Analysis Date2014-04-24 13:01:19
MD5a385a5159a0d616b586eaa3ff0f88a05
SHA1cb4848c2f021bd04f3560a5d1af7bb3cc4cb9751

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: fa60c9663a51883c88fddcddbc51cfa1 sha1: 4769d75729a46caad430a74b3721575ef99d0e11 size: 380928
Section.rdata md5: 5c121ab4fb7b35bcae1efc50e7deed81 sha1: 3cb599ed255bc47acfde0c7d6b3ce5110c457e19 size: 81920
Section.data md5: 942dd0090fbcf056849d9708eafc2dd4 sha1: 06624083cf954f44fb8fd998b60201644427fb92 size: 16384
Section.rsrc md5: 99f02d8450aaa8236ab4190a30a20593 sha1: f5f1bb39b4995d6bed48783dd78cb9144dbbbffd size: 28672
Section.text md5: 8698ac8ca55d4e203a97c49afea9558e sha1: d1eff5a8036f00c4d78c82798ee82dfc4ac55d72 size: 204800
Timestamp2013-06-26 07:52:04
Pdb pathc:\WSMProject\DTLSVN\CommonLibrary\branches\DTLUpg\trunk\AutoUpdater\release\DTLUpg.pdb
VersionInternalName: DTLUpg.exe
FileVersion: 1.0.1.35
CompanyName: 深圳市驱动人生软件技术有限公司
ProductName: 更新程序
ProductVersion: 1.0.1.35
FileDescription: 更新程序
OriginalFilename: DTLUpg.exe
PEhash1d032c6917ff8593e255b1b4958d281e628f8dcf
IMPhash74ae848f9f65bfdd08d59126408f2747
AVmcafeeW32/Ramnit.a
AVavgWin32/Zbot.G
AVaviraW32/Ramnit.C
AVmsseVirus:Win32/Ramnit.P
AVclamavW32.Ramnit-1

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

Creates FileC:\cb4848c2f021bd04f3560a5d1af7bb3cc4cb9751mgr.exe
Creates ProcessC:\cb4848c2f021bd04f3560a5d1af7bb3cc4cb9751mgr.exe

Process
↳ C:\Program Files\Internet Explorer\iexplore.exe

RegistryHKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit ➝
C:\WINDOWS\system32\userinit.exe,,C:\Program Files\huettqja\pbvjeqsq.exe
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_20130508_125854937.html
Creates FileC:\cb4848c2f021bd04f3560a5d1af7bb3cc4cb9751mgr.exe
Creates FileC:\Program Files\huettqja\pbvjeqsq.exe
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Program Files\huettqja\px3.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Reader9\Setup.exe
Creates FileC:\Documents and Settings\Administrator\Start Menu\Programs\Startup\pbvjeqsq.exe
Creates File\Device\Afd\Endpoint
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe\Reader 9.3\Setup Files\Setup.exe
Creates FileC:\Program Files\Internet Explorer\dmlconf.dat
Deletes FileC:\Program Files\huettqja\px3.tmp
Creates Mutex{37FFEB21-FE56-017C-F492-53D695A61D45}

Process
↳ C:\cb4848c2f021bd04f3560a5d1af7bb3cc4cb9751mgr.exe

Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\~TM1.tmp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\~TM2.tmp
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\~TM1.tmp
Deletes FileC:\Documents and Settings\Administrator\Local Settings\Temp\~TM2.tmp

Network Details:

DNSgoogle.com
Type: A
173.194.34.162
DNSgoogle.com
Type: A
173.194.34.161
DNSgoogle.com
Type: A
173.194.34.160
DNSgoogle.com
Type: A
173.194.34.174
DNSgoogle.com
Type: A
173.194.34.167
DNSgoogle.com
Type: A
173.194.34.169
DNSgoogle.com
Type: A
173.194.34.166
DNSgoogle.com
Type: A
173.194.34.164
DNSgoogle.com
Type: A
173.194.34.163
DNSgoogle.com
Type: A
173.194.34.165
DNSgoogle.com
Type: A
173.194.34.168
DNSstromoliks.com
Type: A
72.14.182.233
DNSstromoliks.com
Type: A
66.228.61.232
DNSpromoliks.com
Type: A
66.228.61.232
Flows TCP192.168.1.1:1032 ➝ 173.194.34.162:80
Flows TCP192.168.1.1:1033 ➝ 72.14.182.233:443
Flows TCP192.168.1.1:1034 ➝ 66.228.61.232:443
Flows TCP192.168.1.1:1035 ➝ 66.228.61.232:443

Raw Pcap

Strings
\/
.
\
\
  
/
:
:
/?
..i.
PK
PK
..
.
?
-
-
-
00-+  
CC
.
00-+ 
.
-e-
. 
\
-E-
-0
-0010+-0
0
-0.
00...........?- 
0
0
0
0
...
..d  .. .
....
.
""u\
{----}
R
oO#
.kS
.
S
+
F
.
;..
..
x

080403a8
1.0.1.35
%1: %2
%1 contains an invalid path.=%1 could not be opened because there are too many open files.
%1 has a bad format."%1 contained an unexpected object. %1 contains an incorrect schema.
%1 was not found.
accChild
accChildCount
accDefaultAction
accDescription
accDoDefaultAction
Access to %1 was denied..An invalid file handle was associated with %1.<%1 could not be removed because it is the current directory.6%1 could not be created because the directory is full.
accFocus
accHelp
accHelpTopic
accHitTest
accKeyboardShortcut
accLocation
accName
accNavigate
accParent
accRole
accSelect
accSelection
accState
accValue
All Files (*.*)
An unknown error has occurred.$An invalid argument was encountered.
an unnamed file
Cancel
Cannot find this file.
