Analysis Date2014-11-20 21:19:05
MD54c33100d40907597b603814338e03b74
SHA1e5998aca677e684c791affac24916dfa9559ef63

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 275e4bdb4bbf5e7813efe2ee27a6c8e2 sha1: f6916b17a3012fc1c3c1f9559474c7b70afdb5d7 size: 648192
Section.rdata md5: 841708c50881973a2f40d4d6133fa903 sha1: d9c075a3cdf40137dc18c6b29157b44802998b51 size: 53760
Section.data md5: 8d53e6d16494597b9b6bda557fc3016b sha1: b4007f67236a56caa4ccfe0a7d724d05a9b812d0 size: 125440
Timestamp2014-04-15 21:03:35
PackerMicrosoft Visual C++ ?.?
PEhash2eb0b7c1a55c286db5b420b4e8118231b70e6f36
IMPhash7bfc766d4ec628da6d1eb551de314073
AV360 SafeGen:Variant.Sirefef.121
AVAd-AwareGen:Variant.Sirefef.121
AVAlwil (avast)Kryptik-NQV [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/Symmi.AH.gen!Eldorado
AVAvira (antivir)TR/Crypt.ZPACK.101642
AVBullGuardGen:Variant.Sirefef.121
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)Trojan.Generic.r3
AVClamAVno_virus
AVDr. WebTrojan.KillFiles.13224
AVEmsisoftGen:Variant.Sirefef.121
AVEset (nod32)Win32/Kryptik.BQWI
AVFortinetW32/COMROKI.A!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Variant.Sirefef.121
AVGrisoft (avg)Win32/Cryptor
AVIkarusVirus.Win32.Cryptor
AVK7Trojan ( 0049137f1 )
AVKasperskyTrojan.Win32.Generic:Trojan.Win32.PEF.pf.silent.175154:Trojan.Win32.PEF.pf.silent.181830:Trojan.Win32.PEF.pf.silent.374886:Trojan.Win32.PEF.pf.silent.375904:Trojan.Win32.PEF.pf.silent.376942:Trojan.Win32.PEF.pf.silent.377697:Trojan.Win32.PEF.pf.silent.378515:Trojan.Win32.PEF.pf.silent.379237:Trojan.Win32.PEF.pf.silent.380145:Trojan.Win32.PEF.pf.silent.380997:Trojan.Win32.PEF.pf.silent.416452:Trojan.Win32.PEF.pf.silent.415562:Trojan.Win32.PEF.pf.silent.432299:Trojan.Win32.PEF.pf.silent.432810:Trojan.Win32.PEF.pf.silent.445825:Trojan.Win32.PEF.pf.silent.454569:Trojan.Win32.PEF.pf.silent.456542
AVMalwareBytesTrojan.Agent.FNM
AVMcafeeRDN/Generic.bfr!hs
AVMicrosoft Security EssentialsTrojanSpy:Win32/Nivdort.Y
AVMicroWorld (escan)Gen:Variant.Sirefef.121
AVNormanGen:Variant.Sirefef.121
AVRising0x575bc088
AVSophosno_virus
AVSymantecno_virus
AVTrend MicroTSPY_NIVDORT.SM
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\tst
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\vswzpy1lf9dynxttxvmvy7x.exe
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\vswzpy1lf9dynxttxvmvy7x.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\vswzpy1lf9dynxttxvmvy7x.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\BitLocker Config Internet Web ➝
C:\WINDOWS\system32\evtskgt.exe
Creates FileC:\WINDOWS\system32\drivers\etc\hosts
Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\etc
Creates FileC:\WINDOWS\system32\evtskgt.exe
Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\lck
Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\tst
Deletes FileC:\WINDOWS\system32\\drivers\etc\hosts
Creates ProcessC:\WINDOWS\system32\evtskgt.exe
Creates ServiceProblem Scheduler IPsec Transaction User - C:\WINDOWS\system32\evtskgt.exe

Process
↳ C:\WINDOWS\system32\svchost.exe

Process
↳ Pid 820

Process
↳ Pid 864

Process
↳ C:\WINDOWS\System32\svchost.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\List of event-active namespaces ➝
NULL
Creates FilePIPE\lsarpc
Creates FileC:\WINDOWS\system32\WBEM\Repository\$WinMgmt.CFG
Creates FileC:\WINDOWS\system32\WBEM\Logs\wbemess.log

