Analysis | #totalhash

Analysis Date	2013-12-25 03:28:23
MD5	3a880f2108b78cb7403280bde309bb56
SHA1	a345de0515fb45fb6256cbf2e4f2628921df3524

Static Details:

File type	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section	.text md5: 790e7e00c8fe1a4c28ffad701c147a19 sha1: ff9b194efa3629e0f3ee0af10c57e1e3f9eb1c90 size: 747520
Section	.rdata md5: 753c42530776da8aac0fa4578262d789 sha1: 0f6a0166359a2dd804b9df3fcfbe58f50dd0f4df size: 34304
Section	.data md5: 727f72c7c826390d4abd6f08f52a4112 sha1: 3ae1abe64475f9ed94c314cdfe34619b4be85f6b size: 124416
Timestamp	2013-12-11 04:18:55
Packer	Microsoft Visual C++ ?.?
PEhash	b47ac2ffdb5d5622889b75143eb7583aefdf0bf1
AV	avira	TR/Symmi.25089.45
AV	avg	Crypt2.CDXW

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates File	C:\Documents and Settings\Administrator\Local Settings\Temp\ztauht1jpnvgppxok2dxu5.exe
Creates File	C:\WINDOWS\system32\gwulfpupx\tst
Creates Process	C:\Documents and Settings\Administrator\Local Settings\Temp\ztauht1jpnvgppxok2dxu5.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\ztauht1jpnvgppxok2dxu5.exe

Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\Redirector TP Base Trap Removal Adaptive ➝ C:\WINDOWS\system32\zbjneixzu.exe
Creates File	C:\WINDOWS\system32\gwulfpupx\etc
Creates File	C:\WINDOWS\system32\drivers\etc\hosts
Creates File	C:\WINDOWS\system32\gwulfpupx\lck
Creates File	C:\WINDOWS\system32\zbjneixzu.exe
Creates File	C:\WINDOWS\system32\gwulfpupx\tst
Deletes File	C:\WINDOWS\system32\\drivers\etc\hosts
Creates Process	C:\WINDOWS\system32\zbjneixzu.exe
Creates Service	Session Support Quality Locator Update - C:\WINDOWS\system32\zbjneixzu.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 816

Process
↳ Pid 864

Process
↳ C:\WINDOWS\System32\svchost.exe

Creates File	PIPE\lsarpc

Process
↳ Pid 1228

Process
↳ C:\WINDOWS\system32\spoolsv.exe

Registry	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝ NULL
Registry	HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝ 7
Registry	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝ NULL
Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝ C:\WINDOWS\System32\spool\PRINTERS\\x00

Process
↳ Pid 1872

Process
↳ Pid 1184

Process
↳ C:\WINDOWS\system32\zbjneixzu.exe

Registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝ 1
Creates File	C:\WINDOWS\system32\itbbpkvhryrk.exe
Creates File	C:\WINDOWS\system32\gwulfpupx\lck
Creates File	C:\WINDOWS\system32\gwulfpupx\cfg
Creates File	C:\WINDOWS\system32\gwulfpupx\run
Creates File	pipe\net\NtControlPipe10
Creates File	C:\WINDOWS\system32\gwulfpupx\rng
Creates File	C:\WINDOWS\system32\gwulfpupx\tst
Creates File	\Device\Afd\Endpoint
Creates File	C:\WINDOWS\TEMP\ztauht1z1avgpp.exe
Creates Process	WATCHDOGPROC "c:\windows\system32\zbjneixzu.exe"
Creates Process	C:\WINDOWS\TEMP\ztauht1z1avgpp.exe -r 22012 tcp

Process
↳ C:\WINDOWS\system32\zbjneixzu.exe

Creates File	C:\WINDOWS\system32\gwulfpupx\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\zbjneixzu.exe"

Creates File	C:\WINDOWS\system32\gwulfpupx\tst

Process
↳ C:\WINDOWS\TEMP\ztauht1z1avgpp.exe -r 22012 tcp

Creates File	\Device\Afd\Endpoint
Winsock DNS	239.255.255.250

Network Details:

