Gen.Variant.Zusy.174222_44642d1242 – Adaware

Gen:Variant.Zusy.174222 (B) (Emsisoft), Gen:Variant.Zusy.174222 (AdAware), Packed.Win32.Themida.FD, Trojan-Downloader.Win32.Karagany.1.FD, Trojan-PSW.Win32.Bzub.2.FD, Trojan-PSW.Win32.MSNPassword.FD, Trojan.NSIS.StartPage.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan-PSW, Trojan, Packed

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 44642d1242059e400b66b215784bdf2c

SHA1: 80e93589a8bee38f3f9ed4e0d31c549276bfc53e

SHA256: 7f0f12346b7013c13b050622e1dd196201b6014a45a4e0dff8011438435459c2

SSDeep: 98304:NbAhyLWyYgC8XE3G12agJZ4gu7jC4VyK5Zr:NAcLWy5pSlZVu7G8Xr

Size: 3145808 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, ACProtect141

Company: no certificate found

Created at: 2016-05-27 20:49:43

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan-Downloader. Trojan program, which downloads files from the Internet without user's notice and executes them.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regini.exe:312

The Trojan injects its code into the following process(es):

%original file name%.exe:348

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:348 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\r.log (1 bytes)
C:\UUWiseHelper.dll (291 bytes)
C:\ZMApi.dll (7972 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (843 bytes)
C:\XQS.ini (224 bytes)
C:\dc.dll (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.txt (256 bytes)
C:\%original file name%.exe (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dfg.dat (116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.txt (250 bytes)
C:\ÃƒÆ’Ã‹â€ ÃƒÆ’Ã¢â‚¬Â¢ÃƒÆ’Ã¢â‚¬â€œÃƒâ€šÃ‚Â¾\Ãƒâ€šÃ‚Â²ÃƒÆ’Ã¢â€žÂ¢ÃƒÆ’Ã¢â‚¬â€ÃƒÆ’Ã‚Â·ÃƒÆ’Ã‹â€ ÃƒÆ’Ã¢â‚¬Â¢ÃƒÆ’Ã¢â‚¬â€œÃƒâ€šÃ‚Â¾2016ÃƒÆ’Ã¢â‚¬Å¾ÃƒÆ’Ã‚Âª6ÃƒÆ’Ã¢â‚¬ÂÃƒÆ’Ã¢â‚¬Å¡10ÃƒÆ’Ã‹â€ ÃƒÆ’Ã¢â‚¬Â¢.txt (342 bytes)
C:\qadati.dll (111 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Internet Explorer.lnk (831 bytes)

The Trojan deletes the following file(s):

C:\jzjllzzterudjwconntf.dfg (0 bytes)

Registry activity

The process regini.exe:312 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 A9 5B 60 2A F5 A0 EF 20 97 EA 2A 03 EA 15 34"

The process %original file name%.exe:348 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command]
"(Default)" = "%Program Files%\Internet Explorer\iexplore.exe http://www.2345.com/?34067-0099"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?34067-0099"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows Script\Settings]
"JITDebug" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Search Bar" = "http://www.2345.com/?34067-0099"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = "http://www.2345.com/?34067-0099"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 9A 17 89 52 75 B6 97 0A 57 80 CF EB 3C B6 ED"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?34067-0099"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Policies\Microsoft\Internet Explorer\Main]
"Search Page" = "http://www.2345.com/?34067-0099"
"Default_Page_URL" = "http://www.2345.com/?34067-0099"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

Dropped PE files

MD5	File path
c4c10732a67a5b4caf970c642a701d4a	c:\%original file name%.exe
ab61a40bc56080a37d3b8ec4465d868d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\dfg.dat
dc6b73cbd1f6f5cec640a8c634ae50c8	c:\UUWiseHelper.dll
3acaceed9edcf17193c69b5409cec1e0	c:\ZMApi.dll
f803ad370a8649a143429f179af5f3ab	c:\dc.dll
842cb72bf02c2205d84c243ead552354	c:\qadati.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
regini.exe:312
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\r.log (1 bytes)
C:\UUWiseHelper.dll (291 bytes)
C:\ZMApi.dll (7972 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk (843 bytes)
C:\XQS.ini (224 bytes)
C:\dc.dll (122 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2.txt (256 bytes)
C:\%original file name%.exe (20507 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\dfg.dat (116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\1.txt (250 bytes)
C:\ÃƒÆ’Ã‹â€ ÃƒÆ’Ã¢â‚¬Â¢ÃƒÆ’Ã¢â‚¬â€œÃƒâ€šÃ‚Â¾\Ãƒâ€šÃ‚Â²ÃƒÆ’Ã¢â€žÂ¢ÃƒÆ’Ã¢â‚¬â€ÃƒÆ’Ã‚Â·ÃƒÆ’Ã‹â€ ÃƒÆ’Ã¢â‚¬Â¢ÃƒÆ’Ã¢â‚¬â€œÃƒâ€šÃ‚Â¾2016ÃƒÆ’Ã¢â‚¬Å¾ÃƒÆ’Ã‚Âª6ÃƒÆ’Ã¢â‚¬ÂÃƒÆ’Ã¢â‚¬Å¡10ÃƒÆ’Ã‹â€ ÃƒÆ’Ã¢â‚¬Â¢.txt (342 bytes)
C:\qadati.dll (111 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Internet Explorer.lnk (831 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ?????
Product Name: QQ??????? Www.52Dfg.Com
Product Version: 1.0.0.0
Legal Copyright: ??????????[www.52dfg.com],??????,?????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ????QQ?????,?????,??????,????????
Comments: ???????
Language: English (United States)

Company Name: ?????Product Name: QQ??????? Www.52Dfg.ComProduct Version: 1.0.0.0Legal Copyright: ??????????[www.52dfg.com],??????,?????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ????QQ?????,?????,??????,????????Comments: ???????Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	4247552	1708032	5.5451	4e0d66f7ee449bd2464d66e497efebd9
UPX	4251648	1396736	1396736	4.86304	e272ecfe240c3e6665170c791449946e
.idata	5648384	4096	4096	1.03985	37314439b3c415063cfe6006fd66034b
.rsrc	5652480	20480	20480	2.48603	de9cdfd9a036851211dc667c49bb1484
UPX	5672960	4096	4096	5.53474	120cfc15de5c0bc59a2323df06c9a3dd

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://92wg.sinaapp.com/softtj.php?act=add&softname=XQS	220.181.136.41
hxxp://p21.tcdn.qq.com/ACT/vip_act/act_data/28302.json.js
hxxp://qiniunor.xdwscache.ourwebat.com/20160427.gif
hxxp://qiniunor.xdwscache.ourwebat.com/dfg20160104.dat
hxxp://qiniunor.xdwscache.ourwebat.com/ad220160223.gif
hxxp://7xjnh3.com2.z0.glb.qiniucdn.com/dfg20160104.dat	183.134.16.85
hxxp://7xjnh3.com1.z0.glb.clouddn.com/20160427.gif	183.134.16.85
hxxp://7xjnh3.com2.z0.glb.qiniucdn.com/ad220160223.gif	183.134.16.85
hxxp://imgcache.gtimg.cn/ACT/vip_act/act_data/28302.json.js	203.205.150.19
apisoft.df0535.com	122.141.227.180

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /20160427.gif HTTP/1.1

Referer: hXXp://7xjnh3.com1.z0.glb.clouddn.com/20160427.gif

Accept: */*

Accept-Language: zh-CN

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko QQBrowser/8.1.3700.400

Host: 7xjnh3.com1.z0.glb.clouddn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 09 Jun 2016 12:41:31 GMT

Content-Length: 23203

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Expose-Headers: X-Log, X-Reqid

Access-Control-Max-Age: 2592000

Content-Disposition: inline; filename="20160427.gif"

Content-Transfer-Encoding: binary

Last-Modified: Mon, 23 May 2016 14:45:32 GMT

Server: nginx

Content-Type: image/gif

ETag: "Fub__YQqcV7BJsdeHwIOlpx8gvQH"

X-Log: mc.g;IO:1/304

X-Reqid: UH0AADbKz68lJlYU

X-Qiniu-Zone: 0

Cache-Control: public, max-age=31536000

Age: 1

X-Via: 1.1 dxxz51:8105 (Cdn Cache Server V2.0), 1.1 tzhdx29:8 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a.............................................:.............................K.....q[..........C.................NY..Z..l..r....p.....W..{..g.........Z..R....J..k.."........?........>m..R.......!...V..Z..q..I.....R....b..A..f.................d...H.......#..$...J..........A...p....!T..n....lU.....J..m..E....kw....Y.....VA....CB..J..U....(.....;..9A....;J..A....... B..?....\..K`..8..l.......$..9......J..B..9..8..B....:........7.~sL.....:....P0.......{n..>..<....7h..;...yy;..0..0..0...gi;..<...il....x.;..1../..e.y<..1..L.......2=......}V.k!^..j.U.blG..*..j~:<...QLcsv3x..X.*w..KN>t.hm7clT.QP%s..Z?"p.?gp#e{AaM.;).`.._}. , Q..R..5B.'#:IZ.RjMD>.%5..%S@%.#!.Gq.%..EZ...74O................7a.....$.......5N#-9I#$...........>..........#X...."J...o....;!.!..$c..J..#..............!..NETSCAPE2.0.....!...2...,............a...b....IdX..............;.h$........T..dI<(..ZY..K..bn.D....8s...S.*.@....J.M.......)...'....c...A..i.dJ.-_>.9..'.@}....mN.h.....`..L.>.JB*U..9z.:.d..*Y....S..q..m...Z.s-.]..U..K..m...E.....z....cg>..s3e..{.U.7.h..IP<}1.`....A..6L..sK.M....D.~...7i......z|.H.._...}.{....5..to.....>..U..!..I...\ld........h..7.x........Rs......-...FmWP_.1d.B...........a8.W...XcfA....x..M....*....)..2.n&.t.B..4BCW~....Z._...F.k.v.XM?...(.d..'....|O..%..9.e.......]...9....6...*D...(.8Y...1....b9..%......'..7.GfX......mR.&...:. .x.h.8a..S<...D\..j....ab.......v...tr.).t....t..)... ......%...D.Ed..3.H..."....6......H#.p.H.].rJ)I^j..L..B. ....W\..x..X.........h....".*~t...Ptq.....

<<< skipped >>>

GET /dfg20160104.dat HTTP/1.1

Referer: hXXp://7xjnh3.com2.z0.glb.qiniucdn.com/dfg20160104.dat

Accept: */*

Accept-Language: zh-CN

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko QQBrowser/8.1.3700.400

Host: 7xjnh3.com2.z0.glb.qiniucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 09 Jun 2016 12:41:44 GMT

Content-Length: 116736

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Expose-Headers: X-Log, X-Reqid

Access-Control-Max-Age: 2592000

Content-Disposition: inline; filename="dfg20160104.dat"

Content-Transfer-Encoding: binary

Last-Modified: Mon, 04 Jan 2016 09:23:20 GMT

Server: nginx

Content-Type: application/x-ns-proxy-autoconfig

ETag: "FmA80h0qcmyrSb2W1izjaL0fQ48C"

X-Log: mc.g;IO:1/304

X-Reqid: PQ8AABCpq8zuJVYU

X-Qiniu-Zone: 0

Cache-Control: public, max-age=31536000

Age: 1

X-Via: 1.1 dianxinxiazai50:80 (Cdn Cache Server V2.0), 1.1 zhoudianxin28:6 (Cdn Cache Server V2.0)

Connection: keep-alive

..hk...r......Tl........9sW.'...X.U..............k......U......P...._.....K..]..>>..2.@.X^..y..9.....*...............m.Q..j!v......{U.j.d0......}8..?K.......`Js,Q...lw...8V....(8.L.}..`....i,k}..L.-..g..... !o......0...n{..X...w.w{..1.......1.B...}...W..j....o3X....(-.y.mPs..tW$.N.......H....AkSM............9%D.D.f....AZ:....Kt...C.w\.nY.;.AwHE..1H#ULJ.L.bJ..A.s.N.89<..Q.I"...[B..b.PT...5,.c....t.."gt.......J|...*..$3..........V.ha#.,....O..}.0>..5,.z....|"........e......d.w...O2.%........F............:......G..j*......e,..`..........T.?..nT..a.'...9>.9'3W..."......i.@..7....;\K.Do..E=.}.x...d..=0...pb..9X^..R_.o...\..]....b].J...........QdE5....7.}.`5...rER...dE6_.......Ce".MN....U..i...j.'..*..ecOcl..h1.../.4..o...j...@.._8..0.3...x..I...D.>~.......).{..c.tL0j..&..Sb5.J........kx......l...#(........m.Z[.......A.....<.. ....R.b....l J^X..**.!..h......g...R.c..lJ..!...._.. u....^W.-.....;l..x4..3.)}.Q.%.2.&3....L..=..j.....:....5v.................W..?.W..I....X.....U]...f.S....<8.j.3.C...[.[.Pi-D-q.&.b...wo.....G..SJY..K.K.......F....B;..7..{.`}.Q.......*5>.K~;t^...yV.KS....$?..Uw#...xL..._[xX.F%...../.q.z...=.....*.I.........#....H}...=....XF.!..PZg.P... >=..6r.\1....U..._..z...p..:.Y#.R........p.i.WG.N...._&....................>f9..j.cR..ut...:.l...l(.....~.k....^.'........W.m.Z.Pm.>k.c5...e'.{..K/4|..}D........."J m.(7,.mT..>;.-......._2..0I...A',.rc.n...*...8'...T..kg.X.Z...1_.w.i.&........y..V.m......U.w....jK.6>.G.'..aR......o......d.Q....y.=.....F..........U.....

