Analysis Date2014-11-01 16:49:29
MD5bda3e1c396c66ec647d70f33ea64a318
SHA19d9bf466c4b6e5ba30f72aae04fc8e40c9d60d7e

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: cad595e724b485aa05e2b130e4849aad sha1: 344675f382c333f28e7bc8fb0cf7a2effb1b8fdc size: 303616
Section.rdata md5: 2025aa20ec2900a7dd5726fa82b81471 sha1: c368af8e6d119014b1e3df128873536dcb1756d9 size: 62464
Section.data md5: 10a74adb92a8c3ee5d311a56621186b4 sha1: 96ed9527917708c8db7efd93f5742fb8cef30c7c size: 8192
Section.rsrc md5: 853c9895c8117210b3e206b8b8b3d5b4 sha1: 71d0fa09678171c0347f4a08047799a53db48e7c size: 20992
Section.reloc md5: 866dd32f3a1ba94a5f9791c4e838796f sha1: f3c7b4bdb1b78ae4378b5cdef08b77a019803caf size: 18944
Timestamp2014-03-21 13:00:27
VersionLegalCopyright: 2014
InternalName: dnloader
FileVersion: 3, 3, 9, 0
CompanyName: C
LegalTrademarks: -
Comments: ND
ProductName: premium
ProductVersion: 3, 3, 9, 0
FileDescription: DWD
PackerMicrosoft Visual C++ ?.?
PEhash918387548ffe717d8ec142d09b8e779fffc810d9
IMPhashf87e701744476e45c5c52ff8078b4442
AV360 Safeno_virus
AVAd-AwareGen:Variant.Graftor.152222
AVAlwil (avast)no_virus
AVArcabit (arcavir)no_virus
AVAuthentiumW32/A-4070769d!Eldorado
AVAvira (antivir)no_virus
AVBullGuardGen:Variant.Graftor.152222
AVCA (E-Trust Ino)Win32/Tnega.afGOTEB
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftGen:Variant.Graftor.152222
AVEset (nod32)no_virus
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-SecureGen:Variant.Graftor.152222
AVGrisoft (avg)no_virus
AVIkarusPUA.4Shared
AVK7Unwanted-Program ( 004a9c681 )
AVKasperskyno_virus
AVMalwareBytesPUP.Optional.4Shared
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Graftor.152222
AVNormanGen:Variant.Graftor.152222
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)Downloader.GetFaster

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT2.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNTA.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT1.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\instapp.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT3.tmp
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT4.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNTC.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT5.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT8.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT7.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNTB.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT6.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT9.tmp
Creates File\Device\Afd\Endpoint
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\\instapp.exe
Creates MutexBUNDLES_ACTIVATION_HYBRID_OR_SHUTTLE_SLIDER
Winsock DNSdownloadget.net
Winsock DNSwww.adshost2.com
Winsock DNStrack.getportal.net

Process
↳ C:\Program Files\Internet Explorer\iexplore.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window_Placement ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Locked ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutex_SHuassist.mtx
Creates MutexShell.CMruPidlList

Network Details:

DNSwww.adshost2.com
Type: A
212.124.126.16
DNSwww.adshost2.com
Type: A
212.124.126.10
DNSwww.adshost2.com
Type: A
212.124.126.7
DNSdownloadget.net
Type: A
162.159.244.192
DNSdownloadget.net
Type: A
162.159.245.192
DNSdownloadget.net
Type: A
162.159.244.192
DNSdownloadget.net
Type: A
162.159.245.192
DNSdownloadget.net
Type: A
162.159.244.192
DNSdownloadget.net
Type: A
162.159.245.192
DNStrack.getportal.net
Type: A
178.162.201.18
HTTP GEThttp://www.adshost2.com/at?subId=NzUxNHw3MDA5OHxUSHwzfDF8fA%7C70653d867eedf5b665e62a4348dedf0d
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://downloadget.net/smart-download/67230100/bundle.exe/bundle.exe?bundleorigin=5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://downloadget.net/smart-download/67010530066/bundle.exe/bundle.exe?bundleorigin=5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://downloadget.net/smart-download/67020500066/bundle.exe/bundle.exe?bundleorigin=5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=L5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDB7230100O5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDB7010530066O5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDB7020500066O5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDE7230100O5303331ER404
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDE7020500066O5303331ER404
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDE7010530066O5303331ER404
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://www.adshost2.com/at?subId=NzUxNHw3MDA5OHxUSHwzfDF8fA%7Ce559d4efd0d3343995b66c0312b4d987
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=M5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://downloadget.net/smart-download/67810100/bundle.exe/bundle.exe?bundleorigin=5303331
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=E5303331
User-Agent: UniversalUserAgent(winHTTP)
Flows TCP192.168.1.1:1034 ➝ 212.124.126.16:80
Flows TCP192.168.1.1:1035 ➝ 162.159.244.192:80
Flows TCP192.168.1.1:1036 ➝ 162.159.244.192:80
Flows TCP192.168.1.1:1037 ➝ 162.159.244.192:80
Flows TCP192.168.1.1:1038 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1039 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1040 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1041 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1042 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1043 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1044 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1045 ➝ 212.124.126.16:80
Flows TCP192.168.1.1:1046 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1047 ➝ 162.159.244.192:80
Flows TCP192.168.1.1:1048 ➝ 178.162.201.18:80

Raw Pcap
0x00000000 (00000)   47455420 2f61743f 73756249 643d4e7a   GET /at?subId=Nz
0x00000010 (00016)   55784e48 77334d44 41354f48 78555348   UxNHw3MDA5OHxUSH
0x00000020 (00032)   777a6644 46386641 25374337 30363533   wzfDF8fA%7C70653
0x00000030 (00048)   64383637 65656466 35623636 35653632   d867eedf5b665e62
0x00000040 (00064)   61343334 38646564 66306420 48545450   a4348dedf0d HTTP
0x00000050 (00080)   2f312e31 0d0a436f 6f6b6965 3a200d0a   /1.1..Cookie: ..
0x00000060 (00096)   55736572 2d416765 6e743a20 556e6976   User-Agent: Univ
0x00000070 (00112)   65727361 6c557365 72416765 6e742877   ersalUserAgent(w
0x00000080 (00128)   696e4854 5450290d 0a486f73 743a2077   inHTTP)..Host: w
0x00000090 (00144)   77772e61 6473686f 7374322e 636f6d0d   ww.adshost2.com.
0x000000a0 (00160)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x000000b0 (00176)   702d416c 6976650d 0a0d0a              p-Alive....

