Analysis Date2014-04-19 05:31:28
MD5424c279b8d75c32218f254f1f756fd35
SHA17af6c4c35f6f57125cd893129bf7b2682d1bb396

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: b52f77a9020159d008eb9322519e6813 sha1: 84fc85b47f026f2b114c7eedf44a8ec546f5ddcf size: 634368
Section.rdata md5: 7330f1ad6bf9b4b97fd2c91d801f1017 sha1: 41453e125bfc22e0012ad6a3e07a267d18ee66fd size: 51200
Section.data md5: e6be45ebc7d6eeedfedfac8c77039a34 sha1: 20aff53fec84bc5ba5f6912bb06da768a9f498b3 size: 227840
Timestamp2014-02-12 19:39:57
PEhash64a84aad0fab557f8ce1a07fb0d98988052983e1
IMPhash18fd6a18d2954a24f45dadf5709d026a
AVavgWin32/Sality
AVaviraW32/Sality.AT
AVmcafeeW32/Sality.gen.z
AVmsseVirus:Win32/Sality.AT

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Aasppapmmxkvs\A1_0 ➝
2692894802
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\AntiVirusOverride ➝
1
RegistryHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden ➝
2
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\malware.exe ➝
C:\malware.exe:*:Enabled:ipsec
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride ➝
1
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Aasppapmmxkvs\-993627007\1768776769 ➝
215
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\00015186_Rar\malware.exe
Creates FileC:\WINDOWS\system32\bjudlstmeazxoh\tst
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\ytfvdpuf1v53o0wkupqqan.exe
Creates FileC:\WINDOWS\SYSTEM.INI
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\ytfvdpuf1v53o0wkupqqan.exe
Creates MutexuxJLpe1m
Creates Mutexsvchost.exeM_1112_
Creates Mutexservices.exeM_616_
Creates Mutexmalware.exeM_1396_
Creates Mutexalg.exeM_1848_
Creates Mutexlsass.exeM_628_
Creates Mutexsvchost.exeM_1024_
Creates Mutexsvchost.exeM_808_
Creates Mutexmonitor.exeM_1148_
Creates Mutexuserinit.exeM_204_
Creates Mutexspoolsv.exeM_1312_
Creates Mutexsvchost.exeM_856_
Creates Mutexsvchost.exeM_1116_
Creates Mutexreader_sl.exeM_948_
Creates Mutexcsrss.exeM_548_
Creates Mutexsmss.exeM_500_
Creates Mutexwinlogon.exeM_572_
Creates Mutexexplorer.exeM_296_
Creates Mutexsvchost.exeM_1160_

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\ytfvdpuf1v53o0wkupqqan.exe

Process
↳ Pid 204

Process
↳ Pid 296

Process
↳ Pid 948

Network Details:

DNSdonaven4guia.com
Type: A
216.239.138.217
DNSfredesecas.com
Type: A
216.239.139.20
DNSlaloponea.com
Type: A
216.239.138.68
DNSdavedekilai.com
Type: A
66.147.244.161
DNStablefruit.net
Type: A
98.139.135.198
DNSstickmarch.net
Type: A
98.139.135.198
DNSfairgreen.net
Type: A
208.73.210.209
DNSfairsound.net
Type: A
157.7.200.171
DNSdreamsound.net
Type: A
66.151.181.33
DNSthissound.net
Type: A
66.6.44.4
DNSdreamhand.net
Type: A
74.220.219.141
DNSgrouppage.net
Type: A
64.74.223.44
DNSdreamhappy.net
Type: A
116.126.87.71
DNSthisheat.net
Type: A
182.48.49.156
DNSdreampage.net
Type: A
66.151.181.33
DNSthispage.net
Type: A
50.63.202.62
DNSvisitgreen.net
Type: A
DNSspokesound.net
Type: A
DNSvisitsound.net
Type: A
DNSspokehand.net
Type: A
DNSvisithand.net
Type: A
DNSwatchlift.net
Type: A
DNSfairlift.net
Type: A
DNSwatchgreen.net
Type: A
DNSwatchsound.net
Type: A
DNSwatchhand.net
Type: A
DNSfairhand.net
Type: A
DNSdreamlift.net
Type: A
DNSthislift.net
Type: A
DNSdreamgreen.net
Type: A
DNSthisgreen.net
Type: A
DNSthishand.net
Type: A
DNSarivehappy.net
Type: A
DNSsouthhappy.net
Type: A
DNSariveheat.net
Type: A
DNSsouthheat.net
Type: A
DNSarivesince.net
Type: A
DNSsouthsince.net
Type: A
DNSarivepage.net
Type: A
DNSsouthpage.net
Type: A
DNSuponhappy.net
Type: A
DNSwhichhappy.net
Type: A
DNSuponheat.net
Type: A
DNSwhichheat.net
Type: A
DNSuponsince.net
Type: A
DNSwhichsince.net
Type: A
DNSuponpage.net
Type: A
DNSwhichpage.net
Type: A
DNSspothappy.net
Type: A
DNSsalthappy.net
Type: A
DNSspotheat.net
Type: A
DNSsaltheat.net
Type: A
DNSspotsince.net
Type: A
DNSsaltsince.net
Type: A
DNSspotpage.net
Type: A
DNSsaltpage.net
Type: A
DNSgladhappy.net
Type: A
DNStakenhappy.net
Type: A
DNSgladheat.net
Type: A
DNStakenheat.net
Type: A
DNSgladsince.net
Type: A
DNStakensince.net
Type: A
DNSgladpage.net
Type: A
DNStakenpage.net
Type: A
DNSequalhappy.net
Type: A
DNSgrouphappy.net
Type: A
DNSequalheat.net
Type: A
DNSgroupheat.net
Type: A
DNSequalsince.net
Type: A
DNSgroupsince.net
Type: A
DNSequalpage.net
Type: A
DNSspokehappy.net
Type: A
DNSvisithappy.net
Type: A
DNSspokeheat.net
Type: A
DNSvisitheat.net
Type: A
DNSspokesince.net
Type: A
DNSvisitsince.net
Type: A
DNSspokepage.net
Type: A
DNSvisitpage.net
Type: A
DNSwatchhappy.net
Type: A
DNSfairhappy.net
Type: A
DNSwatchheat.net
Type: A
DNSfairheat.net
Type: A
DNSwatchsince.net
Type: A
DNSfairsince.net
Type: A
DNSwatchpage.net
Type: A
DNSfairpage.net
Type: A
DNSthishappy.net
Type: A
DNSdreamheat.net
Type: A
DNSdreamsince.net
Type: A
DNSthissince.net
Type: A
HTTP GEThttp://donaven4guia.com/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://fredesecas.com/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://laloponea.com/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://davedekilai.com/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://tablefruit.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://stickmarch.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://fairgreen.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://fairsound.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://dreamsound.