Process
↳ Pid 1220

Process
↳ C:\WINDOWS\system32\spoolsv.exe

RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\BeepEnabled ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\Print\TypesSupported ➝
7
RegistryHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\SymbolicLinkValue ➝
NULL
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\DefaultSpoolDirectory ➝
C:\WINDOWS\System32\spool\PRINTERS\\x00
Creates FileWMIDataDevice

Process
↳ Pid 1204

Process
↳ C:\WINDOWS\system32\evtskgt.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Security Center\FirewallDisableNotify ➝
1
Creates FileC:\WINDOWS\TEMP\vswzpy1rs0dynxt.exe
Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\run
Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\lck
Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\tst
Creates FileC:\WINDOWS\system32\iqftookkhmoa.exe
Creates Filepipe\net\NtControlPipe10
Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\cfg
Creates File\Device\Afd\Endpoint
Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\rng
Creates ProcessC:\WINDOWS\TEMP\vswzpy1rs0dynxt.exe -r 31865 tcp
Creates ProcessWATCHDOGPROC "c:\windows\system32\evtskgt.exe"

Process
↳ C:\WINDOWS\system32\evtskgt.exe

Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\tst

Process
↳ WATCHDOGPROC "c:\windows\system32\evtskgt.exe"

Creates FileC:\WINDOWS\system32\hzthofuzvrilwba\tst

Process
↳ C:\WINDOWS\TEMP\vswzpy1rs0dynxt.exe -r 31865 tcp

Creates File\Device\Afd\Endpoint
Winsock DNS239.255.255.250

Network Details:

