Who Wrote Sobig? - O'Reilly Media

Who Wrote Sobig? Copyright 2003-2004 Authors Page 1 of 48Who Wrote Sobig?Version 1.0:Version 1.1:Version 1.2:Version 1.3:19-August-2003.25-August-2003.19-November-2003.17-July-2004. This sanitized variation for public release.Scheduled for release: 1-November-2004.This document is Copyright 2003-2004 by the authors.The PGP key included within this document identifies the authors.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 4 of 48-----BEGIN PGP PUBLIC KEY BLOCK-----Version: PGPmQGiBEF5UyURBACZ9jsrBaowh4npI0ac84RVD9fzzR9oW9x4TkfPNlddzzR4uhkoCsKUK9IfeEz7C6a6pMKbwB83xjBedhjRE5zMfqns4kSY33XJirGzRHWXWbD7n1znWFfq84VBCezDmUy6cy4+zipQDyPYs+u8YfCMUfS2XCHXwD8lqg5jvIzsiwCglpkpz4+x1qvUrVNIkJlxeYzbDOsD/3Y/DHvNmNa8LGKTyF7KFgD5TTBSnPW5tpzdXkcp+UVg09A6qHagx90LGOA6l0P8oOJYPGaCvuQV7Br2zqqAw5PUouwxFPJTsWrmU25NlQ83jf8WaJTvU46/TXg8H+ctKeCLa4R6h4+dDkRjxSeKMuGbK8yZAVOv+VkANRcisFumA/sHb/+ovnRRp0rQ6xSz0HDOzJNNCF3ghZ4M+h13o7Ll4FCYVjr2pWeoeWKH80KZ8QWXfHMv4UmKekJ/ghI0AbUN/2ZLSqMTcQqZjqZdGivHPNG1rSk0qPupyQi++Cp7UM49r8kfC7eMmwqzd3VIix1+HC+nlxmkk6E/rYXaDKvzOLQ4QXV0aG9ycyAoQXV0aG9ycyBvZiAiV2hvIFdyb3RlIFNvYmlnPyIpIDxhdXRob3JzQGRvbWFpbj6IXwQTEQIAHwUCQXlTJQUJA8JnAAQLBwMCAxUCAwMWAgECHgECF4AACgkQ68sDbPEA3GOKQwCcC2Lg98QoRbDhwvm4y2KK0i6gTYsAoIcFHzo1owPyi3uObA80V+wnr11OuQINBEF5U2MQCACH2+h+bY7cMe6ti87JRkx50Ian0B4g8m3ugvNN0qXd2YNdFOuDigrMi/SOLLb8tuGGOTEVkkNwtkejnP0Nc8tppxbJkEvG+MKxbOScSUEHswNAjTG0qdMTT3HsGQZbgoxEE5RzW5ZqMizUTRvLAWB98LCZWeyfzkX14iflJw9m3RtsAFc0TSV/WLsPH+o+ula8hkdc7klEEDRguLMkcOSttgwa4UbDota81pZ1poEbYRDGUFMTVMTrkFNV4mCRsUPsDkOn9spdlBAkC6U/h8kcfWdNT7V8V6mdW7kV4WmJ24xGro7dRxHMiGVVYTMesaW8chz2xO5rG+nwS4yyX723AAMFB/9EMSUKaucuBmFnKwxGHMAbD01m8AAIE4chZF4fhhF9d8lnSMqyxwm/X9uSvUGD/3hF2QwvMzQVTFiy5ChYsIwzTuK2WyQMbgWkmvlUn2RNUP68Il+6ewWyupTZdbSHSxiurWyyAqX9gBLkmX4ndOeGe2LPwBZ+GWLK8KFGGZTyanLkLfZ3DUwj9eMXaW5EYhoEQ/lIcp7m3kJ5k3WlVALAMMU5WJRbpY+7Q8Nn+zS0d59p2HALIEUvXxlueHpoxvhYPKo4j3xzB5/8CE3RdP8yUeNpLSVieR7CDFSYuGvHwsKi+zi0ihHFyjosj9CEJ1rsKAEIlu6P3LdpYKcGEFDMiEwEGBECAAwFAkF5U2MFCQPCZwAACgkQ68sDbPEA3GMMAACeJoVCaAIw6NZA78CHMQpkb1m8nDUAn2UT+n7BsfFUPK3hvtfCCvf9ywP5=7hlJ-----END PGP PUBLIC KEY BLOCK-----

Who Wrote Sobig? Copyright 2003-2004 Authors Page 5 of 482 OverviewSobig was a virus specifically designed to aid the anonymity of spammers. Sobig opened up services that enabledspammers to relay their emails anonymously. Although publicly the motivation and author of the Sobig virus isunknown, through the use of forensics and profiling, we have identified a very likely suspect and motive.Our research indicates that Ruslan Ibragimov of Moscow, Russia, and/or Ibragimov’s development team, authoredthe Sobig virus. Ibragimov himself is the author of Send-Safe, a bulk mailing tool product that was explicitlydesigned for sending unsolicited email (spam).Our investigation will demonstrate:• Advanced knowledge: Ibragimov has demonstrated an advanced knowledge of Sobig outbreaks.o The releases of Send-Safe coincide with Sobig releases;o New features in Send-Safe coincide with Sobig features;o A specific spam group that use Send-Safe was observed relaying through Sobig-infectedsystems as much as two weeks before the official outbreak.This same group has been observed using specific versions of Send-Safe prior topublic release (using pre-released software);The time that the group was observed using Sobig (prior to public announcement)corresponds with the Internet Storm Center recording an increase in port scans forSobig-infected systems.• Necessary skills: Based on the attributes and overall functionality of Sobig, the developer would requirethe following skills:o Knowledge of Microsoft Visual C++;o Self-compressing executables;o Email and spam;o Proxies.Ibragimov has demonstrated these skills and knowledge: Send-Safe is a spam tool designed to send emailusing proxies, written in Microsoft Visual C++, and self-compressed.• Source code access: Sobig and Send-Safe share a common source code base.o Unique source code creates unique opcodes within the executable code.Both the Sobig and Send-Safe software share large sections of common opcodesequences, implying the same source code;The common source code is used to both generate and send email;o The email headers are unique to Send-Safe;o Sobig includes code for an email header that it does not use.This unused code appears in the same order as the Send-Safe executable – and thecode is used in Send-Safe;o Ibragimov has not publicly released the source code to Send-Safe (or any of his otherprograms, to our knowledge).Send-Safe predates Sobig by a few years, indicating Ibragimov had access to theoriginal code base used to develop Sobig;o Ibragimov has demonstrated a pattern of reusing source code.Large blocks of opcodes found in Send-Safe appear in other programs created byIbragimov.• Plausible motive: As Send-Safe provides a list of open proxies to subscribers, there is a clear financialmotive for Ibragimov to have created the Sobig worm.o As Sobig opens additional ports, this provides more open proxies for Send-Safe subscribers.Based on these items that have been identified, we contend that Ruslan Ibragimov, or Ibragimov’s developmentteam, authored Sobig in order to support and extend the Send-Safe customer base.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 8 of 48Fig. 3 Software revisions from SSSG rotate over time. Every color indicates a different software revision.3.3 Identifying Open Proxies and UsageOpen proxies are the third item that an anonymous spam group requires. Open proxies allow a sender to relaymessages while keeping their true IP address anonymous. If the sending system’s IP address happens to be trackedto the spam, the tracker will find a system with an open proxy server, masking the true sender’s IP address. Multipleproxies are used for three main reasons:1. Heavy use of a single proxy may be noticed and cause the proxy to be disabled;2. Some proxies place a limit on the number of times an individual may relay through it;3. The bandwidth of the proxy server is unknown, so by relaying through many proxies, the spam sender canincrease their throughput.Send-Safe provides four methods for sending spam:1. Use your own. The user can provide a list of proxies, leaving it up to the user to acquire the list;2. Send-Safe proxy scanner. Send-Safe provides a proxy scanner for use with the Send-Safe bulk-mailingtool;o As of scanner version 1.5, the unregistered scanner will send all discovered proxies to Send-Safefor use with the registered bulk-mailing tool; if you find a proxy using the unregistered proxyscanner, then other Send-Safe users also gets to use the proxy.3. Send-Safe proxy list. Send-Safe can provide a list of proxies at an additional cost;4. Send direct. If no proxies are available, the Send-Safe bulk-mailing tool can send email directly. The usermay also select an option to send directly.3.4 Conjecture: Send-Safe and SobigThe Send-Safe software appears to have direct links to the Sobig virus.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 9 of 48Multiple releases of Send-Safe software correlate with releases of Sobig, both in chronological order andfunctionality (Fig. 4). Each revision of the Sobig virus had opened a set of network services that can be used to relayspam email; Sobig was likely created to open proxy servers for use by spam senders. 4Fig. 4 Correlations between Send-Safe and Sobig releases.Software Release Date NotesSend-Safe 2.0 09/2002 Send-Safe 2.0 introduced encrypted proxy lists. This happened after a newsgroupacquired the proxy and address list (35Meg file), and made it public.Send-Safe 2.1 11/20/2003 2.1 introduced SSL to the server, along with encrypted proxy data. The same newsgroupcalled it “trivial” to decode, decoded it in under a week, and posted the information.Sobig-A 1/09/2003 No expiration. Executable packaged with tElock. Believed to be a proof-of-concept test. 5Opens proxies on ports 555, 608, and 1180-1185.Send-Safe 2.09 3/19/2003 Compiled on March 18, 2003. (Possible prior releases between 2.1 and 2.09, but we didnot track until March.) Change in registration: Minor registration charge for using yourown proxies. Major registration charge if Send-Safe provides proxies.Send-Safe 2.13 5/18/2003 Compiled on May 18, 2003. Supports more proxy types. (HTTP, HTTPS, Socks, etc.)Sobig-B 5/18/2003 Compiled on May 16, 2003. Deactivates May 31, 2003.Executable packaged with UPX. Believe to be the first non-proof-of-concept release.Release correlates with Send-Safe 2.13 release. Provides many types of proxies, most(all?) are supported by Send-Safe 2.13, but not supported by Send-Safe 2.09.Send-Safe 2.14 5/30/2003 Compiled on May 30, 2003. New registration system. All proxies found by Send-Safeproxy scanner are now sent to a central Send-Safe server for all users. More complexencryption system for transferring the proxy list.Sobig-C 5/31/2003 Compiled on May 30, 2003. Deactivates June 8, 2003. Executable packaged with UPX.More complex encryption system. Release correlates with Send-Safe 2.14 release.Sobig-D 6/18/2003 Deactivates July 2, 2003. Believed to be a premature release or a test due to limitedspread and overlapping expiration date with Sobig-E. Sobig-D used the same ports as theprevious Sobig releases.SSSG 6/18/2003 SSSG observed relaying through a system with ports 2280-2285 open.Sobig-E 6/25/2003 Compiled on June 24, 2003. Deactivates July 14, 2003. Executable packaged withtElock. Proxy ports changed to 1555, 2001, and 2280-2285.Send-Safe 2.14 6/28/2003 Web page updated. Re-release of the same code; no code change.SSSG 7/1/2003 SSSG is observed using a new, unreleased version of Send-Safe. This version is believedto be a pre-release of Send-Safe 2.16, possibly 2.15.SSSG 8/9/2003 SSSG observed relaying through a system with ports 3380-3385 open. The open servicesmatch Sobig-F.Sobig-F 8/18/2003 Compiled August 17, 2003, public announcements 2 days later. Deactivates September10, 2003. Executable packaged with tElock. Includes encrypted command structure andremote control. The proxy ports changed to 2555, 3001, and 3380-3385.SSSG 9/30/2003 SSSG is observed using a new, unreleased version of Send-Safe. This version is laterdetermined to be the final release of Send-Safe 2.16, before the public release.Proxy Scanner 1.6 9/30/2003 New Send-Safe Proxy Scanner released. Coincides with a sudden end of SSSG traffic.Send-Safe 2.16 10/6/2003 The official release of Send-Safe 2.16. Coincides with a sudden restart of SSSG traffic.Send-Safe 2.17a 10/17/2003 Compiled on October 17, 2003. The web page still indicates version 2.16.HPH 1.0 11/11/2003 The first release of Send-Safe’s “Honeypot Hunter”.Send-Safe 2.17b 11/18/2003 The web page was updated to “2.17 beta” but the web page’s date still says October 6,2003.4 Source: “Sobig.a and the spam you receive today.” by Joe Stewart, Lurhq. .5 Source: “Evolution of the Worm.” by Joe Stewart, Lurhq. .

Who Wrote Sobig? Copyright 2003-2004 Authors Page 10 of 484 ISC Malware Scans and Public AnnouncementsAt present, it is inconclusive whether the developers of Send-Safe actually created the virus or simply sponsored thecreation. It is equally ambiguous whether SSSG sponsored the creation of Sobig, requested additional proxies, orjust utilized what was originally provided to them. What we do know is that SSSG and Send-Safe were observed tobe using Sobig-infected systems before the actual public announcement.4.1 Public AnnouncementsAn email was received from SSSG on June 18, 2003. This email was received from IP address “200.75.209.87”,located in Cable Onda, Panama (City), Panama (Country). A scan of that particular host revealed the following:2285/tcp = SMTP server2284/tcp = POP3 server2283/tcp = WinGate FTP server2281/tcp = telnet server of some kind. Prompt says “MNGTR>”2001/tcp = unknown server.Why so many open systems services were running was inexplicable at the time. It simply appeared that more thanlikely the system had been compromised. Between the 18 th and 25 th of June 2003, additional email messagesoriginating from SSSG were observed coming from other systems with the identical open ports.Concurrently, the previously mentioned Send-Safe groups DHS and “Mr. Yahoo” were explicitly relaying throughboth open socks servers and HTTP proxies – systems that did not have the same open ports as the hosts used by theSSSG. Additionally, there were no other non-Send-Safe spam groups observed originating from this particular typeof compromised host system.The Sobig-E virus was officially identified and publicly announced on June 25 th , 2003. Sobig-E opens the identicalservices and ports used by the SSSG. Simultaneously, the Internet Storm Center had begun reporting an increase inscans for port 2280 just prior to the Sobig-E public announcement. This increase in port 2280 scans directlycorresponded with the SSSG’s employment of infected systems.An email received from SSSG on August 9 th , 2003 displayed a similar Sobig-F pattern. Using the ‘nmap’ and‘nessus’ utilities to scan the host system, we identified a telnet service with an “MNGTR>” prompt and many openservices on ports 3380-3385. Additionally, on August 16 th , 2003, the Internet Storm Center began noticing anincrease in port 3380 scans. The Sobig-F malware that opens these particular ports and this particular “MNGTR>”service was not publicly announced until August 19 th , 2003 (Fig. 5).