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://thissound.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://dreamhand.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://grouppage.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://dreamhappy.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://thisheat.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://dreampage.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://thispage.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://donaven4guia.com/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://fredesecas.com/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://laloponea.com/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://davedekilai.com/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://tablefruit.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://stickmarch.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://fairgreen.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://fairsound.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://dreamsound.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://thissound.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://dreamhand.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://grouppage.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://dreamhappy.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://thisheat.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://dreampage.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
HTTP GEThttp://thispage.net/forum/search.php?method=validate&mode=sox&v=023&sox=3b69f000
User-Agent:
Flows TCP192.168.1.1:1037 ➝ 216.239.138.217:80
Flows TCP192.168.1.1:1038 ➝ 216.239.139.20:80
Flows TCP192.168.1.1:1040 ➝ 216.239.138.68:80
Flows TCP192.168.1.1:1041 ➝ 66.147.244.161:80
Flows TCP192.168.1.1:1042 ➝ 98.139.135.198:80
Flows TCP192.168.1.1:1043 ➝ 98.139.135.198:80
Flows TCP192.168.1.1:1045 ➝ 208.73.210.209:80
Flows TCP192.168.1.1:1046 ➝ 157.7.200.171:80
Flows TCP192.168.1.1:1047 ➝ 66.151.181.33:80
Flows TCP192.168.1.1:1048 ➝ 66.6.44.4:80
Flows TCP192.168.1.1:1049 ➝ 74.220.219.141:80
Flows TCP192.168.1.1:1050 ➝ 64.74.223.44:80
Flows TCP192.168.1.1:1051 ➝ 116.126.87.71:80
Flows TCP192.168.1.1:1052 ➝ 182.48.49.156:80
Flows TCP192.168.1.1:1053 ➝ 66.151.181.33:80
Flows TCP192.168.1.1:1054 ➝ 50.63.202.62:80
Flows TCP192.168.1.1:1055 ➝ 216.239.138.217:80
Flows TCP192.168.1.1:1056 ➝ 216.239.139.20:80
Flows TCP192.168.1.1:1057 ➝ 216.239.138.68:80
Flows TCP192.168.1.1:1058 ➝ 66.147.244.161:80
Flows TCP192.168.1.1:1059 ➝ 98.139.135.198:80
Flows TCP192.168.1.1:1060 ➝ 98.139.135.198:80
Flows TCP192.168.1.1:1061 ➝ 208.73.210.209:80
Flows TCP192.168.1.1:1062 ➝ 157.7.200.171:80
Flows TCP192.168.1.1:1063 ➝ 66.151.181.33:80
Flows TCP192.168.1.1:1064 ➝ 66.6.44.4:80
Flows TCP192.168.1.1:1065 ➝ 74.220.219.141:80
Flows TCP192.168.1.1:1066 ➝ 64.74.223.44:80
Flows TCP192.168.1.1:1067 ➝ 116.126.87.71:80
Flows TCP192.168.1.1:1068 ➝ 182.48.49.156:80
Flows TCP192.168.1.1:1069 ➝ 66.151.181.33:80
Flows TCP192.168.1.1:1070 ➝ 50.63.202.62:80