DNSstickmarch.net
Type: A
69.195.129.70
DNStablefruit.net
Type: A
69.195.129.70
DNSmightglossary.net
Type: A
208.91.197.241
DNSrequireneither.net
Type: A
208.91.197.241
DNSgentlefriend.net
Type: A
208.91.197.241
DNSglasshealth.net
Type: A
208.91.197.241
DNSrememberpaint.net
Type: A
208.91.197.241
DNSthroughcountry.net
Type: A
208.91.197.241
DNSsignarmy.net
Type: A
216.239.139.75
DNSsignedge.net
Type: A
184.168.221.1
DNSjumpgray.net
Type: A
69.195.129.70
DNSthreeedge.net
Type: A
216.239.38.21
DNSthreeedge.net
Type: A
216.239.32.21
DNSthreeedge.net
Type: A
216.239.34.21
DNSthreeedge.net
Type: A
216.239.36.21
DNSsignonce.net
Type: A
209.67.50.203
DNSjumpstudy.net
Type: A
116.126.87.94
DNSnecessarydress.net
Type: A
DNSlittleappear.net
Type: A
DNSroomgray.net
Type: A
DNSsigngray.net
Type: A
DNSroomapril.net
Type: A
DNSsignapril.net
Type: A
DNSroomarmy.net
Type: A
DNSroomedge.net
Type: A
DNSmovegray.net
Type: A
DNSmoveapril.net
Type: A
DNSjumpapril.net
Type: A
DNSmovearmy.net
Type: A
DNSjumparmy.net
Type: A
DNSmoveedge.net
Type: A
DNSjumpedge.net
Type: A
DNShillgray.net
Type: A
DNSwhomgray.net
Type: A
DNShillapril.net
Type: A
DNSwhomapril.net
Type: A
DNShillarmy.net
Type: A
DNSwhomarmy.net
Type: A
DNShilledge.net
Type: A
DNSwhomedge.net
Type: A
DNSfeltgray.net
Type: A
DNSlookgray.net
Type: A
DNSfeltapril.net
Type: A
DNSlookapril.net
Type: A
DNSfeltarmy.net
Type: A
DNSlookarmy.net
Type: A
DNSfeltedge.net
Type: A
DNSlookedge.net
Type: A
DNSthreegray.net
Type: A
DNSlordgray.net
Type: A
DNSthreeapril.net
Type: A
DNSlordapril.net
Type: A
DNSthreearmy.net
Type: A
DNSlordarmy.net
Type: A
DNSlordedge.net
Type: A
DNSdrinkgray.net
Type: A
DNSwifegray.net
Type: A
DNSdrinkapril.net
Type: A
DNSwifeapril.net
Type: A
DNSdrinkarmy.net
Type: A
DNSwifearmy.net
Type: A
DNSdrinkedge.net
Type: A
DNSwifeedge.net
Type: A
DNSknowuncle.net
Type: A
DNSableuncle.net
Type: A
DNSknowstudy.net
Type: A
DNSablestudy.net
Type: A
DNSknowloss.net
Type: A
DNSableloss.net
Type: A
DNSknowonce.net
Type: A
DNSableonce.net
Type: A
DNSpickuncle.net
Type: A
DNSsonguncle.net
Type: A
DNSpickstudy.net
Type: A
DNSsongstudy.net
Type: A
DNSpickloss.net
Type: A
DNSsongloss.net
Type: A
DNSpickonce.net
Type: A
DNSsongonce.net
Type: A
DNSroomuncle.net
Type: A
DNSsignuncle.net
Type: A
DNSroomstudy.net
Type: A
DNSsignstudy.net
Type: A
DNSroomloss.net
Type: A
DNSsignloss.net
Type: A
DNSroomonce.net
Type: A
DNSmoveuncle.net
Type: A
DNSjumpuncle.net
Type: A
DNSmovestudy.net
Type: A
DNSmoveloss.net
Type: A
DNSjumploss.net
Type: A
DNSmoveonce.net
Type: A
DNSjumponce.net
Type: A
DNShilluncle.net
Type: A
DNSwhomuncle.net
Type: A
DNShillstudy.net
Type: A
DNSwhomstudy.net
Type: A
DNShillloss.net
Type: A
HTTP GEThttp://stickmarch.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://tablefruit.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://mightglossary.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://requireneither.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://gentlefriend.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://glasshealth.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://rememberpaint.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://throughcountry.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://signarmy.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://signedge.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://jumpgray.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://threeedge.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://signonce.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://jumpstudy.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://stickmarch.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://tablefruit.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://mightglossary.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://requireneither.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://gentlefriend.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://glasshealth.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://rememberpaint.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://throughcountry.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://signarmy.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://signedge.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://jumpgray.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://threeedge.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://signonce.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
HTTP GEThttp://jumpstudy.net/forum/search.php?method=validate&mode=sox&v=028&sox=3e55e602
User-Agent:
Flows TCP192.168.1.1:1036 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1037 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1038 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1039 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1040 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1041 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1042 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1043 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1044 ➝ 216.239.139.75:80
Flows TCP192.168.1.1:1045 ➝ 184.168.221.1:80
Flows TCP192.168.1.1:1046 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1048 ➝ 216.239.38.21:80
Flows TCP192.168.1.1:1049 ➝ 209.67.50.203:80
Flows TCP192.168.1.1:1050 ➝ 116.126.87.94:80
Flows TCP192.168.1.1:1051 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1052 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1053 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1054 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1055 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1056 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1057 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1058 ➝ 208.91.197.241:80
Flows TCP192.168.1.1:1059 ➝ 216.239.139.75:80
Flows TCP192.168.1.1:1060 ➝ 184.168.221.1:80
Flows TCP192.168.1.1:1061 ➝ 69.195.129.70:80
Flows TCP192.168.1.1:1062 ➝ 216.239.38.21:80
Flows TCP192.168.1.1:1063 ➝ 209.67.50.203:80
Flows TCP192.168.1.1:1064 ➝ 116.126.87.94:80

