Analysis Date2014-11-02 20:42:18
MD5b92162485386746469c245497275ca2d
SHA1de6a915c0bac120bf7c280a32965be8a4ea99b7d

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 2dc0d0745452746c63e5076cfcc80d50 sha1: 2a4b1b3a077fc034058b318c34ed77fcf0fb54d4 size: 225792
Section.rdata md5: 05815b03ac57e68a8f265cac010106cb sha1: 70748dc2a16dd6c2f01aed1311351b94d4a7fa21 size: 51200
Section.data md5: ad43a4d0f4da20a8f07dd891ef4270e8 sha1: 1d0e5b0bd5d1479660b4e69e0a8ea5bec6e92fc1 size: 8192
Section.rsrc md5: 89508a79019de3cac2d36029e2c6114c sha1: 24c35c2b88c169588c429f7ba54f594bd873332a size: 34816
Section.reloc md5: 5ef3ceb2364c1f040e37cb501282019d sha1: 381853288b692d3fb1a92582e74f508da2bf7c97 size: 17920
Timestamp2014-03-19 18:56:22
VersionLegalCopyright: 2014
InternalName: dnloader
FileVersion: 3, 3, 7, 0
CompanyName: C
LegalTrademarks: -
Comments: ND
ProductName: premium
ProductVersion: 3, 3, 7, 0
FileDescription: DWD
PackerMicrosoft Visual C++ ?.?
PEhash3ec7b428ff10a71c2575aac10cc50cbd51f218ff
IMPhash724314d1004d791e901ec997b857113c
AV360 Safeno_virus
AVAd-AwareGen:Variant.Application.Bundler.4
AVAlwil (avast)no_virus
AVArcabit (arcavir)no_virus
AVAuthentiumW32/A-083dbbf9!Eldorado
AVAvira (antivir)no_virus
AVBullGuardGen:Variant.Application.Bundler.4
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)no_virus
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftGen:Variant.Application.Bundler.4
AVEset (nod32)no_virus
AVFortinetno_virus
AVFrisk (f-prot)no_virus
AVF-Secureno_virus
AVGrisoft (avg)no_virus
AVIkarusPUA.4Shared
AVK7Unwanted-Program ( 004a9c681 )
AVKasperskyno_virus
AVMalwareBytesPUP.Optional.4shared
AVMcafeeno_virus
AVMicrosoft Security Essentialsno_virus
AVMicroWorld (escan)Gen:Variant.Application.Bundler.4
AVNormanGen:Variant.Application.Bundler.4
AVRisingno_virus
AVSophosno_virus
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)Trojan.Badur

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\4shared\DownloadHelper\AlreadyRun ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT2.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT1.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT3.tmp
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT4.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT5.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT8.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT7.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT6.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\UNT9.tmp
Creates File\Device\Afd\Endpoint
Winsock DNSdownloadget.net
Winsock DNSwww.adshost2.com
Winsock DNStrack.getportal.net

Network Details:

DNSdownloadget.net
Type: A
162.159.245.192
DNSdownloadget.net
Type: A
162.159.244.192
DNSdownloadget.net
Type: A
162.159.244.192
DNSdownloadget.net
Type: A
162.159.245.192
DNSdownloadget.net
Type: A
162.159.245.192
DNSdownloadget.net
Type: A
162.159.244.192
DNSwww.adshost2.com
Type: A
212.124.126.16
DNSwww.adshost2.com
Type: A
212.124.126.7
DNSwww.adshost2.com
Type: A
212.124.126.10
DNStrack.getportal.net
Type: A
178.162.201.18
HTTP GEThttp://downloadget.net/smart-download/67010300066/bundle.exe/bundle.exe?bundleorigin=4300110
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://downloadget.net/smart-download/67230100/bundle.exe/bundle.exe?bundleorigin=4300110
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://www.adshost2.com/at?subId=MjMwODN8NTM1Mjd8VEh8M3wxfHw%7C91b2c621b056215c1c5339e97e804178
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://downloadget.net/smart-download/67020300066/bundle.exe/bundle.exe?bundleorigin=4300110
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=L4300110
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDB7230100O4300110
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDB7020300066O4300110
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDB7010300066O4300110
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDE7020300066O4300110ER404
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDE7230100O4300110ER404
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=BDE7010300066O4300110ER404
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://www.adshost2.com/at?subId=MjMwODN8NTM1Mjd8VEh8M3wxfHw%7C2559fe70e84778aec687cb683b2cbd0c
User-Agent: UniversalUserAgent(winHTTP)
HTTP GEThttp://track.getportal.net/trackcnt/Kvg48RpSKKFNkW8e/?data=M4300110
User-Agent: UniversalUserAgent(winHTTP)
Flows TCP192.168.1.1:1034 ➝ 162.159.245.192:80
Flows TCP192.168.1.1:1036 ➝ 212.124.126.16:80
Flows TCP192.168.1.1:1033 ➝ 162.159.245.192:80
Flows TCP192.168.1.1:1035 ➝ 162.159.244.192:80
Flows TCP192.168.1.1:1037 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1038 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1039 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1040 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1041 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1042 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1043 ➝ 178.162.201.18:80
Flows TCP192.168.1.1:1044 ➝ 212.124.126.16:80
Flows TCP192.168.1.1:1045 ➝ 178.162.201.18:80

Raw Pcap
0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373032 30333030 3036362f   oad/67020300066/
0x00000020 (00032)   62756e64 6c652e65 78652f62 756e646c   bundle.exe/bundl
0x00000030 (00048)   652e6578 653f6275 6e646c65 6f726967   e.exe?bundleorig
0x00000040 (00064)   696e3d34 33303031 31302048 5454502f   in=4300110 HTTP/
0x00000050 (00080)   312e310d 0a436f6f 6b69653a 200d0a55   1.1..Cookie: ..U
0x00000060 (00096)   7365722d 4167656e 743a2055 6e697665   ser-Agent: Unive
0x00000070 (00112)   7273616c 55736572 4167656e 74287769   rsalUserAgent(wi
0x00000080 (00128)   6e485454 50290d0a 486f7374 3a20646f   nHTTP)..Host: do
0x00000090 (00144)   776e6c6f 61646765 742e6e65 740d0a43   wnloadget.net..C
0x000000a0 (00160)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f61743f 73756249 643d4d6a   GET /at?subId=Mj
0x00000010 (00016)   4d774f44 4e384e54 4d314d6a 64385645   MwODN8NTM1Mjd8VE
0x00000020 (00032)   68384d33 77786648 77253743 39316232   h8M3wxfHw%7C91b2
0x00000030 (00048)   63363231 62303536 32313563 31633533   c621b056215c1c53
0x00000040 (00064)   33396539 37653830 34313738 20485454   39e97e804178 HTT
0x00000050 (00080)   502f312e 310d0a43 6f6f6b69 653a200d   P/1.1..Cookie: .