<<< skipped >>>

GET /ACT/vip_act/act_data/28302.json.js HTTP/1.1

Referer: hXXp://imgcache.gtimg.cn/ACT/vip_act/act_data/28302.json.js

Accept: */*

Accept-Language: zh-CN

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko QQBrowser/8.1.3700.400

Host: imgcache.gtimg.cn

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: X2S_Platform

Connection: keep-alive

Date: Fri, 10 Jun 2016 10:55:38 GMT

Cache-Control: max-age=600

Expires: Fri, 10 Jun 2016 11:05:38 GMT

Last-Modified: Sat, 28 Feb 2015 06:31:13 GMT

Content-Type: application/x-javascript

Content-Length: 61984

Keep-Alive: timeout=60

X-Cache-Lookup: Hit From Upstream

X-Cache-Lookup: Hit From Disktank

AMD_28302={cfg:{g:"",n:"PC\u5e74\u8d39\u4f1a\u5458\u4e13\u533a<sup style=\"color:#ff0000;\">2014<\/sup>",st:1408932000,et:1546271996,rid:"",oid:"-",aid:"vip.pingtai.vipsite.year_28302"},form:{1:[{f_1:"ipad2\u4e00\u90e8",f_2:"http:\/\/imgcache.qq.com\/clubact\/2013\/yearGift\/pic\/daily_special\/01.jpg",f_3:2988,f_4:3,f_5:28311},{f_1:"ipad4\u4e00\u90e8",f_2:"http:\/\/imgcache.qq.com\/clubact\/2013\/yearGift\/pic\/daily_special\/02.jpg",f_3:3688,f_4:3,f_5:28320},{f_1:"iphone5\u4e00\u90e8",f_2:"http:\/\/imgcache.qq.com\/clubact\/2013\/yearGift\/pic\/daily_special\/03.jpg",f_3:5288,f_4:3,f_5:28321},{f_1:"\u5c0fQ\u673a\u5668\u4eba\u4e00\u4e2a",f_2:"http:\/\/imgcache.qq.com\/clubact\/2013\/yearGift\/pic\/daily_special\/04.jpg",f_3:5288,f_4:3,f_5:28322},{f_1:"\u5fae\u8f6f\u5e73\u677f\u7535\u8111\u4e00\u53f0",f_2:"http:\/\/imgcache.qq.com\/clubact\/2013\/yearGift\/pic\/daily_special\/05.jpg",f_3:4878,f_4:3,f_5:28323}],6:[{f_1:"25cm\u4f1a\u5458\u516c\u4ed4",f_2:"http:\/\/imgcache.qq.com\/clubact\/2013\/yearGift\/pic\/daily_gift\/02.jpg",f_3:85,f_4:98,f_5:28479},{f_1:"11cmQ\u59b9",f_2:"http:\/\/imgcache.gtimg.cn\/ACT\/svip_act\/act_img\/dannlywang\/201409\/1410438119_Qmei158x158.jpg",f_3:35,f_4:118,f_5:28485},{f_1:"11cmQ\u54e5",f_2:"http:\/\/imgcache.qq.com\/clubact\/2013\/yearGift\/pic\/daily_gift\/09.jpg",f_3:35,f_4:175,f_5:28484},{f_1:"QQ\u8868\u60c5\u516c\u4ed4",f_2:"http:\/\/imgcache.qq.com\/clubact\/2013\/yearGift\/pic\/daily_gift\/04.jpg",f_3:45,f_4:89,f_5:28476},{f_1:"16CM\u5b66\u751f\u88c5\u516c\u4ed

<<< skipped >>>

GET /ad220160223.gif HTTP/1.1

Referer: hXXp://7xjnh3.com2.z0.glb.qiniucdn.com/ad220160223.gif

Accept: */*

Accept-Language: zh-CN

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko QQBrowser/8.1.3700.400

Host: 7xjnh3.com2.z0.glb.qiniucdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 10 Jun 2016 07:23:49 GMT

Content-Length: 19140

Accept-Ranges: bytes

Access-Control-Allow-Origin: *

Access-Control-Expose-Headers: X-Log, X-Reqid

Access-Control-Max-Age: 2592000

Content-Disposition: inline; filename="ad220160223.gif"

Content-Transfer-Encoding: binary

Last-Modified: Sat, 23 Jan 2016 11:50:43 GMT

Server: nginx

Content-Type: image/gif

ETag: "FsW6R2mL9x2_MXsgWWBgBILPa7ts"

X-Log: mc.g;IO:1/304

X-Reqid: diMAAKmAvOJPoVYU

X-Qiniu-Zone: 0

Cache-Control: public, max-age=31536000

Age: 1

X-Via: 1.1 dxxz45:80 (Cdn Cache Server V2.0), 1.1 zhoudianxin27:8 (Cdn Cache Server V2.0)

Connection: keep-alive

GIF89a..F.................................................................................'."6.'D..\.5r.=..C..H..N..U..Z..]..^.._..`..`..`..`..`..`.._.._.._..^..]..\..\..[..Z..Y..Y..Y..Y..Y..Y..Z..Z..Z..Z..Z..Z..[..\..]..`..a..b..e..g..j..m..r..t..x..|..}................................................................................................................ .."..!.. ...........!..!~."|.#w.#u.$r.&o.&m.(m. k..j.0i.2i.3i.6k.8m.;o.=q.>r.?u.Cw.Ay.B|.C..E..F..G..H..I..K..L..M..P..U..X..Z.._..d..i..n..s..v..x..}.......................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,......F.....}..H...4l.*\.......Ta.0..!.}4I.p...C.0..q.....$..... .!&.B...'B2.,".&E4O>...Q..'.}.I.Dh.!M|^)..$C,T..y2...... ....B2PrBl.Ta..C.0i[.M.$j...(.I....(........0!.....ZVje.0.W......%1..D. >{1.. .}.......C.TI]7.......i.".(.....$.G.K8*..5...[$..YS...E.*.Xe...{..0.....&....I.-D.I.D!.$)..LR......*F@..]iD...KdQ..X0..xze..CT....l...cH`...V.H]BmX..F..tbK.}w...i..n>.5.rJi.....W._......=w..<..a.p.t......We)..kB....Kd..E.>...Zn..f=...{fZ.T..uI..l.!..C.)..U&t^^J.tE.....E[\7..P*E....G..............F...."....b....A..................q|F..n.DP.lha)...`D.~....dH...-....]$.....@..2XjH.,.R..5m.. ,.%....@.nJ<8.!.x".'.."..{..P.....'..".*...C.-.R.$..RJ)...H*.D.B....../p.X...@..O .E....i...R.".......J.!.........(

<<< skipped >>>

GET /softtj.php?act=add&softname=XQS HTTP/1.1

Referer: hXXp://92wg.sinaapp.com/softtj.php?act=add&softname=XQS

Accept: */*

Accept-Language: zh-CN

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko QQBrowser/8.1.3700.400

Host: 92wg.sinaapp.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Fri, 10 Jun 2016 10:55:33 GMT

Content-Type: text/html; charset=iso-8859-1

Content-Length: 208

Connection: keep-alive

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /softtj.php was not found on this server.</p>.</body></html>.HTTP/1.1 404 Not Found..Server: nginx..Date: Fri, 10 Jun 2016 10:55:33 GMT..Content-Type: text/html; charset=iso-8859-1..Content-Length: 208..Connection: keep-alive..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /softtj.php was not found on this server.</p>.</body></html>...

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_348:

.text

h.idata

H.rsrc

t%SVh

t$(SSh

~%UVW

u$SShe

oleaut32.dll

ole32.dll

advapi32.dll

Advapi32.dll

Kernel32.dll

user32.dll

kernel32.dll

KERNEL32.DLL

ntdll.dll

UUWiseHelper.dll

dc.dll

ZMApi.dll

qadati.dll

RegOpenKeyA

RegEnumKeyExA

RegCloseKey

uu_reportError

uu_loginA

ReportError

ZM_ReportErrorA

QACloubLogin

QACloubReportError

CreateIoCompletionPort

{18C0788E-59AE-4112-B452-6BF0C1B727FB}

{86AB1D8A-7995-4D86-AE5F-18710759228B}

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

\XQS.ini

?\QQDATA.ini

hXXp://VVV.sz789.net/reg.aspx

hXXp://VVV.uudama.com/userReg.html

hXXp://VVV.zhima365.com/userreg.php

hXXp://VVV.ruokuai.com/home/register

hXXp://VVV.qadati.cn/Account/Register

*.txt

|*.txt

hXXps://apisoft.df0535.com/Dfgapi/grouplink.html

52dfg666888data.name

data.url

WinHttp.WinHttpRequest.5.1

application/x-www-form-urlencoded

MSScriptControl.ScriptControl

function get__key(o) {

a.push(i);

//return JSON.stringify(jsonobj);

if (Object.prototype.toString.apply(O) === '[object Array]') {

for (var i = 0; i

S.push(O2String(O[i]));

J = '[' S.join(',') ']';

else if (Object.prototype.toString.apply(O) === '[object String]') {

J = '"' O.replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"';

else if (Object.prototype.toString.apply(O) === '[object Number]') {

else if (Object.prototype.toString.apply(O) === '[object Date]') {

J = "new Date(" O.getTime() ")";

else if (Object.prototype.toString.apply(O) === '[object RegExp]' || Object.prototype.toString.apply(O) === '[object Function]') {

J = O.toString();

else if (Object.prototype.toString.apply(O) === '[object Object]') {

t = typeof (O[i]) == 'string' ? '"' O[i].replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"' : (typeof (O[i]) === 'object' ? O2String(O[i]) : O[i]);

S.push('\"' i '\"' ':' t);

J = '{' S.join(',') '}';

T@\*.dfg

cmd /c regsvr32 msscript.ocx jscript.dll vbscript.dll /s

hXXp://92wg.sinaapp.com/softtj.php?act=add&softname=XQS

hXXp://VVV.52dfg.com/forum-40-1.html?XQS

hXXp://VVV.52dfg.com

/XQS.ini

bashengpass

{0:4,1:2,2:4,3:1,4:3,5:0}

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXps://apisoft.df0535.com/Dfgapi/softmark

data.mark

data.version

data.log

data.remark

0@SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\

114.114.114.114,114.114.115.115

[/dfgmsg][dfgcolor]

[dfgmsg]

%y/%m/%d

%y-%m-%d

g@\Error.log

hXXp://VVV.52dfg.com/dfg/nvwnuqy2.gif

hXXp://VVV.52dfg.com/dfg/yxj.gif

hXXps://apisoft.df0535.com/Dfgapi/admanage.html

].name

].content

].imgurl

].url

].msg

1970-01-01 08:00:00

hXXp://imgcache.gtimg.cn/ACT/vip_act/act_data/28302.json.js

[[0,1,2,3],[4,5,6,7],[8,9,10,11]]

skey

hXXp://vipfunc.qq.com/common/user.php?callback=showGrowInfoPanel&data=grow_value&g_tk=

hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=23314&callback=vipSignNew.signCb&cachetime=

hXXp://iyouxi.vip.qq.com/ams3.0.php?callback=jQuery

hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=52002&rand=0.

hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=53284&rand=0.

data.op.sign.gift.f_actid

data.op.sign.gift.f_name

hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=

hXXps://ssl.