Check
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
CompanyName
Continue running script?
Copyright (C) 2011
Could not start print job.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.
Disk full while accessing %1..An attempt was made to access %1 past its end.
Dispatch exception: %1
DTLUpg
 DTLUpg
DTLUpg 1.0 
 DTLUpg(&A)...
DTLUpg.exe
Ejjjj
Failed to launch help.
Failed to open document.
Failed to save document.
FileDescription
FileVersion
                                 H
         (((((                  H
&Help
         h((((                  H
&Hide
Internal application error.
InternalName
Invalid filename.
jjjj
jjjjj
jjjjjj
Mail system DLL is invalid.!Send Mail failed to send message.
Mixed
MS Shell Dlg
&New 
No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.
No error occurred.-An unknown error occurred while accessing %1.
No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.
(null)
Open
OriginalFilename
Out of memory.
pixels
Please enter a currency.
Please enter a date.
Please enter a GUID.
Please enter an integer.
Please enter a number.*Please enter an integer between %1 and %2.(Please enter a number between %1 and %2.(Please enter no more than %1 characters.
Please enter a time.
Please select a button.*Please enter an integer between 0 and 255. Please enter a positive integer. Please enter a date and/or time.
Please verify that the correct path and file name are given.
ProductName
ProductVersion
Save As
Save changes to %1? Failed to create empty document.
Seek failed on %15A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.
StringFileInfo
The file is too large to open.
TODO: 
Translation
#Unable to load mail system support.
#Unable to read write-only property.#Unable to write read-only property.
Uncheck
Unexpected file format.V%1
Untitled
VarFileInfo
VS_VERSION_INFO
^(_^[]
                          
\$()\$
0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdefr
 !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
 !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
0^55<T
0-&5SB
^09~(r
0A@@Ju
0e+@Q!{SE
0SSSSS
<0/u8V3
<0/u9V3
0UUUUW
\$0UVW
0VVVVV
0WWWWW
0/wY n
&1=7{F
&1=7t%
192.168.1.35
1h$dRw
@1*IGI
1#QNAN
1#SNAN
	1u7<z
 >'2+{
24,Hm*O
%2\CLSID
%2\DocObject
2eEURQ
2If90t
%2\Insertable
\_'2kB
&2kB/+
&2kB 3
&2kBa&
&2kBa2/e
&2kBaL.
#'2kBX
'2k(^D
&2kL~w
%2\protocol\StdFileEditing\server
%2\protocol\StdFileEditing\verb\0
`=2qs@ 
|38\$ t-
3JJ-Sr
&3kBa2
{4_^]3
\$49|$,r
4JS"=[
4M-b<jjw
4Sr[FB
]%4z]`
5bmFbe*
5\@bn8~CMGp
5FUGz$
%.5{jW8
/^+5!O
[6|}s<
-6x{y)
]6?,Y~
6y*f'+
.72[VS>
}"7%7O
{7]AbV*^
7c;};T:
(7O_\VE*D
$7z7G/
8&2kBa
^89n0r
8abWbN^
8dtrRt
&8kBa-
|$8SSPQR
<8\t#;|$0v
8V+!Cc
'8~vv:>
8VVVVV
8Vyo37
%9, %8
$9F,6c
9~Htc9~
{9m)xkwH
^<9n4r
9nLtq;
^<9n`r
_,9o$r
9p t-S
9~Pu	P
9R#t:	X
9~$~!S
9^@t83
 9t$Ds
9/tE9o
\$`9t$Pr
9<\t	</t
~(9~$u
_9Ui+ 
9^@Wt;3
_ 9w$u
<A|0<Z
(a8>=HXE
A-bB:1
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Accept: */*
Accept-Encoding: gzip, deflate
ActivateActCtx
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAce
AdjustTokenPrivileges
AdjustWindowRectEx
advapi32.dll
ADVAPI32.dll
AEF{S*F
AfxControlBar80s
AfxFrameOrView80s
AfxMDIFrame80s
AfxOldWndProc423
AfxOleControl80s
AfxWnd80s
a[ ,jJ
A%Kuod
AL]Z"2kB1%
An application has made an attempt to load the C runtime library incorrectly.
Apartment
&apos;
[Arhive]Pair|app=%s upf=%s
As#Gw*Gw*~V/
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" name="DTLUpg" type="win32"></assemblyIdentity><ms_asmv2:trustInfo xmlns:ms_asmv2="urn:schemas-microsoft-com:asm.v2"><ms_asmv2:security><ms_asmv2:requestedPrivileges>
<A|S<Z
<at9<rt,<wt
- Attempt to initialize the CRT more than once.