0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373233 30313030 2f62756e   oad/67230100/bun
0x00000020 (00032)   646c652e 6578652f 62756e64 6c652e65   dle.exe/bundle.e
0x00000030 (00048)   78653f62 756e646c 656f7269 67696e3d   xe?bundleorigin=
0x00000040 (00064)   35333033 33333120 48545450 2f312e31   5303331 HTTP/1.1
0x00000050 (00080)   0d0a436f 6f6b6965 3a200d0a 55736572   ..Cookie: ..User
0x00000060 (00096)   2d416765 6e743a20 556e6976 65727361   -Agent: Universa
0x00000070 (00112)   6c557365 72416765 6e742877 696e4854   lUserAgent(winHT
0x00000080 (00128)   5450290d 0a486f73 743a2064 6f776e6c   TP)..Host: downl
0x00000090 (00144)   6f616467 65742e6e 65740d0a 436f6e6e   oadget.net..Conn
0x000000a0 (00160)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000b0 (00176)   76650d0a 0d0a                         ve....

0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373032 30353030 3036362f   oad/67020500066/
0x00000020 (00032)   62756e64 6c652e65 78652f62 756e646c   bundle.exe/bundl
0x00000030 (00048)   652e6578 653f6275 6e646c65 6f726967   e.exe?bundleorig
0x00000040 (00064)   696e3d35 33303333 33312048 5454502f   in=5303331 HTTP/
0x00000050 (00080)   312e310d 0a436f6f 6b69653a 200d0a55   1.1..Cookie: ..U
0x00000060 (00096)   7365722d 4167656e 743a2055 6e697665   ser-Agent: Unive
0x00000070 (00112)   7273616c 55736572 4167656e 74287769   rsalUserAgent(wi
0x00000080 (00128)   6e485454 50290d0a 486f7374 3a20646f   nHTTP)..Host: do
0x00000090 (00144)   776e6c6f 61646765 742e6e65 740d0a43   wnloadget.net..C
0x000000a0 (00160)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373031 30353330 3036362f   oad/67010530066/
0x00000020 (00032)   62756e64 6c652e65 78652f62 756e646c   bundle.exe/bundl
0x00000030 (00048)   652e6578 653f6275 6e646c65 6f726967   e.exe?bundleorig
0x00000040 (00064)   696e3d35 33303333 33312048 5454502f   in=5303331 HTTP/
0x00000050 (00080)   312e310d 0a436f6f 6b69653a 200d0a55   1.1..Cookie: ..U
0x00000060 (00096)   7365722d 4167656e 743a2055 6e697665   ser-Agent: Unive
0x00000070 (00112)   7273616c 55736572 4167656e 74287769   rsalUserAgent(wi
0x00000080 (00128)   6e485454 50290d0a 486f7374 3a20646f   nHTTP)..Host: do
0x00000090 (00144)   776e6c6f 61646765 742e6e65 740d0a43   wnloadget.net..C
0x000000a0 (00160)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d4c3533 30333333 31204854   data=L5303331 HT
0x00000030 (00048)   54502f31 2e310d0a 436f6f6b 69653a20   TP/1.1..Cookie: 
0x00000040 (00064)   0d0a5573 65722d41 67656e74 3a20556e   ..User-Agent: Un
0x00000050 (00080)   69766572 73616c55 73657241 67656e74   iversalUserAgent
0x00000060 (00096)   2877696e 48545450 290d0a48 6f73743a   (winHTTP)..Host:
0x00000070 (00112)   20747261 636b2e67 6574706f 7274616c    track.getportal
0x00000080 (00128)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000090 (00144)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000a0 (00160)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424442 37323330 3130304f   data=BDB7230100O
0x00000030 (00048)   35333033 33333120 48545450 2f312e31   5303331 HTTP/1.1
0x00000040 (00064)   0d0a436f 6f6b6965 3a200d0a 55736572   ..Cookie: ..User
0x00000050 (00080)   2d416765 6e743a20 556e6976 65727361   -Agent: Universa
0x00000060 (00096)   6c557365 72416765 6e742877 696e4854   lUserAgent(winHT
0x00000070 (00112)   5450290d 0a486f73 743a2074 7261636b   TP)..Host: track
0x00000080 (00128)   2e676574 706f7274 616c2e6e 65740d0a   .getportal.net..
0x00000090 (00144)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000a0 (00160)   2d416c69 76650d0a 0d0a6f75 6e643c2f   -Alive....ound</
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424442 37303130 35333030   data=BDB70105300
0x00000030 (00048)   36364f35 33303333 33312048 5454502f   66O5303331 HTTP/
0x00000040 (00064)   312e310d 0a436f6f 6b69653a 200d0a55   1.1..Cookie: ..U
0x00000050 (00080)   7365722d 4167656e 743a2055 6e697665   ser-Agent: Unive
0x00000060 (00096)   7273616c 55736572 4167656e 74287769   rsalUserAgent(wi
0x00000070 (00112)   6e485454 50290d0a 486f7374 3a207472   nHTTP)..Host: tr
0x00000080 (00128)   61636b2e 67657470 6f727461 6c2e6e65   ack.getportal.ne
0x00000090 (00144)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x000000a0 (00160)   6565702d 416c6976 650d0a0d 0a643c2f   eep-Alive....d</
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424442 37303230 35303030   data=BDB70205000
0x00000030 (00048)   36364f35 33303333 33312048 5454502f   66O5303331 HTTP/
0x00000040 (00064)   312e310d 0a436f6f 6b69653a 200d0a55   1.1..Cookie: ..U
0x00000050 (00080)   7365722d 4167656e 743a2055 6e697665   ser-Agent: Unive
0x00000060 (00096)   7273616c 55736572 4167656e 74287769   rsalUserAgent(wi
0x00000070 (00112)   6e485454 50290d0a 486f7374 3a207472   nHTTP)..Host: tr
0x00000080 (00128)   61636b2e 67657470 6f727461 6c2e6e65   ack.getportal.ne
0x00000090 (00144)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x000000a0 (00160)   6565702d 416c6976 650d0a0d 0a643c2f   eep-Alive....d</
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424445 37323330 3130304f   data=BDE7230100O
0x00000030 (00048)   35333033 33333145 52343034 20485454   5303331ER404 HTT
0x00000040 (00064)   502f312e 310d0a43 6f6f6b69 653a200d   P/1.1..Cookie: .
0x00000050 (00080)   0a557365 722d4167 656e743a 20556e69   .User-Agent: Uni
0x00000060 (00096)   76657273 616c5573 65724167 656e7428   versalUserAgent(
0x00000070 (00112)   77696e48 54545029 0d0a486f 73743a20   winHTTP)..Host: 
0x00000080 (00128)   74726163 6b2e6765 74706f72 74616c2e   track.getportal.
