Trojan.Win32.Delphi.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, VirTool
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 7c48316b2376ff78a962f4b728f16212
SHA1: d6d26c317091aefe0be78b11c07e431296553a47
SHA256: 9b4876f682a75e09cf7160af5e9c6a538a6478211c42528013c3dd349132872b
SSDeep: 12288:Yu3XomVNAOBa12Z0yq/Z0/QLDJ byYNEXdyedmyTbAneCtg5q:Yu3Xx1E1ht/ cDJyEXdy0ciq
Size: 753664 bytes
File type: PE32
Platform: WIN32
Entropy: Packed
PEID: ASPackv212, UPolyXv05_v6
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:3380
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:3380 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\flvcd_downrtmp.exe (82347 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\flvjoin.exe (12112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\mp4join.exe (45240 bytes)
Registry activity
The process %original file name%.exe:3380 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
Dropped PE files
MD5 | File path |
---|---|
ec9bc5d281dd20be5ea8d2eb87dbec12 | c:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\flvcd_downrtmp.exe |
bb7730369cd4b1e3bb9046d8dd1a9320 | c:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\flvjoin.exe |
7d8f28cec81947d56070889224ec88d1 | c:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\mp4join.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\flvcd_downrtmp.exe (82347 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\flvjoin.exe (12112 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\flvcd\mp4join.exe (45240 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: flvcd.com
Product Name: Nano
Product Version: 0.4.7
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 0.4.7.11
File Description: ??Nano??????
Comments:
Language: Language Neutral
Company Name: flvcd.comProduct Name: NanoProduct Version: 0.4.7Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 0.4.7.11File Description: ??Nano??????Comments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
CODE | 4096 | 1634304 | 543744 | 5.54484 | a7122871f9bd1744d2858dd3a7b996bc |
DATA | 1638400 | 28672 | 17408 | 5.51076 | 669ad2bb905abd7421930f471492264e |
BSS | 1667072 | 8192 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.idata | 1675264 | 16384 | 4608 | 5.47914 | 67b4d0cce9b337bc8aefa7bba17916b3 |
.tls | 1691648 | 4096 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rdata | 1695744 | 4096 | 512 | 0.127644 | 59fce7c5a5f684438c8f5c77becce3a8 |
.reloc | 1699840 | 102400 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 1802240 | 1007616 | 121856 | 5.49515 | 30f9ea3abf0c4f0a07e7f5bb4e655b99 |
0 | 0 | 0 | 0 | ||
0 | 0 | 0 | 0 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://download.flvcd.com/bigrats_update/flvcd_downrtmp.exe | 124.232.150.42 |
hxxp://download.flvcd.com/bigrats_update/flvjoin.exe | 124.232.150.42 |
hxxp://download.flvcd.com/bigrats_update/mp4join.exe | 124.232.150.42 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /bigrats_update/mp4join.exe HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Host: download.flvcd.com
HTTP/1.1 200 OK
Date: Tue, 31 Jan 2017 02:55:29 GMT
Server: Apache/2.2.27 (CentOS)
Last-Modified: Thu, 01 Dec 2016 16:26:41 GMT
ETag: "e21247-32400-5429b4960c49b"
Accept-Ranges: bytes
Content-Length: 205824
Connection: close
Content-Type: application/octet-stream
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$...E...E...E..v.&..E...3 ..E...3...E...3..EE...=-..E...E...E...3...E...3#..E..Rich.E..........PE..L.....?T.....................D...............0....@.......................................@.....................................,....................................2...............................................................................text.... ..........................`....rdata.......0......................@....data...............................@....rsrc...............................@....reloc...........^..................@....aspack.. ..........................`....adata...............$..............@................................................................................................................................................................................................................................................................................... .......<G.7.M...&....4h.V...l.D....vi7H.#m..R...@yH"..5.m......^V...v..JYTVi.M.......e. ad.l*R@c7.d$.=..o../{....f-......yo;.....y.6.....v.q...6.L.Zf.q2....Z........r.W..U.A.r..n.......w...^...>y..<...}...?....1.*..LY=.o.....B..12.XA.....v........!@.ir..".....#0 J..JM...@.n...o..,TB(*.(V.m$.b W.:x...O..;..SP..c.....2...Wfy..U...5.$i%..T..;7.......y.6......bGp.]@..Z..!H.#RYT..-K>..2.1..U.1....6Q...v.{..c....\..d.["<.rG.-....a&...7r.h..dj..>._.M.....m....qB|#H.k\W..b...#k.8...5.m^.-gu)...40
<<< skipped >>>
GET /bigrats_update/flvjoin.exe HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Host: download.flvcd.com
HTTP/1.1 200 OK
Date: Tue, 31 Jan 2017 02:55:13 GMT
Server: Apache/2.2.27 (CentOS)
Last-Modified: Thu, 01 Dec 2016 16:26:33 GMT
ETag: "e21236-f200-5429b48db2d63"
Accept-Ranges: bytes
Content-Length: 61952
Connection: close
Content-Type: application/octet-stream