0x00000060 (00096)   0a557365 722d4167 656e743a 20556e69   .User-Agent: Uni
0x00000070 (00112)   76657273 616c5573 65724167 656e7428   versalUserAgent(
0x00000080 (00128)   77696e48 54545029 0d0a486f 73743a20   winHTTP)..Host: 
0x00000090 (00144)   7777772e 61647368 6f737432 2e636f6d   www.adshost2.com
0x000000a0 (00160)   0d0a436f 6e6e6563 74696f6e 3a204b65   ..Connection: Ke
0x000000b0 (00176)   65702d41 6c697665 0d0a0d0a            ep-Alive....

0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373233 30313030 2f62756e   oad/67230100/bun
0x00000020 (00032)   646c652e 6578652f 62756e64 6c652e65   dle.exe/bundle.e
0x00000030 (00048)   78653f62 756e646c 656f7269 67696e3d   xe?bundleorigin=
0x00000040 (00064)   34333030 31313020 48545450 2f312e31   4300110 HTTP/1.1
0x00000050 (00080)   0d0a436f 6f6b6965 3a200d0a 55736572   ..Cookie: ..User
0x00000060 (00096)   2d416765 6e743a20 556e6976 65727361   -Agent: Universa
0x00000070 (00112)   6c557365 72416765 6e742877 696e4854   lUserAgent(winHT
0x00000080 (00128)   5450290d 0a486f73 743a2064 6f776e6c   TP)..Host: downl
0x00000090 (00144)   6f616467 65742e6e 65740d0a 436f6e6e   oadget.net..Conn
0x000000a0 (00160)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x000000b0 (00176)   76650d0a 0d0a                         ve....

0x00000000 (00000)   47455420 2f736d61 72742d64 6f776e6c   GET /smart-downl
0x00000010 (00016)   6f61642f 36373031 30333030 3036362f   oad/67010300066/
0x00000020 (00032)   62756e64 6c652e65 78652f62 756e646c   bundle.exe/bundl
0x00000030 (00048)   652e6578 653f6275 6e646c65 6f726967   e.exe?bundleorig
0x00000040 (00064)   696e3d34 33303031 31302048 5454502f   in=4300110 HTTP/
0x00000050 (00080)   312e310d 0a436f6f 6b69653a 200d0a55   1.1..Cookie: ..U
0x00000060 (00096)   7365722d 4167656e 743a2055 6e697665   ser-Agent: Unive
0x00000070 (00112)   7273616c 55736572 4167656e 74287769   rsalUserAgent(wi
0x00000080 (00128)   6e485454 50290d0a 486f7374 3a20646f   nHTTP)..Host: do
0x00000090 (00144)   776e6c6f 61646765 742e6e65 740d0a43   wnloadget.net..C
0x000000a0 (00160)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d4c3433 30303131 30204854   data=L4300110 HT
0x00000030 (00048)   54502f31 2e310d0a 436f6f6b 69653a20   TP/1.1..Cookie: 
0x00000040 (00064)   0d0a5573 65722d41 67656e74 3a20556e   ..User-Agent: Un
0x00000050 (00080)   69766572 73616c55 73657241 67656e74   iversalUserAgent
0x00000060 (00096)   2877696e 48545450 290d0a48 6f73743a   (winHTTP)..Host:
0x00000070 (00112)   20747261 636b2e67 6574706f 7274616c    track.getportal
0x00000080 (00128)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000090 (00144)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000a0 (00160)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424442 37323330 3130304f   data=BDB7230100O
0x00000030 (00048)   34333030 31313020 48545450 2f312e31   4300110 HTTP/1.1
0x00000040 (00064)   0d0a436f 6f6b6965 3a200d0a 55736572   ..Cookie: ..User
0x00000050 (00080)   2d416765 6e743a20 556e6976 65727361   -Agent: Universa
0x00000060 (00096)   6c557365 72416765 6e742877 696e4854   lUserAgent(winHT
0x00000070 (00112)   5450290d 0a486f73 743a2074 7261636b   TP)..Host: track
0x00000080 (00128)   2e676574 706f7274 616c2e6e 65740d0a   .getportal.net..
