcyBjb25maWRlbnRpYWwgYW5kL29yIHByaXZpbGVnZWQsIHByb3ByaWV0YXJ5IGlu Zm9ybWF0aW9uIHRoYXQgaXMgdHJhbnNtaXR0ZWQgc29sZWx5IGZvciB0aGUgcHVycG9zZSBvZiB0 aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpLiBObyBjb25maWRlbnRpYWxpdHkgb3IgcHJpdmlsZWdl IGlzIHdhaXZlZCBvciBsb3N0IGJ5IGFueSBtaXN0cmFuc21pc3Npb24uPG86cD48L286cD48L3Nw YW4+PC9wPjxwIGNsYXNzPU1zb05vcm1hbD48c3BhbiBzdHlsZT0nZm9udC1zaXplOjEwLjVwdDtm b250LWZhbWlseTpDb25zb2xhcyc+SWYgeW91IHJlY2VpdmUgdGhpcyBtZXNzYWdlIGluIGVycm9y LCBwbGVhc2UgaW1tZWRpYXRlbHkgZGVsZXRlIGl0IGFuZCBhbGwgY29waWVzIG9mIGl0IGZyb20g eW91ciBzeXN0ZW0sIGRlc3Ryb3kgYW55IGhhcmQgY29waWVzIG9mIGl0IGFuZCBub3RpZnkgdGhl IHNlbmRlci4gWW91IG11c3Qgbm90LCBkaXJlY3RseSBvciBpbmRpcmVjdGx5LCB1c2UsIGRpc2Ns b3NlLCBkaXN0cmlidXRlLCBwcmludCwgb3IgY29weSBhbnkgcGFydCBvZiB0aGlzIG1lc3NhZ2Ug aWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudC4gVGhlIHNlbmRlciBvciBhbnkg b2YgaXRzIHN1YnNpZGlhcmllcyBlYWNoIHJlc2VydmUgdGhlIHJpZ2h0IHRvIG1vbml0b3IgYWxs IGUtbWFpbCBjb21tdW5pY2F0aW9ucyB0aHJvdWdoIGl0cyBuZXR3b3Jrcy48bzpwPjwvbzpwPjwv c3Bhbj48L3A+PHAgY2xhc3M9TXNvTm9ybWFsPjxzcGFuIHN0eWxlPSdmb250LXNpemU6MTAuNXB0 O2ZvbnQtZmFtaWx5OkNvbnNvbGFzJz4qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKjxvOnA+PC9vOnA+PC9zcGFuPjwvcD48cCBjbGFzcz1Nc29Ob3JtYWw+PG86cD4m bmJzcDs8L286cD48L3A+PC9kaXY+PC9ib2R5PjwvaHRtbD4NCg== --part21336-boundary-1750513842-1034109403-- --part21335-boundary-1750513842-1034109403 Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size="3700"; creation-date="Tue, 07 Dec 2010 08:24:02 GMT"; modification-date="Tue, 07 Dec 2010 08:24:02 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAASwAAACMCAYAAADGFpQvAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJ bWFnZVJlYWR5ccllPAAAA2RpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdp bj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6 eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEz NDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJo dHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlw dGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEu MC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVz b3VyY2VSZWYjIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtcE1N Ok9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRpZDpBNDkwQTE2OUY3OTVERjExQUYxOTg5M0M1MjdF NzczQiIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDoxMTYwN0FBQ0M4RDUxMURGOUFDQTlERTJF QTM5MjAxOSIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDoxMTYwN0FBQkM4RDUxMURGOUFDQTlE RTJFQTM5MjAxOSIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M1IFdpbmRvd3Mi PiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDozQTExOTQ3NUQw QzhERjExOEUzQjhGMzM2OEJGMjUwOSIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDpBNDkwQTE2 OUY3OTVERjExQUYxOTg5M0M1MjdFNzczQiIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRG PiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PruwPTQAAAqmSURBVHja7J2NbSI5FMed aBsgHRxp4CTQbgOkBCghlAAlMCVACUwJ0EBWIN0VEO4qCCVwftnnPcd4vmf4kH4/aZRdGPwxfv77 PY/H83A6nQwAwD3wyCUAAAQLAADBAgAECwAAwQIAQLAAAMECAECwAAAQLABAsAAAECwAAAQLABAs AAAECwAAwQIABAsAAMECAECwAADBAgBAsAAAECwAQLAAABAsAAAECwAQLAAABAsAAMECAAQLAADB AgAECwAAwQIAQLAAAMECAECwAAAQLABAsAAAECwAAAQLABAsAAAECwAAwQIABAsAAMECAECwAADB AgBAsAAAECwAQLAAABAsAAAECwDunm/+f1Z//zuyfzbBOc/TP/84VEl0+dc/7/ZP3/tobtNIcs6X fEf2nHmTyth0pOyjMvnac/taV7+cUs+h/c2xZv5j+2cdfLyy6U0L6r5poS0z2ykjj9x2rfObqnz/ /j2ax8+fPw/X7BS2XAv7J7Xl2Ldc15FNc94wnTMbt2kmDdIbaHrSD14zTnNlXtm8jg3atpZdv729 HW7Rw5qJ0Gmn7xzteJPgY2m0ZU2xiv12nydWcHtoR5vJwGP/3Wvbxm2a7/YY30A9P8ti/7mzxyJH rIx+L8eHCOY1y39rIaF0+rXt/GsVgK5Fa++NHo6xzXtWIznxrHwDP0YEEW5brHreoFN78Cpj4zYv OfpXqONIhWoRRBdlGWn5Nx0IerWQ8IYYq3DkhpItiVZi8xlonr9HFPvZVgWtjHclAjcI3egG4VOr oReUd5SDTjwWT6RJyFVk4zb9eUfpR70qFaoQsfPUHtswDFZvqq9epxOorXSdsuFhm+H+txs3oIWG iNL5t13qlgqOb6zi5RXOZ6nYhUaQ2t+t6P935V3NgkHLD+PSDufVFioKIlzbjusX2ulBhSczX/td qv9MNI2j/exqtn0PdwlFEDZWGJb26MQFVVGqPJ+l5VnHjAAJuCuxGmR4Hka9ivUlbNyWY9lFmJVR PxGpYRWRFE/wmmJ1L4LlkElBmZR/7Ui0xBUOXfNxwU2AZWQeYFL3LiNcjVCQwvYb6J3Di9i4zatt G59FBtVJjZDu6txySJhELvTnpKiKyLTteR5ZVqG38/35KMlvH+al81ahmM3LznsVIMJc9TfMe9Xz PmKTz+JtjwL7k9Bw74VIndq4honTpqGoemyhna6uJFYixpXtWgX25j2slRY25rKOtFPPOsh3Eoyw ZyGB3sE8c7G7vkEArYvVOCIYEvZsdb1UOPgsW76zV2jjOm/UNNw0kXDwLrnpkFA8Bnu8RETEsdC1 W6M28zTnc1ADm8eiIIRg3uq+xCq6bi5Y2BkbvFpd6iAelD1ybVzXbo1otdu/S+hERNzwVCbezfkC t88V6/a71HxdB9UoP5te6K7Lwta9jljhqNV2eEp41z2F6+ZETKxQJIE3PepiqYOGmqlMvGfZuNyt rGHj+wzvbX+Fa954WUPoYcUSqyMCXd3NEy9mmHGxxxnub9285pHrsY6FECqocD/e1SI26MQ6kwpT GvF6Bl2UzebXqo3rXFUYAr5eY9Fn6yGhjupho1WKoTV06nUVM8uktj2GFwrBilaq75s+/wgXF6tB hk3L6u1T7DDx9Vnrrjq9LN60R5s2Po94bOt7FK3YHFbs1v66zBooFavQGNKW7pyFwiUTlk+R0a/N PGKP7mSGEHDzYtXmmqquHt3xhasVG9fV6/NIWLirMjemzx++XrMNHzOEIIm4oh9yV05Xdvsi1dPP 3yNite/SE5L1TvYQ0XjJCGfbyCPJMJiEeaa7I7ZurgnjrjuwhHT2aGzjGtrGPC2ZG9upGA0iIjXW 7z7Mr7m8pT5H2L9GA37Lmr+xAnQ057fuFypSZdKWMPAiiyj1sZ1nXebQxQK/8NGdtOMlDLe6DusS 5aq1VqdoMjfj0ZvKz/FJ5zZf55FkPmvb9ZY4uiL9Oed5wFKiJWvJIsL9+0ZSyWs/UuGquvi0u3VY 2iGHNdzRgwrVy6VXfGuZs9a1NPLkPE+RR2/uLxSMPu9Z805f4Tq9joWrkY3rGrNn9bbqiOynIyJL Ma6x+PSxaA5HQy5XwVVOJeR7Eanna941C9Zute3FJYZHb+5NrPqmxec91ZM6W6enyxEuJVr+2q3a wqfCNSzo20a/l+NJhepq/fvhdDph1QBwF7CnOwAgWAAACBYAIFgAAAgWAACCBQAIFgAAggUAgGAB AIIFAIBgAQAgWACAYAEA3ARfNvD78eNHbHMw2XZCtpbI2lJlY35ttxHbW0d2KYxtrSxpPUU+lw3W Rqbc1h8fXtlCZP+jXeRz2Y4jrVAHl4773Vivz0H/H9uSw32ftV2H25tplHONY9ctyairbJ0iW6gM vbqsgnpKfq/eNS/TLnllCK9LiLOjpwy7CctstHyv5v/N8Y6aX1KyTZd63ZPAntbm60sd+lo+f6fQ 1Py/P1RV2ylrv2XKtzZfNxkMr4HJuJZZe1uttcyp1yYhro3K2ERYPve9vz1NrG3d5omubV3/SLw2 WZv4CzaGb29v+yIPSwr4YH7tg9XXBuxlNELeBmYuHbdvz1D/HxMrt0f2wJy/5qguE83PHWmNOhj9 fqMNLhf5JUOQXtVgY28Tdt/vtMEevGtxiJyfBGUv+7KLgdZlY7K3Ay7bLnXLUJWlXrPUy+tFO0Ov ZJv2NI2dib80wni23PeuwYNe/14N26liv2XKZ1S4XJ5TPXeTc/7nC1fN1+3Jx/rZOKft3XGsaBP7 4Pcrk7/19FLLtsqxI9dfHiLHvkpIeNDE+5HKu9HQjQ6bhkbrRopJxANpkubJO+rWYanlGeZ4Tu5t 0BOtxybSCdz74NwIvNORbWHOX2gwC8peZVvclbbdu2n2ooQmZajC2Btxe5rXzjP2sm2697ytmGCP Nf1w19DYW56LbKeO/RaVL8R5RyOT/3qvlZ6z0XJI/tucyMSvV9U35wyC38+0jIeCtl0F9UqC638I 0j1F2r5QsPpBCOR3vKVXeOdZ1H2t9kbTWmon63meT1ceVpU6TNUAdjmjpxOod2/ECb22rRcSulHs ycTfQdfEu3FbOj97IVAdLuVhpV5IeNS8hhnhZJHnk3he6yKSz9Gcv0R1VtM7r2O/eeWLdfax2s2+ oL1fvPrlbaGc5WGVZR94V1uTv/Op37Z+vQaBYzSM2NpZpPJYoMLvXmJHT2GXEWN+8eZKqoYDg8iF PEQMq6oHkDVKVq2DM4i55rnxznHh5DFI68mcvwpqpY3rj1IfagSTDrybg5Z7Yuq96bfu9a06mk+1 LV69czcZc5RlPZ9ppOM6Wz4EZRtE0imbT137nWYIi28bS+3wLxU866L536YeVliHXkY0kde2i+B6 riPe1SI2N8cWyQBwN7CsAQAQLAAABAsAECwAAAQLAADBAgAECwAAwQIAQLAAAMECAECwAAAQLABA sAAAECwAAAQLABAsAAAECwAAwQIABAsAAMECAECwAADBAgBAsAAAECwAQLAAABAsAAAECwAQLAAA BAsAECwuAQAgWAAACBYAIFgAAAgWAACCBQAIFgAAggUAgGABAIIFAIBgAQAgWACAYAEAIFgAAAgW ACBYAAAIFgAAggUACBYAAIIFAIBgAQCCBQBwMf4TYABnSyaseQPydAAAAABJRU5ErkJggg== --part21335-boundary-1750513842-1034109403-- From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-Path: Received: from [192.168.0.197] (68-243-84-101.pools.spcsdns.net [68.243.84.101]) by mx.google.com with ESMTPS id d15sm6730627ana.15.2010.12.07.06.39.57 (version=SSLv3 cipher=RC4-MD5); Tue, 07 Dec 2010 06:39:58 -0800 (PST) Message-ID: <4CFE473C.2010909@unveillance.com> Disposition-Notification-To: Karim Hijazi Unveillance Email Date: Tue, 07 Dec 2010 09:39:56 -0500 From: Karim Hijazi Unveillance Email Reply-To: khijazi@unveillance.com Organization: Unveillance User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.12) Gecko/20101027 Lightning/1.0b2 Thunderbird/3.1.6 MIME-Version: 1.0 To: "J. Tubbs" Subject: Fwd: RE: Zeus C&C Domain X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This is Earthlink's response. Perhaps we can dig further. KH - -------- Original Message -------- Subject: RE: Zeus C&C Domain Date: Tue, 7 Dec 2010 08:24:01 -0500 From: Peter Chronis To: John Phillips CC: khijazi@unveillance.com John, We are not hosting clickxsearche.com. The domain owner has published an RDNS entry that points to our webhosting VIP. So, at this point, we are unable to track further. We believe that the RDNS may be significant because it may be used in conjunction with other information to get to content hosted somewhere on our hosting farm. Right now, are unable to isolate the ELNK domain hosting account without some IPs from your honeypots. Let me know if you can provide. Thanks. Pete From: John Phillips [mailto:jphillips@unveillance.com] Sent: Monday, December 06, 2010 4:47 PM To: Peter Chronis Cc: khijazi@unveillance.com Subject: Zeus C&C Domain Peter, As Karim discussed, we lifted up the Zeus domain in order to expedite your identification of the infected system. Please let me know when I can give you a call to discuss if this meets your immediate needs. Thank you, John John Phillips Vice President, Global Sales Unveillance 512.6UN.VEIL 512.686.8345 jphillips@unveillance.com [cid:image001.png@01CB95E8.0B699050] Unveillance | Data Leakage Intelligence & Metrics ******************************************** CONFIDENTIAL & PRIVILEGED COMMUNICATION This message is for the named person's use only. The information contained in this communication is confidential and/or privileged, proprietary information that is transmitted solely for the purpose of the intended recipient(s). No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. The sender or any of its subsidiaries each reserve the right to monitor all e-mail communications through its networks. ******************************************** -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (MingW32) iQEcBAEBAgAGBQJM/kc7AAoJEIk0Dw4U/G3lpB8IAJ1RGUYlSU+sdUWRLC9fpRrC cxUyIDBY6YtHZR1Yh0LqWhRR3RuSZOhZi+4VH9wmubWkHSY488Dwdti/Tf0EJ7dv R8J/Yr9q/fcS96wDWCXZ1YvN9Sn+4D1/327Jfu7XdU32E82E9fCdhtFwSEyWOGY3 PFbkcdMXYtNJhb0JIzZeEm7SCcjKRUGM12YlGDQzf79+nvgJHLZyPil5/uI7G8J2 tluqReKH0UID+9n4bIc3iCLdIEm1aKzXTeeWL0xINYhDTAROK+WSjtAqFUscve+P rUKA3fC+ReA5Ot139lX8SLjKacUWACUw3izZofNQTq6VXfNpmkI6EhfdhtpMWL8= =62Ef -----END PGP