0x00000090 (00144)   6e65740d 0a436f6e 6e656374 696f6e3a   net..Connection:
0x000000a0 (00160)   204b6565 702d416c 6976650d 0a0d0a2f    Keep-Alive..../
0x000000b0 (00176)   7469746c 653e0a20 203c2f68 6561643e   title>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424445 37303230 35303030   data=BDE70205000
0x00000030 (00048)   36364f35 33303333 33314552 34303420   66O5303331ER404 
0x00000040 (00064)   48545450 2f312e31 0d0a436f 6f6b6965   HTTP/1.1..Cookie
0x00000050 (00080)   3a200d0a 55736572 2d416765 6e743a20   : ..User-Agent: 
0x00000060 (00096)   556e6976 65727361 6c557365 72416765   UniversalUserAge
0x00000070 (00112)   6e742877 696e4854 5450290d 0a486f73   nt(winHTTP)..Hos
0x00000080 (00128)   743a2074 7261636b 2e676574 706f7274   t: track.getport
0x00000090 (00144)   616c2e6e 65740d0a 436f6e6e 65637469   al.net..Connecti
0x000000a0 (00160)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000b0 (00176)   0d0a746c 653e0a20 203c2f68 6561643e   ..tle>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424445 37303130 35333030   data=BDE70105300
0x00000030 (00048)   36364f35 33303333 33314552 34303420   66O5303331ER404 
0x00000040 (00064)   48545450 2f312e31 0d0a436f 6f6b6965   HTTP/1.1..Cookie
0x00000050 (00080)   3a200d0a 55736572 2d416765 6e743a20   : ..User-Agent: 
0x00000060 (00096)   556e6976 65727361 6c557365 72416765   UniversalUserAge
0x00000070 (00112)   6e742877 696e4854 5450290d 0a486f73   nt(winHTTP)..Hos
0x00000080 (00128)   743a2074 7261636b 2e676574 706f7274   t: track.getport
0x00000090 (00144)   616c2e6e 65740d0a 436f6e6e 65637469   al.net..Connecti
0x000000a0 (00160)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000b0 (00176)   0d0a746c 653e0a20 203c2f68 6561643e   ..tle>.  </head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f61743f 73756249 643d4e7a   GET /at?subId=Nz
0x00000010 (00016)   55784e48 77334d44 41354f48 78555348   UxNHw3MDA5OHxUSH
0x00000020 (00032)   777a6644 46386641 25374365 35353964   wzfDF8fA%7Ce559d
0x00000030 (00048)   34656664 30643333 34333939 35623636   4efd0d3343995b66
0x00000040 (00064)   63303331 32623464 39383720 48545450   c0312b4d987 HTTP
0x00000050 (00080)   2f312e31 0d0a436f 6f6b6965 3a200d0a   /1.1..Cookie: ..
0x00000060 (00096)   55736572 2d416765 6e743a20 556e6976   User-Agent: Univ
0x00000070 (00112)   65727361 6c557365 72416765 6e742877   ersalUserAgent(w
0x00000080 (00128)   696e4854 5450290d 0a486f73 743a2077   inHTTP)..Host: w
0x00000090 (00144)   77772e61 6473686f 7374322e 636f6d0d   ww.adshost2.com.
0x000000a0 (00160)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x000000b0 (00176)   702d416c 6976650d 0a0d0a68 6561643e   p-Alive....head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d4d3533 30333333 31204854   data=M5303331 HT
0x00000030 (00048)   54502f31 2e310d0a 436f6f6b 69653a20   TP/1.1..Cookie: 
0x00000040 (00064)   0d0a5573 65722d41 67656e74 3a20556e   ..User-Agent: Un
0x00000050 (00080)   69766572 73616c55 73657241 67656e74   iversalUserAgent
0x00000060 (00096)   2877696e 48545450 290d0a48 6f73743a   (winHTTP)..Host:
0x00000070 (00112)   20747261 636b2e67 6574706f 7274616c    track.getportal
0x00000080 (00128)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000090 (00144)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000a0 (00160)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x000000b0 (00176)   702d416c 6976650d 0a0d0a68 6561643e   p-Alive....head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373831 30313030 2f62756e   oad/67810100/bun
0x00000020 (00032)   646c652e 6578652f 62756e64 6c652e65   dle.exe/bundle.e
0x00000030 (00048)   78653f62 756e646c 656f7269 67696e3d   xe?bundleorigin=
0x00000040 (00064)   35333033 33333120 48545450 2f312e31   5303331 HTTP/1.1
0x00000050 (00080)   0d0a436f 6f6b6965 3a200d0a 55736572   ..Cookie: ..User
0x00000060 (00096)   2d416765 6e743a20 556e6976 65727361   -Agent: Universa
0x00000070 (00112)   6c557365 72416765 6e742877 696e4854   lUserAgent(winHT
0x00000080 (00128)   5450290d 0a486f73 743a2064 6f776e6c   TP)..Host: downl
0x00000090 (00144)   6f616467 65742e6e 65740d0a 436f6e6e   oadget.net..Conn
0x000000a0 (00160)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000b0 (00176)   76650d0a 0d0a650d 0a0d0a68 6561643e   ve....e....head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d453533 30333333 31204854   data=E5303331 HT
0x00000030 (00048)   54502f31 2e310d0a 436f6f6b 69653a20   TP/1.1..Cookie: 
0x00000040 (00064)   0d0a5573 65722d41 67656e74 3a20556e   ..User-Agent: Un
0x00000050 (00080)   69766572 73616c55 73657241 67656e74   iversalUserAgent
0x00000060 (00096)   2877696e 48545450 290d0a48 6f73743a   (winHTTP)..Host:
0x00000070 (00112)   20747261 636b2e67 6574706f 7274616c    track.getportal
0x00000080 (00128)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000090 (00144)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000a0 (00160)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000b0 (00176)   76650d0a 0d0a650d 0a0d0a68 6561643e   ve....e....head>
0x000000c0 (00192)   0a20203c 626f6479 3e0a2020 20203c68   .  <body>.    <h
0x000000d0 (00208)   313e4e6f 7420466f 756e643c 2f68313e   1>Not Found</h1>
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.


Strings
..
..
....
..
....
 
 
CC
.00-+ 00-+ 
0
\
.
-
 
.
-E-
-0
-0010+-0
0
-000...........?- 
0
0
0
0
.DuTW
000004b0
%%%02X
{123374DE290-123F-4565-9164-39C4925E467B}
2014
2Downloader Helper Maxige
3, 3, 9, 0
400 Bad Request
401 Unauthorized
403 Forbidden
404 Not Found
408 Request Timeout
500 Internal Server Error
502 Bad Gateway
503 Service Unavailable
504 Gateway Timeout
a([a-zA-Z0-9])
ABORT_CONFIRMATION
Accept: */*
_All_Ctrls_Orig_Proc_
 and 
AppID
APPLICATION_NAME
Are you sure you want to abort download?
b([ \t])
_Btn_Is_Checked_
BUNDLES_ACTIVATION_HYBRID_OR_SHUTTLE_SLIDER
button
By clicking "
By clicking "Download" you agree to
By creating account you accept our
Cancel
Cannot download file from:
Cannot download from
c([a-zA-Z])
CCannot download the requested files.