Who Wrote Sobig? Copyright 2003-2004 Authors Page 11 of 48Fig. 5 The Internet Storm Center had recorded an increase in port 3380 scans a few days prior to the August19, 2003 public announcement of the Sobig-F malware.Soon after the Sobig-E and Sobig-F viruses had been publicly announced, other spam groups began to relay throughopen proxies via Sobig-infested systems. There was only a time span of a few days to a few weeks between thepublic announcement and the observed port use by other parasitic spam gangs. Of the identified Send-Safe spamgangs, only a few had not modified their scanning to include the Sobig proxy ports.Although the Sobig releases appear to have direct links to the SSSG, Sobig was not the only malware beingemployed by the SSSG prior to the Sobig public announcements. SSSG had been observed relaying via systemswith an open web proxy on other ports, specifically 5490/tcp as early as June 9 th , 2003 (Fig. 6). This directlycoincides with an increase in 5490 port scans and actually predates the use of other spam groups relaying throughsystems on this specific open port. However, the actual service that was responsible remains unidentified. It is alsounclear if SSSG had actually discovered the proxy on their own, if Send-Safe had discovered it and notified SSSG,or if some other custom malware was directly responsible.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 12 of 48Fig. 6 The Internet Storm Center reported an increase in scans for port 5490 during a time when SSSG wasobserved using systems with port 5490 open.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 14 of 48Ibragimov’s address on record is 12 Krasnokazarmennaya, 111250, Moscow, Russia. Previous known emailaddresses (no longer active) include 8 , 9 , and 10 . As thelatter two email addresses are from universities, it is probable that Ibragimov may have attended Ufa State AviationTechnical University around 1998, and the Ufa State Petroleum Technical University sometime in 2000 and 2001.5.1.2 About Send-SafeAlthough an individual may have authored Send-Safe, it is a fairly large and complex application that requiresdetailed knowledge of networking, multi-threaded programming, SSL, cryptography and more. Although RuslanIbragimov demonstrates skill and knowledge in these areas, there is no definable identifier that he is the soledeveloper. In our review of the Send-Safe executable code, there are numerous traits that suggest multipledevelopers, which indicates Ibragimov may actually manage a team of developers.5.2 Skill to Develop SobigDeveloping the Sobig malware would require a thorough knowledge of Microsoft Visual C++, self-compressedexecutables, email and spam, and proxies. Since Sobig is believed to have been released by posting the virus directlyto newsgroups, knowledge of newsgroup (NNTP) would also be required. Unlike the Send-Safe executable, Sobig isvery small in size, was created with special care to hide the author’s identity, and could have easily been developedby a single individual.Unless otherwise specific, the following versions of Sobig and Send-Safe that are listed below refer to Sobig-F andSend-Safe 2.16.5.2.1 Skill: Microsoft Visual C++The Sobig virus was compiled using Microsoft Visual C++, which is the same type of compiler used to compileSend-Safe. Although it is unclear if the exact same Microsoft Visual C++ compiler was used, Send-Safe appears toalso have been compiled using Microsoft Visual C++ and Borland C++.5.2.2 Skill: Self-Compressed ExecutablesThe phase-1 Sobig malware executable was “packed”, i.e. a self-compressed executable. The Sobig-A, Sobig-E, andSobig-F were packed using tElock by tHE EGOiSTE/TMG; while Sobig-B and Sobig-C were packed using UPX.Both tElock and UPX packing tools include compression and encryption and very commonly used among viruswriters. These tools are freely available and require very little skill to use.Similar to tElock and UPX, the Send-Safe executable was compressed using ASPack by Alexey Solodovnikov. ,Even though the packing software itself is different, this demonstrates that the Send-Safe developers have anawareness of self-compressed and encoded executables.5.2.3 Skill: Email and SpamWell designed email messages are one method used by Sobig to self-propagate and use spam-techniques to hide theorigination system. Two techniques that Sobig employs when propagating by email are “direct delivery” and“bounced delivery”. Direct delivery is when the email is sent directly to the recipient. In this approach, the headerinformation is forged, including the originating hostname and “From:” email address. Key items from the Sobigemail header are:• The header order:o From, To, Subject, Date, Importance, X-Mailer, X-MSMail-Priority, X-Priority, MIME-Version,and Content-Type;• A “Message-ID” header is not present;• The “Date” contains a programming error.8 Source: WHOIS domain registry information for the domain “send-safe.com”.9 Source: newsgroup postings circa 2000-2001.10 Source: newsgroup postings circa 1998.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 15 of 48o If the random time zone is negative, then it is displayed with two negative signs. For example,“Date: Fri, 4 Jul 2003 0:08:45 --0700”;• The “X-Mailer” value is “Microsoft Outlook Express 6.00.2600.0000”.The bounced delivery propagation technique is when email is sent to a non-existing email address, and a maildaemon returns the undelivered email back to the sender. By forging a recipient’s email address within the “From”address, the mail daemon then completes the delivery by including the malware in the “undeliverable” email reply.Authoring Sobig would require knowledge of email generation, delivery, and spam-techniques for obscuring theoriginating host. Ruslan Ibragimov has demonstrated these skills with the Send-Safe bulk-mailing tool.5.2.4 Skill: ProxiesTo remain anonymous, a spam senders must relay through an open proxy. Many malware applications create theirown proxy servers for spam to relay. For example, W32.Mimail.gen@mm worm 11 contains code for opening aproxy server. In contrast, Sobig contains no code for opening proxy servers; Sobig retrieves the proxy tool“WinGate” and installs it on the infected system.As the skill necessary for installing WinGate is minimal, it is likely that the Sobig author(s) has limited or noexperience at developing proxy servers. Ruslan Ibragimov has not been observed demonstrating a proficiency inproxy server development.5.2.5 Skill: NewsgroupsIt is widely believed that the outbreak of each Sobig virus began when infected files were placed within newsgroupforums (NNTP). As newsgroups are extremely common and easy to post messages to, it is likely that the virusauthor is familiar with newsgroups and is not someone new to NNTP. Although there may be many individuals andgroups that fit this particular profile, it cannot be used to rule-out Ruslan Ibragimov; Ibragimov has been posting tonewsgroups since at least 1998.5.3 Access to Sobig Source CodeThere are many similarities between the Sobig and Send-Safe executables, including the generated email headerformats, programmer coding conventions, and identical opcode sequences.5.3.1 Similar: Header OrderingDifferent spam tools will generate different email headers. The email header that was generated by Sobig is verysimilar to the header generated by Send-Safe.Send-Safe 2.14 email headerMessage-ID: From: To: Subject: **You're ~Approved~*Date: Wed, 26 Mar 2003 13:21:50 -0000MIME-Version: 1.0Content-Type: multipart/mixed;boundary="----=_NextPart_000_00B0_40A21C5D.D8133A18"X-Priority: 3 (Normal)X-MSMail-Priority: NormalX-Mailer: QUALCOMM Windows Eudora Version 5.1Importance: NormalSobig-F email headerFrom: To: Subject: Thank you!Date: Tue, 26 Aug 2003 14:29:47 --0400X-MailScanner: Found to be cleanImportance: NormalX-Mailer: Microsoft Outlook Express 6.00.2600.0000X-MSMail-Priority: NormalX-Priority: 3 (Normal)MIME-Version: 1.0Content-Type: multipart/mixed;boundary="_NextPart_000_0661EBB9"Both Sobig and Send-Safe email headers contain the same four generic-email “required” header fields; From, To,Subject, and Date at the beginning and in the same order. But, Sobig does not contain a Message-ID field.11 Source: http://hq.mcafeeasap.com/dispVirus.asp?virus_k=100796

Who Wrote Sobig? Copyright 2003-2004 Authors Page 16 of 48Following the required headers are the “optional” headers for generic email traffic. Even though these fields areconsidered optional, they are always present in email generated by both Send-Safe and Sobig. The optional headersare listed in the exact opposite order (Importance, X-Mailer, X-MSMail-Priority, and X-Priority). The value of theseoptions vary with different Send-Safe versions, but the values used in Sobig-F match the values from Send-Safe2.14.Lastly, the MIME-Version and Content-Type headers are listed in the exact same order, including the sameindentions.Although these subtle differences suggest separate source code, the similarities suggest that Send-Safe was thetemplate, and not other mailing programs such as Outlook, Netscape, The Bat!, or AMS.As these other independent email tools generate their headers with very different ordering, it would seem unlikelythat the Sobig author(s) determined the email headers and values independently.5.3.2 Similar: Coding ConventionsThe Sobig malware has a significant number of coding conventions that are very similar to Send-Safe:• String concatenations. The Sobig virus uses static email header values, i.e. the string “X-Mailer: MicrosoftOutlook Express 6.00.2600.0000” does not vary. Although the string is static, the code that generates itconcatenates two independent strings: “X-Mailer: ” and “Microsoft Outlook Express 6.00.2600.0000”. Theconcatenation suggests that the developer reused code with a static value (“Microsoft...”) rather than simplyencoding the entire static string.The majority of bulk mailing tools concatenate the field and value pairs like Sobig. Send-Safe uses aconcatenation function to combine the header information with the dynamic value strings. This suggeststhat Sobig used existing code for generating an email header, and then modified it to concatenate staticstrings rather than simply hard-coding the static header values.• Use of “%s”. When concatenating strings, there are many different approaches that can be used, i.e. a C++programmer can use “.” or “+” for concatenation, or the old-style C notation “%s”. There are also stringconcatenation functions such as ‘strcat()’.o When generating the email header, both Send-Safe and Sobig do not use “%s” to concatenatestrings. But, when establishing a connection to an email server (SMTP connection), both Send-Safe and Sobig use “%s”. The strings used by Send-Safe and Sobig are identical. For example,“RCPT TO: \r\n\0” (hex: “52 43 50 54 20 54 4F 3A 20 3C 25 73 3E 0D 0A 00”).The use of multiple concatenation approaches, with identical approaches for identical functionality is asignificant correlation.• Unused strings. The Sobig executable contains the string “Message-ID”, even though the virus nevergenerates a Message-ID in email that it sends. This particular unused string also suggests reuse of code.• String ordering. In compiled executables, strings are generally listed in the order that they appear withinthe source code and are not necessarily listed in the order that they are used. 12 The string ordering in Sobigis similar to the ordering in Send-Safe. For example:12 Executables are created in a two-step process. First, the source code is compiled into an object file. Second, allthe object files are linked into a single executable. All of the strings in the source code are grouped in the object file.The order of the strings in the object file match the order they were found in the source code (from top of file tobottom). The linker groups all strings from the object files in the same area of the executable. The order of thestrings matches the object file linking order. Large groups of strings may be in a different order depending on thelinking, but the local cluster of strings will not change as the executable is created.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 17 of 48Sobig-F strings_NextPart_001_%8.8XThis is a multipart message in MIME format%s: %sMessage-IDMIME-VersionSend-Safe 2.16 strings----=_NextPart_FFF_FFFF_FFFFFFFF.FFFFFFFFMessage-ID:Microsoft OutlookReply-To: {%From%}From: {%From%}{%To%}Subject: {%Subj%}MIME-Version: 1.0Since Send-Safe is a much more complex program than Sobig, Send-Safe has many more strings to indicatethe additional options. However, the overall ordering, with the unused “Message-ID” string following the“_NextPart” string and preceding the “MIME-Version”, indicates a semi-unique function ordering (uniqueorder of strings in the source code) between the two code bases.Even though both programs generate email and are expected to use these strings, neither program lists thesestrings in usage order. (For usage ordering, the Message-ID would be listed first, followed by From, To,Subject, etc., and ending with MIME-Version, Content-Type, and _NextPart boundary. The usage ordershould match the email header ordering.) This particular unique string ordering suggests source code withfunctions that use these strings being listed in the same order. The matching string order indicates a similar(or same) code base. It seems very possible that Send-Safe and Sobig used the same basic code base, whilethe Sobig author(s) simply removed unnecessary functionality from the source code.The following unlikely coincidences suggest a common-code base or the same author(s) between Sobig and theSend-Safe code base:1. Use of general string concatenations when creating the email header, but “%s” when communicating to anSMTP server;2. Similar string ordering;3. Sobig’s unused string (“Message-ID”) listed in the same string order (between “_NextPart...” and “MIME-Version”) as Send-Safe.There are no similarities to other email programs when comparing the Sobig and Send-Safe string ordering.The string order comparison was done against the Atomic Mail Sender (AMS) version 2.26, The Bat! version 1.62,Microsoft’s Outlook Express for Windows 2000 and Outlook 2000 13 , elm version 2.5 PL6, mutt version 1.2.5.1i,and pine version 4.44. Therefore, these other email programs are very unlikely to share any code base with Sobig orSend-Safe.5.3.3 Similar: Opcode SequencesWhen creating executable software, source code is written and then compiled into object code. Object code is thenlinked into operation code (opcode) sequences. High-level programming languages such as Visual C++, providemany different ways to create the same functionality. Different implementations for programming the samefunctionality will result in different opcode sequences. Knowing this, there are only a few conditions that cangenerate identical opcode sequences:1. The compiler may optimize small sections of simple functionality (such as a loop to initialize a variable).The optimization may result in identical opcode sequences from different coding implementations. Theidentical opcode sequences are unlikely to be larger than 64 bytes;2. The compiler may have generic templates for common functionality, which is usually the case for the startof any executable program, calls to common library functions, and padding between linked objects;3. Programs that include library functions (“statically linked libraries”) will contain the same opcodesequences due to the inclusion of identical code.13 Based on string order comparisons, only Microsoft’s Outlook and Outlook Express are similar. These programsvery likely share a common code base.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 18 of 48During this investigation, we compared Sobig-F with the Atomic Mail Sender (AMS) version 2.26, Sobig-E, Send-Safe 2.17a installer, and Send-Safe 2.17a installed executable 14 . The comparisons were done using a full-sequencecomparison system (similar to the Unix program ‘diff’, but it compares all sections of code with all other sections –see Appendix A for the detailed comparison).Here were some of our findings:• Comparing Sobig with AMS. AMS and Sobig contain common high-level functionality, as both programsgenerate and send email. Although there are many ways to create this functionality in source code, it isextremely unlikely that two people working independently would generate similar opcode sequences forthis type of functionality. From the results of our comparisons, the first 1K of memory indicated that theyare very similar types of executables. The padding at the end of memory boundaries match, indicationsimilar compilers. However, no part of Sobig’s executable opcode sequence matches AMS. A lack ofsimilarity from this comparison is expected since, although both programs send email, different developersare believed to have created them.• Comparing Sobig-F with Sobig-E. Unlike the AMS comparison, there are very large blocks of similar andidentical opcode sequences between these different revisions, indicating a very similar code base. There aresome differing segments, indicating source code changes between Sobig-E and Sobig-F. The similaritybetween these two programs is expected since the same developer is believed to have created bothprograms; Sobig-F is a later revision of Sobig-E.• Comparing Sobig with the Send-Safe installer. The Send-Safe installer is an executable archive thatinstalls Send-Safe. The only common high-level functionality between Sobig and the installer is thecreation of files on the local computer. Like the AMS comparison, there are similar sections with the initial1K of memory and end of memory boundaries, and there is some similarity with library function calls andlinking with static libraries, indicating similar compilers. However, the complete lack of matchingexecutable opcode sequences clearly indicates completely different code bases. This lack of similarity isexpected since the developer of the installer-building program was unrelated to the Sobig or Send-Safedevelopers.• Comparing Sobig with Send-Safe executable. The Send-Safe executable has the same high-levelrelationship with Sobig as AMS since they both generate and send email. Yet there are significant blocks ofsimilar and identical opcode sequences between Sobig and Send-Safe. These similar, and in very manyinstances, identical sections of opcode sequences, are not due to compiler optimizations or common libraryfunctionality, as some of these similar blocks are over 1K in size. The similar code appears to focus on thegeneration and sending of email. These similar/identical opcode sequences imply the same source codebase.Within the scope of our comparison we can conclude that the developer of the Sobig virus reused source code fromSend-Safe for the creation of code that generates and delivers email in Sobig 15 . The source code to Send-Safe is notpublic or open sourced, as Ruslan Ibragimov owns the source code and appears to keep the code private.In summary for any non-technical readers, this significant appearance of similar and identical opcode sequenceswithin the Send-Safe and Sobig software should be considered as significant as finding a fingerprint on a murderweapon. Although this very close similarity does not constitute guilt, it suggests a very strong correlation.14 The Send-Safe installed executable is encrypted and compressed. When it is executed, the program unpacks itselfin memory. For the comparison, we executed Send-Safe 2.17a and then stored all the program memory (25Megabytes) into a file. The file contains both the unencrypted and uncompressed Send-Safe executable and alldynamically loaded libraries. Our test was performed on a clean-install system that had never accessed Sobig,ensuring that any similarities are not due to Sobig residing on the system.15 Send-Safe predates Sobig by more than a year. It is unlikely that Ruslan Ibragimov acquired the source code fromSobig for use in Send-Safe.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 19 of 485.4 Motive to Write SobigSenders of spam typically relay their email messages through open proxy servers in a continuing effort to obscurethe true sending host. With the proliferation of blacklists and other anti-spam systems, spam senders are finding itmore and more difficult to locate available open proxy servers. By opening multiple proxy services on millions ofcompromised systems, a spam sender could very quickly and anonymously relay messages without the fear of beingidentified.Sobig provides the following two benefits for spam senders:1. Sobig opens multiple proxy servers on systems that are not blacklisted;2. Sobig spreads very quickly, infecting and re-infecting millions of systems in under a week.These benefits provide spam senders with a very large base of open proxy servers. Even though most of the infectedsystems will be cleaned within a week, there will be some systems that will remain infected to continually provideopen proxies for weeks or even months.We believe that Sobig was most likely written to support spam software. Any user or developer of spam mailingsoftware, including Ruslan Ibragimov and Send-Safe, would be financially eager to leverage malware such as Sobig.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 20 of 486 ConclusionBased on our findings and the items we have identified within the scope of this document, we strongly believe thatRuslan Ibragimov of Russia, and/or Ibragimov’s development team, authored Sobig. Ibragimov has demonstrated anadvanced knowledge of Sobig outbreaks, the skills necessary for developing Sobig, access to the source code baseused to develop Sobig, and a clear motive for creating the Sobig malware.

