Analysis Date2014-11-01 16:36:33
MD5437c71afd06b88ec6e7467dd714233d5
SHA182e5c69d8c989da7550ac740196007c32c4689f5

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 6d7aa9be70710b1c326d79a1e4017d2c sha1: 0c1173c6bf01b17efed887e4c33f4a5025c7c26e size: 418304
Section.rdata md5: bd1d4ed18ab6a184097633ed335d00a8 sha1: fe24897a036f1ec202b297cfd0c993b1a4f3d948 size: 59904
Section.data md5: 5f5b5481d68e98200f188e5c9470e1e5 sha1: 3d216e02c707f98d99010f08c1160f48591dfac9 size: 8704
Section.rsrc md5: 9e39f3d43fb86d3f12e79ddafbf04693 sha1: e0af386b64498ed655df77559227554b0256d7ce size: 20992
Section.reloc md5: a67dfad1cccc97b94e12beff0e85d7fb sha1: 90087695db9a42550c9101990e88f31603e58f6a size: 17920
Timestamp2013-11-28 16:08:05
VersionLegalCopyright: Copyright (C) 2013
InternalName: downloader
FileVersion: 3, 1, 14, 0
CompanyName: Company #1
LegalTrademarks: TM(c)
Comments: Get your downloads faster
ProductName: Get your downloads
ProductVersion: 3, 1, 14, 0
FileDescription: Get your downloads
PackerVC8 -> Microsoft Corporation
PEhashdd8c14979f486be4104cbd5e8633b3bbdf2cc3ea
IMPhashad7a86184e56ab255aefa4c070a29bd1
AV360 Safeno_virus
AVAd-Awareno_virus
AVAlwil (avast)no_virus
AVArcabit (arcavir)no_virus
AVAuthentiumW32/A-083dbbf9!Eldorado
AVAvira (antivir)no_virus
AVBullGuardno_virus
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftno_virus
AVEset (nod32)no_virus
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)no_virus
AVIkarusno_virus
AVK7no_virus
AVKasperskyno_virus
AVMalwareBytesPUP.Optional.4Shared
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)no_virus
AVNormanno_virus
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)Downloader.GetFaster

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT2.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT1.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT3.tmp
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT4.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT5.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\Rabito - Musica Nueva En El Barrio [2011].rar
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT8.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT7.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT6.tmp
Creates File\Device\Afd\Endpoint
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\\Rabito - Musica Nueva En El Barrio [2011].rar
Winsock DNSdownloadget.net
Winsock DNSwww.adshost2.com
Winsock DNStrack.getportal.net

Process
↳ C:\Program Files\Internet Explorer\iexplore.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window_Placement ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Locked ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Creates Mutex_SHuassist.mtx
Creates MutexShell.CMruPidlList

Network Details:

DNSdownloadget.net
Type: A
162.159.245.192
DNSdownloadget.net
Type: A
162.159.244.192
DNSwww.adshost2.com
Type: A
212.124.126.10
DNSwww.adshost2.com
Type: A
212.124.126.16
DNSwww.adshost2.com
Type: A
212.124.126.7
DNStrack.getportal.net
Type: A
178.162.201.18
HTTP GEThttp://www.adshost2.com/at?subId=MjIwOTJ8NTM1NTB8Q0x8MXwxfA%7C49c3e330b609865152986f4852c712bc
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://downloadget.net/smart-download/67070110/bundle.exe/bundle.exe?bundleorigin=5303297
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=L5303297
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=M5303297
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://downloadget.net/smart-download/67810100/bundle.exe/bundle.exe?bundleorigin=5303297
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=E5303297
User-Agent: UniversalUserAgent(winHTTP)
Flows TCP192.168.1.1:1033 ➝ 162.159.245.192:80
Flows TCP192.168.1.1:1032 ➝ 212.124.126.10:80
Flows TCP192.168.1.1:1034 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1035 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1036 ➝ 162.159.245.192:80
Flows TCP192.168.1.1:1037 ➝ 178.162.201.18:80

Raw Pcap
0x00000000 (00000)   47455420 2f61743f 73756249 643d4d6a   GET /at?subId=Mj
0x00000010 (00016)   49774f54 4a384e54 4d314e54 42385130   IwOTJ8NTM1NTB8Q0
0x00000020 (00032)   78384d58 77786641 25374334 39633365   x8MXwxfA%7C49c3e
0x00000030 (00048)   33333062 36303938 36353135 32393836   330b609865152986
0x00000040 (00064)   66343835 32633731 32626320 48545450   f4852c712bc HTTP
0x00000050 (00080)   2f312e31 0d0a436f 6f6b6965 3a200d0a   /1.1..Cookie: ..
0x00000060 (00096)   55736572 2d416765 6e743a20 556e6976   User-Agent: Univ
0x00000070 (00112)   65727361 6c557365 72416765 6e742877   ersalUserAgent(w
0x00000080 (00128)   696e4854 5450290d 0a486f73 743a2077   inHTTP)..Host: w
0x00000090 (00144)   77772e61 6473686f 7374322e 636f6d0d   ww.adshost2.com.
0x000000a0 (00160)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x000000b0 (00176)   702d416c 6976650d 0a0d0a              p-Alive....

0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373037 30313130 2f62756e   oad/67070110/bun
0x00000020 (00032)   646c652e 6578652f 62756e64 6c652e65   dle.exe/bundle.e
0x00000030 (00048)   78653f62 756e646c 656f7269 67696e3d   xe?bundleorigin=
0x00000040 (00064)   35333033 32393720 48545450 2f312e31   5303297 HTTP/1.1
0x00000050 (00080)   0d0a436f 6f6b6965 3a200d0a 55736572   ..Cookie: ..User
0x00000060 (00096)   2d416765 6e743a20 556e6976 65727361   -Agent: Universa
0x00000070 (00112)   6c557365 72416765 6e742877 696e4854   lUserAgent(winHT
0x00000080 (00128)   5450290d 0a486f73 743a2064 6f776e6c   TP)..Host: downl
0x00000090 (00144)   6f616467 65742e6e 65740d0a 436f6e6e   oadget.net..Conn
0x000000a0 (00160)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000b0 (00176)   76650d0a 0d0a                         ve....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d4c3533 30333239 37204854   data=L5303297 HT
0x00000030 (00048)   54502f31 2e310d0a 436f6f6b 69653a20   TP/1.1..Cookie: 
0x00000040 (00064)   0d0a5573 65722d41 67656e74 3a20556e   ..User-Agent: Un
0x00000050 (00080)   69766572 73616c55 73657241 67656e74   iversalUserAgent
0x00000060 (00096)   2877696e 48545450 290d0a48 6f73743a   (winHTTP)..Host:
0x00000070 (00112)   20747261 636b2e67 6574706f 7274616c    track.getportal
0x00000080 (00128)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000090 (00144)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000a0 (00160)   39372048 5454502f 312e310a            97 HTTP/1.1.