Change
charset={[A-Za-z0-9\-_]+}
Choose if you'd like to install Baidu PC Faster.
_Class_Pointer_Property_
Close
CLSID
Comments
CompanyName
Component Categories
Confirm
Content-Length: 
Content-Length: {[0-9]+}
Content-Type: application/x-www-form-urlencoded
_Control_Color_
Cookie: 
Create New Free Account
Cz([0-9]+)
d([0-9])
Delete
DEnglish
desktop
Dialog
Djjj
Djjjj
Djjjjjjjjjjjjj
d like to keep your PC fast and smooth throughout its life, then you can
dnloader
download
Download
Downloading...
E0ELExE
edit
EEnglish
E-mail
E-mail cannot be empty, please enter correct e-mail.
#empty
End User License Agreement
equal
eula
.exe
file
FileDescription
FileType
FileVersion
First Name
folder
ForceRemove
                                 H
         (((((                  H
h([0-9a-fA-F])
h123ttp://down123load-faster.net/error.jsp?msg=downloadhelperxmlnotfound
Hardware
         h((((                  H
{<html[^\>]*>.*<body[^\>]*>.*<\/body>.*<\/html>.*}
%i%%
I already have an account...
IDC_BUTTON_BROWSE
IDC_BUTTON_CANCEL
IDC_BUTTON_CHANGE_DST
IDC_BUTTON_CREATE_ACCOUNT
IDC_BUTTON_DOWNLOAD
IDC_BUTTON_LOGIN
IDC_BUTTON_OPEN
IDC_CB_AGREE
IDC_CB_BAIDU
IDC_CB_CHROMEEMPTYTABSet improved Google Chrome Empty Tab
IDC_CB_HOMEPAGE
IDC_LINK_DONT_HAVE_ACCOUNT
IDC_LINK_EULA
IDC_LINK_HAVE_ACCOUNT
IDC_LINK_PP
IDC_LINK_TERM_OF_USE
IDC_MAIN_BUTTON_DOWNLOAD
IDC_MAIN_TEXT_DOWNLOAD_DST
IDC_MAIN_TEXT_DOWNLOAD_DST_PRE
IDC_MAIN_TEXT_INTRO
IDC_MAIN_TEXT_REQUESTED_FILE
IDC_MAIN_TEXT_REQUESTED_FILE_PRE
IDC_PROGRESS_TEXT_FILENAME
IDC_TEXT_AND
IDC_TEXT_AUTH_INSTRUCTION
IDC_TEXT_DESCRIPTION_BAIDU
IDC_TEXT_DOWNLOAD_DST_PRE
IDC_TEXT_FIRSTNAME
IDC_TEXT_HOMEPAGE_INSTRUCTION
IDC_TEXT_INTRO
IDC_TEXT_LOGIN
IDC_TEXT_PASSWORD
IDC_TEXT_PASSWORD_CONFIRM
IDC_TEXT_REQUESTED_FILE_PRE
IDC_TEXT_SECONDNAME
IDC_TEXT_STATUS
IDC_TEXT_STATUS_PROGRESS
I don't have an account,
If you
Ignore and continue
Installation
Installing...
instapp.exe
Interface
InternalName
Invalid DateTime
Invalid DateTimeSpan
%i%% - %s
I want to create new free account...
jjjjj
jjjjjjjjj
KERNEL32.DLL
_Label_Original_Proc_
Last Name
_Lbl_Background_Color_
LegalCopyright
LegalTrademarks
License Agreement
ll perform a complete maintenance routine, including boot time optimization, disk cleanup and much more!
Location: {[A-Za-z0-9\-_%+*:;/.=?&]+}
Login and Download
MESSAGE_LOGIN_EMPTY
MESSAGE_NAMES_EMPTY
MESSAGE_PASSWORD_EMPTY
MESSAGE_PASSWORD_LONG
MESSAGE_PASSWORD_MISMATCH
Mime
mscoree.dll
msctls_progress32
MS Shell Dlg
Name cannot be empty, please enter your name.
ndefault
NoRemove
(null)
open
openas
Open file
Password
Password and confirmation do not match, please enter identical passwords.
Password cannot be empty, please enter correct password.
Password ls too long, please enter shorter password.
policy
POST
premium
Privacy Policy
ProductName
ProductVersion
q("[^"]*")|('[^']*')
Quit
Range: bytes=%i-
renameto_
\r\n
runas
Save the downloaded file to:
SECURITY
Select target dir..
Server answered: 
Set-Cookie:\b*{.+?}\n
Set my homepage to search.b1.org in Internet Explorer, Firefox and Google Chrome
shell32.dll
Show
Show in Explorer
Skip
SkipAll
Software
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
static
StringFileInfo
substring
SYSTEM
t be without Baidu PC Faster. One click and you
temp
Terms of Use
Translation
TypeLib
Unexpected network error
Unexpected network error, cannot download %s
UniversalUserAgent(winHTTP)
URL: 
%USERPROFILE%
utf-8
VarFileInfo
VS_VERSION_INFO
w([a-zA-Z]+)
Welcome to %s Download Helper,
wGET
which will guide you through the download process.
" you agree to 
You have requested file:
You need 4Shared account to download this file:
                          
; <:<^<
 0$0(0
0 0$0(0,0004080<0@0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
0$0(000H0X0\0l0p0t0x0
0$0)020:0K0T0Y0_0i0s0}0
0$0,040<0D0P0p0|0
0$0,040@0l0
0,010I0O0^0d0s0y0
0,030=0g0u0{0
0,080P0o0
0$080X0x0
0(0L0X0|0
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0-141;1I2c2
&030A0i0v0
030Q0X0\0`0d0h0l0p0t0
; ;$;(;0;4;
=$=(=,=0=4=8=<=@=
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<
? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?
: :0:4:D:H:L:T:l:|:
061116015437Z
061A1\1c1h1l1p1
06KM2{c
07969287
079692870
080<0@0
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
?(?0?8?@?L?l?t?|?
<$<0<8<T<\<d<p<
\$09^$
~09n<v
|$09|$,v
\$09\$,v
0A@@Ju
>+>0>B>I>P>
?%?0?B?J?[?d?i?r?z?
0d3h3l3p3t3
:0:D:P:X:
=%=0=>=H=N=
;+;0;:;H;N;`;k;
? ?$?(?0?H?X?\?l?p?
+0iw+hB=
:0K0V0_0e0r0
0SSSSS
;$;0;\;t;
0WWWWW
&+ %) )1
1 10141D1H1X1\1`1h1
1$101P1\1
1(1,1014181@1X1h1l1p1t1|1
1 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1p1t1x1|1
111>1C4S4
1$1<1L1`1l1t1
1(1/1T1X1\1`1
1)152r2
1[1a1r1
1$1D1`1|1
1 1D1L1T1\1d1l1t1|1
1(1H1T1l1p1
1?1N1k1
130815064132Z
131<1n1~1
1 3j3{3
1#41474Q4V4e4n4{4
160815064132Z0e1
161u1|1
?#?*?1?6?G?R?[?a?n?