Who Wrote Sobig? Copyright 2003-2004 Authors Page 21 of 487 Appendix AThe following table shows a comparison of the bytes in the Sobig-F executable when compared with the unpackedSend-Safe 2.16 executable.• The memory address refers to the location within the Sobig-F executable;• A space (“ ”) indicates a byte in Sobig that has no corresponding match in Send-Safe. Only absolutematches (exact same byte value) are permitted;• A dot (“.”) indicates a byte value in Sobig that may correspond with a sequence in Send-Safe;• A star (“*”) indicates a byte value in Sobig that positively corresponds with a sequence in Send-Safe. Apositive match assumes at least 16 sequential matching bytes, showing that the byte is the same and in thesame context;• A zero (“0”) indicates a large sequence of zeros, usually used for padding between memory sections.So in simple terms, the following legend will help as you peruse thru the comparison table:• A large section of dots and spaces indicate no matches;• A section of stars and dots indicate a successful match;• The initial match (memory 00000000 – 00001000) indicates a Windows executable and is common formany programs;• The final match (beginning around 0001A1C0) indicates shared libraries;• The significant matches in the middle (such as 0000A780 – 00014680 and 000164C0 – 00016C00) suggestcommon source code.00000000 |****************************************************************|00000040 |****************************************************************|00000080 | . . . . .|000000C0 |. ................. .. . . ......... . . .....|00000100 |. ...... ... ... .... ......... ................. ......... ...|00000140 |................................. .. .00000000000000000000000000|00000180 |*******000000000000000000000000000000000000000000000000000000000|000001C0 |*******000000000000000 .. .. ....... ...000000000000000000|00000200 |*. . .. .... .. .... .................. ...... ...... *|00000240 |*****************. . ...... .. ..............................|00000280 |...................000000000000000000000000000000000000000000000|000002C0 |0000000000000000000000000000000000000000000000000000000000000000|00000300 |0000000000000000000000000000000000000000000000000000000000000000|00000340 |0000000000000000000000000000000000000000000000000000000000000000|00000380 |0000000000000000000000000000000000000000000000000000000000000000|000003C0 |0000000000000000000000000000000000000000000000000000000000000000|00000400 |0000000000000000000000000000000000000000000000000000000000000000|00000440 |0000000000000000000000000000000000000000000000000000000000000000|00000480 |0000000000000000000000000000000000000000000000000000000000000000|000004C0 |0000000000000000000000000000000000000000000000000000000000000000|00000500 |0000000000000000000000000000000000000000000000000000000000000000|00000540 |0000000000000000000000000000000000000000000000000000000000000000|00000580 |0000000000000000000000000000000000000000000000000000000000000000|000005C0 |0000000000000000000000000000000000000000000000000000000000000000|00000600 |0000000000000000000000000000000000000000000000000000000000000000|00000640 |0000000000000000000000000000000000000000000000000000000000000000|00000680 |0000000000000000000000000000000000000000000000000000000000000000|000006C0 |0000000000000000000000000000000000000000000000000000000000000000|00000700 |0000000000000000000000000000000000000000000000000000000000000000|00000740 |0000000000000000000000000000000000000000000000000000000000000000|00000780 |0000000000000000000000000000000000000000000000000000000000000000|000007C0 |0000000000000000000000000000000000000000000000000000000000000000|00000800 |0000000000000000000000000000000000000000000000000000000000000000|00000840 |0000000000000000000000000000000000000000000000000000000000000000|00000880 |0000000000000000000000000000000000000000000000000000000000000000|000008C0 |0000000000000000000000000000000000000000000000000000000000000000|00000900 |0000000000000000000000000000000000000000000000000000000000000000|00000940 |0000000000000000000000000000000000000000000000000000000000000000|00000980 |0000000000000000000000000000000000000000000000000000000000000000|000009C0 |0000000000000000000000000000000000000000000000000000000000000000|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 22 of 4800000A00 |0000000000000000000000000000000000000000000000000000000000000000|00000A40 |0000000000000000000000000000000000000000000000000000000000000000|00000A80 |0000000000000000000000000000000000000000000000000000000000000000|00000AC0 |0000000000000000000000000000000000000000000000000000000000000000|00000B00 |0000000000000000000000000000000000000000000000000000000000000000|00000B40 |0000000000000000000000000000000000000000000000000000000000000000|00000B80 |0000000000000000000000000000000000000000000000000000000000000000|00000BC0 |0000000000000000000000000000000000000000000000000000000000000000|00000C00 |0000000000000000000000000000000000000000000000000000000000000000|00000C40 |0000000000000000000000000000000000000000000000000000000000000000|00000C80 |0000000000000000000000000000000000000000000000000000000000000000|00000CC0 |0000000000000000000000000000000000000000000000000000000000000000|00000D00 |0000000000000000000000000000000000000000000000000000000000000000|00000D40 |0000000000000000000000000000000000000000000000000000000000000000|00000D80 |0000000000000000000000000000000000000000000000000000000000000000|00000DC0 |0000000000000000000000000000000000000000000000000000000000000000|00000E00 |0000000000000000000000000000000000000000000000000000000000000000|00000E40 |0000000000000000000000000000000000000000000000000000000000000000|00000E80 |0000000000000000000000000000000000000000000000000000000000000000|00000EC0 |0000000000000000000000000000000000000000000000000000000000000000|00000F00 |0000000000000000000000000000000000000000000000000000000000000000|00000F40 |0000000000000000000000000000000000000000000000000000000000000000|00000F80 |0000000000000000000000000000000000000000000000000000000000000000|00000FC0 |*******000000000 .............................................|00001000 | . . . ***************** .. ..... ..|00001040 | ... .. . .. . ... ... . . . . . . ... |00001080 | . . ... . . ... . .... .. ... . ...|000010C0 |. .. . . . . .. ... ... .. |00001100 | ..... . . . ........ .. . ... . ........ . .|00001140 | .. . ...... . .. .. .... .. ... .... .. . . |00001180 | . . .. ... . ... ..... .. ... .. . . . . .|000011C0 | .. . . .. . . . .... . .. . .. .... |00001200 | . . . . . . .. . . . .. . . .... . . |00001240 |.. .... . .. . .... . .. . . .. . .. ..|00001280 |. .. ..... ... . .. . . . . ... . .|000012C0 |.. . . . .. . .... . .. . . .. .. . |00001300 | . .. ..... .. . .. . . .. ... . |00001340 | .... . . . . . . . . . . . ....|00001380 | .... . . .. . . .... . . ...... .... .. |000013C0 | .... .. .. .. .. . . ... . . . .|00001400 |.. . .. .... .. . .. . . . . |00001440 | . .. . . .. . . . .. .. . . |00001480 |. .... . . . . . . ...... .... . . . |000014C0 | . .. . .. . . . . . . . ....... . |00001500 |. .. .. ... . .. . . .. ... .. .. . . .. . |00001540 | . .. . . . .. . .. . . ... |00001580 |.. . .. ...... . . . .... .... .|000015C0 |.... ......... ...... . .. .. ...... .. ..|00001600 |.. .. . . .... . .. ... . .... . .. . . |00001640 | .. . .. . .. . .. .. . .. ..... . .. .. . .... |00001680 | . . . .... . .... . .. ..... .... . .. . . . . .|000016C0 | .. . . .. . ... .. . .. . . ... |00001700 | .. .. .. ... .. . ... .. . . ....|00001740 | .. . . . .. . .. .... ... ... ...... .|00001780 |.. . . . . . .. . ...... . .. ..... . .|000017C0 | .. .. .. ..... .. . .. . .. . .. . .. . .. |00001800 | .. . .. ..... .. .... ... ... . .. |00001840 | .. ... .. . .. . .. . .. .. . .... . |00001880 | . . . .. .... . .... .. . . ...... .. . .|000018C0 |... . .... .. . . . . .. . . . .. . . . ... |00001900 | . .. . .. . . .... . .. . .. . .... .. . . ..|00001940 | . .. .. . .. . . . .... .. .... . . ... .. |00001980 | .... . . . ... . .... . .. .. .. . ... . |000019C0 | .. .. . .. . . ... . .... . .. . ...|00001A00 |..... .. .... .. . . . . .... . .. |00001A40 |.. .. . .. .. ..... .... ... . .|00001A80 |. . . . .... ... .. . ... .... ... .. . .. |00001AC0 | . .... . .. . .... . .... .... |00001B00 | .... . . .... . .. ... . . .. ..... . ... .. .. .. |00001B40 | . .. . .... .. ....... ... .. . . |00001B80 | .. ... .. .. ... .. . . .. ....... . |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 23 of 4800001BC0 |.... ... .. .... .. .. . . . . .. .. .. .. . |00001C00 | . .. . .. . . .. .... . . ... |00001C40 |. . .. . .. . ... . .. . . . . ..... ... .|00001C80 |. .... . .. . .. . . . . ...|00001CC0 | .. ... ... . .. .... .. . . .. ... . . . . . .|00001D00 | . . . .... ... . . .... ..... .. .. . ..|00001D40 | .. .... .. . ... . . .. . .. .. .. . |00001D80 |... . ... ... . ... . .. ... ...........|00001DC0 |... .. . .... ... .. .... . . .... |00001E00 |. . .. ........ ... .. .. .. . .. ... ... |00001E40 | .. ... . .. . ... .. ... .. .. .. . |00001E80 | . . . .. .. . . ... . . . . .. .. . .. . |00001EC0 | . . .. . . . .. .. .... .... .. ... . .|00001F00 | . . ... ... . ..... . .. .. .. . . . |00001F40 |....... . .. . . . . . . .. . . .... .... . |00001F80 | . . . . .... . . ... . .. .. |00001FC0 |. ... . . . ... ... . . . .. . |00002000 | . .. .. .. . ..... . . .... . ....... .. |00002040 |. . . .. .. ... . ... . .... .. ...|00002080 |. . .. ...... . . . .. . . .... . . |000020C0 | . . .. . . .. .. .. . .... . . .. .. .. |00002100 | ... ... .. . .. . .. ... . . .. . .. . ... . . |00002140 |. .. . . . . . . ... ... . . .. .. .. . ..|00002180 | . . . . .. .... .. . .. . . ... . . .|000021C0 |... . .. . .. ... .. .. .. .. . .. ........ ...|00002200 | . ... ...... .. .. . . . .. .. .. . . ... .|00002240 |...... . ... ... .. . . . .... ...... ..|00002280 | .. . .. .. ... .. . . . . .. ..... |000022C0 | . .. . .... ...... ... . . . ... ... |00002300 |. . . .... . .. ...... .. . ....... .. .. |00002340 | . . . ..... . . ...... . ... .. . ...|00002380 |. .. .... . . . ..... .. .... .... . .... |000023C0 |. .. . ... . ..... ... .. . . .. . .. . ..... . |00002400 | . .. .. . ....... . .... ..... ... . |00002440 | . ... . . . . ... ... . . .. .... .... ........ |00002480 | .. . . .. ... .. . . .. ... . . ...|000024C0 | ... . .. ... . . . . .. .. . .. .|00002500 | . ... . ......... ... .. . . . .. . . .. ... . |00002540 | . .... . . . .. .. . . .. . ..... ... |00002580 |. . . .. .. .. . . ... . . . . ... |000025C0 | . . . .. ........ .... .... . .. . ... . .|00002600 | . .. ..... ..... . . ...... ..|00002640 | .... . .. .. . .. . . . ... ... .. . . |00002680 |.. .. ... ......... . .... .. . ... .... .. |000026C0 | . .. . . ... . .. . .. . . .. |00002700 |.. ........ ... . . .... .. ... . ..........|00002740 |. . ... . . . . ... . . . .. .. . ..|00002780 | . . ... . .. .. . .. . . .. . .|000027C0 | . . .. .. .. ... ... .. . . ..... ... .. ...|00002800 | . . .. .... . . .. . .. . . . . .. ... . |00002840 |. . .. . . . . .. . .. .... ... .. |00002880 | . ... ... . ... . .. . ...... . . . .. .|000028C0 | ... .. .... .. . . .. . . . .|00002900 | . ..... . . .... .. . .... ... . . .. ..... |00002940 |. . ...... ... ... .. . . . . .. ... ..|00002980 | . .. . ... ... ... ..... .. . . .. ... |000029C0 | . . . .. . . .. .... ... . .... ... . |00002A00 |.. . .... .. ... ... . . . . ... . . .. . .. |00002A40 | ..... .. .. . . ..... . .. . . . . . |00002A80 | .. . ... . . ... . . ..... .. ........ .. . .|00002AC0 |. . . .... . . . .... .. . .. . . . . .. . |00002B00 |... . . .. . . ... ... ..... . |00002B40 |. . ...... ... .... . ..... .... .. .. .. . |00002B80 | ... .......... ... .. . ... . . .. . ..|00002BC0 |. . . .. . .... . .. ..... . ....... .|00002C00 | . . ....... .. .. . . . .. . . . |00002C40 |.. .. .... .. .. .. .. .... . ... . ... |00002C80 |. .. .. . .. ... . ... . . ........ . ..... ... |00002CC0 |. . ... .. . . .. . ... .. . .. ....... . . |00002D00 |. . .. .... . . ... . . .. . . .... . .|00002D40 |.. . . .... . ... . . . . ....... .. . . .|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 24 of 4800002D80 | . . ... . . . . .. . .. .. . |00002DC0 | .. .. . . . . . . .. .. .. . . . . ... ..|00002E00 |. .. . . . . . . .. .... . . |00002E40 |.. .. .. . . . . . .. . .. . . ... .. |00002E80 |.... . .. ... . .... . . . . . ..... ... ..|00002EC0 |. .. . ... . . . . . . .. . . . .. .... . . .. |00002F00 | . . .... . . ... .... ...... . . . . . . .|00002F40 |.. . .. .. . . .. . ... ....... . . ... |00002F80 | . . ... . . ... . .... . . . . . .. . ....|00002FC0 |. .... . ... .. . .... . .... . . . . . . ....|00003000 | . . .. . . ... . .. .... ... . ... |00003040 | ..... . . .... .. .. . .... . . |00003080 | . . .. . .... ... . .... ....... |000030C0 | .. .. . .. ... . . . .. .. . . . .|00003100 | .. .. ..... . ... . . ... ..... . ..... . .. |00003140 | . .. . . . . . .... .. .... . . . |00003180 | .. . . .. . .. .. . . . . . ..... . . .... ... |000031C0 | .. .. ... . ... .... . .. . . |00003200 |. ... . . .. . .. .... . ... . ........|00003240 | ........ .. ...... ... . . . ... . . . .. |00003280 |. . . . . . . . .. . . .. ... .. .. . . . . |000032C0 | .. .. . ..... . . ... .... .. ... .. . .. .... |00003300 |.. . . . . ... . .. . .. ... .. .. .. . ...|00003340 |. . . ... . . . . ..... .... .. . . ..|00003380 |. . . . .. . . ... ..... . . ..... |000033C0 |.. ... . . . .. .. ... . .. . . . . .. . |00003400 | ... .. .... .. .. .. ..... . .. .. .... ....... .. |00003440 | .. .. . .. . .. . . . .. . . . .. . ....|00003480 | . . . .... . .................. . .. |000034C0 | . . . . . .. . .... .. . .... .|00003500 | .. . . ..... . . . .... . .. .. .. |00003540 | .. .. .. ... . .... . . .. . ....|00003580 |.... . . ... . . . .. .. . .... ... .. . . .|000035C0 |.. . . ... .... . . . . . . . . . . . . |00003600 |. ... .... ..... .. . .. . . .. ... ..|00003640 |.. .. .. . . .. . . . ... .. ...... . .. |00003680 | . . . . . . ... . .... .. .. . . ..... ..|000036C0 | ... .. . .. .. . .. . . . .. . . . ... . . .. |00003700 | . . ... . . . . . . . .. .. ...|00003740 | . .. . ... . .. . ... . . . . .... . |00003780 | ... . .. ...... .. . . .. ..... ..... . |000037C0 | . . .... . .. .... ..... . .... . . . . .... |00003800 | .. . . . . . . . . ..... . ... .|00003840 |.. . . . ..... . . ....... . .. . . . ...|00003880 | . . ... .. .. .... ... .. .. .. .. . .|000038C0 | . . . . ...... ..... .. .. . . .... |00003900 |. . .. . .. ..... ... . . ... . ... .... . |00003940 |.. .. . .. . . . .. .. . . ... ..... .|00003980 |.......... . . .. ... .. .. . . . ..|000039C0 | . ... . . .. .. |00003A00 | .. . .. . . . . . . ..... .........|00003A40 | . .... .. .. ... ... .. . ... . .. . .. .. |00003A80 |.. . .. . . . . .. . . .. .. . ... . .... ..|00003AC0 | .. . .. .. . .. .. . . .. ...... . . . . |00003B00 | ... .. .... .. .. .. . . . .. ... . .|00003B40 |... ............ .. ... .. .. . .. . . . |00003B80 | . .. . .. .. . ....... ... . . ..... . .... . |00003BC0 | .. . ... ... . .. .. . ..... ... .|00003C00 |.. .. . . ... ... .. .. .. . . . ..|00003C40 |.. ... .... .. . .... . ... .. . . .. ..|00003C80 |..... .. . .. ... .. .. ... ... . .... |00003CC0 |.. ..... .. . . .. . .. .. . . .... |00003D00 |... .. . .. . . . . ... .. .. .. . . .... |00003D40 |. . . ...... . .. .. . .. .. . .. .. . |00003D80 |.. .. . . ... . .. . . . . . . ... .. . .|00003DC0 |. . . . . . .. . . . .. . .. .. .......|00003E00 | . . . . .. . ... . . . ..... . . . . |00003E40 | ..... .... . . . . . . . ... .. .. ... .|00003E80 |..... . . .. . . .. . . . ... ... ....|00003EC0 | .. .. . . ... . . . . . ... .. . ....|00003F00 |..... ...... .. . .. .. .. ... . . . |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 25 of 4800003F40 |. . ... . . .. . .... ................. ...... |00003F80 | . ... . . ..... .......... . ......|00003FC0 | . . .. .. .. . ... ... . ... . . ... .. .|00004000 | . ... .. .. . .... .. .. ... . .. . |00004040 | .. .. . ... ... .. .. . .. .. ... ..|00004080 |. . ..... ... . .. . . .. . . . . |000040C0 | . . .... .. . .. .. .. . . . . . ... . .|00004100 |. . .. .. .. .... ..... ... . ... ..... |00004140 | . . . .... .. .. . . . .. . . ..... . |00004180 | . .. ... ...... . . ... .. . .... .. |000041C0 | . . ... ... ..... . . . ...... . .. ..... |00004200 |.. . . .. . ... . . . . .. .. .. ... |00004240 | . .. .. ..... . . .. .. .. . ... . .. |00004280 | . . ... .. . . . . . .. . . ... . . . .|000042C0 |. . . .. . . . .. .... .. ... . ....... .......... |00004300 |. . .. . . .. ..... ... . .... |00004340 |. .... . .. .. .. . ... . . .. . . . ..|00004380 | . . . . ... .. .. . .. . . .... .... . |000043C0 |..... . . ... .. .. .... ... . ... .. ... . .. .. |00004400 | . .... . . .. . . . .. . . .. . . .. .|00004440 |.. .... . . .. . ... .. .... .. . |00004480 | . ... . . .. .. . . ..... . . . .. ..|000044C0 | .. . .. . .... .. . . .. . . ..... . |00004500 |... ... .. ... . .. . .. .. . ... . ... .. .|00004540 |.. ... . .... . . ..... . ... . ... . . . .. .. |00004580 |.. . . . .. . .. . . . .. . .. . . . .. . . |000045C0 | .. . . . . . .. . .. . . .. .. . ...|00004600 |. .. ... .. ... ..... . . ...... .. ..|00004640 | .. . .... .. . . .. ... .. . ..... ... .|00004680 | .. .. .. . . . . ... . .... . ... .. .. |000046C0 | . ... .. . .. . .. . ... . . .... .|00004700 |. ....... . ...... .. .. .. .. . . .|00004740 |. .. ... . .. .... .. . . .. ... . .. |00004780 | . .. . ... . . . ...... .... . |000047C0 | .... .. .......... . .. .. . . .. .. |00004800 |.. . . . . . .. . .. . .. . .. ... . |00004840 | . .... . ............ . ... . .. . . . .. .|00004880 | .. .. .... . . . . ... . .. .. .. ....|000048C0 |....... .. .. . .. . . . .. . . ....... . |00004900 |........ .. . ....... .... .. . ............ . . . . .|00004940 | . . . . .. . . .. .. . ... . .. .|00004980 | . . . .. .... ... . .. . .... .. ... |000049C0 | . .... . ... ...... . . ... . .... ............|00004A00 |.. ... .. ... ..... . .. . . . . .|00004A40 | . .. . .. .... .. .. .. . ... . . . .... |00004A80 | . . . . . . .. .... ..... . . .. . .. |00004AC0 | ... . . . .. . . .. .. . . .. |00004B00 | .. ..... . ...... .. . .. .. . .. .. ... |00004B40 | .. . . ... .. .. . . . .. . .. .. . ..|00004B80 | . .. . . .... ... .. ... . . .... . ......... ..|00004BC0 | .. . . . .. . . . . .. .. .... .. . |00004C00 | ... .. .. ...... .... ... . . .. |00004C40 | . . .. . . . . . ... ... . . ... |00004C80 | . . . .. . .. . . .. . ..... . ... . . . . |00004CC0 | . .. ... . ... ... . . . ... .. . . . |00004D00 | .. .. .. .. .. .. . ... ... . .. . . .. . ..|00004D40 |....... ........... ... . . ... .. |00004D80 | .. ... . .... . .. . ....... . ... .. .. |00004DC0 |. . .......... ......... ... . .. ... . |00004E00 |.... .. . . .. . . . .... .... ...... ... ... . |00004E40 | .. . . .. . . ... . . . .. . .... . ..|00004E80 |. . . .... . ........... ... .... . .. . . |00004EC0 |. . . . ..... . . .. .. . . . |00004F00 | . .. .. ... .. .. . . .. ..... . . .. . .. |00004F40 |. .... .. . .. . . . . .... .. .. .. . .