DNS	kaselindertu.com Type: A 65.254.248.145
DNS	fredesecas.com Type: A 216.239.139.20
DNS	jumpgray.net Type: A 98.139.135.198
DNS	stickmarch.net Type: A 98.139.135.198
DNS	tablefruit.net Type: A 98.139.135.198
DNS	davedekilai.com Type: A 66.147.244.161
DNS	laloponea.com Type: A 216.239.138.68
DNS	sorryshoe.net Type: A 98.139.135.198
DNS	donaven4guia.com Type: A 216.239.138.217
DNS	stickpress.net Type: A 50.63.202.59
DNS	lifeboat.net Type: A 89.105.202.5
DNS	lifepress.net Type: A 75.126.38.98
DNS	tillpress.net Type: A 69.61.78.80
DNS	tillrest.net Type: A 192.64.25.56
DNS	pushpress.net Type: A 107.20.206.69
DNS	lifefind.net Type: A 66.151.181.33
DNS	soilopen.net Type: A
DNS	wheelboat.net Type: A
DNS	saidboat.net Type: A
DNS	wheelpress.net Type: A
DNS	saidpress.net Type: A
DNS	wheelrest.net Type: A
DNS	saidrest.net Type: A
DNS	wheelopen.net Type: A
DNS	saidopen.net Type: A
DNS	stickboat.net Type: A
DNS	ballboat.net Type: A
DNS	ballpress.net Type: A
DNS	stickrest.net Type: A
DNS	ballrest.net Type: A
DNS	stickopen.net Type: A
DNS	ballopen.net Type: A
DNS	enemyboat.net Type: A
DNS	enemypress.net Type: A
DNS	enemyrest.net Type: A
DNS	liferest.net Type: A
DNS	enemyopen.net Type: A
DNS	lifeopen.net Type: A
DNS	mouthboat.net Type: A
DNS	tillboat.net Type: A
DNS	mouthpress.net Type: A
DNS	mouthrest.net Type: A
DNS	mouthopen.net Type: A
DNS	tillopen.net Type: A
DNS	shallboat.net Type: A
DNS	deepboat.net Type: A
DNS	shallpress.net Type: A
DNS	deeppress.net Type: A
DNS	shallrest.net Type: A
DNS	deeprest.net Type: A
DNS	shallopen.net Type: A
DNS	deepopen.net Type: A
DNS	pushboat.net Type: A
DNS	fridayboat.net Type: A
DNS	fridaypress.net Type: A
DNS	pushrest.net Type: A
DNS	fridayrest.net Type: A
DNS	pushopen.net Type: A
DNS	fridayopen.net Type: A
DNS	alongboat.net Type: A
DNS	decemberboat.net Type: A
DNS	alongpress.net Type: A
DNS	decemberpress.net Type: A
DNS	alongrest.net Type: A
DNS	decemberrest.net Type: A
DNS	alongopen.net Type: A
DNS	decemberopen.net Type: A
DNS	longtold.net Type: A
DNS	soiltold.net Type: A
DNS	longfind.net Type: A
DNS	soilfind.net Type: A
DNS	longwear.net Type: A
DNS	soilwear.net Type: A
DNS	longhurt.net Type: A
DNS	soilhurt.net Type: A
DNS	wheeltold.net Type: A
DNS	saidtold.net Type: A
DNS	wheelfind.net Type: A
DNS	saidfind.net Type: A
DNS	wheelwear.net Type: A
DNS	saidwear.net Type: A
DNS	wheelhurt.net Type: A
DNS	saidhurt.net Type: A
DNS	sticktold.net Type: A
DNS	balltold.net Type: A
DNS	stickfind.net Type: A
DNS	ballfind.net Type: A
DNS	stickwear.net Type: A
DNS	ballwear.net Type: A
DNS	stickhurt.net Type: A
DNS	ballhurt.net Type: A
DNS	enemytold.net Type: A
DNS	lifetold.net Type: A
DNS	enemyfind.net Type: A
HTTP GET	http://kaselindertu.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://fredesecas.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://jumpgray.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://stickmarch.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://tablefruit.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://davedekilai.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://laloponea.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://sorryshoe.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://donaven4guia.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://stickpress.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://lifeboat.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://lifepress.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://tillpress.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://tillrest.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://pushpress.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://lifefind.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://kaselindertu.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://fredesecas.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://jumpgray.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://stickmarch.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://tablefruit.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://davedekilai.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://laloponea.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://sorryshoe.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://donaven4guia.com/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://stickpress.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://lifeboat.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://lifepress.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://tillpress.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://tillrest.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
HTTP GET	http://pushpress.net/forum/search.php?method=validate&mode=sox&v=018&sox=2ca8c600 User-Agent:
Flows TCP	192.168.1.1:1031 ➝ 65.254.248.145:80
Flows TCP	192.168.1.1:1032 ➝ 216.239.139.20:80
Flows TCP	192.168.1.1:1034 ➝ 98.139.135.198:80
Flows TCP	192.168.1.1:1035 ➝ 98.139.135.198:80
Flows TCP	192.168.1.1:1036 ➝ 98.139.135.198:80
Flows TCP	192.168.1.1:1037 ➝ 66.147.244.161:80
Flows TCP	192.168.1.1:1039 ➝ 216.239.138.68:80
Flows TCP	192.168.1.1:1040 ➝ 98.139.135.198:80
Flows TCP	192.168.1.1:1044 ➝ 216.239.138.217:80
Flows TCP	192.168.1.1:1045 ➝ 50.63.202.59:80
Flows TCP	192.168.1.1:1046 ➝ 89.105.202.5:80
Flows TCP	192.168.1.1:1047 ➝ 75.126.38.98:80
Flows TCP	192.168.1.1:1048 ➝ 69.61.78.80:80
Flows TCP	192.168.1.1:1049 ➝ 192.64.25.56:80
Flows TCP	192.168.1.1:1051 ➝ 107.20.206.69:80
Flows TCP	192.168.1.1:1052 ➝ 66.151.181.33:80
Flows TCP	192.168.1.1:1053 ➝ 65.254.248.145:80
Flows TCP	192.168.1.1:1054 ➝ 216.239.139.20:80
Flows TCP	192.168.1.1:1055 ➝ 98.139.135.198:80
Flows TCP	192.168.1.1:1056 ➝ 98.139.135.198:80
Flows TCP	192.168.1.1:1057 ➝ 98.139.135.198:80
Flows TCP	192.168.1.1:1058 ➝ 66.147.244.161:80
Flows TCP	192.168.1.1:1059 ➝ 216.239.138.68:80
Flows TCP	192.168.1.1:1060 ➝ 98.139.135.198:80
Flows TCP	192.168.1.1:1061 ➝ 216.239.138.217:80
Flows TCP	192.168.1.1:1062 ➝ 50.63.202.59:80
Flows TCP	192.168.1.1:1063 ➝ 89.105.202.5:80
Flows TCP	192.168.1.1:1064 ➝ 75.126.38.98:80
Flows TCP	192.168.1.1:1065 ➝ 69.61.78.80:80
Flows TCP	192.168.1.1:1066 ➝ 192.64.25.56:80
Flows TCP	192.168.1.1:1067 ➝ 107.20.206.69:80