>1>7>8?
<;=1>9>
<$<1<I<r<
1M1T1]1c1l1
<1<`<o<
=1=O=b=i=|=C>V>
1P%vi!
1#QNAN
1#SNAN
;1<Z<u<
>#?2?`?
"+2!&+!*1!(/!*2!&*
2,202P2l2p2
2!2'212@2_2|2M3X3i3u3}3
2#222A2e2l2z2
2"222c2y2
222=2U4
2$2(282<2@2D2L2d2t2x2
2 2[2w2
2(282<2L2P2T2X2`2x2|2
2,282t2
2!2H2V2
2#2J2[2f2o2u2{2
2(2L2\2t2
2$2P2V2_2f2
2<2P2x2
2 363;3B3
261116015437Z0
2)686L6
>!>->2>7>=>A>G>L>R>W>f>|>
<'<,<2<<<B<R<W<i<p<w<
2C3S3v3
2e3#414
2IDATx
=2pC4A9.
2Z2`2d2h2l2
<3=@=]=
:":3:?:
?-?3?:?{?
303P3X3l3t3
314B4H4`4r4
3 303[3
3$30383T3`3
3#3'3+3/33373;3?3C3G3K3O3S3_3i3
3 3$34383<3@3D3L3d3t3x3
3 3+3B3N3[3b3
333I3m5
3,3L3p3
3,3L3T3\3d3l3t3|3
3?3S3f3
343D3H3X3\3`3h3
343D3T3h3|3
3$4(4,404
3-4F4U4Z4{4
3 4H4h4
3)4N416-8185898=8A8E8I8
383T3q3
:3;8;D;O;T;Y;d;i;
<3=B=s=
3[E62l
3H4h4X5
>'>3>i>s>(?C?V?
?3?<?J?V?e?n?
>#?3?L?
=(>3>l>w>S?b?y?
:3;<;m;
?)?3?m?
;3<R<z<
3X4\4`4d4h4l4p4t4x4|4
:3;?;X;`;m;s;
40484D4d4l4x4
).4$*1
425?5Z5
4,404@4D4T4X4h4l4|4
4 4$4(4,4044484<4@4D4H4L4P4T4X4\4`4d4h4l4p4t4x4|4
4$4,444<4D4L4X4|4
444<4T4e4
444D4H4X4\4`4h4
4,4@4L4T4l4t4|4
4$484@4D4L4T4\4p4x4|4
4=4N4Y4b4h4o4y4
4"5*565
4)565@5N5W5a5
4 565J5
4*595F5
4`5h5l5p5t5x5|5
4?6@7]7m7
484N4S4Z4
>$>4>8>H>L>P>X>p>
4C5R5n5x5
4C5U5g5
>$>,>4><>D>L>T>`>
:4:<:D:L:T:`:
>$>,>4><>D>L>T>\>d>l>
>4><>D>L>T>\>d>l>t>|>
?$?,?4?<?D?L?T?\?d?l?t?|?
=$=,=4=<=D=L=T=\=d=p=
;$;,;4;<;D;L;X;x;
4e6-8:8H8x8
$"+4HNS
:$:,:4:@:`:h:t:
;4;H;T;\;t;
<(<-<4<i<
; ;,;4;L;T;`;
=(=4=<=T=`=
<4<T<h<t<|<
4U4u4'5;5S5g5
4X5u5z5
505<5D5t5
506C6T6q6x6
545<5D5L5T5\5h5
545H5T5\5
5,505@5D5H5P5h5x5|5
5)545X5a5h5q5
5!5&5,51575>5
5 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5 5$5,5D5T5X5\5`5d5l5
5"565=5C5Q5X5]5f5s5y5
5)575=5_5
5<5D5L5T5\5h5
5=5G5[5
5#626`6
5&636A6#717
5%6*6/646D6s6
595V5s5
:5:=:[:c:
5C5e5l5
=5=;=C=O=e=k=z=
5http://certificates.godaddy.com/repository/gdroot.crl0K
=5=O=o=
5P>T>X>\>p>t>
606@6D6L6d6h6
617S7s7	8
646L6`6l6t6
658C8K8X8v8
6&6/656B6Z6h6
6$6(6,646L6\6`6p6t6x6
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6
6 6$6(6,6084888<8@8D8H8L8P8T8X8\8`8d8h8l8
6 6$6*6.6G6b6~6
6"6,666w6|6
6 6(6@6L6l6x6
6$6,686\6d6l6t6|6
6 6,686D6P6[6
6#6=6H6
6(6;6S6e6
6$6<6X6p6
6,686X6d6
6?7(888F8
6-7U7{7
<#<-<6<A<M<R<b<g<m<s<
6P7;8H8
6U6Z6`6f6u6
6w7*;M;i;
707@7D7T7X7\7d7|7
718R8r8
727A7N7Z7j7q7
737C7k7#808
7,707@7D7H7P7h7x7|7
7 747@7H7`7l7
7#7*7/7
7 7,7L7X7|7
7$7<7P7\7d7
7 7/7S7e7w7
7 7D7P7t7|7
7#808G8x8
7'868_8j8s8
7"8H80:W<[<_<c<g<k<o<s<
7"8U8d8m8
7(9!b'q
(7b}aS
7IDATx
7I:X:f:x:
<7<k<Q=
7X8d8w8
7XJ-#s]
828>8e8r8w8
83999u9
848D8T8h8|8
8'858G8U8j8t8
8 869H9
8"8.858
8$8(8,848L8\8`8p8t8|8
8$8:8?8]8d8l8
8(8,8<8@8D8L8d8t8x8
8$8+898
8,8<8L8`8t8
8 8,8L8T8\8d8l8t8|8
8 8,8L8T8\8h8
8#8v8|8
8+9c<s<
8#:9:J:
8.9N9S9~9
8A8K8l8x8
= =,=8=B=N=a=s=z=
? ?$?(?8?@?D?H?L?P?T?X?\?`?d?p?
8F8_8}8
<8<@<H<T<t<|<
8J9Y9n9
8J=Z={=
:!:,:8:M:T:h:o:
!8\$pt
8\$@tU
>8>X>x>
>	?9?\?
