Analysis Date2015-05-06 06:53:24
MD5ead49bb344082ade12998c2e039142c9
SHA143d2f6cc9941c96b8c4f709f870f9e4213236e10

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 901bef219a5c36f84f30e90c86f8bd60 sha1: 306ac883029056e6a3a74b5aa6ae13349028e3ef size: 237568
Section.data md5: 620f0b67a91f7f74151bc5be745b7110 sha1: 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d size: 4096
Section.rsrc md5: 2b1ea7901c5bf1ef0f440a6cf2dd6027 sha1: 82bfa34c84363e5da1d187539513049ef790b204 size: 151552
Timestamp2014-10-15 11:34:00
VersionProductVersion: 1.00
InternalName: k55
FileVersion: 1.00
OriginalFilename: k55.exe
ProductName: Project1
PackerMicrosoft Visual Basic v5.0
PEhash4557f83d2506bc0af05c5a3a6a478856ee579138
IMPhash9d59a496b02fd17a3f7fb83ce741529a
AVAd-AwareGen:Variant.Zusy.115997
AVAlwil (avast)Malware-gen:Trojan-gen:Win32:Malware-gen:Win32:Trojan-gen
AVArcabit (arcavir)Gen:Variant.Zusy.115997:Gen:Variant.Kazy.147434:Gen:Variant.Zusy.74789
AVAuthentiumW32/S-cb66fa92!Eldorado
AVAvira (antivir)TR/Dropper.Gen
AVBitDefenderGen:Variant.Zusy.115997
AVBullGuardGen:Variant.Zusy.115997
AVCA (E-Trust Ino)Win32/Tnega.JbGZYB
AVCAT (quickheal)Backdoor.VB.r3
AVClamAVno_virus
AVDr. WebTrojan.PWS.Siggen1.29282
AVEmsisoftGen:Variant.Zusy.115997
AVEset (nod32)Win32/AutoRun.VB.BJB worm
AVFortinetW32/VB.BJSY!tr
AVFrisk (f-prot)W32/Trojan-Gypikon-based.DM2!Ma
AVF-SecureGen:Variant.Zusy.115997
AVGrisoft (avg)Worm/Generic3.PYT
AVIkarusWorm.Win32.AutoRun
AVK7Riskware ( 0040eff71 )
AVKasperskyTrojan-Banker.Win32.Bancos.xat
AVMalwareBytesno_virus
AVMcafeeGenericR-CIK!EAD49BB34408
AVMicrosoft Security EssentialsTrojan:Win32/Dynamer!ac
AVMicroWorld (escan)Gen:Variant.Zusy.115997
AVPadvishTrojan.Win32.OtranVB.B
AVRisingno_virus
AVSophosMal/VB-MW:Mal/StartP-A
AVSymantecno_virus
AVTrend MicroPossible_Otorun8
AVTwisterW32.AutoRun.VB.BJB.fphe
AVVirusBlokAda (vba32)Backdoor.VB

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\GenericHost\Policy ➝
/w!2.&;&c;&c~<_>-s<,!,rg*!`h<_c,>b*!,fd,!*f@`>k<\>,!@`>*k~@+>\kk-@-<f*>`k@\4\>f->\kd`!*f@+>*k<->_!@->,k~g_!_hg`!_hg\!\h<-@,z<\c_>~b*!`f<_c_><\>+!f`>kb_!*f~<c>b+!*fb!,f0_@\!a,a\ad*!f@>\k<_>,!@,>-k\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\wkssvc
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\~DFBC89.tmp
Creates Filec:\windows\4bbd7.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates Process"c:\windows\4bbd7.exe"
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!

Process
↳ "C:\WINDOWS\system32\cmd.exe" /c c:\windows\9054b.exe

Creates Processc:\windows\9054b.exe

Process
↳ "c:\windows\4bbd7.exe"

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell ➝
Explorer.exe , e32c2.exe\\x00
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\GenericHost\Policy ➝
/w!2.&;&c;&c~<_>-s<,!,rg*!`h<_c,>b*!,fd,!*f@`>k<\>,!@`>*k~@+>\kk-@-<f*>`k@\4\>f->\kd`!*f@+>*k<->_!@->,k~g_!_hg`!_hg\!\h<-@,z<\c_>~b*!`f<_c_><\>+!f`>kb_!*f~<`c,>b,!*fb*!`f0+@`!a_a`ad+!\f@_>_k<\>!@_>+k\\x00
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b4x2b ➝
4bbd7.exe\\x00
RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Mystatus\status ➝
nowfuck\\x00
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FilePIPE\wkssvc
Creates FileC:\WINDOWS\e32c2.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\~DFFFE4.tmp
Creates Filec:\windows\9054b.exe
Creates Process"C:\WINDOWS\system32\cmd.exe" /c c:\windows\9054b.exe

Process
↳ c:\windows\9054b.exe

RegistryHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b4x2b ➝
4bbd7.exe
Creates FilePIPE\lsarpc

Network Details:


Raw Pcap

Strings
B
b
KK[[
 
.
.
 
