Analysis Date2015-01-07 15:19:15
MD5cbc67f95baccff37457e221aa943e733
SHA12fa071d3c405664d0fc2c34b74def22fdb37e596

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 880c7f502f8a4c3a7ce0ba7b5486bd9e sha1: 96100c54fb28a8aab4069574d1046a1505fd3ac2 size: 93184
Section.rdata md5: 72b1b36a2819addaf91e90aa2f84c7a0 sha1: d7b142ddf94283f0199eb64b58da42ebd663d8c8 size: 61952
Section.data md5: 7debc1478d8dbcb25e8525f8153bc38b sha1: 0ee2c9c76ec8b0cc29df94ead316aa061d88a932 size: 11776
Section.rsrc md5: 571cbea28684a386635adf545173eae7 sha1: 4c097ed9d768411b5821bb97727c4a8a90f9857b size: 128000
Timestamp2014-12-21 15:56:22
Pdb pathH:\communication\pipes\int\devmode.pdb
PackerMicrosoft Visual C++ ?.?
PEhash83c66ba473a59f51cf45bb82e1706c01ade28483
IMPhash6822666983d9fa9b10a7431ded3850d2
AV360 Safeno_virus
AVAd-AwareTrojan.Generic.12391031
AVAlwil (avast)Malware-gen:Win32:Malware-gen
AVArcabit (arcavir)Trojan.Generic.12391031
AVAuthentiumW32/Trojan.BKOB-9125
AVAvira (antivir)TR/Ramnit.A.109
AVBullGuardTrojan.Generic.12391031
AVCA (E-Trust Ino)Win32/Ramnit.RQdcTbC
AVCAT (quickheal)TrojanRansom.Foreign.r4
AVClamAVno_virus
AVDr. Webno_virus
AVEmsisoftTrojan.Generic.12391031
AVEset (nod32)Win32/Kryptik.CUIW
AVFortinetW32/Kryptik.CTQR!tr
AVFrisk (f-prot)no_virus
AVF-SecureTrojan.Generic.12391031
AVGrisoft (avg)Crypt3.BMPP
AVIkarusTrojan-Ransom.Win32.Foreign
AVK7Trojan ( 004b2e0d1 )
AVKasperskyTrojan-Ransom.Win32.Foreign.lhrj
AVMalwareBytesTrojan.FakeAdobe.ED
AVMcafeeRDN/Generic.grp!hs
AVMicrosoft Security EssentialsTrojan:Win32/Ramnit
AVMicroWorld (escan)Trojan.Generic.12391031
AVRisingno_virus
AVSophosTroj/Agent-AKZV
AVSymantecno_virus
AVTrend Microno_virus
AVVirusBlokAda (vba32)no_virus

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\epkiipun.exe
Creates FilePIPE\lsarpc
Creates ProcessC:\Documents and Settings\Administrator\Local Settings\Temp\epkiipun.exe

Process
↳ C:\Documents and Settings\Administrator\Local Settings\Temp\epkiipun.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\EpkIipun ➝
C:\Documents and Settings\Administrator\Local Settings\Temp\epkiipun.exe
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UAC_bypassed ➝
TRUE
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start ➝
4
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride ➝
1
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall ➝
NULL
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\lyrbgkji.exe
Creates FilePIPE\lsarpc
Creates ProcessC:\WINDOWS\system32\svchost.exe
Creates ProcessC:\WINDOWS\system32\svchost.exe
Creates Mutex{38038F27-A33D-BF6F-D4CB-0E8E9ECA1C98}
Creates Mutex{38038F28-A33D-BF6F-D4CB-0E8E9ECA1C98}

Process
↳ C:\WINDOWS\system32\svchost.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\UtvDbgok ➝
C:\Documents and Settings\Administrator\Local Settings\Application Data\mneqqdft\utvdbgok.exe
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit ➝
C:\WINDOWS\system32\userinit.exe,,C:\Documents and Settings\Administrator\Local Settings\Application Data\mneqqdft\utvdbgok.exe
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start ➝
4
RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system\EnableLUA ➝
NULL
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride ➝
1
RegistryHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall ➝
NULL
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\mneqqdft\utvdbgok.exe
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Startup\utvdbgok.exe
Creates FileC:\Documents and Settings\All Users\Application Data\cujewyvk.log
Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\mneqqdft\px1.tmp