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d4d3533 30333239 37204854   data=M5303297 HT
0x00000030 (00048)   54502f31 2e310d0a 436f6f6b 69653a20   TP/1.1..Cookie: 
0x00000040 (00064)   0d0a5573 65722d41 67656e74 3a20556e   ..User-Agent: Un
0x00000050 (00080)   69766572 73616c55 73657241 67656e74   iversalUserAgent
0x00000060 (00096)   2877696e 48545450 290d0a48 6f73743a   (winHTTP)..Host:
0x00000070 (00112)   20747261 636b2e67 6574706f 7274616c    track.getportal
0x00000080 (00128)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000090 (00144)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000a0 (00160)   39372048 5454502f 312e310a            97 HTTP/1.1.

0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373831 30313030 2f62756e   oad/67810100/bun
0x00000020 (00032)   646c652e 6578652f 62756e64 6c652e65   dle.exe/bundle.e
0x00000030 (00048)   78653f62 756e646c 656f7269 67696e3d   xe?bundleorigin=
0x00000040 (00064)   35333033 32393720 48545450 2f312e31   5303297 HTTP/1.1
0x00000050 (00080)   0d0a436f 6f6b6965 3a200d0a 55736572   ..Cookie: ..User
0x00000060 (00096)   2d416765 6e743a20 556e6976 65727361   -Agent: Universa
0x00000070 (00112)   6c557365 72416765 6e742877 696e4854   lUserAgent(winHT
0x00000080 (00128)   5450290d 0a486f73 743a2064 6f776e6c   TP)..Host: downl
0x00000090 (00144)   6f616467 65742e6e 65740d0a 436f6e6e   oadget.net..Conn
0x000000a0 (00160)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000b0 (00176)   76650d0a 0d0a                         ve....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d453533 30333239 37204854   data=E5303297 HT
0x00000030 (00048)   54502f31 2e310d0a 436f6f6b 69653a20   TP/1.1..Cookie: 
0x00000040 (00064)   0d0a5573 65722d41 67656e74 3a20556e   ..User-Agent: Un
0x00000050 (00080)   69766572 73616c55 73657241 67656e74   iversalUserAgent
0x00000060 (00096)   2877696e 48545450 290d0a48 6f73743a   (winHTTP)..Host:
0x00000070 (00112)   20747261 636b2e67 6574706f 7274616c    track.getportal
0x00000080 (00128)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000090 (00144)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000a0 (00160)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000b0 (00176)   76650d0a 0d0a                         ve....


Strings
 
%+#.*
%+#.*L
%+#.*
e
%+#I64
.,
.
 
--
 
CC
.
-e-
. 
.
-e-
. 
.
00-+ 00-+ *00-+ 
0
0
0
\
::
::
% 
-%
..
.
-E-
-0
-0010+-0
0
-000...........?- 
0
0
0
0
.
Gu...
000004b0
%%%02X
{123374DE290-123F-4565-9164-39C4925E467B}
2Downloader Helper Maxige
3, 1, 14, 0
AAPPLICATION_NAME
a([a-zA-Z0-9])
ABORT_CONFIRMATION
Accept: */*
AGET
AIgnore and continue
 and 
AppID
Are you sure you want to abort download?
BINARY
b([ \t])
button
By clicking "
By clicking "Download" you agree to
By creating account you accept our
Cancel
Cannot download file from:
Cannot download from
Cannot establish connection to the server.
c([a-zA-Z])
Change
charset={[A-Za-z0-9\-_]+}
Choose if you'd like to install Baidu PC Faster.
Choose target directory...
Close
CLSID
Comments
Company #1
CompanyName
Component Categories
Confirm
Content-Length: 
Content-Length: {[0-9]+}
Content-Type: application/x-www-form-urlencoded
Cookie: 
Copyright (C) 2013
Create New Free Account
d([0-9])
Delete
desktop
dGlG
Dialog
d like to keep your PC fast and smooth throughout its life, then you can
download
Download
downloader
Downloading...
E-mail
E-mail cannot be empty, please enter correct e-mail.
End User License Agreement
English
equal
.exe
file
FileDescription
FileType
FileVersion
First Name
Fjjj
Fjjjj
Fjjjjjjjjjjjjj
folder
ForceRemove
Get your downloads
Get your downloads faster
gInvalid DateTimeSpan
                                 H
         (((((                  H
h([0-9a-fA-F])
Hardware
         h((((                  H
{<html[^\>]*>.*<body[^\>]*>.*<\/body>.*<\/html>.*}
http://download-faster.net/error.jsp?msg=downloadhelperxmlnotfound
_Hyperlink_Color_
@_Hyperlink_Original_Proc_
%i%%
I already have an account...
IDC_BUTTON_BROWSE
IDC_BUTTON_CANCEL
IDC_BUTTON_CHANGE_DST
IDC_BUTTON_CREATE_ACCOUNT
IDC_BUTTON_DOWNLOAD
IDC_BUTTON_LOGIN
IDC_BUTTON_OPEN
IDC_CB_AGREE
IDC_CB_BAIDU
IDC_CB_CHROMEEMPTYTABSet improved Google Chrome Empty Tab
IDC_CB_HOMEPAGE
IDC_LINK_DONT_HAVE_ACCOUNT
IDC_LINK_EULA
IDC_LINK_HAVE_ACCOUNT
IDC_LINK_PP
IDC_LINK_TERM_OF_USE
IDC_MAIN_BUTTON_DOWNLOAD
IDC_MAIN_TEXT_DOWNLOAD_DST
IDC_MAIN_TEXT_DOWNLOAD_DST_PRE
IDC_MAIN_TEXT_INTRO
IDC_MAIN_TEXT_REQUESTED_FILE
IDC_MAIN_TEXT_REQUESTED_FILE_PRE
IDC_PROGRESS_TEXT_FILENAME
IDC_TEXT_AND
IDC_TEXT_AUTH_INSTRUCTION
IDC_TEXT_DESCRIPTION_BAIDU
IDC_TEXT_DOWNLOAD_DST_PRE
IDC_TEXT_FIRSTNAME
IDC_TEXT_HOMEPAGE_INSTRUCTION
IDC_TEXT_INTRO
IDC_TEXT_LOGIN
IDC_TEXT_PASSWORD
IDC_TEXT_PASSWORD_CONFIRM
IDC_TEXT_REQUESTED_FILE_PRE
IDC_TEXT_SECONDNAME
IDC_TEXT_STATUS
IDC_TEXT_STATUS_PROGRESS
I don't have an account,
If you
Ijjj
Installation
Installing...
instapp.exe
Interface
InternalName
Invalid DateTime
%i%% - %s
I want to create new free account...
jjjjj
kernel32
KERNEL32.DLL
_Label_Original_Proc_
Last Name
_Lbl_Background_Color_
LegalCopyright
LegalTrademarks
License Agreement
ll perform a complete maintenance routine, including boot time optimization, disk cleanup and much more!
Location: {[A-Za-z0-9\-_%+*:;/.=?&]+}
Login and Download
MaxConnectionsPer1_0Server
MaxConnectionsPerServer
MESSAGE_LOGIN_EMPTY
MESSAGE_NAMES_EMPTY
MESSAGE_PASSWORD_EMPTY
MESSAGE_PASSWORD_LONG
MESSAGE_PASSWORD_MISMATCH
Mime
mscoree.dll
msctls_progress32
MS Shell Dlg
Name cannot be empty, please enter your name.
NoRemove
(null)
@open
openas
Open file
Password
Password and confirmation do not match, please enter identical passwords.
Password cannot be empty, please enter correct password.
Password ls too long, please enter shorter password.
Please go back to the site and download the file again.
POST
Privacy Policy
ProductName
ProductVersion
q("[^"]*")|('[^']*')
Quit
r123unas
Range: bytes=%i-
renameto_
Save the downloaded file to:
SECURITY
Set-Cookie:\b*{.+?}\n
Set my homepage to search.b1.org in Internet Explorer, Firefox and Google Chrome
shell32.dll
Show
Show in Explorer
Software
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Something's wrong either with your Internet connection or with our server. We recommend you to go back to the site and download the original file again.
Sorry, your session has expired.
static
StringFileInfo
substring
SYSTEM
t be without Baidu PC Faster. One click and you
temp
Terms of Use
TM(c)
Translation
TypeLib
Unexpected network error
Unexpected network error, cannot download %s
UniversalUserAgent(winHTTP)
%USERPROFILE%
utf-8
VarFileInfo
VS_VERSION_INFO
w([a-zA-Z]+)
Welcome to %s Download Helper,
which will guide you through the download process.
" you agree to 
You have requested file:
You need 4Shared account to download this file:
z([0-9]+)
~~~~~~
~~~~~~~~~
< =.=\=
=???? 
                          