SIGNATURE----- From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs123966yhg; Mon, 6 Dec 2010 20:45:15 -0800 (PST) Received: by 10.151.113.19 with SMTP id q19mr989444ybm.202.1291697115430; Mon, 06 Dec 2010 20:45:15 -0800 (PST) Return-Path: Received: from mail-gy0-f173.google.com (mail-gy0-f173.google.com [209.85.160.173]) by mx.google.com with ESMTP id u5si7706440yba.53.2010.12.06.20.45.15; Mon, 06 Dec 2010 20:45:15 -0800 (PST) Received-SPF: neutral (google.com: 209.85.160.173 is neither permitted nor denied by best guess record for domain of jphillips@unveillance.com) client-ip=209.85.160.173; Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.160.173 is neither permitted nor denied by best guess record for domain of jphillips@unveillance.com) smtp.mail=jphillips@unveillance.com Received: by gye5 with SMTP id 5so6996128gye.4 for ; Mon, 06 Dec 2010 20:45:14 -0800 (PST) Received: by 10.100.166.13 with SMTP id o13mr4577833ane.123.1291697114633; Mon, 06 Dec 2010 20:45:14 -0800 (PST) Return-Path: Received: from bda2475.bisx.prod.on.blackberry (bda-67-223-77-219.bise.na.blackberry.com [67.223.77.219]) by mx.google.com with ESMTPS id c39sm6248387anc.21.2010.12.06.20.45.13 (version=SSLv3 cipher=RC4-MD5); Mon, 06 Dec 2010 20:45:14 -0800 (PST) X-rim-org-msg-ref-id: 1191684215 Message-ID: <1191684215-1291697112-cardhu_decombobulator_blackberry.rim.net-2078429402-@bda480.bisx.prod.on.blackberry> Reply-To: jphillips@unveillance.com X-Priority: Normal References: <008701cb95c8$6bfece50$43fc6af0$@com><95A6CCA5-64AC-4D4D-99EB-D02979857D88@unveillance.com> In-Reply-To: <95A6CCA5-64AC-4D4D-99EB-D02979857D88@unveillance.com> Sensitivity: Normal Importance: Normal Subject: Re: DLI Overview Slick To: "J. Tubbs" Cc: "Karim Hijazi Unveillance Email" ,"Patrick Callahan" From: "John Phillips" Date: Tue, 7 Dec 2010 04:45:01 +0000 Content-Type: multipart/alternative; boundary="part20962-boundary-943575488-861334895" MIME-Version: 1.0 --part20962-boundary-943575488-861334895 Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="Windows-1252" QWdyZWVkLiBQbHVzIEknbSBnb2luZyB0byBjaGFuZ2UgdGhlIGJhY2tncm91bmQgY29sb3IgdG9v LiBEb2luZyB0aGF0IG5vdyBhbmQgc2VuZGluZyBiYWNrIG91dC4gDQoNCkpvaG4NCkpvaG4gUGhp bGxpcHMNClZpY2UgUHJlc2lkZW50LCBHbG9iYWwgU2FsZXMNClVudmVpbGxhbmNlDQo1MTIuNlVO LlZFSUwNCjUxMi42ODYuODM0NQ0KDQpqcGhpbGxpcHNAdW52ZWlsbGFuY2UuY29tDQpodHRwOi8v d3d3LnVudmVpbGxhbmNlLmNvbQ0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTog IkouIFR1YmJzIiA8anR1YmJzQHVudmVpbGxhbmNlLmNvbT4NCkRhdGU6IE1vbiwgNiBEZWMgMjAx MCAyMzo0Mzo0NSANClRvOiBKb2huIFBoaWxsaXBzPGpwaGlsbGlwc0B1bnZlaWxsYW5jZS5jb20+ DQpDYzogPGtoaWphemlAdW52ZWlsbGFuY2UuY29tPjsgJ1BhdHJpY2sgQ2FsbGFoYW4nPHBhdHJp Y2tAZGVjYWxhdy5jb20+DQpTdWJqZWN0OiBSZTogRExJIE92ZXJ2aWV3IFNsaWNrDQoNCkkgbGlr ZSB0aGUgb3ZlcmFsbCBkaXJlY3Rpb24gb2YgdGhlIGRvY3VtZW50LiAgSSB0aGluayBpdCBnaXZl cyBhIHZlcnkgcXVpY2sgb3ZlcnZpZXcgb2YgZXhhY3RseSB3aGF0IHdlIHByZWFjaCBhcyB0aGUg RExJLg0KDQpPbmx5IHRoaW5nIEkgd291bGQgY29uc2lkZXIgY2hhbmdpbmcgaXMgdGhlIGxhc3Qg c3RhdGVtZW50IGFib3V0IHRoZSB1cGRhdGUgcm90YXRpb24uICBOb3QgdGhhdCBpdCBpcyBpbmNv cnJlY3QsIGFzIGl0IGRvZXMgcHJlc2VudGx5IHVwZGF0ZSBkYWlseSwgYnV0IEkgaGF2ZSBwbGFu cyB0byBoYXZlIGl0IHVwZGF0ZSBtb3JlIG9mdGVuLiAgUmVnYXJkbGVzcyBvZiB3aGVuZXZlciBJ IGFtIGFibGUgdG8gaW1wbGVtZW50IGEgbW9yZSBhZ2dyZXNzaXZlIHVwZGF0ZSBjeWNsZSBmb3Ig c3RhdGlzdGljcywgSSB0aGluayBhIG1vcmUgZ2VuZXJhbCBzdGF0ZW1lbnQgY291bGQgYmUgcHV0 IGluIGhlcmUgaW4gY29uanVuY3Rpb24gdGhhdCB3ZSB1cGRhdGUgb3V0IGRhdGFzZXQgaG91cmx5 Lg0KDQpJIHRoaW5rIHRoYXQgd2UgcmVhbGx5IHdhbnQgdGhlIERMSSB0byBlbmQgdXAgbXVjaCBs aWtlIGEgc3RvY2sgcHJpY2UgaW4gdGhhdCBpdCBpbmRpY2F0ZXMgaW50ZXJuYWwgY29tcGFueSBw ZXJmb3JtYW5jZSwgYW5kIG5vdCBqdXN0IHNlY3VyaXR5LiAgV2Ugd2FudCBpdCB0byBzZWVtIGxp a2UgaXQncyB1cGRhdGluZyB2ZXJ5IGFnZ3Jlc3NpdmVseSBhbmQgY29uc3RhbnRseSBldm9sdmlu ZyByZXZlYWxpbmcgbW9yZSBhYm91dCBhbiBvcmdhbml6YXRpb24gdGhhbiBqdXN0IHNlY3VyaXR5 IHN0YXRlLg0KDQpKLiBUdWJicw0KQ1RPDQpVbnZlaWxsYW5jZSwgTExDDQpPLiAoNDA0KSA0ODIt MzU1Nw0Kd3d3LnVudmVpbGxhbmNlLmNvbQ0KanR1YmJzQHVudmVpbGxhbmNlLmNvbQ0KDQoqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKg0KQ09ORklERU5USUFMICYg UFJJVklMRUdFRCBDT01NVU5JQ0FUSU9OIFRoaXMgbWVzc2FnZSBpcyBmb3IgdGhlIG5hbWVkDQpw ZXJzb24ncyB1c2Ugb25seS4gVGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBpbiB0aGlzIGNvbW11 bmljYXRpb24gaXMNCmNvbmZpZGVudGlhbCBhbmQvb3IgcHJpdmlsZWdlZCwgcHJvcHJpZXRhcnkg aW5mb3JtYXRpb24gdGhhdCBpcw0KdHJhbnNtaXR0ZWQgc29sZWx5IGZvciB0aGUgcHVycG9zZSBv ZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpLiBObw0KY29uZmlkZW50aWFsaXR5IG9yIHByaXZp bGVnZSBpcyB3YWl2ZWQgb3IgbG9zdCBieSBhbnkgbWlzdHJhbnNtaXNzaW9uLg0KSWYgeW91IHJl Y2VpdmUgdGhpcyBtZXNzYWdlIGluIGVycm9yLCBwbGVhc2UgaW1tZWRpYXRlbHkgZGVsZXRlIGl0 IGFuZA0KYWxsIGNvcGllcyBvZiBpdCBmcm9tIHlvdXIgc3lzdGVtLCBkZXN0cm95IGFueSBoYXJk IGNvcGllcyBvZiBpdCBhbmQNCm5vdGlmeSB0aGUgc2VuZGVyLiBZb3UgbXVzdCBub3QsIGRpcmVj dGx5IG9yIGluZGlyZWN0bHksIHVzZSwgZGlzY2xvc2UsDQpkaXN0cmlidXRlLCBwcmludCwgb3Ig Y29weSBhbnkgcGFydCBvZiB0aGlzIG1lc3NhZ2UgaWYgeW91IGFyZSBub3QgdGhlDQppbnRlbmRl ZCByZWNpcGllbnQuIFRoZSBzZW5kZXIgb3IgYW55IG9mIGl0cyBzdWJzaWRpYXJpZXMgZWFjaCBy ZXNlcnZlDQp0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb25zIHRo cm91Z2ggaXRzIG5ldHdvcmtzLg0KKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioNCg0KT24gRGVjIDYsIDIwMTAsIGF0IDExOjM3IFBNLCBKb2huIFBoaWxsaXBzIHdy b3RlOg0KDQo+IEdlbnRsZW1lbiwNCj4gIA0KPiBZb3VyIGZlZWRiYWNrIGlzIG11Y2ggYXBwcmVj aWF0ZWQuICBJdJJzIGEgd29yayBpbiBwcm9ncmVzcy4NCj4gIA0KPiBUaGFuayB5b3UsDQo+IEpv aG4NCj4gIA0KPiBKb2huIFBoaWxsaXBzDQo+IFZpY2UgUHJlc2lkZW50LCBHbG9iYWwgU2FsZXMN Cj4gVW52ZWlsbGFuY2UNCj4gNTEyLjZVTi5WRUlMDQo+IDUxMi42ODYuODM0NQ0KPiBqcGhpbGxp cHNAdW52ZWlsbGFuY2UuY29tDQo+ICANCj4gPGltYWdlMDAxLnBuZz4NCj4gVW52ZWlsbGFuY2Ug fCBEYXRhIExlYWthZ2UgSW50ZWxsaWdlbmNlICYgTWV0cmljcw0KPiAgDQo+ICoqKioqKioqKioq KioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqDQo+IENPTkZJREVOVElBTCAmIFBSSVZJ TEVHRUQgQ09NTVVOSUNBVElPTiBUaGlzIG1lc3NhZ2UgaXMgZm9yIHRoZSBuYW1lZCBwZXJzb24n cyB1c2Ugb25seS4gVGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBpbiB0aGlzIGNvbW11bmljYXRp b24gaXMgY29uZmlkZW50aWFsIGFuZC9vciBwcml2aWxlZ2VkLCBwcm9wcmlldGFyeSBpbmZvcm1h dGlvbiB0aGF0IGlzIHRyYW5zbWl0dGVkIHNvbGVseSBmb3IgdGhlIHB1cnBvc2Ugb2YgdGhlIGlu dGVuZGVkIHJlY2lwaWVudChzKS4gTm8gY29uZmlkZW50aWFsaXR5IG9yIHByaXZpbGVnZSBpcyB3 YWl2ZWQgb3IgbG9zdCBieSBhbnkgbWlzdHJhbnNtaXNzaW9uLg0KPiBJZiB5b3UgcmVjZWl2ZSB0 aGlzIG1lc3NhZ2UgaW4gZXJyb3IsIHBsZWFzZSBpbW1lZGlhdGVseSBkZWxldGUgaXQgYW5kIGFs bCBjb3BpZXMgb2YgaXQgZnJvbSB5b3VyIHN5c3RlbSwgZGVzdHJveSBhbnkgaGFyZCBjb3BpZXMg b2YgaXQgYW5kIG5vdGlmeSB0aGUgc2VuZGVyLiBZb3UgbXVzdCBub3QsIGRpcmVjdGx5IG9yIGlu ZGlyZWN0bHksIHVzZSwgZGlzY2xvc2UsIGRpc3RyaWJ1dGUsIHByaW50LCBvciBjb3B5IGFueSBw YXJ0IG9mIHRoaXMgbWVzc2FnZSBpZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50 LiBUaGUgc2VuZGVyIG9yIGFueSBvZiBpdHMgc3Vic2lkaWFyaWVzIGVhY2ggcmVzZXJ2ZSB0aGUg cmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb25zIHRocm91Z2ggaXRzIG5l dHdvcmtzLg0KPiAqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKg0K PiAgDQo+IDxETElfT3ZlcnZpZXcucGRmPg0KDQoNCg== --part20962-boundary-943575488-861334895 Content-Transfer-Encoding: base64 Content-Type: text/html; charset="Windows-1252" PGh0bWw+PGhlYWQ+PGJhc2UgaHJlZj0ieC1tc2c6Ly8xMjIvIj48L2hlYWQ+PGJvZHkgc3R5bGU9 IndvcmQtd3JhcDogYnJlYWstd29yZDsgLXdlYmtpdC1uYnNwLW1vZGU6IHNwYWNlOyAtd2Via2l0 LWxpbmUtYnJlYWs6IGFmdGVyLXdoaXRlLXNwYWNlOyAiPkFncmVlZC4gUGx1cyBJJ20gZ29pbmcg dG8gY2hhbmdlIHRoZSBiYWNrZ3JvdW5kIGNvbG9yIHRvby4gRG9pbmcgdGhhdCBub3cgYW5kIHNl bmRpbmcgYmFjayBvdXQuIDxici8+PGJyLz5Kb2huPHA+Sm9obiBQaGlsbGlwczxici8+VmljZSBQ cmVzaWRlbnQsIEdsb2JhbCBTYWxlczxici8+VW52ZWlsbGFuY2U8YnIvPjUxMi42VU4uVkVJTDxi ci8+NTEyLjY4Ni44MzQ1PGJyLz48YnIvPmpwaGlsbGlwc0B1bnZlaWxsYW5jZS5jb208YnIvPmh0 dHA6Ly93d3cudW52ZWlsbGFuY2UuY29tPC9wPjxoci8+PGRpdj48Yj5Gcm9tOiA8L2I+ICJKLiBU dWJicyIgJmx0O2p0dWJic0B1bnZlaWxsYW5jZS5jb20mZ3Q7DQo8L2Rpdj48ZGl2PjxiPkRhdGU6 IDwvYj5Nb24sIDYgRGVjIDIwMTAgMjM6NDM6NDUgLTA1MDA8L2Rpdj48ZGl2PjxiPlRvOiA8L2I+ Sm9obiBQaGlsbGlwcyZsdDtqcGhpbGxpcHNAdW52ZWlsbGFuY2UuY29tJmd0OzwvZGl2PjxkaXY+ PGI+Q2M6IDwvYj4mbHQ7a2hpamF6aUB1bnZlaWxsYW5jZS5jb20mZ3Q7OyAnUGF0cmljayBDYWxs YWhhbicmbHQ7cGF0cmlja0BkZWNhbGF3LmNvbSZndDs8L2Rpdj48ZGl2PjxiPlN1YmplY3Q6IDwv Yj5SZTogRExJIE92ZXJ2aWV3IFNsaWNrPC9kaXY+PGRpdj48YnIvPjwvZGl2PkkgbGlrZSB0aGUg b3ZlcmFsbCBkaXJlY3Rpb24gb2YgdGhlIGRvY3VtZW50LiAmbmJzcDtJIHRoaW5rIGl0IGdpdmVz IGEgdmVyeSBxdWljayBvdmVydmlldyBvZiBleGFjdGx5IHdoYXQgd2UgcHJlYWNoIGFzIHRoZSBE TEkuPGRpdj48YnI+PC9kaXY+PGRpdj5Pbmx5IHRoaW5nIEkgd291bGQgY29uc2lkZXIgY2hhbmdp bmcgaXMgdGhlIGxhc3Qgc3RhdGVtZW50IGFib3V0IHRoZSB1cGRhdGUgcm90YXRpb24uICZuYnNw O05vdCB0aGF0IGl0IGlzIGluY29ycmVjdCwgYXMgaXQgZG9lcyBwcmVzZW50bHkgdXBkYXRlIGRh aWx5LCBidXQgSSBoYXZlIHBsYW5zIHRvIGhhdmUgaXQgdXBkYXRlIG1vcmUgb2Z0ZW4uICZuYnNw O1JlZ2FyZGxlc3Mgb2Ygd2hlbmV2ZXIgSSBhbSBhYmxlIHRvIGltcGxlbWVudCBhIG1vcmUgYWdn cmVzc2l2ZSB1cGRhdGUgY3ljbGUgZm9yIHN0YXRpc3RpY3MsIEkgdGhpbmsgYSBtb3JlIGdlbmVy YWwgc3RhdGVtZW50IGNvdWxkIGJlIHB1dCBpbiBoZXJlIGluIGNvbmp1bmN0aW9uIHRoYXQgd2Ug dXBkYXRlIG91dCBkYXRhc2V0IGhvdXJseS48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PkkgdGhp bmsgdGhhdCB3ZSByZWFsbHkgd2FudCB0aGUgRExJIHRvIGVuZCB1cCBtdWNoIGxpa2UgYSBzdG9j ayBwcmljZSBpbiB0aGF0IGl0IGluZGljYXRlcyBpbnRlcm5hbCBjb21wYW55IHBlcmZvcm1hbmNl LCBhbmQgbm90IGp1c3Qgc2VjdXJpdHkuICZuYnNwO1dlIHdhbnQgaXQgdG8gc2VlbSBsaWtlIGl0 J3MgdXBkYXRpbmcgdmVyeSBhZ2dyZXNzaXZlbHkgYW5kIGNvbnN0YW50bHkgZXZvbHZpbmcgcmV2 ZWFsaW5nIG1vcmUgYWJvdXQgYW4gb3JnYW5pemF0aW9uIHRoYW4ganVzdCBzZWN1cml0eSBzdGF0 ZS48L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2Pg0KPHNwYW4gY2xhc3M9IkFwcGxlLXN0eWxlLXNw YW4iIHN0eWxlPSJib3JkZXItY29sbGFwc2U6IHNlcGFyYXRlOyBjb2xvcjogcmdiKDAsIDAsIDAp OyBmb250LWZhbWlseTogSGVsdmV0aWNhOyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFu dDogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyBs aW5lLWhlaWdodDogbm9ybWFsOyBvcnBoYW5zOiAyOyB0ZXh0LWFsaWduOiBhdXRvOyB0ZXh0LWlu ZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd2lk b3dzOiAyOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC1ib3JkZXItaG9yaXpvbnRhbC1zcGFj aW5nOiAwcHg7IC13ZWJraXQtYm9yZGVyLXZlcnRpY2FsLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10 ZXh0LWRlY29yYXRpb25zLWluLWVmZmVjdDogbm9uZTsgLXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0 OiBhdXRvOyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IGZvbnQtc2l6ZTogbWVkaXVt OyAiPjxzcGFuIGNsYXNzPSJBcHBsZS1zdHlsZS1zcGFuIiBzdHlsZT0iYm9yZGVyLWNvbGxhcHNl OiBzZXBhcmF0ZTsgY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IEhlbHZldGljYTsg Zm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQ6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5v cm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgb3JwaGFu czogMjsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNl OiBub3JtYWw7IHdpZG93czogMjsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtYm9yZGVyLWhv cml6b250YWwtc3BhY2luZzogMHB4OyAtd2Via2l0LWJvcmRlci12ZXJ0aWNhbC1zcGFjaW5nOiAw cHg7IC13ZWJraXQtdGV4dC1kZWNvcmF0aW9ucy1pbi1lZmZlY3Q6IG5vbmU7IC13ZWJraXQtdGV4 dC1zaXplLWFkanVzdDogYXV0bzsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyBmb250 LXNpemU6IG1lZGl1bTsgIj48ZGl2IHN0eWxlPSJ3b3JkLXdyYXA6IGJyZWFrLXdvcmQ7IC13ZWJr aXQtbmJzcC1tb2RlOiBzcGFjZTsgLXdlYmtpdC1saW5lLWJyZWFrOiBhZnRlci13aGl0ZS1zcGFj ZTsgIj48ZGl2PkouIFR1YmJzPGJyPkNUTzxicj5VbnZlaWxsYW5jZSwgTExDPGJyPk8uICg0MDQp IDQ4Mi0zNTU3PGJyPjxhIGhyZWY9Imh0dHA6Ly93d3cudW52ZWlsbGFuY2UuY29tLyI+PGZvbnQg Y2xhc3M9IkFwcGxlLXN0eWxlLXNwYW4iIGNvbG9yPSIjMkExMUZGIj53d3cudW52ZWlsbGFuY2Uu Y29tPC9mb250PjwvYT48L2Rpdj48ZGl2PjxhIGhyZWY9Imh0dHA6Ly93d3cudW52ZWlsbGFuY2Uu Y29tLyI+PC9hPjx1Pjxmb250IGNsYXNzPSJBcHBsZS1zdHlsZS1zcGFuIiBjb2xvcj0iIzJBMTFG RiI+PGEgaHJlZj0ibWFpbHRvOmp0dWJic0B1bnZlaWxsYW5jZS5jb20iPmp0dWJic0B1bnZlaWxs YW5jZS5jb208L2E+PC9mb250PjwvdT48YnI+PGJyPioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKioqKioqPGJyPkNPTkZJREVOVElBTCAmYW1wOyBQUklWSUxFR0VEIENPTU1V TklDQVRJT04gVGhpcyBtZXNzYWdlIGlzIGZvciB0aGUgbmFtZWQ8YnI+cGVyc29uJ3MgdXNlIG9u bHkuIFRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhpcyBjb21tdW5pY2F0aW9uIGlzPGJy PmNvbmZpZGVudGlhbCBhbmQvb3IgcHJpdmlsZWdlZCwgcHJvcHJpZXRhcnkgaW5mb3JtYXRpb24g dGhhdCBpczxicj50cmFuc21pdHRlZCBzb2xlbHkgZm9yIHRoZSBwdXJwb3NlIG9mIHRoZSBpbnRl bmRlZCByZWNpcGllbnQocykuIE5vPGJyPmNvbmZpZGVudGlhbGl0eSBvciBwcml2aWxlZ2UgaXMg d2FpdmVkIG9yIGxvc3QgYnkgYW55IG1pc3RyYW5zbWlzc2lvbi48YnI+SWYgeW91IHJlY2VpdmUg dGhpcyBtZXNzYWdlIGluIGVycm9yLCBwbGVhc2UgaW1tZWRpYXRlbHkgZGVsZXRlIGl0IGFuZDxi cj5hbGwgY29waWVzIG9mIGl0IGZyb20geW91ciBzeXN0ZW0sIGRlc3Ryb3kgYW55IGhhcmQgY29w aWVzIG9mIGl0IGFuZDxicj5ub3RpZnkgdGhlIHNlbmRlci4gWW91IG11c3Qgbm90LCBkaXJlY3Rs eSBvciBpbmRpcmVjdGx5LCB1c2UsIGRpc2Nsb3NlLDxicj5kaXN0cmlidXRlLCBwcmludCwgb3Ig Y29weSBhbnkgcGFydCBvZiB0aGlzIG1lc3NhZ2UgaWYgeW91IGFyZSBub3QgdGhlPGJyPmludGVu ZGVkIHJlY2lwaWVudC4gVGhlIHNlbmRlciBvciBhbnkgb2YgaXRzIHN1YnNpZGlhcmllcyBlYWNo IHJlc2VydmU8YnI+dGhlIHJpZ2h0IHRvIG1vbml0b3IgYWxsIGUtbWFpbCBjb21tdW5pY2F0aW9u cyB0aHJvdWdoIGl0cyBuZXR3b3Jrcy48YnI+KioqKioqKioqKioqKioqKioqKioqKioqKioqKioq KioqKioqKioqKioqKio8L2Rpdj48L2Rpdj48L3NwYW4+PC9zcGFuPg0KPC9kaXY+DQo8YnI+PGRp dj48ZGl2Pk9uIERlYyA2LCAyMDEwLCBhdCAxMTozNyBQTSwgSm9obiBQaGlsbGlwcyB3cm90ZTo8 L2Rpdj48YnIgY2xhc3M9IkFwcGxlLWludGVyY2hhbmdlLW5ld2xpbmUiPjxibG9ja3F1b3RlIHR5 cGU9ImNpdGUiPjxzcGFuIGNsYXNzPSJBcHBsZS1zdHlsZS1zcGFuIiBzdHlsZT0iYm9yZGVyLWNv bGxhcHNlOiBzZXBhcmF0ZTsgZm9udC1mYW1pbHk6IEhlbHZldGljYTsgZm9udC1zdHlsZTogbm9y bWFsOyBmb250LXZhcmlhbnQ6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNw YWNpbmc6IG5vcm1hbDsgbGluZS1oZWlnaHQ6IG5vcm1hbDsgb3JwaGFuczogMjsgdGV4dC1pbmRl bnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdpZG93 czogMjsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtYm9yZGVyLWhvcml6b250YWwtc3BhY2lu ZzogMHB4OyAtd2Via2l0LWJvcmRlci12ZXJ0aWNhbC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4 dC1kZWNvcmF0aW9ucy1pbi1lZmZlY3Q6IG5vbmU7IC13ZWJraXQtdGV4dC1zaXplLWFkanVzdDog YXV0bzsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyBmb250LXNpemU6IG1lZGl1bTsg Ij48ZGl2IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj48ZGl2IGNsYXNz PSJXb3JkU2VjdGlvbjEiIHN0eWxlPSJwYWdlOiBXb3JkU2VjdGlvbjE7ICI+PGRpdiBzdHlsZT0i bWFyZ2luLXRvcDogMGluOyBtYXJnaW4tcmlnaHQ6IDBpbjsgbWFyZ2luLWJvdHRvbTogMC4wMDAx cHQ7IG1hcmdpbi1sZWZ0OiAwaW47IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGli cmksIHNhbnMtc2VyaWY7ICI+R2VudGxlbWVuLDxvOnA+PC9vOnA+PC9kaXY+PGRpdiBzdHlsZT0i bWFyZ2luLXRvcDogMGluOyBtYXJnaW4tcmlnaHQ6IDBpbjsgbWFyZ2luLWJvdHRvbTogMC4wMDAx cHQ7IG1hcmdpbi1sZWZ0OiAwaW47IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGli cmksIHNhbnMtc2VyaWY7ICI+PG86cD4mbmJzcDs8L286cD48L2Rpdj48ZGl2IHN0eWxlPSJtYXJn aW4tdG9wOiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4tYm90dG9tOiAwLjAwMDFwdDsg bWFyZ2luLWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwg c2Fucy1zZXJpZjsgIj5Zb3VyIGZlZWRiYWNrIGlzIG11Y2ggYXBwcmVjaWF0ZWQuJm5ic3A7IEl0 knMgYSB3b3JrIGluIHByb2dyZXNzLjxvOnA+PC9vOnA+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2lu LXRvcDogMGluOyBtYXJnaW4tcmlnaHQ6IDBpbjsgbWFyZ2luLWJvdHRvbTogMC4wMDAxcHQ7IG1h cmdpbi1sZWZ0OiAwaW47IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7ICI+PG86cD4mbmJzcDs8L286cD48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9w OiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4tYm90dG9tOiAwLjAwMDFwdDsgbWFyZ2lu LWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1z ZXJpZjsgIj5UaGFuayB5b3UsPG86cD48L286cD48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9w OiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4tYm90dG9tOiAwLjAwMDFwdDsgbWFyZ2lu LWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1z ZXJpZjsgIj5Kb2huPG86cD48L286cD48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOiAwaW47 IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4tYm90dG9tOiAwLjAwMDFwdDsgbWFyZ2luLWxlZnQ6 IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsg Ij48bzpwPiZuYnNwOzwvbzpwPjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbi10b3A6IDBpbjsgbWFy Z2luLXJpZ2h0OiAwaW47IG1hcmdpbi1ib3R0b206IDAuMDAwMXB0OyBtYXJnaW4tbGVmdDogMGlu OyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyAiPjxi PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ2FtYnJpYSwgc2VyaWY7IGNvbG9yOiBibGFjazsg Ij5Kb2huIFBoaWxsaXBzPC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENhbWJy aWEsIHNlcmlmOyAiPjxvOnA+PC9vOnA+PC9zcGFuPjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbi10 b3A6IDBpbjsgbWFyZ2luLXJpZ2h0OiAwaW47IG1hcmdpbi1ib3R0b206IDAuMDAwMXB0OyBtYXJn aW4tbGVmdDogMGluOyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5z LXNlcmlmOyAiPjxiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ2FtYnJpYSwgc2VyaWY7ICI+ VmljZSBQcmVzaWRlbnQsIEdsb2JhbCBTYWxlczwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiBDYW1icmlhLCBzZXJpZjsgIj48bzpwPjwvbzpwPjwvc3Bhbj48L2Rpdj48ZGl2IHN0 eWxlPSJtYXJnaW4tdG9wOiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4tYm90dG9tOiAw LjAwMDFwdDsgbWFyZ2luLWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTog Q2FsaWJyaSwgc2Fucy1zZXJpZjsgIj48Yj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENhbWJy aWEsIHNlcmlmOyAiPlVudmVpbGxhbmNlPC9zcGFuPjwvYj48Yj48bzpwPjwvbzpwPjwvYj48L2Rp dj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4t Ym90dG9tOiAwLjAwMDFwdDsgbWFyZ2luLWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250 LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsgIj48Yj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6IENhbWJyaWEsIHNlcmlmOyAiPjUxMi42VU4uVkVJTDxvOnA+PC9vOnA+PC9zcGFuPjwvYj48 L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJn aW4tYm90dG9tOiAwLjAwMDFwdDsgbWFyZ2luLWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBm b250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsgIj48Yj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk6IENhbWJyaWEsIHNlcmlmOyAiPjUxMi42ODYuODM0NTwvc3Bhbj48L2I+PG86cD48L286 cD48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBt YXJnaW4tYm90dG9tOiAwLjAwMDFwdDsgbWFyZ2luLWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0 OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsgIj48Yj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6IENhbWJyaWEsIHNlcmlmOyAiPjxhIGhyZWY9Im1haWx0bzpqcGhpbGxpcHNAeW9y ZWwuY29tIiB0YXJnZXQ9Il9ibGFuayIgc3R5bGU9ImNvbG9yOiBibHVlOyB0ZXh0LWRlY29yYXRp b246IHVuZGVybGluZTsgIj48c3BhbiBzdHlsZT0iY29sb3I6IGJsdWU7ICI+anBoaWxsaXBzQHVu dmVpbGxhbmNlLmNvbTwvc3Bhbj48L2E+PC9zcGFuPjwvYj48Yj48bzpwPjwvbzpwPjwvYj48L2Rp dj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4t Ym90dG9tOiAwLjAwMDFwdDsgbWFyZ2luLWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250 LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsgIj48bzpwPiZuYnNwOzwvbzpwPjwvZGl2Pjxk aXYgc3R5bGU9Im1hcmdpbi10b3A6IDBpbjsgbWFyZ2luLXJpZ2h0OiAwaW47IG1hcmdpbi1ib3R0 b206IDAuMDAwMXB0OyBtYXJnaW4tbGVmdDogMGluOyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFt aWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyBsaW5lLWhlaWdodDogMTVwdDsgYmFja2dyb3VuZC1p bWFnZTogaW5pdGlhbDsgYmFja2dyb3VuZC1hdHRhY2htZW50OiBpbml0aWFsOyBiYWNrZ3JvdW5k LW9yaWdpbjogaW5pdGlhbDsgYmFja2dyb3VuZC1jbGlwOiBpbml0aWFsOyBiYWNrZ3JvdW5kLWNv bG9yOiB3aGl0ZTsgIj48YSBocmVmPSJodHRwOi8vdW52ZWlsbGFuY2UuY29tLyIgdGl0bGU9IiZx dW90O1VudmVpbGxhbmNlIHwgRGF0YSBMZWFrYWdlIEludGVsbGlnZW5jZSAmYW1wOyBNZXRyaWNz JnF1b3Q7ICIgc3R5bGU9ImNvbG9yOiBibHVlOyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsg Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOiA5cHQ7IGZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1z ZXJpZjsgY29sb3I6IHJnYigzMCwgMTUxLCAxODUpOyB0ZXh0LWRlY29yYXRpb246IG5vbmU7ICI+ PHNwYW4+Jmx0O2ltYWdlMDAxLnBuZyZndDs8L3NwYW4+PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOiA5cHQ7IGZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjsgY29sb3I6IHJn