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\otbgykrj.log
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Application Data\mneqqdft\px1.tmp
Creates Mutex{38038E51-A33D-BF6F-D4CB-0E8EA2761C98}
Creates Mutex{38038A13-A33D-BF6F-D4CB-0E8E9ECA1C98}
Creates MutexDBWinMutex
Creates Mutex{38038F28-A33D-BF6F-D4CB-0E8E9ECA1C98}

Process
↳ C:\WINDOWS\system32\svchost.exe

Creates FilePIPE\lsarpc
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\pkftrhyj.log
Creates Mutex{38039914-A33D-BF6F-D4CB-0E8E9ECA1C98}
Creates Mutex{38038F28-A33D-BF6F-D4CB-0E8E9ECA1C98}

Network Details:

DNShgyudheedieibxy.com
Type: A
94.126.178.24
DNSectdsitvvoydawmfni.com
Type: A
195.22.26.232
DNShufqifjq.com
Type: A
166.78.62.91
DNSanrylixwcbnjopdd.com
Type: A
86.124.164.25
DNSppyblaohb.com
Type: A
5.152.205.194
DNSknpqxlxcwtlvgrdyhd.com
Type: A
95.141.36.218
DNSgoogle.com
Type: A
173.194.125.67
DNSgoogle.com
Type: A
173.194.125.66
DNSgoogle.com
Type: A
173.194.125.65
DNSgoogle.com
Type: A
173.194.125.64
DNSgoogle.com
Type: A
173.194.125.78
DNSgoogle.com
Type: A
173.194.125.73
DNSgoogle.com
Type: A
173.194.125.72
DNSgoogle.com
Type: A
173.194.125.71
DNSgoogle.com
Type: A
173.194.125.70
DNSgoogle.com
Type: A
173.194.125.69
DNSgoogle.com
Type: A
173.194.125.68
DNSvbvqbnwyurqem.com
Type: A
195.22.26.232
DNSitktxexjghvvxa.com
Type: A
176.31.62.76
DNSjetuergatod.com
Type: A
195.22.26.232
DNSckyioylutybvcxv.com
Type: A
195.22.26.232
DNSooadnxbvbhxnnm.com
Type: A
86.124.164.25
DNStqjhvylf.com
Type: A
DNSvrndmdrdrjoff.com
Type: A
DNSnvlyffua.com
Type: A
DNSjhghrlufoh.com
Type: A
DNSkhllpmpmare.com
Type: A
DNSanxsmqyfy.com
Type: A
DNSriaaiysk.com
Type: A
DNSvfrpojablskkqrx.com
Type: A
DNSegopuefrdsefc.com
Type: A
DNSfycecyuksgjfxy.com
Type: A
DNSwldlrwlygck.com
Type: A
DNSqyuylvjwh.com
Type: A
DNSlcqavndroo.com
Type: A
DNSqvberjspofqsxdnr.com
Type: A
DNSacuhjbadvnmhthwnlxv.com
Type: A
DNSeuvyalbkwahxxjn.com
Type: A
DNStypmyloijdcxtdxd.com
Type: A
DNShjahmduyebf.com
Type: A
DNSuvenqtbfbeyvebqeb.com
Type: A
DNSebrfoyrs.com
Type: A
DNSjmmurxyktxvegsxid.com
Type: A
DNSmyhyfpuoh.com
Type: A
DNSvffamysgsfsodw.com
Type: A
DNSsblbtuqtiavvtrkrn.com
Type: A
DNSqtyvbditfgmkxqjrik.com
Type: A
DNSwxxnufbeacmrtdam.com
Type: A
DNSfsxgwfwychumrgrmhwo.com
Type: A
DNSlvrjjmbdtfapwev.com
Type: A
DNSrijfxtotkuysyfh.com
Type: A
DNSibvtknxochoyjidm.com
Type: A
DNSvwlcnujosuovul.com
Type: A
DNSaflgqgddfi.com
Type: A
DNStbajypaiecloxihf.com
Type: A
DNSxoqxabqb.com
Type: A
DNSwnftxxhnwiugtvwyo.com
Type: A
DNSimvfakaudq.com
Type: A
DNSjmesrbwtcjev.com
Type: A
DNSrrewytfucjjylju.com
Type: A
DNSxrtgqevawtlmulghjj.com
Type: A
DNSycafyovxdnlsa.com
Type: A
DNSfgcdhqgcdomle.com
Type: A
DNSxbjersli.com
Type: A
DNSjymqfxgwfhyns.com
Type: A
DNSrepliinjqssbrnf.com
Type: A
DNSealxbraobohxb.com
Type: A
DNSdhfejwhoj.com
Type: A
DNSllgnygbqhv.com
Type: A
DNSscfxvdlmfbgf.com
Type: A
DNStodyennhm.com
Type: A
DNSnfqhufvxyssyda.com
Type: A
DNSemlxeyirx.com
Type: A
DNSshnlojyteeocltymxe.com
Type: A
DNSqdboaveuhwabhwik.com
Type: A
DNSyovkoaxsana.com
Type: A
DNSexmfhgyv.com
Type: A
DNSqpfrvbstn.com
Type: A
DNShajqfvvqjkkaejwi.com
Type: A
DNSovypjimjcnvwwooiamj.com
Type: A
DNSucfenxbryboqwbmlxke.com
Type: A
DNSnwuqfobauuwsyuppii.com
Type: A
DNSokfatclblpl.com
Type: A
DNSifbomanec.com
Type: A
DNSgwmjxjueqme.com
Type: A
DNSedvxemrsvvycwt.com
Type: A
DNSogfavxwxus.com
Type: A
DNSkynknfyngikfno.com
Type: A
DNSecsgmpariu.com
Type: A
DNSicqxkusbfdwhy.com
Type: A
DNSnxlakdliamyuejsss.com
Type: A
DNScbxyvrxewvlnxhkadfg.com
Type: A
DNSmyqenkelfk.com
Type: A
DNSsmisifkrfkyccnlk.com
Type: A