.
.
* - *
* (*)
* (*) - *
* (*) -- *
040904B0
1&'.
, 1, 0
1.00
11111111111111111111111
22222222222
6a@!2&coe!2&(=c6a@
A+0160
Aaz3m\AppData\Local\Mic
Aaz3m\AppData\Local\Micro
Access to this key is denied
action=Open
addapi
Adodb.Stream
@*\AE:\Other\my files\55\tools\backup2\Project1.vbp
@*\AE:\Other\my files\55\tools\backup\Project1.vbp
[ALT]
Aout(
API-Guide test program
\AppData\Local\Micro
ATL:
Atpos="top" sheet="common">
[autorun]
autorun.inf
AUTORUN.INf
A" YScrollable="true" l
@az3m\AppData\Local\Micro
BABA
Bad Key Name
bbbvc
%block%
[BS]
Button
 /c 
$)c1"r.?T1"r-gtGPQWnY!2&w$wpm1coevbn
C*\AE:\Other\my files\55\Project1.vbp
Can't Open Key
Can't Read Key
Can't Write Key
[CAPS]
cconvwndbase
* Chat
Click
Close
cmd.exe
cmdtimer
Connecting to Yahoo! Chat
Content-Type: application/x-www-form-urlencoded
.cRegistry
[CTRL]
custom
CUSTOM
cY,vn&coeqttttu6pl5pl5GPQibqpl5vbn
Debu
default
[Del]
document
Documents and Settings\
[DOWN]
download
/e, 
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:_?/WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/QlUzxcqwtam7pl5dp06a@=#BfW"{Sh_?/|p*(=cw$ww$wpm1qwt!2&}'$pm1w$w6a@zxcpl5qwt_?/aP0vbncoe9v4pm1=#B@+xzxcqe2pm1=#Bc>:w$-pm1ibq(=c!2&zxcpl5qwt=#B.?T13s!2&zxcpl5qwt6a@_?/
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:_?/WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/QlUzxcqwtam7pl5dp06a@=#BfW"{Sh_?/|p*(=cw$ww$wpm1qwt!2&}'$pm1w$w6a@zxcpl5qwt_?/mop6a@13s
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:_?/WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/QlUzxcqwtam7pl5dp06a@=#BfW"{Sh_?/|p*(=cw$ww$wpm1qwt!2&}'$pm1w$w6a@zxcpl5qwt_?/QlUzxcqwtqe2pl59v4pl5qwt
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:_?/WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/QlUzxcqwtam7pl5dp06a@_?/|p*(=cw$ww$wpm1qwt!2&}'$pm1w$w6a@zxcpl5qwt_?/%<8pl5qe2zxcibqzxcpm16a@_?/WnYvn&6a@!2&pm1vbn
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:_?/WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/QlUzxcqwtam7pl5dp06a@_?/|p*(=cw$ww$wpm1qwt!2&}'$pm1w$w6a@zxcpl5qwt_?/&c$(=cqwt
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:_?/WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/qu6pm1w$wpl5|pq|pq
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:_?/WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/v^apm1qwtpm1w$wzxcibq]eEpl56a@!2&
]eEcWvc>:l|P@B*cDc.?T|p*$)ccDc@B**,!$)c|p*]eEaP0fW"c>:_?/WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/*,!vn&6a@!2&coe!2&(=c6a@
]eEcWvc>:l|P@B*|p*_%M&c$&c$c>:fW"{Sh@B*_%MWnYc>:&c$_?/WnYpl5mop!2&dp0coew$wpm1_?/l|Pcoequ6pl5pl5_?/13scoe9v4pm1w$w
]eEcWvc>:l|P@B*|p*_%M&c$&c$c>:fW"{Sh@B*_%MWnYc>:&c$_?/WnYpl5mop!2&dp0coew$wpm1_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/aP0qwt!2&pm1w$wqwtpm1!2&=#Bc>:w$-13sqe2pl5w$wpm1w$w_?/*,!coezxcqwt
ejra
<elem
EnableLUA
[End]
{END}
[Ent]
Error
.exe
%exe%
%explore%
explorer