|00004F80 | . . . .. . . . ... .. ... . ....|00004FC0 | . . .. ... . .. . ... .. .... . .. |00005000 | ........ .. ..... .. . .... .. . . . ..|00005040 | . . . .. . .. . .... ....... .. . . ....|00005080 | .... .. .. .. .. . .... .... .. .... ... .. . .... . .|000050C0 | . . . . ..... . ..... .. ...... .. ...|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 26 of 4800005100 |. ... .. . .. . .. . . . .. . .|00005140 | . .. . . .... .. .. . ... ..... ... |00005180 | . . ..... .. . ... . . .... . . ... . |000051C0 | . . . . . . .. . ..... . . ... . |00005200 | .. .. ... .. .... .. ... . . ... . .. . . |00005240 |... . .. .... .. . .... . .. . . |00005280 | . .. .. .... ......... . .... .. ... ...|000052C0 | . .. ... . . . . ... .. . ... .. |00005300 | .. .. . . .. ..... .... .. ... . . . . . . . .. |00005340 | .. .. .. .. . . .... ... . .. .. .... ..|00005380 | . .. . .. . ... . .... .. ... .. . ..... .|000053C0 |. ... .. . . .... . . .. . ... .. . . .. |00005400 |.. . ..... . .. . . .... . .. ... . |00005440 | . .. . .. . .... .. .. . . ... . |00005480 | . .. .. . ... . ... .. .. . .. . .. .... .|000054C0 |.... . . . . ... . .. .. .. .. . . . |00005500 | .. . ... .. .... . ... . . .. .. . . . |00005540 |.. .. . .. ... . . . . .. ..... . .. .. |00005580 | .. . . ... . ... .... .... . . . ... . . . |000055C0 | . . ... .. . . . .. .. ..... .. .... . |00005600 | . .. . .... .... .. ... .... . .. . . . . |00005640 |. ... ... . ... ... .. . . ..... ... |00005680 |... . . .. .. . . .. . ... . . . . .. .|000056C0 | . ..... ... . .. . . . . . ... . |00005700 |. ... .. . . . . ... . . . ... . .|00005740 | . . .. .... . . .. . . .. . .. .. . .... |00005780 | . .... ... ..... .... .. .... ... .|000057C0 |... . . . ... ... ..... ... ... .. .... ..|00005800 |. .. . .. . . . .. . .. .. . . |00005840 | .... .. ... .. ..... .. . ... ... .... |00005880 |.. . .... .. ... .. .... .. . ... ..... ...|000058C0 |. . .. . .. ... .. .. . .. . .. ... |00005900 | .. .. ... . .. .. .. .. ... ... ... . |00005940 |... . . .. .... .. .. . . .. .. . .. . . . ..|00005980 |. . . .. . . . . .. . ... . .. . .. |000059C0 | . . ... . . . ...... .. . .. ..... .. . . . |00005A00 |. ... .. .. . .. . .. . . . ... . . .|00005A40 | . . . . . .. . ... ... . .. . . . . .. . |00005A80 | .... ........ .. ..... .. . .. . . . . .. |00005AC0 | . ... .. . ... . . .... .. . . ... . . .. . |00005B00 | .. . . .. .. . ... . . . . ... .. . .. .|00005B40 |... .. . ... . . . .. .. ... . . . |00005B80 | .. .. . .... ... . . .. . .... .. . ..|00005BC0 | . .... .... . .. . .... . . . |00005C00 | ... ....... ... . .. . ... .... .. ... . . ..|00005C40 | .. . .. ... ..... . .. ... . . .. . . . |00005C80 |.... . .. . .. .... .. . .. . ... . |00005CC0 |. . ... . . .. . . . . . .. ... . .. .. ....|00005D00 | .. . . . . .. ... .. ..... .. . . . |00005D40 |. .. . . . . .. . .. . . .. . ... |00005D80 |.. . ... .... ... ... ... ...... . . .. .. ..|00005DC0 |. .. ... .... .. .... .. . .. . .. .. ..|00005E00 |. . .. . .. . . .. . .. ... .. . ... . . ... |00005E40 |. . . .... . . .... ... . .. .. |00005E80 | . ... .... ... ... .... ... ..... .. ... .|00005EC0 |.. ... .. .... ... . .. .. . ... . ... |00005F00 | .. ..... . . .. ... ... .. .... ... . ... ... |00005F40 |... ... . . ... .... . .. ... .. ... |00005F80 |.... ... . . .. . . ..... . . .... |00005FC0 |.. . .. ... . .. ....... .. .. . |00006000 | .. ........ .... ... . .. . . ... . . . |00006040 |. . . ... ..... . .. .. .. . ... ....|00006080 | . .. .... .... . .. .. .. .. . . |000060C0 | . .. . ... .. . .. . ... .. ... . . ... |00006100 | ... . .... . .... . .... . .. ... . .... ...|00006140 |.. .... .. ..... ... . .. . .. . . .|00006180 | .. . . .. . . ... .. . . ... ... ... .. ..|000061C0 |... .. . .. ... . ... ... .. . .. .. . .|00006200 | . . .. ... . .. . . ......... ...... .. . .|00006240 |.. ... .. .. . .. .. ... ... . ... . .... .|00006280 |. .... . . ..... .. ... . . . .... . . ..|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 27 of 48000062C0 | .... . .. . . .... .. . ... ... . .. ... .|00006300 |... . . .. .... . . . .. .... ........ . .. |00006340 | . . . . ... .. ... . .. .. .... .. |00006380 | .. ... . .. . . .... . . . |000063C0 | ... . . .. ... . . . .. . .. . . ...|00006400 |.... ..... .. . . .. . . ... . ..... . ... . |00006440 | . .... .. ... ..... ... ... ......... .. . .|00006480 |.. ..... .. .. .. .. . . .. . . . . ..|000064C0 | . ... ..... ... ........ .. .. ... ... .|00006500 | .... .. . .. .... .. .. ... ..... . . ...... |00006540 | . . .. .. .. ... .. .. ... ... .. |00006580 | . .. . . .. . . .. ... . .. ... |000065C0 | .. .. .. . .... .. . ... .. .... . ... . |00006600 |.. ... . . ... .. . .... .. ... ... ..|00006640 |.. ... .. ... ... . ..... .. .. .. ... .|00006680 |. ... . ... ... .. ... .... . ... . .. . .. .|000066C0 | .. . . . . . . .. . .. . . .... ... ..|00006700 |. ... .... ... ... ... .... ... . .... . . ... .|00006740 | .... . .. .. .. .. .. .. . . .|00006780 |.. .. .. .. . . . ... . .. . ... .. |000067C0 |. ... . . ..... .. ... .. . ... .... . .|00006800 |. . ... . .. . .... . . ... .. ... . |00006840 |.... . . . ... . . . . . . . . .. .|00006880 | . .. .. . . .. .. .... .. .. . .. . |000068C0 | . .. . . .. .. . ... ... . .. ... .. .. .. . |00006900 | . . ... .. . . . . . . .. .. . .. |00006940 |.. . . .. . . . ...... . .... . . . . .|00006980 |.. . . ... ...... . .. .. .. .... . .. . .|000069C0 | .. .. .. ... . . . ... . . .. . .. .. |00006A00 | .. . . . . . ... . .. ... .. ....... .... |00006A40 | .. . ... . . .... . . . .... . . .. . . . |00006A80 |... . .. . . . .. . ... . ... . .. |00006AC0 | . . ... . . .. ... .. . . . .. . |00006B00 | .. . .. .. ... . .. .. . . .. . |00006B40 | . .. . . . .. . .. .... . .. . . . .. .. . |00006B80 | .. .. . .. .. .. . ... . .. ... . . . |00006BC0 | . .. . .. .. .... . ..... ........ . .. ..|00006C00 |.. . . . .. ... .... ... . .. . |00006C40 | .. . .. .. . ... . . . .... . . . |00006C80 | . . . . . ....... . .. .. .. ... ... . .|00006CC0 | . .. . . ...... .. .. . .. ... .. .. .. . . . .. |00006D00 |.. . . .. .. . .. .. .. ... .. .. .. . |00006D40 |. .. . .. . .. . .. .. .. ... . .. . .|00006D80 |.. . . . . . .. . ... . . . .|00006DC0 | .. . .. . .. .. .. . .... .. . . . ... .|00006E00 | . ... . .. ... .. .. . . . . .. .. . |00006E40 | .... . . . .. . . . ... .. . . |00006E80 |. ..... . .. . .. .. .... .. .. . ..... ... |00006EC0 |... ..... ..... . . . ... .... .. ...........|00006F00 | ......... . . .. . . . ........ .|00006F40 |. .. .... . . .. . . .. . . . . .. |00006F80 | ... ... .. .. . . .. . . .. . .. . . |00006FC0 |.. . .. ... . . . . .... . .... .. . . . |00007000 | ... .... . . ****************** ....... . ....|00007040 |.. . . ..... ... .. .. ... . . .. . .. .|00007080 |. .... .. . ............. .. . . ... . . .. .|000070C0 |...... . . ....... .. ....... ..... . . |00007100 | . .. . . ... ... .. . ... ... |00007140 | ... . . .. .. . .... . . .. ..... . |00007180 | . ....... ... ..... .. . .. .... . . ..|000071C0 | .... ..... . . ... . . ... .... . .. ... . .. . |00007200 | ...... .. . .. . . .. . . . ..... .. .|00007240 | . . . . .. .. .... ... . . ..|00007280 |.. ... ..... . .. .. ... ... .. .. .... .. .|000072C0 |. .. .. ... .. . . .. . .. .. . .. ..... |00007300 | .. . ....... .. .. . . . ....... |00007340 | ........ . . ........ .. . . .. .... . . |00007380 |. .... ...... .. . . . ... .. . . .. . |000073C0 | .. .. .... .. .. ... ... .... .. .|00007400 | . .. . . . .. ... .. . .. .. .. ... .|00007440 |... .. . .. . .. .... ......... . .|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 28 of 4800007480 |... . . . ....... .... . . .. . . .......|000074C0 |........ . . .. .. .. . ... . . ... . . .|00007500 |. .. .. . ... .. . .. .. . . |00007540 |.. ... .. ..... . . . ..... ..... . ... .. . .|00007580 |.. .. ... . ... .. . ... .. . ... . .. . .. .. . |000075C0 | .. . .. ..... .. .. ... .. . .. ..|00007600 |. ... . .. .. .... . . .. .. .... .|00007640 | ... . . ... . .... . . .... . ......... .. |00007680 | .. ... . . . . .... . . . ... . . .. . ...|000076C0 | .. . . . .... . . ....... .... . .. . . . |00007700 |. . .. .... ... . ....... .... .. . |00007740 | ...... . ... . ... . .... . .... . ... . |00007780 | ..... ... ........ . .. .. ...... . .. . .|000077C0 | .. . ... ..... ..... .... . . .. ...... ... .... |00007800 |.. ... .. . ..... . . ... ... .. . .|00007840 | ... . ... .. ..... .. .. .. .. .. .. ..... .|00007880 |. . .. ... ..... ... . .. . . .. . .|000078C0 |.. . . ... ... . . . .... .. . ....***********|00007900 |******* .. . ... . ....... . .. . .. . ... |00007940 |... . . . ...... . . ............. . ... . . |00007980 | . ....... . .. . .... ... . .. . .. .. . .|000079C0 | . ... . . . . .. .. ..... .. .|00007A00 | ... .. . .. . .. . . .. .... . .. . ...|00007A40 | .. . ... .. . . . . .... .. .. ...|00007A80 |.......... ..... . . . . . .......... ...... . . |00007AC0 | . .. ........ ..... ........ .. . .. . . .... |00007B00 | ... . . .. .. . . . . .... . ..... . . . ..|00007B40 | . . ..... . ..... .. . .. . . .. . .........|00007B80 |. . ... . . . . . .. .. .. .. . .. ..|00007BC0 |... ....... ... ..... .. . .... ... . . ..|00007C00 | .... . . . . . . ...... . ....|00007C40 |. . ... . .... .. .. . . .. . . . .. |00007C80 | . . ... .... ... ... . .. . .. .. .. .......... |00007CC0 |. ... ..... .... . . .... . . ... . .. |00007D00 | .. . . .... .. ... . .. .. . . . . |00007D40 | . .. ... .... . . . . ..... . . |00007D80 |.. . .. . .. . . .. . .. .. ... . . .... ...|00007DC0 | . . . . ..... . . ..... .. ... . .... |00007E00 |. . . ... ...... ..... . . . ........ . |00007E40 |... ... . . .. . .. . ....... |00007E80 |. . . .. . . . .. . . . .. ..... . |00007EC0 | . . . .. ... .. . . ... .. . ... |00007F00 | . . .. . . ... . . . . .. . .. .|00007F40 | . .. .. . .. .. . .. . ... ... . . ....|00007F80 |............. ......... . . . . . ... .. .... .... ....|00007FC0 | ... . . . ..... . .. . . . . ... . . |00008000 | . . . .... . .. .. ... .. .. . . . .|00008040 |.. . .... .. .. .. .. . . .. . ... . .|00008080 | ... . .. . . . .... . . .. .... . . . |000080C0 |. ... . . .. . . ...... ... . . .. |00008100 |. . ... ... . . ... .. . .............|00008140 |....... . . .... . . .. . ..... ....|00008180 | ... ...... . . . .. . . .. . .. . .|000081C0 | . .. .... . .. ... . . . .... .. . . ..|00008200 | ..... . .. . . .... . . .... . .. |00008240 | ***************** ......... . . . .. ..|00008280 |.. . .. .. .. ... .... .. .. ... . .. . .|000082C0 | .. . . . ... . . .. .. .... .... . . . |00008300 |... .. .. . . . .... .. ....... . . . . |00008340 |. ...... ...***********************. .. .. . |00008380 | . .. . . ..... .. ... . ..... ...... |000083C0 | . . . ... .. . ....... . . ..|00008400 | .. . . .. . . .... . |00008440 | . ...... .. .. . .... . ... . |00008480 | .... . ... . .. .. . ... . . . . ......|000084C0 |..... .. ..... . . . . . ... . |00008500 | . . ... ... .. . . . . ... ... . . . |00008540 | . ..... . . . . . . . .. . . . ... .. . |00008580 |... .. .. .... . .. . .. . ... . |000085C0 |... ...... .. . . .. .... . . .. ... .. . .|00008600 | .. . .. ... .. . .. .. .. .. ... . .. .. .. |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 29 of 4800008640 |..... ... . .. . .... .. ... . . .... |00008680 | . . ... ... .... . ... ... . . . ... .|000086C0 |........ ..... ... . . . .. . . . . ... |00008700 | ... .. . .. ... .. .. . . .. . . ... . . . |00008740 | .. . . ... . .... .. ..... . .. ... ......|00008780 |..... . .. . . . . .. . .... . |000087C0 |. . .... .. .. .... . .. .. .. . . |00008800 |.. ... . . . . ... ... .. .. ..... . |00008840 | . .. .... . ... .. ... . .. . .. |00008880 | .. . . . .. . . . . .. . ...... .... |000088C0 | . . . ..... . .. . .. .. . .. .... . .. |00008900 | ... . .. . ... ... . .. .. . .. |00008940 | . ... . .. .. . . ... . . .. .. . |00008980 | .. . ... .. . . . . .... . . |000089C0 | .. .. . . . .. ... . ...... . .... .... |00008A00 | ..... .. . . .. ... . .... ...... ..... . .. .. |00008A40 | .. .. .. ...... .. . ... .. . . . |00008A80 |.. . ... . .. .. . . .. .. . .. ... . |00008AC0 | . . .. .... ... . . ... .... ... . . . . . ..|00008B00 |.. ..... . .. . . .. . . . .. ..... .... .. . |00008B40 | . .. .. . .. . .. . . .. .. |00008B80 | ...... . . ... .... .. ... . . .. .. .. |00008BC0 | . . .. ... .. ... . .. . .... .. .|00008C00 | . . ... . .. .. . ... .. .. . .... |00008C40 | ..... .... ... . .... .. . .... .... .. . .. . .|00008C80 |. . . .... ... .. . .. . .. .. . .. . .. . ... . . ..|00008CC0 |. ... . ... .. .. |00008D00 | .. . .. . ... .. .... .... .. ..... . . . ..|00008D40 | ...... ... .... .. . .. . . .. .. . . |00008D80 | . . . . .. .. . .... ... .. . .. ... . .. .|00008DC0 |.. .. .. .... ..... . . . .. ... . |00008E00 |. ... . ... .. .. .. .. ... .. .. ... .... . .|00008E40 |... ... . . .. .. . .. . .. .. .. . ... . . . |00008E80 |. .. . . . . .. . .. .... .... . .. .. . . |00008EC0 | ..... . . . .... .. . . . . |00008F00 | ... . ..... . . .. .. . .. . . ... .. |00008F40 |.. ........ .. ..... . . . .. .. . . |00008F80 |.... ... ...... .. .. . ... .. . |00008FC0 |.. .. .. . . .. .. . .. . . ... ... ... . |00009000 | . .... .. .. .. .. . .. ... . .. ......... .. |00009040 |... .... . ... . . . . .. . . .... .. |00009080 | .... ... . .. . .. . ... .. .. . .. . .|000090C0 | . ... ..... .. . ... .. .. . . .. . .... .|00009100 |.. . .. . .... ... . . .. .. .. ... .... |00009140 |. ... . .. .. . .. .. . . .. .. .|00009180 |.. . . .... . ... . . ...... .. . . . ... ..|000091C0 | . .. . . . ... . ..... . . .... ...... . .... |00009200 |.. ..... .. . .... . . . . . .. .. . ...... ..|00009240 | ... . .. . . .. .. .. ... . ...... .. . ...|00009280 | . . . . . .... .. . . . .. |000092C0 | . . ... ... . . ..... .. . . ... ... .. .. ...|00009300 |. . ... .. ... . ..... . . .. .. . .... . |00009340 | . ... . .. .. . . .. ... .. .. .... . . ... . |00009380 | .... .. .. .. . . .. . . . .. . ... |000093C0 | .. ...... . . .. ..... . . .. . ... . . . . |00009400 | .. .. ... . ..... .. .. .. ... .. . . . . |00009440 |. .... .. . .... .. ........ . . . |00009480 | .. ... . .... . . .... .. . ..... ... |000094C0 |... .. .. .... . ..... .. .. . ... ... . .. .|00009500 |.. . .. . . . . . . ... .. ..|00009540 |.. . .... . . . .. ... ... .. .. .. .... . .|00009580 | . ... .... . .. .. .. .... .. .. . .|000095C0 |. . . . .. . . . .. ... . . . . . ... .|00009600 |.... ........ .... .. .. .. .... .. .. . |00009640 |... . ..... . ... .. .. . .. . . .. |00009680 | .. .. .. .. . .. ...... .. ... . .. |000096C0 | .. . .. .... . .. . . .. . . .. .. . .. .|00009700 |.. ... . . .. . .. . . .... ... . . . .. |00009740 |.. ... .. .. . .. . .. ... . . . .. .|00009780 | . ... . .. .... . .. . . ... . . . ...... |000097C0 | ..... . . . . .. .. .. .. . ... |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 30 of 4800009800 |.. .. . ..... . . ..... . . . .. .. ... ... .. . .|00009840 |. ... . . .... .... . ..... . ... ...... ..|00009880 | .. . .. . . .. . .. . .. .... ... .... |000098C0 |.... . .. . . ... . ... . . . . ...|00009900 |.. . .. . .. ... . . .. . .. . . . .. . . .|00009940 | .. . .. .... .. . . ..... . ... . |00009980 | . .. .. ... . .. . .. . . . .. . .. . |000099C0 | . ........ . .. ........ . . . . ....|00009A00 | . . . . ... .. .. ... . .. . . . .... .. |00009A40 | ... . . . . . .. . . ..|00009A80 |.. .... .... . . . . . . . .. . ... ..... .|00009AC0 | . . .... .. .........|00009B00 |....... ..... . . . . .. .. . ... .. . . . |00009B40 |.. . .. . ... . . . ...... . |00009B80 | . . . . . . . . . .... .. . . |00009BC0 | . . ... . .... ... . . . .. . .|00009C00 |. . .. ... ... . . . ... . . .... . . ..|00009C40 |. ... . ... . . . . .. .. .|00009C80 | .. ..... . . . . . . .. . . . |00009CC0 | . . . .. .. . . .... . .. . . |00009D00 | .. . .. . . .. . . . . . ... ... . . ...|00009D40 |............ . .. .. . . . ... . ....|00009D80 |. .. ....... . ... . . . ... |00009DC0 |. . . . . .... . . .. ... . .. |00009E00 | . .. . . . . . .. . . . . ... . |00009E40 |.... . ... . ....... . .... . . . . . .... .. . .... |00009E80 | . ......... .. . . .. .. . |00009EC0 |. .. . ... .. . .. ... . .... ..... .. .|00009F00 | .. ... . .... .. . . . .. .. . . .... .. |00009F40 | .. .. ... . ... ... ... . .. . |00009F80 | . . . .... . ..... ... . ... . . . .. ... .. ..|00009FC0 | .. . . . ... .. . . .. .. . .. .. ... . |0000A000 |. ..... . .. ..... .. . . .. . .... ... ... |0000A040 |. . ........ .......... .... ... . . .... |0000A080 | . .. . .. . . . ... ... .. .. |0000A0C0 | .... . . . . .. . .. ... . .|0000A100 |. ..... . . .... . . . . .. . ... .. . . |0000A140 |. .. ... . .. . . . . . . . .....|0000A180 | ... ... .. . . . . ... .. ... .. .... .. |0000A1C0 | . . .. .. .. . . ... . .... .. .... . . |0000A200 | ... .... .. ... .. . . .. .. ... ... . |0000A240 | .. . . . . . ... .... .. .. . . ..|0000A280 | ..... .. .. ... .. . .... . . . ... .. . |0000A2C0 | . . . .... .... . ................. .. ..... .. |0000A300 | .. . ... . .. . . .. .. . .... ... . .. |0000A340 | ... .. .. . . . . . .. . .. . .. |0000A380 | .. . ... . . . . ... . ...... ......... |0000A3C0 | ................ .. .. ... .. .. ... . . ..|0000A400 | . .... . .. . . .. . ... . .. . . . |0000A440 | .. .. ... .... . . .. ... . .. .. |0000A480 | .. . . .. .. . . .. .. ... .|0000A4C0 | . . . .. ... ... . . .... ..... . .. . . .|0000A500 | . .. .. ....... .. ...... . .... .... . .. |0000A540 | . ... ... .. ....... .. .. .. . . ...|0000A580 | .... . . . . . . ... .... . ....... |0000A5C0 |... . ... . .......... . . . . . . .. . ..... |0000A600 | . .. .... . . .. . . .. . .. .. . . |0000A640 | .. ... ... .. . .. .. . .. .. . . . . . |0000A680 | . .. . ... . . . .. . ... . ..|0000A6C0 | ... ....... . . . ... . . ... ... ..... ........ |0000A700 | .... . .. ............ ..... ......... ........ . .|0000A740 | . . . . . . . .. .... . . . ............ ...|0000A780 |. .. . ....****************************************|0000A7C0 |**************************************** . . . . |0000A800 |... ..... .. ... . . . . .. .... . ... . . . |0000A840 | .. ........ .... ..... .. . . ..****************|0000A880 |********************* ...........************************ .*|0000A8C0 |********************* .... . . . . . . . .****|0000A900 |****************************************************************|0000A940 |** ... . . . . ************************|0000A980 |*************************************************......... ...|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 31 of 480000A9C0 |..... .*********************** .... .. . . .********|0000AA00 |***********....... .************************************** .*|0000AA40 |********************************************* .... . . .|0000AA80 | . . . . .********************************************|0000AAC0 |************************** ... . . . .****************|0000AB00 |*************************.. ************************* .. .