Raw Pcap

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206b61 73656c69 6e646572 74752e63   : kaselindertu.c
0x00000080 (00128)   6f6d0d0a 0d0a                         om....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206672 65646573 65636173 2e636f6d   : fredesecas.com
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206a75 6d706772 61792e6e 65740d0a   : jumpgray.net..
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b6d 61726368 2e6e6574   : stickmarch.net
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 626c6566 72756974 2e6e6574   : tablefruit.net
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206461 76656465 6b696c61 692e636f   : davedekilai.co
0x00000080 (00128)   6d0d0a0d 0a0a                         m.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c61 6c6f706f 6e65612e 636f6d0d   : laloponea.com.
0x00000080 (00128)   0a0d0a0d 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20736f 72727973 686f652e 6e65740d   : sorryshoe.net.
0x00000080 (00128)   0a0d0a0d 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20646f 6e617665 6e346775 69612e63   : donaven4guia.c
0x00000080 (00128)   6f6d0d0a 0d0a                         om....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b70 72657373 2e6e6574   : stickpress.net
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 6665626f 61742e6e 65740d0a   : lifeboat.net..
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 66657072 6573732e 6e65740d   : lifepress.net.
0x00000080 (00128)   0a0d0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207469 6c6c7072 6573732e 6e65740d   : tillpress.net.
0x00000080 (00128)   0a0d0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207469 6c6c7265 73742e6e 65740d0a   : tillrest.net..
0x00000080 (00128)   0d0a0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207075 73687072 6573732e 6e65740d   : pushpress.net.
0x00000080 (00128)   0a0d0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 66656669 6e642e6e 65740d0a   : lifefind.net..
0x00000080 (00128)   0d0a0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206b61 73656c69 6e646572 74752e63   : kaselindertu.c
0x00000080 (00128)   6f6d0d0a 0d0a                         om....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206672 65646573 65636173 2e636f6d   : fredesecas.com
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206a75 6d706772 61792e6e 65740d0a   : jumpgray.net..
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b6d 61726368 2e6e6574   : stickmarch.net
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 626c6566 72756974 2e6e6574   : tablefruit.net
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206461 76656465 6b696c61 692e636f   : davedekilai.co
0x00000080 (00128)   6d0d0a0d 0a0a                         m.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c61 6c6f706f 6e65612e 636f6d0d   : laloponea.com.
0x00000080 (00128)   0a0d0a0d 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20736f 72727973 686f652e 6e65740d   : sorryshoe.net.
0x00000080 (00128)   0a0d0a0d 0a0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20646f 6e617665 6e346775 69612e63   : donaven4guia.c
0x00000080 (00128)   6f6d0d0a 0d0a                         om....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b70 72657373 2e6e6574   : stickpress.net
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 6665626f 61742e6e 65740d0a   : lifeboat.net..
0x00000080 (00128)   0d0a0d0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206c69 66657072 6573732e 6e65740d   : lifepress.net.
0x00000080 (00128)   0a0d0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207469 6c6c7072 6573732e 6e65740d   : tillpress.net.
0x00000080 (00128)   0a0d0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207469 6c6c7265 73742e6e 65740d0a   : tillrest.net..
0x00000080 (00128)   0d0a0a0a 0d0a                         ......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303138 26736f78 3d326361 38633630   =018&sox=2ca8c60
0x00000040 (00064)   30204854 54502f31 2e300d0a 41636365   0 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207075 73687072 6573732e 6e65740d   : pushpress.net.
0x00000080 (00128)   0a0d0a0a 0d0a                         ......