Explorer
[F1]
[F10]
[F11]
[F12]
[F2]
[F3]
[F4]
[F5]
[F6]
[F7]
[F8]
[F9]
Failed to create registry Key: '
Failed to delete registry Key: '
Failed to open key '
Failed to set registry value Key: '
false
\Favorites\
fdffffdfffffff
file://
FILE://
FileVersion
?fname=
' for delete access
fuckauto
fuckme~~
FUCKYOUUUUUUUUUUUUU
getElementById
GetFile
getit
GetSpecialFolder
getstat
gger
*Google*
gooooz
HKEY_
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_DYN_DATA
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\generic
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Generic
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\shaaaash
HKEY_PERFORMANCE_DATA
HKEY_USERS
HKgohEY_
HKjooonEY_
[Home]
{HOME}
host
Host
hotgirl
ibqqu6pm1qe26a@zxc
IMClass
\Indian girl.avi.exe
[Ins]
InstancesOf
InternalName
internetExplorer.application
Internet Explorer_Server
Invalid Parameter
jfyttyretrsthgf
jjjj
Join Room
joon
jooon
jooooooooooon
k55.exe
kazi
KAZI
kazibaba
',Key: '
&keyword=
kiiiiii7665346dsd
kkkk
klog
[LEFT]
llll
%log%
logurl
ment f
meyl
Microsoft.XMLHTTP
mop(=cibqf88vbnpm1
MSXML2.ServerXMLHTTP
Msxml2.XMLHTTP.3.0
Name
navigate
"Nev
nnnn
open
%open%
Open
OpenTextFile
oplay=1
OriginalFilename
Out of memory
[PageUP]
[Pause]
[PD]
Poli
Policy
ProcessId
ProductName
ProductVersion
Project1
Project1.exe
QlUzxcqwt]eE!2&!2&13sGPQQlUzxcqwt]eE!2&!2&13s&c$pm1c%l(=cpm16a@!2&
QlUzxcqwt]eE!2&!2&13sGPQQlUzxcqwt]eE!2&!2&13s&c$pm1c%l(=cpm16a@!2&GPQ|pqGPQaq@
qu6!2&!2&13s(s:40C40Ct'?t'?t'?ibqam7GPQzxcqwtmoppl540C9v4pm1qwtpm1w$wzxcibq40Cqu6pl56a@!2&GPQ13squ613s
qu6!2&!2&13s(s:40C40Cvbnpm1w$w2.&;&cGPQpl5w$w9v440C9v4pm1qwtpm1w$wzxcibq40Cqu6pl56a@!2&GPQ13squ613s
quit
qwtpl5dp0mop(=cibqf88
readyState
REG_SZ
RegWrite
responseBody
responseText
result=
[RIGHT]
sadkljhfaisdfsdafa
SaveToFile
Scripting.FileSystemObject
',Section: '
send
&Send
Send an Instant Message
Send Message to Group
sendtoall
seourl
sexy
shaaaash
Shell
Shell DocObject View
shellexecute=%open%
shell\explore\command=%explore%
shell\Open\command=%open%
[Shift]
Size
SKIN
SOFTWARE\Classes\
[SPC]
Start Page
Status
StringFileInfo
SYSTEM
system32\
'&T6a@13svbnw$w'&T
[Tab]
tf(TEX
The Registry Database is corrupt!
There is more data than the buffer has been allocated to hold.
' to value: '
Translation
tttt
Type
Unable to get process snapshot
Undefined Error Code:  
[UP]
.url
useaut
v^ac>:{Sh
VarFileInfo
%vbnewline%
Visible
VS_VERSION_INFO
Webcam for*
win32_process
WinHttp.WinHttpRequest
WinHttp.WinHttpRequest.5.1
winmgmts:
WM_HTML_GETOBJECT
*,!WnYIm^*,!cDc902GPQWnYpm1w$wwvfpm1w$wIm^*,!cDc]eE{Sh{Sh%<8
WnY.?T@+x{ShQlU$)c&c$c>:_?/*,!zxcibqw$wpl56a@pl5mop!2&_?/QlUzxcqwtam7pl5dp06a@_?/|p*(=cw$ww$wpm1qwt!2&}'$pm1w$w6a@zxcpl5qwt_?/&c$(=cqwt
write
Wscript.shell
@+xaP0cDcc>:(s:40C40C
Yahoo!
YahooBuddyMain
@yahoo.com
Yahoo! Messenger Insider
Yahoo! User ID
YIMInputWindow
YImportContactsWnd