Raw Pcap
0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20646f 6e617665 6e346775 69612e63   : donaven4guia.c
0x00000080 (00128)   6f6d0d0a 0d0a                         om....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206672 65646573 65636173 2e636f6d   : fredesecas.com
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c61 6c6f706f 6e65612e 636f6d0d   : laloponea.com.
0x00000080 (00128)   0a0d0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206461 76656465 6b696c61 692e636f   : davedekilai.co
0x00000080 (00128)   6d0d0a0d 0a0a                         m.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 626c6566 72756974 2e6e6574   : tablefruit.net
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b6d 61726368 2e6e6574   : stickmarch.net
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 69726772 65656e2e 6e65740d   : fairgreen.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 6972736f 756e642e 6e65740d   : fairsound.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d73 6f756e64 2e6e6574   : dreamsound.net
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 6973736f 756e642e 6e65740d   : thissound.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d68 616e642e 6e65740d   : dreamhand.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206772 6f757070 6167652e 6e65740d   : grouppage.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d68 61707079 2e6e6574   : dreamhappy.net
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 69736865 61742e6e 65740d0a   : thisheat.net..
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d70 6167652e 6e65740d   : dreampage.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 69737061 67652e6e 65740d0a   : thispage.net..
0x00000080 (00128)   0d0a0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20646f 6e617665 6e346775 69612e63   : donaven4guia.c
0x00000080 (00128)   6f6d0d0a 0d0a                         om....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206672 65646573 65636173 2e636f6d   : fredesecas.com
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c61 6c6f706f 6e65612e 636f6d0d   : laloponea.com.
0x00000080 (00128)   0a0d0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206461 76656465 6b696c61 692e636f   : davedekilai.co
0x00000080 (00128)   6d0d0a0d 0a0a                         m.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 626c6566 72756974 2e6e6574   : tablefruit.net
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b6d 61726368 2e6e6574   : stickmarch.net
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 69726772 65656e2e 6e65740d   : fairgreen.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206661 6972736f 756e642e 6e65740d   : fairsound.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d73 6f756e64 2e6e6574   : dreamsound.net
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 6973736f 756e642e 6e65740d   : thissound.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d68 616e642e 6e65740d   : dreamhand.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206772 6f757070 6167652e 6e65740d   : grouppage.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d68 61707079 2e6e6574   : dreamhappy.net
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 69736865 61742e6e 65740d0a   : thisheat.net..
0x00000080 (00128)   0d0a0d0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206472 65616d70 6167652e 6e65740d   : dreampage.net.
0x00000080 (00128)   0a0d0a0a 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303233 26736f78 3d336236 39663030   =023&sox=3b69f00
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 69737061 67652e6e 65740d0a   : thispage.net..
0x00000080 (00128)   0d0a0a0a 0a0a                         ......


