HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Jaik.10450 (B) (Emsisoft), Gen:Variant.Jaik.10450 (AdAware), Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: afd7795db6352e1d4f68f549dd218c54
SHA1: 69d14de28995ae8c25db10f053b88ae20ad416c6
SHA256: 9ef90e8513b801831b470d0b379781eefa73b4e4cfe460df297521ef3550e591
SSDeep: 98304:/IMwUDlG49Ne7Wr0Mfss/Oy mSVE2h21JgBMQXk3c:Bu6gy mmXGc
Size: 4100096 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2016-10-18 18:56:45
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1792
netsh.exe:2428
The Trojan injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1792 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Windows\DellDriver\spoolsvs.exe (40702 bytes)
C:\1.bat (77 bytes)
C:\Windows\DellDriver\CPU.zip (1 bytes)
The Trojan deletes the following file(s):
C:\%original file name%.exe (0 bytes)
C:\1.bat (0 bytes)
C:\Windows\DellDriver\CPU.zip (0 bytes)
Registry activity
The process %original file name%.exe:1792 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASAPI32]
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Interner Settings\Zones\3]
"1803" = "3"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASMANCS]
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASMANCS]
"MaxFileSize" = "1048576"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASMANCS]
"EnableConsoleTracing" = "0"
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFileMenu" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASMANCS]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASAPI32]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSetFolders" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"GlobalAssocChangedCounter" = "47"
[HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserOptions" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFind" = "1"
"NoControlPanel" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASAPI32]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\afd7795db6352e1d4f68f549dd218c54_RASAPI32]
"FileDirectory" = "%windir%\tracing"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KuangGong" = "c:\%original file name%.exe"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VMware Tools"
"Adobe ARM"
"SunJavaUpdateSched"
"Adobe Reader Speed Launcher"
"VMware User Process"
The process netsh.exe:2428 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E\@%SystemRoot%\system32]
"napipsec.dll,-1" = "IPsec Relying Party"
"napipsec.dll,-3" = "Microsoft Corporation"
"napipsec.dll,-2" = "Provides IPsec based enforcement for Network Access Protection"
"napipsec.dll,-4" = "1.0"
[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"
[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E\@%SystemRoot%\system32]
"eapqec.dll,-102" = "1.0"
"eapqec.dll,-103" = "Microsoft Corporation"
"eapqec.dll,-100" = "EAP Quarantine Enforcement Client"
"eapqec.dll,-101" = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."
"dhcpqec.dll,-102" = "Microsoft Corporation"
"dhcpqec.dll,-103" = "1.0"
"dhcpqec.dll,-100" = "DHCP Quarantine Enforcement Client"
"dhcpqec.dll,-101" = "Provides DHCP based enforcement for NAP"
"tsgqec.dll,-102" = "1.0"
"tsgqec.dll,-103" = "Microsoft Corporation"
"tsgqec.dll,-100" = "RD Gateway Quarantine Enforcement Client"