0x00000090 (00144)   436f6e6e 65637469 6f6e3a20 4b656570   Connection: Keep
0x000000a0 (00160)   2d416c69 76650d0a 0d0a204b 6565702d   -Alive.... Keep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424442 37303230 33303030   data=BDB70203000
0x00000030 (00048)   36364f34 33303031 31302048 5454502f   66O4300110 HTTP/
0x00000040 (00064)   312e310d 0a436f6f 6b69653a 200d0a55   1.1..Cookie: ..U
0x00000050 (00080)   7365722d 4167656e 743a2055 6e697665   ser-Agent: Unive
0x00000060 (00096)   7273616c 55736572 4167656e 74287769   rsalUserAgent(wi
0x00000070 (00112)   6e485454 50290d0a 486f7374 3a207472   nHTTP)..Host: tr
0x00000080 (00128)   61636b2e 67657470 6f727461 6c2e6e65   ack.getportal.ne
0x00000090 (00144)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x000000a0 (00160)   6565702d 416c6976 650d0a0d 0a65702d   eep-Alive....ep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424442 37303130 33303030   data=BDB70103000
0x00000030 (00048)   36364f34 33303031 31302048 5454502f   66O4300110 HTTP/
0x00000040 (00064)   312e310d 0a436f6f 6b69653a 200d0a55   1.1..Cookie: ..U
0x00000050 (00080)   7365722d 4167656e 743a2055 6e697665   ser-Agent: Unive
0x00000060 (00096)   7273616c 55736572 4167656e 74287769   rsalUserAgent(wi
0x00000070 (00112)   6e485454 50290d0a 486f7374 3a207472   nHTTP)..Host: tr
0x00000080 (00128)   61636b2e 67657470 6f727461 6c2e6e65   ack.getportal.ne
0x00000090 (00144)   740d0a43 6f6e6e65 6374696f 6e3a204b   t..Connection: K
0x000000a0 (00160)   6565702d 416c6976 650d0a0d 0a65702d   eep-Alive....ep-
0x000000b0 (00176)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424445 37303230 33303030   data=BDE70203000
0x00000030 (00048)   36364f34 33303031 31304552 34303420   66O4300110ER404 
0x00000040 (00064)   48545450 2f312e31 0d0a436f 6f6b6965   HTTP/1.1..Cookie
0x00000050 (00080)   3a200d0a 55736572 2d416765 6e743a20   : ..User-Agent: 
0x00000060 (00096)   556e6976 65727361 6c557365 72416765   UniversalUserAge
0x00000070 (00112)   6e742877 696e4854 5450290d 0a486f73   nt(winHTTP)..Hos
0x00000080 (00128)   743a2074 7261636b 2e676574 706f7274   t: track.getport
0x00000090 (00144)   616c2e6e 65740d0a 436f6e6e 65637469   al.net..Connecti
0x000000a0 (00160)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000b0 (00176)   0d0a6976 650d0a0d 0a                  ..ive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424445 37323330 3130304f   data=BDE7230100O
0x00000030 (00048)   34333030 31313045 52343034 20485454   4300110ER404 HTT
0x00000040 (00064)   502f312e 310d0a43 6f6f6b69 653a200d   P/1.1..Cookie: .
0x00000050 (00080)   0a557365 722d4167 656e743a 20556e69   .User-Agent: Uni
0x00000060 (00096)   76657273 616c5573 65724167 656e7428   versalUserAgent(
0x00000070 (00112)   77696e48 54545029 0d0a486f 73743a20   winHTTP)..Host: 
0x00000080 (00128)   74726163 6b2e6765 74706f72 74616c2e   track.getportal.
0x00000090 (00144)   6e65740d 0a436f6e 6e656374 696f6e3a   net..Connection:
0x000000a0 (00160)   204b6565 702d416c 6976650d 0a0d0a0a    Keep-Alive.....
0x000000b0 (00176)   0d0a6976 650d0a0d 0a                  ..ive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d424445 37303130 33303030   data=BDE70103000
0x00000030 (00048)   36364f34 33303031 31304552 34303420   66O4300110ER404 
0x00000040 (00064)   48545450 2f312e31 0d0a436f 6f6b6965   HTTP/1.1..Cookie
0x00000050 (00080)   3a200d0a 55736572 2d416765 6e743a20   : ..User-Agent: 
0x00000060 (00096)   556e6976 65727361 6c557365 72416765   UniversalUserAge
0x00000070 (00112)   6e742877 696e4854 5450290d 0a486f73   nt(winHTTP)..Hos
0x00000080 (00128)   743a2074 7261636b 2e676574 706f7274   t: track.getport
0x00000090 (00144)   616c2e6e 65740d0a 436f6e6e 65637469   al.net..Connecti
0x000000a0 (00160)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x000000b0 (00176)   0d0a6976 650d0a0d 0a                  ..ive....

0x00000000 (00000)   47455420 2f61743f 73756249 643d4d6a   GET /at?subId=Mj
0x00000010 (00016)   4d774f44 4e384e54 4d314d6a 64385645   MwODN8NTM1Mjd8VE
0x00000020 (00032)   68384d33 77786648 77253743 32353539   h8M3wxfHw%7C2559
0x00000030 (00048)   66653730 65383437 37386165 63363837   fe70e84778aec687
0x00000040 (00064)   63623638 33623263 62643063 20485454   cb683b2cbd0c HTT
0x00000050 (00080)   502f312e 310d0a43 6f6f6b69 653a200d   P/1.1..Cookie: .
0x00000060 (00096)   0a557365 722d4167 656e743a 20556e69   .User-Agent: Uni
0x00000070 (00112)   76657273 616c5573 65724167 656e7428   versalUserAgent(
0x00000080 (00128)   77696e48 54545029 0d0a486f 73743a20   winHTTP)..Host: 
0x00000090 (00144)   7777772e 61647368 6f737432 2e636f6d   www.adshost2.com
0x000000a0 (00160)   0d0a436f 6e6e6563 74696f6e 3a204b65   ..Connection: Ke
0x000000b0 (00176)   65702d41 6c697665 0d0a0d0a            ep-Alive....

0x00000000 (00000)   47455420 2f747261 636b636e 742f4b76   GET /trackcnt/Kv
0x00000010 (00016)   67343852 70534b4b 464e6b57 38652f3f   g48RpSKKFNkW8e/?
0x00000020 (00032)   64617461 3d4d3433 30303131 30204854   data=M4300110 HT
0x00000030 (00048)   54502f31 2e310d0a 436f6f6b 69653a20   TP/1.1..Cookie: 
0x00000040 (00064)   0d0a5573 65722d41 67656e74 3a20556e   ..User-Agent: Un
0x00000050 (00080)   69766572 73616c55 73657241 67656e74   iversalUserAgent
0x00000060 (00096)   2877696e 48545450 290d0a48 6f73743a   (winHTTP)..Host:
0x00000070 (00112)   20747261 636b2e67 6574706f 7274616c    track.getportal
0x00000080 (00128)   2e6e6574 0d0a436f 6e6e6563 74696f6e   .net..Connection
0x00000090 (00144)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000a0 (00160)   0d0a436f 6e6e6563 74696f6e 3a204b65   ..Connection: Ke
0x000000b0 (00176)   65702d41 6c697665 0d0a0d0a            ep-Alive....


Strings
 
.
.
..
..
.
..
..
..
 
 
CC
.00-+ 
0
\
--E-
-0
-0010+-0
0
-000...........?- 
0
0
0
0
Du
.