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z....L...L...L...L...L...L,..L...L...L...L...L...L...L...L...L...L...LRich...L........PE..L....3>T.................N...v...............`....@..........................@......~.....@.................................. ..,....................................a...............................................................................text....P..........................`....rdata...@...`......................@....data....@..........................@....rsrc...............................@....reloc... ..........................@....aspack.. ..........................`....adata.......0......................@........................................................................................................................................................................................................................................................................................... .......3...4&....FP*J.`...Hh..H..wf....6..NK.!... ..V}>.jw.s..[G.m.S...[-|,.<.....H ...`...c<...~h.ay.E...........?(^s..s....y.A.{vS.v>[!r..v......sAl.V.l...oW6<.dZ..6.F.q.....{..y.8=............^.......f......`D..,l..=././........._^.....^......n....9.i"<.m..m.7..VnXw.:'B8.. .yF:].@s(....u.Z} ..$..nJ.....&.W[A.I#.......-d..t...2.#..6.RV.s..&Y.........h...@..pc.z.#.(.]...d.G..A..DBX..c.S.JX..a..j...wpOI.Y.*......A.Y..........Q.\b.NC;f.W.......1...!?U..X...1YQ~...^.U.....T.M...L...o.`
<<< skipped >>>
GET /bigrats_update/flvcd_downrtmp.exe HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Host: download.flvcd.com
HTTP/1.1 200 OK
Date: Tue, 31 Jan 2017 02:55:04 GMT
Server: Apache/2.2.27 (CentOS)
Last-Modified: Thu, 01 Dec 2016 16:26:38 GMT
ETag: "e2123e-74e34-5429b493088f3"
Accept-Ranges: bytes
Content-Length: 478772
Connection: close
Content-Type: application/octet-stream
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......P."..p............t.......2..`.............@.................................x......... ..............................@...............................................................`.......................................................text....r.......t..................`.P`.data...,!......."...x..............@.`..rdata...3.......4..................@.`@.bss.....0............................`..idata.......@......................@.0..CRT.........P......................@.0..tls.... ....`......................@.0./4...........p........................@B/19....................................B/35....................................B/51.....>..............................B/63....................................B/77.....)..............................B/89...................................0B/102....-..............................B/113....0............ .................B........U......HCF....f.U......,CF....f.U..S..4...E...t..D$......D$.......$...........$..@..Dp................E..E......D$....D..D$...F...$..F..D$..E..D$...n....$F...uP..n......D....N.............m.....D$....F..D$....F...$.........m....$..o..........$CF....D..D$..C...$..m....$F..D$..C0..$..m....$F..D$..CP..$..m...i.......'....U.......$.......CF.........&....U.......$.......CF.........&....U..S....E.....=....w;=....rK......D$.......$......m...................1....[]...=....tY=....t.=....u...=.....t&.tE=....u..D$.
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_3380:
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
.aspack
.aspack
.adata
.adata
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s[%d]
%s[%d]
%s_%d
%s_%d
.Owner
.Owner
EInvalidGraphicOperation
EInvalidGraphicOperation
comctl32.dll
comctl32.dll
USER32.DLL
USER32.DLL
uxtheme.dll
uxtheme.dll
UrlMon
UrlMon
%s%s%s%s%s%s%s%s%s%s
%s%s%s%s%s%s%s%s%s%s
Proportional
Proportional
MAPI32.DLL
MAPI32.DLL
TStatusBarh%D
TStatusBarh%D
vsReport
vsReport
OnKeyDown
OnKeyDown
OnKeyPressh
OnKeyPressh
OnKeyUp
OnKeyUp
TComboBoxExEnumerator
TComboBoxExEnumerator
ole32.dll
ole32.dll
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword
HelpKeyword
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
OnExecute
OnExecute
AutoHotkeys|
AutoHotkeys|
AutoHotkeys
AutoHotkeys
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreviewp
KeyPreviewp
WindowState
WindowState
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
tcPW
tcPW
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
c:\hp\delphi7se\Lib\TntClasses.pas
c:\hp\delphi7se\Lib\TntClasses.pas
c:\hp\delphi7se\Lib\TntActnList.pas
c:\hp\delphi7se\Lib\TntActnList.pas
PasswordChar\ G
PasswordChar\ G
c:\hp\delphi7se\Lib\TntStdCtrls.pas
c:\hp\delphi7se\Lib\TntStdCtrls.pas
Internal Error: TntCombo_AutoCompleteKeyPress is only for csSimple and csDropDown style combo boxes.
Internal Error: TntCombo_AutoCompleteKeyPress is only for csSimple and csDropDown style combo boxes.
c:\hp\delphi7se\Lib\TntMenus.pas
c:\hp\delphi7se\Lib\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" "%s").
Internal Error: SyncHotKeyPosition Failed ("%s" "%s").
c:\hp\delphi7se\Lib\TntControls.pas
c:\hp\delphi7se\Lib\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
Internal Error: SubClassUnicodeControl.Control is not Unicode.
.UnicodeClass
.UnicodeClass
Uh.rI
Uh.rI
TntUnicodeVcl.DestroyWindow
TntUnicodeVcl.DestroyWindow
c:\hp\delphi7se\Lib\TntForms.pas
c:\hp\delphi7se\Lib\TntForms.pas
!"#$%&*;@[]^_`{|}
!"#$%&*;@[]^_`{|}
c:\hp\delphi7se\Lib\imgutil.pas
c:\hp\delphi7se\Lib\imgutil.pas
c:\hp\delphi7se\Lib\Winskinini.pas
c:\hp\delphi7se\Lib\Winskinini.pas
%s_%s
%s_%s
ttntpanel.unicodeclass
ttntpanel.unicodeclass
ttntsilentpaintpanel.unicodeclass
ttntsilentpaintpanel.unicodeclass
xcFastReport
xcFastReport
TWWKeyCombo=Combobox
TWWKeyCombo=Combobox
TWWTempKeyCombo=combobox
TWWTempKeyCombo=combobox
TO32DBFLEXEDIT=Edit
TO32DBFLEXEDIT=Edit
5.60.03.29
5.60.03.29
BUTTON.RADIO
BUTTON.RADIO
BUTTON.CHECKBOX
BUTTON.CHECKBOX
3333333
3333333
Progress.Chunk
Progress.Chunk
Tab.Pane
Tab.Pane
Trackbar.ThumbHorz
Trackbar.ThumbHorz
Trackbar.ThumbVert
Trackbar.ThumbVert
Trackbar.ThumbLeft
Trackbar.ThumbLeft
Trackbar.ThumbRight
Trackbar.ThumbRight
Trackbar.ThumbUp
Trackbar.ThumbUp
Trackbar.ThumbDown
Trackbar.ThumbDown
UpDown.Horz
UpDown.Horz
UpDown.Vert
UpDown.Vert
user32.dll
user32.dll
DisableProcessWindowsGhosting
DisableProcessWindowsGhosting
Internal Error: Control does not support ITntGlyphButton.