- Attempt to use MSIL code from this assembly during native code initialization
&`{A(u
.?AUCThreadData@@
August
.?AUIAccessible@@
.?AUIAccessibleProxy@@
.?AUIAtlStringMgr@ATL@@
.?AUIBoundObjectSite@@
.?AUIDispatch@@
.?AUIEnumVOID@@
.?AUIMessageFilter@@
.?AUINotifyDBEvents@@
.?AUIOleClientSite@@
.?AUIOleContainer@@
.?AUIOleControlSite@@
.?AUIOleInPlaceFrame@@
.?AUIOleInPlaceSite@@
.?AUIOleInPlaceSiteEx@@
.?AUIOleInPlaceSiteWindowless@@
.?AUIOleInPlaceUIWindow@@
.?AUIOleWindow@@
.?AUIParseDisplayName@@
.?AUIPropertyNotifySink@@
.?AUIRowsetNotify@@
.?AUISequentialStream@@
.?AUIStream@@
.?AUIUnknown@@
.?AV_AFX_BASE_MODULE_STATE@@
.?AV_AFX_HTMLHELP_STATE@@
.?AVAFX_MODULE_STATE@@
.?AVAFX_MODULE_THREAD_STATE@@
.?AV_AFX_OLE_STATE@@
.?AV_AFX_THREAD_STATE@@
.?AVbad_alloc@std@@
.?AVbad_exception@std@@
.?AVbase_sock@@
.?AVbase_thread@@
.?AVbuffer_t@@
.?AVCAccessibleProxy@ATL@@
.?AVCAfxStringMgr@@
.?AVCArchiveException@@
.?AVCArchiveStream@@
.?AV?$CArray@VCVariantBoolPair@@ABV1@@@
.?AVCBaseFile@@
.?AVCBaseLog@@
.?AVCBasePackage@@
.?AVCByteArray@@
.?AVCClientDC@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCComCtlWrapper@@
.?AVCCommandAction@@
.?AVCCommDlgWrapper@@
.?AVCCommonDialog@@
.?AVCCommunicationAddr@@
.?AVCComObjectRootBase@ATL@@
.?AV?$CComObjectRootEx@VCComSingleThreadModel@ATL@@@ATL@@
.?AVCControlSiteFactoryMgr@@
.?AVCCtrlExcutor@@
.?AVCCtrlFile@@
.?AVCDataSourceControl@@
.?AVCDC@@
.?AVCDialog@@
.?AVCDllIsolationWrapperBase@@
.?AVCDTLUpgApp@@
.?AVCEnumArray@@
.?AVCEnumUnknown@@
.?AVCEventSocket@@
.?AVCException@@
.?AVCExcutor@@
.?AVCFile@@
.?AVCFileException@@
.?AVCFixedStringMgr@ATL@@
.?AV?$CFixedStringT@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@$0BAA@@ATL@@
.?AVCFont@@
.?AVCGdiObject@@
.?AVCHandleMap@@
.?AVCHttpFileDataCell@@
.?AVCHttpFileDataTransfer@@
.?AVCInvalidArgException@@
.?AV?$CList@PAVIControlSiteFactory@@PAV1@@@
.?AVCLocalExcutor@@
.?AVCMapPtrToPtr@@
.?AVCMemFile@@
.?AVCMemoryException@@
.?AVCMenu@@
.?AV?$CMFCComObject@VCAccessibleProxy@ATL@@@@
.?AVCNoTrackObject@@
.?AVCNotSupportedException@@
.?AVCObArray@@
.?AVCObject@@
.?AVCOccManager@@
.?AVCOleBusyDialog@@
.?AVCOleControlContainer@@
.?AVCOleControlSite@@
.?AVCOleControlSiteFactory@@
.?AVCOleDialog@@
.?AVCOleDispatchException@@
.?AVCOleException@@
.?AVCOleMessageFilter@@
.?AVCPaintDC@@
.?AVCProxySocket@@
.?AVCPtrArray@@
.?AVCPtrList@@
.?AVCRepairExcutor@@
.?AVCResourceException@@
.?AVCRgn@@
.?AVCSimpleException@@
.?AV?$CSimpleStringT@_W$0A@@ATL@@
.?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@
.?AVCTCPFileDataCell@@
.?AVCTCPFileDataTransfer@@
.?AVCTCPProxySocket@@
.?AVCTestCmdUI@@
.?AV?$_CTypedPtrList@VCPtrList@@PAUCOleControlSiteOrWnd@@@@
.?AV?$CTypedPtrList@VCPtrList@@PAUCOleControlSiteOrWnd@@@@
.?AVCUdpCommandAction@@
.?AVCUDPProxySocket@@
.?AVCUdpReciver@@
.?AVCUdpReciverProcessor@@
.?AVCUdpRemoteRepBuffer@@
.?AVCUdpRemoteReqBuffer@@
.?AVCUdpSender@@
.?AVCUdpSocket@@
.?AVCUpdateCfg@@
.?AVCUpdateFile@@
.?AVCUserException@@
.?AVCWinApp@@
.?AVCWindowDC@@
.?AVCWinThread@@
.?AVCWnd@@
.?AVexception@std@@
.?AV?$IAccessibleProxyImpl@VCAccessibleProxy@ATL@@@ATL@@
.?AVIControlSiteFactory@@
.?AVlength_error@std@@
.?AVlogic_error@std@@
.?AVout_of_range@std@@
.?AVTiXmlAttribute@@
.?AVTiXmlBase@@
.?AVTiXmlComment@@
.?AVTiXmlDeclaration@@
.?AVTiXmlDocument@@
.?AVTiXmlElement@@
.?AVTiXmlNode@@
.?AVTiXmlText@@
.?AVTiXmlUnknown@@
.?AVtype_info@@
.?AVXAccessible@CWnd@@
.?AVXAccessibleServer@CWnd@@
.?AVXAmbientProps@COleControlSite@@
.?AVXBoundObjectSite@COleControlSite@@
.?AVXEnumVOID@CEnumArray@@
.?AVXEventSink@COleControlSite@@
.?AVXMessageFilter@COleMessageFilter@@
.?AVXNotifyDBEvents@COleControlSite@@
.?AVXOleClientSite@COleControlSite@@
.?AVXOleContainer@COleControlContainer@@
.?AVXOleControlSite@COleControlSite@@
.?AVXOleIPFrame@COleControlContainer@@
.?AVXOleIPSite@COleControlSite@@
.?AVXPropertyNotifySink@COleControlSite@@
.?AVXRowsetNotify@COleControlSite@@
.Ay0.IO
b00{b9D
b3kB7F
bad allocation
bad exception
BaFoit
)BanD(
 Base Class Array'
 Base Class Descriptor at (
__based(
@@BBf;
BBFFf;
b_bKiL
bCB)!TI
BeginPaint
BeginRecvData failed(%d)
b/g	gP
b=NAYUj
!=bq9[
>/B;)S
bs;1gs
buffer error
Bv#P~4X
bYX%{~Wx-
c0H>ue
"c6UQ(