YigxMDIsIDEwMiwgMTAyKTsgIj48bzpwPjwvbzpwPjwvc3Bhbj48L2Rpdj48ZGl2IHN0eWxlPSJt YXJnaW4tdG9wOiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4tYm90dG9tOiAwLjAwMDFw dDsgbWFyZ2luLWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJy aSwgc2Fucy1zZXJpZjsgIj48YSBocmVmPSJodHRwOi8vdW52ZWlsbGFuY2UuY29tLyIgc3R5bGU9 ImNvbG9yOiBibHVlOyB0ZXh0LWRlY29yYXRpb246IHVuZGVybGluZTsgIj48c3BhbiBzdHlsZT0i Y29sb3I6IGJsdWU7ICI+VW52ZWlsbGFuY2UgfCBEYXRhIExlYWthZ2UgSW50ZWxsaWdlbmNlICZh bXA7IE1ldHJpY3M8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2lu LXRvcDogMGluOyBtYXJnaW4tcmlnaHQ6IDBpbjsgbWFyZ2luLWJvdHRvbTogMC4wMDAxcHQ7IG1h cmdpbi1sZWZ0OiAwaW47IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNh bnMtc2VyaWY7ICI+PG86cD4mbmJzcDs8L286cD48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9w OiAwaW47IG1hcmdpbi1yaWdodDogMGluOyBtYXJnaW4tYm90dG9tOiAwLjAwMDFwdDsgbWFyZ2lu LWxlZnQ6IDBpbjsgZm9udC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1z ZXJpZjsgIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOiAxMC41cHQ7IGZvbnQtZmFtaWx5OiBDb25z b2xhczsgIj4qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKjxvOnA+ PC9vOnA+PC9zcGFuPjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbi10b3A6IDBpbjsgbWFyZ2luLXJp Z2h0OiAwaW47IG1hcmdpbi1ib3R0b206IDAuMDAwMXB0OyBtYXJnaW4tbGVmdDogMGluOyBmb250 LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBzYW5zLXNlcmlmOyAiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6IDEwLjVwdDsgZm9udC1mYW1pbHk6IENvbnNvbGFzOyAiPkNPTkZJREVO VElBTCAmYW1wOyBQUklWSUxFR0VEIENPTU1VTklDQVRJT04gVGhpcyBtZXNzYWdlIGlzIGZvciB0 aGUgbmFtZWQgcGVyc29uJ3MgdXNlIG9ubHkuIFRoZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4g dGhpcyBjb21tdW5pY2F0aW9uIGlzIGNvbmZpZGVudGlhbCBhbmQvb3IgcHJpdmlsZWdlZCwgcHJv cHJpZXRhcnkgaW5mb3JtYXRpb24gdGhhdCBpcyB0cmFuc21pdHRlZCBzb2xlbHkgZm9yIHRoZSBw dXJwb3NlIG9mIHRoZSBpbnRlbmRlZCByZWNpcGllbnQocykuIE5vIGNvbmZpZGVudGlhbGl0eSBv ciBwcml2aWxlZ2UgaXMgd2FpdmVkIG9yIGxvc3QgYnkgYW55IG1pc3RyYW5zbWlzc2lvbi48bzpw PjwvbzpwPjwvc3Bhbj48L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW4tdG9wOiAwaW47IG1hcmdpbi1y aWdodDogMGluOyBtYXJnaW4tYm90dG9tOiAwLjAwMDFwdDsgbWFyZ2luLWxlZnQ6IDBpbjsgZm9u dC1zaXplOiAxMXB0OyBmb250LWZhbWlseTogQ2FsaWJyaSwgc2Fucy1zZXJpZjsgIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOiAxMC41cHQ7IGZvbnQtZmFtaWx5OiBDb25zb2xhczsgIj5JZiB5b3Ug cmVjZWl2ZSB0aGlzIG1lc3NhZ2UgaW4gZXJyb3IsIHBsZWFzZSBpbW1lZGlhdGVseSBkZWxldGUg aXQgYW5kIGFsbCBjb3BpZXMgb2YgaXQgZnJvbSB5b3VyIHN5c3RlbSwgZGVzdHJveSBhbnkgaGFy ZCBjb3BpZXMgb2YgaXQgYW5kIG5vdGlmeSB0aGUgc2VuZGVyLiBZb3UgbXVzdCBub3QsIGRpcmVj dGx5IG9yIGluZGlyZWN0bHksIHVzZSwgZGlzY2xvc2UsIGRpc3RyaWJ1dGUsIHByaW50LCBvciBj b3B5IGFueSBwYXJ0IG9mIHRoaXMgbWVzc2FnZSBpZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQg cmVjaXBpZW50LiBUaGUgc2VuZGVyIG9yIGFueSBvZiBpdHMgc3Vic2lkaWFyaWVzIGVhY2ggcmVz ZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb25zIHRocm91 Z2ggaXRzIG5ldHdvcmtzLjxvOnA+PC9vOnA+PC9zcGFuPjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdp bi10b3A6IDBpbjsgbWFyZ2luLXJpZ2h0OiAwaW47IG1hcmdpbi1ib3R0b206IDAuMDAwMXB0OyBt YXJnaW4tbGVmdDogMGluOyBmb250LXNpemU6IDExcHQ7IGZvbnQtZmFtaWx5OiBDYWxpYnJpLCBz YW5zLXNlcmlmOyAiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6IDEwLjVwdDsgZm9udC1mYW1pbHk6 IENvbnNvbGFzOyAiPioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioq PG86cD48L286cD48L3NwYW4+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luLXRvcDogMGluOyBtYXJn aW4tcmlnaHQ6IDBpbjsgbWFyZ2luLWJvdHRvbTogMC4wMDAxcHQ7IG1hcmdpbi1sZWZ0OiAwaW47 IGZvbnQtc2l6ZTogMTFwdDsgZm9udC1mYW1pbHk6IENhbGlicmksIHNhbnMtc2VyaWY7ICI+PG86 cD4mbmJzcDs8L286cD48L2Rpdj48L2Rpdj48c3Bhbj4mbHQ7RExJX092ZXJ2aWV3LnBkZiZndDs8 L3NwYW4+PC9kaXY+PC9zcGFuPjwvYmxvY2txdW90ZT48L2Rpdj48YnI+PC9ib2R5PjwvaHRtbD4N Cg== --part20962-boundary-943575488-861334895-- From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs137443yhg; Tue, 7 Dec 2010 04:35:47 -0800 (PST) Received: by 10.151.27.8 with SMTP id e8mr1702603ybj.280.1291725346335; Tue, 07 Dec 2010 04:35:46 -0800 (PST) Return-Path: Received: from mail-gw0-f52.google.com (mail-gw0-f52.google.com [74.125.83.52]) by mx.google.com with ESMTP id u7si855311ybe.13.2010.12.07.04.35.46; Tue, 07 Dec 2010 04:35:46 -0800 (PST) Received-SPF: neutral (google.com: 74.125.83.52 is neither permitted nor denied by best guess record for domain of jphillips@unveillance.com) client-ip=74.125.83.52; Authentication-Results: mx.google.com; spf=neutral (google.com: 74.125.83.52 is neither permitted nor denied by best guess record for domain of jphillips@unveillance.com) smtp.mail=jphillips@unveillance.com Received: by gwb11 with SMTP id 11so2470626gwb.11 for ; Tue, 07 Dec 2010 04:35:46 -0800 (PST) Received: by 10.150.185.20 with SMTP id i20mr1612783ybf.397.1291725345773; Tue, 07 Dec 2010 04:35:45 -0800 (PST) Return-Path: Received: from bda2475.bisx.prod.on.blackberry (bda-67-223-77-219.bise.na.blackberry.com [67.223.77.219]) by mx.google.com with ESMTPS id 37sm1593775yhl.21.2010.12.07.04.35.43 (version=SSLv3 cipher=RC4-MD5); Tue, 07 Dec 2010 04:35:44 -0800 (PST) X-rim-org-msg-ref-id: 1255592924 Message-ID: <1255592924-1291725342-cardhu_decombobulator_blackberry.rim.net-805563546-@bda480.bisx.prod.on.blackberry> Reply-To: jphillips@unveillance.com X-Priority: Normal Sensitivity: Normal Importance: Normal Subject: NDA To: "Karim Hijazi Unveillance Email" From: "John Phillips" Date: Tue, 7 Dec 2010 12:35:42 +0000 Content-Type: text/plain MIME-Version: 1.0 Karim, Please send to maynard316@gmail.com Thank you, John John Phillips Vice President, Global Sales Unveillance 512.6UN.VEIL 512.686.8345 jphillips@unveillance.com http://www.unveillance.com From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs138814yhg; Tue, 7 Dec 2010 05:24:05 -0800 (PST) Received: by 10.150.139.3 with SMTP id m3mr1803711ybd.267.1291728243861; Tue, 07 Dec 2010 05:24:03 -0800 (PST) Return-Path: Received: from atl-exch03.internal.earthlink.net (eef01-eef02-nsrp.ga-atlanta0.ne.earthlink.net [207.69.174.4]) by mx.google.com with ESMTP id i65si4125819yha.187.2010.12.07.05.24.03; Tue, 07 Dec 2010 05:24:03 -0800 (PST) Received-SPF: pass (google.com: domain of chronispe@corp.earthlink.net designates 207.69.174.4 as permitted sender) client-ip=207.69.174.4; Authentication-Results: mx.google.com; spf=pass (google.com: domain of chronispe@corp.earthlink.net designates 207.69.174.4 as permitted sender) smtp.mail=chronispe@corp.earthlink.net Received: from atl-exch07.internal.earthlink.net (10.10.62.43) by ATL-EXCH03.internal.earthlink.net (10.10.251.13) with Microsoft SMTP Server (TLS) id 8.2.254.0; Tue, 7 Dec 2010 08:24:03 -0500 Received: from atl-exch07.internal.earthlink.net ([10.10.62.43]) by atl-exch07.internal.earthlink.net ([10.10.62.43]) with mapi; Tue, 7 Dec 2010 08:24:03 -0500 From: Peter Chronis To: John Phillips CC: "khijazi@unveillance.com" Date: Tue, 7 Dec 2010 08:24:01 -0500 Subject: RE: Zeus C&C Domain Thread-Topic: Zeus C&C Domain Thread-Index: AcuVjxeY1MvGN9FNSEWpkzyLRkDR/wAgmRlA Message-ID: <2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6@atl-exch07.internal.earthlink.net> References: <001701cb958f$181e1e00$485a5a00$@com> In-Reply-To: <001701cb958f$181e1e00$485a5a00$@com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/related; boundary="_004_2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6atlexch07inte_"; type="multipart/alternative" MIME-Version: 1.0 Return-Path: chronispe@corp.earthlink.net --_004_2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6atlexch07inte_ Content-Type: multipart/alternative; boundary="_000_2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6atlexch07inte_" --_000_2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6atlexch07inte_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable John, We are not hosting clickxsearche.com. The domain owner has published an R= DNS entry that points to our webhosting VIP. So, at this point, we are una= ble to track further. We believe that the RDNS may be significant because = it may be used in conjunction with other information to get to content host= ed somewhere on our hosting farm. Right now, are unable to isolate the ELN= K domain hosting account without some IPs from your honeypots. Let me know if you can provide. Thanks. Pete From: John Phillips [mailto:jphillips@unveillance.com] Sent: Monday, December 06, 2010 4:47 PM To: Peter Chronis Cc: khijazi@unveillance.com Subject: Zeus C&C Domain Peter, As Karim discussed, we lifted up the Zeus domain in order to expedite your = identification of the infected system. Please let me know when I can give = you a call to discuss if this meets your immediate needs. Thank you, John John Phillips Vice President, Global Sales Unveillance 512.6UN.VEIL 512.686.8345 jphillips@unveillance.com [cid:image001.png@01CB95E8.0B699050] Unveillance | Data Leakage Intelligence & Metrics ******************************************** CONFIDENTIAL & PRIVILEGED COMMUNICATION This message is for the named perso= n's use only. The information contained in this communication is confidenti= al and/or privileged, proprietary information that is transmitted solely fo= r the purpose of the intended recipient(s). No confidentiality or privilege= is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all = copies of it from your system, destroy any hard copies of it and notify the= sender. You must not, directly or indirectly, use, disclose, distribute, p= rint, or copy any part of this message if you are not the intended recipien= t. The sender or any of its subsidiaries each reserve the right to monitor = all e-mail communications through its networks. ******************************************** --_000_2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6atlexch07inte_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