hXXp://

ptlogin2.qq.com/pt4_auth?daid=50&appid=7000201&auth_token=

&regmaster=&aid=7000201&s_url=http://baobao.qq.com/act/gamepet/

hXXp://cgi.baobao.qq.com/cgi-bin/pets_get_carried

pet.seq

hXXp://cgi.baobao.qq.com/cgi-bin/pets_takeoff

cmd=2&from=baobao

hXXp://cgi.baobao.qq.com/cgi-bin/pets_speedup_info

hXXp://cgi.baobao.qq.com/cgi-bin/pets_list

.avatarid

.life

300007156

hXXp://cgi.baobao.qq.com/cgi-bin/pets_takeon

hXXp://cgi.baobao.qq.com/cgi-bin/pets_speedup

ptlogin2.qq.com/pt4_auth?daid=173&appid=7000201&auth_token=

&regmaster=&aid=7000201&s_url=http://bbly.qq.com/

cmd=22&petID=

hXXp://cgi.bbly.qq.com/cgi-bin/PetHome?

a.push(b,c,d,e,f,g);

a.push(b,c,d,e,f);

function ptui_qlogin_CB(b,c,d)

a.push(b,c,d);

a.push(b,c);

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; qdesk 2.5.1277.202; Windows NT 6.1; WOW64; Trident/6.0; QQBrowser/7.7.28658.400)

hXXps://

https

hXXp://app.gamevip.qq.com/cgi-bin/gamevip_sign/GameVip_SignIn?callback=jQuery

SignDay.day

hXXp://app.gamevip.qq.com/cgi-bin/gamevip_sign/GameVip_Lottery?callback=jQuery

hXXp://app.gamevip.qq.com/cgi-bin/gamevip_m_sign/GameVip_m_SignIn?_

FB6BD4FB-5175-477D-A66C-121252F39935

hXXp://api.ruokuai.com/register.xml

hXXp://api.ruokuai.com/info.xml

hXXp://api.ruokuai.com/recharge.xml

hXXp://api.ruokuai.com/create.xml

hXXp://api.ruokuai.com/reporterror.xml

hXXp://iyouxi.vip.qq.com/json.php?mod=game&func=award&uin=

hXXp://iyouxi.vip.qq.com/jsonp.php?_c=page&actid=5474&isLoadUserInfo=1&callback=page.signInCb&g_tk=

hXXp://iyouxi.vip.qq.com/ams2.02.php?actid=23074&g_tk_type=1&g_tk=

hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=22249&g_tk=

hXXp://iyouxi.vip.qq.com/ams3.0.php?g_tk=

data.op.name

hXXp://x.pet.qq.com/vip_platform?cmd=set_sign_info&callback=jQuery

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=21547&sServiceDepartment=xinyue&set_info=xinyue

flowRet.sMsg

hXXp://starvip.qq.com/fcg-bin/v2/fcg_mobile_starvip_site_checkin?g_tk=

data.add

hXXp://flower.qzone.qq.com/fcg-bin/cgi_plant?g_tk=

&newflower=1&outCharset=utf-8&g_tk=

hXXp://flower.qzone.qq.com/cgi-bin/cgi_pickup_oldfruit?g_tk=

&outCharset=utf-8&fupdate=1&format=json

mode=1&g_tk=

data.count

hXXp://flower.qzone.qq.com/cgi-bin/cgi_show_userprop?p=0.

data.prop[

hXXp://flower.qzone.qq.com/cgi-bin/cgi_exchange_prop?g_tk=

&qzreferrer=http://rc.qzone.qq.com/appstore/dailycoupon?from=appstore.myInfoBoxBtn&fupdate=1

qzreferrer=http://ctc.qzs.qq.com/qzone/flower/tool.html#&op_uin=

frameElement.callback(

hXXp://flower.qzone.qq.com/cgi-bin/cgi_use_mallprop?g_tk=

qzreferrer=http://ctc.qzs.qq.com/qzone/flower/tool.html#&propid=7&op_uin=

hXXp://flower.qzone.qq.com/cgi-bin/fg_get_giftpkg?&g_tk=

Referer: hXXp://ctc.qzs.qq.com/qzone/client/photo/swf/RareFlower/FlowerVineLite.swf

data.vDailyGiftpkg[0].granttime

hXXp://flower.qzone.qq.com/cgi-bin/fg_use_giftpkg?g_tk=

giftpkgid=5001&outCharset=utf-8&granttime=

data.usedgiftpkg[0].caption

data.usedgiftpkg[0].content

&imei=&mac=&key=&t=

&skey=

hXXp://m.ac.qq.com/event/dailySignIn/SignIn.php?action=signIn&uin=

reward.exp

reward.bonus

hXXp://m.ac.qq.com/event/dailySignIn/SignIn.php?action=lottery&uin=

hXXp://fight.pet.qq.com/cgi-bin/petpk?cmd=award&op=1&type=0

ContinueLogin

hXXp://cgi.meigui.qq.com/cgi-bin/rosary_activity_oper?gprand=0.

request=2&cmd=15&cgiVersion=36&paytype=1&benew0908=1

hXXp://fcg.3366.com/fcg-bin/growinfo/mgp_growinfo_signin?&_r=

ptlogin2.qq.com/pt4_auth?daid=5&appid=549000912&auth_token=

&regmaster=&aid=549000912&s_url=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

hXXp://user.qzone.qq.com/

hXXp://appstore.qzone.qq.com/cgi-bin/comm/appstore_qq_icon?uin=

hXXp://appact.qzone.qq.com/appstore_activity_appinner_fusionapi?uin=

hXXp://activity.qzone.qq.com/fcg-bin/appstore_activity_daily_signing?action=level&act=5084&g_tk=

data.signing_reward

].status

data.signing_reward[

].signing_day

].rand_reward_desc

].extra_score

hXXp://activity.qzone.qq.com/fcg-bin/appstore_activity_daily_signing?uin=

data.extra_score

data.result

data.reward_name

hXXp://appact.qzone.qq.com/appstore_activity_new_userinfo?uin=

hXXp://appact.qzone.qq.com/appstore_activity_daily_lottery?uin=

&canvastype=&from=appstore.myInfoBoxBtn&uin=

&pfid=2&qz_ver=8&appcanvas=0&qz_style=31&params=dailycoupon&entertime=

qzreferrer=http://appstore.qzone.qq.com/cgi-bin/qzapps/qz_appstore_home_v4?uin=

hXXp://h5.qzone.qq.com/vipinfo/index?plg_nld=1&source=qqmail&plg_auth=1&plg_uin=1&_wv=3&plg_dev=1&plg_nld=1&aid=jh&_bid=368&plg_usr=1&plg_vkey=1&pt_qzone_sig=1

window.shine0callback =

hXXp://vip.qzone.qq.com/fcg-bin/v2/fcg_mobile_vip_site_checkin?t=0.

&low_login=1&uin=

hXXp://pay.video.qq.com/fcgi-bin/sign?callback=jQuery111006800204519842937_

result.msg

result.code

%y-%m-%d

hXXp://c.pc.qq.com/fcgi-bin/signin?callback=jsonp

&data={"req_header":{"cmd":17004,"appid":30013,"version":2,"major_version":2},"req_body":{"ReqMsg_body":{"weiyun.WeiyunDailySignInMsgReq_body":{}}}}&callback=jsonp2

hXXp://web2.cgi.weiyun.com/weiyun_activity.fcg?cmd =17004&g_tk=

rsp_header.retcode

rsp_body.RspMsg_body["weiyun.WeiyunDailySignInMsgRsp_body"].add_point

hXXp://account.book.qq.com/usercenter/index.html

hXXp://account.book.qq.com

X-Requested-With: XMLHttpRequest

Referer: hXXp://account.book.qq.com/usercenter/index.html

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

hXXp://account.book.qq.com/usercenter/signin.html

hXXp://checkin.qq.com/json.php?mod=home&act=getcalendar&month=

].create_time

hXXp://snsapp.qzone.qq.com/cgi-bin/signin/checkin_cgi_read?version=1&more_info_length=10&is_need_rank=1&plattype=1&r=0.

data.seal_info.seal_info['23'][5].post_proxy

data.seal_info.seal_info['23'][5].id

hXXp://login.52dfg.com/xinxi/shuoshuo/getss.php?type=

hXXp://snsapp.qzone.qq.com/cgi-bin/signin/checkin_cgi_publish?g_tk=

qzreferrer=http://ctc.qzs.qq.com/qzone/app/checkin_v4/html/checkin.html#id=0&groupId=0&nofeeds=0&ref=checkin_button&to=ICONVIEW&plattype=1&hostuin=

Referer: hXXp://ctc.qzs.qq.com/qzone/app/checkin_v4/html/checkin.html

hXXp://social.minigame.qq.com/cgi-bin/social/welcome_panel_operate?cmd=2&DomainID=207&g_tk=

hXXp://social.minigame.qq.com/cgi-bin/social/welcome_panel_operate?callback=jQuery&cmd=1&uin=

hXXp://social.minigame.qq.com/cgi-bin/social/welcome_panel_operate?callback=jQuery&cmd=3&uin=

].lotteryid

].lotteryitemname

hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_feedback_send_lottery.fcg?activeid=110&rnd=

data.alreadysend

hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_dmrp_get_present.fcg?activeid=73&rnd=

hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_dmrp_send_lottery.fcg?activeid=128&format=jsonp&inCharset=GB2312&outCharset=gb2312&notice=0&platform=activity&jsonpCallback=MusicJsonCallback&needNewCode=1&rnd=

hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_dmrp_send_lottery.fcg?activeid=130&format=jsonp&inCharset=GB2312&outCharset=gb2312&notice=0&platform=activity&jsonpCallback=MusicJsonCallback&needNewCode=1&rnd=

hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_dmrp_send_lottery.fcg?activeid=138&format=jsonp&inCharset=GB2312&outCharset=gb2312&notice=0&platform=activity&jsonpCallback=MusicJsonCallback&needNewCode=1&rnd=

Referer: hXXp://youxi.vip.qq.com/m/wallet/activeday/index.html?_wv=3&pvsrc=101

User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.4; zh-cn; Lan998 Build/GRJ22) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 V1_AND_SQ_5.2.1_183_YYB_D QQ/5.2.1.2305 NetType/WIFI

hXXp://i.browser.qq.com

hXXp://i.browser.qq.com/all_data_query?guid=6F9994A1FEB1E4BFC613806C0BCE93B5&g_tk=

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.87 Safari/537.36 QQBrowser/9.2.5748.400

static_data.task_list

].interface

static_data.task_list[

].title

].score

hXXp://buluo.qq.com/cgi-bin/bar/card/bar_list_by_page?neednum=1&startnum=0&r=0.

result.followbarnum

D@hXXp://buluo.qq.com/cgi-bin/bar/card/bar_list_by_page?neednum=40&startnum=

result.followbars

].bid

result.followbars[

hXXp://buluo.qq.com/cgi-bin/bar/user/sign

result.add_credits

hXXp://qun.qq.com/cgi-bin/qun_mgr/get_group_list

join

join[

hXXp://qiandao.qun.qq.com/cgi-bin/sign

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=11117&sServiceDepartment=djc&set_info=djc

modRet.ret

modRet.msg

gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=11117&iFlowId=96910&g_tk=

flowRet.iRet

modRet.sMsg

hXXp://proxy.vac.qq.com/cgi-bin/srfentry.fcgi?ts=

Referer: hXXp://vac.qq.com/wifi/v2/integral.html?_wv=1

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X; en-us) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53

&data={"10137":{"req":{"platId":1,"count":4}}}

["10137"].data.vecRecord

].platId

["10137"].data.vecRecord[

].taskId

].taskFlow

].netcoin

].taskName

["10146"].msg

hXXp://cgi.vip.qq.com/online/set?p_tk=&g_tk_type=1&g_tk=

hXXp://1.game.qq.com/app/sign?start=

jData.signInfo.msg

jData.signInfo.ret

hXXp://x.pet.qq.com/petgrow?cmd=Random&callback=jQuery

hXXp://x.pet.qq.com/toolbarsign?cmd=Sign&callback=jQuery

hXXp://x.pet.qq.com/toolbarsign?cmd=Gift&callback=jQuery

hXXp://novelsns.html5.qq.com/ajax?m=task&type=sign&t=

; Q-H5-SKEY=

hXXp://qzs.qq.com/qzone/mall/app/vip_reward/index.html

hXXp://activity.qzone.qq.com/fcg-bin/fcg_qzact_count?g_tk=

hXXp://activity.qzone.qq.com/fcg-bin/fcg_qzact_lottery?g_tk=

&qzreferrer=http://qzs.qq.com/qzone/qzact/act/hkhd/index.html

data[0].name

data[0].count

hXXp://pf.vip.qq.com/common/vframe1.1.php?&id=2000013&g_tk=

TASK.RET

TASK.RESULT.level

hXXp://king.qq.com/lb.html

hXXp://pf.vip.qq.com/common/vframe1.1.php?&id=3000013&g_tk=

hXXp://pf.vip.qq.com/common/vframe1.1.php?&id=5000013&g_tk=

dfg.dat

operatea

hXXps://apisoft.df0535.com/Dfgapi/startpage.html

].browsername

].startpage

1.txt

HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command [9]