Cache-Control: no-cache
CallNextHookEx
CallWindowProcA
CArchiveException
CByteArray
CClientDC
CCmdTarget
<![CDATA[
<![CDATA[%s]]>
__cdecl
CDialog
CException
cfg %s newhash(%s) calhash(%s)
CFileException
CGdiObject
/	Ch8B
CharNextA
CharUpperA
 check error
CheckMenuItem
CheckProcess.dll
CInvalidArgException
 Class Hierarchy Descriptor'
ClientToScreen
CloseHandle
ClosePrinter
__clrcall
CLSID\%1
CLSID\%1\AuxUserType\2
CLSID\%1\AuxUserType\3
CLSID\%1\DefaultExtension
CLSID\%1\DefaultIcon
CLSID\%1\DocObject
CLSID\%1\InprocHandler32
CLSID\%1\InProcServer32
CLSID\%1\Insertable
CLSID\%1\LocalServer32
CLSID\%1\MiscStatus
CLSID\%1\Printable
CLSID\%1\ProgID
CLSID\%1\Verb\0
CLSID\%1\Verb\1
CLSIDFromProgID
CLSIDFromString
c|M9HCG
CMapPtrToPtr
$@CMemFile
CMemoryException
CNotSupportedException
CObArray
CObject
CoFreeUnusedLibraries
CoGetClassObject
COleBusyDialog
COleDialog
COleDispatchException
COleException
comctl32.dll
COMCTL32.dll
comdlg32.dll
[COMEBACK]:MoveFileEx %s %d
[COMEBACK]:set %s not readonly failed
commctrl_DragListMsg
CompareStringA
CompareStringW
 Complete Object Locator'
connect failed(%d)
Connection: keep-alive
CONOUT$
Content-Length: 
[Control]
[Control]DTL_CreateProcessAsUser failed
[Control]DTL_CreateProcessAsUser OK
[Control]ExcuteCtrl Error
[Control]ExcuteCtrl OK.
[Control]InitCtrlFile Error
Control Panel\Desktop\ResourceLocale
[Control]PreviousDealCtrlFile Error
[Control]PreviousDealCtrlFile Ready
ConvertDefaultLocale
CopyAcceleratorTableA
`copy constructor closure'
CopyFileA
Copy file %s failed
CopyRect
Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
CoRegisterMessageFilter
CoRevokeClassObject
CorExitProcess
CoTaskMemAlloc
CoTaskMemFree
CPaintDC
CPtrArray
CPtrList
crc check
CreateActCtxA
CreateActCtxW
CreateBitmap
CreateDialogIndirectParamA
CreateDirectoryA
CreateDirectoryW
CreateEnvironmentBlock
CreateEventA
CreateFileA
CreateFileMappingA
CreateFileW
CreateILockBytesOnHGlobal
CreateProcessA
CreateProcessAsUserA
CreateRectRgnIndirect
CreateSemaphoreA
CreateStdAccessibleObject
CreateThread
CreateToolhelp32Snapshot
CreateWellKnownSid
CreateWindowExA
CResourceException
cr@[hP
- CRT not initialized
[CTRL]Check CtrlFile failed
\ctrlf
(C.}@U
CUserException
CWinApp
CWindowDC
CWinThread
c:\WSMProject\DTLSVN\CommonLibrary\branches\DTLUpg\trunk\AutoUpdater\release\DTLUpg.pdb
D$0_^]
D$0SUW
D$0vT2
d2y6cE
D$4)D$(
D$4PhX{F
D$4QPh
D$4QPhtPF
D$4QPhXPF
'#d4u%
D$4vT2
D$4WPSV
 d6XlU
D$ 9F$
D9|$Hr
_d9o\r
^d9^`v
@.data
data error
D$,)D$(
D$(;D$
D$()D$$
D$$)D$,
[%d-%d-%d %d:%d:%d 6]
dddd, MMMM dd, yyyy
D$$D|F
DeactivateActCtx
December
DecodePointer
`default constructor closure'
default status
DefWindowProcA
`DEId2S
 delete
 delete[]
Delete
DeleteCriticalSection
DeleteDC
DeleteFileA
DeleteFileW
DeleteObject
deque<T> too long
DestroyEnvironmentBlock
DestroyMenu
DestroyWindow
dF<-uE
DGyCLB
D$HD|F
D$hSUVW
D$hUVW
D$hWPh
DispatchMessageA
DISPLAY
D$lD|F
D$lPh0NF
D$lPh IF
D$lSUV
D$lu&9
DocumentPropertiesA
DOMAIN error
DosDateTimeToFileTime
download file %s hash check failed
D$phhSF
D$$Ph(JF
D$PPGF
D$ PQ3
D$$PQR
D$ PUSQ
D$@QRP
DrawTextA
DrawTextExA
D$<SUV
D$,SUV
D$<SUVW
D$@SUVW
D$ t*;
D$$t*;
D$#<\t
|$D;T$ 
d:TF7$
D$\tI9|$ps
DTLCheckProcess
DTLCheckProcess Failed
[DTLCopyFile]:set %s not readonly failed
DTL_CreateProcessAsUser failed
DTL_CreateProcessAsUser OK
DTLGetMainWindow
DTLTMP
DTLUpdater CmdLine:%s
DTLUPG Exception
D$TQPh
D$TQPh$PF
DuplicateHandle
DuplicateTokenEx
D$<UVW
~`;~dv
Dw=c:s
Dw=d:s
Dw=f:s
Dw=g:s
Dw=h:s
D$Wh`wF
Dw=i:s
Dw=m:s
Dw=`:s
Dw=^:s
Dw=~:s
Dw=|:s
Dw=_:s
Dw=':s
Dw=]:s
Dw={:s
Dw=}:s
Dw=&:s
Dw=	:s
Dw=t:s
Dw=u:s
Dw=U:s
Dw=y:s
Dw=z:s
D$XSUVW
D$XUPh
D$XUVW
`dynamic atexit destructor for '
`dynamic initializer for '
E@_^[]
E+$1r*
E<[^_3
.E>cF 
<EDFK]
&Edit,0,2
`eh vector constructor iterator'
`eh vector copy constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`eh vector vbase copy constructor iterator'
E~J}G)
Embedded Object
Embed Source
empty distance tree with lengths
e"m.)q6s
EnableMenuItem
EnableWindow
EncodePointer
encoding
encoding="
encoding="%s" 
EndDialog
EndPaint
EnterCriticalSection
EnumDisplayDevicesA
EnumDisplayMonitors
EnumResourceLanguagesA
EqualRect
EqualSid
Error document empty.