|0000AB40 |. ... . . ... . . . .. .. .... ... . . |0000AB80 | . . . ... .. . ... . . . ...... ... .......|0000ABC0 | .............. . . .. . . . . . . . |0000AC00 | . . ..... ..... .. . . .... . .. ... ... . |0000AC40 | .. .. . ..... ... ... . . ... .***********|0000AC80 |*************************************** ................*****|0000ACC0 |******************** . .************************************ **|0000AD00 |******************************************* *****************|0000AD40 |**** .******************************************* ..........|0000AD80 |... ***************************************** .............|0000ADC0 |. ********************* .................******************* ..|0000AE00 |........... *********************************** ************|0000AE40 |******* ............... *********************************|0000AE80 |*** *********************************************************|0000AEC0 |*********** ........... . . . ... . . .. .. ... . |0000AF00 | .. .... ... .... .... . .. .. ..... .|0000AF40 |****************************************************************|0000AF80 |****************** ..********************** ...... .*******|0000AFC0 |************ . . ..... . . . ...... ***|0000B000 |************************** . ... . . |0000B040 | .. . . .. .. .. .. ... .... ... . . ....|0000B080 | ..... . ... . . . . . |0000B0C0 | . ... .... . . . . . . .... .. .... . |0000B100 | . .... . . ..... . . . ..... . ..... . .. . . ..|0000B140 |... .***********************************************************|0000B180 |****************************************************************|0000B1C0 |****************************************************************|0000B200 |****************************************************************|0000B240 |******************************************* ... . . . |0000B280 |. . .. . ... .... . .********************|0000B2C0 | .... ..... .. . . ..********************************|0000B300 |*****.. . . . . .. .. . . . .. . |0000B340 | . . . . . . .. . ... .. ... . . . |0000B380 | . . . . . . .... . . ... .|0000B3C0 | . . . . . . . . . . . . . .|0000B400 |. . . . ..**************************** ........ .*******|0000B440 |**************** .... .. . . .************************|0000B480 |* .************************************** .*****************|0000B4C0 |***************************** ... .. .. .. .. .. .|0000B500 | .************************************************************|0000B540 |********** ... . . . .********************************|0000B580 |************************************************* ... .. . .. |0000B5C0 |. . .... .... . . . . . . . . . ..... .. ... |0000B600 | . .. . .. . ... . . .. .. . |0000B640 | . . .. . .. . . .. .... ... .... . ...........|0000B680 |. .. ............ ............... ******|0000B6C0 |******************** . . . . . |0000B700 | .. .... . .. ... .. . . . ... . . .... . .. . ....|0000B740 | . . ... . . ..... .... . .. |0000B780 |.... ....... ******************************* . .... . |0000B7C0 |... .. ...... .. ................... .. .... .... .|0000B800 |....... ... ...... .. ..... . .. . . . |0000B840 |. ... . .. . ......... ..... ....... . .. ... .... ..|0000B880 |.....********************* .... .......... .. . ....... ...|0000B8C0 |... ..... ........ ............. ............... ...... |0000B900 | . . ..... ...... ... .. ............. ..... ... .....|0000B940 | . . . . .... . . . . ... . .. . |0000B980 | . . ... .... . . .... ............... ....... .... |0000B9C0 | ............ .. . . . . .. . . .... . .|0000BA00 | .... ... . . . . . . .. . . .. . .. .|0000BA40 |. . ..... . ... .. . . .. .. |0000BA80 | .. . . .. ..... . ..... ....... .. ... |0000BAC0 |............ ..... .. ....... ............... . ...... .. |0000BB00 | . ... . ... . . . .. ........ .|0000BB40 | ....... .... .... .............. .. ....... ...........|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 32 of 480000BB80 |. ... .... ... .... . .. . .*************|0000BBC0 |*********************** ............ ... . ... .... .. |0000BC00 | . .. . .... . ... . .. .... . ..... ..|0000BC40 | .. ... . .. .... .. ***********************|0000BC80 | . ...... ........ ... . ....... ... ............ .|0000BCC0 | . . .. . . . . . . |0000BD00 |. .. . . . ... . ... . ..... . .. . |0000BD40 | . . . . .. . . . . . .|0000BD80 | .. ... . .. . . .. . . . .. .... .....|0000BDC0 |. . . . .. .. .. ... . . . .. ... . ... |0000BE00 | . .. .. ... ..********************************* |0000BE40 | .. .... .. . . . ... .. . ........... .. ***|0000BE80 |******************* .... ......... ***************** |0000BEC0 |......... ........ ... ....... .. ....... ....... *|0000BF00 |********************************************** ........ .. |0000BF40 | ... .. . . . .... . ... .. ........|0000BF80 |. ... . .... . .. . ********************** .|0000BFC0 |.... ..... .... **************************** .. |0000C000 | ....... . . .. . .. .|0000C040 |... . .... ... ... ... .. . . ........ . . . .. |0000C080 | .. . . ... . .... ... . . . . .. ... |0000C0C0 | . . . . .. . .. ... .. .... . . .. ......|0000C100 |....... .. ... . .. .. .. .. . .... ... .... .|0000C140 |.. . ... . .... . . .. . .. .. .. |0000C180 | .. .******************* ...... ........... ... ........|0000C1C0 |...... ................ ............ ......***************|0000C200 |*************************************************************.. |0000C240 |.. . ... ... .... . . .... .. . . ..|0000C280 |. .. . .. ..... .. .... . . ... |0000C2C0 | ... . . . .. . .. .... .... *********|0000C300 |********************* ...... ..... ....... ......... ...... |0000C340 | ......... .. . . .. . . ..... . . . .. |0000C380 | . .. ........ .. .. .. ..... ....... . . ...............|0000C3C0 |... ...... .. . .. .... . . . . . . |0000C400 |..... . . ..... .... . . ... . ... . .. ..|0000C440 | ... .. ...... ... . ... .. . ... . .|0000C480 | ... ....... .. .. ... . . . . .. . . |0000C4C0 | .. ... . . . ... .. .... ...... ......|0000C500 |.... . .... .............. ... ..... ............... ****|0000C540 |************************ ... .... .. . . . .. .. . |0000C580 |... .. . .. ...... . .. .. . .... .... |0000C5C0 | . ... ..... ... . .. ...... .......... ........|0000C600 | . .. ..************************************ |0000C640 | .. ....... .. .. .... ... .. .......... ...|0000C680 |.. .......... ******************** ......... .... ....|0000C6C0 |......... ... .... ....... .000000000000000000000 ....|0000C700 |. .. ......... .... . ... .. . . . . .. . |0000C740 | .. . .. . . . . . ..... . . .. .|0000C780 | . .. .. . .. .. . . . |0000C7C0 | .. .......... ..... ..... .......... ....... ..... ....... ...|0000C800 |. ......... *************************** ********************* .|0000C840 |..... ********************************* *****************|0000C880 |***** ********************* ...... .... .... ..........|0000C8C0 |.... ......... ...... ... . . . .. . .... .. |0000C900 |... . ..... . ..... .. ..... . ........ .... ...|0000C940 |............ *************************** ......... *************|0000C980 |***********.. .. . . . . . . . ... . . .. . ... |0000C9C0 | . . .. .. . .. . .. ..................... . .|0000CA00 |....... **************************** ********************.|0000CA40 |...... ..*******************************************************|0000CA80 |********************** ****************************** ........ *|0000CAC0 |**************** ******************************* ....... .. |0000CB00 | ......... . .*******************************************|0000CB40 |******** ************************** ....... .... **************|0000CB80 |*** .. ... ****************************** .... ******|0000CBC0 |************************************ . . ............. **|0000CC00 |****************************** ............. ........... .|0000CC40 | .******************************************* ....... ..|0000CC80 |..... ....... *****************************.... . |0000CCC0 | ... . .... .. . .. ... . . . . . .. . .|0000CD00 | .. .. .......... ****************************************|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 33 of 480000CD40 |** ... *****************************************************|0000CD80 | . .******************************* ... ...... |0000CDC0 | ................. ......... ........ ....... ........ *******|0000CE00 |********** ....... ......... ......... ........ ....... ....|0000CE40 |.... ........... ......... .... ........ ..... . . .|0000CE80 | .. . ... . .. .. ... . . .. .. |0000CEC0 | .... ....... .... ...... .... .......... .......... .. |0000CF00 |........ ........... .. . ...... ..... . . ....|0000CF40 |... . . .********************************************. . .|0000CF80 |.******************************** ***************************|0000CFC0 |*******.............. .. .. ..... . .. . . .|0000D000 | .. . .... ... . . . . .. .. . . . . .......|0000D040 | . . . . ... .. ...... . ....... ......|0000D080 |....... ... . ..... ............ ............. . ... ....|0000D0C0 |............ . . ... .. .. . . . .....|0000D100 | . .... . . .. ... ....... .. ....... ...|0000D140 |. ... ......... . ......................... .... |0000D180 | . .. . . ... ...********************* .........|0000D1C0 |.. ........... ............... ***************************|0000D200 |************************* ****************************** .|0000D240 |....... .......... ... ... . . .. . . |0000D280 | . ... . . . . ... . . . . . . .. . .|0000D2C0 | .. .. . .. ........... .............. ....|0000D300 |... . ... ..... ... ... . . .. ... .|0000D340 |. .. . . . . .. .. . . .. . .. . .... . |0000D380 | ............ ........ .... .. ..... ............ |0000D3C0 | ....... . . ... ............ ......... ... |0000D400 | .......... ......... .... ....... ........ ........... .|0000D440 |..... ****************************************************|0000D480 |*******..***************** . ... .... . . . . |0000D4C0 | . ... .. . ... ............ ....... ......... .|0000D500 | .... .... .... ... ........ .............. ..... ..............|0000D540 | ... .... .... ............... ............ ******************|0000D580 |************ ...................... ********************** .....|0000D5C0 |...... ....... ................ ........ ...... . . |0000D600 |. . . ... .... .. . . . . .. . . . ..|0000D640 |. ....... ........ ... ....... .. ..... ...... .... |0000D680 |.... ...... ...... . . .. ... *********|0000D6C0 |*********... .. . . . . .. .. ............|0000D700 |.. ............ ........... ....... ................ ..|0000D740 |..... ............. ....... ....... .. ...... . ... .. ..|0000D780 | .. .............. ........... .. .. . ... . |0000D7C0 | . . .. . .... . .. . . .. ....|0000D800 |................ .. ........... .. ...... ... .. .. .|0000D840 |.... ... ............. . .. . ... . . .|0000D880 | . .. . ... . . ... . ... ... ........|0000D8C0 |... ....... *********************************** ......|0000D900 |... **************************** ............... ***********|0000D940 |****** *********************************************************|0000D980 |***********************************. ... *********************|0000D9C0 |********* ....... ....... . ....... .. .. .... .......|0000DA00 |......... .............. . .. . . .. . . ... |0000DA40 |. .. .. . .... . ....... .. . .. . ... .. |0000DA80 | . . . . .. . ... .. . .. . . . . .. . .|0000DAC0 | ...... . . .. . . ...... .. . ... . . |0000DB00 | . . . . . ..... . ... . . |0000DB40 | .. . . ... .. .... ... . . . . . . . . .. . .|0000DB80 |.............************************ *************************|0000DBC0 |************************ ... . ... ..... .... ...|0000DC00 |. ..... ... .... ......... ... ****************|0000DC40 |****** ....... .... .... ... ... .... .... ....|0000DC80 | .... ... .... . .. .. . ... . .. ...|0000DCC0 | . . . .. .. .. ....... .. ....... .......|0000DD00 |....... ********************* ..... ..... ...... .. |0000DD40 | . . .. . . . . .. ... . . .. .|0000DD80 | . ..... ... .. ... .... .. .. ..... . .... . .... .|0000DDC0 |... ... . .. ... .***************** *****|0000DE00 |************ ........ ******************* ........ .......|0000DE40 |... . .. .... . ... . .. ************************|0000DE80 | . ........... ......... .... . ... ... |0000DEC0 |.. ... .... ... . ...... .. ..***********|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 34 of 480000DF00 |************ ........... . .... ... ....... . |0000DF40 | . .*************************** *********************|0000DF80 |******** ******************* ************************ |0000DFC0 | . ... .. ... . ... . .... .. ... ... .. .......|0000E000 |... . ........ .. ........ ... .. ... ....... . |0000E040 | ...... ... . .. ... ....... .... .. ..... ...|0000E080 |.. ... . . .. .. .. ..... . ..... .... ...|0000E0C0 |.. ......... . ....... . ....... ........... .... . ..... |0000E100 |... . . .................. ....... .|0000E140 |... .. .. .............. ................ ..............|0000E180 | ********************* . .. ... ... |0000E1C0 |. ... . ..... . . .. . .. . ..... .|0000E200 | . .. .. ........ ******************** ******************|0000E240 |******** ......... .... ................ . . ........ .......|0000E280 |...... ............ .... ........... ..|0000E2C0 |...... . .. ... ... . . . .....|0000E300 | .. . . . . . ... . .. ....... .....*******************|0000E340 |****************************************************************|0000E380 |****************************************************************|0000E3C0 |***** . . ... ... ... . . .... .. . .. .. .. |0000E400 | . . . . . . . . ....... ...... .........|0000E440 | .********************************************** ...........|0000E480 |.... ............ .***************************** ... .**|0000E4C0 |***************************.. . ... . ... . . . . |0000E500 |. . . . . . . . ... ... . . ..... ..... |0000E540 | ........ .************************ ................ .....|0000E580 |.... ......... . . .... . . . . ... . .|0000E5C0 | .. .. .. .. .... ................. .......|0000E600 | .. .. .. .********************* ... .**************|0000E640 |****************************************************************|0000E680 |**************************** ... ... ... . .. ...|0000E6C0 | . .. ... . . . ... ... .. ... ............ .. |0000E700 | *********************** ........... .......... ..........|0000E740 |... .***************************** ......... .............|0000E780 |.. ........... ............ .............. ......... |0000E7C0 | . . .... ..... . . . . .. |0000E800 |....... ....... ..... ........... .................. ...|0000E840 |..... .************************* .******************** .**|0000E880 |************************** .************************* *******|0000E8C0 |************************************************** .**********|0000E900 |******** .*********************************************** .*|0000E940 |******************************************* *******************|0000E980 |*********************************** .*************************|0000E9C0 |***.. . .... ******************* ... . . .|0000EA00 |.... . . . ..... . .... ... .... ...... .... |0000EA40 | ..... ... ........ ..... .*******************.........|0000EA80 |....... ........ . . . . . . ...... ....... .... |0000EAC0 | ....... . ... . . . ... . .. .. .|0000EB00 | .. . ... . . ... .... .. .. .. .. .. . |0000EB40 | . . . . . . ..... . . .. .. .... . . ... . .. .|0000EB80 | .. . . . .. ... .. . . ... . .. . .|0000EBC0 | . ... .. ... . ............ . . .. .. . . .. ..|0000EC00 | .. .. . . ..... . . .. .. . .. .. ........... .. .. |0000EC40 |... .. .. .. ..... . . ..... . . . .. .. . . .....|0000EC80 | . .. .......... .... .... .... ..... |0000ECC0 |. ....... .. .. .. .. . ... .. . . . |0000ED00 | .... . .. . . . . . . . . . ......|0000ED40 |.. ... .. ... .......... .............. ........ |0000ED80 |... .. . . ... . . .... ..... ..|0000EDC0 | . .... . . . . . . . ..****************** |0000EE00 | .**************************************************************|0000EE40 |****************************************************************|0000EE80 |************************************ .************************|0000EEC0 |****************************************************************|0000EF00 |****************************************************************|0000EF40 |****************************************************************|0000EF80 |****************************************************************|0000EFC0 |****************************************************************|0000F000 |****************************************************************|0000F040 |****************************************************************|0000F080 |***************** ........ ..... ................ ..... |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 35 of 480000F0C0 |.. . . . . ... . . . . .. . . |0000F100 | .. . . . . . . .. . . . ... . . . . .|0000F140 |. . . . . ... . . .. ... .**************************|0000F180 |********************************************************** .**|0000F1C0 |****************************************************************|0000F200 |****************************************************************|0000F240 |**************************** .******************************|0000F280 |********************************************* ........ .........|0000F2C0 | .............****************** ... .....****************** ..|0000F300 |.... ... ***************************.***********************|0000F340 |********* ******************************************************|0000F380 |**...... .... .......... ........... ........... ... ****|0000F3C0 |****************************************************************|0000F400 |***** ...... ..... ********************** .... .............|0000F440 | .************************* ... .....***************** ...... .|0000F480 |.. ************************************ ....**************|0000F4C0 |************* ... ...................... . . . |0000F500 |. .... . . . . . . . . ... . . .... ..|0000F540 |................ . . .... . .. .. .|0000F580 | ... .******************************************|0000F5C0 |****************************************************************|0000F600 |******************************************** . .. . . . |0000F640 | ... ............ .. .. .. ...... |0000F680 | ... .. . .. . ... .. ..*******************************|0000F6C0 |**** ... ........... ...... *****************************|0000F700 |****** ........ ************************************ .......|0000F740 |. ......................... .. ....... . . .*****|0000F780 |*************** .. . ... .. ......... . . .. .. |0000F7C0 | . . .. .. . . .... .. . . ..|0000F800 | . . . . . . .... . .. .. . . ..... |0000F840 |. ... . .. .********************************* **|0000F880 |***************************** *********************** ****|0000F8C0 |********************************** **************************|0000F900 |**********.... .. .. ... . ... .. . .. . .. . |0000F940 | . .... . . .***************** .......