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main [9]

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel [9]2.txt

HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command [2 8]

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main [2 8]

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel [2 8]cmd /c regini

"%Program Files%\Internet Explorer\iexplore.exe"

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\

Software\Policies\Microsoft\Internet Explorer\Main\Default_Page_URL

Software\Microsoft\Internet Explorer\Main\Default_Page_URL

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProfilesDirectory

*.lnk

qqbrowser.exe

wshom.ocx

S.push(i ':' t);

[/dfgmsg]

hXXps://ssl.ptlogin2.qq.com/login?u=

Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko QQBrowser/8.1.3700.400

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36

Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

\UUWiseHelper.dll

`.rdata

@.data

@.reloc

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

KERNEL32.dll

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

SHLWAPI.dll

urlmon.dll

dbghelp.dll

gdiplus.dll

IPHLPAPI.DLL

WS2_32.dll

GetProcessHeap

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_loginW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÃ

"0,01070

8Â8J8R8x8

0#0'0-01070;0

=*>0>4>8>

5%6S6

3$3,383\3|3

\dc.dll

MFC42.DLL

GdiplusShutdown

WSOCK32.dll

MSVCP60.dll

ReportError_A

VBYB_ReportError

VB_ReportError

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

config.ini

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

\ZMApi.dll

9^ u%f

uÃ¹ u f9k

Ht.Ht!

tAHt.Ht

uÃ¹~DuH

It.It

F t.Oj

hCRTkQ

hCRTrW

hCRTgW

hCRTbW

tÃ¹}

u&SSh

A$v%SU

D$`CRTr

D$lCRTg

D$xCRTb

?%uMf

\Captcha\Src\Common\MyGlobal.cpp

%.2d-%.2d:%.2d:%.2d.%.3d [ %s %d ]

s:%d %s len:%d

\Captcha\Src\Common\MyToolsLib.cpp

CNotSupportedException

CHttpConnection

CHttpFile

CCmdTarget

COMCTL32.DLL

hhctrl.ocx

mscoree.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

OLEACC.dll

?#%X.y

1.2.3

%u BitsPerSample not allowed for JPEG

Broken pipe

Inappropriate I/O control operation

Operation not permitted

z:\Captcha\Temp\Zmapi\Release\Zmapi.pdb

UnhookWindowsHookEx

GetKeyState

SetWindowsHookExW

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

comdlg32.dll

WINSPOOL.DRV

RegOpenKeyW

RegDeleteKeyW

RegEnumKeyW

RegCreateKeyExW

UrlUnescapeW

InternetCrackUrlW

InternetCanonicalizeUrlW

HttpAddRequestHeadersW

HttpQueryInfoW

HttpSendRequestW

HttpOpenRequestW

WININET.dll

Zmapi.dll

ZM_ReportErrorW

.PAVCObject@@

.PAVCException@@

.PAVCOleException@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCInternetException@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.PAVCArchiveException@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCFileException@@

Save RAW not supported

Save WMF not supported

Unsupported WBMP type

1.2.24

Page %d

compression type not supported

libpng error: %s

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng warning: %s

libpng warning no. %s: %s

iTXt chunk not supported.

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

NULL row buffer for row %ld, pass %d

Empty keyword in iCCP chunk

Unknown compression type %d

Empty keyword in sPLT chunk

white_x=%f, white_y=%f

zero length keyword

keyword length must be 1 - 79 characters

Zero length keyword

extra interior spaces removed from keyword

leading spaces removed from keyword

trailing spaces removed from keyword

invalid keyword character 0xX

Out of memory while procesing keyword

Empty keyword in tEXt chunk

Empty keyword in zTXt chunk

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

RST%d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

Obtained EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC index %d

Unsupported color conversion request

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

IDCT output block size %d not supported

Invalid component ID %d in SOS

Bogus message code %d

%ld%c

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Seek error at scanline %lu, strip %lu

%s: Data buffer too small to hold strip %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Seek error at row %ld, col %ld, tile %ld

%s: Data buffer too small to hold tile %ld

%s: No space for data buffer at scanline %ld

%u: Sample out of range, max %u

Sample %d out of range, max %u

"%s": Bad mode

Not a TIFF file, bad version number %d (0x%x)

Not a TIFF file, bad magic number %d (0x%x)

%s: Out of memory (TIFF structure)

Sorry, can not handle YCbCr images with %s=%d

Sorry, LogL data must have %s=%d

Sorry, can not handle LogLuv images with %s=%d

Sorry, LogLuv data must have %s=%d or %d

Sorry, can not handle image with %s=%d

Sorry, can not handle separated image with %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Sorry, can not handle RGB image with %s=%d

Missing needed %s tag

%s: Cannot modify tag "%s" while writing

%s: Unknown %stag %u

%f: Bad value for "%s"

%s: Invalid %stag "%s" (not supported by codec)

%ld: Bad value for "%s"

%d: Bad value for "%s"

Nonstandard tile length %d, convert file

Nonstandard tile width %d, convert file

Bad value %ld for "%s" tag ignored

%s: Invalid InkNames value; expecting %d names, found %d

%s: Error fetching directory count

%s: Error fetching directory link

"%s": Information lost writing value (%g) as (unsigned) RATIONAL

Error writing data for field "%s"

%s: Error writing SubIFD directory link

%d: Sample out of range, max %d

%s: No space for %s arrays

%s: Must set "PlanarConfiguration" before writing data

%s: Must set "ImageWidth" before writing data

%s: File not open for writing

%s: No space for output buffer

%s: No space to expand strip arrays

%s: Write error at scanline %lu

%s: Seek error at scanline %lu

Bogus "%s" field, ignoring and calculating from imagelength

TIFF directory is missing required "%s" field, calculating from imagelength

unknown field with tag %d (0x%x) ignored

wrong data type %d for "%s"; tag ignored

No space %s

TIFF directory is missing required "%s" field

incorrect count for field "%s" (%lu, expecting %lu); tag ignored

Error fetching data for field "%s"

%s: Rational with zero denominator (num = %lu)

Cannot handle different per-sample values for field "%s"

Cannot read TIFF_ANY type %d for field "%s"

Compression scheme %u %s encoding is not implemented

%s %s encoding is not implemented

%s %s encoding is no longer implemented due to Unisys patent enforcement

Compression scheme %u %s decoding is not implemented

%s %s decoding is not implemented

Compression algorithm does not support random access

Internal error, unknown tag 0x%x

%s compression support is not configured

?%s: No space for LogLuv state block

Inappropriate photometric interpretation %d for SGILog compression; %s

LogL16Decode: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

%s: No space for SGILog translation buffer

No support for converting user data format to LogL

No support for converting user data format to LogLuv

SGILog compression supported only for %s, or raw data

Unknown data format %d for LogLuv compression

Unknown encoding %d for LogLuv compression

%s: %s

%s: Not enough data at scanline %d (short %d bytes)

%s: zlib error: %s

%s: Decoding error at scanline %d, %s

%s: Encoder error: %s

%s: No space for state block

%s: Bad code word at scanline %d (x %lu)

%s: %s at scanline %d (got %lu, expected %lu)

%s: Premature EOF at scanline %d (x %lu)

%s: No space for Group 3/4 reference line

%s: No space for Group 3/4 run arrays

%s: Uncompressed data (not supported) at scanline %d (x %lu)

Fax SubAddress: %s

(%u = 0x%x)

%suncompressed data

%sEOL padding

%s2-d encoding

%s compression is not supported

Tiled Wang image not supported

Does not support lossless Huffman coding

RowsPerStrip must be multiple of %d for JPEG

JPEG tile width must be multiple of %d

JPEG tile height must be multiple of %d

BitsPerSample %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

ThunderDecode: %s data at scanline %ld (%lu != %lu)

PackBitsDecode: discarding %d bytes to avoid buffer overrun

LZWDecode: Not enough data at scanline %d (short %d bytes)

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

DumpModeDecode: Not enough data for scanline %d

Horizontal differencing "Predictor" not supported with %d-bit samples

"Predictor" value %d not supported

%u (0x%x)

Portable Graymap/Pixmap (PNM)

error: BMP format does not support color space

%s %s %d %ld %ld

hXXp://VVV.ijg.org

The IJG JPEG library is required for JPEG decoding support.

The IJG JPEG library is required for JPEG encoding support.

len = %d;

type = 0xx (%s);

tileno = %d; len = %d; partno = %d; numparts = %d

prec[%d] = %d; sgnd[%d] = %d; hsamp[%d] = %d; vsamp[%d] = %d

tilewidth = %d; tileheight = %d; tilexoff = %d; tileyoff = %d;

width = %d; height = %d; xoff = %d; yoff = %d;

caps = 0xx;

prcwidth[%d] = %d, prcheight[%d] = %d

cblkwidthval = %d; cblkheightval = %d; cblksty = 0xx;

prg = %d; numlyrs = %d;

numdlvls = %d; qmfbid = %d; mctrans = %d

csty = 0xx;

cblkwidthval = %d; cblkheightval = %d; cblksty = 0xx; qmfbid = %d;

compno = %d; csty = 0xx; numdlvls = %d;

compno = %d; roisty = %d; roishift = %d

expn[%d] = 0xx; mant[%d] = 0xx;

qntsty = %d; numguard = %d; numstepsizes = %d

compno = %d; qntsty = %d; numguard = %d; numstepsizes = %d

seqno = %d;

ind=%d; len = %d;

le[%d] = %d

rs[%d] = %d; re[%d] = %d;

cs[%d] = %d; ce[%d] = %d;

po[%d] = %d;

hoff[%d] = %d; voff[%d] = %d

regid = %d;

invalid code block width %d

invalid code block height %d

warning: ignoring invalid option %s

warning: invalid intermediate layer rates specifier ignored (%s)

ignoring bad rate specifier %s

ignoring invalid progression order %s

ignoring invalid mode %s

unsupported image type

Creator: JasPer Version %s

error: too few guard bits (need at least %d)

lyrno=d cmptno=d rlvlno=d bandno=d prcno=d cblkno=d passno=d

lyrno = d

success %d goodthresh %f

maxlen=ld actuallen=ld thresh=%f

min rdslope = %f max rdslope = %f

cblk ] ] ] ]

prc ] ] ] ] (] ])

band ] ] ] ]

rlvl ] ] ] ]

tcmpt ] ] ] ]

CODE BLOCK %d

CODE BLOCK GROUP %d

BAND %d

xs =%d, ys = %d, xe = %d, ye = %d, w = %d, h = %d

RESOLUTION LEVEL %d

ICC Profile CS x

error: unsupported compression type

box type %s

error: encoding method not supported

error: RLE encoding method not supported

warning: palettized images not fully supported

error: unsupported color space

error: unsupported BMP encoding

THE BMP FORMAT IS NOT FULLY SUPPORTED!

unsupported BMP encoding

no palettized image support for BMP format

warning: support for signed sample data requires use of nonstandard extension to PNM format

%s%ld

error: PNM support required

warning: ignoring unsupported options

data=%s

component tlx=%ld tly=%ld sampperx=%ld samppery=%ld width=%ld height=%ld prec=%d sgnd=%d

(%f, %f, %f)

entry[%d] = %f

gamma = %f

number of entires = %d

maclen = %d

sccode = %d

uclangcode = %d; uclen = %d

ascii = "%s"

string = "%s"

numintabents=%d, numouttabents=%d

e[%d][%d]=%f

numinchans=%d, numoutchans=%d, clutlen=%d

1.900.1

packet offset=ld prg=%d cmptno=d rlvlno=d prcno=d lyrno=d

coding pass failed passtype=%d segtype=%d

type=%c%s%c (0xx); length=%d

csid=%d

method=%d; pri=%d; approx=%d

channo=%d; type=%d; assoc=%d

cmptno=%d; map=%d; pcol=%d

numchans = %d

LUT[%d][%d]=%d

numents=%d; numchans=%d

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

The delta operation is invalid (mismatched color_types?)