Strings
" 
a
 ' 
%+#I64
.,
 
.
:
:
+
e
......
  
%+#.*
%+#.*L
..
-_
+%D%A%26A&
h121212
 
"1"
2d1x
 0
S
''
\
.
.
.
.
..
...
...
...
....
...
...
 ! 
" 
# .
$
.
&
'
('
)*)+,-.)/)
[
Z
[
[
 
d2
h2
1
1
x
ranEabsroAiFrSKaa3npjnvdCCSEOiacgdrhHCrn2vWon.dTS
 
- 
CC-E-
-0
-0010+-0
0
-0
00-+ 
.00-+ 
.
-e-
. 
\
00:\
:..
.
  ...........?- 
0
0
0
0
-
t
.
..
[
.
.
i.Y.
.u

                                 H
         (((((                  H
         h((((                  H
jjjjh
jjjjj
KERNEL32.DLL
mscoree.dll
(null)
                          
((!_{`
\$(_^[
																		
\$0_^[
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0A@@Ju
!0b.@<
0+<}`b
0C3ijy
0+FsVN
%"0	GH
\$0h N
0I+F4O'
0SSSSS
|$0VSRW
0WHoi_G
0WWWWW
1\1FOKp1*B
(~1dzv
,&1el	j
1#QNAN
1#SNAN
1Y.YL"
2{CUrH
2+d}A!
2ka"lk
2Lz|bq
2N4,(~
&2qgj-8
2] y8P
31Rwv~
3B!o=O
3fRqmL
3G(W1j
3i;vq+
3N.\l(
+41dd~j
4G7}9	
4JtPR~
"4MI%C
4wO#_{D
4x]8V+71
5 ^+#@
59zU*"
*5\bev
5;HXSD
5L/ngso
@5olco2
&5Td'[
=5Z%QBh
_<68c;O
/6c73sz
6dG<,_w
*6GTpq
6I*/,@E
6[>Pb9
6-tG{9
/6x[I2
7t[Fh*
7(ZwJ/
`^82Eu
~8j*u!
8n@5.'
8\$<th
8VVVVV
9\$0tz
9Au	*jpI
9D$ t%h
9\$Lt"j(h
9l$,uU
^@9n8r
^\9nTr
?9PSM#
9-_Q~h
|$@9\$Ts
9t$(t/
9\$tvm
9\$ uf
9\$(uF
9Uj!H~
9\$,ux9\$
|$ 9x<
A9kP:Y
*'/,Aa
,AAMh;b
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
aclk	!
Adeque<T> too long
aeX!iX
a%FEdqr
ah}#(PTC
*AHUpF
aJd[G6
america
american
american english
american-english
aN~2<=
An application has made an attempt to load the C runtime library incorrectly.
A#OFLG
<at9<rt,<wt
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
.?AUctype_base@std@@
August
=A u}LsOC
australian
.?AVbad_alloc@std@@
.?AVbad_cast@std@@
.?AVbad_exception@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$ctype@D@std@@
.?AVexception@std@@
.?AVfacet@locale@std@@
.?AVfailure@ios_base@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AVlength_error@std@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AV?$numpunct@D@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AVout_of_range@std@@
.?AVruntime_error@std@@
.?AVtype_info@@
AWS2_32.dll
Ay8iCNN
B1N+J2
bad allocation
bad cast
bad exception
 Base Class Array'
 Base Class Descriptor at (
__based(
BBc.S-V
/bc|#?
BeginPaint
belgian
#B`h@B
\bM;xU
bPM3zv$}/M
britain
}	bswt
>bxPoP<(
bzJkk:.i
CallWindowProcA
canadian
cB$Q!-
__cdecl
*cD>Hx
,)c*Fj
CheckDlgButton
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
 Class Hierarchy Descriptor'
CloseHandle
__clrcall
cmd.exe
C&%\[n
]CnmgF
CompareStringA
CompareStringW
 Complete Object Locator'
COMSPEC
CONOUT$
`copy constructor closure'
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
CorExitProcess
C PjPV
C$PjQV
C.PjRV
C/PjSV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
CreateFileA
CreateProcessA
CreateThread
- CRT not initialized