YSearchMenuWndClass
YTopWindow
*,!zxcibqw$wpl56a@pl5mop!2&GPQIm^*,!cDc]eE{Sh{Sh%<8
            />
#';;-$
(00(//
0======A=BAB0
0O`sRp<
1===A=AAAABB1
`1)F"Dkj]
1m67B3>D=
26P>5P6>D	C
33333333333333333
333LLL,
3XP\v{.
}4Mkm4
4V4{oy>v|
6}}}K7
70mA}a
72F0L6
7B!!				
7B!!%99+"
7BBBBBBBB7777
88:8:8:8:8
8BBBBBBBB;7
8BBBBBBBB;=7
8Wy(?	t
98K:ON
A95NA	>NF	F
aaa333
AAAAAAAAAAAA
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
adultkill
advapi32
advapi32.dll
A>f;B8}!
_allmul
AM[TkN
{."aPZ,Qo4
</assembly>
<assemblyIdentity
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
B&**,#B
beready
BlockInput
BringWindowToTop
:BXb+X
chkarr
_CIatan
_CIcos
_CIexp
_CIlog
_CIsin
_CIsqrt
_CItan
Class1
ClassKey
CloseHandle
CloseProgram
C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
CreateKey
CreateToolhelp32Snapshot
C:\Windows\SysWow64\MSVBVM60.DLL\3
`_^D1\
`.data
DDDDDD
DDDDDDDDD@
DDDDDDDDDDDDDD
DDDDDDDDDGpw
DeCode
decode1
Default
DeleteKey
DeleteMenu
DeleteUrlCacheEntryA
DeleteValue
<description>Project1</description>
disableit
DllFunctionCall
Drive1
Duration
e7-!fw
E\&l9H
EnableWindow
Encode
Encode1
EnumChildWindows
EnumerateSections
EnumerateValues
EnumProcesses
EnumProcessModules
EnumWindows&
Eoo/CCCx
esL]t	Q
eValueType
EVENT_SINK_AddRef
EVENT_SINK_QueryInterface
EVENT_SINK_Release
ExitProcess
ExpandEnvironmentStringsA
FindWindowA
FindWindowExA
formload
fuck_u4
fuck_u5
fYSsy9
GetAsyncKeyState
GetClassNameA
GetComputerNameA
GetDeviceCaps
GetDiskFreeSpaceA
GetDriveTypeA
GetForegroundWindow
gethostbyaddr
gethostbyname
GetKeyboardLayout
GetKeyboardLayoutNameA
GetKeyState
GetLocaleInfoA
GetLogicalDriveStringsA
GetModuleFileNameExA
GetParent
GetSystemDirectoryA
GetSystemMenu
GetTickCount
GetUserNameA
GetVersionExA
getverstr
GetVolumeInformationA
GetWindowsDirectoryA
GetWindowTextA
GetWindowTextLengthA
GetWindowThreadProcessId
GlobalMemoryStatus
gpwfV@;
G|.	)%SSS<
&GS%]Wo)%
{hhhkl
hkkkkkkkkkkkkkkkkkkkkhk
IDAT]1
I'dvy4
IHI5Qg`
iKeyCount
iLOO333
inet_addr
InternetCloseHandle
InternetGetConnectedState
InternetGetConnectedStateExA
InternetOpenA
InternetOpenUrlA
InternetReadFile
iSectCount
i\s'V*Gf
IsWindowVisible
J]~#)e
J<f;H6}!
}#j\hd.@
j\hd.@
j hx.@
JLOOwM
kernel32
Kernel32.dll
KeyExists
Keyhandle
Keyname
Killapp
Label1
lE:28B	
                level="requireAdministrator"
LMMaYV
LNN244
LockFile
LOO/5R
lstrlenA
Machine
maxcommand
maxroom
maxs2a
mciSendStringA
m/m"?1
Module1
MSVBVM60.DLL
mydecode
my file
myName
<N676PP	N
	name="Microsoft.VB6.Project1" />
NewValue
NNPPPPPPPPPPP
@#n.V!
O5]gzz
ObjectFromLresult
oleacc
OpenProcess
 osinfProject1
ParseKey
P:f;Q4}$
PostMessageA
ppaagx
PPs	,{3
PQh@*@
PQhl[A
Process32First
Process32Next
Project1
psapi.dll
pussyClose
Pv6GF7g
}-"'q*
qhrs]]t5
&@qH%t
Qj?SRP
QRh@*@
RasApi32.dll
RasEnumConnectionsA
RasGetConnectStatusA
RegCloseKey
RegConnectRegistryA