Raw Pcap
0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b6d 61726368 2e6e6574   : stickmarch.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 626c6566 72756974 2e6e6574   : tablefruit.net
0x00000080 (00128)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d69 67687467 6c6f7373 6172792e   : mightglossary.
0x00000080 (00128)   6e65740d 0a0d0a                       net....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207265 71756972 656e6569 74686572   : requireneither
0x00000080 (00128)   2e6e6574 0d0a0d0a                     .net....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206765 6e746c65 66726965 6e642e6e   : gentlefriend.n
0x00000080 (00128)   65740d0a 0d0a0d0a                     et......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20676c 61737368 65616c74 682e6e65   : glasshealth.ne
0x00000080 (00128)   740d0a0d 0a0a0d0a                     t.......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207265 6d656d62 65727061 696e742e   : rememberpaint.
0x00000080 (00128)   6e65740d 0a0d0a0a                     net.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 726f7567 68636f75 6e747279   : throughcountry
0x00000080 (00128)   2e6e6574 0d0a0d0a                     .net....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207369 676e6172 6d792e6e 65740d0a   : signarmy.net..
0x00000080 (00128)   0d0a6574 0d0a0d0a                     ..et....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207369 676e6564 67652e6e 65740d0a   : signedge.net..
0x00000080 (00128)   0d0a6574 0d0a0d0a                     ..et....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206a75 6d706772 61792e6e 65740d0a   : jumpgray.net..
0x00000080 (00128)   0d0a6574 0d0a0d0a                     ..et....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 72656565 6467652e 6e65740d   : threeedge.net.
0x00000080 (00128)   0a0d0a74 0d0a0d0a                     ...t....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207369 676e6f6e 63652e6e 65740d0a   : signonce.net..
0x00000080 (00128)   0d0a0a74 0d0a0d0a                     ...t....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206a75 6d707374 7564792e 6e65740d   : jumpstudy.net.
0x00000080 (00128)   0a0d0a74 0d0a0d0a                     ...t....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207374 69636b6d 61726368 2e6e6574   : stickmarch.net
0x00000080 (00128)   0d0a0d0a 0d0a0d0a                     ........

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207461 626c6566 72756974 2e6e6574   : tablefruit.net
0x00000080 (00128)   0d0a0d0a 0d0a0d0a                     ........

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206d69 67687467 6c6f7373 6172792e   : mightglossary.
0x00000080 (00128)   6e65740d 0a0d0a0a                     net.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207265 71756972 656e6569 74686572   : requireneither
0x00000080 (00128)   2e6e6574 0d0a0d0a                     .net....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206765 6e746c65 66726965 6e642e6e   : gentlefriend.n
0x00000080 (00128)   65740d0a 0d0a0d0a                     et......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a20676c 61737368 65616c74 682e6e65   : glasshealth.ne
0x00000080 (00128)   740d0a0d 0a0a0d0a                     t.......

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207265 6d656d62 65727061 696e742e   : rememberpaint.
0x00000080 (00128)   6e65740d 0a0d0a0a                     net.....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 726f7567 68636f75 6e747279   : throughcountry
0x00000080 (00128)   2e6e6574 0d0a0d0a                     .net....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207369 676e6172 6d792e6e 65740d0a   : signarmy.net..
0x00000080 (00128)   0d0a6574 0d0a0d0a                     ..et....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207369 676e6564 67652e6e 65740d0a   : signedge.net..
0x00000080 (00128)   0d0a6574 0d0a0d0a                     ..et....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206a75 6d706772 61792e6e 65740d0a   : jumpgray.net..
0x00000080 (00128)   0d0a6574 0d0a0d0a                     ..et....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207468 72656565 6467652e 6e65740d   : threeedge.net.
0x00000080 (00128)   0a0d0a74 0d0a0d0a                     ...t....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a207369 676e6f6e 63652e6e 65740d0a   : signonce.net..
0x00000080 (00128)   0d0a0a74 0d0a0d0a                     ...t....

0x00000000 (00000)   47455420 2f666f72 756d2f73 65617263   GET /forum/searc
0x00000010 (00016)   682e7068 703f6d65 74686f64 3d76616c   h.php?method=val
0x00000020 (00032)   69646174 65266d6f 64653d73 6f782676   idate&mode=sox&v
0x00000030 (00048)   3d303238 26736f78 3d336535 35653630   =028&sox=3e55e60
0x00000040 (00064)   32204854 54502f31 2e300d0a 41636365   2 HTTP/1.0..Acce
0x00000050 (00080)   70743a20 2a2f2a0d 0a436f6e 6e656374   pt: */*..Connect
0x00000060 (00096)   696f6e3a 20636c6f 73650d0a 486f7374   ion: close..Host
0x00000070 (00112)   3a206a75 6d707374 7564792e 6e65740d   : jumpstudy.net.
0x00000080 (00128)   0a0d0a74 0d0a0d0a                     ...t....