Internal Error: Control does not support ITntGlyphButton.
c:\hp\delphi7se\Lib\TntButtons.pas
c:\hp\delphi7se\Lib\TntButtons.pas
c:\hp\delphi7se\Lib\TntComCtrls.pas
c:\hp\delphi7se\Lib\TntComCtrls.pas
Internal Error in TTntListColumns.Create().
Internal Error in TTntListColumns.Create().
Internal Error in TTntCustomListView.Create().
Internal Error in TTntCustomListView.Create().
Internal Error: OnCreateItemClass.ItemClass must inherit from TTntListItem.
Internal Error: OnCreateItemClass.ItemClass must inherit from TTntListItem.
Operation would block
Operation would block
Operation now in progress
Operation now in progress
Operation already in progress
Operation already in progress
Socket operation on non-socket
Socket operation on non-socket
Protocol not supported
Protocol not supported
Socket type not supported
Socket type not supported
Operation not supported on socket
Operation not supported on socket
Protocol family not supported
Protocol family not supported
Address family not supported by protocol family
Address family not supported by protocol family
WinSock DLL cannot support this application
WinSock DLL cannot support this application
wsock32.dll
wsock32.dll
Unable to load wsock32.dll -
Unable to load wsock32.dll -
Winsock startup error ws2_32.dll -
Winsock startup error ws2_32.dll -
ws2_32.dll
ws2_32.dll
Unable to load ws2_32.dll -
Unable to load ws2_32.dll -
wship6.dll
wship6.dll
Unable to load wship6.dll -
Unable to load wship6.dll -
advapi32.dll
advapi32.dll
TIcsMsgMap
TIcsMsgMap
c:\hp\delphi7se\Lib\OverbyteIcsWndControl.pas
c:\hp\delphi7se\Lib\OverbyteIcsWndControl.pas
MsgLow not defined
MsgLow not defined
Msg value out of bound
Msg value out of bound
Msg not registered
Msg not registered
windows-1250
windows-1250
windows-1251
windows-1251
windows-1252
windows-1252
windows-1253
windows-1253
windows-1254
windows-1254
windows-1255
windows-1255
windows-1256
windows-1256
windows-1257
windows-1257
windows-1258
windows-1258
gb2312 csgb2312 gbk cp936 ms936 windows-936
gb2312 csgb2312 gbk cp936 ms936 windows-936
shift_jis ms_kanji csshiftjis
shift_jis ms_kanji csshiftjis
windows-874
windows-874
us-ascii ascii us ansi_x3.4-1968 iso-ir-6 ansi_x3.4-1986 iso_646.irv:1991 iso646-us ibm367 cp367 csascii
us-ascii ascii us ansi_x3.4-1968 iso-ir-6 ansi_x3.4-1986 iso_646.irv:1991 iso646-us ibm367 cp367 csascii
IcsNtlmMsgs (c) 2004-2012 F. Piette V8.00
IcsNtlmMsgs (c) 2004-2012 F. Piette V8.00
TNTLM_Msg2_Info
TNTLM_Msg2_Info
TIcsBufferHandler.Remove: Invalid Len
TIcsBufferHandler.Remove: Invalid Len
TIcsBufferHandler.Remove: nothing to remove
TIcsBufferHandler.Remove: nothing to remove
wsoTcpNoDelay
wsoTcpNoDelay
wsoNoHttp10Tunnel
wsoNoHttp10Tunnel
THttpTunnelAuthType
THttpTunnelAuthType
THttpTunnelServerAuthTypes
THttpTunnelServerAuthTypes
THttpTunnelErrorEvent
THttpTunnelErrorEvent
TCustomHttpTunnelWSocket
TCustomHttpTunnelWSocket
Port
Port
LocalPort
LocalPort
SocksPort
SocksPort
SocksPasswordx
SocksPasswordx
HttpTunnelAuthType
HttpTunnelAuthType
HttpTunnelPassword
HttpTunnelPassword
HttpTunnelPort
HttpTunnelPort
HttpTunnelServer
HttpTunnelServer
HttpTunnelUsercode$
HttpTunnelUsercode$
OnHttpTunnelError
OnHttpTunnelError
OnHttpTunnelConnectedT
OnHttpTunnelConnectedT
0.0.0.0
0.0.0.0
Cannot change Port if not closed
Cannot change Port if not closed
Cannot change LocalPort if not closed
Cannot change LocalPort if not closed
255.255.255.255
255.255.255.255
Winsock Resolve Port: Invalid Port.
Winsock Resolve Port: Invalid Port.
Winsock Resolve Port: Invalid Proto.
Winsock Resolve Port: Invalid Proto.