|0000F980 |.. .......... **********************************************|0000F9C0 |****************************************************************|0000FA00 |***** *************************** ************************|0000FA40 |****************************************************************|0000FA80 |*** .............. ..... .... .... ........... ..... ... .|0000FAC0 |.. .................. ************************************|0000FB00 |*** ******************************.. . . |0000FB40 | . . . . . . . ....|0000FB80 |.. ..... ****************************************** ...........|0000FBC0 |.. .. ................ .. . .. .. . .... . ... |0000FC00 |. . . . . . . . .. . . .... .. . ... .|0000FC40 |. . . . . ... . . .. . . .. .. ... . |0000FC80 |. . .******************************************************* |0000FCC0 | ****************** . .............. . ............ . .*********|0000FD00 |*********************************************** .. .. |0000FD40 | . . . . . .. . |0000FD80 | ......... ............. *********************************|0000FDC0 |** ........ ............... ...... . .. . . ...|0000FE00 | .. .. .. ......... . ... .. . .. . .... ... ..|0000FE40 | .. ....... ................ ......... ............ . ..... **|0000FE80 |****************************************************************|0000FEC0 |****************************************************************|0000FF00 |****************************************************************|0000FF40 |********************************************************* ******|0000FF80 |*********************************************************** ...|0000FFC0 |.. ..... ... ...... .... ....|00010000 | .. .. ... .... .. .. . . *****************|00010040 |****************************************************************|00010080 |********* ............... ................*******************|000100C0 |************** .... . . .. ......... . . .. .. |00010100 | ...... ..... .. .. ... ........ ....... ***********|00010140 |*********** .... .. ........ .... . . .. . ... .|00010180 |.. . ... ... . .. .. ... . ... . . ... . .. .... |000101C0 |. . . . . .. . . .. .. |00010200 | . . . ... .... .. . .. ......... ....... .. ...|00010240 |.......... .... ...... .. . .... .. .. .|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 36 of 4800010280 |..... ..... .. ....... .... ... .. ..... |000102C0 | .... .. **************************************************|00010300 |***** ....... .. .... .... ..... ............... *****|00010340 |************ . .. . .. .***********************|00010380 |********************** ........ *****************************|000103C0 | *********************************** ........ .......... |00010400 | ............. .......... . .. . . .|00010440 |. ... . ... . .. . . . ...**********|00010480 |***********************.............. .... .. .................|000104C0 | ****************** ...... ............. .. .............. |00010500 |..... ....... ***************************** ......... ...|00010540 | ..... ******************************************* ..........|00010580 | .......... **************************** *************|000105C0 |****************************************************************|00010600 |** .............. .............. **********************|00010640 |*******... .. .. .... .. . .. . .. |00010680 | . ..... . . . ... .. .. ... .. ... . |000106C0 | . ...... .. . . ..... .... .. .........|00010700 |. ... . . ... .... .... ..... . . |00010740 | .. . . . . ... ... . . . . . .. . |00010780 |. . ... . . ....... ........ .... ..... ...... .... |000107C0 | ....... ...... ..... . ... .... ... . . ...|00010800 | . .. . .. . . . . . . . . ... . .. |00010840 | ...... ************************* ....... .... ***|00010880 |****************** .... .... *********************** |000108C0 |...... . ..... . . ....... . ... .. .. ..|00010900 |.. ............... ............... . .. ............ |00010940 | .... ... ....... . .... . . . . |00010980 | . . . . . . . . . ... .... .. ......|000109C0 | ...... .... .... .... .. ... ..... .... |00010A00 | .............. . . ... ..|00010A40 | .... . ..... .. . ...... .. .. ... ... .|00010A80 |. .... ... ... .. ... . . ... ... ..... ...|00010AC0 |.. .... .............. ............... . ..... *|00010B00 |***************************************** ............ |00010B40 | ..... ..... .. ... ... .. .. .. ... ..|00010B80 |. ..... ...... ................ . .. . |00010BC0 | .. . ............. . ....... ........ .... . |00010C00 |. .. . ......... .******************************|00010C40 |************************************** ... ........... ...|00010C80 |. ********************************** ......... ***************|00010CC0 |*********.. .. . . ... . . . |00010D00 | . ... .. .. . . . . . .. ... . .. |00010D40 | . ...... . ... .. .. .... .. . ... . .. . |00010D80 | .. ... ...******************** ..... .. **************|00010DC0 |************ .. ********************* ....... ...........|00010E00 |.... ............... ............... ............... ...........|00010E40 |.... ...... ....... . ........ . ..... |00010E80 | ........ .. . . .. . .. .. . . .. |00010EC0 | . . . .. ... ... .. . . |00010F00 | .. . . ...... ... ... .. ..... .|00010F40 |............... ......... ...... ..... ........ .......|00010F80 |.... ............ . . . .. . . .. ... . |00010FC0 | . ..... . .. . .. .......... .. ... |00011000 |.*********************************** .............. **********|00011040 |************************ .... .*****************************|00011080 |*************************************** .*********************|000110C0 |******************************************** .****************|00011100 |****************************************************************|00011140 |****************************************************************|00011180 |****************************************************************|000111C0 |*************** .********************* .********************|00011200 |***************************** ..... .********************** |00011240 | ......... ............. .*********************************|00011280 |************************** .************************* *******|000112C0 |************************** .............. ................ |00011300 |.***************************** ***************** ...... ..|00011340 |............ . . ... .. ..... ... .******|00011380 |************************ ................. .****************|000113C0 |****************************** .... ....... ......... .**|00011400 |******************************************** ....... .******|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 37 of 4800011440 |*********************** .***************** .****************|00011480 |**************** .************************************** ...|000114C0 |........ .********************************************* ... |00011500 | ...... ... . . . ... ...******************|00011540 |******************************************* ........... ......|00011580 |.......... .... . . . . .... ... .. . .. |000115C0 | ... ... .. . . . .. .......... . . .. . . .|00011600 | ... ... . . .... ... . ... . . .. ... |00011640 |........... ........ ................ .*******************|00011680 |**************** ............ .. ******************* ****|000116C0 |************* ****************** .. .......... .. ...|00011700 |........ ......... .. .... ........ .............. .|00011740 |. ............. ....... ........ .... .... |00011780 | . . ... . ..**********************************|000117C0 |********************************************************.. . .|00011800 | . . .. ... . .. . .... ..... . . . .. |00011840 |.... . ........... ... . . ..... .. |00011880 |. . .. . ... .. .. . ... . . .. . .. ..|000118C0 | .... . . .. . . .. . .. . .. . |00011900 | ......... .... ******************** ............. ..|00011940 |....... . .... ... .. . . .. . .. |00011980 | . . . .. . . . . . .... .. .......... ..|000119C0 |....... ....... ******************************************|00011A00 |*********** . ... . ... .. . . . ..|00011A40 | .. . ... . ... . .. . .. . ... ... |00011A80 | ... .. .. .. . ... ... . . .. |00011AC0 | . .. ... . . ...... . ... . .. ... .. ... |00011B00 | . . . .. .. .. .. .. .. . ... ... .. ........|00011B40 | . . . . ... . . .. ..... |00011B80 | .. . .. . . . . . . . ... .. .. . . |00011BC0 |... .. . . .. ... .. . .. ... . ******|00011C00 |********************** ....... ................ |00011C40 |............... . ... .......... .. ..... .. ... .. . .. . .|00011C80 | . . . .. . .. .... .. ...... . . .. . .. ...... .. |00011CC0 |.. ...... ...... ....... . ... . . . ... . . .. .|00011D00 | .... .... .. . ... ... ......... ... . . .. .|00011D40 | . . ... . . . ... ... . ... . .|00011D80 | ... ..... . .. ... . . .. .. . .. .. . .. . . ..|00011DC0 | ... . ...... ....... . . ... .... ... ...|00011E00 |.......... ........................... ... .... ...... |00011E40 |.......... . ....... .. ...... .. ... ..... ..************|00011E80 |****** ...... ...... ....... ************************* . |00011EC0 |... .... .............. ......... **********************|00011F00 |*********** *********************** ... . .... ..... |00011F40 |.... . .. .. ............ ............. ....... *********|00011F80 |******************* .............. ...... ........ ...|00011FC0 |...... ***************************************** ............|00012000 |... .......... ....... ..... .. .... ***************|00012040 |**************************** ... . ....... .. |00012080 |........ ****************** .. ....... .... .. .. ... |000120C0 | .. ......... . ......... ..... .......... .. ....|00012100 |.... ******************** .... .. .. ..... .. .. ... ....|00012140 | .. .. ......... . ......... ........ ...... .........|00012180 |....... .............. .... .... ...... . *****************|000121C0 |* ... ***************** .............. ...... ......|00012200 |...... ********************** ....... . . |00012240 | ............. ****************** ......... |00012280 |......... ****************** ..... . .. .. . ... ..|000122C0 | . ... . . ... .. . . . . . . .. ..|00012300 | ....... .. . . . . . . . .. ...... ... |00012340 | . . ... .. .. ... . ... . .. .|00012380 |.. .... . . .... . . ...... . . .. .. |000123C0 |. ... . .. ... ... .. . .. ... |00012400 |...*************************************************************|00012440 |****************************************************************|00012480 |****************************************************************|000124C0 |****************************************.. . . . ... . |00012500 |... . .**************************************. .... |00012540 | .... ....... ......... ********************** .... .|00012580 |...... .... ............. ...... ..... ...... .... .|000125C0 | . .. . . .. . .. .. ... ... ....|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 38 of 4800012600 |.. . . ......................... ................ .... |00012640 | ............... ..... ............. .............. ....|00012680 |............ .******************** .************************|000126C0 |**** .********************* .............. *****************|00012700 |************************** ............... .****************|00012740 |****** . .. . . .. . . . . ....|00012780 |...... *************************** ********************** ..|000127C0 |. ....... .. ..... .. ..************************** . ...... ..|00012800 |..... . ................ . .************************************|00012840 |******************** .. *************************************|00012880 | . ... ********************** ............... |000128C0 | ******************************************************|00012900 |*********************** . . .. .... |00012940 | .. .. .. . .. .... . . . . . .. . . . ....|00012980 | . .. .. . . ..... ... .. . ... .... |000129C0 |. ....... ....... . . .... ....... ... .******************|00012A00 |****************************************************************|00012A40 |*************************** ******************* ..........|00012A80 |..... . . . . . ..*******************************|00012AC0 |****** . ******************... .|00012B00 | .. ******************** .... ............. .. . .. . |00012B40 |.. . .. .....********************************************|00012B80 |************************************************************* ..|00012BC0 |............ ..... ......... .. . . . |00012C00 |.. . ....*************************** ... .. ....... |00012C40 |. . ... . .. ...... . . . . . . |00012C80 |. .. . ... ... .. . . . ... . .. .. .. ... .... ... |00012CC0 | ... ..... .... .......... .... . . . ......|00012D00 |.... . ...........**************************** ........... |00012D40 | ..... . . . .. . . .. |00012D80 | .... .. ..... ... .... ... ....... .. .. ... .. .|00012DC0 |... .. . .... ..... . ..... . . . ... . |00012E00 |. . . .... .... ..... ........... ... .. ...... |00012E40 |.... .... . .. . . . . .......... *******|00012E80 |********************* ****************************************|00012EC0 |******......... ....... **********************************|00012F00 |********** ************************************ ****************|00012F40 |*************. .. ...... . ... ..*********|00012F80 |****************************************************************|00012FC0 |****************************************************************|00013000 |****************************************************************|00013040 |*************************************************** ...|00013080 | .************************************************************|000130C0 |******************************.......... . .. . . . |00013100 |. . . . . . . . .. .. .. .|00013140 | . . . .... . . . . . . .. .. .... . .|00013180 | . ........ . . .. . . . .... ..... .. .|000131C0 | . . .. . ... . ... . . ... . . .|00013200 | . . ... ... . . .. ..... ..... . .. |00013240 |. ... .. . . .. . .. . ... . .. . . ..|00013280 | . ... . .. .. .. . .... . . . . .. |000132C0 | .. .. . . .. ... . ................. ...... *****|00013300 |************** ............ ***************** .. . ..... |00013340 |******************* .. ....... ......... ........ ....|00013380 |...... ........... ... . .......... ...... ...... ****|000133C0 |***********************************************......... .....|00013400 |....... ............... .......... ......... ........... ....|00013440 |......... . ........... **************************** ........|00013480 |. .... . ........ ................... ..... . ......... ..|000134C0 |.... ........ ............ . .......... ... ...... |00013500 | .. . .............. ....... . ...................|00013540 | . ......... ....********************************************|00013580 |************************ .. ......... ...... .............|000135C0 |..... ...... ..... ............ ..**************************|00013600 |................ ******************************************....|00013640 |... **********************************************************|00013680 |*************************** ********************** .*********|000136C0 |***************************************************** .... ... |00013700 | ... ........... ...... ............. ..... ...... ....|00013740 |...... ... .... .. ............ . ........ .... ....... .. |00013780 | ....... .... ... ..... ............ ....... ..... ......|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 39 of 48000137C0 |. ............. ..... ... ........ ... . ... . . ... ..|00013800 | .. . . . . . ..... ............ . ..... |00013840 | . . . . .. . ...... ..... |00013880 | . . . .. . .. . . .. .... .. ... .|000138C0 |. . . ... . . .. .. ... . . |00013900 | . . . .. . . .. . . ... .... ...|00013940 | ... ... .. . . .... ..... ****************** ........... |00013980 |. ... . ... . . . .... ... .. ........... .. ....... |000139C0 | ... ... ***************** .... .......... ..|00013A00 | ....... ... ... ......... . .. . . . .......|00013A40 | .. ......... ..... ............|00013A80 | ................. ********************* . .... .. .. |00013AC0 |. . ********************* . .. ..... ...... .. .... .. |00013B00 |.. .. .... .. .. ... .... ......... .....|00013B40 |............... ...... . |00013B80 | ..... ****************************************************|00013BC0 |********************************* .... ....... ..... .. |00013C00 | . .. . .. ... . ... .. . . . |00013C40 |.... . ... . . .. .. . .. .. .|00013C80 | . . .. . .... . ... ..*************************|00013CC0 |******************* ********************* ......... .....|00013D00 |..... ... *********************************** ***********|00013D40 |*************** ********************************** ...... |00013D80 | .......... ...... *****************************************|00013DC0 | ... .... ......************************* ...............|00013E00 | ................ . . ... .. .. . . .. . . . . .|00013E40 | .. . .... . . . . .......... ***************|00013E80 |***** ********************************* ******************* |00013EC0 | . ... . . . ..... . .... .. .. ...|00013F00 | . . . . . . ... .. . ... ...... . .. . .. .|00013F40 |. .. .. .. . . . . . .. . . . ......... .........|00013F80 |. ***************************..... .......... *****************|00013FC0 |******************* ******************************** .........|00014000 |..... .. .. .. ............... *********************************|00014040 |************************************ ......... .....***********|00014080 |************ ..... . .............. *************************|000140C0 |************* ..... ......... ..... .. *************************|00014100 |**************** ...............*******************************|00014140 |*************** ......... . . .****************** .|00014180 |.... .......... ..... .. ******************* ........... ..|000141C0 |... . ..... .... . ...... .. . . . . .|00014200 |.. . ... . .. ..... .. . .... ...|00014240 |.. .. .. . . . .. .. . ....... .......... |00014280 | . .. . .... . . . . . ... .. . . . .... . . .|000142C0 |.. .. . . ..... ****************************************|00014300 | ......... .... ..... ....... ...... ........ ... ..|00014340 |. . ... .. . . . . ... . . . .. . .. . ...|00014380 |. .... ..... ******************* .... *************|000143C0 |********* ............ ........ .. .... ... .|00014400 |.............. ... ................ . . .. . ..... .|00014440 |..... . .. ............ .. ..... ... .... .... . .. .|00014480 | ... . . . . . . . . . . . .. ... . |000144C0 |.. . .. .. .. . .. . .. ... ....... ..... |00014500 |..... ......... ........ ......... ... ... ....... ***|00014540 |************************* ...... . ...... ... ...............|00014580 |. ....... ............. .. . . . .. .. ... . |000145C0 | . ... .. .. ... . . . .. . ..... .*******|00014600 |*********** ********************************** ...........|00014640 |. ************************************************** ......|00014680 |....... ................ .................... . ..