\$|9](
90K0[0
9$:*:2:?:S:m:
9#=*=3=9=?=H=
949T9p9
95:X:{:
9*909;9@9L9
9#939E9s9
9#979B9S9a9x9
9$9,949<9H9h9p9x9
9 9$9(909H9X9\9l9p9x9
9 9&9-939:9C9O:X:
9,9<9@9P9T9X9`9x9
9	9*9C9J9P9W9f9m9s9z9
9 9(9D9P9t9
9.9[9v9
9(9H9T9t9
9%9J9b9i9r9x9~9
9,9S9|9
9C3J3W
9D9\9l9|9
>">*>9>@>J>T>]>n>x>
9(:L:x:
^@9n8r
^\9nTr
:%:9:s:
9S9a9c>q>
;9\$@t
9\$$tp3
\$ 9t$$ue
\$ 9t$,uE
~ 9^ u
9+u4;s
],9](v
}-9XK<a
9>xp)i
]\9]Xv
9Xxu	_]
a`9kO_
AAFFf;
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Adobe ImageReadyq
ADVAPI32.dll
AHXLXN
AlphaBlend
america
american
american english
american-english
An application has made an attempt to load the C runtime library incorrectly.
;+;:;A;N;q;
AppendMenuW
\a*Q4o	
Arizona1
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
.?AUctype_base@std@@
August
.?AUITextWidther@@
australian
autolaunch
.?AV?$AND_Checkers@V?$NOT_Checker@VXmlRegCheck@@@@@@
.?AV?$AND_Checkers@VXmlFileFolderCheck@@@@
.?AV?$AND_Checkers@VXmlRegCheck@@@@
.?AVbad_alloc@std@@
.?AVbad_cast@std@@
.?AVbad_exception@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AVBundlesSliderWindow@@
.?AVCAtlException@ATL@@
.?AV?$ctype@D@std@@
.?AVCustomWindow@@
.?AVDiskFile@@
.?AVexception@std@@
.?AVfacet@locale@std@@
.?AVfailure@ios_base@std@@
.?AVFileBase@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AVLabelTextSetter@@
.?AVlength_error@std@@
.?AVLoaderCallback@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AVMainDownloaderWindowSlider@@
.?AVMainWindow@@
.?AVMemoryFile@@
.?AV?$MemPoolT@$0CE@@tinyxml2@@
.?AV?$MemPoolT@$0CM@@tinyxml2@@
.?AV?$MemPoolT@$0DA@@tinyxml2@@
.?AV?$MemPoolT@$0DE@@tinyxml2@@
.?AVMemPool@tinyxml2@@
.?AV?$NOT_Checker@VXmlRegCheck@@@@
.?AVNullFile@@
.?AV?$OR_Checkers@V?$NOT_Checker@VXmlRegCheck@@@@@@
.?AV?$OR_Checkers@VXmlFileFolderCheck@@@@
.?AV?$OR_Checkers@VXmlRegCheck@@@@
.?AVout_of_range@std@@
.?AVProgressDownloaderWindow@@
.?AVruntime_error@std@@
.?AVScreenBase@@
.?AVServerResponsesHandler@@
.?AVtype_info@@
.?AVWinHttpSmartLoader@@
.?AVXMLAttribute@tinyxml2@@
.?AVXmlBackImage@@
.?AVXmlBinary@@
.?AV?$XmlBundledContent@VXmlComplexDescriptionBundle@@@@
.?AVXmlBundleEulaText@@
.?AVXmlBundleLine@@
.?AVXmlBundleNumber@@
.?AVXmlBundleText@@
.?AVXMLComment@tinyxml2@@
.?AVXmlComplexBundlesLoadManager@@
.?AVXmlComplexDescriptionBundle@@
.?AVXmlContentBase@@
.?AVXmlContentData@@
.?AVXMLDeclaration@tinyxml2@@
.?AVXMLDocument@tinyxml2@@
.?AVXMLElement@tinyxml2@@
.?AVXmlExBundle@@
.?AVXmlFileFolderCheck@@
.?AVXmlIconedBundle@@
.?AVXmlLaunchValidation@@
.?AVXmlLink@@
.?AVXmlLoaderBase@xml@@
.?AVXmlLoadManager@@
.?AVXMLNode@tinyxml2@@
.?AVXmlRawBundle@@
.?AVXmlRegCheck@@
.?AVXMLText@tinyxml2@@
.?AVXmlUniversalStyleContent@@
.?AVXMLUnknown@tinyxml2@@
.?AVXmlValidationResponse@@
>#>+>B>
backimages
bad allocation
bad cast
bad exception
 Base Class Array'
 Base Class Descriptor at (
__based(
Bcl.-x
BeginPaint
belgian
}!Bg97f
^b&H0C:
binary
BitBlt
BLS[i`
bottom
)bQBq:
BringWindowToTop
britain
>!>)>:>B>r>w>
bsbLs#&s?
bundle
bundle0buttonLabel
bundle0fileName
bundle0header1
bundle0header2
bundle0header3
bundle0requestLabel
bundlebeforelaunch
bundle%d
bundle%dbuttonLabel
bundle%deulatext
bundle%dex
bundle%dfileName
bundle%dheader1
bundle%dheader2
bundle%dheader3
bundle%dicon
bundle%dlines
bundledownloaderror
bundledownloadstart
bundledownloadsuccess
bundle%drequestLabel
bundlelauncherror
bundlelaunchsuccess
bundleperscreen
bundlepostsuccess
bundlestimeout
buttonLabel
=#=[=c=
C1U1e1W2u3
C2H2o:|:
c6#EQ[
CallWindowProcW
canadian
cancelbutton
cCP	V 
<![CDATA[
__cdecl
<C<d<p<v<{<
"C=dwE"
<'=C=f=y=
checkbox
CheckDlgButton
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
CIM.49"##
>">/>C>j>
 Class Hierarchy Descriptor'
CloseHandle
__clrcall
cnw_T?f
CoCreateInstance
CO^h[M
CoInitializeEx
COMCTL32.dll
 Complete Object Locator'
CONOUT$
`copy constructor closure'
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
CorExitProcess
CoTaskMemFree
C PjPV
C$PjQV
C.PjRV
C/PjSV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
/C<pQVI
CreateCompatibleBitmap
CreateCompatibleDC
CreateDialogIndirectParamW
CreateDialogParamW
CreateDIBSection
CreateEventW
CreateFileA
CreateFileW
CreateFontIndirectW
CreateFontW
CreateMutexW
CreatePatternBrush
CreatePopupMenu
CreateSolidBrush
CreateThread
CreateWindowExW
=(=C=R=k=
- CRT not initialized
=C>U>f>
: ;C;w;};
Cyprus1
D$ _^][
D$0+D$(
D$0RPj
D$0SUVW
D$0SVW
D$4jdP
D$4PQP
D$ ,6E
D$8PRj
D$8SUVW
D$@	9l$0r
\$d9t$@
D$ 9t$4s
D$$9t$Tr
\$d9t$xs
]D9]@v
@.data
D$(+D$ 
D$@;D$D
dddd, MMMM dd, yyyy
D$DSUVW
D$dSVW
December
DecodePointer
`default constructor closure'
 delete
 delete[]
DeleteCriticalSection
DeleteDC
DeleteFileW
DeleteObject
  </dependency>
  <dependency>
    </dependentAssembly>
    <dependentAssembly>
destinationFolder
destinationLabel
DestroyMenu
DestroyWindow
D$H+D$@
D$,H?E
D$HSUVW
:$:,:D:I:S:c:m:
DispatchMessageW
D$<jdP
d%J`%J
D$L+D$D
<(<,<<<@<D<L<d<t<x<
= =D=L=T=`=
:$:D:L:T:\:d:l:x:
< <D<L<X<|<
<D=O=i=n=u=~=
DOMAIN error
downloaderror
downurl
D$PPj\W
D$PSVW
D$PUPW
D$$QRP
D$$QRPW
DrawFrameControl
DrawTextW
>!>D>R>]>s>y>
D$ RUWj
D$,SUV
D$(SUV
D$<SUVW
D$ SUVW
D$(SUVW
D$@SUVW
D$$SUVW
D$\SUVW
D$<SUW
D$`SVW
D$ SVW
D$$SVW
D$tP?E
D$TSUVW
= =$=,=D=T=X=h=l=p=x=
dutch-belgian
}@;}Dv
D$ VSUP
D$(WPWU
D$xSUVW