/-,,,,,-
/-,,,,,,,,/
/+++++++++
/+++++++++/
"@"""""":
&&&&&&&
&&&&&&&&
&&&&&&&&&&
&&&&&&&&&&&&
&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
#$$$$$$#
######%
%#####
%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%
++++++++
											
																																																																																																																																																																												
																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																						
<0|	,0
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0 0$0(0,0004080<0@0D0H0L0P0T0X0h0
0 0$0(0,0004080H0L0P0T0d0h0l0p0
0$0*00060<0B0H0N0T0Z0`0f0l0r0x0~0
0 0(00080@0H0P0X0`0h0p0x0
0%000B0J0[0d0i0r0z0
0$000P0\0|0
0$0,040H0P0d0l0p0t0|0
0 0@0H0T0t0
0$0<0L0P0`0d0l0
0#0,0l0q0
0(04080\0`0d0h0
0%070_0
0!080K0w0
0$0D0P0p0|0
0&0F0w0
$0)0J0V0i0v0
0!111D1s1
0%1-1F1L1Q1`1g1m1u1{1
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0 1l1{1
> ?$?(?,?0?4?8?<?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
< <0<4<D<H<L<T<l<|<
0?4R4e4
(050<0D0K0d0s0}0
050;1W1s1
061116015437Z
<!<&<,<0<6<;<A<F<U<k<v<{<
;%;0;6;A;F;Y;
070V0n0
0"7+71777A7G7X7n7u7|7
07969287
079692870
#08031E1k1r1
<,<0<8<P<`<d<t<x<|<
\$09^$
092h2p2v2|2
|0::9D2rDS
~09n<v
|$09|$,v
\$09\$,v
0A@@Ju
0BAAA?E
:0:<:D:\:h:
=,=0=@=D=H=P=h=x=|=
0J???C
0jkk#.
0L1P1T1t1
=0=L=P=l=p=
<0<L<P<p<
0mlmM0jlV
0mm`mN
<0|O<9
;0;P;p;
0R1,242L2d2
0S1b1q1
0SSSSS
0t-HHt
0WWWWW
1%%),$$1
1(101D1L1P1T1\1d1
1 1(10181@1H1P1X1`1h1p1x1
1!1(1,1014181<1@1D1
1 1$1(1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
1 1&1,12181>1D1J1P1V1\1b1h1n1t1z1
1$1)1/191C1M1W1a1k1v1z1
1,1<1@1P1T1\1t1
1&1,121
1"1/1c1
1 1,1L1X1x1
1,141@1`1h1t1
1 161I1j1
1<1B1t1
1 1c1p1
1@1c1u1
1"1e1t1
1-1M1U1_1
1<1T1^1t1}1
122:2G2
1(2&48465H5F6X6C;P;
1	292s2
1%2C2i2
1?2M2g2W3d3
130815064132Z
?1<:4<
160815064132Z0e1
>1>6>D>L>X>_>h>{>
=1=8=<=@=D=H=L=P=T=
1|9:5:
1bxhefffaaaaagg"`
1$%)C1##,
1D4H4L4P4T4X4\4`4d4h4t4
1dgiccddddddhhho
1E1R1z5
1:i}cHICz
>">1>;>J>
1$%)l#k,
#1M1~1
>1-N=k4=
1o444:4u
1Q2W2c2r2
1#QNAN
1$%)r*#&5+#
.;1s(N
1#SNAN
###1	\twheeffffaaaaa[
$$$%@2
2080F0S0a0I5X5l5
21393N3Y3
2 2024282@2X2h2l2|2
2 2(20282@2H2P2X2 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
2 2$2(2,2024282<2@2D2H2L2P2T2X2\2`2d2h2l2p2t2x2|2
#	2''''''''''''''''''''''222222
&2'''222222222222222
2"2(2.242:2@2F2L2R2X2^2d2j2p2v2|2
2 2.272A2u2
2,23282<2@2a2
2$242D2X2l2x2
2(242T2`2
2,272J2
2"282>2C2K2b2t2
2$2D2`2|2
2(2H2P2X2`2h2p2x2
2*3034383<3
2!3,3=3W3]3q3z3
23393]3{3
2$3,3A3[3l3
2363;3
2_3h3c4u4
242H2T2\2t2
 24>.ML@LMMFBLaq
#252G2
261116015437Z0
282D2d2l2x2
? ?&?,?2?8?>?D?J?P?V?\?b?h?n?t?z?
2a3r3x3
> >2>?>a>s>z>
2C6I6O6U6[6a6h6o6v6}6
;2;f;x;
2mXWmi(
2mXXYmS'
2mXYXEo=
2mYYXXmx
2mYYYXml(
2mYYYYW
=*>2>p>
2P0ODOfQ0KKII],j
>2>Q>p>
:2:::R:Z:r:z:
2S9I>>
2ZWZl(
303@3D3T3X3\3d3|3
30B0r0
30-NRiWwZ(j2hS
313B3L3i3
32''''''''''''22222222222222
3$303d3h3
3$303P3\3|3
33333333333333
3$3,383X3d3
3 383H3L3\3`3h3
3$384<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
3'393r3
3<3D3P3p3|3
3<3H3h3t3
3.3X3_3w3}3
3&4/4;4t4}4
3$4,4m4
3(4H4h4
36B6V6
;3<9<E<K=G>_>
<3=C=f=
;3<<<c<n<
3%$+E!,#k1
;#;3;E;s;
:3:E:S:h:r:
3f5l5r5x5~5
>#>'>+>/>3>?>I>a>h>r>z>
3##*!-kk+z
:3:O:z:
3P6b6r6
<3=R=u=
?*?3?T?s?
3%$+zY7
404<4\4l4x4
<4:<1?
41::ID7
435=5c5r5
436C6U6e6u6
&44444
444&444
444444444444
4444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444
4 4$4(44484
&&&&&&&&&444444&kQUdb
4(4,4<4@4P4T4X4`4x4
444<4D4P4t4|4
=4445(
4:4454-4
4$4*464<4d4l4v4
4$4(484<4@4D4L4d4t4x4
4 4-484J4]4h4n4t4y4
4$4,484X4`4h4p4x4
4'4.4v455
4-4544:4
44585<5@5
4#4H4O4g4m4r4z4
4,4L4p4
:44ws$
4>4Y4b4
4;5%%%
4 5H5h5
4	5Z5s5x5
; ;$;4;8;<;D;\;l;p;
~4;~8v
4B4c5q5
4B4j4]5
&4D:9:
?4?@?d?l?t?|?
:$:,:4:<:D:L:T:\:d:l:t:|:
?$?,?4?<?D?L?T?\?d?l?t?|?
:$:,:4:<:D:P:p:x:
<$<4<F<K<
:$;4;:;F;L;\;b;w;
4G5T5%626E7R7c8x8
4/GcFGFGF\\\G\ba
4H4{425h5
=(=,=4=L=\=`=p=t=x=
4M4\4|4
4M5W5o5w5
}?<4/o
|<?:4?O
4O5\5v5
:(:4:P:p:
4U4^4d4
4X5j5|5
 5%%%#
516?6M6