Requested nEED resources are not supported

MHDR simplicity indicates unsupported feature(s)

Keyword cannot be zero-length

%s: Out of memory in %s

%s: decoder table overflow

%d %d

%d,%d

%d %d %d

/.badpixels

%s is not a valid PGM file!

%s has the wrong dimensions!

Scaling with p->black %d, multipliers

%s: Cannot use camera p->white balance.

Median filter pass %d...

11124811248488

012347800000005896

%d:%d:%d %d:%d:%d

%f %f %f

Ixpress %d-Mp

50132467

Failed to read metadata from %s

Reading metadata from %s ...

0134567028

023457000000006000

012346000000000000

%d:%d:%d

%d.%d.%d

%*s %s %d %d:%d:%d %d

v%d %dx%d

%s %s

%s: You must link dcraw with libjpeg!!

%dx%d

Converting to %s colorspace...

d:d:d d:d:d

12435867

Unknown option "-%c".

Non-numeric argument to "-%c"

1141111142

Created by MIDL version 6.00.0361 at Wed Nov 05 22:09:21 2014

,0004080

3!3(31363

: :$:(:,:0:4:]:,;[;|;

=$=0=7=>=

;%@>

?0?4?8?@?

748:8?8_8

; ;$;(;,;

\qadati.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

USER32.DLL

X%c

112.124.55.239

password

oldPassword

newPassword

__NOT_LOGIN

115.29.173.200

__TCP_CONNECT_%d

__TCP_SEND_%d

__TCP_RECV_%d

__TCP_RECV_ERROR

D:\My Datas\Dropbox\QACloubProductization\QACloub\Release\qadati.pdb

WinHttpOpen

WinHttpSetTimeouts

WinHttpConnect

WinHttpOpenRequest

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpCloseHandle

WINHTTP.dll

GetConsoleOutputCP

QACloubChangePassword

QACloubLoginKey

QACloubLoginRegCode

8&858:8[8`8

.toString()

.splice(

.push(

get__key(

ui.ptlogin2.qq.com/cgi-bin/login?link_target=blank&f_url=loginerroralert&hide_title_bar=1&style=11&daid=196&low_login=0&appid=710032918&s_url=http://bbs.lol.qq.com/member.php?mod=logging&action=loginsucc&target=self

pt_login_sig

hXXp://check.

&u1=http://bbs.lol.qq.com/member.php?mod=logging&action=loginsucc&r=0.

&appid=710032918&js_ver=10034&js_type=1&login_sig=

ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=1&uin=

captcha.qq.com/cap_union_show?clientype=2&aid=710032918&uin=

&js_ver=10034&js_type=1&login_sig=

&pt_randsalt=0&ptredirect=0&u1=http://bbs.lol.qq.com/member.php?mod=logging&action=loginsucc&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=

ptlogin2.qq.com/login?u=

captcha.qq.com/cap_union_verify?aid=710032918&uin=

aq.qq.com

while (z aD

t = aC.substring(z, z aD) "\n";

return t aC.substring(z, aC.length)

return "0" t.toString(16)

return t.toString(16)

if (aG

var aC = aD.length - 1;

var aE = aD.charCodeAt(aC--);

z.nextBytes(t)

this.dmp1 = null;

this.dmq1 = null;

this.coeff = null

if (z != null && t != null && z.length > 0 && t.length > 0) {

uv_alert("Invalid RSA public key")

return t.modPowInt(this.e, this.n)

var t = ah(aC, (this.n.bitLength() 7) >> 3);

var aD = this.doPublic(t);

var z = aD.toString(16);

if ((z.length & 1) == 0) {

N.prototype.doPublic = Y;

N.prototype.setPublic = q;

N.prototype.encrypt = r;

this.fromNumber(z, t, aC)

this.fromString(z, 256)

this.fromString(z, t)

aG = Math.floor(aC / 67108864);

au.prototype.am = aA;

au.prototype.DB = ay;

au.prototype.DM = ((1

au.prototype.DV = (1

au.prototype.FV = Math.pow(2, ac);

au.prototype.F1 = ac - ay;

au.prototype.F2 = 2 * ay - ac;

ar = "0".charCodeAt(0);

ar = "a".charCodeAt(0);

ar = "A".charCodeAt(0);

return ag.charAt(t)

var aC = ai[z.charCodeAt(t)];

z.fromInt(t);

this.fromRadix(aG, z);

var aF = aG.length,

if (aG.charAt(aF) == "-") {

if (aE aD > this.DB) {

this[this.t - 1] |= (t & ((1

this[this.t ] = (t >> (this.DB - aE))

if (aE >= this.DB) {

aE -= this.DB

this[this.t - 1] |= ((1

this.clamp();

au.ZERO.subTo(this, this)

var t = this.s & this.DM;

return "-" this.negate().toString(z)

return this.toRadix(z)

var aG = this.DB - (aD * this.DB) % aC;

if (aG > aG) > 0) {

aH |= this[--aD] >> (aG = this.DB - aC)

aG = this.DB; --aD

au.ZERO.subTo(this, t);

return (this.s

return this.DB * (this.t - 1) l(this[this.t - 1] ^ (this.s & this.DM))

z.t = Math.max(this.t - aC, 0);

var z = aH % this.DB;

var t = this.DB - z;

var aE = Math.floor(aH / this.DB),

aG = (this.s

aD.clamp()

var aE = Math.floor(aG / this.DB);

var z = aG % this.DB;

t = Math.min(z.t, this.t);

aD[aC ] = aE & this.DM;

aE >>= this.DB

aD[aC ] = aE & this.DM;

aE >>= this.DB

aD[aC ] = this.DV aE

var t = this.abs(),

aE = z.abs();

aD[aC t.t] = t.am(0, aE[aC], aD, aC, 0, t.t)

aD.clamp();

au.ZERO.subTo(aD, aD)

var t = this.abs();

var aD = t.am(z, t[z], aC, 2 * z, 0, 1);

if ((aC[z t.t] = t.am(z 1, 2 * t[z], aC, 2 * z 1, aD, t.t - z - 1)) >= t.DV) {

aC[z t.t] -= t.DV;

aC[aC.t - 1] = t.am(z, t[z], aC, 2 * z, 0, 1)

aC.clamp()

var aQ = aK.abs();

var aI = this.abs();

aH.fromInt(0)

this.copyTo(aG)

var aP = this.DB - l(aQ[aQ.t - 1]);

aQ.lShiftTo(aP, aE);

aI.lShiftTo(aP, aG)

aQ.copyTo(aE);

aI.copyTo(aG)

var aT = this.FV / aL,

aE.dlShiftTo(aN, aF);

if (aG.compareTo(aF) >= 0) {

aG.subTo(aF, aG)

au.ONE.dlShiftTo(aM, aF);

aF.subTo(aE, aE);

var aD = (aG[--aO] == aC) ? this.DM: Math.floor(aG[aO] * aT (aG[aO - 1] aR) * aS);

if ((aG[aO] = aE.am(0, aD, aG, aN, 0, aM))

aE.dlShiftTo(aN, aF);

aG.subTo(aF, aG);

aG.subTo(aF, aG)

aG.drShiftTo(aM, aH);

au.ZERO.subTo(aH, aH)

aG.clamp();

aG.rShiftTo(aP, aG)

au.ZERO.subTo(aG, aG)

this.abs().divRemTo(t, null, z);

if (this.s 0) {

t.subTo(z, z)

if (t.s = 0) {

return t.mod(this.m)

t.divRemTo(this.m, null, t)

t.multiplyTo(aC, z);

this.reduce(z)

t.squareTo(z);

M.prototype.convert = X;

M.prototype.revert = am;

M.prototype.reduce = L;

M.prototype.mulTo = J;

M.prototype.sqrTo = aw;

z = (z * (2 - t * z % this.DV)) % this.DV;

return (z > 0) ? this.DV - z: -z

this.mp = t.invDigit();

this.mpl = this.mp & 32767;

this.mph = this.mp >> 15;

this.um = (1

this.mt2 = 2 * t.t

t.abs().dlShiftTo(this.m.t, z);

z.divRemTo(this.m, null, z);

if (t.s 0) {

this.m.subTo(z, z)

t.copyTo(z);

this.reduce(z);

while (t.t

var aD = (z * this.mpl (((z * this.mph (t[aC] >> 15) * this.mpl) & this.um)

t[z] = this.m.am(0, aD, t, aC, 0, this.m.t);

while (t[z] >= t.DV) {

t[z] -= t.DV;

t.clamp();

t.drShiftTo(this.m.t, t);

if (t.compareTo(this.m) >= 0) {

t.subTo(this.m, t)

g.prototype.convert = al;

g.prototype.revert = av;

g.prototype.reduce = R;

g.prototype.mulTo = B;

g.prototype.sqrTo = ao;

return au.ONE

aF = aI.convert(this),

aF.copyTo(aG);

aI.sqrTo(aG, aC);

aI.mulTo(aC, aF, aG)

return aI.revert(aG)

if (aC

return this.exp(aC, aD)

au.prototype.copyTo = aa;

au.prototype.fromInt = p;

au.prototype.fromString = y;

au.prototype.clamp = Q;

au.prototype.dlShiftTo = at;

au.prototype.drShiftTo = Z;

au.prototype.lShiftTo = v;

au.prototype.rShiftTo = n;

au.prototype.subTo = ad;

au.prototype.multiplyTo = F;

au.prototype.squareTo = S;

au.prototype.divRemTo = G;

au.prototype.invDigit = D;

au.prototype.isEven = k;

au.prototype.exp = A;

au.prototype.toString = s;

au.prototype.negate = T;

au.prototype.abs = an;

au.prototype.compareTo = I;

au.prototype.bitLength = w;

au.prototype.mod = P;

au.prototype.modPowInt = ap;

au.ZERO = c(0);

au.ONE = c(1);

d(new Date().getTime())

/*if(navigator.appName=="Netscape"&&navigator.appVersion

K = Math.floor(65536 * Math.random());

o.init(W);

for (ae = 0; ae

return o.next()

for (t = 0; t

af.prototype.nextBytes = ax;

z = (z this.S[aD] aE[aD % aE.length]) & 255;

m.prototype.init = f;

m.prototype.next = a;

t.setPublic(aC, z);

return t.encrypt(aD)

return Math.round(Math.random() * 4294967295)

for (var B = 0; B

var C = Number(D[B]).toString(16);

if (C.length == 1) {

for (var A = 0; A

C = String.fromCharCode(parseInt(B.substr(A, 2), 16))

for (var A = 0; A

B[A] = C.charCodeAt(A)

var A = C.length;

var A = E.length;

for (var C = 0; C

var A = u.length;

for (var B = 0; B

C[B] = E.charCodeAt(B) & 255

for (var B = 0; B

C[A ] = parseInt(E.substr(B, 2), 16)

for (var B = 0; B

A = String.fromCharCode(C[B])

return d.encode(A)

initkey: function(A, B) {

d.PADCHAR = "=";

d.ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";

d.getbyte = function(C, B) {

var A = C.charCodeAt(B);

d.encode = function(E) {

if (arguments.length != 1) {

var B = d.PADCHAR;

var G = d.ALPHA;

var F = d.getbyte;

var C = E.length - E.length % 3;

if (E.length == 0) {

A.push(G.charAt(H >> 18));

A.push(G.charAt((H >> 12) & 63));

A.push(G.charAt((H >> 6) & 63));

A.push(G.charAt(H & 63))

switch (E.length - C) {

A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) B B);

A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) G.charAt((H >> 6) & 63) B);

return A.join("")

return binl2hex(core_md5(str2binl(s), s.length * chrsz))

return binl2str(core_md5(str2binl(s), s.length * chrsz))

function hex_hmac_md5(key, data) {

return binl2hex(core_hmac_md5(key, data))

function b64_hmac_md5(key, data) {

return binl2b64(core_hmac_md5(key, data))

function str_hmac_md5(key, data) {

return binl2str(core_hmac_md5(key, data))

for (var i = 0; i

function core_hmac_md5(key, data) {

var bkey = str2binl(key);

if (bkey.length > 16) {

bkey = core_md5(bkey, key.length * chrsz)

ipad[i] = bkey[i] ^ 909522486;

opad[i] = bkey[i] ^ 1549556828

var hash = core_md5(ipad.concat(str2binl(data)), 512 data.length * chrsz);

return core_md5(opad.concat(hash), 512 128)

for (var i = 0; i

bin[i >> 5] |= (str.charCodeAt(i / chrsz) & mask)

for (var i = 0; i

str = String.fromCharCode((bin[i >> 5] >>> (i % 32)) & mask)

for (var i = 0; i

str = hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8 4)) & 15) hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8)) & 15)

for (var i = 0; i

if (i * 8 j * 6 > binarray.length * 32) {

str = tab.charAt((triplet >> 6 * (3 - j)) & 63)

for (var i = 0; i

arr.push("\\x" str.substr(i, 2))

arr = arr.join("");

if (Math.random() > (probability || 1)) {

var url = location.protocol "//ui.ptlogin2.qq.com/cgi-bin/report?id=" mid;

var s = document.createElement("img");

s.src = url;

function getEncryption(password, salt, vcode) {

var md5Pwd = md5(password),

rsaH1 = RSA.rsa_encrypt(h1),

rsaH1Len = (rsaH1.length / 2).toString(16),

hexVcode = TEA.strToBytes(vcode.toUpperCase()),

vcodeLen = "000" vcode.length.toString(16);

while (rsaH1Len.length

TEA.initkey(s2);

var saltPwd = TEA.enAsBase64(rsaH1Len rsaH1 TEA.strToBytes(salt) vcodeLen hexVcode);