|000146C0 | . ..... .. .. . . . . . . . . . .. |00014700 |.. ... .. .. .. .. .... ... ... ... |00014740 | ... ... ... ... .. .. . . . ... |00014780 |.. . . . .. .. . . . . . . .. . .. .. .|000147C0 | ... . .. . . .. .. .. .... . .. . ... .... |00014800 |. . . .. . . .. .. . .. |00014840 | .. ... .. . ..... .. . . .... . . .|00014880 | . . . .... . . . . .. . . .... . .. |000148C0 | .... . . . . . .. ......... ... .. |00014900 | . .. . .. . . .. . .. .. .. . ... . .. |00014940 | . .... ..... ..... . . .. .. . .. . . . |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 40 of 4800014980 |.. .. .. ... .. .. .. .. . .. . ... .. |000149C0 |.. . .. . .. . . .. . ... .. .. . . ...|00014A00 |. .. .. . . ... .. .. . . ... .. .. . . ... |00014A40 |.. .. . . ... .... . .. . . |00014A80 | . . . . . . . ... .. . .|00014AC0 | ... .. .. . ... .. .. . .. . .. . ... |00014B00 | .. .. . . .. .. .. .. ... .. .. . . . .. |00014B40 | .. ... .. .. .. .. .... . ... . |00014B80 |. .. .. . ... ... .. ... . . . .. ..... . .|00014BC0 | . .. .. .. .. . . . . . ... . . . .. |00014C00 |.... . . ... .. .. .. .. . ... . .. . |00014C40 | . . .. . .. . .. . .. ..... . . . .... .|00014C80 | . . . .... .. . . .... . . . . ...|00014CC0 |.. . .. . ... . ... . .. . ... . .. |00014D00 |. . .. . ... ....... .. .. . .... .. .. .|00014D40 | .... .. .. . .. . .. .. . ...... . . . .. .|00014D80 |. .. .... . ... .. .. . .. . ... .. .|00014DC0 |. .... .. . .... . . .. .. ... . ... . .. |00014E00 | .. .. . ... . ..... . .... ... . ..|00014E40 | . . ... . ... .... .. . .. .. .. . .. . . |00014E80 |.. . . .. . .. . .. . . . . . .. .|00014EC0 | .. . ... .. . .. . .. .. .. ... .. ... |00014F00 | .. . .. . ... . . .... . .... .. . .. .... .. |00014F40 | .. ...... .. . .. . .. . .. . . . .. . . .. |00014F80 | . ..... ... . .. . .... .. . .. .. .... .|00014FC0 | .. . .. . ... . .. ... ... |00015000 | .. . .. . ... . .. . . . ..|00015040 |.. . ... . .. .. .. .. . . .. .. .. .. . . ... . |00015080 | .. .. ..... . . . .... . . . .... . .|000150C0 | . . . .... . . . . .... . . . .... .|00015100 | . . . . .. ..... . . . .. . . ..... .|00015140 |.. . . . .. .. . . . . . . . |00015180 |. . .. . ...... . . ... . .. . .. . |000151C0 | . ... .. ... . .. . .. . ... . .... ...|00015200 | . .. .. .... . ... ... . .. . .. . .. . . |00015240 | ... .. .. . ... .. . .. . .. . . .. . .. .|00015280 | . . .. .. ... . .... .. ...|000152C0 |. .. . . .. ... . .. . .. . ... .. . .. ... |00015300 |.. .. . . ...... . . . .. . . ...|00015340 | ...... . .. . . .. . . .. . ... .. . .. ..|00015380 | .. .. .. . .. . .... . .. .|000153C0 |. . . . . .. . ..................|00015400 |..00000000000000000000000000000000000000000000000000000000000000|00015440 |0000000000000000000000000000000000000000000000000000000000000000|00015480 |0000000000000000000000000000000000000000000000000000000000000000|000154C0 |0000000000000000000000000000000000000000000000000000000000000000|00015500 |0000000000000000000000000000000000000000000000000000000000000000|00015540 |0000000000000000000000000000000000000000000000000000000000000000|00015580 |0000000000000000000000000000000000000000000000000000000000000000|000155C0 |0000000000000000000000000000000000000000000000000000000000000000|00015600 |0000000000000000000000000000000000000000000000000000000000000000|00015640 |0000000000000000000000000000000000000000000000000000000000000000|00015680 |0000000000000000000000000000000000000000000000000000000000000000|000156C0 |0000000000000000000000000000000000000000000000000000000000000000|00015700 |0000000000000000000000000000000000000000000000000000000000000000|00015740 |0000000000000000000000000000000000000000000000000000000000000000|00015780 |0000000000000000000000000000000000000000000000000000000000000000|000157C0 |0000000000000000000000000000000000000000000000000000000000000000|00015800 |0000000000000000000000000000000000000000000000000000000000000000|00015840 |0000000000000000000000000000000000000000000000000000000000000000|00015880 |0000000000000000000000000000000000000000000000000000000000000000|000158C0 |0000000000000000000000000000000000000000000000000000000000000000|00015900 |0000000000000000000000000000000000000000000000000000000000000000|00015940 |0000000000000000000000000000000000000000000000000000000000000000|00015980 |0000000000000000000000000000000000000000000000000000000000000000|000159C0 |0000000000000000000000000000000000000000000000000000000000000000|00015A00 |0000000000000000000000000000000000000000000000000000000000000000|00015A40 |0000000000000000000000000000000000000000000000000000000000000000|00015A80 |0000000000000000000000000000000000000000000000000000000000000000|00015AC0 |0000000000000000000000000000000000000000000000000000000000000000|00015B00 |0000000000000000000000000000000000000000000000000000000000000000|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 41 of 4800015B40 |0000000000000000000000000000000000000000000000000000000000000000|00015B80 |0000000000000000000000000000000000000000000000000000000000000000|00015BC0 |0000000000000000000000000000000000000000000000000000000000000000|00015C00 |0000000000000000000000000000000000000000000000000000000000000000|00015C40 |0000000000000000000000000000000000000000000000000000000000000000|00015C80 |0000000000000000000000000000000000000000000000000000000000000000|00015CC0 |0000000000000000000000000000000000000000000000000000000000000000|00015D00 |0000000000000000000000000000000000000000000000000000000000000000|00015D40 |0000000000000000000000000000000000000000000000000000000000000000|00015D80 |0000000000000000000000000000000000000000000000000000000000000000|00015DC0 |0000000000000000000000000000000000000000000000000000000000000000|00015E00 |0000000000000000000000000000000000000000000000000000000000000000|00015E40 |0000000000000000000000000000000000000000000000000000000000000000|00015E80 |0000000000000000000000000000000000000000000000000000000000000000|00015EC0 |0000000000000000000000000000000000000000000000000000000000000000|00015F00 |0000000000000000000000000000000000000000000000000000000000000000|00015F40 |0000000000000000000000000000000000000000000000000000000000000000|00015F80 |0000000000000000000000000000000000000000000000000000000000000000|00015FC0 |*******00000000000000000000000000000000000000000000000..........|00016000 | .. .. ... ...... .. .. .. .. ... .. .. ... ... ... ..|00016040 |. ... . .. ... .. .. . . . .. .. ... . . .. ..|00016080 | .. . . . . . .. .. . .. .. ... ... .. .. ..|000160C0 | .. ... .. .. .. .. .. .. .. .. .. .. .. .. .. ..|00016100 | .. .. .. .... .. .. .. .. .. .. ... .. .. .. .. ..|00016140 | .. .. .. .. .. .. .. ... ... . . . . . . . .|00016180 | . . .. . . ...... ... .. ......... .. ... .......|000161C0 | ... ....... . ...... ... ... ... ... ... ... ... ... .......|00016200 | ....... ... ... ... ... ... ... ... ... ....... . . . .|00016240 |.... ......... . . . . . . . . . . ... ... ... ... .. ..|00016280 | .. .. .. .. ...... .. .. .. . .. ...... |000162C0 | .... . .. ..... ... . .. .|00016300 | .. . . . . . ... . . . . . .. . . .|00016340 | ........... ...... ...... ...... ...... ............ .|00016380 | ...... . . .. . . . . . . .. . .|000163C0 | . . . .. .. .. . . . .. . . . . . . ..|00016400 | . . ... . . . . .. . . . . . . . . . .|00016440 | .. . . . . . . . . . . ... .|00016480 | . .. . .................... |000164C0 | . ..********************************************|00016500 |****************************************************************|00016540 |****************************************************************|00016580 |****************************************************************|000165C0 |*******************..... . ........... ... . ............ .|00016600 | . . . ........ . . . ... . ......... . .....|00016640 |........ ...... . .. ... .. ..... ... .. ..............|00016680 | ...... . ........ . ..... . .************************|000166C0 |************************************************...... .... . ..|00016700 |. .. . . . . . ..... .................. . ..... . .|00016740 |... ...... . ..... . .. ..... . ..... ...|00016780 | .. . . .. ... . .... . ....****************************|000167C0 |**************************************************************..|00016800 |.... .. ........ ...... .. .... ... . . *************|00016840 |******************************************************** . .|00016880 | ... . . ... . . ... .... . . .**************|000168C0 |****************************************************************|00016900 |****************************************************************|00016940 |****************************************************************|00016980 |****************************************************************|000169C0 |****************************************************************|00016A00 |****************************************************************|00016A40 |****************************************************************|00016A80 |****************************************************************|00016AC0 |****************************************************************|00016B00 |****************************************************************|00016B40 |**********************************.......... . .............|00016B80 |..**************************************************************|00016BC0 |**************** . ..... . . ..*******************|00016C00 | ..................... ..................... .. . .....|00016C40 |........ ... ............... . ...... . .................|00016C80 |.... ............. . . ..... ..................... ... .|00016CC0 | . ................. ............. ......... ......... |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 42 of 4800016D00 |........ ................. ............. . . .........|00016D40 |........ ... ............. . . ...... .....................|00016D80 | .............. ... .............. . ...... .... .....|00016DC0 |.................... ..... . .... .. ... . .............|00016E00 |........ ... . ..... . ... .... ..................... . .|00016E40 |.... . ..... . ..... . ..... . ..... . ..... . ..... . . ... . .|00016E80 | . ... ......................... .... ..... . ..... .|00016EC0 |.... ..... ..... . ... . ..... .....................|00016F00 |.... . . . .. ..................... . ..... . .. ...|00016F40 | .......................... ..... ...... ... ... .....|00016F80 |.................... ..... . . ... .....................|00016FC0 |.... ..... . ..... . ... . ..... . ..... . . . .... .....|00017000 |................ ... . . .... ..................... ... .|00017040 |..... . . ..... .......................... ..... . ....|00017080 | ......................... .. ... . .....................|000170C0 |.... . . .... ......................... . ..... .....|00017100 |.................... ..... ... . ... ............. ......|00017140 |................ ... ... .................. ...... ... .....|00017180 |.................... ... ... ..................... .|000171C0 | ..... ..................... . . ..... .............|00017200 |........ . ... ......................... . ....|00017240 | ......................... . . .... .....................|00017280 | ... . . .... . ......................... . . ...... ....|000172C0 |.................... . ..... . . .... .....................|00017300 | . . . ... ......................... .. ... . .....|00017340 |.................... ..... ..... .. ... .. ... .. ...|00017380 | ............. . . . . ................|000173C0 | . . ... ......................... ..... .. ...|00017400 | . ......................... ..... .. ... . .............|00017440 |............ .. ... . ......................... .. ...|00017480 | . . ... ................. ..... ......... ... ..... .|000174C0 |.... ..... ..... . ... . ... .......... ... ...........|00017500 |. ................. . ..... .......................... .|00017540 |.... ... .......................... . . . ... . ... .|00017580 | ... . ... ..... . .... . . ... .....................|000175C0 |.... . . .... ......................... . ... ... .....|00017600 |.................... .. .... ..................... .|00017640 |.... ..... ... ......................... ..... ... ...|00017680 | ..................... ..... ... .....................|000176C0 |..... ... ... ..................... . .... .....|00017700 |................ . .... . ..................... . .|00017740 |. .... . ......................... . .... .............|00017780 |............ ..... ..... ... ......... ............... .|000177C0 |.... . .... ......................... ..... ..... ...|00017800 | ......................... ..... ..... . . .... .....|00017840 |.................... ...... ..... ... .....................|00017880 |.... ..... . ... . ... . ... . .... ..... . ... .|000178C0 |.. .... ......................... . . .... .............|00017900 |............ ..... . . ... . . ... . . ... . . ... . . ... . .|00017940 | ... . . ... . . ... . ..... . . ... ......................|00017980 | . ..... . .... ..... . ... ... ... .. ... . . ... . .|000179C0 |.... . ..... . . .... ......................... ...... .|00017A00 | .... ......................... ..... . . .... .....|00017A40 |..................... ..... . .... ......................|00017A80 |.... ..... . ... . ......................... ..... .|00017AC0 |.... ... ... ...................... ..... ..... .|00017B00 |.... . ..... . ..... . ..... . ..... . ....... ..... . . ....|00017B40 | ......................... . . ... .....................|00017B80 |...... ..... ... ... ......................... . . . ....|00017BC0 | ......................... . ..... .... .....................|00017C00 |.... ..... ... ... ..................... . ..... ...|00017C40 | ......................... .. .... .....................|00017C80 | . ..... ..... ... ......................... ..... .|00017CC0 |.. ... ..................... ..... ... .............|00017D00 |............ ... ... ..................... ..... .|00017D40 | ... .. ... .. ... .. ... .. ... .. ... .. ... .. ... ..|00017D80 | ... .. ... .. . . ... . ......................... ...... .|00017DC0 | ... ..... . . ... .......................... ..... .|00017E00 | ... ... ... . ... ... ... ..................... ...|00017E40 |.... ... ... .... .... ......................... . ..... . .|00017E80 |.... . ..... . . . ... . ... . ......................... . .|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 43 of 4800017EC0 |.... . ..... . . ... . . ... . ..... . . ... . . ... . ..... ...|00017F00 | ... . ..... .. ... . ... ............. ... ... ... .....|00017F40 |............ . .... ......................... . . ...|00017F80 | ......................... . ....... . . ... .............|00017FC0 |............ ..... ..... ..... ............. ... .....|00018000 |.... ............. ... .......... ............. ... ......|00018040 | ... . ... . ..... ....... . ...........................|00018080 | .. .. .... . ..................... .. . . ..... . ......|000180C0 |.... .. . . ... . . . |00018100 | ................ ... . .. ... .....................|00018140 | . ..... . ..... .... ... ..... ... .. .. ..... .|00018180 |.... . ... 000000000000000000000 . ... .....|000181C0 |.................... ..... ............. ... ......... .|00018200 |.... ...... . .......... .. .. .......... .. .. ......|00018240 |.... .. .. .......... .. .. .......... ...... ..........|00018280 | ... .. .......... .. .. .......... .. ..................|000182C0 |.... .. . .. ...... ... .. . .. ... .. .. .. .. ..|00018300 | .. .. .. .. .. .. .. .. .. .. .. .. ... .. .. ..|00018340 | .. .. .. ... .. .. .. .. .. .. .. .. .. .. .. ..|00018380 | .. .. .. .... . .. . .. . . ... . . . . . .|000183C0 | .. . . .. .. .. . . . . ... . ... ... . .|00018400 | .. .. .. .. ... .. . . . .. . . . .. . .|00018440 | . ... ... .. .... . . ....... . ... . .... .. .. .. .. |00018480 | .. .. ... .... .. ..... ... ... ... ... ... ... ... ... ...|000184C0 | ........... ....... ... ... ... ... ... ... ........... .. .|00018500 | ..... ..... . . ... . . . . . .|00018540 | . . .********************** . . . .. .. . |00018580 | . . .. ..... .. .. . .. . ....... . .. . .. . . . . |000185C0 |. .. .... . . . ... .. .. ................. . ..|00018600 |.. . . . . *********************** *******************....|00018640 | ******************..... ............. ... .... ... . .. . |00018680 | . ... . . . . . . ........... ..... . ....... ..... .|000186C0 |. .. .. .. . ... .... ... .. .... ***********************|00018700 | . . . . .............. ........ . ... .... . . . . ...|00018740 |. . .......... .... .. ... .. . . .. . .|00018780 | ... ... ******************** . .... ... ....... . ... .|000187C0 |... .. ..... ............ . . . . . . .. . .....|00018800 |..... ... .. ... ............ ........ . . . . .. .... |00018840 | .... .. ............... ............. . ..................|00018880 | ............. .............. . . .... ..... .. *************|000188C0 |**** .. . . . . . ........... .. . ... ...........|00018900 | ............. .... . ..... ...... . . .. .. ... .|00018940 | . . . .. .. .. . . .. . . ...... .. ..... |00018980 | ... . . . .. ... .. . . ..... . . ........... ..... .|000189C0 | .... .. . . . . .... . . . . .. ... ... . ...|00018A00 |. . .. *******************************..... .******************|00018A40 | . ******************** ............ .......... ..|00018A80 |............ . .. .. .. ******************* ......... . .. |00018AC0 |. .. . ... .. . . . ****|00018B00 |**********************************************.......***********|00018B40 |****** . .. . ******************************** ...|00018B80 |..... . . ....***********************************************|00018BC0 |****.************************************............ .. .. ..|00018C00 |... . .... ...... . ... .... . ..... . . .... . . .|00018C40 |. ...... . . ... .. . ....... . ..... . .. ...|00018C80 | .. . .. ............... .. ...... ... . ... ..|00018CC0 | . . ... ... ... . . .. .. .. ............000000000|00018D00 |0000000000000000000000000000000000000000000000000000000000000000|00018D40 |0000000000000000000000000000000000000000000000000000000000000000|00018D80 |0000000000000000000000000000000000000000000000000000000000000000|00018DC0 |0000000000000000000000000000000000000000000000000000000000000000|00018E00 |0000000000000000000000000000000000000000000000000000000000000000|00018E40 |0000000000000000000000000000000000000000000000000000000000000000|00018E80 |0000000000000000000000000000000000000000000000000000000000000000|00018EC0 |0000000000000000000000000000000000000000000000000000000000000000|00018F00 |0000000000000000000000000000000000000000000000000000000000000000|00018F40 |0000000000000000000000000000000000000000000000000000000000000000|00018F80 |0000000000000000000000000000000000000000000000000000000000000000|00018FC0 |******0.........................................................|00019000 |.... .. .. .. .. .. .. .. . . . . . . . . . .....|00019040 |.... . . . ......... ......... ..... .**********|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 44 of 4800019080 |************************************************.... ... . |000190C0 | . . ... .. . . .... . . .. ...... |00019100 |.... . . . ......... . . . .