"tsgqec.dll,-101" = "Provides RD Gateway enforcement for NAP"
Dropped PE files
MD5 | File path |
---|---|
e3427d9f439aebefa3d9c299e2a94af3 | c:\Windows\DellDriver\spoolsvs.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1792
netsh.exe:2428 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Windows\DellDriver\spoolsvs.exe (40702 bytes)
C:\1.bat (77 bytes)
C:\Windows\DellDriver\CPU.zip (1 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KuangGong" = "c:\%original file name%.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 620546 | 622592 | 4.54375 | 97e252fe9c74e8adec126eaf8ea2772d |
.rdata | 626688 | 3393634 | 3395584 | 5.52886 | 2e79aeba94b67e9ff9f238772c7ebe81 |
.data | 4022272 | 276778 | 73728 | 3.61518 | 72ce935601e074f2ff61426f967911ea |
.rsrc | 4300800 | 581 | 4096 | 0.727828 | 3a70aec4f8e99d7b676eda4c01c3d8d8 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
xmr.prohash.net | 138.201.206.47 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1792:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
|$D.tm
|$D.tm
~%UVW
~%UVW
u$SShe
u$SShe
Bv=kAv.SCv
Bv=kAv.SCv
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
advapi32.dll
advapi32.dll
Advapi32.dll
Advapi32.dll
shell32.dll
shell32.dll
Kernel32.dll
Kernel32.dll
ws2_32.dll
ws2_32.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
oleaut32.dll
oleaut32.dll
ole32.dll
ole32.dll
OleAut32.dll
OleAut32.dll
wininet.dll
wininet.dll
CreatePipe
CreatePipe
PeekNamedPipe
PeekNamedPipe
RegOpenKeyA
RegOpenKeyA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
ShellExecuteA
ShellExecuteA
updD73C.tmp
updD73C.tmp
wwbizsrv.exe
wwbizsrv.exe
xmr.prohash.net
xmr.prohash.net
xmr.aippx.win
xmr.aippx.win
hXXp://
hXXp://
\kernel32.dll
\kernel32.dll
\CPU.zip
\CPU.zip
libwinpthread-1.dll
libwinpthread-1.dll
=%Uy|
=%Uy|
cgÃ
cgÃ
|h.Ex2
|h.Ex2
ssleay32.dll
ssleay32.dll
ya.Zf
ya.Zf
FB%u
FB%u
A5\-q}
A5\-q}
b!.%F
b!.%F
d%XSM;8
d%XSM;8
T"C%F
T"C%F
Fp%4S
Fp%4S
.kA\7
.kA\7
Bu%S]
Bu%S]
minerd.exe
minerd.exe
J.evz
J.evz
sc9j4E%CT
sc9j4E%CT
`0/.odP
`0/.odP
NTCrT!
NTCrT!
XR!i.PL
XR!i.PL
)uP.Pk
)uP.Pk
y/.Sf
y/.Sf
.Jy8!
.Jy8!
.Uv`P
.Uv`P
X5.YMB
X5.YMB
-Qm}=
-Qm}=
wp.eV
wp.eV
.pg8Cv
.pg8Cv
q?.fk
q?.fk
.,.tqX
.,.tqX
.eE>HP
.eE>HP
fYc%U
fYc%U
Q1.hP
Q1.hP
`.Hl5
`.Hl5
.vO*5
.vO*5
Y.ccKDt
Y.ccKDt
>C%cs
>C%cs
QL.crSo}
QL.crSo}
h%d~/
h%d~/
wO.nR1
wO.nR1
3=%%u
3=%%u
.Ud`"
.Ud`"
Q.lwp
Q.lwp
c.XFJ>
c.XFJ>
wc%x?
wc%x?
CD.Ld
CD.Ld
;'.ll
;'.ll
Qf'%S
Qf'%S
zlib1.dll
zlib1.dll
t]5.wV
t]5.wV
;%ut8LuM
;%ut8LuM
libcurl.dll
libcurl.dll
tM3
tM3
XrAO.XT
XrAO.XT
o=.sf
o=.sf
6}f.Ar~J
6}f.Ar~J
X%Fy}
X%Fy}
jI.mR
jI.mR
.ca=rG
.ca=rG
%sbUZxs
%sbUZxs
:bxL.XK
:bxL.XK
þ)o
þ)o
.vF|>H
.vF|>H
y.pD90/W
y.pD90/W
.xz})
.xz})
libeay32.dll
libeay32.dll
XVs.gp
XVs.gp
UQ.fU
UQ.fU
x K.SK
x K.SK
z.eAWdfI
z.eAWdfI
H%5xn
H%5xn
x
x
_A.cW
_A.cW
h.BsQ]y
h.BsQ]y
r[%f_I
r[%f_I
3GU[.PUkb
3GU[.PUkb
sD}%F
sD}%F
ah'.GGl8wW,S
ah'.GGl8wW,S
$HXS.yP
$HXS.yP
by~I%d
by~I%d
.bmc!Q
.bmc!Q
.FYJ
.FYJ
.VAv}
.VAv}
$;.BJ
$;.BJ
'%c;'
'%c;'
z)w%uW
z)w%uW
GTcp
GTcp
4GJ.LeJ&
4GJ.LeJ&
;C %s
;C %s
zh7%s
zh7%s
.jSp3
.jSp3
Vx*.dK
Vx*.dK
.rhtr3!f
.rhtr3!f
f8.tQ)
f8.tQ)
%uaC|
%uaC|
1-J7}
1-J7}
(.ep)
(.ep)
.sGVhu
.sGVhu
1/b.fna
1/b.fna
rx`%F
rx`%F
?.HA}
?.HA}
?(($$44"
?(($$44"
~$~,~
~$~,~
%U$U&5!