John,

We are not hosting clickxsearche.com. Th= e domain owner has published an RDNS entry that points to our webhosting VI= P. So, at this point, we are unable to track further. We believ= e that the RDNS may be significant because it may be used in conjunction wi= th other information to get to content hosted somewhere on our hosting farm= . Right now, are unable to isolate the ELNK domain hosting account wi= thout some IPs from your honeypots.

Let me know if you can provide.

Thank= s.

Pete

F= rom: John Phillips [mailto:jphillips@unveillance.com]
Sent: M= onday, December 06, 2010 4:47 PM
To: Peter Chronis
Cc: = khijazi@unveillance.com
Subject: Zeus C&C Domain

Peter,

As Karim discussed, we lifted up the Zeus domain in order= to expedite your identification of the infected system. Please let m= e know when I can give you a call to discuss if this meets your immediate n= eeds.

Thank you,

John

John Phillips

Vice President, = Global Sales<= /o:p>

Unveillance

512.6UN.VEIL

512.686.8345

jphillips@unveillance.com

Unveil= lance | Data Leakage Intelligence & Metrics

*****************************************= ***

CONFIDENTIAL & PRIVILEGED COMMUNICATION This m= essage is for the named person's use only. The information contained in thi= s communication is confidential and/or privileged, proprietary information = that is transmitted solely for the purpose of the intended recipient(s). No= confidentiality or privilege is waived or lost by any mistransmission.

If you receive this message in error, please immediately = delete it and all copies of it from your system, destroy any hard copies of= it and notify the sender. You must not, directly or indirectly, use, discl= ose, distribute, print, or copy any part of this message if you are not the= intended recipient. The sender or any of its subsidiaries each reserve the= right to monitor all e-mail communications through its networks.