Strings

     0        lji.SlesK Eneeldt FvnereetaCaeodhttagvnlOnHaieTaclACenlel b2orS  eedCpreS eEte e3trtWr 
                                 H
         (((((                  H
         h((((                  H
jjjh
jjjj
jjjjh
jjjjj
jjjjjj
KERNEL32.DLL
Ljjj
Mjjj
mscoree.dll
Njjj
(null)
                          
																		
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
,0@8dy
0A@@Ju
0B&;@d^
0SSSSS
0WWWWW
0|"Y>5C3
+\!1;f
1/g/X?
1MFHp=
1#QNAN
1#SNAN
-2dOnp
/` }2e[_V
2swnqj5R
2`VJTo6#
 3!BxB
3cT!"L
3D:VXT
3#Ir4P
3?*+rjcT[
40Kh".
45Z3hu
4(6T=6-
_=4'P\
)"4{RxxV
4s/I'v
4TBuun
5dp*YIDo
|}5L.U
5uGmKl?
6|17swF
6(>|c,w
6e%{$b
-6&wG1
7'GQizA
7J7{1Z
7-P\x%
8HbEU6
+8LvF1&
?$8=p 
8Q`gXl6k
8]sF*}S
8VVVVV
9,03fJ+
9#iYv@a
9 Q6P]T
9u\9pT|
9-&X&h
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
A^!cg@
a(DeR%1
?Al"8kI
america
american
american english
american-english
aM*ni;
An application has made an attempt to load the C runtime library incorrectly.
aOX9D?
AR<0 )
a{T|8=Ph
<at9<rt,<wt
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
.?AUctype_base@std@@
August
australian
.?AVbad_alloc@std@@
.?AVbad_cast@std@@
.?AVbad_exception@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$ctype@D@std@@
.?AVexception@std@@
.?AVfacet@locale@std@@
.?AVfailure@ios_base@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AVlength_error@std@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AV?$numpunct@D@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AVout_of_range@std@@
.?AVruntime_error@std@@
.?AVtype_info@@
bad allocation
bad cast
bad exception
 Base Class Array'
 Base Class Descriptor at (
__based(
BeginPaint
belgian
bET^,`
`b)mCATE
britain
bsJ0EE
c	{Aj0c[
CallWindowProcA
canadian
__cdecl
CheckDlgButton
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
 Class Hierarchy Descriptor'
CloseHandle
__clrcall
c:-:m	<(
cmd.exe
CompareStringA
CompareStringW
 Complete Object Locator'
COMSPEC
CONOUT$
`copy constructor closure'
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
CorExitProcess
C PjPV
C$PjQV
C.PjRV
C/PjSV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
CreateFileA
CreateProcessA
- CRT not initialized
c^V~0!S*
cwu"u|
%_cXNv
`D7,~~O!
!d.8Dq(<
@.data
dddd, MMMM dd, yyyy
December
DecodePointer
`default constructor closure'
 delete
 delete[]
Delete
DeleteCriticalSection
DeleteFileA
deque<T> too long
\D*k)@
DmJp"=
DOMAIN error
DQAL"=R
DrawTextA
>drINi
dRs,R>
D[T;k<'_
dutch-belgian
`dynamic atexit destructor for '
`dynamic initializer for '
DZIyeo
*DZ{qvy-
D<Z	y{)
ecN-au
(^+eFo
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
EK@$w4O8
eM81ve
EnableWindow
EncodePointer
EndDialog
EndPaint
england
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
EnterCriticalSection
EnumSystemLocalesA
[eo4$H
eQsW<3
Eq_`/y
	<e(Rn
eS^API
e /'Vb6
ExitProcess
ez.1\hN
__fastcall
February
FF[oq4z
fIBIGa!