TW

000004b0
%%%02X
2014
3, 3, 7, 0
{374DE290-123F-4565-9164-39C4925E467B}
400 Bad Request
401 Unauthorized
403 Forbidden
404 Not Found
408 Request Timeout
500 Internal Server Error
502 Bad Gateway
503 Service Unavailable
504 Gateway Timeout
64shared.com Download Helpe
a([a-zA-Z0-9])
ABORT_CONFIRMATION
Accept: */*
AHash
AI don't have an account,
@_All_Ctrls_Orig_Proc_
AlreadyRun
AMQUTIL.DLL
 and 
@APPLICATION_NAME
Are you sure you want to abort download?
b([ \t])
_Btn_Is_Checked_
button
By clicking "
By clicking "Download" you agree to
By creating account you accept our
Cancel
Cannot download file from:
Cannot download from
Cannot download the requested files.
c([a-zA-Z])
Change
charset={[A-Za-z0-9\-_]+}
Choose if you'd like to install Baidu PC Faster.
_Class_Pointer_Property_
Comments
CompanyName
Confirm
Content-Length: 
Content-Length: {[0-9]+}
Content-Type: application/x-www-form-urlencoded
_Control_Color_
Cookie: 
Create New Free Account
d([0-9])
Dialog
d like to keep your PC fast and smooth throughout its life, then you can
dnloader
Download
Downloading...
edit
E-mail
E-mail cannot be empty, please enter correct e-mail.
#empty
End User License Agreement
English
equal
eula
.exe
file
FileDescription
FileVersion
First Name
%FIRSTNAME%
folder
                                 H
         (((((                  H
h([0-9a-fA-F])
         h((((                  H
{<html[^\>]*>.*<body[^\>]*>.*<\/body>.*<\/html>.*}
http://download-faster.net/error.jsp?msg=downloadhelperxmlnotfound
https://www.4shared.com/terms.jsp
%i%%
I already have an account...
IDC_BUTTON_BROWSE
IDC_BUTTON_CANCEL
IDC_BUTTON_CHANGE_DST
IDC_BUTTON_CREATE_ACCOUNT
IDC_BUTTON_DOWNLOAD
IDC_BUTTON_LOGIN
IDC_BUTTON_OPEN
IDC_CB_AGREE
IDC_CB_BAIDU
IDC_CB_CHROMEEMPTYTABSet improved Google Chrome Empty Tab
IDC_CB_HOMEPAGE
IDC_LINK_DONT_HAVE_ACCOUNT
IDC_LINK_EULA
IDC_LINK_HAVE_ACCOUNT
IDC_LINK_PP
IDC_LINK_TERM_OF_USE
IDC_MAIN_BUTTON_DOWNLOAD
IDC_MAIN_TEXT_DOWNLOAD_DST
IDC_MAIN_TEXT_INTRO
IDC_MAIN_TEXT_REQUESTED_FILE
IDC_MAIN_TEXT_REQUESTED_FILE_PRE
IDC_PROGRESS_TEXT_FILENAME
IDC_TEXT_AND
IDC_TEXT_AUTH_INSTRUCTION
IDC_TEXT_DESCRIPTION_BAIDU
IDC_TEXT_DOWNLOAD_DST_PRE
IDC_TEXT_FILENAME
IDC_TEXT_FIRSTNAME
IDC_TEXT_HOMEPAGE_INSTRUCTION
IDC_TEXT_INTRO
IDC_TEXT_LOGIN
IDC_TEXT_PASSWORD
IDC_TEXT_PASSWORD_CONFIRM
IDC_TEXT_REQUESTED_FILE_PRE
IDC_TEXT_SECONDNAME
IDC_TEXT_STATUS
IDC_TEXT_STATUS_PROGRESS
If you
Ignore and continue
InternalName
%i%% - %s
I want to create new free account...
jjjjj
KERNEL32.DLL
_Label_Original_Proc_
Last Name
%LASTNAME%
_Lbl_Background_Color_
lBUNDLES_ACTIVATION_XEROX_SLIDER
LegalCopyright
LegalTrademarks
License Agreement
ll perform a complete maintenance routine, including boot time optimization, disk cleanup and much more!
Location: {[A-Za-z0-9\-_%+*:;/.=?&]+}
Location of the downloaded file:
Login
%LOGIN%
Login and Download
MESSAGE_LOGIN_EMPTY
MESSAGE_NAMES_EMPTY
MESSAGE_PASSWORD_EMPTY
MESSAGE_PASSWORD_LONG
MESSAGE_PASSWORD_MISMATCH
mscoree.dll
msctls_progress32
MS Shell Dlg
Name cannot be empty, please enter your name.
ndefault
NETMSG.DLL
(null)
open
openas
Open file
Password
%PASSWORD%
Password and confirmation do not match, please enter identical passwords.
Password cannot be empty, please enter correct password.
Password ls too long, please enter shorter password.
policy
POST
premium
Privacy Policy
ProductName
ProductVersion
q("[^"]*")|('[^']*')
Quit
Range: bytes=%i-
renameto_
\r\n
runas
Save the downloaded file to:
Select target dir..
Server answered: 
Set-Cookie:\b*{.+?}\n
Set my homepage to search.b1.org in Internet Explorer, Firefox and Google Chrome
shell32.dll
Show
Show in Explorer
Skip
SkipAll
Software\4shared\DownloadHelper
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
static
StringFileInfo
substring
t be without Baidu PC Faster. One click and you
Terms of Use
Time on your computer is incorrect, therefore cannot establish connection to the server. Please set correct time and try again.
Translation
Unexpected network error
Unexpected network error, cannot download %s
UniversalUserAgent(winHTTP)
Unknown error. Error code: 0x%x
%URL%
URL: 
%USERPROFILE%
utf-8
VarFileInfo
VS_VERSION_INFO
w([a-zA-Z]+)
Welcome to %s Download Helper,
which will guide you through the download process.