(cvu}O
Cw9MZ5G
CX0ZOm"
cYfQc#
)D$$_^][
D$,_^]
D$(_^][
D$$_^]
D$$_^][
D$$[_^]
D$0GWP
D$0Phk
D$0@WP
D$<_^[3
D$|_^[3
D?3e"|
D$4_^]
D$4SUVW
D$ "8^(
D$895$
D$8SVW
D$@9\$Ts
D$ ;A<
dddd, MMMM dd, yyyy
D$DFVh8
D$$;D$,ts
D$$;D$,ts)\$,
D$$;E<
December
DecodePointer
`default constructor closure'
 delete
 delete[]
Delete
DeleteCriticalSection
dF5712
D$H9\$D
D$hPQR
D$HRWP
D$hSUVW
D$HSUVW
D$hSVW
D$HSVW
}DJ&?3
D$ j.h
D$,}Jj
D))K30
D$LprA
D$lQUSRP
D$lSUVW
D$LSUVW
!dO9[)
DOMAIN error
#DoQg3
]^d{OQZ
>'DO%t
D$ Ph?
D$Ph|8L
D$$]PQ
D$@PQj
D$ PQUV
D$pSVW
D$ PVW
D$,PWQ
D$,PWU
D$ PWUV
D$ QRP
D$,QRP
DrawTextA
D$ SPW
d$$SSh |D
D$`SUVW
D$<SUVW
D$ SUVW
D$<SVW
D$ SVW
}DsX-g
dutch-belgian
D$ VSUP
+D$|W+
D$(WPf
D$,WSV
D$\WWP
D$XPQVSS
D$XPWVS
D$XRWP
D$xSVW
D$xWPQR
`dynamic atexit destructor for '
`dynamic initializer for '
E3Ak[(i
?E'$4u
>e4WL'D
E<9}Ps
E9]#XB
! EAd5
	e)b@O1s
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
!e i0\
EnableWindow
EncodePointer
EndDialog
EndPaint
england
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
EN]/nn
EnterCriticalSection
EnumSystemLocalesA
EpSVWP
EpU}P]&]
Eqq#]T
etr2mN
et#rry
eU;=un
ExitProcess
~f05$p
F09n(u
(F3d;m
f9nc:e 
__fastcall
[(F}Cq
Fdz8FZ
February
FI/k0l-
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindResourceA
F\=@)J
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
ForceRemove
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
french-belgian
french-canadian
french-luxembourg
french-swiss
Friday
Ftk@]<^\7&k
^F<-uB
Fy^clU
G06#5X
GAIsProcessorFeaturePresent
\gc6Ts]
GDI32.dll
_-+{GdPOW7
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
GetACP
GetActiveWindow
GetBkColor
GetClipRgn
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetCurrentObject
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetCursor
GetDeviceCaps
GetDialogBaseUnits
GetDlgItem
GetDlgItemInt
GetDriveTypeA
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesA
GetFileType
GetFullPathNameA
GetGraphicsMode
GetInputState
GetKeyboardType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetMapMode
GetMenu
GetMenuCheckMarkDimensions
GetMenuContextHelpId
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMetaRgn
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetNearestColor
GetNearestPaletteIndex
GetObjectType
GetOEMCP
GetPixelFormat
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessWindowStation
GetPropA
GetQueueStatus
GetScrollPos
GetStartupInfoA
GetStdHandle
GetStretchBltMode
GetStringTypeA
GetStringTypeW
GetSystemPaletteUse
GetSystemTimeAsFileTime
GetTextColor
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetUserObjectInformationA
GetWindowContextHelpId
GetWindowDC
GetWindowLongA
g__}>g
gHC0!F
GlobalFlags
GlobalSize
:GOV_AA
-`:~{GR
great britain
gRj[WR
gsi15Bf
~	Gt>2