DNShvyfjjqdlwhnlrpaa.com
Type: A
DNSmlgdwljfmnkt.com
Type: A
DNShvklxvhkmfsdgd.com
Type: A
DNSvefqierywsov.com
Type: A
DNSliedjckipkehqxwtdl.com
Type: A
DNSppvrnfkbarbnlm.com
Type: A
DNSckgvnbwdywbxvlnk.com
Type: A
DNSbpiwebgqddyvgcnjgh.com
Type: A
DNSeyvvpstmcwwvsyjtif.com
Type: A
DNSyctkhjksne.com
Type: A
DNSllurxdkpkbvjx.com
Type: A
DNSsdjvmbngpgwnpdj.com
Type: A
DNSqhnhlgmfepeuelxtpkv.com
Type: A
DNSudiivoyrbugyfruq.com
Type: A
DNSfacmttijcdq.com
Type: A
DNSootuuujaep.com
Type: A
DNSwvmmvpbkjrds.com
Type: A
DNSdbygksqtu.com
Type: A
DNSetjdsnjpvb.com
Type: A
DNSyytbonkxjwy.com
Type: A
DNSuvkejdrigublblsst.com
Type: A
DNSnglqogrh.com
Type: A
DNSqiisbgyqkrokokwrbq.com
Type: A
DNSxcpvexsyqjsf.com
Type: A
DNScyanlvwkuatvmw.com
Type: A
DNSwxkeojjdshd.com
Type: A
DNSjvmckcospyqedcsjny.com
Type: A
DNSlvqdhrqhfxlsglkf.com
Type: A
DNSbriujbxmkjeusvslrln.com
Type: A
DNSsbpvpkuwoxevjiy.com
Type: A
DNSmkdnthyiqlq.com
Type: A
DNSaufdloglxlqoxxlepp.com
Type: A
DNSdwbdecmppklvbevtjq.com
Type: A
DNSjherkljjcsloepd.com
Type: A
DNSpxjjwmhlmptbsvhuq.com
Type: A
DNSqnyyirhtuautt.com
Type: A
DNShoeqosqeicddv.com
Type: A
DNSxsmympdmnacrqxkdb.com
Type: A
DNSkdkdpwql.com
Type: A
DNSfxngienbgebck.com
Type: A
DNSjkyyolccxfy.com
Type: A
DNStjslktadkjklb.com
Type: A
DNSkuwkdqstblavept.com
Type: A
DNSduhjqituiokycypi.com
Type: A
DNScuhbjlgw.com
Type: A
DNSdxktegertgbgeeoi.com
Type: A
DNSkcilhmepervm.com
Type: A
DNSrjbejalpcsghdm.com
Type: A
DNSgbcpynphvropsyu.com
Type: A
DNSlorwmtrf.com
Type: A
DNSovtindng.com
Type: A
DNSxdyowsheht.com
Type: A
DNSoyxmxbsppuucbtiwm.com
Type: A
DNSycmusvulvknohnbwhvp.com
Type: A
DNSocvqccdhenkjs.com
Type: A
DNSrmjkunxkbcrsltbc.com
Type: A
DNSbmjvrxrqpkiwdrdv.com
Type: A
DNShllcololi.com
Type: A
DNSmchpmdywgs.com
Type: A
DNSjycxmcdof.com
Type: A
DNSclkcdjjmyylwib.com
Type: A
DNSnxhdmugxeiht.com
Type: A
DNSpnfnkahiocdseewyen.com
Type: A
DNSmuabyljiutasgqjedl.com
Type: A
DNSejfrcfwdbsaahtdt.com
Type: A
DNSfmjboahxkasxdl.com
Type: A
DNSmfnaqngqorgbxbnsc.com
Type: A
DNSbmaucdrfpmnh.com
Type: A
DNSvpwxxqwcnvdrxpc.com
Type: A
DNSwjpsxawqxomokepfbw.com
Type: A
DNSapbhwiohxqbvoxlumdh.com
Type: A
DNShjvlshecwshpfxwfl.com
Type: A
DNSfijdmkqvralmgorinlc.com
Type: A
DNSkjpsjoxqsutgewlrah.com
Type: A
DNSgwnppapgwhntidegx.com
Type: A
DNSbseboouatanfddgbrdv.com
Type: A
DNSbmjjksysowdwmoy.com
Type: A
DNShwruujnk.com
Type: A
DNSqwmqyrcvkseynvrgdnv.com
Type: A
DNShlrsxjdakvl.com
Type: A
DNSrmdmqetbpbpgpufhql.com
Type: A
DNSlpvdauemfexnvoyh.com
Type: A
DNSmhuvivlyndmsx.com
Type: A
DNShqskceeltysbbnc.com
Type: A
DNSayketyjlsaeu.com
Type: A
DNSevrlsscrxvmd.com
Type: A
DNSugkrxtjrlfbxmakmt.com
Type: A
DNShllnakmxmgoyh.com
Type: A
DNSdfalxqubjhl.com
Type: A
DNSoyuqibrjowbfmvj.com
Type: A
DNSgaqqerty.com
Type: A
DNSupnsdndflqokigybdr.com
Type: A
DNSlabxpyvjtwuiijwghie.com
Type: A
DNSvcssgidqhxkar.com
Type: A
DNSbvqdvfihwnaja.com
Type: A
DNSyxiibnav.com
Type: A
DNSfmqegimr.com
Type: A
DNSlpivbutq.com
Type: A
DNSkvfkfxakmqoof.com
Type: A
DNSyembvgbgmdipfwjmd.com
Type: A
DNSxtbwxayxxvqpspo.com
Type: A
DNSnqnyteqxqgqohvco.com
Type: A
DNSemxwjwdcb.com
Type: A
DNSwacwpxqx.com
Type: A
DNSgrbfrnxxej.com
Type: A
DNSfvkcrcflhy.com
Type: A
DNSptvaolhg.com
Type: A
DNSjhfykbugtthmdkgga.com
Type: A
DNSpbdlsfkjrxclqjo.com
Type: A
DNSlwnggpwijlvyagmu.com
Type: A
DNSvdbtvdpujtfhwa.com
Type: A
DNSccylbclg.com
Type: A
DNSwehtwbqu.com
Type: A
DNSlehmgspxp.com
Type: A
DNSdwksmbrq.com
Type: A
DNSxdtfqohfbskcgxameg.com
Type: A
DNSiylelocfjsj.com
Type: A
DNScgwootylkoyxe.com
Type: A
DNSsthspflawbhacxp.com
Type: A
DNSnqgsmrbkwvnifdyost.com
Type: A
DNSgunqwxgyrl.com
Type: A