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindResourceA
fJtF<uU,
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
ForceRemove
F~:)q{
^f'qVm
fR\C;).
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
french-belgian
french-canadian
french-luxembourg
french-swiss
Friday
^F<-uB
f+}}v$
f^:`Vs
G^{*@A
GAIsProcessorFeaturePresent
G.(a(o
^Gc"GM
GDI32.dll
<)gD*O+
GEi:2t
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
GetACP
GetActiveWindow
GetBkColor
GetClipRgn
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetCursor
GetDCBrushColor
GetDCPenColor
GetDeviceCaps
GetDialogBaseUnits
GetDlgItem
GetDlgItemInt
GetDriveTypeA
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesA
GetFileTime
GetFileType
GetFontLanguageInfo
GetFontUnicodeRanges
GetForegroundWindow
GetFullPathNameA
GetInputState
GetKeyboardType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetMapMode
GetMenu
GetMenuCheckMarkDimensions
GetMenuContextHelpId
GetMenuItemCount
GetMenuItemID
GetMenuState
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetNearestPaletteIndex
GetObjectType
GetOEMCP
GetPixelFormat
GetPolyFillMode
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessWindowStation
GetPropA
GetQueueStatus
GetRandomRgn
GetStartupInfoA
GetStdHandle
GetStretchBltMode
GetStringTypeA
GetStringTypeW
GetSystemTimeAsFileTime
GetTextAlign
GetTextCharacterExtra
GetTextCharset
GetTextCharsetInfo
GetTextColor
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetUserObjectInformationA
GetVersion
GetWindowContextHelpId
GetWindowDC
GetWindowLongA
GlobalAlloc
GlobalFlags
GlobalHandle
GlobalSize
g}?(M.
great britain
_"g"^t
GyP~~e
Gy_(pN
`h````
h)0v=}
H2hp)3Q
"hbM9?z
&HC!l.
{[\He^
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
hG|mA.
`h`hhh
HH:mm:ss
HHtXHHt
HHtYHHt
Hj,tyX
holland
hong-kong
/hSN&!
hUGG2%
I0ZOV\U
if86dR
>If90t
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
invalid map/set<T> iterator
invalid string position
ios_base::badbit set
ios_base::failbit set
iP|$4(
iP~]eH
irish-english
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWindowEnabled
IsWindowUnicode
italian-swiss
'iyTnK
j4h( M
J69?TM21
j7h oM
JanFebMarAprMayJunJulAugSepOctNovDec
January
jBhxXL
/=jBr5
jDg|;Le
jDh`pM
j	h0NM
j	h<3M
j%h CM
 j%h\dM
#j%h\dM
j	hDpM
j	hDqM
j	hdrM
j&hHCM
j	hHmM
j#h|\L
j	h`LM
j.hpuM
j	h<rM
j"hXoM
j	hXOM
jIhpqM
j@j ^V
/jlP#u=
J%M(9Xw:w
j"^SSSSS
j+	V5.
;K3{TS
\K=7E-
_k!{[9*t
kC?:Fo8
KDn$=2
Ke@PKm
KERNEL32
KERNEL32.dll
KGNL.t
k~J]4#
K\-{@x
{kX<d*
l;1sE0
{l;['4
)L8]LC
.L{a.y
L[?';c
LC_ALL
LC_COLLATE
LC_CTYPE
LCMapStringA
LCMapStringW
LC_MONETARY
LC_NUMERIC
LC_TIME
LeaveCriticalSection
lhszt7
lhvYa4xs
L*N{Y!
LoadIconA
LoadLibraryA
LoadResource
LocalAlloc
LocalFlags
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
LockResource
^%loX9
ls7M5n
Lu7F2:e
=LZ{6&
,m!6i"@
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
map/set<T> too long
M]dby1
MessageBoxA