Error: empty tag.
Error null (0) or unexpected EOF found in input stream.
Error parsing CDATA.
Error parsing Comment.
Error parsing Declaration.
Error parsing Element.
Error parsing Unknown.
Error reading Attributes.
Error reading Element value.
Error reading end tag.
Error when TiXmlDocument added to document, because TiXmlDocument can only be at the root.
	_*ERU49
Escape
!*]^et
EU1TLR
ew/d~\eG
Ew(P~5T
Exception thrown in destructor
ExitProcess
ExitThread
EXPLORER.EXE
EXT_DOWNLOAD_ERROR
EXT_EXCUTE_ERROR
EXT_EXCUTING
EXT_INIT_ERROR
EXT_PREPARED
ExtSelectClipRgn
EXT_SUCESSED
ExtTextOutA
EXT_UPDATEFILE_ERROR
F??/*0
F#32768
F4_]^[
{f8SuTM
F95pvG
F@9^8~%3
Failed to open file
Failed to read Element name
__fastcall
FD_^][
;fD-l@
+F(_;E
February
F(;F0u
`)ff28
F(@@;F,v
file error
FileName
FileNameW
file %s hash check failed within arhive
filesize
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FindWindowExA
FindWindowEx Code=%d
- floating point not loaded
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushInstructionCache
'fmIX[2`
ForceRemove
FormatMessageA
FP;FTt
F(;^ r
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeResource
Friday
f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
f:\rtm\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
FR<,x;G
fUWMQ<
-_'f>X%
|g2jBa
{g2k6p
G$_^]3
g9n t_;
GAIsProcessorFeaturePresent
GDI32.dll
Gd_;PR
GenuineIntelAuthenticAMDCentaurHauls7z
GetAce
GetAclInformation
GetACP
GetActiveWindow
GetBkColor
GetCapture
GetClassInfoA
GetClassInfoExA
GetClassLongA
GetClassNameA
GetClientRect
GetClipBox
GetCommandLineA
GetConsoleCP
GetConsoleMode
GetConsoleOutputCP
GetCPInfo
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetCursorPos
GetDesktopWindow
GetDeviceCaps
GetDlgCtrlID
GetDlgItem
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileAttributesA
GetFileAttributesW
GetFileSecurityA
GetFileSize
GetFileTime
GetFileTitleA
GetFileType
GetFocus
GetForegroundWindow
GetFullPathNameA
GetKeyState
GetLastActivePopup
GetLastError
GetLengthSid
GetLocaleInfoA
GetLocalTime
GetMapMode
GetMenu
GetMenuCheckMarkDimensions
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMessageA
GetMessagePos
GetMessageTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetMonitorInfoA
GetNextDlgGroupItem
GetNextDlgTabItem
GetObjectA
GetOEMCP
GetParent
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessWindowStation
GetPropA
GetRgnBox
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetStartupInfoA
GetStdHandle
GetStockObject
GetStringTypeA
GetStringTypeW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemDefaultUILanguage
GetSystemInfo
GetSystemMetrics
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempFileName %s failed
GetTextColor
GetThreadContext
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetTokenInformation
GetTopWindow
GetUserDefaultUILanguage
GetUserObjectInformationA
GetVersion
GetVersionExA
GetViewportExtEx
GetVolumeInformationA
GetWindow
GetWindowDC
GetWindowExtEx
GetWindowLongA
GetWindowPlacement
GetWindowRect
GetWindowsDirectoryA
GetWindowTextA
GetWindowThreadProcessId
--Gg?&$58
g>GZto
GJG\{4
Global\{AC6FC22D-CE6C-42f8-85B5-0623C6C4D256}
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalUnlock
gm1fT!