DNSxmlonthptunynnxf.com
Type: A
DNSdfvxuvljbykia.com
Type: A
DNSpacffcnx.com
Type: A
DNScroxxnrtvrqt.com
Type: A
DNSvlglwuyqoxjn.com
Type: A
DNSersbvvdxamjotwpm.com
Type: A
DNSkavkwpjdndsk.com
Type: A
DNSogmwrgryk.com
Type: A
DNSwgvmlfyygec.com
Type: A
DNSssclrhiimfeodm.com
Type: A
DNSgqnoupteuivrwte.com
Type: A
DNSkyskhoopsmkbmenau.com
Type: A
DNSlyvxrtpkchmddb.com
Type: A
DNSslvmktdpxdd.com
Type: A
DNSfmdjnmskmjhjq.com
Type: A
DNSaprocqhqmmkl.com
Type: A
DNSowerubvhcinavarinm.com
Type: A
DNSgtiswnukb.com
Type: A
DNSydgsadpgvne.com
Type: A
DNSkdjsnsre.com
Type: A
DNSotdvlbjeucwyqkfbn.com
Type: A
DNSwknfjeopkdj.com
Type: A
DNSmqojcxmnnxy.com
Type: A
DNStwwrktawwgpito.com
Type: A
DNSijfwbyvcirepgd.com
Type: A
DNSjhrqfnrlpyvo.com
Type: A
DNSyoxbjnpkmkjirj.com
Type: A
DNSmxgainbmtvariv.com
Type: A
DNSlyxbotuappfreadkfk.com
Type: A
DNSgmsxrgagrfgivh.com
Type: A
DNSikkjjgbqgts.com
Type: A
DNSxktepjxakoyq.com
Type: A
DNSixwnsfmyg.com
Type: A
DNSfkcfkcygpldjcr.com
Type: A
DNSuoidxmhugvidc.com
Type: A
DNSgdekatkjjihi.com
Type: A
DNSoptiidevdabtlewjd.com
Type: A
DNSsrjkrxvxmkuql.com
Type: A
DNSvilapacdnnodhsehneh.com
Type: A
DNSpgnpuktvbnmrybjsv.com
Type: A
DNSlsvnoumbqcsjl.com
Type: A
DNScqvylephudwsuqjhge.com
Type: A
DNSdledwgrxiiqspx.com
Type: A
DNSveymnlvyoknk.com
Type: A
DNSovhlfqcpfxoyjgjb.com
Type: A
DNSkvcovjrpsb.com
Type: A
DNSpgtujjyovgffyfrn.com
Type: A
DNSntikqcjtehpvih.com
Type: A
DNSxuajockq.com
Type: A
DNSguifymdmxj.com
Type: A
DNSfuogcmhewqer.com
Type: A
DNSdxxteubknwecsdutlp.com
Type: A
DNSbltolwbwychlyt.com
Type: A
DNSodcenmfimwibhrfvxxy.com
Type: A
DNSxnttexmtc.com
Type: A
DNSycvmwjae.com
Type: A
DNSlybfxrtkcdkbbqr.com
Type: A
DNSjjdvasey.com
Type: A
DNSnbkqygsfvri.com
Type: A
DNSmktxegrucbkv.com
Type: A
DNSapkdwbwdpickk.com
Type: A
DNSxirrjlpllrcosfqsf.com
Type: A
DNSvrvfonqdkfjo.com
Type: A
DNSuuofllccd.com
Type: A
DNStnqtdfodepctna.com
Type: A
DNSiqhafgpvsrj.com
Type: A
DNScjagpjgd.com
Type: A
DNSlyftposyknpigp.com
Type: A
DNSrwcdljyemxplouufjvd.com
Type: A
DNSnhcdrnwpsasnaar.com
Type: A
DNSsnpryjitnos.com
Type: A
DNSmbpnjenhxgcimx.com
Type: A
DNSdnqjposxrclhqplwli.com
Type: A
DNSasdldoqoolcgm.com
Type: A
DNSnvgmdyabspq.com
Type: A
DNSqxqkdvwayhengjqm.com
Type: A
DNSyxkhvhehtjfoqrnedi.com
Type: A
DNSjnjjlojgnvxesr.com
Type: A
DNSsrvmkdeaerccaffs.com
Type: A
DNSnxxuwtws.com
Type: A
DNSoexdjxjdoiplmxfybbm.com
Type: A
DNSavxvatwmxwbyiepwmwo.com
Type: A
DNSqglhlsyskvufb.com
Type: A
DNSjkgvbneenmrbklortr.com
Type: A
DNSnfbodxdevgpjba.com
Type: A
DNSadvvpbrtyw.com
Type: A
DNSmioqhqvmduqicvoey.com
Type: A
DNSrgrtvwsmalhmx.com
Type: A
DNSeipvatwwexl.com
Type: A
DNSltrpfybf.com
Type: A
DNSybgpdikdudmdfr.com
Type: A
DNSluvrqdhavhxcbtc.com
Type: A
DNSyctgocejemh.com
Type: A
DNSuehhvrdnuc.com
Type: A
DNSilpvrpxwfauqaxyq.com
Type: A
DNSxlqaburwns.com
Type: A
Flows TCP192.168.1.1:1039 ➝ 94.126.178.24:443
Flows TCP192.168.1.1:1041 ➝ 195.22.26.232:443
Flows TCP192.168.1.1:1043 ➝ 166.78.62.91:443
Flows TCP192.168.1.1:1044 ➝ 86.124.164.25:443
Flows TCP192.168.1.1:1045 ➝ 5.152.205.194:443
Flows TCP192.168.1.1:1046 ➝ 173.194.125.67:80
Flows TCP192.168.1.1:1047 ➝ 95.141.36.218:443
Flows TCP192.168.1.1:1048 ➝ 195.22.26.232:443
Flows TCP192.168.1.1:1049 ➝ 176.31.62.76:443
Flows TCP192.168.1.1:1051 ➝ 195.22.26.232:443
Flows TCP192.168.1.1:1053 ➝ 195.22.26.232:443
Flows TCP192.168.1.1:1056 ➝ 86.124.164.25:443

Raw Pcap

Strings
CC
.
\
 
...
_.
7
\.

    
(0..255)
0&C-Quellcode
< 0x&00
1in &neue Datei einf
2&Text suchen...	Strg+F
3&Hex-Werte suchen...	Strg+Alt+X
4Text e&rsetzen...	Strg+H
5Hex-Werte &ersetzen...	Strg+Alt+H
6&Kombinierte Suche...