Winsock Resolve Port: Cannot convert port '
Winsock Resolve Port: Cannot convert port '
GetPeerPort
GetPeerPort
c:\hp\delphi7se\Lib\OverbyteIcsWSocket.pas
c:\hp\delphi7se\Lib\OverbyteIcsWSocket.pas
setsockopt(IPPROTO_TCP, TCP_NODELAY)
setsockopt(IPPROTO_TCP, TCP_NODELAY)
Connect: No Port Specified
Connect: No Port Specified
Connect (Invalid operation in OnChangeState)
Connect (Invalid operation in OnChangeState)
listen: port not assigned
listen: port not assigned
TCustomWSocket.Shutdown
TCustomWSocket.Shutdown
SetSocketFamily: New API requires winsock 2.2 and Windows XP, property "SocketFamily" reset to "sfIPv4"
SetSocketFamily: New API requires winsock 2.2 and Windows XP, property "SocketFamily" reset to "sfIPv4"
Multi-Status (WebDAV)
Multi-Status (WebDAV)
Unsupported Media Type
Unsupported Media Type
Unprocessable Entity (WebDAV)
Unprocessable Entity (WebDAV)
Locked (WebDAV)
Locked (WebDAV)
Failed Dependency (WebDAV)
Failed Dependency (WebDAV)
Blocked by Windows Parental Controls
Blocked by Windows Parental Controls
HTTP Version Not Supported
HTTP Version Not Supported
Insufficient Storage (WebDAV)
Insufficient Storage (WebDAV)
HTTP status code
HTTP status code
Not a HTTP status code
Not a HTTP status code
Proxy server must support HTTP/1.1
Proxy server must support HTTP/1.1
Not a HTTP tunnel error
Not a HTTP tunnel error
HTTP Proxy -
HTTP Proxy -
Can't change socks port if not closed
Can't change socks port if not closed
Can't use Socks when HTTP proxy is used as well
Can't use Socks when HTTP proxy is used as well
Listening is not supported thru socks server
Listening is not supported thru socks server
TCP is the only protocol supported thru socks server
TCP is the only protocol supported thru socks server
IPv6 not supported with current socks version
IPv6 not supported with current socks version
0.0.0.1
0.0.0.1
command not supported
command not supported
address type not supported
address type not supported
TCP is the only protocol supported by HTTP proxies
TCP is the only protocol supported by HTTP proxies
HTTP/1.1
HTTP/1.1
HTTP/1.
HTTP/1.
Listening is not supported thru HTTP proxy servers
Listening is not supported thru HTTP proxy servers
Can't change HTTP proxy authentication if not closed
Can't change HTTP proxy authentication if not closed
Can't change HTTP proxy password if not closed
Can't change HTTP proxy password if not closed
Can't change HTTP proxy port if not closed
Can't change HTTP proxy port if not closed
Can't change HTTP proxy if not closed
Can't change HTTP proxy if not closed
Can't use HTTP proxy when Socks is used as well
Can't use HTTP proxy when Socks is used as well
Can't change HTTP proxy usercode if not closed
Can't change HTTP proxy usercode if not closed
THttpTunnelWSocket - DataAvailable error
THttpTunnelWSocket - DataAvailable error
Received header line too long. Increase HttpTunnelBufferSize.
Received header line too long. Increase HttpTunnelBufferSize.
THttpTunnelWSocket - Fatal: Invalid state in TriggerDataAvailable
THttpTunnelWSocket - Fatal: Invalid state in TriggerDataAvailable
THttpTunnelWSocket - Fatal: Internal error in WMHttpTunnelReconnect
THttpTunnelWSocket - Fatal: Internal error in WMHttpTunnelReconnect
TIcsURL (c) 1997-2012 F. Piette V8.00
TIcsURL (c) 1997-2012 F. Piette V8.00
http:
http:
EHttpContentCodingException
EHttpContentCodingException
THttpContentCoding
THttpContentCoding
THttpCCodIdentity
THttpCCodIdentity
THttpCCodStar
THttpCCodStar
THttpContCodItem
THttpContCodItem
THttpContCodHandler
THttpContCodHandler
%s;q=%s
%s;q=%s
%s, %s;q=%s
%s, %s;q=%s
%s, %s
%s, %s
THttpCli (c) 1997-2014 F. Piette V8.10
THttpCli (c) 1997-2014 F. Piette V8.10
EHttpException
EHttpException
THttpRequest
THttpRequest
httpABORT
httpABORT
httpGET
httpGET
httpPOST
httpPOST
httpPUT
httpPUT
httpHEAD
httpHEAD
httpDELETE
httpDELETE
httpCLOSE
httpCLOSE
httpPATCH
httpPATCH
httpOPTIONS
httpOPTIONS
httpTRACE
httpTRACE
OverbyteIcsHttpProt
OverbyteIcsHttpProt
THttpAuthType
THttpAuthType
httpAuthNone
httpAuthNone
httpAuthBasic
httpAuthBasic
httpAuthNtlm
httpAuthNtlm
httpAuthDigest
httpAuthDigest
THttpBeforeAuthEvent
THttpBeforeAuthEvent
THttpRequestDone
THttpRequestDone
THttpCliOption
THttpCliOption
httpoNoBasicAuth
httpoNoBasicAuth
httpoNoNTLMAuth
httpoNoNTLMAuth
httpoBandwidthControl
httpoBandwidthControl
httpoEnableContentCoding
httpoEnableContentCoding
httpoUseQuality
httpoUseQuality
httpoNoDigestAuth
httpoNoDigestAuth
THttpCliOptions
THttpCliOptions