WININET.DLL
" you agree to 
You have requested file:
You need 4Shared account to download this file:
@z([0-9]+)
>">(>}>
                          
+);;<+
+;;;<+,0
0,);;<+
0+<;;+
0+);;)+0
0$0,040<0D0L0T0\0d0p0
0$0,040<0H0h0p0x0
0$0(080<0@0H0`0p0t0
0'0,090G0M0Z0z0
0"0.0W0d0w0?1e2q3
0'010=0I0S0_0l0y0
0'010A0F0M0
0$04080H0L0\0`0d0h0p0
0#070U0r0{0
0.080E0\0x0
0!0P0_0
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0/1H1O1W1\1`1d1
; ;$;(;0;4;
; ;$;(;,;0;4;8;<;@;D;H;L;P;
< <$<(<,<0<4<8<<<@<D<H<L<P<T<X<\<`<d<h<l<p<t<x<|<
= =$=(=,=0=4=8=<=@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=|=
: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:
; ;$;(;,;0;4;8;<;@;L;X;d;p;
? ?&?*?0?4?:?>?D?H?M?S?W?]?a?g?k?q?u?
051]1|1
060_0m0
061116015437Z
07969287
079692870
080<0@0
? ?(?0?8?D?d?p?
?0?8?@?H?P?\?|?
? ?(?0?8?@?H?P?X?
= =(=0=8=@=H=P=X=`=h=p=x=
> >(>0>8>@>H>P>X>`>h>p>x>
>$>0>8>P>\>|>
>(>,>0>8>P>`>d>t>x>|>
0A@@Ju
;$;0;C;J;U;[;f;k;w;
0d3h3l3p3t3
:,:0:@:D:H:P:h:x:|:
=0=@=D=T=X=\=`=h=
0F2K2Z2
>0><>\>h>
: :$:(:0:H:X:\:l:p:
;"<0<I<X<f<
0P0d0p0x0
?$?0?P?`?h?t?
<$<0<P<X<`<l<
?0R0\0i0
0s9x9E=
0SSSSS
<0T0Z0
0U1d1n1
0u6b9m9
0WWWWW
1,10141<1T1d1h1x1|1
1 1(10181@1L1l1t1
1 1(141T1\1d1l1x1
1,131>1L1Z1r1}1
1$141>1b1h1x1}1
1#14181?1C1I1S1]1g1r1v1{1
1$14181<1D1\1|4
1(141T1\1d1p1
1$1D1`1|1
1*1S1y1
1(2<2H2P2h2p2x2
1>2D2H2L2P2
1"2M2z2
1:2X2j2|2
131230073353Z
141?1t2
141@1x1
142B2`2
161230073353Z0c1
?"?1?6?>?F?T?Z?b?p?
:1;b;i;
1d2h2l2p2t2x2|2
:1:E:j:
1joE|b=z
<"<'<1<><M<h<s<
1#QNAN
; ;&;1;=;R;Y;m;t;
1#SNAN
1X204V5w5
202@2E2L2
2 2)212E2S2^2t2z2
2#2'2+2/23272D2
2!2'2(3
2 2@2L2l2t2|2
2 2@2L2l2x2
2%2>2R2X2a2t2
2$24282<2D2\2l2p2x2
2~243:3U3T4]4o4V5
2.2A3W3
2"333@3`3
2	3&373A3^3
2(3<3l3v3
2-3M3[3`3
261116015437Z0
2`6d6h6l6p6t6x6|6
282S2v2
283B3x3
303J3U3f3r3
325U5`5
3 3(303<3d3|3
3(3,343L3\3`3p3t3x3
3,3L3p3
3;3m3t3x3|3
34383<3@3D3H3L3P3T3X3\3`3d3h3l3p3x5|5
3	4"424=495K5\5
3>4C4K4
3 4H4h4
3@4S4d4t4
373F3r3
<3<C<Y<`<h<|<
?3?g?m?y?
3H3\3h3p3
3H4O4U4\4
:%<3<;<H<f<p<y<
3P3d3p3x3
? ?(?4?|?
404@4D4T4X4`4x4
435N5i5
4&404?4L4R4\4k4
4,444@4`4l4
4%4/474B4r4
4!494?4N4T4c4i4w4
4'494W4
4"4D4f4
4)4D4j4
4 4P4d4p4x4
4(4P4h4|4
4+525E5c5
4	5#5,5^5n5
4	5&5e5l5r5
4 585H5X5l5
4;5A6d6
4"5J5Q5X5a5w5
4]6n6v6|6
4/7W7i7
~4;~8v
="=(=.=4=:=A=H=O=V=]=d=k=s={=
<%<4<:<C<O<]<c<o<u<
:$:4:c:q:
?4?D?H?X?\?d?|?
>$>,>4><>D>L>T>\>d>l>
;$;,;4;<;D;L;T;\;d;l;t;|;
>$>,>4><>D>L>T>\>d>l>x>
; ;4;<;@;D;L;T;\;p;x;|;
<$<,<4<<<D<L<X<x<
4F4P4]4l4z4
;$;,;4;<;H;h;p;x;
:$:,:4:<:H:h:t:
<$<,<4<@<`<h<p<|<
=(=,=4=L=P=h=l=
<$<(<,<4<L<\<`<p<t<x<
: :,:4:L:T:\:h:
>-?4?O?T?\?b?i?o?v?|?
;(;4;T;`;
< <$<,<4<T<h<t<|<
= =(=4=T=t=
506?6Q6X6h6
515<5F8
5 5054585<5@5H5`5p5t5
5 505D5X5d5l5
5 5,525o5
 5$5(5,5054585<5@5D5H5L5P5T5X5\5`5d5h5l5p5t5x5|5
5 5$5(5,5
5*5;5D5X5d5t5
5$5\5p5|5
5(666T7
566Y6y6
5-6E6N6_6g6l6q6
5<6F6_6g6
5{6q7y7,8
5F5[5e5
=+=5=<=h=n=
5http://certificates.godaddy.com/repository/gdroot.crl0K
<,=5=P=\=
5P6Z6j6x6
>.>5>T>
606@6D6T6X6h6l6|6
606H6X6h6|6
64696\6
646P6h6
6$606P6X6\6t6x6
6$6,646<6D6L6T6\6d6l6t6|6
6 6&6,62676
6 6$6(6|6
6 6$6(6,6064686<6@6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6
6+666<6B6G6P6m6s6~6
6(6H6P6\6|6
6*6I6`6e6
6)6J6P6
6%71777
6!7+7S7l7
>%?6?A?b?
6C7b7m7}7
:!:&:6:@:G:R:[:q:|:
6M7W7_7v7
6p7t7x7|7
707\7|7
71-252
717=7J7Q7
7>;2=Q=.?