/gp!e=
$g(;_q
gq;BaU
gQ{l$(l
gR&/6lP
GrayStringA
}(GrKr4i`
Gw*P~4Q
|gx_'j
`h````
h4r%5q~
H.8pu%
_H9o@r
HcX(cU
^h>dY]
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
	H.|EQ*
hGzo`$
hhctrl.ocx
`h`hhh
HH:mm:ss
hhor 2
HHtAHHt
HHt@HHt
HHtjHtHHt&H
\$$h\IF
hj\DGdV<F^1#
Host: 
hR^B.2}
^Hsx-(
HtbHt@Ht
HtjHt4H
HtMHt,H
HtmlHelpA
HtpHHt
http://
 HTTP/1.1
+h^"?v"%k
hXPSoY
HY_^Z[
:I^<[`
I8.;D%
idz	Ieg
I;!e+J|
iesc`q
,Ik0F-C
Inc|*[l
incompatible version
incomplete distance tree
incomplete dynamic bit lengths tree
incomplete literal/length tree
incorrect data check
incorrect header check
/index.html
index.html
InitCommonControls
InitCommonControlsEx
InitializeAcl
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
initialize excutor error
InitializeSecurityDescriptor
InitUpdateFile failed
inservice
insufficient memory
I$;N t
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IntersectRect
InvalidateRect
InvalidateRgn
invalid bit length repeat
invalid bitset<N> position
invalid block type
invalid distance code
invalid literal/length code
invalid stored block lengths
invalid string position
invalid window size
%i~_ozD
ip:%s port=%d
#I_rM 
IsChild
IsDebuggerPresent
IsDialogMessageA
IsIconic
I~sL63
IsRectEmpty
IsValidSecurityDescriptor
IsWindow
IsWindowEnabled
IsWindowVisible
]i>v$N
IYXh~]
'J0tAk
J1'Wdo
j7+VFW
JanFebMarAprMayJunJulAugSepOctNovDec
January
_jb4M`
jBaL)j
<jBaN+
jCp	Bt
'	JD-h
j h|vF
j(j ^V
j([oa0
jPz_<Z
JQlv68
JsMtw$]
j"^SSSSS
&JU?wnt{
``(/JV{
)[&JVv
[j	W>}Y
[k4eF/
k9~8uDj
	Ka1w 
kBalT(
kbQIMJ
KERNEL32
kernel32.dll
Kernel32.dll
KERNEL32.dll
KERNEL32.DLL
]KfxMk
%Kg*aM
[@k+m=
k}-/Ri
@-k<T+!
k}UXl'{
L$0_^]
L$0h`kF
L$(][3
L3?qc>
L$4WQUP
L$89|$h
L$89\$h
L$89l$h
L$8j Q
^L9~Dr
l9pU^b
l$<9](r
LCMapStringA
LCMapStringW
]L{C\xf
(;l$Dr
;L$ds3
LeaveCriticalSection
@:lE>h
>L;Frk
>L[Frk
>L[Frkq
>LgFrk
@lGI9b
L$HRPQ
`L[I&>/
Link Source
Link Source Descriptor
list<T> too long
LkLW{km
L$(;L$
L$l_^][3
LMWuAu
LoadBitmapA
LoadCursorA
LoadIconA
LoadLibraryA
LoadResource
LocalAlloc
LocalFree
LocalMark Save %s failed
LocalReAlloc
`local static guard'
`local static thread guard'
`local vftable'
`local vftable constructor closure'
Location: 
LockFile
LockResource
log\DTLUpg.log
LookupPrivilegeValueA
-l.P@,
L$P9L$Lt ;
L$P9L$Lt!
lpE:cDa
L$pj@Q
@L;ppt
L$ PQR
L$(QhpGF
L$ QPU
\lQrx/k
L$:QWQP
LresultFromObject
L$,RhXlF
L$ RQP
>LsFrk
>LSFrk
lstrcmpA
lstrcmpW
lstrlenA
;L$ t(
L$()~t
L$\VPQh
l$,VW3
~LWh4/F
;m1`: 
m4(Z\C
M67r]t)P
`managed vector constructor iterator'
`managed vector copy constructor iterator'
`managed vector destructor iterator'
MapDialogRect
MapViewOfFile
MapWindowPoints
`(MB)p
mc7"N)
MessageBeep
MessageBoxA
mfcm80.dll
MFCM80ReleaseManagedReferences
 MfMn7Z
mgf2jM
mgr.exe
Microsoft Visual C++ Runtime Library
m#?(JJ
'MkxDq
<mlZRu^
MM/dd/yy
ModifyMenuA
Monday
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MoveFileExA
MoveWindow
mqG#<2s
        </ms_asmv2:requestedExecutionLevel>
        <ms_asmv2:requestedExecutionLevel level="asInvoker" uiAccess="false">
      </ms_asmv2:requestedPrivileges></ms_asmv2:security></ms_asmv2:trustInfo></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD`
mscoree.dll
MS Shell Dlg
MSWHEEL_ROLLMSG
.m*TV!:
MulDiv
MultiByteToWideChar
"MU[w1
?n!6Xz
Native
:-/nCmH$
nDiCx_
need dictionary
 new[]
N<+F0+N4
NFXw-x
nJ#hXT+C
NL;Apt
NlmgRR
N,;N0r
N'O5'	
NoBackButton
NoClose
NoDrives
NoEntireNetwork
No error
NoFileMru
NoNetConnectDisconnect
NoPlacesBar
NoRecentDocsHistory
NoRemove
- not enough space for arguments
- not enough space for environment
- not enough space for locale information
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
not find file %s
NotifyWinEvent
not impl
November
:Nr?'iJ
ntdll.dll
(null)
Nvd5?}d
o6\W~	 
O 9Htu
Object Descriptor
ObjectLink
oC	'Kl1
October
OffsetRect
OffsetViewportOrgEx
>|OFrk
o$H'56
~o~h\c
ole32.dll
OLEACC.dll
OLEAUT32.dll
oledlg.dll
OleFlushClipboard
OleInitialize
OleIsCurrentClipboard
OleUninitialize
`omni callsig'
onAK,"Fb
[OnAPP]Pair|app=%s upf=%s
[OnCFG]Pair|app=%s upf=%s
OnDownloadFile Connect %s failed
O{	pBA`
&Open,0,2
Open http File %s failed
OpenMutexA
OpenPrinterA
OpenProcess
OpenProcess id=%d
OpenProcessToken
operator
](Oqr%5
Ot1^ L
O|Ten5
:	OUFE
oversubscribed distance tree
oversubscribed dynamic bit lengths tree
oversubscribed literal/length tree
oW:EV7Gx
OwnerLink
\>O^x`'
OXN[@%sg#9
o&Z*&'
^P%\	}3\
parent process id %d
__pascal
PathFindExtensionA
PathFindFileNameA
PathIsUNCA
PathStripToRootA
.PAVCArchiveException@@
.PAVCException@@
.PAVCFileException@@
.PAVCInvalidArgException@@
.PAVCMemoryException@@
.PAVCNotSupportedException@@
.PAVCObject@@
.PAVCOleDispatchException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCSimpleException@@
.PAVCUserException@@
P=E8)S
PeekMessageA
PhF;t$
P\_I?0
`placement delete closure'
`placement delete[] closure'
Please contact the application's support team for more information.