7Ganze &Zahl suchen...
8&Gleitkommazahl suchen...
8u	e
9Text&passagen suchen...
- abort() has been called
ais, SVP!
Alle &minimieren
%Alles aus&w
&Alle schlie
Alle spe&ichern...
Als &Jokerzeichen werten:
Als Partitionsanfang interpretieren
AMarkierung &l
AMicrosoft Visual C++ Runtime Library
.Anor&dnung als Projekt speichern...
A&NSI-ASCII
&Ansicht
A&nzeigen
April
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
Au&fspalten
August
Ausblendungen &verewigen
&Ausf
&Ausschneiden...	Strg+X
Auswahl au&fheben	Esc
Bates-&Numerierung...
b&Daten-Dolmetscher...	Alt+F5
&Bearbeiten
&Bed.: Offset mod
&Beenden	Alt+F4
berblick erweitern...	F10
berblick neu einlesen
&Bereich:
bereinander
&Beschreibung...
\&Block festlegen...
BMar&kierung aufsuchen	Strg+K
Button
-&Byteweise (8 Bit)
'&Byteweise (8 Bit)
c&Disk 
C]	f
&Chinese, please!
cken e&xtrahieren...
ck	Strg+
CONIN$
CONOUT$
CPositions-&Manager...	Strg+M
- CRT not initialized
-]	d
	]}	d
&Datei
Datei-&
<Datei&anfang	Strg+Pos1
Datei-&Container
=Datei&ende	Strg+Ende
Datei-&Tools
&Daten-Dolmetscher
&Datensatz-Darstellung...
D&Blockanfang	Alt+Strg+Pos1
dddd, MMMM dd, yyyy
December
Die folgende Gleitkommazahl wird ge&sucht:
Die folgenden Hex-Werte werden ge&sucht:
Disk-T&ools
< &DoD
DOMAIN error
&Doppelte Zeilenabst
&Double, 8 Bytes
Drucken
d&Zeilenanfang	Pos1
EBloc&kende	Alt+Strg+Ende
Edit
/&Editoranzeige	Alt+
&Eigenschaften...	Alt+
 &einf
+Einfg
&Einsehen	
en...
&English, please!
en	Strg+Q
en	Strg+W
$&Entfernen...	Entf
E&spa
&Externe Programme
Externe &Virenpr
&Extras
eZei&lenende	Ende
+F10
&Falldaten
f&ANSI-ASCII
FD&rucken...	Strg+P
February
&Fenster
&Fenster-Manager...
&Fenster synchronisieren
ffnen...
ffnen...	Alt+F9
ffnen...	F9
ffnen...	Strg++
&ffnen...	Strg+O
ffneten Fe&nstern suchen
- floating point support not loaded
Floa&t (Single), 4 Bytes
&Fran
&Freien Speicher extrahieren...
Freien Speicher &hervorheben
&Freien Speicher initialisieren...
#&freigeben...
Friday
fung...
Gd,P
&Gehe zum
gen...
gen	
gen...	Strg+V
ger &interpretieren
ger klonen...	Strg+D
g&IBM-ASCII
;Globale Suche f&ortsetzen	F4
G;,P
&GREP-Hex
                                 H
         (((((                  H
H&Allgemein...	F5
&Hash-Datenbank...	
h&Codepage...
,&Hex-Werte	Strg+
         h((((                  H
HH:mm:ss
&Hilfe
hlen	Strg+A
&Horizontal
hren	Strg+E
IDa&ten modifizieren...	Strg+T
Image als Datentr
In allen ge
&In Datei drucken
&Informationsspalte
(in &neue Datei	Strg+
I&taliano, per favore!
i&Unicode (UCS-2LE)
January
&Japanese, please!
July
J&Umrechnung...	F8
June
jUnicode (UCS-2&BE)
KDezimal / Hexadezimal
kernel32
KERNEL32.DLL
Konve&rtieren...	Strg+R
k&Sicherheit...
LHexadezimal / IBM-ASCII
&Lizenzstatus/Upgrade
&Long Double (Extended), 10 Bytes
March
mDat&ei-
&MFT-Records initialisieren...
MHexadezimal / ANSI-ASCII
MM/dd/yy
Monday
mscoree.dll
MS Shell Dlg
&Navigation
n&Datentr
nderte speichern...
&Neu...	Strg+F8
&Neu...	Strg+N
&Newsletter
N|	g
ngig...
ngig	Strg+Z
NHexadezimal / Codepage...
n&ormal	Strg+C
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
"N&ullbytes einf
Nur &innerhalb des Blocks suchen
October
oDateien retten nach &Typ...
?Offset &aufsuchen...	Alt+G
&Ohne Abfragen schlie
ol, por favor!
&Online
OPCODES	IDI_ICON1	IDI_ICON3
Optional:
&Optionen
)&Parallele Suche...	Alt+F10
Partitionsl
&Pascal-Quellcode
~&Plattenparameter eingeben...
Po&lish, please!
&Portugues, por favor!
@Position mark&ieren	Strg+I
Program: 
<program name unknown>
- pure virtual function call
q&Deinstallieren...
R6002
R6008
R6009
R6010
R6016
R6017
R6018
R6019
R6024
R6025
R6026
R6027
R6028
R6030
R6031
R6032
R6033
RAID-System zusammensetzen...
&Real, 6 Bytes
&Registerleiste
&Registrieren...
&Rekursiv l
rSeitenan&fang	Alt+Pos1
runtime error 
Runtime Error!
&Russian, please!
Saturday
{&Schablonen-Manager...	Alt+F12
schen
schen...
&Schlie
&Schlupfspeicher extrahieren...
Schlupfspeicher h&ervorheben
&Schlupfspeicher initialisieren...