Strings
.a
" 
 ' 
%+#I64
.,
\.
 
**
/
+
e
:
:
  
%+#.*
%+#.*L
+%D%A%26A&
 
......
.
h1
21212
"1"2d1x
\
-_
/
 0
'
''
?S
\
.
.
.
.
.
..
...
...
.......
...
 ..
!"!
#!$!.
%
.
'
(.
*
+
,+
-
.-
/
012-3-
[
Z
[Z
[
 
d2
h2
1
1
x
aarnAaEg.pCoS3FarndSScrhnrdKisvdbaCor2nTnHOiWEvjC
 
- 
CC-E-
-0
-0010+-0
0
-0
00-+ 
.
.
-e-
. 
00-+ 
\
00:\
:..
  .
...........?- 
0
0
0
0
-
I
t
?
,.
X
...
_3
.d./{
.t-.
u
                                 H
         (((((                  H
         h((((                  H
jjjh
Jjjj
jjjjj
Jjjjj
KERNEL32.DLL
Kjjj
Ljjj
Mjjj
mscoree.dll
(null)
                          
\$ _^[
\$(_^[
\$$_^[
																		
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0A@@Ju
\$0PUV
0SSSSS
0vrI(bTJ)
0;w)BI
0WWWWW
<^0zni
1h 	dL
1#QNAN
1>qR`r
1sl>k96
1#SNAN
2ktS[-
2Uc@4O
\$<3\$@#
"3#/2p
3a{@Xx 
+3tM".
|42= F&@
5P`e\B
6X2s|mX
76<VqGK
~7^B?eJ
7c$4$;
'7hdQK
!:)7JuD
\7wB$U
8VVVVV
8#`Wgi"
8^|)XkU
9"}0he
*9^0t7j
9\$Dt*
9D$@tOf
9D$\uX
\$,9F<
9F%h8,
9G0tlj
9l$0u_
9\$Lv7
9M8@clI
^@9n8r
^\9nTr
\$,9p<
">9P$-
9|$P|?
9\$$t"j(h 
|$@9\$Ts
9t$$u*
9\$ uf
9\$(uF
\$(9|$Xr
-A0fXf
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
a$ d`[
@A#-D 
Adeque<T> too long
AHSfin
 :_$'aLU
america
american
american english
american-english
a*m`ex$
An application has made an attempt to load the C runtime library incorrectly.
aNyxq{n0J
]`A&oSp
<at9<rt,<wt
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
.?AUctype_base@std@@
August
australian
.?AVbad_alloc@std@@
.?AVbad_cast@std@@
.?AVbad_exception@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AV?$ctype@D@std@@
.?AVexception@std@@
.?AVfacet@locale@std@@
.?AVfailure@ios_base@std@@
.?AVios_base@std@@
.?AV?$_Iosb@H@std@@
.?AVlength_error@std@@
.?AV_Locimp@locale@std@@
.?AVlogic_error@std@@
.?AV?$numpunct@D@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AVout_of_range@std@@
.?AVruntime_error@std@@
.?AVtype_info@@
-Ay2H?
%]]AyZ4
bad allocation
bad cast
bad exception
 Base Class Array'
 Base Class Descriptor at (
__based(
Bc>	QB
<[Be?c
BeginPaint
belgian
(BJ>gpI
BOOZS'
britain
= ""Bu#
B]]U!W
B#XD!N=
C?6rAnCe{
Ca]I &
CallWindowProcA
canadian
__cdecl
CheckDlgButton
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
C}# i0
_ck$+,
 Class Hierarchy Descriptor'
CloseHandle
)%cL{r
__clrcall
cmd.exe
CompareStringA
CompareStringW
 Complete Object Locator'
COMSPEC
CONOUT$
`copy constructor closure'
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
CorExitProcess
C PjPV
C$PjQV
C.PjRV
C/PjSV
C*PjTV
C+PjUV
C,PjVV
C-PjWV
CreateFileA
CreateProcessA
CreateThread
- CRT not initialized
@cTqSt=
Cw<n!@
cW(/)y7
c$yJu)8