`dynamic atexit destructor for '
`dynamic initializer for '
dynboth
dynleft
dyntop
>>>e>{>
e0'4F[
E>Ac,^
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
=)>>>E>L>T>
EnableWindow
EncodePointer
EndDialog
EndPaint
england
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
EnterCriticalSection
EnumChildWindows
EnumSystemLocalesA
eRP\e6E
:E;];u;
ExitProcess
ExpandEnvironmentStringsW
expire
extra1
extra2
extra3
F09^(u
F0@;F,~LSW
F0h@2E
F49n,r
@@f90u
F@9n8r
failon302redirect
__fastcall
;F<c=v=
February
filecheck
fileName
filepostcheck
FillRect
finish
finishimg
fixHeight
FL9nDr
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FP9nHr
FQ=]v9>
FreeEnvironmentStringsA
FreeEnvironmentStringsW
french-belgian
french-canadian
french-luxembourg
french-swiss
Friday
fR[n` 
(f;)u$
)f;*u%
:.;F;V;d;
=&=F=w=
fXZS*V+
G0_^][
G<9t$$r
GAIsProcessorFeaturePresent
GDI32.dll
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
GetACP
GetActiveWindow
GetAncestor
GetClientRect
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCursorPos
GetDlgCtrlID
GetDlgItem
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetMessageW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetObjectW
GetOEMCP
GetParent
GetProcAddress
GetProcessWindowStation
GetPropW
GetStartupInfoA
GetStdHandle
GetStockObject
GetStringTypeA
GetStringTypeW
GetSysColorBrush
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTextExtentPoint32W
GetTickCount
GetUserDefaultLCID
GetUserObjectInformationA
GetVersionExW
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
=G>g>l>z?
=G>^>h>
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
(Go Daddy Class 2 Certification Authority0
GoDaddy.com, Inc.1301
'Go Daddy Secure Certification Authority1
gq)+.;J
great britain
!>GSAZK
<G=U=v=
`h````
hcenter
|$H+|$D
header1
header2
header3
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
|$ hH(E
`h`hhh
HH:mm:ss
HHtXHHt
HHtYHHt
@HKB/g@Oe
?,?H?l?t?
~h;~lv
_h;_lv
{h;{lv
hmp\af;BFnsvSX\4:?cilLQV
"hnmNr
holland
hong-kong
*http://certificates.godaddy.com/repository0
+http://certificates.godaddy.com/repository/0
*http://certificates.godaddy.com/repository100.
>http://certificates.godaddy.com/repository/gd_intermediate.crt0
"http://crl.godaddy.com/gds5-16.crl0S
http://ocsp.godaddy.com0F
http://ocsp.godaddy.com/0J
hybridFileName
hybridUrl
IA%yP5
|IDATx
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:3DD5C9019D5C11E3BA01FEA404FAD141" xmpMM:DocumentID="xmp.did:3DD5C9029D5C11E3BA01FEA404FAD141"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3DD5C8FF9D5C11E3BA01FEA404FAD141" stRef:documentID="xmp.did:3DD5C9009D5C11E3BA01FEA404FAD141"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:F78B75BF9D6D11E3BA01FEA404FAD141" xmpMM:DocumentID="xmp.did:F78B75C09D6D11E3BA01FEA404FAD141"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F78B75BD9D6D11E3BA01FEA404FAD141" stRef:documentID="xmp.did:F78B75BE9D6D11E3BA01FEA404FAD141"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>i
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:08C0D76B9D6C11E3BA01FEA404FAD141" xmpMM:InstanceID="xmp.iid:08C0D76A9D6C11E3BA01FEA404FAD141" xmp:CreatorTool="Adobe Photoshop CS6 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="E089FF6E8743023187518D0ED4809278" stRef:documentID="E089FF6E8743023187518D0ED4809278"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
>If90t
ijZxWwb
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
introscreen
InvalidateRect
invalid map/set<T> iterator
invalid string position
ios_base::badbit set
ios_base::eofbit set
ios_base::failbit set
irish-english
IsDebuggerPresent
IsDialogMessageW
IsDlgButtonChecked
IsValidCodePage
IsValidLocale
IsWindow
italian-swiss
$iTXtXML:com.adobe.xmp
iTXtXML:com.adobe.xmp
JanFebMarAprMayJunJulAugSepOctNovDec
January
J'\'Gg
j h8bE
=J>h>z>
jJ_HNF=
j@j ^V
'j%[Kk
JL	H+1
:$:>:J:R:b:w:
j"^SSSSS
jThXaE
>+???J?X?
:K>]97V
KERNEL32
KERNEL32.dll
KillTimer
K-j](]
kl9khv
KP)~rtX
Ks3y0Y
>K>T>`>
K v1u,
=&=_=l=
L$$;1s.Q
L3+wCT}
L$89t$hr
_l9_hv
L$,9\$@s
L$\9t$Pr
L$,9t$\r
L$,9\$xr
launch-params
launch-type
launchValidation
lBd'EG
LC_ALL
LC_COLLATE
LC_CTYPE
LCMapStringA
LCMapStringW
LC_MONETARY
LC_NUMERIC
LC_TIME
L$d^[3
L$d_[3
L$d9t$xs
LeaveCriticalSection
leftBorder
: ;L;h;
l$H9L$
Limassol1
line%d
.lJVzaI
L$,;L$
L$,+L$$+
L$$+L$ 
L$,+L$$j
L$L+L$H
l$$;l$,t
LoadCursorW
LoadIconW
LoadLibraryA
LoadLibraryW
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
L}O:g Dq
L$ PQh
;$;<;L;P;T;\;t;
L$$QSSSSP
L$$RPQ
L$$RPQV
L$ SQP
lstrcatW
lstrcmpiA
lstrcmpiW
lstrcpynW
lstrcpyW
lstrlenA
lstrlenW
;L$<t	
L$t9|$lr
L$tPVP
L$TRSShX
>,>@>L>T>t>
L$,UUUUUQP3
L$,WUj
L$,WUURV
L$x_^[3
= =,=L=X=x=
]_l?[y%
lZj&KTl
; ;&;m;
mainbundle
maincheckbox
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
map/set<T> too long
MapWindowPoints
masteraction
masterrun
masterstart
Maxiget Limited0
Maxiget Limited1
MessageBeep
MessageBoxA
MessageBoxW
metalink
</metalink>
metaurl
mHmP#&
Microsoft Visual C++ Runtime Library
:}MI*d
MM/dd/yy
Monday
MoveFileW
MoveWindow
MSIMG32.dll
MultiByteToWideChar
M$<Up8
<m=$>x>
N\9nTr
 new[]
new-zealand
Nh9n`r
Nl9ndr
norwegian
norwegian-bokmal
norwegian-nynorsk
Norwegian-Nynorsk
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
NP9nHr
nt`K]{
>N?U?^?d?j?w?