!&schreiben...	Strg+B
&Schriftgr
ScrollBar
SEine S&palte weniger
September
&Setup
Sicherer &Dateiexport...
	&Sicher l
Sicherungs-&Manager...	F12
Sicherung &wiederherstellen...
SING error
&Sparse kopieren...
Spec&ialist
Speiche&r 
&Speichern	Strg+S
Speichern &unter...
sSeitene&nde	Alt+Ende
&Start-Center...	
Static
:Suche &fortsetzen	F3
&Suchen
Suche nach Gleitkommazahl
Suche nach Hex-Werten
Such&richtung:
Sunday
S&ymbole anordnen
&Symbolleiste
Synchronisieren && &vergleichen
Ta&bellen
Technischer Detailbe&richt...	
TEine &Spalte mehr
&Text extrahieren...	Strg+F10
tHash berechnen...	Strg+F2
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
Thursday
TLOSS error
Tuesday
- unable to initialize heap
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
UNur &Text-Anzeige	F7
v&Anzeige aktualisieren
&Vergleichen...
+Ver&hardlinken...
Ver&ketten...	Alt+K
Verlorene &Partitionen suchen...
Versch&melzen
&Vertikal
&Verzeichnis 
&Verzeichnis-Browser...	Strg+F5
&Verzeichnis-Browser	Strg+F7
Ver&z. replizieren...
Viewer-&Programme...	
VNur &Hex-Anzeige	Alt+F7
&Vollversion bestellen
&Vor	Strg+
W&Editier-Modus...	F6
Wednesday
&Weitere Schablonen
w&Forum
&Wortliste exportieren...
&Wortweise (16 Bit)
WUSER32.DLL
x&Homepage
X&Rechner	Alt+F8
X-Ways &Trace aufrufen
y&Inhalt	F1
Y&Initialisieren...
Z&Block verschieben...	Alt+F11
Zei&chensatz
&Zerlegen...	Alt+Z
&Zur
&Zwischenablage
                          
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
01INVLPG/LGDT/LIDT/LMSW/SGDT/SIDT/SMSW/SMSW
`02bF"
04H,=&
06PUSH
08INVD
09WBINVD
0a<T6A
0EPUSH
?	%0hM
&0Mr=4h
0sGs`&
0X$bE$
/0XM10\/
16PUSH
1%%,bML<wbaG
1D44>[IIImZZT{gf]
1EPUSH
1gps61
20\2m=
25!55:
[\2=EDS
.2&&FcPPW
2z=So>
30WRMSR
31RDTSC
32RDMSR
33RDPMC
3/7:g}|
3AT(hI
3sT0S~\
40CMOVO
41CMOVNO
42CMOVB/CMOVC/CMOVNAE
42&&FSCBT|gg_
43CMOVAE/CMOVNB/CMOVNC
44CMOVE/CMOVZ
45CMOVNE/CMOVNZ
46CMOVBE/CMOVNA
47CMOVA/CMOVNBE
48CMOVS
49CMOVNS
4ACMOVP/CMOVPE
&4az^|x
4BCMOVNP/CMOVPO
>4C@)$
4CCMOVL/CMOVNGE
4<//CZIIQs`_^
4DCMOVGE/CMOVNL
4ECMOVLE/CMOVNG
4FCMOVG/CMOVNLE
4g" D=
50PUSH
5@Ad}M
*(5lL9
5!qmBY
5>$@Xj*-
60PUNPCKLBW
60PUSHA/PUSHAD
<60%z[
61POPA/POPAD
61PUNPCKLWD
62BOUND
62PUNPCKLDQ
63ARPL
63PACKSSWB
64PCMPGTB
65PCMPGTW
66PCMPGTD
67PACKUSWB
68PUNPCKHBW
68PUSH
69++BK;;L_MMVq^^_
69IMUL
69PUNPCKHWD
6APUNPCKHDQ
6APUSH
6BIMUL
6BPACKSSDW
6CINS/INSB
6DINS/INSD/INSW
6EMOVD
6EOUTS/OUTSB
6FMOVQ
6FOUTS/OUTSD/OUTSW
6{}'>l^b
-`6mD$,
'6R~C`
71PSLLW/PSRAW/PSRLW
72JB/JC/JNAE
72PSLLD/PSRAD/PSRLD
73JAE/JNB/JNC
73PSLLQ/PSRLQ
74JE/JZ
74PCMPEQB
75JNE/JNZ
75PCMPEQW
76JBE/JNA
76PCMPEQD
77**AG77JXGGSiWW\xedc
77EMMS
77JA/JNBE
7AJP/JPE
7BJNP/JPO
7CJL/JNGE
7DJGE/JNL
7EJLE/JNG
7EMOVD
7FJG/JNLE
7FMOVQ
7GA_Z+?