D$ ^][
D$,[]_^
D$(^][
D$(_^][
D$0^[3
D$0;A<
D$0PQR
D$0PQV
D$0@PV
D$0WPC
D$0-y^
D\#!$/4f
D$4PPUS
D$4SVW
D$4t:j
D$4Vj	
D$8j2P
D$8SUVW
D$(9\$t
D$@9\$Ts
@.data
D$@cPcaj
D$@;D$,
dddd, MMMM dd, yyyy
D$Dh0u
D$Dj@P
D$DPQV
D$DPQVS
D$DPQVWW
D$DPWQ
D$DPWV
D$DPWVSS
D$DRWP
D$dSUVW
$DE7 9
December
DecodePointer
`default constructor closure'
 delete
 delete[]
Delete
DeleteCriticalSection
DeleteFileA
D$()\$<f
D$H_^]
D$H-(a
D$hPWV
D$HSVW
D$$hTQK
{-D@INu
}DjjHs|
D@=\" jL
D$L9\$p
D$L9|$`s
)DLL9V
D$lPhT
D$lQUSRP
D$LRWP
D$LSUVW
D$LSVW
D$L-ta_I
D{^m?b?T
DOMAIN error
D$P9|$XtW
D$,Pj$
D$(PjKj
D$\PQj
D$pSUVW
D$<pUN
D$,PUWj
D$PVj8
D$,PWQ
D$,PWU
D$$PWVQ
D$,QRP
D$|QSRPV
D$\QWRf
DrawTextA
D``RGO
D$@RWP
~?(D;sO
D$ SPW
D$`SUVW
D$<SUVW
D$(SUVW
D$@SUVW
D$<SVW
D$@SVW
D$|+t$4
D$T:D$
;D$$tM
;D$$tM)\$$
D$tPVf
D$tSUVW
D$TSUVW
D$,UT-
dutch-belgian
D$<Vj"
D$ VSUP
)D$ Wj
DW:%jA
D$xSVW
D$xWPQR
`dynamic atexit destructor for '
`dynamic initializer for '
dYSw[WU
/DZ'T>
] $e.<
E,9udr
	.e&H+
EhSVWP
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
|Ej	h 
E;-L.M
ElSVWP
EM3t?Vv7Zw
EnableWindow
EncodePointer
EndDialog
england
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
EnterCriticalSection
EnumSystemLocalesA
EpSVWP
^eU}thp
	Exc*'|
ExitProcess
EyX3\<
eZ-?\0
F09n(u
F$1t%f
 F>2(-
F;5dNK
__fastcall
February
	,/\F!H(
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindResourceA
f/J>fE
- floating point support not loaded
f~LR{c
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
ForceRemove
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
french-belgian
french-canadian
french-luxembourg
french-swiss
Friday
)f{'s7
^F<-uB
,fuQ2gp
FZr|UA
*g3r^m5
g]4A$r
GAIsProcessorFeaturePresent
g/_c6p
GDI32.dll
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
GetACP
GetActiveWindow
GetBkColor
GetClipRgn
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetCurrentObject
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDCBrushColor
GetDCPenColor
GetDeviceCaps
GetDlgItem
GetDlgItemInt
GetDriveTypeA
GetEnvironmentStrings
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesA
GetFileType
GetFontLanguageInfo
GetForegroundWindow
GetFullPathNameA
GetGraphicsMode
GetInputState
GetKeyboardType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetMenu
GetMenuContextHelpId
GetMenuItemCount
GetMetaRgn
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetNearestPaletteIndex
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessWindowStation
GetPropA
GetQueueStatus
GetRandomRgn
GetScrollPos
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemPaletteUse
GetSystemTimeAsFileTime