TEA.initkey("");

return saltPwd.replace(/[\/\ =]/g,

"/": "-",

" ": "*",

"=": "_"

{pass}

getEncryption("{pass}","{salt}","{code}")

TEAKEY

SESSIONkEY

-12027,TEAKEY

&password=

&softkey=

Content-Disposition: form-data; name="password"

Content-Disposition: form-data; name="softkey"

{softkey}

Content-Disposition: form-data; name="image"; filename="System.Byte[]"

ui.ptlogin2.qq.com/cgi-bin/login?appid=21000110&f_url=loginerroralert&s_url=http://gamevip.qq.com/hhb/index.shtml?ADTAG=IM.XINXI&aid=7000201&qlogin_jumpname=jump&qlogin_param=u1=http%3A//gamevip.qq.com/hhb/index.shtml%3FADTAG%3DIM.XINXI%26aid%3D7000201&daid=176

&appid=21000110&js_ver=10034&js_type=0&login_sig=&u1=http://gamevip.qq.com/hhb/index.shtml?ADTAG=IM.XINXI&aid=7000201&r=0.

ptlogin2.qq.com/check?pt_tea=1&uin=

&mibao_css=&t=1&g=1&js_type=0&js_ver=10034&login_sig=

&aid=21000110&u1=http://gamevip.qq.com/hhb/index.shtml?ADTAG=IM.XINXI&aid=7000201&h=1&ptredirect=1&ptlang=2052&daid=176&from_ui=1&dumy=&fp=loginerroralert&action=

xui.ptlogin2.qq.com/cgi-bin/xlogin?proxy_url=hXXp://game.qq.com/comm-htdocs/milo/proxy.html&appid=21000127&f_url=loginerroralert&target=self&qtarget=self&s_url=http://xinyue.qq.com/comm-htdocs/login/logincallback.htm&no_verifyimg=1&daid=8&qlogin_jumpname=jump&qlogin_param=u1=http://xinyue.qq.com/comm-htdocs/login/logincallback.htm

&u1=http://xinyue.qq.com/comm-htdocs/login/logincallback.htm&r=0.

&appid=21000127&js_ver=10034&js_type=1&login_sig=

captcha.qq.com/cap_union_show?clientype=2&aid=21000127&uin=

&pt_randsalt=0&ptredirect=0&u1=http://xinyue.qq.com/comm-htdocs/login/logincallback.htm&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=

captcha.qq.com/cap_union_verify?aid=21000127&uin=

xui.ptlogin2.qq.com/cgi-bin/xlogin?proxy_url=http://qzs.qq.com/qzone/v6/portal/proxy.html&daid=5&&hide_title_bar=1&low_login=0&qlogin_auto_login=1&no_verifyimg=1&link_target=blank&appid=549000912&style=22&target=self&s_url=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&pt_qr_app=Ã¦â€°â€¹Ã¦Å“ÂºQQÃ§Â©ÂºÃ©â€”Â´&pt_qr_link=http://z.qzone.com/download.html&self_regurl=http://qzs.qq.com/qzone/v6/reg/index.html&pt_qr_help_link=http://z.qzone.com/download.html

&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&r=0.

&appid=549000912&js_ver=10144&js_type=1&login_sig=

captcha.qq.com/cap_union_show?clientype=2&aid=549000912&uin=

&js_ver=10144&js_type=1&login_sig=

&pt_randsalt=0&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&ptredirect=0&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=

captcha.qq.com/cap_union_verify?aid=549000912&uin=

ui.ptlogin2.qq.com/cgi-bin/login?appid=7000201&f_url=loginerroralert&s_url=http://meigui.qq.com/&ptopt=1&qlogin_param=u1=http%3A//meigui.qq.com/%26ptopt%3D1&daid=49&style=11

&u1=http://meigui.qq.com/&ptopt=1&r=0.

&appid=7000201&js_ver=10034&js_type=1&login_sig=

ptlogin2.qq.com/check?regmaster=&pt_tea=1&uin=

&mibao_css=&t=1&g=1&js_ver=10034&js_type=1&login_sig=

&aid=7000201&u1=http://meigui.qq.com/&ptopt=1&h=1&ptredirect=1&ptlang=2052&daid=49&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=

xui.ptlogin2.qq.com/cgi-bin/xlogin?proxy_url=hXXp://game.qq.com/comm-htdocs/milo/proxy.html&appid=21000501&target=top&s_url=http://daoju.qq.com/mall/&daid=8

&u1=http://daoju.qq.com/mall/&r=0.

&appid=21000501&js_ver=10138&js_type=1&login_sig=

captcha.qq.com/cap_union_show?clientype=2&aid=21000501&uin=

captcha.qq.com/getimgbysig?aid=21000501&uin=

&js_ver=10138&js_type=1&login_sig=

&pt_randsalt=0&ptredirect=1&u1=http://daoju.qq.com/mall/&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=

captcha.qq.com/cap_union_verify?aid=21000501&uin=

SetClientCertificate

admin@52dfg.com

5ugg%u

09/27/12

admin@52dfg.com

%d&&'

123456789

00003333

1.2.18

?456789:;

!"#$%&'()* ,-./0123

%*.*f

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

iphlpapi.dll

MPR.dll

VERSION.dll

Shell32.dll

Mpr.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

;3 #>6.&

'2, / 0&7!4-)1#

VVV.dywt.com.cn

%s,%d

%s.lnk

(*.avi)|*.avi

RICHED32.DLL

RICHED20.DLL

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

keywords

(%S)%M%D %y-%m-%d

After RemoveDC(), pen counter: %d, bursh counter: %d, font counter: %d

!!! Create pen ERROR! ErrNo.[%d]

Create pen No.%d

!!! Create brush ERROR! ErrNo.[%d]

Create brush No.%d

!!! Create font ERROR! ErrNo.[%d]

Create font No.%d

- Delete pen No.%d

- Delete brush No.%d

- Delete font No.%d

TrayIcon event: %x

hXXp://VVV.eyuyan.com

service@dywt.com.cn

86(0411)39895834

86(0411)39895831

This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info

DelAllKeyValues

DelKeyValue

GetAllKeys

GetKeyValue

AddKeyValue

DSGetErrMsg

BiTreeGetCurNodeKey

ListGetCurNodeKey

ListUpdateNodeFromKey

ListRemoveNodeFromKey

edatastructure_fnMapDelAllKeyValues

edatastructure_fnMapDelKeyValue

edatastructure_fnMapGetAllKeys

edatastructure_fnMapGetKeyValue

edatastructure_fnMapAddKeyValue

edatastructure_fnBiTreeGetCurNodeKey

edatastructure_fnListGetCurNodeKey

edatastructure_fnListUpdateNodeFromKey

edatastructure_fnListRemoveNodeFromKey

1.1.4

%d%d%d

rundll32.exe shell32.dll,

.PAVCResourceException@@

[13:55:44][

[13:55:44]

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

hid.dll

mscorwks.dll

mscorsvr.dll

KernelBase.dll

mscoreei.dll

clr.dll

diasymreader.dll

SEGetNumExecUsed

SEGetNumExecLeft

SESetNumExecUsed

SEGetExecTimeUsed

SEGetExecTimeLeft

SESetExecTime

SEGetTotalExecTimeUsed

SEGetTotalExecTimeLeft

SESetTotalExecTime

SECheckExecTime

SECheckTotalExecTime

&&&&6666????

""""****

2222::::

$$$$\\\\

00006666

####====

PSAPI.DLL

RegOpenKeyExA

RegCreateKeyExA

RegDeleteKeyA

!#^#/6!`

.HCX=

r%s#m

=Cy.cX

2Wps.Di

{.fCI

CRTx

2z%X!8k

.tuN0

n.tuN

wj.fq

a.DH%R

F/.zP

cMdbU9

.Nzkl

sQlz

4%x|PpN

lU.Bp

I.Ppi-o

J.Ju.

w%sDl

.eh7l

e.Qp=

.lV8P

7S.Gm=

|,D.yd

2jNwÃ“7

.VJV(

,.UG|p

Yi.xd

%Ujv)

%8UAL

T.Yqh

UDP~(I

f&.BR

2oV{CRT

.CH{

[m%Xh

D.Ju.

<.vz1>

WINMM.dll

AVIFIL32.dll

.Du'rk}

/M0%F

/-p%F

/[pY%0S7

%TN_7[Udp

/=/6!`0*

=.IhY~

;WINMM.dll

(WinExec

GetWindowsDirectoryA

SetWindowsHookExA

UnregisterHotKey

RegisterHotKey

EnumChildWindows

CreateDialogIndirectParamA

GetViewportExtEx

GetViewportOrgEx

@ADVAPI32.dll

RegCreateKeyA

&RegCloseKey

ShellExecuteA

Safengine Shielden v2.3.4.0

ovaMSVCRT.dll

1, 0, 6, 6

- Skin.dll

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.5

WiseClientAPI-2.0.0.5

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.5|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.5;

WiseClient-2.0.0.5

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 5

1.0.0.1

!"#$%&'()* ,-

25, 0, 0, 1

Windows

s:%d MyCloseSocket

\ZMException.txt

addr.sa_family != AF_INET,

s:%d ConnetToServer

%d.%d.%d.%d

[%d] %s

\ZMApi.ini

Mysql

ERROR_DATABASE_USERORPASSWORD

ERROR_DATABASE_MYSQL_INIT

ERROR_DATABASE_MYSQL_ERROR

ERROR_CUSTOMER_REPORT

hXXp://VVV.zhima365.com/jump/api_new_version.php

hXXp://VVV.zm60.com/jump/jump_new_version.php

ERROR_ANOTHER_PLACE_LOGIN

ERROR_PASSWORD_EMPTY

ERROR_PASSWORD_ERROR

\ZMError.ini

%.2d.txt

%s IP %d.%d.%d.%d

%.3d.zm60.com

2147516317

\ZMConnect.ini

. s:%d nPacketLen:%d

%s\%.4d%.2d%.2d\%.2d\%.2d

xxxUpdate.exe

\ZMApiUpdate.exe

\ZMWorkerUpdate.exe

Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/xaml xml, application/x-ms-xbap, application/x-ms-application, application/vnd.ms-xpsdocument, */*

AfxParseURL()

s:%d MySend()

: nResultLen %d

: nPicIDLen %d

PicID: %s

cRecognizeState: %d

Report

Customer_Send_Report()

: nNoticeLen %d

Host: ssl.zhima365.com

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

/user/reg_user_vc .php?loginname=%s&password=%s&repassword=%s&email=%s&qq=%s&phone=%s&name=%s&softwareid=%d HTTP/1.1

hXXps://ssl.zhima365.com/user/reg_user_vc .php?loginname=%s&password=%s&repassword=%s&email=%s&qq=%s&phone=%s&name=%s&softwareid=%d

11111111111

Reg@163.com

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

/user/user_card_recharge.php?loginname=%s&password=%s&prepaid_card=%s&softwareid=%d HTTP/1.1

hXXps://ssl.zhima365.com/user/user_card_recharge.php?loginname=%s&password=%s&prepaid_card=%s&softwareid=%d

/user/user_api_statistic.php?loginname=%s&password=%s HTTP/1.1

hXXps://ssl.zhima365.com/user/user_api_statistic.php?loginname=%s&password=%s

Customer_Send_Login()

nErrorCode:%d

IP %u

s:%d Customer_Recv_Response_QueryBalance()

: ZMApiUpdate.exe

ZM_QueryBalanceW() NULL == pszPassword

Customer_Recv_Response_Login()

s:%d Customer_Recv_Report_OK()

s:%d Customer_Recv_Result()

s:%d Customer_Recv_Response_Login()

s:%d Customer_Recv_Report_OK()

ZM_ReByBufferW() NULL == pszPassword

sbtm %d

nJPGSize:%d

nPicSize:%d

ZM_ReByBufferW() NULL == pszSoftwareKey

ZM_ReByFileW() NULL == pszPassword

ZM_ReByFileW() NULL == pszSoftwareKey

ZM_ReByScreenW() NULL == pszPassword

ZM_ReByScreenW() NULL == pszSoftwareKey

ZM_ReportErrorW() pszPicID

ZM_ReportErrorW() NULL == pszPicID

ZM_QueryBalanceA() NULL == pszPassword

ZM_ReByBufferA() NULL == pszPassword

ZM_ReByBufferA() NULL == pszSoftwareKey

ZM_ReByFileA() NULL == pszPassword

ZM_ReByFileA() NULL == pszSoftwareKey

ZM_ReByScreenA() NULL == pszPassword

ZM_ReByScreenA() NULL == pszSoftwareKey

ZM_ReportErrorA() pszPicID

ZM_ReportErrorA() NULL == pszPicID

\%.4d%.2d%.2d_%.2d%.2d%.2d_%s

WININET.DLL

HTTP/1.0

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

%s.dll

TYPELIB\%s

accKeyboardShortcut

CxImage 6.0.0

!"#$%&'()* ,-./01234567

2, 1, 1, 0

All Files (*.*)

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.

Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.

Access to %1 was denied..An invalid file handle was associated with %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Disk full while accessing %1..An attempt was made to access %1 past its end.

No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.

#Unable to load mail system support.

proxy8.qadati.cn

proxy7.qadati.cn

proxy6.qadati.cn

proxy5.qadati.cn

proxy4.qadati.cn

proxy3.qadati.com

datiapi2.qacloub.com

datiapi.qacloub.com

G/User/Login

y/User/LoginKey

e/User/LoginRegCode

d/User/ChangePassword

D/Code/ReportError

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)

C:\QAClOUB_LOG.txt

Cookie: ASP.NET_SessionId=QACloub12f948b017d1;software_id=%s;login_session=%s;

Cookie: ASP.NET_SessionId=QACloub12f948b017d1

(*.*)

1.0.0.0

Www.52Dfg.Com

[VVV.52dfg.com]

%original file name%.exe_348_rwx_00401000_0040F000:

t%SVh

t$(SSh

~%UVW

u$SShe

oleaut32.dll

ole32.dll

advapi32.dll

Advapi32.dll

Kernel32.dll

user32.dll

kernel32.dll

KERNEL32.DLL

ntdll.dll

UUWiseHelper.dll

dc.dll

ZMApi.dll

qadati.dll

RegOpenKeyA

RegEnumKeyExA

RegCloseKey

uu_reportError

uu_loginA

ReportError

ZM_ReportErrorA

QACloubLogin

QACloubReportError

CreateIoCompletionPort

{18C0788E-59AE-4112-B452-6BF0C1B727FB}

{86AB1D8A-7995-4D86-AE5F-18710759228B}

{A068799B-7551-46b9-8CA8-EEF8357AFEA4}

\XQS.ini

?\QQDATA.ini

hXXp://VVV.sz789.net/reg.aspx

hXXp://VVV.uudama.com/userReg.html

hXXp://VVV.zhima365.com/userreg.php

hXXp://VVV.ruokuai.com/home/register

hXXp://VVV.qadati.cn/Account/Register

*.txt

|*.txt

hXXps://apisoft.df0535.com/Dfgapi/grouplink.html

52dfg666888data.name

data.url

WinHttp.WinHttpRequest.5.1

application/x-www-form-urlencoded

MSScriptControl.ScriptControl

function get__key(o) {

a.push(i);

//return JSON.stringify(jsonobj);

if (Object.prototype.toString.apply(O) === '[object Array]') {

for (var i = 0; i

S.push(O2String(O[i]));

J = '[' S.join(',') ']';

else if (Object.prototype.toString.apply(O) === '[object String]') {

J = '"' O.replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"';

else if (Object.prototype.toString.apply(O) === '[object Number]') {

else if (Object.prototype.toString.apply(O) === '[object Date]') {

J = "new Date(" O.getTime() ")";

else if (Object.prototype.toString.apply(O) === '[object RegExp]' || Object.prototype.toString.apply(O) === '[object Function]') {

J = O.toString();

else if (Object.prototype.toString.apply(O) === '[object Object]') {

t = typeof (O[i]) == 'string' ? '"' O[i].replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"' : (typeof (O[i]) === 'object' ? O2String(O[i]) : O[i]);

S.push('\"' i '\"' ':' t);

J = '{' S.join(',') '}';

T@\*.dfg

cmd /c regsvr32 msscript.ocx jscript.dll vbscript.dll /s

hXXp://92wg.sinaapp.com/softtj.php?act=add&softname=XQS

hXXp://VVV.52dfg.com/forum-40-1.html?XQS

hXXp://VVV.52dfg.com

/XQS.ini

bashengpass

{0:4,1:2,2:4,3:1,4:3,5:0}

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

hXXps://apisoft.df0535.com/Dfgapi/softmark

data.mark

data.version

data.log

data.remark

0@SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\

114.114.114.114,114.114.115.115

[/dfgmsg][dfgcolor]

[dfgmsg]

%y/%m/%d

%y-%m-%d

g@\Error.log

hXXp://VVV.52dfg.com/dfg/nvwnuqy2.gif

hXXp://VVV.52dfg.com/dfg/yxj.gif

hXXps://apisoft.df0535.com/Dfgapi/admanage.html

].name

].content

].imgurl

].url

].msg

1970-01-01 08:00:00

hXXp://imgcache.gtimg.cn/ACT/vip_act/act_data/28302.json.js

[[0,1,2,3],[4,5,6,7],[8,9,10,11]]

skey

hXXp://vipfunc.qq.com/common/user.php?callback=showGrowInfoPanel&data=grow_value&g_tk=

hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=23314&callback=vipSignNew.signCb&cachetime=

hXXp://iyouxi.vip.qq.com/ams3.0.php?callback=jQuery

hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=52002&rand=0.

hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=53284&rand=0.

data.op.sign.gift.f_actid

data.op.sign.gift.f_name

hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=

hXXps://ssl.

hXXp://

ptlogin2.qq.com/pt4_auth?daid=50&appid=7000201&auth_token=

&regmaster=&aid=7000201&s_url=http://baobao.qq.com/act/gamepet/

hXXp://cgi.baobao.qq.com/cgi-bin/pets_get_carried

pet.seq

hXXp://cgi.baobao.qq.com/cgi-bin/pets_takeoff

cmd=2&from=baobao

hXXp://cgi.baobao.qq.com/cgi-bin/pets_speedup_info

hXXp://cgi.baobao.qq.com/cgi-bin/pets_list

.avatarid

.life

300007156

hXXp://cgi.baobao.qq.com/cgi-bin/pets_takeon

hXXp://cgi.baobao.qq.com/cgi-bin/pets_speedup

ptlogin2.qq.com/pt4_auth?daid=173&appid=7000201&auth_token=

&regmaster=&aid=7000201&s_url=http://bbly.qq.com/

cmd=22&petID=

hXXp://cgi.bbly.qq.com/cgi-bin/PetHome?

a.push(b,c,d,e,f,g);

a.push(b,c,d,e,f);

function ptui_qlogin_CB(b,c,d)

a.push(b,c,d);

a.push(b,c);

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; qdesk 2.5.1277.202; Windows NT 6.1; WOW64; Trident/6.0; QQBrowser/7.7.28658.400)

hXXps://

https

hXXp://app.gamevip.qq.com/cgi-bin/gamevip_sign/GameVip_SignIn?callback=jQuery

SignDay.day

hXXp://app.gamevip.qq.com/cgi-bin/gamevip_sign/GameVip_Lottery?callback=jQuery

hXXp://app.gamevip.qq.com/cgi-bin/gamevip_m_sign/GameVip_m_SignIn?_

FB6BD4FB-5175-477D-A66C-121252F39935

hXXp://api.ruokuai.com/register.xml

hXXp://api.ruokuai.com/info.xml

hXXp://api.ruokuai.com/recharge.xml

hXXp://api.ruokuai.com/create.xml

hXXp://api.ruokuai.com/reporterror.xml

hXXp://iyouxi.vip.qq.com/json.php?mod=game&func=award&uin=

hXXp://iyouxi.vip.qq.com/jsonp.php?_c=page&actid=5474&isLoadUserInfo=1&callback=page.signInCb&g_tk=

hXXp://iyouxi.vip.qq.com/ams2.02.php?actid=23074&g_tk_type=1&g_tk=

hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=22249&g_tk=

hXXp://iyouxi.vip.qq.com/ams3.0.php?g_tk=

data.op.name

hXXp://x.pet.qq.com/vip_platform?cmd=set_sign_info&callback=jQuery

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=21547&sServiceDepartment=xinyue&set_info=xinyue

flowRet.sMsg

hXXp://starvip.qq.com/fcg-bin/v2/fcg_mobile_starvip_site_checkin?g_tk=

data.add

hXXp://flower.qzone.qq.com/fcg-bin/cgi_plant?g_tk=

&newflower=1&outCharset=utf-8&g_tk=

hXXp://flower.qzone.qq.com/cgi-bin/cgi_pickup_oldfruit?g_tk=

&outCharset=utf-8&fupdate=1&format=json

mode=1&g_tk=

data.count

hXXp://flower.qzone.qq.com/cgi-bin/cgi_show_userprop?p=0.

data.prop[

hXXp://flower.qzone.qq.com/cgi-bin/cgi_exchange_prop?g_tk=

&qzreferrer=http://rc.qzone.qq.com/appstore/dailycoupon?from=appstore.myInfoBoxBtn&fupdate=1

qzreferrer=http://ctc.qzs.qq.com/qzone/flower/tool.html#&op_uin=

frameElement.callback(

hXXp://flower.qzone.qq.com/cgi-bin/cgi_use_mallprop?g_tk=

qzreferrer=http://ctc.qzs.qq.com/qzone/flower/tool.html#&propid=7&op_uin=

hXXp://flower.qzone.qq.com/cgi-bin/fg_get_giftpkg?&g_tk=

Referer: hXXp://ctc.qzs.qq.com/qzone/client/photo/swf/RareFlower/FlowerVineLite.swf

data.vDailyGiftpkg[0].granttime

hXXp://flower.qzone.qq.com/cgi-bin/fg_use_giftpkg?g_tk=

giftpkgid=5001&outCharset=utf-8&granttime=

data.usedgiftpkg[0].caption

data.usedgiftpkg[0].content

&imei=&mac=&key=&t=

&skey=

hXXp://m.ac.qq.com/event/dailySignIn/SignIn.php?action=signIn&uin=

reward.exp

reward.bonus

hXXp://m.ac.qq.com/event/dailySignIn/SignIn.php?action=lottery&uin=

hXXp://fight.pet.qq.com/cgi-bin/petpk?cmd=award&op=1&type=0

ContinueLogin

hXXp://cgi.meigui.qq.com/cgi-bin/rosary_activity_oper?gprand=0.

request=2&cmd=15&cgiVersion=36&paytype=1&benew0908=1

hXXp://fcg.3366.com/fcg-bin/growinfo/mgp_growinfo_signin?&_r=

ptlogin2.qq.com/pt4_auth?daid=5&appid=549000912&auth_token=

&regmaster=&aid=549000912&s_url=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone

hXXp://user.qzone.qq.com/

hXXp://appstore.qzone.qq.com/cgi-bin/comm/appstore_qq_icon?uin=

hXXp://appact.qzone.qq.com/appstore_activity_appinner_fusionapi?uin=

hXXp://activity.qzone.qq.com/fcg-bin/appstore_activity_daily_signing?action=level&act=5084&g_tk=

data.signing_reward

].status

data.signing_reward[

].signing_day

].rand_reward_desc

].extra_score

hXXp://activity.qzone.qq.com/fcg-bin/appstore_activity_daily_signing?uin=

data.extra_score

data.result

data.reward_name

hXXp://appact.qzone.qq.com/appstore_activity_new_userinfo?uin=

hXXp://appact.qzone.qq.com/appstore_activity_daily_lottery?uin=

&canvastype=&from=appstore.myInfoBoxBtn&uin=

&pfid=2&qz_ver=8&appcanvas=0&qz_style=31&params=dailycoupon&entertime=

qzreferrer=http://appstore.qzone.qq.com/cgi-bin/qzapps/qz_appstore_home_v4?uin=

hXXp://h5.qzone.qq.com/vipinfo/index?plg_nld=1&source=qqmail&plg_auth=1&plg_uin=1&_wv=3&plg_dev=1&plg_nld=1&aid=jh&_bid=368&plg_usr=1&plg_vkey=1&pt_qzone_sig=1

window.shine0callback =

hXXp://vip.qzone.qq.com/fcg-bin/v2/fcg_mobile_vip_site_checkin?t=0.