<5:47?I
5'505<5H5U5\5g5o5w5
5&50565@5O5a5
5$505X5p5
5#525X5
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5$5(585<5D5\5l5p5
5%5+5E5V5\5m5
5(5<5H5P5
5#5.5h5p5y5
555mz555m
5"5,5u5
557G7Y7
5 585>5M5S5b5h5v5
5 585H5L5\5`5d5l5
#%5%5@a
5&5F5f5
#%#5@@?$?5???GHa
5(5H5d5h5p5t5
5#656E677
5	6$6+626
569H9F=X=
576<6S6z6
5#828F8
5):8:L:
5;;9<::::::
:5:9|1
5-949i9|9 :&:+:?:E:J:P:W:i:
5;;9<::<9;;=
>5?9?=?A?E?I?M?Q?\?
$5%%@a
5C6S6l6
5::<CIC9DP!P
;';5;C<O<
&.  /5DM??5?Ha
<:#%%%%%%%%??5??GGFa
5http://certificates.godaddy.com/repository/gdroot.crl0K
?+?5???j?r?
5P5`5t5
$%5Y}~}
?%?6?`?
606h6z6L7V7c7~7
616T6a6m6u6}6
627J7[7k7
6448565984+0
6448566666<
646@6`6l6
656<6g6
6 60646D6H6P6h6x6|6
6$6)636C6M6l6v6
6 6$6(606H6X6\6l6p6t6|6
6 6&6,62686>6D6J6P6V6\6b6h6n6t6z6
6 6$6(6,6064686<6@6D6H6L6P6
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
6'6-666;6J6q6
6*6/676?6H6R6s6
6(6@6T6`6h6
<6@6D6H6L6P6T6X6\6`6d6h6
6%6d6k6q6
6`6m6{6
6#6W6]6i6
6#767f7S8a8z8
6	7B7[7
6!7F7s7
686@6D6\6`6|6
6.888a8x8
6?C9@?
6E:I:M:Q:U:Y:]:a:e:i:m:q:~:J;%<=<L<x<
:':6:I:t:
;6;?;m<{<
6O7f7	8
6V6`6i637>7C7c7
70777F7[7q7
757499CI<D
757?7L7`7n7y7
7+737@7G7
7:7@7{7
7!7'7+71757;7?7E7I7N7T7X7^7b7h7l7r7v7
7 7$7(7,7074787<7@7D7H7L7P7T7X7\7`7d7h7l7p7t7x7|7
77;7?7C7G7K7O7S7W7[7_7c7g7k7o7s7w7{7
7(7.7@7K7m7
7'7.7D7R7n7|7
7%7,7S7Y7d7p7
7 7(7X7`7d7|7
7(787<7@7D7L7d7t7x7
7(787<7L7P7T7X7`7x7
7,787X7d7
7,7D7T7d7x7
7)7E7a7
7%7S8e8t8
7 848m8
7%8,8w8
7>8C8~8
7#8D8P8V8[8f8l8v8
7+8K8P8
$%%$7a
7d8i8)9V9v9
7DI::14
7I7X7f7
;7;J;|;
7%kkj)nFF
: <8<1=
]8;;4 
8449559844
84888<8@8D8H8L8P8T8\8
859@9W9
859D9X9
]8777;
8.;7;@;w;
8,808H8X8\8l8p8t8x8
8(848<8T8`8
8'8,828<8B8R8W8i8p8w8
8-8@8^8
8$8(888<8@8H8`8p8t8|8
8'888D8R8X8d8j8w8
888D8d8l8x8
8 8,8L8X8x8
888X8x8
8.8H8a8h8o8t8
8!91989>9E9V9q9z9
8 949X9
!;;8<::<9;;9
899@9k9
8*9?9H9
8%9=9N9
8!9a9g9
8A8N8q8b9z9
> >8>D>d>p>
;$<8<D<L<d<p<
>$>(>8><>D>\>l>p>
>8>D>L>\>q>
; ;8;H;L;\;`;d;l;
!8\$ht
8L9b9m9
?(?8?<?L?P?T?\?t?
=8=L=X=`=
!8\$pt
:&:,:8:S:
\$,8\$!t
: :8:<:T:d:h:x:|:
8\$`t)j
8VVVVV
=,=8=X=`=l=
>8>X>x>
?8?X?x?
\$|9](
9$>(>,>0>4>8><>@>D>H>L>P>T>X>\>`>d> ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
944<8<y\8I
94S&I<
959E9e9
9/:&<6<
9#:6:_:
)9;;;8
9,909@9D9T9X9\9`9d9l9
9,909H9L9d9t9x9|9
9(949T9`9
9 9@9`9
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9
9	9&9,9L9
9,9@9L9T9l9t9
9$9D9P9p9|9
9:9I9Y9w9
?@9C?6
9C<U<q<#>5>F?X?
:9:D4&
\9\$Dt
9EEIEEEEIEEEEEE
?"?*?9?@?J?T?]?n?x?
9l$4rA
9#:M:]:i;
^@9n8r
^\9nTr
9O9W9\9b9l9r9
9?<OI8by9<
9S9c9|9+=
_9>t&j
\$ 9t$$ue
\$ 9t$,uE
|$<9|$(u
<9:w$;
9Xxu	_]
<9yb8IO<?9
'\))`a
))`a))
))a`))
a`))\'
A(9Q r
AAf91u
AAFFf;
abb^\\b
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
a)\\cc)cN
=A>c>v>
`adjustor{
ADVAPI32.dll
ADVAPI32.DLL
>A?G?Y?
america
american
american english
american-english
amfc\cccPPc\FFnpiZ>TTTTTka2D818/3<6&
An application has made an attempt to load the C runtime library incorrectly.
`anonymous namespace'
}aO@Y4
AppendMenuW
Arizona1
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<at9<rt,<wt
AtIHt0Hu
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
AtttKHDND
.?AUctype_base@std@@
August
.?AUIFake@@
.?AUIFakeOne@@
.?AUIFakeProgressParams@@
.?AUITextWidther@@
australian
.?AUThank_you@Define_the_symbol__ATL_MIXED@@
autolaunch
.?AVbad_alloc@std@@
.?AVbad_cast@std@@
.?AVbad_exception@std@@
.?AVbad_typeid@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AVCAtlException@ATL@@
.?AVcodecvt_base@std@@
.?AV?$codecvt@DDH@std@@
.?AV?$ctype@D@std@@
.?AVCustomWindow@@
.?AVDiskFile@@
.?AVexception@std@@
.?AVfacet@locale@std@@
.?AVfailure@ios_base@std@@
.?AVFileBase@@
.?AVFileReader@@
.?AVinvalid_argument@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AVLabelTextSetter@@
.?AVlength_error@std@@
.?AVLoaderCallback@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AVMainDownloaderWindow@@
.?AVMainWindow@@
.?AVMemoryFile@@
.?AV?$MemPoolT@$0CE@@tinyxml2@@
.?AV?$MemPoolT@$0CM@@tinyxml2@@
.?AV?$MemPoolT@$0DA@@tinyxml2@@