THttpCli
THttpCli
OverbyteIcsHttpProtG
OverbyteIcsHttpProtG
ProxyPort
ProxyPort
Password
Password
ProxyPassword
ProxyPassword
%2.2d %s %4.4d %2.2d:%2.2d:%2.2d
%2.2d %s %4.4d %2.2d:%2.2d:%2.2d
application/x-www-form-urlencoded
application/x-www-form-urlencoded
Mozilla/4.0
Mozilla/4.0
State = httpReady
State = httpReady
State = httpNotConnected
State = httpNotConnected
State = httpConnected
State = httpConnected
State = httpDnsLookup
State = httpDnsLookup
State = httpDnsLookupDone
State = httpDnsLookupDone
State = httpWaitingHeader
State = httpWaitingHeader
State = httpWaitingBody
State = httpWaitingBody
State = httpBodyReceived
State = httpBodyReceived
State = httpWaitingProxyConnect
State = httpWaitingProxyConnect
State = httpClosing
State = httpClosing
State = httpAborting
State = httpAborting
PrepareNTLMAuth begin, FStatusCode = %d FProxyAuthNTLMState=%d FAuthNTLMState=%d
PrepareNTLMAuth begin, FStatusCode = %d FProxyAuthNTLMState=%d FAuthNTLMState=%d
PrepareNTLMAuth end, FStatusCode = %d FProxyAuthNTLMState=%d FAuthNTLMState=%d
PrepareNTLMAuth end, FStatusCode = %d FProxyAuthNTLMState=%d FAuthNTLMState=%d
Login
Login
https
https
HTTP/
HTTP/
httpChunkDone, end of document
httpChunkDone, end of document
HTTP/1.0
HTTP/1.0
hXXp://
hXXp://
hXXps://
hXXps://
HTTP component
HTTP component
HTTP component has nothing to post, put or patch
HTTP component has nothing to post, put or patch
options.htm
options.htm
document.htm
document.htm
HTTP no status code (connection closed prematurely)
HTTP no status code (connection closed prematurely)
Insupported HTTP version
Insupported HTTP version
LeftPopup
LeftPopup
olepro32.dll
olepro32.dll
IWebBrowser
IWebBrowser
IWebBrowserAppL
IWebBrowserAppL
IWebBrowser2
IWebBrowser2
TWebBrowserStatusTextChange
TWebBrowserStatusTextChange
TWebBrowserProgressChange
TWebBrowserProgressChange
TWebBrowserCommandStateChange
TWebBrowserCommandStateChange
TWebBrowserTitleChange
TWebBrowserTitleChange
TWebBrowserPropertyChange
TWebBrowserPropertyChange
TWebBrowserBeforeNavigate2
TWebBrowserBeforeNavigate2
TWebBrowserNewWindow2
TWebBrowserNewWindow2
TWebBrowserNavigateComplete2
TWebBrowserNavigateComplete2
TWebBrowserDocumentComplete
TWebBrowserDocumentComplete
TWebBrowserOnVisible
TWebBrowserOnVisible
TWebBrowserOnToolBar
TWebBrowserOnToolBar
TWebBrowserOnMenuBar
TWebBrowserOnMenuBar
TWebBrowserOnStatusBar
TWebBrowserOnStatusBar
TWebBrowserOnFullScreen
TWebBrowserOnFullScreen
TWebBrowserOnTheaterMode
TWebBrowserOnTheaterMode
TWebBrowser
TWebBrowser
1.2.5
1.2.5
TntEdit1KeyDown
TntEdit1KeyDown
\getset.bak
\getset.bak
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
hXXp://VVV.flvcd.com/diy/diy00
hXXp://VVV.flvcd.com/diy/diy00
hXXp://VVV.flvcd.com/diy.php?id=
hXXp://VVV.flvcd.com/diy.php?id=
hXXp://VVV.flvcd.com/getset.php?url=
hXXp://VVV.flvcd.com/getset.php?url=
HttpOnly
HttpOnly
"url":"
"url":"
'port':'
'port':'
'key':'
'key':'
"clipsURL":[
"clipsURL":[
"clipsURL":["
"clipsURL":["
",port:
",port:
keyUrl=
keyUrl=
Mozilla/5.0 (MSIE 9.0; Windows NT 6.1; Trident/5.0)
Mozilla/5.0 (MSIE 9.0; Windows NT 6.1; Trident/5.0)
.html
.html
.HTML
.HTML
hXXp://data.vod.itc.cn/stream/
hXXp://data.vod.itc.cn/stream/
hXXp://data.vod.itc.cn/
hXXp://data.vod.itc.cn/
?key=
?key=
&key1=
&key1=
&keya=
&keya=
&keyb=
&keyb=
port=
port=
keya=
keya=
keyb=
keyb=
tv.sohu.com
tv.sohu.com
hXXp://pptv.soooner.com:19765/ppvaplaybyopen?url=
hXXp://pptv.soooner.com:19765/ppvaplaybyopen?url=
#EXT-X-KEY:METHOD=AES-128,URI="
#EXT-X-KEY:METHOD=AES-128,URI="
hXXp://air.flvcd.com/51cto?key=
hXXp://air.flvcd.com/51cto?key=
hXXp://VVV.flvcd.com/interface/getlink.php?url=
hXXp://VVV.flvcd.com/interface/getlink.php?url=
ssl/host.shtml
ssl/host.shtml
ssl/ssl.shtml?r=
ssl/ssl.shtml?r=
media1.icourses.cn/
media1.icourses.cn/
media2.icourses.cn/
media2.icourses.cn/
hXXp://k.youku.com/player/getFlvPath/sid/
hXXp://k.youku.com/player/getFlvPath/sid/
m3u8key:
m3u8key:
flvcd.com
flvcd.com
&vkey=
&vkey=
\flvcd\flvcd_downrtmp.exe
\flvcd\flvcd_downrtmp.exe
\flvcd\flvcd_downrtmp.exe" -r "
\flvcd\flvcd_downrtmp.exe" -r "
\flvcd\flvcd_downrtmp.exe" -r "
\flvcd\flvcd_downrtmp.exe" -r "
.mp4" --flv "
.mp4" --flv "
" --swfUrl "
" --swfUrl "
" --pageUrl "
" --pageUrl "
.mp4" --swfUrl "
.mp4" --swfUrl "
VVV.flvcd.com
VVV.flvcd.com
&type=web.fpp
&type=web.fpp
regeturl_run=
regeturl_run=
flvcd_downrtmp.exe
flvcd_downrtmp.exe
InetURL:/1.0
InetURL:/1.0
\flvcd\minfo.exe
\flvcd\minfo.exe
ProxyPort
ProxyPort
.text
.text
\flvcd\flvjoin.exe" "