GetTextAlign
GetTickCount
GetTimeZoneInformation
GetUserDefaultLCID
GetUserObjectInformationA
GetVersion
GetWindowContextHelpId
GetWindowDC
GetWindowLongA
GlobalAlloc
GlobalFlags
GlobalHandle
GlobalSize
g^NfsB3Z
great britain
G;=X,M
`h````
h#2WwI
^=H7s-:
\$h9|$`r
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
Hf]9bcp
hHg.1<
`h`hhh
HH:mm:ss
HHtXHHt
HHtYHHt
@h)j p
holland
hong-kong
=%{H`ry[
-HrZ9^P
|$Ht#h
hx@5>=z:Q
IC%H00
>If90t
iL)@hK
Im,!H*
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
invalid map/set<T> iterator
invalid string position
ios_base::badbit set
ios_base::eofbit set
ios_base::failbit set
irish-english
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWindowEnabled
italian-swiss
i)>w^@(
j0h$4K
\$ j1h
j4h$2K
{J5)om
jAhP0K
JanFebMarAprMayJunJulAugSepOctNovDec
January
jbhpWK
\$$j	f
jGhH9K
j^h0VK
j	hd3K
j	hDQK
j?h\GK
j	hH]K
j:hhzK
j,h({K
j#hL'K
j	hPpK
j	hpUK
j	hx3K
j@j ^V
`;J,Nbv
JQ!#eu
jSH^c}
js#j#n
j"^SSSSS
JY1g x
K5bU1,
KERNEL32
KERNEL32.dll
kf5=)MC
KJviH(di<U
K@*jWn8
KUutbC
k`V'.0+?+
kXTXA"
L$0)|$D
L$0UPj
l2@AAh
L$`_^[3
L$,^]3
L$(_^3
L$\_^[3
L$\_^]3
L$4_^[3
L$4QWVR
l{7gzu
L$8-Q5&}Qf
\$L9|$Dr
L9t$Tr
LC_ALL
LC_COLLATE
LC_CTYPE
LCMapStringA
LCMapStringW
LC_MONETARY
LC_NUMERIC
LC_TIME
`l"d0|F2
L$d_^[3
L$D9D$0t%h
L%Dj3`
L$DPQ3
L$DQRV
L$DQRVSS
L$DQVf
L$DURPVQ
LeaveCriticalSection
|~l}Ff
L$hQRUUj
L$hQSVR
L$HQURP
$Li%tx*
lJ2"Pb
L)"j&9%5
L$ j@Q
L$l_^][3
L$LPWQ
L$lVj	
LM_Kt2
\$L;n<
L}^N?a
lo90R^
LoadIconA
LoadLibraryA
LoadResource
LocalAlloc
LocalFlags
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
lofK#mI
LOQ_EU
L$P< |
L$pQPh
L$pRSPQVW
L$PVVj
LP>zdT
L$,Qj0
L$,Qj4
L$ QUV
L$@QWR
L$`QWWj
;L%RUOuNucl
L$(SU;
L$Th8'K
L$tQRPh
L$\<+t'<-t#<0u
L$ <-u
l$ VW3
LW~6ck4.
L$ WQP
L$xRSPQWV
L$XSWPQ
!lX	VF
m2E\_l
M4@Y9c
M,9uHr
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
map/set<T> too long
(mcJgR8
MessageBoxA
mfvTcMF
Microsoft Visual C++ Runtime Library
MM/dd/yy
Monday
MoveFileA
MoveWindow
MTeV52
&mU;fk
MultiByteToWideChar
M@Z9K7
N>2-RH
`n+`3d
Nd-@;{
n		d?j_*
ne;LbDeY
 new[]
new-zealand
nGgHSVi
NoRemove
norwegian
norwegian-bokmal
norwegian-nynorsk
Norwegian-Nynorsk
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
n*uG@Z(v
(null)
/"N+x(
O6xbfFS
)o7-HN
October
OLEAUT32.dll
`omni callsig'
operator
O,?Pw+
	ot`]RF
Oz[ub}
ozZO^Z
p674j@
p9~28B
__pascal
P?B=}.s
	pE3m&1-x
Pf95(2M
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
PO2^JBl)
portuguese-brazilian
PostMessageA
PPPPPPPP
|$ PQj
PQSUVW
pr china
pr-china
Program: 
<program name unknown>
$%Pt&9\P
__ptr64
puerto-rico
- pure virtual function call
PUy%TQ
q3jrFD6
Q`{'6ezZ