%U$U&5!
TvT.TnT^T
TvT.TnT^T
%U.U!uW
%U.U!uW
.JpC|C)1T
.JpC|C)1T
De|.JqZ
De|.JqZ
E.[.ew
E.[.ew
.:.zat
.:.zat
:.tm$
:.tm$
.nmvb
.nmvb
.kuikt
.kuikt
.Eio(
.Eio(
{p.Gsl
{p.Gsl
libgcc_s_seh-1.dll
libgcc_s_seh-1.dll
libstdc -6.dll
libstdc -6.dll
|_.DQ_
|_.DQ_
.uCsg
.uCsg
*d.svb@
*d.svb@
u7.hBG
u7.hBG
.pm.i{
.pm.i{
]K.AV
]K.AV
c7%xW
c7%xW
Z=t.dk
Z=t.dk
jn9d,jE%f
jn9d,jE%f
?Iy%F
?Iy%F
K:\Lp
K:\Lp
/.CCz}v
/.CCz}v
3.JGG
3.JGG
UG`.ep
UG`.ep
H].JGR
H].JGR
sSHh8
sSHh8
D.AyW
D.AyW
.HX"$
.HX"$
.vH?`
.vH?`
.GARK
.GARK
GCMD
GCMD
TCP &J
TCP &J
:N.uu
:N.uu
-1pP3}
-1pP3}
%U XJ
%U XJ
R.oG5
R.oG5
4.2.6.1.5.3.7
4.2.6.1.5.3.7
&%%UK
&%%UK
.BS"]
.BS"]
\libcurl.dll
\libcurl.dll
\libeay32.dll
\libeay32.dll
\libgcc_s_seh-1.dll
\libgcc_s_seh-1.dll
\libstdc -6.dll
\libstdc -6.dll
\libwinpthread-1.dll
\libwinpthread-1.dll
\minerd.exe
\minerd.exe
\ssleay32.dll
\ssleay32.dll
\zlib1.dll
\zlib1.dll
\wwbizsrv.exe
\wwbizsrv.exe
\wwbizsrv.exe -a cryptonight -o stratum tcp://
\wwbizsrv.exe -a cryptonight -o stratum tcp://
?os=windowsxp&userid=
?os=windowsxp&userid=
cmd.exe
cmd.exe
reg.exe
reg.exe
conhost.exe
conhost.exe
\1.bat
\1.bat
C:\Windows\DellDriver
C:\Windows\DellDriver
{4590f811-1d3a-11d0-891f-00aa004b2e24}
{4590f811-1d3a-11d0-891f-00aa004b2e24}
{dc12a687-737f-11cf-884d-00aa004b2e24}
{dc12a687-737f-11cf-884d-00aa004b2e24}
https
https
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
http=
http=
HTTP/1.1
HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
hXXps://
hXXps://
spoolsvs.exe
spoolsvs.exe
p'.QN
p'.QN
"?%x*pV;4W
"?%x*pV;4W
]]:.Eo
]]:.Eo
.TJF*
.TJF*
.dIG0
.dIG0
.ZEw!
.ZEw!