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegisterWindowMessageA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueA
RegQueryValueExA
RegSetValueExA
            <requestedExecutionLevel
        </requestedPrivileges>
        <requestedPrivileges>
Richya
RPhl[A
rsion =
RtlMoveMemory
s^?99I
SectionKey
    </security>
    <security>
SendMessageA
SendMessageTimeoutA
setclip
SetForegroundWindow
SetWindowPos
SetWindowTextA
shell32.dll
ShellExecuteA
ShowWindow
sKeyNames
sMachine
sRRRO>&Q
srtuUA
S^*S*/
sSectionKey
strarr
sValueKey
SystemParametersInfoA
TerminateProcess
!This program cannot be run in DOS mode.
Timer1
Timer2
Timer3
Timer4
tmrcommand
tmrtmp
</trustInfo>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
t-ZL!z'
u]&''i6
                uiAccess="false"
URLDownloadToFileA
urlmon
user32
uSUUT6=`P
:^;:	V
V2FHa?":
ValueEx
ValueKey
ValueType
(vA	T3@
VBA6.DLL
__vbaAryConstruct2
__vbaAryCopy
__vbaAryDestruct
__vbaAryLock
__vbaAryMove
__vbaAryUnlock
__vbaAryVar
__vbaBoolVarNull
__vbaChkstk
__vbaEnd
__vbaErase
__vbaErrorOverflow
__vbaExceptHandler
__vbaExitProc
__vbaFileClose
__vbaFileCloseAll
__vbaFileOpen
__vbaFixstrConstruct
__vbaForEachVar
__vbaFPException
__vbaFpI2
__vbaFpI4
__vbaFPInt
__vbaFpR8
__vbaFreeObj
__vbaFreeObjList
__vbaFreeStr
__vbaFreeStrList
__vbaFreeVar
__vbaFreeVarList
__vbaGenerateBoundsError
__vbaHresultCheckObj
__vbaI2I4
__vbaI2Var
__vbaI4ErrVar
__vbaI4Str
__vbaI4Var
__vbaInputFile
__vbaInStr
__vbaInStrVar
__vbaLateMemCall
__vbaLateMemCallLd
__vbaLateMemSt
__vbaLbound
__vbaLenBstr
__vbaLineInputStr
__vbaLsetFixstr
__vbaNew
__vbaNew2
__vbaNextEachVar
__vbaObjIs
__vbaObjSet
__vbaObjSetAddref
__vbaObjVar
__vbaOnError
__vbaPrintFile
__vbaPutOwner3
__vbaRecAnsiToUni
__vbaRecUniToAnsi
__vbaRedim
__vbaRedimPreserve
__vbaRefVarAry
__vbaSetSystemError
__vbaStr2Vec
__vbaStrBool
__vbaStrCat
__vbaStrCmp
__vbaStrComp
__vbaStrCompVar
__vbaStrCopy
__vbaStrErrVarCopy
__vbaStrFixstr
__vbaStrI2
__vbaStrI4
__vbaStrLike
__vbaStrMove
__vbaStrR8
__vbaStrToAnsi
__vbaStrToUnicode
__vbaStrVarCopy
__vbaStrVarMove
__vbaStrVarVal
__vbaUbound
__vbaUI1I2
__vbaUI1I4
__vbaUnkVar
__vbaVar2Vec
__vbaVarAdd
__vbaVarAnd
__vbaVarCat
__vbaVarCmpEq
__vbaVarCmpNe
__vbaVarCopy
__vbaVarDup
__vbaVarForInit
__vbaVarForNext
__vbaVargVarCopy
__vbaVarLateMemCallLd
__vbaVarLateMemCallLdRf
__vbaVarLateMemSt
__vbaVarMove
__vbaVarOr
__vbaVarSetObjAddref
__vbaVarSetVar
__vbaVarSub
__vbaVarTstEq
__vbaVarTstGt
__vbaVarTstLt
__vbaVarTstNe
__vbaVarVargNofree
__vbaWriteFile
vDefault
	version="1.0.0.0" 
verstr
VLMMMW9
vqgwh@
vValue
vwwig_
vYYYYVVZaArz
waveOutGetNumDevs
w[^[\\]b]X\}
what_thefuck
what_thefucku
WindowFromPoint
wininet
wininet.dll
winmm.dll
wn~wop
wppRRRP47V
WSACleanup
WSAStartup
wsock32.dll
wWsS7Wv
wwwwww
wwwwwwp
wwwwwwww
wwwwwwwwwwwwwp
wwwwwwwwwwwwww
wwwwwwwwwwwwwwww
ww`yw8
x`I)O;
<?xml version="1.0" encoding="UTF-8"?>
xxxx|<$(#
XXXYZX
?Y0:M_i
<Y7 m@
Z{`32l
Z{`32l:O
_/zW`W