********************************************<= /p>

= --_000_2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6atlexch07inte_-- --_004_2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6atlexch07inte_ Content-Type: image/png; name="image001.png" Content-Description: image001.png Content-Disposition: inline; filename="image001.png"; size=3700; creation-date="Tue, 07 Dec 2010 08:24:02 GMT"; modification-date="Tue, 07 Dec 2010 08:24:02 GMT" Content-ID: Content-Transfer-Encoding: base64 iVBORw0KGgoAAAANSUhEUgAAASwAAACMCAYAAADGFpQvAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJ bWFnZVJlYWR5ccllPAAAA2RpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdp bj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6 eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEz NDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJo dHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlw dGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEu MC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVz b3VyY2VSZWYjIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtcE1N Ok9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRpZDpBNDkwQTE2OUY3OTVERjExQUYxOTg5M0M1MjdF NzczQiIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDoxMTYwN0FBQ0M4RDUxMURGOUFDQTlERTJF QTM5MjAxOSIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDoxMTYwN0FBQkM4RDUxMURGOUFDQTlE RTJFQTM5MjAxOSIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M1IFdpbmRvd3Mi PiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDozQTExOTQ3NUQw QzhERjExOEUzQjhGMzM2OEJGMjUwOSIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDpBNDkwQTE2 OUY3OTVERjExQUYxOTg5M0M1MjdFNzczQiIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRG PiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PruwPTQAAAqmSURBVHja7J2NbSI5FMed aBsgHRxp4CTQbgOkBCghlAAlMCVACUwJ0EBWIN0VEO4qCCVwftnnPcd4vmf4kH4/aZRdGPwxfv77 PY/H83A6nQwAwD3wyCUAAAQLAADBAgAECwAAwQIAQLAAAMECAECwAAAQLABAsAAAECwAAAQLABAs AAAECwAAwQIABAsAAMECAECwAADBAgBAsAAAECwAQLAAABAsAAAECwAQLAAABAsAAMECAAQLAADB AgAECwAAwQIAQLAAAMECAECwAAAQLABAsAAAECwAAAQLABAsAAAECwAAwQIABAsAAMECAECwAADB AgBAsAAAECwAQLAAABAsAAAECwDunm/+f1Z//zuyfzbBOc/TP/84VEl0+dc/7/ZP3/tobtNIcs6X fEf2nHmTyth0pOyjMvnac/taV7+cUs+h/c2xZv5j+2cdfLyy6U0L6r5poS0z2ykjj9x2rfObqnz/ /j2ax8+fPw/X7BS2XAv7J7Xl2Ldc15FNc94wnTMbt2kmDdIbaHrSD14zTnNlXtm8jg3atpZdv729 HW7Rw5qJ0Gmn7xzteJPgY2m0ZU2xiv12nydWcHtoR5vJwGP/3Wvbxm2a7/YY30A9P8ti/7mzxyJH rIx+L8eHCOY1y39rIaF0+rXt/GsVgK5Fa++NHo6xzXtWIznxrHwDP0YEEW5brHreoFN78Cpj4zYv OfpXqONIhWoRRBdlGWn5Nx0IerWQ8IYYq3DkhpItiVZi8xlonr9HFPvZVgWtjHclAjcI3egG4VOr oReUd5SDTjwWT6RJyFVk4zb9eUfpR70qFaoQsfPUHtswDFZvqq9epxOorXSdsuFhm+H+txs3oIWG iNL5t13qlgqOb6zi5RXOZ6nYhUaQ2t+t6P935V3NgkHLD+PSDufVFioKIlzbjusX2ulBhSczX/td qv9MNI2j/exqtn0PdwlFEDZWGJb26MQFVVGqPJ+l5VnHjAAJuCuxGmR4Hka9ivUlbNyWY9lFmJVR PxGpYRWRFE/wmmJ1L4LlkElBmZR/7Ui0xBUOXfNxwU2AZWQeYFL3LiNcjVCQwvYb6J3Di9i4zatt G59FBtVJjZDu6txySJhELvTnpKiKyLTteR5ZVqG38/35KMlvH+al81ahmM3LznsVIMJc9TfMe9Xz PmKTz+JtjwL7k9Bw74VIndq4honTpqGoemyhna6uJFYixpXtWgX25j2slRY25rKOtFPPOsh3Eoyw ZyGB3sE8c7G7vkEArYvVOCIYEvZsdb1UOPgsW76zV2jjOm/UNNw0kXDwLrnpkFA8Bnu8RETEsdC1 W6M28zTnc1ADm8eiIIRg3uq+xCq6bi5Y2BkbvFpd6iAelD1ybVzXbo1otdu/S+hERNzwVCbezfkC t88V6/a71HxdB9UoP5te6K7Lwta9jljhqNV2eEp41z2F6+ZETKxQJIE3PepiqYOGmqlMvGfZuNyt rGHj+wzvbX+Fa954WUPoYcUSqyMCXd3NEy9mmHGxxxnub9285pHrsY6FECqocD/e1SI26MQ6kwpT GvF6Bl2UzebXqo3rXFUYAr5eY9Fn6yGhjupho1WKoTV06nUVM8uktj2GFwrBilaq75s+/wgXF6tB hk3L6u1T7DDx9Vnrrjq9LN60R5s2Po94bOt7FK3YHFbs1v66zBooFavQGNKW7pyFwiUTlk+R0a/N PGKP7mSGEHDzYtXmmqquHt3xhasVG9fV6/NIWLirMjemzx++XrMNHzOEIIm4oh9yV05Xdvsi1dPP 3yNite/SE5L1TvYQ0XjJCGfbyCPJMJiEeaa7I7ZurgnjrjuwhHT2aGzjGtrGPC2ZG9upGA0iIjXW 7z7Mr7m8pT5H2L9GA37Lmr+xAnQ057fuFypSZdKWMPAiiyj1sZ1nXebQxQK/8NGdtOMlDLe6DusS 5aq1VqdoMjfj0ZvKz/FJ5zZf55FkPmvb9ZY4uiL9Oed5wFKiJWvJIsL9+0ZSyWs/UuGquvi0u3VY 2iGHNdzRgwrVy6VXfGuZs9a1NPLkPE+RR2/uLxSMPu9Z805f4Tq9joWrkY3rGrNn9bbqiOynIyJL Ma6x+PSxaA5HQy5XwVVOJeR7Eanna941C9Zute3FJYZHb+5NrPqmxec91ZM6W6enyxEuJVr+2q3a wqfCNSzo20a/l+NJhepq/fvhdDph1QBwF7CnOwAgWAAACBYAIFgAAAgWAACCBQAIFgAAggUAgGAB AIIFAIBgAQAgWACAYAEA3ARfNvD78eNHbHMw2XZCtpbI2lJlY35ttxHbW0d2KYxtrSxpPUU+lw3W Rqbc1h8fXtlCZP+jXeRz2Y4jrVAHl4773Vivz0H/H9uSw32ftV2H25tplHONY9ctyairbJ0iW6gM vbqsgnpKfq/eNS/TLnllCK9LiLOjpwy7CctstHyv5v/N8Y6aX1KyTZd63ZPAntbm60sd+lo+f6fQ 1Py/P1RV2ylrv2XKtzZfNxkMr4HJuJZZe1uttcyp1yYhro3K2ERYPve9vz1NrG3d5omubV3/SLw2 WZv4CzaGb29v+yIPSwr4YH7tg9XXBuxlNELeBmYuHbdvz1D/HxMrt0f2wJy/5qguE83PHWmNOhj9 fqMNLhf5JUOQXtVgY28Tdt/vtMEevGtxiJyfBGUv+7KLgdZlY7K3Ay7bLnXLUJWlXrPUy+tFO0Ov ZJv2NI2dib80wni23PeuwYNe/14N26liv2XKZ1S4XJ5TPXeTc/7nC1fN1+3Jx/rZOKft3XGsaBP7 4Pcrk7/19FLLtsqxI9dfHiLHvkpIeNDE+5HKu9HQjQ6bhkbrRopJxANpkubJO+rWYanlGeZ4Tu5t 0BOtxybSCdz74NwIvNORbWHOX2gwC8peZVvclbbdu2n2ooQmZajC2Btxe5rXzjP2sm2697ytmGCP Nf1w19DYW56LbKeO/RaVL8R5RyOT/3qvlZ6z0XJI/tucyMSvV9U35wyC38+0jIeCtl0F9UqC638I 0j1F2r5QsPpBCOR3vKVXeOdZ1H2t9kbTWmon63meT1ceVpU6TNUAdjmjpxOod2/ECb22rRcSulHs ycTfQdfEu3FbOj97IVAdLuVhpV5IeNS8hhnhZJHnk3he6yKSz9Gcv0R1VtM7r2O/eeWLdfax2s2+ oL1fvPrlbaGc5WGVZR94V1uTv/Op37Z+vQaBYzSM2NpZpPJYoMLvXmJHT2GXEWN+8eZKqoYDg8iF PEQMq6oHkDVKVq2DM4i55rnxznHh5DFI68mcvwpqpY3rj1IfagSTDrybg5Z7Yuq96bfu9a06mk+1 LV69czcZc5RlPZ9ppOM6Wz4EZRtE0imbT137nWYIi28bS+3wLxU866L536YeVliHXkY0kde2i+B6 riPe1SI2N8cWyQBwN7CsAQAQLAAABAsAECwAAAQLAADBAgAECwAAwQIAQLAAAMECAECwAAAQLABA sAAAECwAAAQLABAsAAAECwAAwQIABAsAAMECAECwAADBAgBAsAAAECwAQLAAABAsAAAECwAQLAAA BAsAECwuAQAgWAAACBYAIFgAAAgWAACCBQAIFgAAggUAgGABAIIFAIBgAQAgWACAYAEAIFgAAAgW ACBYAAAIFgAAggUACBYAAIIFAIBgAQCCBQBwMf4TYABnSyaseQPydAAAAABJRU5ErkJggg== --_004_2ED4195B883A1149B9F7AA6BBB8313F61657DCE6B6atlexch07inte_-- From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs121083yhg; Mon, 6 Dec 2010 18:07:23 -0800 (PST) Received: by 10.90.253.6 with SMTP id a6mr8936006agi.41.1291687643389; Mon, 06 Dec 2010 18:07:23 -0800 (PST) Return-Path: Received: from mail-gx0-f177.google.com (mail-gx0-f177.google.com [209.85.161.177]) by mx.google.com with ESMTP id c16si13009116anc.25.2010.12.06.18.07.22; Mon, 06 Dec 2010 18:07:23 -0800 (PST) Received-SPF: neutral (google.com: 209.85.161.177 is neither permitted nor denied by best guess record for domain of jphillips@unveillance.com) client-ip=209.85.161.177; Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.161.177 is neither permitted nor denied by best guess record for domain of jphillips@unveillance.com) smtp.mail=jphillips@unveillance.com Received: by gxk27 with SMTP id 27so3846902gxk.36 for ; Mon, 06 Dec 2010 18:07:22 -0800 (PST) Received: by 10.100.225.2 with SMTP id x2mr4487473ang.214.1291687642667; Mon, 06 Dec 2010 18:07:22 -0800 (PST) Return-Path: Received: from DevComp1 (h209.63.91.75.dynamic.ip.windstream.net [75.91.63.209]) by mx.google.com with ESMTPS id p9sm1291776anf.7.2010.12.06.18.07.21 (version=TLSv1/SSLv3 cipher=RC4-MD5); Mon, 06 Dec 2010 18:07:21 -0800 (PST) From: "John Phillips" To: "'J. Tubbs'" Cc: Subject: Now this is a great botnet detection idea Date: Mon, 6 Dec 2010 21:07:20 -0500 Message-ID: <008101cb95b3$7ba11530$72e33f90$@com> MIME-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_0082_01CB9589.92CB0D30" X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcuVs3sKkGhHpZCnQXSnrNjnCoPExw== Content-Language: en-us This is a multi-part message in MIME format. ------=_NextPart_000_0082_01CB9589.92CB0D30 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0083_01CB9589.92CB0D30" ------=_NextPart_001_0083_01CB9589.92CB0D30 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit http://botnet-tracker.blogspot.com/2010/12/ddos-attacks-make-wikileaks-great .html John Phillips Vice President, Global Sales Unveillance 512.6UN.VEIL 512.686.8345 jphillips@unveillance.com http://unveillance.com/wp-content/themes/creation/images/logo.png Unveillance | Data Leakage Intelligence & Metrics ******************************************** CONFIDENTIAL & PRIVILEGED COMMUNICATION This message is for the named person's use only. The information contained in this communication is confidential and/or privileged, proprietary information that is transmitted solely for the purpose of the intended recipient(s). No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. The sender or any of its subsidiaries each reserve the right to monitor all e-mail communications through its networks. ******************************************** ------=_NextPart_001_0083_01CB9589.92CB0D30 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
http://botnet-tracker.blogspot.com/2010/12/ddos-attacks= -make-wikileaks-great.html

John = Phillips
Vice = President, Global Sales
Unveillance
512.6UN.VEIL
512.686.8345
jphillips@unveillance.com