.?AV?$MemPoolT@$0DE@@tinyxml2@@
.?AVMemPool@tinyxml2@@
.?AV__non_rtti_object@std@@
.?AVNullFile@@
.?AV?$numpunct@D@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AVout_of_range@std@@
.?AVProgressDownloaderWindow@@
.?AVProgressWindowParams@@
.?AVruntime_error@std@@
.?AVScreenBase@@
.?AVtype_info@@
.?AVUrlOpener@Utilities@@
.?AVWinHttpSmartLoader@@
.?AVXMLAttribute@tinyxml2@@
.?AVXmlBackImage@@
.?AVXmlBinary@@
.?AV?$XmlBundledContent@VXmlComplexDescriptionBundle@@@@
.?AVXmlBundleEulaText@@
.?AVXmlBundleLine@@
.?AVXmlBundleNumber@@
.?AVXMLComment@tinyxml2@@
.?AVXmlComplexBundlesLoadManager@@
.?AVXmlComplexDescriptionBundle@@
.?AVXmlContentBase@@
.?AVXmlContentData@@
.?AVXMLDeclaration@tinyxml2@@
.?AVXMLDocument@tinyxml2@@
.?AVXMLElement@tinyxml2@@
.?AVXmlExBundle@@
.?AVXmlFileFolderCheck@@
.?AVXmlFileFolderCheckers_OR@@
.?AVXmlIconedBundle@@
.?AVXmlLaunchValidation@@
.?AVXmlLoaderBase@xml@@
.?AVXmlLoadManager@@
.?AVXMLNode@tinyxml2@@
.?AVXMLPrinter@tinyxml2@@
.?AVXmlRawBundle@@
.?AVXmlRegCheck@@
.?AVXmlRegCheckers_OR@@
.?AVXMLText@tinyxml2@@
.?AVXmlUniversalStyleContent@@
.?AVXMLUnknown@tinyxml2@@
.?AVXmlValidationResponse@@
.?AVXMLVisitor@tinyxml2@@
AYm02ri(
)a)Z\a^Z
B1_START_OF_HIDDEN_DATA_SECTION_B1
"BAAAA
`b^aacJ
backimages
bad allocation
bad cast
bad exception
bad format for extra1 (need "LM" or "CU" or "CR"
bad format for extra3 (need "command:value"
 Base Class Array'
 Base Class Descriptor at (
__based(
:";B;b;
b\\^bba
BCEEEEEECECEECECECCCCCEEECEEC
BEEEEEEIEEEEEEEEEECEE
BeginPaint
belgian
<^?b?f?j?n?r?v?z?
;B<G<Q<
binary
BitBlt
>&>B>J>Q>W>a>g>}>
]bKb\c
}bLCAz4
bottom
britain
bundle
bundlebeforelaunch
bundle%d
bundle%dbuttonLabel
bundle%deulatext
bundle%dex
bundle%dheader1
bundle%dheader2
bundle%dheader3
bundle%dicon
bundle%dlines
bundledownloaderror
bundledownloadstart
bundledownloadsuccess
bundle%drequestLabel
bundlelauncherror
bundlelaunchsuccess
buttonLabel
bW\WWe
>#?(?C?[?
;???C"
c0r0]1
CallWindowProcW
canadian
cancelbutton
c\bKb]
}CCC~}}~~~
C~CCC~
C}CC~C
~CCCC~C~CCCCC
cc`ccK(
CCECECCE
CCIWz&
<![CDATA[
__cdecl
"C=dwE"
CECECCCEEEEEEEE9W
CECEEEEECECEEECCCEC
CEECEEEECCCEEE
~CEECEEEEEEEEEE>
CEEEEEEE
cegnbbbcbbcccccbO1<dghhhasu1.OKCSDIPOICKhja^^MMOS
checkbox
CheckDlgButton
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
>!><>C>H>L>P>q>
???CI?
=C>J>i>p>
CJI:q<
class 
 Class Hierarchy Descriptor'
cli::array<
cli::pin_ptr<
CloseHandle
__clrcall
coclass 
CoCreateInstance
CoInitializeEx
cointerface 
COMCTL32.dll
CompareStringA
CompareStringW
 Complete Object Locator'
CONIN$
CONOUT$
const 
`copy constructor closure'
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
CorExitProcess
CoTaskMemFree
CoUninitialize
C PjPV
C$PjQV
C.PjRV
C/PjSV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
CreateCompatibleBitmap
CreateCompatibleDC
CreateDialogIndirectParamW
CreateDialogParamW
CreateEventW
CreateFileA
CreateFileW
CreateFontIndirectW
CreateFontW
CreatePatternBrush
CreatePopupMenu
CreateSolidBrush
CreateThread
CreateWindowExW
- CRT not initialized
cthaaaaagagggV
=(=.?C?T?z?
>C?^?v?
;+c&~W
;C<Y<}>
Cyprus1
<(<@<d<
<)<d<]=
::D~~</
/<~~D::
D$ _^][
D$0+D$,
D$0+D$(
D$0+D$,P
D$0+D$,S
D$0+D$,U
D$0SUVW
D$4+D$,
D$4jdP
D$4PQP
D7ip\bbbbccbbcccbebbnppppnsu D'faDICPI^OS^QQNIDD
D$8SUVW
D$8SVW
D$$9D$ 
D$ 9l$4s
D$ 9t$4s
D$@9t$pr
DAAAAAAAAAAD
DaOPCQPDC^P0OQfIB4r
@.data
D??????????D
D$(+D$ 
DD<8OPQ
D$@;D$D
dddd, MMMM dd, yyyy
>(>D>d>l>x>
December
DecodePointer
`default constructor closure'
 delete
 delete[]
DeleteCriticalSection
DeleteDC
DeleteFileW
DeleteObject
  </dependency>
  <dependency>
    </dependentAssembly>
    <dependentAssembly>
dePGG??%IkYUUXEWiRAA=
destinationFolder
destinationLabel
DestroyMenu
DestroyWindow
:*:d:!<G<
>:?@?D?H?L?
D$hSUVW
D$hSUWV
D$hSVW
D.h!zU
D<IC994757
.DI=KOQKI7?^i
 directory: 
DispatchMessageW
D$,jdP
^D@Ks}
DLHHIJJIHHHD
=<=D=L=X=x=
DOMAIN error
double
downloaderror
downurl
<$<D<P<p<|<
><>D>P>p>x>
D$$PQV
D$PSUVW
D$$QRP