74787@7H7P7T7\7p7
757X7{7
7+757E7l7z7
7$7,747<7H7h7p7x7
7$7*7;7
7#7'7+7/73777;7?7C7O7Y7q7x7
7,7<7@7P7T7X7\7d7|7
7 7*7C7M7`7
7)7:7E7j7
7 7@7L7l7t7|7
7,787@7X7x7
7:7h7r7
788X8H9q9
7 898[8x8
7A8G8i8
=&>7>E>
7<;H;{;
7XJ-#s]
;7;Y<f<
=!=8=[=
80F0T0f0
848Z8l8w8
858D8I8j8o8
8,808@8D8H8P8h8x8|8
8(848l8
8$8@8`8
8 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|8
8$8,888X8d8
8%8-8>8d8
8$8<8L8P8T8X8`8x8
888L8X8`8x8
8#8/8O8X8v8
8%8T8y8
8 9%9-9@9
8	9)9>9W9
8@9^9o9
8B9H9b9q9~9
8B9U9h9
? ?$?(?8?@?D?H?L?P?T?X?\?`?d?p?
=#=8=E=U=g=m=~=
8_<f<n<x<
=8=@=L=l=t=|=
8^,t&j
8^Tu79^4t29^Xt-V
:);8;W;
\9%:\\
909<9D9t9
909Y9r:
9	:$:,:4:K:d:
96:P;j<
9 9094989<9D9\9`9x9|9
9$949N9
9 989X9l9x9
9$9,989p9
9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9x9|9
9 9$9(9,949L9\9`9p9t9x9|9
9(9D9H9d9h9
9$9H9Q9X9a9
9,9L9l9
9%9q9|9
9C3J3W
<!='=/=9=G=V=h=o=v=
9I9d9j9s9z9
<9<@<I<o<|<
9J9Y9f9
:%:9:J:j:~:
9K:d:s:
9O:U:e:
9\$Xta
9x tX3
9|Y[?J
AAFFf;
@@AAJu
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Adobe ImageReadyq
ADVAPI32.dll
AHXLXN
> >A>k>
AlphaBlend
america
american
american english
american-english
An application has made an attempt to load the C runtime library incorrectly.
AppendMenuW
Arizona1
:a;s;};
      <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
.?AUctype_base@std@@
August
.?AUITextWidther@@
`Au>P].
australian
autolaunch
.?AVbad_alloc@std@@
.?AVbad_cast@std@@
.?AVbad_exception@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AVBundlesSliderWindow@@
.?AVCAtlException@ATL@@
.?AV?$ctype@D@std@@
.?AVCustomWindow@@
.?AVDiskFile@@
.?AVexception@std@@
.?AVfacet@locale@std@@
.?AVfailure@ios_base@std@@
.?AVFileBase@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AVLabelTextSetter@@
.?AVlength_error@std@@
.?AVLoaderCallback@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AVLoginWindow@@
.?AVMainDownloaderWindowSlider@@
.?AVMainWindow@@
.?AVMemoryFile@@
.?AV?$MemPoolT@$0CE@@tinyxml2@@
.?AV?$MemPoolT@$0CM@@tinyxml2@@
.?AV?$MemPoolT@$0DA@@tinyxml2@@
.?AV?$MemPoolT@$0DE@@tinyxml2@@
.?AVMemPool@tinyxml2@@
.?AVNullFile@@
.?AVout_of_range@std@@
.?AVProgressDownloaderWindow@@
.?AVruntime_error@std@@
.?AVScreenBase@@
.?AVScreenLogin@@
.?AVScreenRegistererBase@@
.?AV?$ScreenRegisterer@VScreenLogin@@@@
.?AV?$ScreenRegisterer@VScreenSignUp@@@@
.?AVScreenSignUp@@
.?AV?$Screen@VScreenLogin@@@@
.?AV?$Screen@VScreenSignUp@@@@
.?AVServerResponsesHandler@@
.?AVtype_info@@
.?AVWinHttpSmartLoader@@
.?AVXMLAttribute@tinyxml2@@
.?AVXmlBackImage@@
.?AVXmlBinary@@
.?AV?$XmlBundledContent@VXmlComplexDescriptionBundle@@@@
.?AVXmlBundleEulaText@@
.?AVXmlBundleLine@@
.?AVXmlBundleNumber@@
.?AVXmlBundleText@@
.?AVXMLComment@tinyxml2@@
.?AVXmlComplexBundlesLoadManager@@
.?AVXmlComplexDescriptionBundle@@
.?AVXmlContentBase@@
.?AVXmlContentData@@
.?AVXMLDeclaration@tinyxml2@@
.?AVXMLDocument@tinyxml2@@
.?AVXMLElement@tinyxml2@@
.?AVXmlExBundle@@
.?AVXmlFileFolderCheck@@
.?AVXmlFileFolderCheckers_OR@@
.?AVXmlIconedBundle@@
.?AVXmlLaunchValidation@@
.?AVXmlLink@@
.?AVXmlLoaderBase@xml@@
.?AVXmlLoadManager@@
.?AVXMLNode@tinyxml2@@
.?AVXmlRawBundle@@
.?AVXmlRegCheck@@
.?AVXmlRegCheckers_OR@@
.?AVXMLText@tinyxml2@@
.?AVXmlUniversalStyleContent@@
.?AVXMLUnknown@tinyxml2@@
.?AVXmlValidationResponse@@
backimages
bad allocation
bad cast
bad exception
 Base Class Array'
 Base Class Descriptor at (
__based(
BeginPaint
belgian
<b<g<q<
binary
>B>I>Q>[>i>
BitBlt
bottom
BringWindowToTop
britain
bsbLs#&s?