(null)
>#?N?V?\?w?
=N=W=]=c=m=s=
:);o;2<e<
October
offset
O=GmG{
;?;O;g;q;
OiCCPPhotoshop ICC profile
okT6ii
ol9ohv
ole32.dll
`omni callsig'
o^MwWM
O<;OD~
operator
p0t0x0|0
P1T1X1\1`1d1h1l1p1t1x1|1
__pascal
PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
PathRenameExtensionW
PathStripPathW
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
policy
policytext
portuguese-brazilian
postchecktimeout
PostMessageW
PostQuitMessage
PPh$%E
PPh\$E
PPhl$E
PPPPPPPP
PQhH%E
PQhl%E
PQSUVW
pr china
pr-china
Program: 
<program name unknown>
progress
progressimg
? ?$?<?@?P?t?
__ptr64
}p;}tv
<p>t>x>|>
puerto-rico
- pure virtual function call
PVVVVQ
<)<Q<i<t<~<
Qj2j2Pj
QQSVWd
QueryPerformanceCounter
qz9,(q]@P
%,>R47mg
r7d~\~
radiocustom
radioquick
RaiseException
`.rdata
ReadFile
regcheck
regcheck_notexists
RegCloseKey
RegOpenKeyExW
regpostcheck
regpostcheck_notexists
RegQueryValueExW
ReleaseDC
@.reloc
RemovePropW
        <requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
requestLabel
__restrict
RjY FW
Rn.c4)G
RtlUnwind
ru"/HY
runtime error 
Runtime Error!
;!;r;w;
?=?r?w?|?
<!--%s-->
<?%s?>
"S3c2L
S4b4q4
Saturday
saveFileName
'-sb{m
`scalar deleting destructor'
Scottsdale1
ScreenToClient
    </security>
    <security>
SelectObject
SendMessageW
September
SetBkMode
SetCursor
SetDlgItemTextW
SetEvent
SetFilePointer
SetFocus
SetHandleCount
SetLastError
SetPropW
SetStdHandle
SetTextColor
SetTimer
SetUnhandledExceptionFilter
SetWindowLongW
SetWindowPos
SetWindowTextW
SHBrowseForFolder
SHCreateDirectoryExW
SHCreateStreamOnFileEx
SHELL32.dll
ShellExecuteExW
Shell_NotifyIconW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHLWAPI.dll
SHOpenWithDialog
ShowWindow
signupurl
silent
SING error
<sKNT|
sl9shv
slovak
south africa
south-africa
south korea
south-korea
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
[;s|R>
s[S;7|G;w
^SSSSS
startrightafterskip
stats-url
stats-url2
staturl
__stdcall
`string'
string too long
StrStrIW
StrToIntExW
subidlaunch
Sunday
SunMonTueWedThuFriSat
 SUVWj
(SUVWj
swedish-finland
;\$(t	
;t<|<0=7=@=F=L=U=^=u=
T$09t$dr
T$09t$pr
T$4jdR
>&>T>7?
T$ 9|$4s
t!9^`r
t$d9\$xs
T$DQRh
tehyLB
TerminateProcess
tEXtSoftware
tgSUVW
t h|>E
t"h\:E
t%h :E
t%h,:E
t%h@:E
t%h\>E
The Go Daddy Group, Inc.110/
+t HHt
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
t"hL:E
t#hL;E
t hp>E
t"ht:E
t#hT;E
Thursday
t%hx=E
t=hX.E
tinyxml2::XMLDocument error id=%d str1=%s str2=%s
T$<jdR
T$,jdR
< tK<	tG
=(=T=l=
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t#/nnv
topBorder
T$ PQVR
T$PRj\U
tR99u2
TrackPopupMenuEx
TranslateMessage
trinidad & tobago
T$$RUP
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
T$ RWh3
t"SS9]
<+t(<-t$:
t$<"u	3
Tuesday
;t$,v-
t VV9u
T$(WQRP
t+WWVPV
T$x9t$pr
 Type Descriptor'
`typeof'
:?;U;\;
u-9^`r
u?9^`r
UBRPSW
uchP9E
`udt returning'
>>?U?h?
u,hx@E
u)jAXf;
uLSUh8
- unable to initialize heap
- unable to open console device
__unaligned
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UNICODE
uninstall
uniquescreen
united-kingdom
united-states
Unknown exception
UpdateWindow
UQPXY]Y[
url_download_method
url_params
URPQQh
USER32.dll
USER32.DLL
UTF-16LE
u,VVWV
}(;},v
<"<><V<|<
V09n(r
V49n,r
`vbase destructor'
v%br_o
`vbtable'
`vcall'
vcenter
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
vector<T> too long
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
`vftable'
>(>V?h?
virgin
VirtualAlloc
`virtual displacement map'
VirtualFree
=;=V=j=
Vj j j
Vl9ndr
v m2=:
v	N+D$
v&NkO*L
V-o$`~'5,
v?;O/PG
_VVVVV
Vx9npr
=w=0>H>M>
W?0i%!o&8
WaitForMultipleObjects
WaitForSingleObject
Wednesday
|$ Wh8
WICConvertBitmapSource
WideCharToMultiByte
WindowsCodecs.dll
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WINHTTP.dll
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpWriteData
wintitle
wl9whv
WriteConsoleA
WriteConsoleW
WriteFile
^<W;^@v
^WWWWW
|$X9L$\s
@xcOiqAh
XHM}z\U
xml version="1.0"
<?xml version="1.0" encoding="UTF-8"?>
xml version="1.0" encoding="UTF-8"
<?xpacket begin="
x)_p"e
xppwpp
xpxxxx
}X;}\v
XYiZ1W
~]<@}Y
Y0h0v0
Y^avz~
y|	cw?L
Ynq%3a
>=Yt1j
Yt9Ypv	
z1/kNw
zAv,iZZ
ZS|UmrTm^
z%wQ}6