?=?D?]?q?w?
DrawTextW
D$$SUV
D$`SUVW
D$|SUVW
D$ SUVW
D$@SUVW
D$$SUVW
D$\SUVW
D$`SVW
D$<SVW
D$ SVW
D$t+D$p
:(:,:D:T:X:h:l:p:x:
<dty<itu<otq<utm<xti<Xte
dutch-belgian
D$(UVW
D$ VSUP
D$(WPWU
D$x+D$t
D$XSVW
`dynamic atexit destructor for '
`dynamic initializer for '
===D=Z=f=
=;>E>]>
E0]0l0}0
E!7555
/(#%*EC
ECCEEEECC
ECECCEEEEEECB
EECECCEEEECEEE
}EECECEEE
EECEEEE
EECEEEEEEC}
EEECEEEE
EEECEEEEEEEECEEEEEFEF
EEECEEEEEEEEEI:y
EEEEE|;
EEEEE*%
EEEEECCEEEECEEECEE
EEEEEE
EEEEEECCEEECECEEEECEEECECCEE
EEEEEECEFEE
EEEEEEECCEE~
EEEEEEEEEEEECCEEEEEEEEEEEEEEEEECEE@
EEEEExQ_
EEEEFFFM
EEEFCE
EEFFFE
@E}E~s
EFECEEE
e_{FEEE
EFFEFFE
EFFFFFFF
e>fFFFFFGFOlTTTTTT"kd>ETWQaYUE1bOOGGFGFFF\FF]a
EhhheeeeaaetUWtgagggggbbb 
EHHHHHE
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
EIz55557EEEEEE 555 LE
eLfbcccbfPb\\\\JKgk4T4TTjh.'0P'8`0.6&H.	
<ellipsis>
,<ellipsis>
EnableWindow
EncodePointer
EndDialog
EndPaint
england
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
EnterCriticalSection
EnumChildWindows
EnumSystemLocalesA
E -oEXYYYZ
EoooEooo
EooooE
EPHLAHK]
erP%%%#
eSvM:?@
EuefaaaaafvtgggbbbbbxE
eWW\Wb
ExitProcess
ExpandEnvironmentStringsW
expire
externals
extern "C" 
extra1
extra2
extra3
?$?*?f?
F0_^][
F09n(u
F0@;F,~LSW
F0P555%5/YVVVVUUVZm
F49n,r
f90t3W
@@f90u
failon302redirect
__fastcall
FatalAppExitA
  fcc\\\cc\F\dghho"TTTTTl1
February
FEEEECEEEEEEE
FEFEEEEFF
FEFE@:x;
Fh=PvG
filecheck
fileName
fileName: 
FillRect
FindResourceW
finish
finishimg
fixHeight
FL9nDr
{flat}
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
;F,~LSW
FlushFileBuffers
F=oooo
FP1#kj0
FPPPPRPE
<-<;<F<Q<\<j<u<
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
french-belgian
french-canadian
french-luxembourg
french-swiss
Friday
<=<F<s<
Ft,Nt	NtFNt#NuV
(f;)u$
)f;*u%
^F<-uB
Fx9npr
FyJJyF
G<9t$$r
GAIsProcessorFeaturePresent
GDI32.dll
generic-type-
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
GetACP
GetActiveWindow
GetAncestor
GetClientRect
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCursorPos
GetDateFormatA
GetDlgItem
GetDlgItemTextW
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetMessageW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetObjectW
GetOEMCP
GetParent
GetProcAddress
GetProcessHeap
GetProcessWindowStation
GetPropW
GetStartupInfoA
GetStdHandle
GetStockObject
GetStringTypeA
GetStringTypeW
GetSysColorBrush
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTextExtentPoint32W
GetTickCount
GetTimeFormatA
GetTimeZoneInformation
GetUserDefaultLCID
GetUserObjectInformationA
GetVersionExW
GetWindowLongW
GetWindowRect
GetWindowTextW
GGGGG>>%3
GI99CS7S
g}llliiiiiicc
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
>G?l?t?y?
(Go Daddy Class 2 Certification Authority0
GoDaddy.com, Inc.1301
'Go Daddy Secure Certification Authority1
great britain
;=<g<r<:=L=R=
>>>>>G>s
:G:V<p<w<
>(>=>G>W>\>f>r>|>
;G;W;i;};
`h````
;H<"=2=E=
H8//; S7;ON8Om
hcenter
|$H+|$D
header1
header2
header3
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
;(;H;h;
`h`hhh
!HHHHH=
"HHHHHI
HH:mm:ss
HHt4HHt
HHt*HHt
HHtXHHt
HHtYHHt
HIf98t
<<<H<L<P<T<X<`<d<
holland
hong-kong
|<ho'r
;(;H;P;X;d;
hQ9xxyyx>}>yx
hQ9;x;y;
hR;EECEE
hRS0SRP
Ht\Ht,
<(<H<T<t<|<
; ;@;H;T;t;|;
*http://certificates.godaddy.com/repository0
+http://certificates.godaddy.com/repository/0
*http://certificates.godaddy.com/repository100.
>http://certificates.godaddy.com/repository/gd_intermediate.crt0
"http://crl.godaddy.com/gds5-16.crl0S
http://ocsp.godaddy.com0F
http://ocsp.godaddy.com/0J
hybridFileName
hybridUrl
:"I!?@
@?!I":
I?74:5<
I8\y<8<449
I9#%%%5?@a
I9C<9G?I(
<I9>?fR)
>>I9S2
?IC???
>If90t
(I?G9<C9I
IIIIMM
IIMIMI
II@w9CSS
ijZxWwb
images
IMIMMM
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
__int128
__int16
__int32
__int64
__int8
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
InvalidateRect
invalid map/set<T> iterator
invalid string argument
invalid string position
ios_base::badbit set
ios_base::eofbit set