g'|:t9f
~G&TE1
GU:a X
g+?@XA
`h````
H>*AN6
hdD[@.T
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
heHL|T
hGy=&6
`h`hhh
HH:mm:ss
HHtXHHt
HHtYHHt
H@K0qk
H]k9/j*
\$ h N
\$,h N
\$(h N
\$$h N
holland
hong-kong
|H(p-5f)
H=t@x+u$
hu-NDXp
\$ hxCL
hy$YW<9q)
^I0=,k<
!I:c0yi
]$>_iD
>If90t
~?ii?$
I:KHDGG_'M
imXks!
(i.nif]
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
invalid map/set<T> iterator
invalid string position
ios_base::badbit set
ios_base::eofbit set
ios_base::failbit set
irish-english
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWindowEnabled
IsWindowUnicode
italian-swiss
]i&waG
IWGnD 
ix"t;p1[
j(6H6$
j7QDs9
|J8dYR#
J9\$HtD
JanFebMarAprMayJunJulAugSepOctNovDec
January
J<b28Dl
jBhP>L
:$jeC/
jE Q<:>f
j'h$7L
j?h89L
j	hh3L
j	hh[L
j,hHrJ
j	hL3L
Jj"[,#
jJTo6}0Q
j@j ^V
,j?&M=
J{\nl|
jOh(HL
jOuUS--
j"^SSSSS
jThXuJ
JtLx}le
	ju]=1
Jyp`&4;6
jzUgL_
k9LMZv
KERNEL32
KERNEL32.dll
"K'fV#I
^kg1NM
L$0^]3
L$0j2Q
L$0QPS
L$(^]3
L$@^[3
\--L6M
L$8QVP
L9t$Tr
LC_ALL
LC_COLLATE
LC_CTYPE
LCMapStringA
LCMapStringW
LC_MONETARY
LC_NUMERIC
LC_TIME
L$(;D$
L$D_^[3
L$DQSR
L$dQUV
L$DURPVQ
LeaveCriticalSection
lfE^_UWx8
L$ ;H<
L$ h03L
L$@hdML
lJ1)ftP
L$|j1Q
L$<j2Q
L$<j@Q
L$ j@Q
L$l][3
LoadIconA
LoadLibraryA
LocalAlloc
LocalFlags
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
LockResource
lo	OlrK
L$p_^][3
L$Ph0u
L$@PQ3
L$pQPh
L$pRSPQVW
L$`QhT
L$$Qj$
L$$QPf
L$\QSh
L$ QUV
L$(QUVR
L$@QWR
ls|HZo>\
L$(SU;
L$t_^[3
L$T_^]3
L$T[_^]3
LtbIN|
'^/LtF
L$TQj$
L$tQRPh
L$\<+t'<-t#<0u
L$ <-u
L$,UPj
L$(USWVP
l$$UVS
L$$Vjp
=L[wou1
L$$WQP
L$xRSPQWV
(/l=xzR9
L[yY%U
M4M(Ay
m]'?(6QRl
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
map/set<T> too long
M{"=bt<4n
MessageBoxA
m..g[m
Microsoft Visual C++ Runtime Library
MM/dd/yy
@mM~:n
M,N	b<
Monday
MoveFileA
MoveWindow
#mO'w?
@M"RI0
MultiByteToWideChar
{\?mX(
MZo>Gs2
N0C&{h+
n";0q3
N7Bo]c
NC4X*~
&nCNP\M>
Nd]Zj	f
 new[]
new-zealand
NE$zW9&
n_O(_ku
NoRemove
norwegian
norwegian-bokmal
norwegian-nynorsk
Norwegian-Nynorsk
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
nP {7IH
	n.'q<
nRj0j;
]:NTky
(null)
"n+xVu;
/}N$[Zp`
nZwwtS
<O0iaR
!O,!2G
O61n	%
(oax<FC
O c9|v
October
}$o+Fp
ogc%4q
'O'h7gK
OLEAUT32.dll
`omni callsig'
operator
p~^#	`
\$P_^[
P0\Enz
P7eN27
__pascal
>^%PB5
pCxH8Umb`R
pD56yQ
\pe1GTF
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
\/PM}	Y
portuguese-brazilian
PostMessageA
PPPPPPPP
|$ PQj
PQSUVW
pr china
pr-china
Program: 
<program name unknown>
pT{fQ6
__ptr64
" PT&S
puerto-rico
- pure virtual function call
q^&}<"
?Q9t-I
Qaf21V91
qhihyvCxW
qj;^|6
&q;jyd
$+q+K@/
QKU:Y/j"(
qlBY0H
Q?^LqRz
q<p+L$
QQSVWd
QSSSSSSh 
QueryPerformanceCounter
R{3&^M
.R4]PL
R8\O!%"
RaiseException
.rdata
RDk<F@
rDYlvO
ReadFile
RemovePropA
%?r'en
__restrict
rh83|I
R;i;7u[!
-^R!~j
R	R)?,G