|00019140 | . . . . . ..... . . . . . ....|00019180 |........ . . ......... ...... . . . |000191C0 |........ ..... . ......... .. ... . . .. ... . . . |00019200 | ... . . . . . . .. . ..... .... . . . .... |00019240 | ... . .............. . . ... . . ... . .... . . ..|00019280 |.... .. . ... .... .... ..... .. ... .. ... |000192C0 | . ..... .. ... ... .. .********************. *********|00019300 |******************* . . ................ . ......|00019340 |........ ... . .... . .. ... .... . .... ...|00019380 | . .. ...... ........ .. *************************|000193C0 |***. .. . . . ............... .. .. ....|00019400 |. ***************************************************. ... ..|00019440 |. . . . .. .. . .. .... . . . ... |00019480 |.... . . ........... .. . .. . ... ... . ... |000194C0 | .... . ... .. . .. .. . .. . . . .. . |00019500 | .. .. ..... ... .. . ..... . . .. ..... ... |00019540 |.... .. ... ....... . ... .. . ............ .... ..... |00019580 | .. . ... . .. ... .. . . . .. .... .|000195C0 | . . .... . . . ... . .... .. ..... |00019600 | .. .. ... ... . .. .. . . .. .. .... .|00019640 | ... . . .... .. .. . . ... . . .. . . .. . .. |00019680 |..... .. . .. ..... ... .......... .. .... .. .... . .. ....|000196C0 |.... . . . . ... .... ... . .. .. ..... .. .. . .|00019700 |. . .. . . ...... . .. . ... ... .. ........ .. . .. . .|00019740 | .. . ... ... .. ........ .. . . . ... . ...... . ...|00019780 | .. .... ...... . ... . ... ... ... .... ... . .|000197C0 | . .. .... . . . .. ... . .. .. . .. . |00019800 |. . . .. .... .. .. .. . . ..... .. . .. . ... |00019840 |. ..... . . .. . ...... ... ... . ...... ...|00019880 |. .. ...... . . . ... .... . .... ... .... .|000198C0 | ...... ... .... ...... ..... .. ... .. . ... .... |00019900 | . . . . ..... ... ... .. ... . . |00019940 |..... .. . . .. .... ....... . . . . . ...|00019980 |. ........ . . .. ..... . .. ... . . .. . . .|000199C0 | . . .. .. . .. .. . . .. . . ... . .|00019A00 | . .. .. .. .. . . . . . . .. ... |00019A40 | . ... . . ... . . . . . .. .. . . . |00019A80 | ..... . ... . . ... . ...... ... . .... . |00019AC0 | . . . . ... .. . . . . .... . .. ... .|00019B00 | . . . . . .... .. . . . . . .. |00019B40 | .. .. . . . .. . . . . .. ... . |00019B80 |.... . ... . .. .. . ..... . . . . . |00019BC0 |. ... . ..... ... . .. . . . . .. ... |00019C00 | ... . . .. ... . . .. . .... .... |00019C40 | . .. ... ... . .|00019C80 | . . . . . . . . . ....|00019CC0 | ..... .... .... ...... ..... ... ..... . . .|00019D00 | . . ... . . .. .. . .... . . . .. |00019D40 | . .. . ... . .|00019D80 | . . . . . . .. . . .. . . . . |00019DC0 |... . . . . . . .... . . .. .. . ... .. .|00019E00 | . . .. . .. . .... . . . . . . . . . . .|00019E40 |. .... ... .. . .... .. ....... .. . . . . .|00019E80 | . . .... ... . .. ..... . . . .. . .... . . .|00019EC0 |.. . . . . .. .. . . .. .. . .. . .... . . |00019F00 |. . .. . . .... . . .. . . .. . .... .. . .. . |00019F40 |.... . . . . ... . ..... . ... . ... ... ............. |00019F80 |. . .... ...... . .... . ..... . .. ..|00019FC0 | . ..... . . .... . ..... ... .. ..... ... ..|0001A000 | . . ..... . . ............. ............|0001A040 | .. .. .. .. ............... .. .. . . . . .. .|0001A080 | . . . . . . . . . . . . . . . . . . . . . . .|0001A0C0 | . . . . . . . . . . . . ... .. .. .. .. .. .. .. .. ..|0001A100 | .. .. .. .. .. .. . ... ...... ............. .....|0001A140 | . ............ . ..... . ....... ..............|0001A180 |................................................................|0001A1C0 |...............................000000000000000000000000000000000|0001A200 |0000000000000000000000000000000000000000000000000000000000000000|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 45 of 480001A240 |0000000000000000000000000000000000000000000000000000000000000000|0001A280 |0000000000000000000000000000000000000000000000000000000000000000|0001A2C0 |0000000000000000000000000000000000000000000000000000000000000000|0001A300 |0000000000000000000000000000000000000000000000000000000000000000|0001A340 |0000000000000000000000000000000000000000000000000000000000000000|0001A380 |*******00000000000000000000000000...............0000000000000000|0001A3C0 |000000000000................. .............................. .|0001A400 |............ ............... 000000000000000000000000000000000|0001A440 |******00000000000...............................................|0001A480 |........................ . *********************************|0001A4C0 |****************************************************************|0001A500 |****************************************************************|0001A540 |****************************************************************|0001A580 |********************........ .. . . . . . .........|0001A5C0 | . . . .********************************************************|0001A600 |****************************************************************|0001A640 |****************************************************************|0001A680 |****************************************************************|0001A6C0 |****************************************************************|0001A700 |0000000000000000000000000000000000000000000000000000000000000000|0001A740 |0000000000000000000000000000000000000000000000000000000000000000|0001A780 |*******0000000000000000000000000000000000000000000000000000000..|0001A7C0 |.........................***************************************|0001A800 |***************************************************. ....... ...|0001A840 | ... ... .... . ... . ... . .... . ... . .... . ... . .|0001A880 | ..... . ..... ..... . .... . ... . .... . ... .|0001A8C0 | .... ..... ..... ..... . ... .|0001A900 | ... .. ... . ... . .... ....... ...... . ...... .|0001A940 |................. ........... .. ... 0000000000000000000........|0001A980 |........................0000000000000000000000000000000000000000|0001A9C0 |****************************************************************|0001AA00 |******0000000000000000000000000000000000000000000000000000000000|0001AA40 |****************************************************************|0001AA80 |****************************************************************|0001AAC0 |*******0000000000000000000000000000000000000000000000000 . . .|0001AB00 |..............................**********************************|0001AB40 |****************************************************************|0001AB80 |*************************************... .... ......************|0001ABC0 |******************** ..... ..... ..... ..... .. ... .|0001AC00 |.... ..... . . ... . . ... . . ... . . ... . ... . ... .|0001AC40 | ... . ... . .... . ... ..... .**************************|0001AC80 |****************************************************************|0001ACC0 |****************************************************************|0001AD00 |****************************************************************|0001AD40 |****************************************************************|0001AD80 |****************************************************************|0001ADC0 |*****.........**************************************************|0001AE00 |********........ ....... . . . . . . . . . . . . . . .|0001AE40 | .............. ......... ......... ........ |0001AE80 |..**************************************************************|0001AEC0 |****************************************************************|0001AF00 |****************************************************************|0001AF40 |****************************************************************|0001AF80 |****************************************************************|0001AFC0 |****************************************************************|0001B000 |****************************************************************|0001B040 |****************************************************************|0001B080 |****************************************************************|0001B0C0 |****************************************************************|0001B100 |****************................................................|0001B140 |..................0000000000000000000000000000000000000000000000|0001B180 |0000000000000000000000000000000000000000000000000000000000000000|0001B1C0 |0000000000000000000000000000000000000000000000000000000000000000|0001B200 |0000000000000000000000000000000000000000000000000000000000000000|0001B240 |0000000000000000000000000000000000000000000000000000000000000000|0001B280 |0000000000000000000000000000000000000000000000000000000000000000|0001B2C0 |0000000000000000000000000000000000000000000000000000000000000000|0001B300 |0000000000000000000000000000000000000000000000000000000000000000|0001B340 |0000000000000000000000000000000000000000000000000000000000000000|0001B380 |0000000000000000000000000000000000000000000000000000000000000000|0001B3C0 |0000000000000000000000000000000000000000000000000000000000000000|

Who Wrote Sobig? Copyright 2003-2004 Authors Page 46 of 480001B400 |0000000000000000000000000000000000000000000000000000000000000000|0001B440 |0000000000000000000000000000000000000000000000000000000000000000|0001B480 |0000000000000000000000000000000000000000000000000000000000000000|0001B4C0 |0000000000000000000000000000000000000000000000000000000000000000|0001B500 |0000000000000000000000000000000000000000000000000000000000000000|0001B540 |0000000000000000000000000000000000000000000000000000000000000000|0001B580 |0000000000000000000000000000000000000000000000000000000000000000|0001B5C0 |0000000000000000000000000000000000000000000000000000000000000000|0001B600 |0000000000000000000000000000000000000000000000000000000000000000|0001B640 |0000000000000000000000000000000000000000000000000000000000000000|0001B680 |0000000000000000000000000000000000000000000000000000000000000000|0001B6C0 |0000000000000000000000000000000000000000000000000000000000000000|0001B700 |0000000000000000000000000000000000000000000000000000000000000000|0001B740 |0000000000000000000000000000000000000000000000000000000000000000|0001B780 |0000000000000000000000000000000000000000000000000000000000000000|0001B7C0 |0000000000000000000000000000000000000000000000000000000000000000|0001B800 |0000000000000000000000000000000000000000000000000000000000000000|0001B840 |0000000000000000000000000000000000000000000000000000000000000000|0001B880 |0000000000000000000000000000000000000000000000000000000000000000|0001B8C0 |0000000000000000000000000000000000000000000000000000000000000000|0001B900 |0000000000000000000000000000000000000000000000000000000000000000|0001B940 |0000000000000000000000000000000000000000000000000000000000000000|0001B980 |0000000000000000000000000000000000000000000000000000000000000000|0001B9C0 |0000000000000000000000000000000000000000000000000000000000000000|0001BA00 |0000000000000000000000000000000000000000000000000000000000000000|0001BA40 |0000000000000000000000000000000000000000000000000000000000000000|0001BA80 |0000000000000000000000000000000000000000000000000000000000000000|0001BAC0 |0000000000000000000000000000000000000000000000000000000000000000|0001BB00 |0000000000000000000000000000000000000000000000000000000000000000|0001BB40 |0000000000000000000000000000000000000000000000000000000000000000|0001BB80 |0000000000000000000000000000000000000000000000000000000000000000|0001BBC0 |0000000000000000000000000000000000000000000000000000000000000000|0001BC00 |0000000000000000000000000000000000000000000000000000000000000000|0001BC40 |0000000000000000000000000000000000000000000000000000000000000000|0001BC80 |0000000000000000000000000000000000000000000000000000000000000000|0001BCC0 |0000000000000000000000000000000000000000000000000000000000000000|0001BD00 |0000000000000000000000000000000000000000000000000000000000000000|0001BD40 |0000000000000000000000000000000000000000000000000000000000000000|0001BD80 |0000000000000000000000000000000000000000000000000000000000000000|0001BDC0 |0000000000000000000000000000000000000000000000000000000000000000|0001BE00 |0000000000000000000000000000000000000000000000000000000000000000|0001BE40 |0000000000000000000000000000000000000000000000000000000000000000|0001BE80 |0000000000000000000000000000000000000000000000000000000000000000|0001BEC0 |0000000000000000000000000000000000000000000000000000000000000000|0001BF00 |0000000000000000000000000000000000000000000000000000000000000000|0001BF40 |0000000000000000000000000000000000000000000000000000000000000000|0001BF80 |000000000000000000000000000000000000000000000000000000000000....|0001BFC0 |*******00000000000000...000000000000000000000000................|0001C000 |. ..... ...... . ... ... . . . ...... . . |0001C040 | .. .. .... . .. . ... ......|0001C080 | ... .. . .. .. ...|0001C0C0 | ........ . ..... ... . ... . . . . . .. .. |0001C100 | ... . .... . . .... . . . ... . ... ... .. |0001C140 | . ... . . . ... . ...... .. .... . . . |0001C180 |.. .... . .. .. . . .. . . . .... |0001C1C0 | . .. . . . . . ... . . . . |0001C200 |... ... . . . . . . . . .... .. |0001C240 | .. .. . . . .. . . .. . ... . . .. . |0001C280 | ..... .. ... .... . . . .. ... .. |0001C2C0 | .. .... ... .... .... .... .... |0001C300 |..... ... .. .. . ..... . ... .. .|0001C340 |... .. . . ..... . . . .. ... ..|0001C380 |. .. .. .... .. . .. .. .. . . ... |0001C3C0 | . ... . . .... .. . .. .. .. . .. |0001C400 | ... .. .. .. . . ... .. .... .. . . ....|0001C440 |.................................................. . .|0001C480 | . . . . .. . .. . . . .... . |0001C4C0 | . .. ... .. . . . ... . . .|0001C500 |. . .. . . . . . |0001C540 |. . . . . ... . . |0001C580 | . . . . . . . . . |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 47 of 480001C5C0 | . . . ... .. . . |0001C600 | . . . ... . .|0001C640 | .. .. . . . . . . . |0001C680 | .... .. . . . ..... .... .. .. . ..... . |0001C6C0 | . .. . .... ... . . .. . .. . |0001C700 | .. . . .. . . .. . . .. .. ... |0001C740 | . . . . .. . . . . . .. . |0001C780 | . . . . ... .. . ... ... .|0001C7C0 |. . ... ... . ... .. . .. .. . . . |0001C800 | .. . ... ... . ... .. .. .|0001C840 |... .. . ... .. .... . .. . ... |0001C880 | . . . . . . . .. . . . ..... ... ... |0001C8C0 | . . . ... .... . . . . . . .. ...|0001C900 |. ... ... . . .. . .. .. .. |0001C940 | . .... .. .. ...... . . ... .|0001C980 | ... .... ........... . .. . . . .... .... ... .. . |0001C9C0 | . . . . . .. .... . .. . ... |0001CA00 | . . . ... . .. ... ....... |0001CA40 | . .... . . .... . ..... . .. .. |0001CA80 |.. .. .. . . . . .. . .... .. . |0001CAC0 | . .. . .. . .. . . .. . .. .. .. ... ... ...|0001CB00 | .... . . .. .. .. . . . .. . .. .. ... |0001CB40 | ... . . ... ... .. . . . .. ..... .. .|0001CB80 |. .. .. . . . .. .. . . ... ... ..|0001CBC0 | . . . ... . .. . . . ...|0001CC00 |.. ..... . . .. .. . . .. .. .. . . |0001CC40 | . .. .. . . . . . . . . .|0001CC80 | . .. .. . . .. . . . . . ... ...... |0001CCC0 | . . . . . . .. .. .. . .. |0001CD00 |... . . . . . . . . . . . |0001CD40 | . . . . . . . . . . .. |0001CD80 | . .. .... .. . . |0001CDC0 | ... . .. . . .. .. . . . .|0001CE00 | .. . .... . .. . .. .. .. .. . .. .... |0001CE40 | . .. . . . . . .... . .|0001CE80 | . .. . . . . . . . |0001CEC0 | .. .... . ...... . . . . . |0001CF00 | .. . . . .. . . . . .. ... . |0001CF40 | . . . ... .. . .|0001CF80 |. .. . . . . . . . . . .|0001CFC0 | . . ..... . . . .... ... |0001D000 | . ... . .. ... . . . |0001D040 |.. . . . ... . ... ... .. . . ... . .. .|0001D080 |. .. .. ... ... ... . . . . ..|0001D0C0 |. . ... . ... . ... .... . ... . ..|0001D100 | . . . ... . .... . . . .. . . . . ... |0001D140 | ... . .. . . . . ... .. .. .... . .. . |0001D180 | ..... .. . ... ... . .. . . |0001D1C0 | . . . . .. . .. . ... . . ... |0001D200 | . . . . . . .. . .... . .... ......|0001D240 |... ... . ... . ... . ... . . . ... .|0001D280 |.. .. .. .. .. .... ... . . ... ..|0001D2C0 |. .. . . . . . . .. . . . . . |0001D300 |... . . .. . .. ... . .. . .. . . |0001D340 | . .. . . . . . ... . |0001D380 | . . .. .. . . ... . ... .... .. |0001D3C0 | .... .. ........ ... . ... .. ... . . |0001D400 | . .... . . ...... ..... ... . . ... . .|0001D440 | . . . . ..... . . .. . |0001D480 |... .... .. . ... . . .. . . . |0001D4C0 | . . . .. .. . .. .. . . . . . . |0001D500 |. .. ... ... ... .. ... .. .. ... ... .. ..|0001D540 |. . .... ... . . . ... . ... .. . . |0001D580 | ........ ........ ... ......... . . . |0001D5C0 | . .. ... .. .. ... . . . ... |0001D600 | . . . .. .. . . . . ...... . . |0001D640 | . .. . . . . .. . . .. ..... ... . . |0001D680 |... . . . . . . .. . . .|0001D6C0 | . ... . . |0001D700 | . . . . . ... . . . |0001D740 | . .. . . . . . . .. |

Who Wrote Sobig? Copyright 2003-2004 Authors Page 48 of 480001D780 | . . . . . . . . . . |0001D7C0 | .. . ... . . |0001D800 | . .. . . . . . . . . . |0001D840 |. . . . . . . . ... |0001D880 | . . . . . . . . . |0001D8C0 | .. .. . . . . .. |0001D900 | . .... .. ... . . . . . .. . |0001D940 | . . . . . . |0001D980 |. . . . . . .. . . ... ..... |0001D9C0 | . .... .. .. . .. . .. ... |0001DA00 |. . .. . . ...... .... ... . .. .. |0001DA40 |.... ... . . .... ... . .. .. .. . |0001DA80 | . . . . .. . ... .... ..|0001DAC0 | ..... . ... ... . |0001DB00 | . . . . ... . . . . . . |0001DB40 | . . . . .. . ... . .|0001DB80 | . . . . . .|0001DBC0 | . ..... .. .. . ... ......... . . .......|0001DC00 |.. . ..................... ..... ..... ..... .*******|0001DC40 |**********. .. . ********************** .............|0001DC80 |.. ..... . . . . . . ... ......... ........... ..|0001DCC0 |.. .. ............. . .... ..... .. .. ... .. .. ..|0001DD00 |. .. ........................................................|0001DD40 |............................ . ... ... ... ... ... ... ... ..|0001DD80 |. .. .. ... .. .. ... ... ....... .................... ...|0001DDC0 |..*****00000000000000000000 ...... .. . . ... . . ... . |0001DE00 |. . .. . ............. . .. ...... . .. . . .... . .....|0001DE40 |.. .... . .. . . ....... . .. . . . . . . .. . .|0001DE80 | .. . . .. . . . . . . ....... . . ... . ..... . |0001DEC0 |... . ... . .. .. . .. .. . .. . . . .... .|0001DF00 | ...... .. . .. .. ....... . .... . ......... . .. ..|0001DF40 |. ... . . . . .... . ... ..... ... . . . |0001DF80 |.. ...............000000000000000000000000000000000000000000|0001DFC0 |0000000000000000000000000000000000000000000000000000000000000000|0001E000 |0000000000000000000000000000000000000000000000000000000000000000|0001E040 |0000000000000000000000000000000000000000000000000000000000000000|0001E080 |0000000000000000000000000000000000000000000000000000000000000000|0001E0C0 |0000000000000000000000000000000000000000000000000000000000000000|0001E100 |0000000000000000000000000000000000000000000000000000000000000000|0001E140 |0000000000000000000000000000000000000000000000000000000000000000|0001E180 |00000000000000000000000000000000000000000000000000..............|0001E1C0 |..0000000000000000000000000000000000...0000000000000000000000000|