Microsoft Visual C++ Runtime Library
MIVf~v
MM/dd/yy
Monday
MoveFileA
MultiByteToWideChar
mXu~uEw
"M$!y>
mZ??sm
['n|$*@
n`>	D0
 new[]
new-zealand
ng*J:J4J
ngwEua
nk72H^
[NNoKQ
)nNYRi9W
NoRemove
norwegian
norwegian-bokmal
norwegian-nynorsk
Norwegian-Nynorsk
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
nR)Jtc
NSfQgT <7T
(null)
nzAI'd>~N*
nz{r7=3
October
OLEAUT32.dll
`omni callsig'
omvto~
operator
@-p4&'
Pa8wK{
__pascal
P_c*|nd
P\E6/.#M
Pf7LvpL
Pf95HbN
PkZ`q&
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
PLHP(&pL
portuguese-brazilian
PostMessageA
PPPPPPPP
pr china
pr-china
Program: 
<program name unknown>
{!/prZ
__ptr64
puerto-rico
- pure virtual function call
p	;wm>
pY#u<uA$~
Q7^x<t
?qB<)=
|qbP6o<
\Q)$Da1(
qe.T^Rx
`qg+mAa
QIz7']
QOAYkKs
Q}p gPbu
QQSVWd
qS_zNU9
qtYIkl 
QueryPerformanceCounter
'QX[I5
r97fb!
RaiseException
`.rdata
rD-db{
ReadFile
RemovePropA
__restrict
:Rh|cF4>
r'IA	'
rnYDhxdW
^R]>Q$Bd
RtlUnwind
runtime error 
Runtime Error!
Saturday
`scalar deleting destructor'
SendMessageA
September
SetDlgItemTextA
SetEndOfFile
SetEnvironmentVariableA
SetFilePointer
SetFocus
SetHandleCount
SetLastError
SetPixel
SetStdHandle
SetSystemPaletteUse
SetTextAlign
SetTextCharacterExtra
SetTextColor
SetTextJustification
SetUnhandledExceptionFilter
SetWindowTextA
ShowWindow
s'ilsh
SING error
SizeofResource
sJKF@&
sJRvx<
slovak
south africa
south-africa
south korea
south-korea
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
spbDb}
srSK@,
s[S;7|G;w
^SSSSS
__stdcall
`string'
string too long
Sunday
SunMonTueWedThuFriSat
swedish-finland
SystemRoot
t$<+,,
TerminateProcess
?tF'^?
t=FA9]
tGHt.Ht&
(</t$hh
+t HHt
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
Thursday
TIchz}
tIj"[:
t^j'vbZ
< tK<	tG
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
]tMR{:FOh.}a
<\tM</tI
,]tO(e
tR99u2
trinidad & tobago
t"SS9]
<+t(<-t$:
t$<"u	3
Tuesday
;t$,v-
t VV9u
t+WWVPV
 Type Descriptor'
`typeof'
,}U7bE
>:u8FV
`udt returning'
&u}e.B
uHjGh(
#&>uJ:
u|j	h`
uL9=taN
- unable to initialize heap
- unable to open console device
__unaligned
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UNICODE
united-kingdom
united-states
Unknown exception
UpdateColors
']UPMD/
UQPXY]Y[
uqSSSSS
URPQQh
USER32.dll
USER32.DLL
u[SSSP
UTF-16LE
~u_:~V
u,VVWV
`vbase destructor'
`vbtable'
`vcall'
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
`vftable'
VirtualAlloc
`virtual displacement map'
VirtualFree
v	N+D$
V,Ow.l
vUk=;O
V,vEGe
Vv(orP
_VVVVV
VVVVVQRSSj
V^XV$wwM
|$W1Qx
WaitForSingleObject
wc7FB`
Wednesday
[,W.^H
WideCharToMultiByte
WindowFromDC
	wlRV2
WNODf2u
&w)%)o
wr?1i2~vY\
WriteConsoleA
WriteConsoleW
WriteFile
WS2_32.dll
^WWWWW
x3Q()[
xBN58_
XHB4,$
xppwpp
xpxxxx
X\rbYO
<xtX<XtT
xVZRRMV
y3&pCfS
(Yd];)
*yH9Rb
Yhj3yY]`
Y@ios_base::eofbit set
ymDORb
ynGuytA
>=Yt1j
Y<\u#j\V
YZKU[S
z29qF|8RI.
z35YdcCz(
(Z	B19
Z>cY8&#a
ZdRU-2
zEBIvo7
ze*/kX
zIA>m0
zUj3L	
&z}#V+
Z/xGd-