;7]t%;
7|\uS(V
7VxLd<
80ADC/ADD/AND/CMP/OR/SBB/SUB/XOR
81ADC/ADD/AND/CMP/OR/SBB/SUB/XOR
81%%FC44O^LLXzee`
82JB/JC/JNAE
83ADC/ADD/AND/CMP/OR/SBB/SUB/XOR
83JAE/JNB/JNC
84JE/JZ
84TEST
85JNE/JNZ
85TEST
86JBE/JNA
86XCHG
87JA/JNBE
87XCHG
8AJP/JPE
8BJNP/JPO
8CJL/JNGE
8DJGE/JNL
8EJLE/JNG
8FJG/JNLE
8qf$)`
@8S@ym
90NOP/XCHG
90SETO
91SETNO
92SETB/SETC/SETNAE
93SETAE/SETNB/SETNC
94SETE/SETZ
95SETNE/SETNZ
96SETBE/SETNA
97SETA/SETNBE
98CBW/CWDE
98SETS
99CDQ/CWD
99sbUI
99SETNS
9ACALL
9ASETP/SETPE
9BD9FSTCW/FSTENV
9BDBE2FCLEX/E3FINIT
9BDDFSAVE/FSTSW
9BDFE0FSTSW
9BFWAIT/WAIT
9BSETNP/SETPO
9CPUSHF/PUSHFD
9CSETL/SETNGE
9DPOPF/POPFD
9DSETGE/SETNL
<9dsU(|
9ESAHF
9ESETLE/SETNG
9FLAHF
9FSETG/SETNLE
9++KXDDLu_^N
9NKs.7
9,,+pYY<
9s,V4R
A0PUSH
A4MOVS/MOVSB
A4SHLD
A5MOVS/MOVSD/MOVSW
A5SHLD
*|A6)c
A6CMPS/CMPSB
A7CMPS/CMPSD/CMPSW
A8PUSH
A8TEST
A9TEST
AASTOS/STOSB
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
ABSTOS/STOSD/STOSW
acb]`h`
ACLODS/LODSB
ACSHRD
ADLODS/LODSD/LODSW
ADSHRD
ADVAPI32.dll
AESCAS/SCASB
AeZOsh
AFIMUL
AFSCAS/SCASD/SCASW
_a_jXbX
A;L$,|
aP\f1/#
a&:QO)
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
*!A.t%
August
AVIBuildFilterA
AVIFIL32.dll
B0CMPXCHG
B1CMPXCHG
B6MOVZX
B7MOVZX
BABT/BTC/BTR/BTS
 Base Class Array'
 Base Class Descriptor at (
__based(
BeginPaint
BEMOVSX
BFMOVSX
bgcvO^O
BGM-#iU
BitBlt
bLD.w,<
C0$$J<..NN==SbPOXua`]
C0RCL/RCR/ROL/ROR/SAL/SAR/SHL/SHR
C0XADD
C1%%K@10OTCCTkXWY
C1RCL/RCR/ROL/ROR/SAL/SAR/SHL/SHR
C1XADD
C5((LL;;QjWVW
C7CMPXCHG8B
C8BSWAP
C8ENTER
C9LEAVE
cA\/}@
__cdecl
CEINTO
CeZ3jo
C;;faMLL
CFIRET/IRETD
c!-$[H
 Class Hierarchy Descriptor'
CL)d/#
CloseHandle
__clrcall
~cMY<_ <_
completed
 Complete Object Locator'
Component Categories
ConsoleWindowClass
`copy constructor closure'
CorExitProcess
CreateBitmapIndirect
CreateCompatibleDC
CreateEventA
CreateFileW
CreateIcon
CreateSolidBrush
CreateThread
,cRNHI	
[`c&ttt
cx}1MJ1
CXx$W'k
Cz<rpf
?D08T!(
D$0;D$
D0RCL/RCR/ROL/ROR/SAL/SAR/SHL/SHR
D1PSRLW
D1RCL/RCR/ROL/ROR/SAL/SAR/SHL/SHR
D2PSRLD
D2RCL/RCR/ROL/ROR/SAL/SAR/SHL/SHR
D3PSRLQ
D3RCL/RCR/ROL/ROR/SAL/SAR/SHL/SHR
D7XLAT/XLATB
D8F***
D8PSUBUSB
D$8RPj
D9F***
D9PSUBUSW
DAF***
@.data
DBF***
DBPAND
DCF***
DCPADDUSB
dddd, MMMM dd, yyyy
DDF***
ddJ(dhc.
DDPADDUSW
=ddUtbN
December
DecodePointer
DEF***
`default constructor closure'
DefWindowProcA
 delete
 delete[]
Delete
DeleteCriticalSection
DeleteDC
DeleteMenu
DeleteObject
DestroyMenu
DestroyWindow
'dF)8B$
DFF***
DFPANDN
D\FV"J
;/##D:,,KH88Q\JIXnZZ^
D,!!K<--LP==MjUUP
D^LfbH
:/##D;--LM=<ScPPZwcb`
D$tj@P
@dTX44
DUG$ORE :
`dynamic atexit destructor for '
`dynamic initializer for '
E0LOOPNE/LOOPNZ
E1LOOPE/LOOPZ
E1PSRAW
E2LOOP
E2PSRAD
E3JCXZ/JECXZ
E5PMULHW
E8CALL
E8PSUBSB
E9PSUBSW
__eabi
ECPADDSB
EDPADDSW
Edy$v,
EFPXOR
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
!$EI, 
E,!!J9++LI88M`LLPu``T
EJLmWeW
Ellipse
	Em=,T@$	
EnableMenuItem
EncodePointer
EndPaint
EnterCriticalSection
EnumDesktopsA
E[Pw-g
EqxCqT
et:Z0\}
){eUOL
ewiV+9S
ExitProcess
ExitThread
)!!::--F
F0LOCK
F1PSLLW
F2A6REPNE
F2A7REPNE
F2AEREPNE
F2AFREPNE
F2PSLLD
F36CREP
F36DREP
F36EREP
F36FREP
F3A4REP
F3A5REP
F3A6REPE
F3A7REPE
F3AAREP
F3ABREP
F3ACREP
F3ADREP
F3AEREPE
F3AFREPE
F3PSLLQ
F5PMADDWD
F6DIV/IDIV/IMUL/MUL/NEG/NOT/TEST
/F77Dta`Z
F7DIV/IDIV/IMUL/MUL/NEG/NOT/TEST
F88MoYYL
F8PSUBB
F9PSUBW
FA;ND5
FAPSUBD
__fastcall
FCPADDB
[}`F)D
FDPADDW
February
FEDEC/INC
FEPADDDP(
FFCALL/DEC/INC/JMP/PUSHP00LLDT/LTR/SLDT/STR/VERR/VERW
FileTimeToLocalFileTime
FileTimeToSystemTime
FileType
FillRect
FindResourceA
FindWindowA
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
F<opbB
ForceRemove
FreeEnvironmentStringsW
FreeResource
Friday
`FUjG4
fU,!W	
` Fy,q
?g|[@}
*GC4H5
GC@#w?g
GDI32.dll
GE>MfUtj
GetACP
GetActiveWindow
GetClientRect