bundle0buttonLabel
bundle0fileName
bundle0header1
bundle0header2
bundle0header3
bundle0requestLabel
bundlebeforelaunch
bundlecloseapperror
bundle%d
bundle%dbuttonLabel
bundle%deulatext
bundle%dex
bundle%dfileName
bundle%dheader1
bundle%dheader2
bundle%dheader3
bundle%dicon
bundle%dlines
bundledownloaderror
bundledownloadstart
bundledownloadsuccess
bundle%drequestLabel
bundlelauncherror
bundlelaunchsuccess
bundleperscreen
bundlepostsuccess
bundlestimeout
buttonLabel
C09s(u
CallWindowProcW
canadian
cancelbutton
C+++)C
cCP	V 
<![CDATA[
__cdecl
checkbox
CheckDlgButton
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
;#</<C<K<
 Class Hierarchy Descriptor'
CloseHandle
__clrcall
CoCreateInstance
CoInitializeEx
COMCTL32.dll
 Complete Object Locator'
CONOUT$
`copy constructor closure'
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
CorExitProcess
CoTaskMemFree
C PjPV
C$PjQV
C.PjRV
C/PjSV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
CreateCompatibleBitmap
CreateCompatibleDC
CreateDialogIndirectParamW
CreateDialogParamW
CreateDIBSection
CreateEventW
CreateFileA
CreateFileW
CreateFontIndirectW
CreateFontW
CreateMutexW
CreatePatternBrush
CreatePopupMenu
CreateSolidBrush
CreateThread
CreateWindowExW
- CRT not initialized
cR"#Wi@*<
:+:C:U:y:
:$:D:`:|:
D$8!D$`
@.data
dddd, MMMM dd, yyyy
D$ !D$H
D$,+D$(j
December
DecodePointer
`default constructor closure'
 delete
 delete[]
DeleteCriticalSection
DeleteDC
DeleteFileW
DeleteObject
  </dependency>
  <dependency>
    </dependentAssembly>
    <dependentAssembly>
DestroyMenu
DestroyWindow
<,<<<@<D<H<L<T<l<p<
DispatchMessageW
D$,j0QP
D$l+D$h
>(>,><>@>D>L>d>t>x>
;(;,;<;@;D;L;d;t;x;
=$=D=L=T=\=d=p=
DOMAIN error
downloaderror
downurl
D$pSVW
D$PSVW
DrawFrameControl
DrawTextW
D$(SVW
? ?$?,?D?T?X?h?l?p?x?
dutch-belgian
D$<Wh`
`dynamic atexit destructor for '
`dynamic initializer for '
dynboth
dynleft
dyntop
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
EnableWindow
EncodePointer
EndDialog
EndPaint
england
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
EnterCriticalSection
EnumChildWindows
EnumSystemLocalesA
?E?T?Z?l?
ExitProcess
EXj0QP
ExpandEnvironmentStringsW
expire
extra1
extra2
extra3
F0@;F,~FSW
@@f90u
failon302redirect
__fastcall
February
Fh= eD
filecheck
fileName
FillRect
fixHeight
;F;K;V;[;y;*<7<
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
french-belgian
french-canadian
french-luxembourg
french-swiss
Friday
<"<.<:<F<R<^<j<v<
FYY;t$
?'?:?@?G?
G0K0O0S0W0[0_0c0
G;~4Y|
>g> ?8?=?
GAIsProcessorFeaturePresent
GDI32.dll
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
GetACP
GetActiveWindow
GetAncestor
GetClientRect
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCursor
GetCursorPos
GetDlgCtrlID
GetDlgItem
GetDlgItemTextW
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileAttributesW
GetFileSize
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetMessageW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetObjectW
GetOEMCP
GetParent
GetProcAddress
GetProcessWindowStation
GetPropW
GetStartupInfoA
GetStdHandle
GetStockObject
GetStringTypeA
GetStringTypeW
GetSysColorBrush
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTextExtentPoint32W
GetTickCount
GetUserDefaultLCID
GetUserObjectInformationA
GetVersionExW
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
(Go Daddy Class 2 Certification Authority0
GoDaddy.com, Inc.1301
'Go Daddy Secure Certification Authority1
great britain
!>GSAZK
GVC;*++<T
GYG;|$0u
gZ/Pu4
`h````
hcenter
header1
header2
header3
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
:(:H:h:
`h`hhh
HH:mm:ss
=<=H=h=t=
HHt<-6
HHtYHHt
<,<H<L<
holland
hong-kong
h=++);T
:(:H:T:t:
*http://certificates.godaddy.com/repository0
+http://certificates.godaddy.com/repository/0
*http://certificates.godaddy.com/repository100.
>http://certificates.godaddy.com/repository/gd_intermediate.crt0
"http://crl.godaddy.com/gds5-16.crl0S
http://ocsp.godaddy.com0F
http://ocsp.godaddy.com/0J
h=*++<?Vf
hybridFileName
hybridUrl
 IDATx
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:3DD5C9019D5C11E3BA01FEA404FAD141" xmpMM:DocumentID="xmp.did:3DD5C9029D5C11E3BA01FEA404FAD141"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3DD5C8FF9D5C11E3BA01FEA404FAD141" stRef:documentID="xmp.did:3DD5C9009D5C11E3BA01FEA404FAD141"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:598858EB9D6511E3BA01FEA404FAD141" xmpMM:DocumentID="xmp.did:598858EC9D6511E3BA01FEA404FAD141"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:598858E99D6511E3BA01FEA404FAD141" stRef:documentID="xmp.did:598858EA9D6511E3BA01FEA404FAD141"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:69D1948E9D6511E3BA01FEA404FAD141" xmpMM:DocumentID="xmp.did:95DCFAFA9D6511E3BA01FEA404FAD141"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:69D1948C9D6511E3BA01FEA404FAD141" stRef:documentID="xmp.did:69D1948D9D6511E3BA01FEA404FAD141"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:F78B75BF9D6D11E3BA01FEA404FAD141" xmpMM:DocumentID="xmp.did:F78B75C09D6D11E3BA01FEA404FAD141"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F78B75BD9D6D11E3BA01FEA404FAD141" stRef:documentID="xmp.did:F78B75BE9D6D11E3BA01FEA404FAD141"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>i
;I;l;L<
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
introscreen
InvalidateRect
invalid map/set<T> iterator
invalid string position
ios_base::badbit set
ios_base::eofbit set
ios_base::failbit set
irish-english
IsDebuggerPresent
IsDialogMessageW
IsDlgButtonChecked
IsValidCodePage
IsValidLocale
IsWindow
italian-swiss
iTCNO5s
$iTXtXML:com.adobe.xmp
>(>]>j>
j1|(hl
j1q1y1
j9SQGu
JanFebMarAprMayJunJulAugSepOctNovDec
January
;>;J;c;
J'\'Gg
j hp	D
jJ_HNF=
j@j ^V
'j%[Kk
JL	H+1
j"^SSSSS
;+;;;K;
?(?:?K?