p:&n"yK
#POQL|
PostMessageA
PostQuitMessage
PostThreadMessageA
PPPPhd
PPPPPPPP
_\p[qo
PQQQQQ
PQSUVW
Pragma: no-cache
PreviewPages
Process32First
Process32Next
ProcessIdToSessionId
Program: 
<program name unknown>
pS|]%@
PtInRect
__ptr64
PtVisible
PTyEC,+
PUPko\
- pure virtual function call
PVh8zF
PWVWWW
Q09*jc
q_4+O$
Qbv~.\
@qcQ`b
?q!Hx+L{0Zw5
Qkkbal
QQSUVW
QQSVWd
QShdFF
QueryPerformanceCounter
quf CY>+
&quot;
q)]YLa
R	0G:*D
r%>2^nJ
R+66s`
r>-8iY
RaiseException
Range: bytes=
RB/7T>
rc?I#Y
`.rdata
ReadFile
RectVisible
Referer: 
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyA
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueA
RegQueryValueExA
RegSetValueExA
ReleaseActCtx
ReleaseCapture
ReleaseDC
ReleaseSemaphore
RemoveDirectoryA
RemovePropA
repair
[REPAIR]Check UpdateFile failed
[REPAIR]Check UpdateFile frist failed
[REPAIR]DealDownloadNewCfg Error
[REPAIR]DownloadedUpdateFile failed
[REPAIR]DownloadNewCfg Error
[REPAIR]has error return
[REPAIR]InitUpdateCfg Error
[REPAIR]UpdateAppFile Error
[REPAIR]UpdateFiles Count=%d
ResetEvent
RestoreDC
__restrict
RestrictRun
ResumeThread
><Rich
RichEdit Text and Objects
Rich Text Format
rjWj"UVS
RKUOkm
Rl]ZH'
rm{AW0
r'@r"Ct&Yf&
RtlUnwind
runtime error 
Runtime Error!
RXt3<y>+
<!--%s-->
S\_^[]
S}3~YEV
s5]~!m
\<<sA3
Saturday
SaveDC
S!>Byd
`scalar deleting destructor'
ScaleViewportExtEx
ScaleWindowExtEx
s!>cVe6
"[S,cY
Sd2KBa
%s.dll
%s download failed(%d)
SeDebugPrivilege
SelectObject
SendDlgItemMessageA
SendMessageA
SendMessageTimeoutA
September
SetActiveWindow
SetBkColor
SetCapture
SetCurrentDirectoryA
SetCursor
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileSecurityA
SetFileTime
SetFocus
SetForegroundWindow
SetHandleCount
SetLastError
SetMapMode
SetMenuItemBitmaps
SetNamedSecurityInfoA
SetPropA
SetRect
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
SetStdHandle
SetTextColor
SetThreadContext
SetThreadStackGuarantee
Settings
SetTokenInformation
SetUnhandledExceptionFilter
SetViewportExtEx
SetViewportOrgEx
SetWindowContextHelpId
SetWindowExtEx
SetWindowLongA
SetWindowPos
SetWindowsHookExA
SetWindowTextA
(%s) failed
SHELL32.dll
ShellExecuteExA
SHLWAPI.dll
ShowWindow
/showwnd
SI|EEHNMq
SING error
SizeofResource
?s"L{0aw9
 %s nameed to %s %d
software
Software\
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Sok947e
*'Sp!X3
s+q%Mc
(Sr	c;w
sR\H2Bd
SRQWVj
%s='%s'
%s="%s"
s[S;7|G;w
%s (%s:%d)
%s:%s failed
%s:%s ok
SSOWVQ
^SSSSS
-ST8}c
standalone
standalone="
standalone="%s" 
__stdcall
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
 %s to %s
stream end
stream error
`string'
string too long
Sunday
SunMonTueWedThuFriSat
SuspendThread
\SUVW3
SVWj(3
System
SystemParametersInfoA
SystemTimeToFileTime
T$0_^]
t39w u&
T$4RWUS
T$4SUV
T$4WRVP
t59t$P
._T5apR
?t79^Du2
T$89l$h
T$8RSW
t	9APu
T$(9h4r	
t-9HPu
t]9l$<rP
^t9nlr
t,9|$P
t	9p(u
T$,9T$
t^9(uZ
tA9wht<
TabbedTextOutA
TBZx%$r
tc8D$ 
t+Cr#Yf&
Td2;(c@
tD9(u@
TerminateProcess
TerminateThread
@.text
TextOutA
tf};}A
t=FA9]
!T`)ff2
tg<>th
T$<h`GF
+t HHt
This application has requested the Runtime to terminate it in an unusual way.