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetCPInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDlgCtrlID
GetDlgItem
GetEnvironmentStringsW
GetFileAttributesA
GetFileSecurityA
GetFileType
GetLastActivePopup
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessWindowStation
GetStartupInfoW
GetStdHandle
GetStockObject
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
GetUserObjectInformationW
GetWindowLongA
GGGz000)```
GlobalAlloc
GlobalLock
GlobalUnlock
^g(W#|#
h~0Rpc
H4''LC33NVDDRkXWV}hh[
H6))LG66N^KKRu``W
Hardware
Hatch brush background is OPAQUE
Hatch brush background is TRANSPARENT
H:\communication\pipes\int\devmode.pdb
HeapAlloc
HeapCreate
HeapFree
HeapReAlloc
HeapSetInformation
HeapSize
h@et:l#
HH:mm:ss
H=..MXEENzdcS
HqX%u=
	h;u\|
h=yD^%
+i8QVO
/I99>dQQKvbaV
IIIa((('
IIIe555)
@I[_m&H
Information
InitializeCriticalSectionAndSpinCount
Interface
InterlockedDecrement
InterlockedIncrement
InvalidateRect
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
`ITI7 
j7j3j	j
January
jIt+!g2
j@j ^V
j;`\NH
j	r,b;UU
jXhpbB
#jXP8K
~}JZu7
Kb|=HQ
_kbvWh
KERNEL32.dll
+^KJ?}hgP
KKKraaa
KksFk+
:klJwV
.KmOz-
]=l#;'{
LCMapStringW
LeaveCriticalSection
l!%{F$ A6t
@<..LfRRQ
LineTo
L$@+L$43
	=Ln?<
ln*kysz<
LoadLibraryA
LoadLibraryW
LoadMenuA
LoadResource
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
LockResource
L$@Qj(P
lstrlenA
L$tj@Q
L$z%_	
M9H$D 
m9Xvg6
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
MessageBeep
MessageBoxA
MessageBoxW
MM/dd/yy
Monday
MoveToEx
MPR.dll
MultiByteToWideChar
N;8!y]
NdL2vt
 new[]
+!NF4G
NGi,>JQ
N<M5"G
N^NpO^O
NoRemove
November
(NUJfBD
OB#]yX
October
o@g+/G5
oIUdlX4#I|
O/$$L>//LQ>>LiTTN
`omni callsig'
O^O^O^O
~~~+oooQDDDN
OpenProcessToken
operator
(OqDEu
O,<vT(
o;Y9l'
(p<4K7
PA<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
p'ALK8
%,pa:N_
__pascal
}\!PJ2
`placement delete closure'
`placement delete[] closure'
Pooas[
PostMessageA
PostQuitMessage
PPPPPPPP
p$Rll1
__ptr64
P,weB'2
P)z5<P)
.Q9Uu)
qdsK{pya@4
q '<Ll`ha
Q@'Ml(x`
qPX_4s
QueryPerformanceCounter
R1cFE9DA
R(_aZ4
`.rdata
ReadConsoleInputA
ReadFile
RealizePalette
Rectangle
ReleaseDC
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
      <requestedPrivileges>
__restrict
RjyJP!
}rntQKI
RtlUnwind
rUNb-46
S4L"]p
S5BE4d
Saturday
`scalar deleting destructor'
    </security>
    <security>
SECURITY
SelectObject
SelectPalette
Select your brush background.
September
SetBkColor
SetConsoleMode
SetEvent
SetFilePointer
SetHandleCount
SetLastError
SetMenu
SetPixel
SetStdHandle
SetUnhandledExceptionFilter
SetWindowContextHelpId
SetWindowLongA
SHLWAPI.dll
sIY:!aZ
SizeofResource
Software
s?qTHG 
^SSSSS
__stdcall
`string'
StrNCatA
Sunday
!+`suz
SYSTEM
SZ"["y
<:t0f;#L@
T4,:|+
T4~2Tj$
%}t4aD
TEqhKQ@o
TerminateProcess
TextOutA
__thiscall
!This program cannot be run in DOS mode.
thread
Thursday
Tj3$\&T
< tK<	tG
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t-l|^T3
T$ QRSP
T$@Rj j
/T#r}n
  </trustInfo>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
t"SS9] u
T@S%T|
t tJfym
t$<"u	3
Tuesday
;t$,v-
 Type Descriptor'
TypeLib
`typeof'
}U3kZf
u|C,ic
`udt returning'
UDv:}&a
?\/UFC
&u@J+{b
[u(=MXS	\Or
__unaligned
UnhandledExceptionFilter
UpdateColors
UQPXY]Y[
URFdu5
URPQQh@X@
User32
USER32.dll
uTVWhvG@
@\\v-@
;v_-0Y^
}V4qZ|$
V5)AB&
`vbase destructor'
`vbtable'
`vcall'
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
`vftable'
`virtual displacement map'
v	N+D$
w$8h;J8
$W&|95S
WaitForSingleObject
Wednesday
|W$f19
w`gKI~
WideCharToMultiByte
,WI<P	
WNetConnectionDialog
WriteConsoleW
WriteFile
W<u\TZ
w+X"g?
Wxy/utx
@x4P<G.
X$gT-,
_	XO`5
XXXiJJJD666
XYZHy}y
y)0x]kf
y8W&t^
YJNd4H""
YOp$R@
y!(W%$i_
Y`y1,W-,
yZNmo,
>$z,:%
zEPk;b
}:Z>@hn_K2
zTs4:\D
`z]wL)
|Z~]}xc