KERNEL32
KERNEL32.dll
KillTimer
K%K0?(
:#;,;@;K;R;
Kt9Kt+K
L1Bd3T
launch-params
launch-type
launchValidation
LC_ALL
LC_COLLATE
LC_CTYPE
LCMapStringA
LCMapStringW
LC_MONETARY
LC_NUMERIC
LC_TIME
L$d_^[3
LeaveCriticalSection
leftBorder
line%d
LoadBitmapW
LoadCursorW
LoadIconW
LoadLibraryA
LoadLibraryW
LocalFree
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
=,=l=r=
L$ Sh`
L$ Shl
lstrcatW
lstrcmpiA
lstrcmpiW
lstrcpynW
lstrcpyW
lstrlenA
lstrlenW
]_l?[y%
mainbundle
maincheckbox
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
map/set<T> too long
MapWindowPoints
masteraction
masterrun
masterstart
message
MessageBeep
MessageBoxA
MessageBoxW
metalink
</metalink>
metaurl
Microsoft Visual C++ Runtime Library
MM/dd/yy
Monday
MoveFileW
MoveWindow
MSIMG32.dll
>!?M?u?
MultiByteToWideChar
 new[]
New IT Limited0
New IT Limited1
new-zealand
Nicosia1
norwegian
norwegian-bokmal
norwegian-nynorsk
Norwegian-Nynorsk
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
>,>>>N>\>r>x>
Nt3Nt"Nt
= =$=n=t=x=|=
(null)
October
ODMgqQ
offset
OiCCPPhotoshop ICC profile
:O;k;};
ole32.dll
`omni callsig'
O<;OD~
operator
=.>O>t>{>
<O<U<]<j<~<
"&:o}y
p2t2x2|2
<>=P=a=
__pascal
PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
PathRenameExtensionW
PathStripPathW
:P;e;u;
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
policy
policytext
portuguese-brazilian
postchecktimeout
PostMessageW
PostQuitMessage
PPPPPPPP
pr china
pr-china
Program: 
<program name unknown>
;(;,;<;@;P;T;d;h;x;|;
__ptr64
puerto-rico
- pure virtual function call
;-;<;Q;
QQSVWd
QueryPerformanceCounter
QWWWVRP
:>;Q;X;
qz9,(q]@P
:":,:R:
R0a0k0~0
radiocustom
radioquick
RaiseException
;R;a;o;
rd-7rt
`.rdata
ReadFile
regcheck
regcheck_notexists
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
ReleaseDC
@.reloc
RemovePropW
        <requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
requestLabel
__restrict
RjY FW
rLJ42u
RP-/88
RtlUnwind
runtime error 
Runtime Error!
=>>R>x>
=$>/><>s>
Saturday
`scalar deleting destructor'
Scottsdale1
ScreenToClient
    </security>
    <security>
SelectObject
SendMessageW
September
SetBkMode
SetCursor
SetDlgItemTextW
SetEvent
SetFilePointer
SetFocus
SetHandleCount
SetLastError
SetPropW
SetStdHandle
SetTextColor
SetTimer
SetUnhandledExceptionFilter
SetWindowLongW
SetWindowPos
SetWindowTextW
!Sh@*<
SHBrowseForFolder
SHCreateDirectoryExW
SHCreateStreamOnFileEx
SHELL32.dll
ShellExecuteExW
Shell_NotifyIconW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHLWAPI.dll
SHOpenFolderAndSelectItems
SHOpenWithDialog
ShowWindow
signupurl
silent
SING error
slovak
south africa
south-africa
south korea
south-korea
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
s[S;7|G;w
^SSSSS
SSVhPh@
startrightafterskip
stats-url
stats-url2
staturl
__stdcall
`string'
string too long
StrStrIW
StrToIntExW
subidlaunch
Sunday
SunMonTueWedThuFriSat
swedish-finland
t-9\$xt
TerminateProcess
TEvh&uD
tEXtSoftware
The Go Daddy Group, Inc.110/
+t HHt
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
Thursday
tKHHt.HHt
< tK<	tG
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t#/nnv
to=@oD
topBorder
tR99u2
TrackPopupMenuEx
TranslateMessage
trinidad & tobago
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
t"SS9]
<+t(<-t$:
t$<"u	3
Tuesday
;t$,v-
t VV9u
t+WWVPV
 Type Descriptor'
`typeof'
:.;u;{;
u%9x,uh
`udt returning'
!Ui@*<
u)jAXf;
- unable to initialize heap
- unable to open console device
__unaligned
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UNICODE
uninstall
uniquescreen
united-kingdom
united-states
Unknown exception
UpdateWindow
UQPXY]Y[
url_download_method
url_params
URPQQh
USER32.dll
USER32.DLL
u_SUWP
UTF-16LE
u,VVWV
=:=U=x=
v$;5doD
`vbase destructor'
`vbtable'
`vcall'
vcenter
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
vector<T> too long
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
`vftable'
virgin
VirtualAlloc
`virtual displacement map'
VirtualFree
v m2=:
v	N+D$
=/=V=r=}=
VSSSSS
v~vq$?;
_VVVVV
VVVVVVVVV
VVVVVVVVVUVVVj
VVVVVVVVVVj
VVVVVVVVVVVVVj
WaitForMultipleObjects
WaitForSingleObject
Wednesday
WICConvertBitmapSource
WideCharToMultiByte
WindowsCodecs.dll
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WINHTTP.dll
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpWriteData
wintitle
WriteConsoleA
WriteConsoleW
WriteFile
^WWWWW
WWWWWWW
;*<_<x<
<?xml version="1.0" encoding="UTF-8"?>
xml version="1.0" encoding="UTF-8"
<?xpacket begin="
xppwpp
xpxxxx
Y;=(kD
yn\S&W}#
>=Yt1j
YYVVVS
Z0J3;8?8C8G8K8O8S8W8[8_8c8g8k8o8s8w8{8
ZIl8M,
:@:Z:_:n:
ZP'J.G
z#w8B-