rS}}s\Ccs
RtlUnwind
runtime error 
Runtime Error!
@S1Pr?
&$s9u.
Saturday
`scalar deleting destructor'
S(=D:-
SendMessageA
September
SetEndOfFile
SetEnvironmentVariableA
SetFilePointer
SetFocus
SetHandleCount
SetLastError
SetStdHandle
SetTextAlign
SetTextCharacterExtra
SetTextColor
SetTextJustification
SetUnhandledExceptionFilter
SetWindowTextA
ShowWindow
SING error
slovak
s_")}(m
sN<9Bl
south africa
south-africa
south korea
south-korea
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
SRUQWP
s[S;7|G;w
SSPh@]D
|&SSSh
^SSSSS
SSVh@#@
sS_z 2
__stdcall
STk>b*
`string'
string too long
Sunday
SunMonTueWedThuFriSat
swedish-finland
SystemRoot
;|$$t	
\$ ;\$(t
T$09T$Tt_
;t$0t	
t3h,)J
T$4jlR
T$4RWP
t7`Gb>
}?T8LhI
T$ 9\$
\$t9|$lr
t9\$,u&
T$dSWQR
teh\jH
TerminateProcess
t=FA9]
tGh4)J
tGHt.Ht&
T?gTv&
(</t$h
T$(hH?L
+t HHt
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
t h@"J
t"h$)J
t$Hj0j
T$,h N
T$HPWR
t$HQSV
Thursday
T$hWQR
tIj"[:
T$$j)h 
tJj$hT
t j}<\;l
< tK<	tG
T'L_#k
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
<\tM</tI
T$PRQP
T$PRSSj
t$$PRV
T$|PSQRWV
t$PWPh
tq7ij$
tQ9^(t9
t'Qgdp
T$@QWR
tR99u2
T$ Rh?
trinidad & tobago
T$(RPj
T$$RPPj
t$(RQPV
T$<RSVP
T$(RUWj
ts;h+IBM
tsjah0@L
t"SS9]
<+t(<-t$:
T$T^][
T$tPWQRV
T$TRSVP
T$TRVWj
t$<"u	3
Tuesday
tuSSSh
;t$,v-
t VV9u
TWqrsI
t$(WSP3
t+WWVPV
T!X%BJ#
T$XRPV
T$XRPVSS
T$XRPVWW
T$XRWV
T$xVSQR
 Type Descriptor'
`typeof'
tYSSSh
tzJdO*
tZj$hT
;\$ u1f
u1~&$M
~U"6k[c
u6SSSh
U8cp_8
>:u8FV
`udt returning'
@Ue=FV
u,h|;J
u+j	h\
UMpdWE8
- unable to initialize heap
- unable to open console device
__unaligned
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UNICODE
united-kingdom
united-states
Unknown exception
UpdateColors
U@PWRS
UQPXY]Y[
uqSSSSS
URPQQh
USER32.dll
USER32.DLL
uSSSh |D
u[SSSP
UTF-16LE
u^Vu39
/< UVus
u,VVWV
UVWjMh
uy[Ii0
uY\	nhG_q
v	1,O<
v'3V6DS]4
v$;58aL
V88kPW8
V9>9d;
VaN%Hvq
v%b$0@d[U
`vbase destructor'
VbHsK)
`vbtable'
vBw$I)
`vcall'
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
VEWvm,q<$
`vftable'
<=vh<>u
VirtualAlloc
`virtual displacement map'
VirtualFree
}&-vjd>
|VLc<_
v	N+D$
v|#(/oH?(
Vonk2B!
#}VsB|
VVh@-A
_VVVVV
VVVVVQRSSj
@]vV;ZT\
vY$:UL
~+!W(~^
W0\u&m
_^w3EX
w(.4[C.q
w8=3PW
WaitForSingleObject
}"wbO!
Wednesday
wh%k/B
W!h@Sv
	Wi6T0\
WideCharToMultiByte
|$(Wj"
Wk8BdWf
W	@kyR
wLGO`.
`W$o=I6
Wp,xx}T
WQWWWh
WriteConsoleA
WriteConsoleW
WriteFile
wtG%O@^
#"wUrKa
WUXpn,P
W-^],v
^WWWWW
wxzs(D
)	[x"\
x1]^dP
\$X9|$Pr
@.x^B1
	xC+8R
	xDkD(
x$DP,.m
xEDwj#
-xi}_f
 xJy7U
xppwpp
xpxxxx
XSQ!iN^d
Xt	nA=:~
<xtX<XtT
 \%X U
Xxh?,,
~$_^]Y
;y#5sj
Y 9LK)n
Y%e=)_7
Yg	|l-p
?y/Hy\
YI+_jh
yjF`i4=VO
y<[}K@
~Y}K*k
Yo }K6T
Y^Pe}e
>=Yt1j
Y<\u#j\V
Y%Uuc:Y
yvtd,^c
YYhP"J
,Y&zF=
~z=0{b
.>Z0g;
,z2<gg
~Z7zpW
Z.8afH
$Z}`a,
ZbZx`n|
)Z'?kbr,
!ZN^GD
zQ-dk<L*
\={Zw7
)/Z!WO
ZxZVME