\flvcd\flvjoin.exe" "
\flvcd\mp4join.exe" "
\flvcd\mp4join.exe" "
\flvcd\nbing.bat
\flvcd\nbing.bat
cmd /C "
cmd /C "
\flvcd\nbing.bat"
\flvcd\nbing.bat"
ffmpeg.exe
ffmpeg.exe
\flvcd\ffmpeg.exe" -y -i
\flvcd\ffmpeg.exe" -y -i
.mp4"
.mp4"
.avi"
.avi"
\flvcd\ffmpeg.exe" -i
\flvcd\ffmpeg.exe" -i
.flv"
.flv"
\flvcd\ffmpeg.exe" -i
\flvcd\ffmpeg.exe" -i
flvbind.exe
flvbind.exe
mp4box.exe
mp4box.exe
.mp4"
.mp4"
\flvcd\flvbind.exe" "
\flvcd\flvbind.exe" "
\flvcd\mp4box.exe"
\flvcd\mp4box.exe"
grfKeyState
grfKeyState
TComTargetExecEvent
TComTargetExecEvent
CmdGroup
CmdGroup
nCmdID
nCmdID
nCmdexecopt
nCmdexecopt
hhctrl.ocx
hhctrl.ocx
URLMON.DLL
URLMON.DLL
SHDOCLC.DLL
SHDOCLC.DLL
IWebBrowserApp
IWebBrowserApp
IWebBrowser28
IWebBrowser28
TEWBWindowSetResizable
TEWBWindowSetResizable
TEWBWindowSetLeft
TEWBWindowSetLeft
TEWBWindowSetTop
TEWBWindowSetTop
TEWBWindowSetWidth
TEWBWindowSetWidth
TEWBWindowSetHeight
TEWBWindowSetHeight
bstrUrlContext
bstrUrlContext
bstrUrl
bstrUrl
OnWindowSetResizableh
OnWindowSetResizableh
OnWindowSetLeft
OnWindowSetLeft
OnWindowSetTop
OnWindowSetTop
OnWindowSetWidth0
OnWindowSetWidth0
OnWindowSetHeightx
OnWindowSetHeightx
rcmDefault
rcmDefault
rcmDebug
rcmDebug
DontExecuteScripts
DontExecuteScripts
DontExecuteJava
DontExecuteJava
DontExecuteActiveX
DontExecuteActiveX
DisableUrlIfEncodingUTF8
DisableUrlIfEncodingUTF8
EnableUrlIfEncodingUTF8
EnableUrlIfEncodingUTF8
CheckFontSupportsCodePage
CheckFontSupportsCodePage
DisableSubmitUrlInUTF8
DisableSubmitUrlInUTF8
EnableSubmitUrlInUTF8
EnableSubmitUrlInUTF8
lpMsg
lpMsg
PMsg
PMsg
pguidCmdGroup
pguidCmdGroup
TTranslateUrlEvent
TTranslateUrlEvent
pchURLIn
pchURLIn
ppchURLOut
ppchURLOut
CmdID
CmdID
pszUrl
pszUrl
pszUrlContext
pszUrlContext
szPassWord
szPassWord
ErrorUrl
ErrorUrl
OptionKeyPath
OptionKeyPath
OverrideOptionKeyPath
OverrideOptionKeyPath
OnTranslateUrl
OnTranslateUrl
OnCommandExec
OnCommandExec
'%s' is not supported.
'%s' is not supported.
WebocPopupManagement
WebocPopupManagement
ValidateNavigateUrl
ValidateNavigateUrl
HttpUsernamePasswordDisable
HttpUsernamePasswordDisable
GetUrlDomFilePathUnencoded
GetUrlDomFilePathUnencoded
XmlHttp
XmlHttp
PTF://
PTF://
AppEvents\Schemes\Apps\Explorer\Navigating\.Current
AppEvents\Schemes\Apps\Explorer\Navigating\.Current
.Current
.Current
\ieframe.dll
\ieframe.dll
\shdocvw.dll
\shdocvw.dll
\StringFileInfo\%0.4x%0.4x\%s
\StringFileInfo\%0.4x%0.4x\%s
TMsgEvent
TMsgEvent
TKeyEventEx
TKeyEventEx
Bypass
Bypass
poPortrait
poPortrait
OnKeyDown0}V
OnKeyDown0}V
0.750000
0.750000
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform
User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(
User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(
EmbeddedWB hXXp://bsalsa.com/
EmbeddedWB hXXp://bsalsa.com/
(bigrats web browser for nano 0.4.7.11r)
(bigrats web browser for nano 0.4.7.11r)
hXXp://v.t.sina.com.cn/share/share.php?url=
hXXp://v.t.sina.com.cn/share/share.php?url=
TntFormKeyDown
TntFormKeyDown
ListView1KeyDown
ListView1KeyDown
TntListView2KeyDown
TntListView2KeyDown
TntListView3KeyDown
TntListView3KeyDown
Nano v0.4.7.11
Nano v0.4.7.11
Bigrats Nano v0.4.7.11 release
Bigrats Nano v0.4.7.11 release
\flvcd\nanoset.ini
\flvcd\nanoset.ini
FLVCDHotKey
FLVCDHotKey
\flvcd\mainlist.dxq
\flvcd\mainlist.dxq
@@.flv@@.mp4@@.f4v@@.m4v@@.flx@@.hlv@@.rm@@.rmvb@@.3gp@@.wmv@@.fmv@@.flvx@@
@@.flv@@.mp4@@.f4v@@.m4v@@.flx@@.hlv@@.rm@@.rmvb@@.3gp@@.wmv@@.fmv@@.flvx@@
@@.flx@@.flvx@@.hlv@@.fmv@@
@@.flx@@.flvx@@.hlv@@.fmv@@
\flvcd\baq.txt
\flvcd\baq.txt
Nano 0.4.7.11
Nano 0.4.7.11
\flvcd\nanolist\*.lt
\flvcd\nanolist\*.lt
hXXp://VVV.flvcd.com/diy/
hXXp://VVV.flvcd.com/diy/
\flvcd\mainlist_bak.dxq
\flvcd\mainlist_bak.dxq
C:\flvcd
C:\flvcd
hXXp://VVV.flvcd.com/interface/parsem-flvcd.php?id=
hXXp://VVV.flvcd.com/interface/parsem-flvcd.php?id=
&url=
&url=
hXXp://video.baidu.com/v?&word=
hXXp://video.baidu.com/v?&word=
hXXp://VVV.google.com.hk/search?q=
hXXp://VVV.google.com.hk/search?q=
\flvcd\flvjoin.dll
\flvcd\flvjoin.dll
\flvcd\mp4join.exe
\flvcd\mp4join.exe
\flvcd\flvjoin.exe
\flvcd\flvjoin.exe
\flvcd\bing.exe
\flvcd\bing.exe
\convert.exe
\convert.exe
\mencoder.exe
\mencoder.exe
\ffmpeg.exe
\ffmpeg.exe
{CAF49BBB-AC40-4FDE-8797-51D5AEB5FLVCD}
{CAF49BBB-AC40-4FDE-8797-51D5AEB5FLVCD}
\mainlist_bak.dxq
\mainlist_bak.dxq
\mainlist.dxq
\mainlist.dxq
C:\flvcd\mainlist.dxq
C:\flvcd\mainlist.dxq
C:\flvcd\mainlist_bak.dxq
C:\flvcd\mainlist_bak.dxq
!!""##$$%%&&''(())** ,,--..//0123456789:;?