=
Unveillance = | Data Leakage Intelligence & Metrics

*************************= *******************
CONFIDENTIAL & = PRIVILEGED COMMUNICATION This message is for the named person's use = only. The information contained in this communication is confidential = and/or privileged, proprietary information that is transmitted solely = for the purpose of the intended recipient(s). No confidentiality or = privilege is waived or lost by any = mistransmission.
If you receive this = message in error, please immediately delete it and all copies of it from = your system, destroy any hard copies of it and notify the sender. You = must not, directly or indirectly, use, disclose, distribute, print, or = copy any part of this message if you are not the intended recipient. The = sender or any of its subsidiaries each reserve the right to monitor all = e-mail communications through its networks.
*************************= *******************

------=_NextPart_001_0083_01CB9589.92CB0D30-- ------=_NextPart_000_0082_01CB9589.92CB0D30 Content-Type: image/png; name="image001.png" Content-Transfer-Encoding: base64 Content-ID: iVBORw0KGgoAAAANSUhEUgAAASwAAACMCAYAAADGFpQvAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJ bWFnZVJlYWR5ccllPAAAA2RpVFh0WE1MOmNvbS5hZG9iZS54bXAAAAAAADw/eHBhY2tldCBiZWdp bj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+IDx4OnhtcG1ldGEgeG1sbnM6 eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDUuMC1jMDYwIDYxLjEz NDc3NywgMjAxMC8wMi8xMi0xNzozMjowMCAgICAgICAgIj4gPHJkZjpSREYgeG1sbnM6cmRmPSJo dHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4gPHJkZjpEZXNjcmlw dGlvbiByZGY6YWJvdXQ9IiIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEu MC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvc1R5cGUvUmVz b3VyY2VSZWYjIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtcE1N Ok9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRpZDpBNDkwQTE2OUY3OTVERjExQUYxOTg5M0M1MjdF NzczQiIgeG1wTU06RG9jdW1lbnRJRD0ieG1wLmRpZDoxMTYwN0FBQ0M4RDUxMURGOUFDQTlERTJF QTM5MjAxOSIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDoxMTYwN0FBQkM4RDUxMURGOUFDQTlE RTJFQTM5MjAxOSIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ1M1IFdpbmRvd3Mi PiA8eG1wTU06RGVyaXZlZEZyb20gc3RSZWY6aW5zdGFuY2VJRD0ieG1wLmlpZDozQTExOTQ3NUQw QzhERjExOEUzQjhGMzM2OEJGMjUwOSIgc3RSZWY6ZG9jdW1lbnRJRD0ieG1wLmRpZDpBNDkwQTE2 OUY3OTVERjExQUYxOTg5M0M1MjdFNzczQiIvPiA8L3JkZjpEZXNjcmlwdGlvbj4gPC9yZGY6UkRG PiA8L3g6eG1wbWV0YT4gPD94cGFja2V0IGVuZD0iciI/PruwPTQAAAqmSURBVHja7J2NbSI5FMed aBsgHRxp4CTQbgOkBCghlAAlMCVACUwJ0EBWIN0VEO4qCCVwftnnPcd4vmf4kH4/aZRdGPwxfv77 PY/H83A6nQwAwD3wyCUAAAQLAADBAgAECwAAwQIAQLAAAMECAECwAAAQLABAsAAAECwAAAQLABAs AAAECwAAwQIABAsAAMECAECwAADBAgBAsAAAECwAQLAAABAsAAAECwAQLAAABAsAAMECAAQLAADB AgAECwAAwQIAQLAAAMECAECwAAAQLABAsAAAECwAAAQLABAsAAAECwAAwQIABAsAAMECAECwAADB AgBAsAAAECwAQLAAABAsAAAECwDunm/+f1Z//zuyfzbBOc/TP/84VEl0+dc/7/ZP3/tobtNIcs6X fEf2nHmTyth0pOyjMvnac/taV7+cUs+h/c2xZv5j+2cdfLyy6U0L6r5poS0z2ykjj9x2rfObqnz/ /j2ax8+fPw/X7BS2XAv7J7Xl2Ldc15FNc94wnTMbt2kmDdIbaHrSD14zTnNlXtm8jg3atpZdv729 HW7Rw5qJ0Gmn7xzteJPgY2m0ZU2xiv12nydWcHtoR5vJwGP/3Wvbxm2a7/YY30A9P8ti/7mzxyJH rIx+L8eHCOY1y39rIaF0+rXt/GsVgK5Fa++NHo6xzXtWIznxrHwDP0YEEW5brHreoFN78Cpj4zYv OfpXqONIhWoRRBdlGWn5Nx0IerWQ8IYYq3DkhpItiVZi8xlonr9HFPvZVgWtjHclAjcI3egG4VOr oReUd5SDTjwWT6RJyFVk4zb9eUfpR70qFaoQsfPUHtswDFZvqq9epxOorXSdsuFhm+H+txs3oIWG iNL5t13qlgqOb6zi5RXOZ6nYhUaQ2t+t6P935V3NgkHLD+PSDufVFioKIlzbjusX2ulBhSczX/td qv9MNI2j/exqtn0PdwlFEDZWGJb26MQFVVGqPJ+l5VnHjAAJuCuxGmR4Hka9ivUlbNyWY9lFmJVR PxGpYRWRFE/wmmJ1L4LlkElBmZR/7Ui0xBUOXfNxwU2AZWQeYFL3LiNcjVCQwvYb6J3Di9i4zatt G59FBtVJjZDu6txySJhELvTnpKiKyLTteR5ZVqG38/35KMlvH+al81ahmM3LznsVIMJc9TfMe9Xz PmKTz+JtjwL7k9Bw74VIndq4honTpqGoemyhna6uJFYixpXtWgX25j2slRY25rKOtFPPOsh3Eoyw ZyGB3sE8c7G7vkEArYvVOCIYEvZsdb1UOPgsW76zV2jjOm/UNNw0kXDwLrnpkFA8Bnu8RETEsdC1 W6M28zTnc1ADm8eiIIRg3uq+xCq6bi5Y2BkbvFpd6iAelD1ybVzXbo1otdu/S+hERNzwVCbezfkC t88V6/a71HxdB9UoP5te6K7Lwta9jljhqNV2eEp41z2F6+ZETKxQJIE3PepiqYOGmqlMvGfZuNyt rGHj+wzvbX+Fa954WUPoYcUSqyMCXd3NEy9mmHGxxxnub9285pHrsY6FECqocD/e1SI26MQ6kwpT GvF6Bl2UzebXqo3rXFUYAr5eY9Fn6yGhjupho1WKoTV06nUVM8uktj2GFwrBilaq75s+/wgXF6tB hk3L6u1T7DDx9Vnrrjq9LN60R5s2Po94bOt7FK3YHFbs1v66zBooFavQGNKW7pyFwiUTlk+R0a/N PGKP7mSGEHDzYtXmmqquHt3xhasVG9fV6/NIWLirMjemzx++XrMNHzOEIIm4oh9yV05Xdvsi1dPP 3yNite/SE5L1TvYQ0XjJCGfbyCPJMJiEeaa7I7ZurgnjrjuwhHT2aGzjGtrGPC2ZG9upGA0iIjXW 7z7Mr7m8pT5H2L9GA37Lmr+xAnQ057fuFypSZdKWMPAiiyj1sZ1nXebQxQK/8NGdtOMlDLe6DusS 5aq1VqdoMjfj0ZvKz/FJ5zZf55FkPmvb9ZY4uiL9Oed5wFKiJWvJIsL9+0ZSyWs/UuGquvi0u3VY 2iGHNdzRgwrVy6VXfGuZs9a1NPLkPE+RR2/uLxSMPu9Z805f4Tq9joWrkY3rGrNn9bbqiOynIyJL Ma6x+PSxaA5HQy5XwVVOJeR7Eanna941C9Zute3FJYZHb+5NrPqmxec91ZM6W6enyxEuJVr+2q3a wqfCNSzo20a/l+NJhepq/fvhdDph1QBwF7CnOwAgWAAACBYAIFgAAAgWAACCBQAIFgAAggUAgGAB AIIFAIBgAQAgWACAYAEA3ARfNvD78eNHbHMw2XZCtpbI2lJlY35ttxHbW0d2KYxtrSxpPUU+lw3W Rqbc1h8fXtlCZP+jXeRz2Y4jrVAHl4773Vivz0H/H9uSw32ftV2H25tplHONY9ctyairbJ0iW6gM vbqsgnpKfq/eNS/TLnllCK9LiLOjpwy7CctstHyv5v/N8Y6aX1KyTZd63ZPAntbm60sd+lo+f6fQ 1Py/P1RV2ylrv2XKtzZfNxkMr4HJuJZZe1uttcyp1yYhro3K2ERYPve9vz1NrG3d5omubV3/SLw2 WZv4CzaGb29v+yIPSwr4YH7tg9XXBuxlNELeBmYuHbdvz1D/HxMrt0f2wJy/5qguE83PHWmNOhj9 fqMNLhf5JUOQXtVgY28Tdt/vtMEevGtxiJyfBGUv+7KLgdZlY7K3Ay7bLnXLUJWlXrPUy+tFO0Ov ZJv2NI2dib80wni23PeuwYNe/14N26liv2XKZ1S4XJ5TPXeTc/7nC1fN1+3Jx/rZOKft3XGsaBP7 4Pcrk7/19FLLtsqxI9dfHiLHvkpIeNDE+5HKu9HQjQ6bhkbrRopJxANpkubJO+rWYanlGeZ4Tu5t 0BOtxybSCdz74NwIvNORbWHOX2gwC8peZVvclbbdu2n2ooQmZajC2Btxe5rXzjP2sm2697ytmGCP Nf1w19DYW56LbKeO/RaVL8R5RyOT/3qvlZ6z0XJI/tucyMSvV9U35wyC38+0jIeCtl0F9UqC638I 0j1F2r5QsPpBCOR3vKVXeOdZ1H2t9kbTWmon63meT1ceVpU6TNUAdjmjpxOod2/ECb22rRcSulHs ycTfQdfEu3FbOj97IVAdLuVhpV5IeNS8hhnhZJHnk3he6yKSz9Gcv0R1VtM7r2O/eeWLdfax2s2+ oL1fvPrlbaGc5WGVZR94V1uTv/Op37Z+vQaBYzSM2NpZpPJYoMLvXmJHT2GXEWN+8eZKqoYDg8iF PEQMq6oHkDVKVq2DM4i55rnxznHh5DFI68mcvwpqpY3rj1IfagSTDrybg5Z7Yuq96bfu9a06mk+1 LV69czcZc5RlPZ9ppOM6Wz4EZRtE0imbT137nWYIi28bS+3wLxU866L536YeVliHXkY0kde2i+B6 riPe1SI2N8cWyQBwN7CsAQAQLAAABAsAECwAAAQLAADBAgAECwAAwQIAQLAAAMECAECwAAAQLABA sAAAECwAAAQLABAsAAAECwAAwQIABAsAAMECAECwAADBAgBAsAAAECwAQLAAABAsAAAECwAQLAAA BAsAECwuAQAgWAAACBYAIFgAAAgWAACCBQAIFgAAggUAgGABAIIFAIBgAQAgWACAYAEAIFgAAAgW ACBYAAAIFgAAggUACBYAAIIFAIBgAQCCBQBwMf4TYABnSyaseQPydAAAAABJRU5ErkJggg== ------=_NextPart_000_0082_01CB9589.92CB0D30-- From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs121321yhg; Mon, 6 Dec 2010 18:17:09 -0800 (PST) Received: by 10.150.178.15 with SMTP id a15mr693212ybf.382.1291688229402; Mon, 06 Dec 2010 18:17:09 -0800 (PST) Return-Path: Received: from mail-gx0-f177.google.com (mail-gx0-f177.google.com [209.85.161.177]) by mx.google.com with ESMTP id s4si13770362ybh.9.2010.12.06.18.17.09; Mon, 06 Dec 2010 18:17:09 -0800 (PST) Received-SPF: neutral (google.com: 209.85.161.177 is neither permitted nor denied by best guess record for domain of jtubbs@unveillance.com) client-ip=209.85.161.177; Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.161.177 is neither permitted nor denied by best guess record for domain of jtubbs@unveillance.com) smtp.mail=jtubbs@unveillance.com Received: by gxk27 with SMTP id 27so3852157gxk.36 for ; Mon, 06 Dec 2010 18:17:09 -0800 (PST) Received: by 10.90.25.11 with SMTP id 11mr8772133agy.119.1291688228955; Mon, 06 Dec 2010 18:17:08 -0800 (PST) Return-Path: Received: from [192.168.1.68] (99-1-188-105.lightspeed.tukrga.sbcglobal.net [99.1.188.105]) by mx.google.com with ESMTPS id 35sm6129219ano.11.2010.12.06.18.17.06 (version=TLSv1/SSLv3 cipher=RC4-MD5); Mon, 06 Dec 2010 18:17:08 -0800 (PST) References: <008101cb95b3$7ba11530$72e33f90$@com> In-Reply-To: <008101cb95b3$7ba11530$72e33f90$@com> Mime-Version: 1.0 (iPhone Mail 8C148) Content-Transfer-Encoding: 7bit Content-Type: multipart/alternative; boundary=Apple-Mail-4--151581275 Message-Id: <73C7D6C5-35C9-48EB-9EF0-C804D702029A@unveillance.com> Cc: "" X-Mailer: iPhone Mail (8C148) From: "J. Tubbs" Subject: Re: Now this is a great botnet detection idea Date: Mon, 6 Dec 2010 21:17:04 -0500 To: John Phillips --Apple-Mail-4--151581275 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii It's well known that it's mostly botnets like blackenergy and darkness. Fur= thermore, I would venture to guess that most of the attacking IPs are anonym= ous using open proxies to mask their overall attack vectors -- especially co= nsidering the high profile aspect of that site. -J. On Dec 6, 2010, at 21:07, "John Phillips" wrote:= > http://botnet-tracker.blogspot.com/2010/12/ddos-attacks-make-wikileaks-gre= at.html >=20 > =20 >=20 > =20 >=20 > =20 >=20 > John Phillips >=20 > Vice President, Global Sales >=20 > Unveillance >=20 > 512.6UN.VEIL >=20 > 512.686.8345 >=20 > jphillips@unveillance.com >=20 > =20 >=20 > >=20 > Unveillance | Data Leakage Intelligence & Metrics >=20 > =20 >=20 > ******************************************** >=20 > CONFIDENTIAL & PRIVILEGED COMMUNICATION This message is for the named pers= on's use only. The information contained in this communication is confidenti= al and/or privileged, proprietary information that is transmitted solely for= the purpose of the intended recipient(s). No confidentiality or privilege i= s waived or lost by any mistransmission. >=20 > If you receive this message in error, please immediately delete it and all= copies of it from your system, destroy any hard copies of it and notify the= sender. You must not, directly or indirectly, use, disclose, distribute, pr= int, or copy any part of this message if you are not the intended recipient.= The sender or any of its subsidiaries each reserve the right to monitor all= e-mail communications through its networks. >=20 > ******************************************** >=20 > =20 --Apple-Mail-4--151581275 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
It's well known that it's mostly botnet= s like blackenergy and darkness. Furthermore, I would venture to guess= that most of the attacking IPs are anonymous using open proxies to mask the= ir overall attack vectors -- especially considering the high profile aspect o= f that site.