__thiscall
This indicates a bug in your application.
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
!This program cannot be run in DOS mode.
t$ hpzF
;T$hs)
t>Ht2Ht&
T$ htzF
T$hUQSVP
Thursday
tJ&2kA
tj9~8u@j
t$$j\Sj\V
TJZ+!TL
TK*Bav
<<tkj0
< tK<	tG
/tLh\IF
TLOSS error
T$LPQR
[T@_LS
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TNDj=V>"R
T]NR'=
tO9^,tJ
TO]ARoC\(
too many length or distance symbols
T$phdSF
T$pj@R
T$pSVP
tq9xPu
t|-&Q	g
tQHtEHt9Ht-Huk
tR99u2
TranslateMessage
T$<RUP
T$(RVW
t#SSUP
T$ SUUUPQR
<\t	</t
<+t(<-t$:
T$TQRj
T$TRQP
+t#T>Z
t$<"u	3
Tuesday
t$ UVV
;t$,v-
.T>Vb60kB
t/Vp"Cm
t$$VSS
tW9qttR
t+WWVPV
=T,wZpsb}r7
tyM~h:
 Type Descriptor'
`typeof'
u0hxJF
u29t$8
u	_^]3
U4SSSPQR
*U6g@U
u7[*H:
>:u8FV
}=U<9+k] MK
u'9|$p
Ud2jBa
Ud2o6b
udp service is not created
`udt returning'
u&f!;f;
;U Ggi
u;h@JF
u,hL,F
u;hPJF
u;hT,F
u'h`uG
u:j0^V
UJJQlf6;
Uj\VSW
Un7z file %s failed
- unable to initialize heap
- unable to open console device
__unaligned
uncompress 7z arhive %s to %s failed
uncompress zip arhive %s to %s failed
- unexpected heap error
- unexpected multithread lock error
UnhandledExceptionFilter
UnhookWindowsHookEx
UNICODE
unknown compression method
Unknown exception
Unknown socket event code %d
UnlockFile
UnmapViewOfFile
UnregisterClassA
_Update_
[Update]arp=%s rp=%s uf=%s app=%s
[Update]CFG %s to %s
[Update]Load Xml %s failed
UpdateProcessor ERROR_ALREADY_EXISTS
UpdateWindow
update.xml
UQPXY]Y[
url %s %d download failed
URPQQhP
`u	<'s
uS9|$(
USER32
user32.dll
USER32.dll
USER32.DLL
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; GTB7.1; .NET CLR 2.0.50727)
USERENV.dll
<'u#Sh
USJ$#N.
|)	#ut
@u';t$
UTF-16LE
uU9~`r
U+U&IY
uW,7{bvsZ
uW9n`rF
uW9t$8
<UWH$[pa<
uwVIsb
uXPqw(
	\uyTP^
v$;5\DG
v!6 lh
`}V<6PO9
v7;FDr2w
ValidateRect
Vb+3kBR
`vbase destructor'
Vbc3kBb
`vbtable'
vc9^0uc
`vcall'
`vector constructor iterator'
`vector copy constructor iterator'
`vector deleting destructor'
`vector destructor iterator'
vector<T> too long
`vector vbase constructor iterator'
`vector vbase copy constructor iterator'
version
version="
version="%s" 
`vftable'
&;+vgY
VirtualAlloc
`virtual displacement map'
VirtualFree
VirtualProtect
VirtualQuery
v:jh*'
v	N+D$
/@,v R
vR+BR=/
VVVVPUVV
VVVVQVVVj
_VVVVV
VVVVVj
.VVVVVSRSSj
vwkBnH
VWQRSj
w*7l{.P
WaitForSingleObject
(Wdk>en
Wednesday
W:|*Gs
WHQjd64
WideCharToMultiByte
WinHelpA
WINSPOOL.DRV
winsta0\default
wndcls
WriteConsoleA
WriteConsoleW
WriteFile
WritePrivateProfileStringA
$wrk*y
WS2_32.dll
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAWaitForMultipleEvents
w;->tl"z
Wto=8DG
WtrHHt
WTSAPI32.dll
WTSGetActiveConsoleSessionId
WTSQueryUserToken
^WWWWW
wZ\+q7
&#x%02X;
^X9nPr
x-)ay3
X~G<4[
XK8:7j
&Xk(a2
(xKF~$^
%_XK^u
xM~?:%
<?xml 
XOA}RA
/XPe)T
xppwpp
xpxxxx
xr}_I>
xSUVW3
|xTyFq8
xYK[ql
y0go!;s$Hx+|W.
Y?'2kB
Y]%2kB
Y'-2kBa
]|y5[9-
-y>.A7
[y cJ"]
Yd[:k6hF
YdY*+X
,Yi\d%H
yP-q*0
YSErkSa
>=Yt/j
yxBaF(
_^][YY
YYtF+u
YYt SVW
YYt\VV
YYu-9D$
YYu/hD-F
YYuTVWh
Y(znL;#"Y(
Z1']KX
ZAr?@OPE^wVEky	
Zb|tgC
z}`C;$-
zc}9)A
ZgBaF8
(Zgd;L
*Zjo2#
zlk:J[
Zq+ClD
Z,QN.3(@
Z_sa<-
Zt,Ht$Ht
Z$T^J 
ZUw}H(
ZylQ'<
zzo\wa