On%d^
On%d^
".nCJ_
".nCJ_
Y..cT
Y..cT
a/~H.rm
a/~H.rm
S%DYI
S%DYI
r.sUP
r.sUP
B.Lk&)
B.Lk&)
:$D.IM5
:$D.IM5
/Q.sO|
/Q.sO|
3.tGx`p
3.tGx`p
.EU}rh
.EU}rh
I.Qfg
I.Qfg
.VnCGy
.VnCGy
.lg!h
.lg!h
.RuU'n
.RuU'n
h.Rf9~W
h.Rf9~W
%f$i_
%f$i_
}.rrp
}.rrp
\.kk4~
\.kk4~
<.uh>
<.uh>
Qs_G.TX
Qs_G.TX
P.Btz}
P.Btz}
A&.MHUj
A&.MHUj
a2.pTK
a2.pTK
E#"%U
E#"%U
/.lg->wTb-w
/.lg->wTb-w
G.znjr
G.znjr
dc.ctL
dc.ctL
K#%Sv0
K#%Sv0
C:.af
C:.af
n}Ls%u%
n}Ls%u%
d@~%S
d@~%S
wWEbe
wWEbe
c.TCu
c.TCu
>m.eQX
>m.eQX
;^7%c
;^7%c
n)j.BPR
n)j.BPR
nN.ld
nN.ld
%XY\!
%XY\!
s.pGlg&w
s.pGlg&w
qV%7s
qV%7s
X.Lc"A
X.Lc"A
".SlQ
".SlQ
`HL
`HL
.PcI}/6b@
.PcI}/6b@
Eh%s#F]8
Eh%s#F]8
aV%Dm
aV%Dm
&F%0%c
&F%0%c
T")I%u
T")I%u
9>.sl{I
9>.sl{I
_/#%C
_/#%C
.eAKOw
.eAKOw
J8.VL
J8.VL
p.TlH
p.TlH
w%SN'YC
w%SN'YC
.hS34
.hS34
F(.xLc
F(.xLc
K .yJ
K .yJ
H%ut4
H%ut4
L\7.gL/
L\7.gL/
wl!%xf
wl!%xf
vA ^.me
vA ^.me
=s&4%c
=s&4%c
N.QgD
N.QgD
lY%XX|
lY%XX|
qH.Te
qH.Te
b.gX.
b.gX.
x$1%Cg
x$1%Cg
o&.Oy6Zf
o&.Oy6Zf
t.qC6
t.qC6
.zZ;C
.zZ;C
*.ZNw
*.ZNw
.CfdU8T
.CfdU8T
cÊQ]
cÊQ]
l:.cgoG"
l:.cgoG"
(.Zc
(.Zc
N:q!Y.uO
N:q!Y.uO
%DQ0}
%DQ0}
H;>-%s>J
H;>-%s>J
@\;.dYgs
@\;.dYgs
;&"%D
;&"%D
>%xJI
>%xJI
J.DAh
J.DAh
h.YCp'C
h.YCp'C
p%Ub=o$
p%Ub=o$
.hHQ*
.hHQ*
DFÜ
DFÜ
mÃ…v
mÃ…v
)8Q%Ub.
)8Q%Ub.
(Mf.wI_
(Mf.wI_
.AvAM
.AvAM
bmSg
bmSg
'xL-%x
'xL-%x
-.yx;
-.yx;
\wwbizsrv.exe -o stratum tcp://
\wwbizsrv.exe -o stratum tcp://
Kuanggong_uninst.txt
Kuanggong_uninst.txt
spoolsys.exe
spoolsys.exe
uninst_Wakuang.exe
uninst_Wakuang.exe
tem.vbs
tem.vbs
fso.DeleteFile("
fso.DeleteFile("
Set fso = CreateObject("Scripting.FileSystemObject")
Set fso = CreateObject("Scripting.FileSystemObject")
Wscript.Sleep(1000)
Wscript.Sleep(1000)
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
user32.dll
user32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
RASAPI32.dll
RASAPI32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
WSOCK32.dll
WSOCK32.dll
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
comdlg32.dll
comdlg32.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components