-J.

On Dec 6, 2010, at 21:07, "John Philli= ps" <jphillips@unveillance.c= om> wrote:

http://botnet-tracker.blogspot.com/2010/12/ddos-attacks-make-wikilea= ks-great.html
=

=
John Phillips=
Vice President, Global Sales
Unveillance
512.6= UN.VEIL
512.686.8345
jphillips@unveillance.com

<im= age001.png>
Unveillance | Data Leakage Intelligence & Metrics

************************= ********************
CONFIDENTIAL & PRIVILEGED COM= MUNICATION This message is for the named person's use only. The information c= ontained in this communication is confidential and/or privileged, proprietar= y information that is transmitted solely for the purpose of the intended rec= ipient(s). No confidentiality or privilege is waived or lost by any mistrans= mission.
If you receive this message in error, please i= mmediately delete it and all copies of it from your system, destroy any hard= copies of it and notify the sender. You must not, directly or indirectly, u= se, disclose, distribute, print, or copy any part of this message if you are= not the intended recipient. The sender or any of its subsidiaries each rese= rve the right to monitor all e-mail communications through its networks.
********************************************

= --Apple-Mail-4--151581275-- From - Sat May 21 19:27:13 2011 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Delivered-To: khijazi@unveillance.com Received: by 10.236.108.45 with SMTP id p33cs123444yhg; Mon, 6 Dec 2010 20:14:08 -0800 (PST) Received: by 10.150.140.15 with SMTP id n15mr861111ybd.366.1291695247822; Mon, 06 Dec 2010 20:14:07 -0800 (PST) Return-Path: Received: from mail-gx0-f177.google.com (mail-gx0-f177.google.com [209.85.161.177]) by mx.google.com with ESMTP id u47si13182040yhc.169.2010.12.06.20.14.06; Mon, 06 Dec 2010 20:14:06 -0800 (PST) Received-SPF: pass (google.com: domain of raypeery@gmail.com designates 209.85.161.177 as permitted sender) client-ip=209.85.161.177; Authentication-Results: mx.google.com; spf=pass (google.com: domain of raypeery@gmail.com designates 209.85.161.177 as permitted sender) smtp.mail=raypeery@gmail.com; dkim=pass (test mode) header.i=@gmail.com Received: by gxk27 with SMTP id 27so3906948gxk.36 for ; Mon, 06 Dec 2010 20:14:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type; bh=PO6gMfanyYDTs7xvGjFLl1db86MKIcv7VR/nMw9sJlQ=; b=bJo3jDkX/OyeUNxk4rLottN1mKs0fMAazMXSpLsiiEaZgEBxBEXrx99FbAMBhL53ae YoWMgMFtj+bIJ2OZ1+2J+aUa/I9yxDidyYX6yWJ1q0FOlttJFC9NE+3pepxIeGEgOnMo rgdvAmxVzEDLLVnCDlA6Tih7tYgzLyxidskqU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=KcYxkTRzxi15OADyMVj9ikw5l1mLOdyv2H9q1H78ZvnYlRPzlv08AyzhXyhot6XK3D UBNpFqjEygM2cjpr0iu32eaI++f+XE0mUxmSl/med83EMITClYYlTjKU04ncTnyZWug+ /cadS51ZxdTCH9+A/cEr5rVkpGypItGkOFqSE= MIME-Version: 1.0 Received: by 10.101.133.20 with SMTP id k20mr1514214ann.250.1291695246432; Mon, 06 Dec 2010 20:14:06 -0800 (PST) Received: by 10.100.136.15 with HTTP; Mon, 6 Dec 2010 20:14:06 -0800 (PST) In-Reply-To: <4CE5D534.8050201@unveillance.com> References: <4CE5D534.8050201@unveillance.com> Date: Mon, 6 Dec 2010 21:14:06 -0700 Message-ID: Subject: Re: Unveillance information & pricing From: Ray Peery To: khijazi@unveillance.com Content-Type: multipart/alternative; boundary=0016e6d26587525ba80496ca3c92 --0016e6d26587525ba80496ca3c92 Content-Type: text/plain; charset=ISO-8859-1 Just a little cage-rattle... On Thu, Nov 18, 2010 at 6:39 PM, Karim Hijazi Unveillance Email < khijazi@unveillance.com> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Ray, > > Really great catching up with you the other day and thanks again for > your time and your feedback with the demo. > > As promised, I am attaching some documents for your review: > > - - Our enterprise list pricing sheet - it is our MSRP sheet and our > starting point for downward negotiations > - - Our commission sheet for platinum level sales reps (basically it > will give you about 50% wiggle room) and the commissions associated > - - The introductory presentation in PDF > - - A white paper I wrote a few weeks ago defining and explaining "Data > Leak Intelligence" > - - A formal sales representation agreement is forthcoming in the next > week or so - have the company's attorney on it right now > > This should be a good start to get you mobilized. I will also be > provisioning an account for you on Praetorian shortly - just finishing > some critical updates. I will also be setting up an Unveillance email > address for you which will also be your login if that is okay. We are > using Google enterprise so calendar sharing and such are a snap. > > It is great to be back in touch with you my friend and I look forward > to see what we will be able to accomplish together. Please don't > hesitate to call me with any questions or comments. > > - -- > All the best, > > Karim Hijazi > CEO | President > Unveillance, LLC > O. (404) 585-7487 > M. (561) 542-5704 > www.unveillance.com > khijazi@unveillance.com > > ******************************************** > CONFIDENTIAL & PRIVILEGED COMMUNICATION This message is for the named > person's use only. The information contained in this communication is > confidential and/or privileged, proprietary information that is > transmitted solely for the purpose of the intended recipient(s). No > confidentiality or privilege is waived or lost by any mistransmission. > If you receive this message in error, please immediately delete it and > all copies of it from your system, destroy any hard copies of it and > notify the sender. You must not, directly or indirectly, use, > disclose, distribute, print, or copy any part of this message if you > are not the intended recipient. The sender or any of its subsidiaries > each reserve the right to monitor all e-mail communications through > its networks. > ******************************************** > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.10 (MingW32) > > iQEcBAEBAgAGBQJM5dU0AAoJEIk0Dw4U/G3lKHcIAKYiCvfZ1U81eD47T9p7bzcU > mGKLzOhPwhghO9qD89l88qbVCRQN6vk63+1IC0WeTerVWvNem+0ZjxIqqaWmoaWu > dyG1XHYXVN4bL9j/p5xLTZhq0coBEqISL8XF0ZrFBeLUrXvUyrA7Zn21nGZaHJ9e > roWwwxSvUFX8bjSM6dgjdS/DdgNFDcn4WEK+UzQa8GVmRf90jRUOzxC62/7ZIthM > 1+8mRgegO3KoKOkMFl/4ARRlaZ/DPiepJoeFQjWXF5/gOWVHn1BS0qYwILy3i1B1 > qHTcxp5fRmcPSuwKQ2mIY3/wLvqpxNdoqO/9S8mCb2ldPZCYDYMjs7hpi0UuVxA= > =itWo > -----END PGP SIGNATURE----- > > --0016e6d26587525ba80496ca3c92 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Just a little cage-rattle...

On Thu, Nov = 18, 2010 at 6:39 PM, Karim Hijazi Unveillance Email <<= a href=3D"mailto:khijazi@unveillance.com">khijazi@unveillance.com> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Ray,

Really great catching up with you the other day and thanks again for
your time and your feedback with the demo.

As promised, I am attaching some documents for your review:

- - Our enterprise list pricing sheet - it is our MSRP sheet and our
starting point for downward negotiations
- - Our commission sheet for platinum level sales reps (basically it
will give you about 50% wiggle room) and the commissions associated
- - The introductory presentation in PDF
- - A white paper I wrote a few weeks ago defining and explaining "Dat= a
Leak Intelligence"
- - A formal sales representation agreement is forthcoming in the next
week or so - have the company's attorney on it right now

This should be a good start to get you mobilized. =A0I will also be
provisioning an account for you on Praetorian shortly - just finishing
some critical updates. =A0I will also be setting up an Unveillance email address for you which will also be your login if that is okay. =A0We are using Google enterprise so calendar sharing and such are a snap.

It is great to be back in touch with you my friend and I look forward
to see what we will be able to accomplish together. =A0Please don't
hesitate to call me with any questions or comments.

- --
All the best,

Karim Hijazi
CEO | President
Unveillance, LLC
O. (404) 585-7487
M. (561) 542-5704
www.unveillance.co= m
khijazi@unveillance.com

********************************************
CONFIDENTIAL & PRIVILEGED COMMUNICATION This message is for the named person's use only. The information contained in this communication is confidential and/or privileged, proprietary information that is
transmitted solely for the purpose of the intended recipient(s). No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please immediately delete it and
all copies of it from your system, destroy any hard copies of it and
notify the sender. You must not, directly or indirectly, use,
disclose, distribute, print, or copy any part of this message if you
are not the intended recipient. The sender or any of its subsidiaries
each reserve the right to monitor all e-mail communications through
its networks.
********************************************
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)

iQEcBAEBAgAGBQJM5dU0AAoJEIk0Dw4U/G3lKHcIAKYiCvfZ1U81eD47T9p7bzcU
mGKLzOhPwhghO9qD89l88qbVCRQN6vk63+1IC0WeTerVWvNem+0ZjxIqqaWmoaWu
dyG1XHYXVN4bL9j/p5xLTZhq0coBEqISL8XF0ZrFBeLUrXvUyrA7Zn21nGZaHJ9e
roWwwxSvUFX8bjSM6dgjdS/DdgNFDcn4WEK+UzQa8GVmRf90jRUOzxC62/7ZIthM
1+8mRgegO3KoKOkMFl/4ARRlaZ/DPiepJoeFQjWXF5/gOWVHn1BS0qYwILy3i1B1
qHTcxp5fRmcPSuwKQ2mIY3/wLvqpxNdoqO/9S8mCb2ldPZCYDYMjs7hpi0UuVxA=3D
=3DitWo
-----END PGP SIGNATURE-----

--0016e6d26587525ba80496ca3c92--