ios_base::failbit set
.>?I?P
IP""PI
irish-english
<I&S49
IsDebuggerPresent
IsDialogMessageW
IsDlgButtonChecked
'ISQOT
IsValidCodePage
IsValidLocale
IsWindow
IsWindowEnabled
IsWindowVisible
IsWow64Process
italian-swiss
It"IIuQ
It.It+It!It
~~~~~~~~}}}iu\	$$$$$$$$$#
;IUUI;
%ixidddddhhheeej
iy~}}}}zlllll
J0b0z0
j2j2Qj
JanFebMarAprMayJunJulAugSepOctNovDec
January
;+;J;b;x;
Jcaa^b`
J;EFFE
jF<-uH
>J>g>l>
ji_jdZf;
jijqFjmY
JIMPWW
j@j ^V
jspbbbcbcccbbcccbcccccccntf1
j"^SSSSS
: ;[;k;
%%##k##%
k89k4v
(Kcc`cc
:#;K<c<u<
:KDD%%55@a
KERNEL32
KERNEL32.dll
KillTimer
<*<K<l<|<
kpbcbbbbbbbccbbbccbbbccbpsR
+;+KPP3
;><K<R<Y<
~~~~~}}}}}}}kws
<&<_<l<
L$0VPQ
L$0WWj
L1X1x1
L$49t$tr
L$4jdQ
L$89t$hr
l$\9D$T
L$`9t$Pr
lACLb}
launch-params
launch-type
launchValidation
LC_ALL
LC_COLLATE
LC_CTYPE
LCMapStringA
LCMapStringW
LC_MONETARY
LC_NUMERIC
LC_TIME
LeaveCriticalSection
leftBorder
lGAHLK
Limassol1
line%d
L$,jdQ
L$(j@Q
L$ ;L$
L$ +L$
L$,;L$
L$,+L$$+
L$$+L$ 
L$l_][3
<ll;$##%%%%?a
LLLG@"@
LLLLLL
LLLLLL!
}lllllllllliixn
LLLLMLL
l$$;l$,t
ll%$+z
LoadCursorW
LoadIconW
LoadImageW
LoadLibraryA
LoadLibraryW
LoadResource
`local static destructor helper'
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
LockResource
!LPLD<vDLPL=
]LPPPPHE
L$PQVP
L$pWPQ
L!*qk$5
L$ QSh3
L$ QSPR
L$ RPQ
L$$RPQ
L$$RPQV
L$(RQWP
lstrcatW
lstrcmpiA
lstrcmpiW
lstrcpynW
lstrcpyW
lstrlenA
lstrlenW
L$t9|$lr
L$t+L$p
L$$<-u
;L$ u$9x,
L$ WQWR
L$(WRQP
L$x_^3
#,l%$+z
lZWWWWXw
-%#&.m
m5555 
M91[<u
MAAMAD
mainbundle
maincheckbox
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
map/set<T> too long
masteraction
masterrun
masterstart
maxiget
Maxiget Limited0
Maxiget Limited1
MBAAAA!
?:<\MB^u|{{zvxr~</
MessageBeep
MessageBoxA
MessageBoxW
metalink
</metalink>
metaurl
Microsoft Visual C++ Runtime Library
M)J<GDD?<yM
:MMCDCz]999
MM/dd/yy
mmkFjimX
Monday
MoveFileW
MoveWindow
  mtncbbbbbcbbcbccccc\\cccnsf
MultiByteToWideChar
@?:MvSe
My<?DDG<J)M
N@9n8r
Nc)cc\\)a
need key path
%+nEFE
 new[]
new-zealand
N fFFF\FG?^jWTTTTUWNSETTWQa!1
Nh9n`r
NIfGGG?G?F0mEUTTUTTYhd"WWQaWZ>FHSPF5GFGGFFFF]a
Nm`mm0
`non-type-template-parameter
norwegian
norwegian-bokmal
norwegian-nynorsk
Norwegian-Nynorsk
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
NP9nHr
<%=,=N=U=
(null)
n$^][Y
o/4<?}
O?4:?<|
$<OC/&2xWXXWw3AWZWXZ
October
o>fF?GG?5KhgAAQ3"ZEVUVA2[=3mDG5%%5?G??G?GGFG\a
offset
oicccccdhhhdxx
ole32.dll
`omni callsig'
omWYYYYm
O<;OD~
oooEooo
oooEooooooooo
ooooEoooo
oooooEoo
[oooooooooooooooooozzz{{}|yyusspssuy|}}zzwxr
operator
orf\\\F\\\GcdhX
OSS5??5@a
ovFHLRRGAHP{
ow}}}zllllllllr
#/oXWWWWWEE(amWZ02ZYo=
P%$$;1
P3T3X3\3`3d3h3l3p3t3x3|3
  P5555%*VYUUWZm
  P?55%5DVVUUUUVXEXjRAA .#$$#
?P@6u2qq
__pascal
PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
PathRenameExtensionW
PathStripPathW
</PGG?55IaZEWiRAAQ3"ZxldUa>3G%5%55??????GGGG\a
  PGGG??5@^Q>
PHAGRRGHLv{p
P?I?>.
PJ""JP
PJ]]JP
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
PNW??@}&;PS
policy
portuguese-brazilian
PostMessageW
PostQuitMessage
P!PD9CIC<::5
PPPPPPPP
PPPWWPPP
PPWWPP
PQSUVW
pr china
pr-china
private: 
Program: 
<program name unknown>
progress
progressimg
protected: 
  P%#%/S;
PSVVSP
__ptr64
public: 
puerto-rico
- pure virtual function call
  P%%%%$@>wZm
PZWJMWWMJWZP
"Qa^\]
<q:IJC
qllilicdccdddev\	11
q~}}}}}}}}lll}wi$
QPHLHPQ
qq2u6@P?
QQSVWd
QSUVWj
qtyXww8
QueryPerformanceCounter
)qz`si
r2%$+nM
>R4VTTTTV '11*
RaiseException
RBECEC
`.rdata
rdfbbcccbb\c\\\_MIajU"""Xu(
ReadFile
regcheck
regcheck_notexists
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
ReleaseDC
@.reloc
RemovePropW
        <requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
requestLabel
__restrict
)Rf?>9I<
rof\FF\FFFGdi
rTG?n4444&44444
RtlUnwind
runtime error 
Runtime Error!
<RWPWW
<!--%s-->
<?%s?>
;,;<;S;
S1b1y1
s4;s8v
S7SC99IG
Saturday
saveFileName
`scalar deleting destructor'
Scottsdale1
ScreenToClient
SDr2D9::0|
    </security>
    <security>
SelectObject
SendMessageW
September
SetBkMode