!!""##$$%%&&''(())** ,,--..//0123456789:;?
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
(3-!0,1'8"5.*2$
(3-!0,1'8"5.*2$
inflate 1.2.5 Copyright 1995-2010 Mark Adler
inflate 1.2.5 Copyright 1995-2010 Mark Adler
hu`%C
hu`%C
iu2.iu
iu2.iu
GetKeyboardType
GetKeyboardType
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegQueryInfoKeyA
RegQueryInfoKeyA
RegFlushKey
RegFlushKey
RegEnumKeyExA
RegEnumKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
WinExec
WinExec
GetCPInfo
GetCPInfo
CreatePipe
CreatePipe
version.dll
version.dll
gdi32.dll
gdi32.dll
SetViewportOrgEx
SetViewportOrgEx
GetViewportOrgEx
GetViewportOrgEx
VkKeyScanW
VkKeyScanW
UnregisterHotKey
UnregisterHotKey
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
SetWindowsHookExA
SetWindowsHookExA
RegisterHotKey
RegisterHotKey
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyW
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyNameTextW
GetKeyNameTextW
GetKeyNameTextA
GetKeyNameTextA
GetAsyncKeyState
GetAsyncKeyState
EnumWindows
EnumWindows
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
shell32.dll
shell32.dll
ShellExecuteW
ShellExecuteW
SHFileOperationA
SHFileOperationA
wininet.dll
wininet.dll
InternetOpenUrlA
InternetOpenUrlA
HttpQueryInfoA
HttpQueryInfoA
UrlMkSetSessionOption
UrlMkSetSessionOption
winmm.dll
winmm.dll
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
&OverbyteIcsUrl
&OverbyteIcsUrl
TntWindows
TntWindows
.TntComCtrls
.TntComCtrls
0OverbyteIcsHttpProt
0OverbyteIcsHttpProt
'OverbyteIcsNtlmMsgs
'OverbyteIcsNtlmMsgs
OverbyteIcsHttpContCod
OverbyteIcsHttpContCod
?HTTPApp
?HTTPApp
>WebConst
>WebConst
nano 0.4.7.11
nano 0.4.7.11
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
KeyPreview
KeyPreview
Picture.Data
Picture.Data
Glyph.Data
Glyph.Data
0.4.7.11 Build 160425
0.4.7.11 Build 160425
}}~}}~}}~}}~}}~}}~}}~}}~~~
}}~}}~}}~}}~}}~}}~}}~}}~~~
}}~}}~}}~}}~}}~}}~}}~}}~}}~}}~}}~~~
}}~}}~}}~}}~}}~}}~}}~}}~}}~}}~}}~~~
hXXp://weibo.com/flvcd
hXXp://weibo.com/flvcd
.LGBA)
.LGBA)
'%D"8h
'%D"8h
Items.Strings
Items.Strings
Icon.Data
Icon.Data
Skin3rd.Strings
Skin3rd.Strings
#V.zTo
#V.zTo
cK^.ShM
cK^.ShM
bNTPORTPU[^~
bNTPORTPU[^~
PrintOptions.Margins.Left
PrintOptions.Margins.Left
PrintOptions.Margins.Right
PrintOptions.Margins.Right
PrintOptions.Margins.Top
PrintOptions.Margins.Top
PrintOptions.Margins.Bottom
PrintOptions.Margins.Bottom
PrintOptions.HTMLHeader.Strings
PrintOptions.HTMLHeader.Strings
PrintOptions.Orientation
PrintOptions.Orientation
C:\FDownload\
C:\FDownload\
D:\FDownload\
D:\FDownload\
E:\FDownload\
E:\FDownload\
F:\FDownload\
F:\FDownload\
The procedure entry point %s could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
urlmon.dll
urlmon.dll
version="1.0.0.0"
version="1.0.0.0"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
Unspecified error (%d) from %s.
Unspecified error (%d) from %s.