q({bdM1S
,Q<IhF
QQSVWd
QSSSSSSh 
QSUVW3
QueryPerformanceCounter
qvgj22
r5m]?L
r"99N?
`"R9h@
RaiseException
`.rdata
ReadFile
RemovePropA
__restrict
RfzZ)g
rgj;3ul<
R@O UZG
RtlUnwind
runtime error 
Runtime Error!
rW:!W_
r[<W?z
s8k;]FC
+S&9[_
Saturday
s}>Bm6'
`scalar deleting destructor'
SendMessageA
September
SetDlgItemTextA
SetEndOfFile
SetEnvironmentVariableA
SetFilePointer
SetFocus
SetHandleCount
SetLastError
SetPixel
SetStdHandle
SetSystemPaletteUse
SetTextCharacterExtra
SetTextColor
SetUnhandledExceptionFilter
SetWindowTextA
ShowWindow
SING error
SizeofResource
}sj!hl
@slGCC
slovak
]sL+Rat
S.O_^[
south africa
south-africa
south korea
south-korea
	S?#p]
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
SRSSSh
SRUQWP
s[S;7|G;w
SSSh0?@
SSShP$D
^SSSSS
__stdcall
`string'
string too long
Sunday
SunMonTueWedThuFriSat
swedish-finland
\$(SWj
:SWm2O
SystemRoot
;|$ t	
;|$$t	
\$|;t$
\$ ;\$(t
T1WNlf
t3hHjJ
T$4jlR
T$4Rh?
T$8j2R
T$8RPj
T$8RPQ
T8VpIuH
t"bz:H
T$DRWV
T$DRWVS
\$T)D$ W
t$dWVU
TerminateProcess
t=FA9]
tfd2I?V
tGhPjJ
tGHt.Ht&
(</t$h
T$hh01K
+t HHt
t h iJ
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
t"h@jJ
Thursday
tIj"[:
< tK<	tG
TLOSS error
+Tl/r{6
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
<\tM</tI
T$$PQRV
T$PRj$
T$pRSVf
T$PRVSj
T$|PSQRWV
t$ PSV
t$PWPh0/J
t$ QVP
tR99u2
trinidad & tobago
tR|$mRO
T$$RPQV
t$(RQPV
T$ RQQj
T$$RVP
T$$RWPV
t"SS9]
T$<SVW3
<+t(<-t$:
T$TQWR
T$TRQP
T$,;t$\sZ
t$<"u	3
Tuesday
t,uia2
\$TuXj
;t$,v-
T&VpoK
t VV9u
T$(VW3
T,&wOk
t$<WPR
t$$WSPVj
t+WWVPV
T$Xh0u
T$xVSQR
T%YCnV
 Type Descriptor'
`typeof'
T`z<YV
U6uj4G
>:u8FV
`udt returning'
u	F;t$
:U,{`h
Uh9]Dr
Uh9](r
U'+HmUB
UhOBPq
uL9=8:M
*%U[MZ
- unable to initialize heap
- unable to open console device
__unaligned
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UNICODE
united-kingdom
united-states
Unknown exception
Uo&|B@
UpdateColors
u+PPPhP
U@PVRj
UQPXY]Y[
uqSSSSS
URPQQhP
USER32.dll
USER32.DLL
u[SSSP
UTF-16LE
u,VVWV
UVW=;N
uWjLhX
+uwrI?
UxPVRj
;|$|v	
"V{&0W[
v15cZW
V 1T$8
`vbase destructor'
`vbtable'
`vcall'
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
`vftable'
vfV)mZ
VgxG+"
VirtualAlloc
`virtual displacement map'
VirtualFree
v!MA/A
v	N+D$
<=vN<>u'
<=v\<>u8
vU<]n+
_VVVVV
VVVVVQRSSj
\$`VWj
\$(VWRS
'w&%\;
W(0:5P
WaitForSingleObject
Wednesday
WideCharToMultiByte
wIf3P[p
WindowFromDC
|$$Wj"
WriteConsoleA
WriteConsoleW
WriteFile
WS2_32.dll
WV!};na
^WWWWW
X+D},f
-XhKJf
Xn7Ira
=)~XP3
xppwpp
xpxxxx
X$QmX0x
<xtX<XtT
[xU	U`J
x[w;|N
~$_^]Y
!y1{v;Z
y49PIpo
~+yma8&
?>Yq x|
>=Yt1j
Y<\u#j\V
YYh0iJ
ZfAkQ{
+zGk4?c
ZNSkNz
`/Zrk6
ZT/&"/
z#TNtyK
Zvl5SVh`