SetConsoleCtrlHandler
SetCursor
SetDlgItemTextW
SetEndOfFile
SetEnvironmentVariableA
SetEvent
SetFilePointer
SetFocus
SetHandleCount
SetLastError
SetPropW
SetStdHandle
SetTextColor
SetTimer
SetUnhandledExceptionFilter
SetWindowLongW
SetWindowPos
SetWindowTextW
?,?S?e?u?
<sf\FF\GGG]SYTTTTYgNYUTTUh2		/23>/Jc\cc\ccccna
sghiiiicccccddd
\$ Sh8
SHBrowseForFolderW
SHCreateDirectoryExW
SHELL32.dll
ShellExecuteExW
Shell_NotifyIconW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHLWAPI.dll
SHOpenWithDialog
short 
ShowWindow
signed 
signupurl
SING error
SizeofResource
SJCSJPZ
sKC@[$
$'=SkoZ
slovak
south africa
south-africa
south korea
south-korea
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
SP;&}@??WNP
_SRP[YjRF
SRSEPRS
s@?S]]
]]S?@s
s[S;7|G;w
SSC9w@II
^SSSSS
sssssv
static 
stats-url
stats-url2
staturl
__stdcall
stP555%50YVUUUUUUUUXxxlD
`string'
string too long
StrStrIW
StrToIntExW
struct 
]]]]]Su
subidlaunch
	su}~~}}}}}}lzz
Sunday
SunMonTueWedThuFriSat
svnup.sh
?SVVS?
SVWj>3
$sw44:
swedish-finland
SystemFunction036
sZa"&Jq{>
==>]>t>
;\$(t	
t$09t$,v
T$0SPj
T$0+T$,9T$
T$4jdR
T$ 9|$4s
t!9^`r
T$|9t$tr
t$`9u,
tCP%%$%%%.">0-NSjYZEXZ/Rx
tCP%$#9+
teHtFHt&Hu
`template-parameter
template-parameter-
`template static data member constructor helper'
`template static data member destructor helper'
teP5$$%$
TerminateProcess
tGHt.Ht&
tgSUVW
The Go Daddy Group, Inc.110/
+t HHt
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
 throw(
;$;T;h;t;|;
?<?T?h?t?|?
[thunk]:
Thursday
tinyxml2::XMLDocument error id=%d str1=%s str2=%s
T$,jdR
T$`jlR
T$,j@R
< tK<	tG
tK<_t<<$t8<<t4<>t0<-t,<a|
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
tM<it-<ot)<ut%<xt!<Xt
to=DtG
topBorder
T$pQRS
t$PQVP
tR99u2
TrackPopupMenuEx
TranslateMessage
t$ RhD
trinidad & tobago
trinity.void.v3
T$$RPV
TRPVVPP0
T&<rskO
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
t"SS9]
<+t(<-t$:
<+t'<-t#<0u
t.<@t5V
ttHMH<<
TtUHtKHtAHt
TTWad!W4TTU4
t\<@tXj'
t$<"u	3
tU<A|B<P
Tuesday
;t$,v-
t VV9u
T$ WRWQ
t+WWVPV
T$x+T$t
 Type Descriptor'
`typeof'
ty<%tA
tY<@tO<Zt
~~~~~}u
u<[19M
u4:444o1
>:u8FV
u-9^`r
u?9^`r
UBRPSW
`udt returning'
u)jAXf;
uLSUh8
- unable to initialize heap
- unable to open console device
__unaligned
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UNICODE
uninstall
union 
united-kingdom
united-states
universal.catalina.v3
universal.newit.v3
universal.v3
UNKNOWN
`unknown ecsu'
Unknown exception
unsigned 
UpdateWindow
UQPXY]Y[
url_download_method
url_params
URPQQh$MD
USER32.dll
USER32.DLL
UTF-16LE
UvcdhhhhhheeffP
u,VVWV
>#?(?=?V?{?
V09n(r
v$;5htG
V\9nTr
`vbase destructor'
`vbtable'
`vcall'
vcenter
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
vector<T> too long
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
`vftable'
Vgaaaggbbbbbbbx=
virgin
virtual 
VirtualAlloc
`virtual displacement map'
VirtualFree
Vj j j
Vl9ndr
vlliiiiiiccccc
v	N+D$
volatile
 volatile
volatile 
VRhSjRRE
`vtordisp{
`vtordispex{
_VVVVV
VVVVVQRSSj
#%/vZEWWWWVm!(kZE
w~~~~~~}}}}}
W0_0s0
__w64 
;$w:9<
WaitForMultipleObjects
WaitForSingleObject
wchar_t
:-;W;^;d;v;~;
Wednesday
wEEICEEI
WideCharToMultiByte
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WINHTTP.dll
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpWriteData
WMJRRJMW
\WPGKKGPW\
WP{\\{PW
?;?W?\?q?
WriteConsoleA
WriteConsoleW
WriteFile
+w +t$@
Wthhhhhefefffff[`
WuCEEu
^<W;^@v
WVm"(jmWXXZ
wv{{}}}}}}{zzvwxq~
WWPMIJ
WWPWR<
^WWWWW
wwXyt\'
wZ'SwYYXYZ
X7iii9P
x}EEEEEEECEEEEEEEEEEEEECEEEI@>
Xj0j2j2j
xml version="1.0"
<?xml version="1.0" encoding="UTF-8"?>
xml version="1.0" encoding="UTF-8"
xppwpp
xpxxxx
XsEECv
<xtV<XtR
<xtX<XtT
'xxwu}
;;;;x;;;;y
xyXvh8
>;;xy;;;;yy;|FEE
~]<@}Y
~$_^][Y
YCDCMMBBLLHAGz
Ycdddhhhhhehvv1	iteaagggggbbg!
YEICc}R
>=Yt1j
Y;=X|G
|YxMexm
<z~$<A|
ZatppppppppppppppppppnpppssuN+
Z^a\Z)a)
%+zEEEL 
ZEUTTUYROEYQSmlH55LB???G?GGGFG\a
]\]ZeZ
ZeZ]\]
{Zgddgz{
Zim[]jllq
_Zlllllllliicicvp
^{zmF]mzlX
z{M*jzzY
ZPJSCJS
&zWICC
ZWXYYZ