.flv.bc
.flv.bc
.mp4.bc
.mp4.bc
.f4v.bc
.f4v.bc
.m4v.bc
.m4v.bc
hXXp://VVV.flvcd.com/nil
hXXp://VVV.flvcd.com/nil
hXXp://VVV.flvcd.com/null2
hXXp://VVV.flvcd.com/null2
\success.wav
\success.wav
lxdns.com/|503|
lxdns.com/|503|
hXXp://VVV.flvcd.com/util/pptv_key.php
hXXp://VVV.flvcd.com/util/pptv_key.php
TOM.COM
TOM.COM
.html.bc
.html.bc
hXXp://download.flvcd.com/bigrats_update/flvcd_downrtmp.exe
hXXp://download.flvcd.com/bigrats_update/flvcd_downrtmp.exe
\minfo.exe
\minfo.exe
Explorer.exe
Explorer.exe
errorUrl
errorUrl
\bigratesupdate.ini
\bigratesupdate.ini
hXXp://download.flvcd.com/bigrats_update/bigratesupdate.ini
hXXp://download.flvcd.com/bigrats_update/bigratesupdate.ini
\touch.exe
\touch.exe
\nano.exe
\nano.exe
\shuffle.exe
\shuffle.exe
\commence.exe
\commence.exe
\upgrade.exe
\upgrade.exe
: nano 0.4.7.11 build 160425
: nano 0.4.7.11 build 160425
flvcd@126.com
flvcd@126.com
\nano.exe.tmp
\nano.exe.tmp
hXXp://VVV.flvcd.com
hXXp://VVV.flvcd.com
mainlist.dxq
mainlist.dxq
mainlist.bak.dxq
mainlist.bak.dxq
hXXp://VVV.flvcd.com/start.htm
hXXp://VVV.flvcd.com/start.htm
hXXp://VVV.flvcd.com/flvcdgame_5.htm
hXXp://VVV.flvcd.com/flvcdgame_5.htm
\flvjoin.exe
\flvjoin.exe
\mp4join.exe
\mp4join.exe
hXXp://VVV.flvcd.com/flvcdgame_1.htm
hXXp://VVV.flvcd.com/flvcdgame_1.htm
hXXp://VVV.flvcd.com/flvcdgame_2.htm
hXXp://VVV.flvcd.com/flvcdgame_2.htm
hXXp://VVV.flvcd.com/flvcdgame_3.htm
hXXp://VVV.flvcd.com/flvcdgame_3.htm
\bing.exe
\bing.exe
hXXp://VVV.flvcd.com/flvcdgame_6.htm
hXXp://VVV.flvcd.com/flvcdgame_6.htm
hXXp://download.flvcd.com/bigrats_update/flvjoin.exe
hXXp://download.flvcd.com/bigrats_update/flvjoin.exe
hXXp://download.flvcd.com/bigrats_update/mp4join.exe
hXXp://download.flvcd.com/bigrats_update/mp4join.exe
hXXp://VVV.flvcd.com/convert/index.htm
hXXp://VVV.flvcd.com/convert/index.htm
\upgrade.exe.bc
\upgrade.exe.bc
hXXp://VVV.flvcd.com/bigrats_updata/upgrade.exe
hXXp://VVV.flvcd.com/bigrats_updata/upgrade.exe
\flvcd_downrtmp.exe
\flvcd_downrtmp.exe
\lt.dxq
\lt.dxq
Thai (Windows)
Thai (Windows)
Turkish (Windows)
Turkish (Windows)
Vietnamese (Windows)
Vietnamese (Windows)
Western European (Windows)"GetCoding must be overridden in %s"Invalid buffer size for decryption
Western European (Windows)"GetCoding must be overridden in %s"Invalid buffer size for decryption
JPEG error #%d
JPEG error #%d
Cyrillic (Windows)
Cyrillic (Windows)
Greek (Windows)
Greek (Windows)
Hebrew (Windows)
Hebrew (Windows)
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s
Arabic (Windows)
Arabic (Windows)
Baltic (Windows)
Baltic (Windows)
Central European (Windows)
Central European (Windows)
Invalid ownerE%d is an invalid PageIndex value. PageIndex must be between 0 and %d=This control requires version 4.70 or greater of COMCTL32.DLL
Invalid ownerE%d is an invalid PageIndex value. PageIndex must be between 0 and %d=This control requires version 4.70 or greater of COMCTL32.DLL
Date exceeds maximum of %s
Date exceeds maximum of %s
Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or timeúiled to set maximum selection range$Failed to set calendar min/max rangeúiled to set calendar selected range
Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or timeúiled to set maximum selection range$Failed to set calendar min/max rangeúiled to set calendar selected range
No help keyword specified.
No help keyword specified.
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d
Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d
Cannot open clipboard/Menu '%s' is already being used by another form
Cannot open clipboard/Menu '%s' is already being used by another form
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Value must be between %d and %d
Value must be between %d and %d
Invalid clipboard format Clipboard does not support Icons
Invalid clipboard format Clipboard does not support Icons
$Parent given is not a parent of '%s'
$Parent given is not a parent of '%s'
%s property out of range
%s property out of range
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Failed to get data for '%s'
Failed to get data for '%s'
Failed to set data for '%s'
Failed to set data for '%s'
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Thread creation error: %s
Thread creation error: %s
Thread Error: %s (%d)0Tab position incompatible with current tab style0Tab style incompatible with current tab position
Thread Error: %s (%d)0Tab position incompatible with current tab style0Tab style incompatible with current tab position
Unable to write to %s
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid property element: %s
Invalid property element: %s
Invalid data type for '%s' List capacity out of bounds (%d)
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Failed to create key %s
Failed to create key %s
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Operation not supported
Operation not supported
External exception %x
External exception %x
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
1Format '%s' invalid or incompatible with argument
1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
!'%s' is not a valid integer value('%s' is not a valid floating point value
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d
I/O error %d
"FLVCD.COM"
"FLVCD.COM"
0.4.7.11
0.4.7.11
0.4.7
0.4.7
%original file name%.exe_3380_rwx_006AE000_00002000:
kernel32.dll
kernel32.dll
user32.dll
user32.dll
The procedure entry point %s could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
advapi32.dll
advapi32.dll
oleaut32.dll
oleaut32.dll
version.dll
version.dll
gdi32.dll
gdi32.dll
ole32.dll
ole32.dll
comctl32.dll
comctl32.dll
shell32.dll
shell32.dll
wininet.dll
wininet.dll
urlmon.dll
urlmon.dll
winmm.dll
winmm.dll
GetKeyboardType
GetKeyboardType
version="1.0.0.0"
version="1.0.0.0"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
flvcd.com
flvcd.com
0.4.7.11
0.4.7.11
0.4.7
0.4.7