&low_login=1&uin=

hXXp://pay.video.qq.com/fcgi-bin/sign?callback=jQuery111006800204519842937_

result.msg

result.code

%y-%m-%d

hXXp://c.pc.qq.com/fcgi-bin/signin?callback=jsonp

&data={"req_header":{"cmd":17004,"appid":30013,"version":2,"major_version":2},"req_body":{"ReqMsg_body":{"weiyun.WeiyunDailySignInMsgReq_body":{}}}}&callback=jsonp2

hXXp://web2.cgi.weiyun.com/weiyun_activity.fcg?cmd =17004&g_tk=

rsp_header.retcode

rsp_body.RspMsg_body["weiyun.WeiyunDailySignInMsgRsp_body"].add_point

hXXp://account.book.qq.com/usercenter/index.html

hXXp://account.book.qq.com

X-Requested-With: XMLHttpRequest

Referer: hXXp://account.book.qq.com/usercenter/index.html

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

hXXp://account.book.qq.com/usercenter/signin.html

hXXp://checkin.qq.com/json.php?mod=home&act=getcalendar&month=

].create_time

hXXp://snsapp.qzone.qq.com/cgi-bin/signin/checkin_cgi_read?version=1&more_info_length=10&is_need_rank=1&plattype=1&r=0.

data.seal_info.seal_info['23'][5].post_proxy

data.seal_info.seal_info['23'][5].id

hXXp://login.52dfg.com/xinxi/shuoshuo/getss.php?type=

hXXp://snsapp.qzone.qq.com/cgi-bin/signin/checkin_cgi_publish?g_tk=

qzreferrer=http://ctc.qzs.qq.com/qzone/app/checkin_v4/html/checkin.html#id=0&groupId=0&nofeeds=0&ref=checkin_button&to=ICONVIEW&plattype=1&hostuin=

Referer: hXXp://ctc.qzs.qq.com/qzone/app/checkin_v4/html/checkin.html

hXXp://social.minigame.qq.com/cgi-bin/social/welcome_panel_operate?cmd=2&DomainID=207&g_tk=

hXXp://social.minigame.qq.com/cgi-bin/social/welcome_panel_operate?callback=jQuery&cmd=1&uin=

hXXp://social.minigame.qq.com/cgi-bin/social/welcome_panel_operate?callback=jQuery&cmd=3&uin=

].lotteryid

].lotteryitemname

hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_feedback_send_lottery.fcg?activeid=110&rnd=

data.alreadysend

hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_dmrp_get_present.fcg?activeid=73&rnd=

Referer: hXXp://youxi.vip.qq.com/m/wallet/activeday/index.html?_wv=3&pvsrc=101

User-Agent: Mozilla/5.0 (Linux; U; Android 2.3.4; zh-cn; Lan998 Build/GRJ22) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 V1_AND_SQ_5.2.1_183_YYB_D QQ/5.2.1.2305 NetType/WIFI

hXXp://i.browser.qq.com

hXXp://i.browser.qq.com/all_data_query?guid=6F9994A1FEB1E4BFC613806C0BCE93B5&g_tk=

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.87 Safari/537.36 QQBrowser/9.2.5748.400

static_data.task_list

].interface

static_data.task_list[

].title

].score

hXXp://buluo.qq.com/cgi-bin/bar/card/bar_list_by_page?neednum=1&startnum=0&r=0.

result.followbarnum

D@hXXp://buluo.qq.com/cgi-bin/bar/card/bar_list_by_page?neednum=40&startnum=

result.followbars

].bid

result.followbars[

hXXp://buluo.qq.com/cgi-bin/bar/user/sign

result.add_credits

hXXp://qun.qq.com/cgi-bin/qun_mgr/get_group_list

join

join[

hXXp://qiandao.qun.qq.com/cgi-bin/sign

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=11117&sServiceDepartment=djc&set_info=djc

modRet.ret

modRet.msg

gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=dj&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=11117&iFlowId=96910&g_tk=

flowRet.iRet

modRet.sMsg

hXXp://proxy.vac.qq.com/cgi-bin/srfentry.fcgi?ts=

Referer: hXXp://vac.qq.com/wifi/v2/integral.html?_wv=1

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X; en-us) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53

&data={"10137":{"req":{"platId":1,"count":4}}}

["10137"].data.vecRecord

].platId

["10137"].data.vecRecord[

].taskId

].taskFlow

].netcoin

].taskName

["10146"].msg

hXXp://cgi.vip.qq.com/online/set?p_tk=&g_tk_type=1&g_tk=

hXXp://1.game.qq.com/app/sign?start=

jData.signInfo.msg

jData.signInfo.ret

hXXp://x.pet.qq.com/petgrow?cmd=Random&callback=jQuery

hXXp://x.pet.qq.com/toolbarsign?cmd=Sign&callback=jQuery

hXXp://x.pet.qq.com/toolbarsign?cmd=Gift&callback=jQuery

hXXp://novelsns.html5.qq.com/ajax?m=task&type=sign&t=

; Q-H5-SKEY=

hXXp://qzs.qq.com/qzone/mall/app/vip_reward/index.html

hXXp://activity.qzone.qq.com/fcg-bin/fcg_qzact_count?g_tk=

hXXp://activity.qzone.qq.com/fcg-bin/fcg_qzact_lottery?g_tk=

&qzreferrer=http://qzs.qq.com/qzone/qzact/act/hkhd/index.html

data[0].name

data[0].count

hXXp://pf.vip.qq.com/common/vframe1.1.php?&id=2000013&g_tk=

TASK.RET

TASK.RESULT.level

hXXp://king.qq.com/lb.html

hXXp://pf.vip.qq.com/common/vframe1.1.php?&id=3000013&g_tk=

hXXp://pf.vip.qq.com/common/vframe1.1.php?&id=5000013&g_tk=

dfg.dat

operatea

hXXps://apisoft.df0535.com/Dfgapi/startpage.html

].browsername

].startpage

1.txt

HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command [9]

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main [9]

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel [9]2.txt

HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command [2 8]

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main [2 8]

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel [2 8]cmd /c regini

"%Program Files%\Internet Explorer\iexplore.exe"

CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command\

Software\Policies\Microsoft\Internet Explorer\Main\Default_Page_URL

Software\Microsoft\Internet Explorer\Main\Default_Page_URL

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProfilesDirectory

*.lnk

qqbrowser.exe

wshom.ocx

S.push(i ':' t);

[/dfgmsg]

hXXps://ssl.ptlogin2.qq.com/login?u=

Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko QQBrowser/8.1.3700.400

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36

Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

\UUWiseHelper.dll

.text

`.rdata

@.data

@.reloc

SSSSh

ByScreen.JPG

operator

GetProcessWindowStation

E:\work\UUWiseHelper

\UUWiseHelper.pdb

KERNEL32.dll

RegOpenKeyExW

ADVAPI32.dll

SHELL32.dll

OLEAUT32.dll

SHLWAPI.dll

urlmon.dll

dbghelp.dll

gdiplus.dll

IPHLPAPI.DLL

WS2_32.dll

GetProcessHeap

GetCPInfo

UUWiseHelper.DLL

uu_easyRecognizeUrlA

uu_easyRecognizeUrlW

uu_loginW

uu_recognizeByCodeTypeAndUrlA

uu_recognizeByCodeTypeAndUrlW

zcÃ

"0,01070

8Â8J8R8x8

0#0'0-01070;0

=*>0>4>8>

5%6S6

3$3,383\3|3

\dc.dll

MFC42.DLL

GdiplusShutdown

WSOCK32.dll

MSVCP60.dll

ReportError_A

VBYB_ReportError

VB_ReportError

debug.ini

ReportError:%s

Error:%s

%s|!|%s

\dms.pdb

%u%u,

dclog.txt

config.ini

port

settimeout:%d

[%d]%s

reg2:%s

checkok:%s %s

check fail:%s %s %s

check:%s %s

getcjfail:%s %s

getcj:%s %s

%s%uout

%s%uin

put img ok:%s

put img fail:%s

put img:%s %s %d

get result ok:%s,%s

get result fail:%s

get result:%s

notifyfail ok:%s

%s\%d-%s.png

notifyfail fail:%s,%s

notifyfail:%s

getimgok:%s,%s

getimg:%s

getinfo fail:%s

getinfo:%s,%s

setresult:%s,%s

HTTP/1.1 200 OK

recv:%d

send:%d

GET /ip.txt HTTP/1.1

Host: %s

User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2

select:%d

ioctlsocket:%d

socket:%d

api.qqchaoren.net

14.17.65.24

14.17.65.23

dama2.qqchaoren.net

dama1.qqchaoren.net

connect total:%s %d

:%s %d

connect discard:%s %d

[d-d-d d:d:d](u)

recv timeout:

recvfail:%d

server close:%d

recv:%d

send:%d

sendfail:%d

connect timeout:

connectok:%s %hu

127.0.0.1

1.1.3

\ZMApi.dll

9^ u%f

uÃ¹ u f9k

Ht.Ht!

tAHt.Ht

uÃ¹~DuH

It.It

F t.Oj

hCRTkQ

hCRTrW

hCRTgW

hCRTbW

tÃ¹}

u&SSh

A$v%SU

D$`CRTr

D$lCRTg

D$xCRTb

?%uMf

\Captcha\Src\Common\MyGlobal.cpp

%.2d-%.2d:%.2d:%.2d.%.3d [ %s %d ]

s:%d %s len:%d

\Captcha\Src\Common\MyToolsLib.cpp

CNotSupportedException

CHttpConnection

CHttpFile

CCmdTarget

COMCTL32.DLL

hhctrl.ocx

mscoree.dll

internal state. The program cannot safely continue execution and must

continue execution and must now be terminated.

- This application cannot run using the active version of the Microsoft .NET Runtime

Please contact the application's support team for more information.

OLEACC.dll

?#%X.y

1.2.3

%u BitsPerSample not allowed for JPEG

Broken pipe

Inappropriate I/O control operation

Operation not permitted

z:\Captcha\Temp\Zmapi\Release\Zmapi.pdb

UnhookWindowsHookEx

GetKeyState

SetWindowsHookExW

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

comdlg32.dll

WINSPOOL.DRV

RegOpenKeyW

RegDeleteKeyW

RegEnumKeyW

RegCreateKeyExW

UrlUnescapeW

InternetCrackUrlW

InternetCanonicalizeUrlW

HttpAddRequestHeadersW

HttpQueryInfoW

HttpSendRequestW

HttpOpenRequestW

WININET.dll

Zmapi.dll

ZM_ReportErrorW

.PAVCObject@@

.PAVCException@@

.PAVCOleException@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.PAVCNotSupportedException@@

.PAVCInvalidArgException@@

.?AVCNotSupportedException@@

.PAVCInternetException@@

.?AVCHttpConnection@@

.?AVCHttpFile@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.PAVCArchiveException@@

.?AVCTestCmdUI@@

.PAVCUserException@@

.PAVCFileException@@

Save RAW not supported

Save WMF not supported

Unsupported WBMP type

1.2.24

Page %d

compression type not supported

libpng error: %s

libpng error: %s, offset=%d

libpng error no. %s: %s

libpng warning: %s

libpng warning no. %s: %s

iTXt chunk not supported.

Unknown zTXt compression type %d

Incomplete compressed datastream in %s chunk

Data error in compressed datastream in %s chunk

Buffer error in compressed datastream in %s chunk

gamma = (%d/100000)

gx=%f, gy=%f, bx=%f, by=%f

wx=%f, wy=%f, rx=%f, ry=%f

incorrect gamma=(%d/100000)

NULL row buffer for row %ld, pass %d

Empty keyword in iCCP chunk

Unknown compression type %d

Empty keyword in sPLT chunk

white_x=%f, white_y=%f

zero length keyword

keyword length must be 1 - 79 characters

Zero length keyword

extra interior spaces removed from keyword

leading spaces removed from keyword

trailing spaces removed from keyword

invalid keyword character 0xX

Out of memory while procesing keyword

Empty keyword in tEXt chunk

Empty keyword in zTXt chunk

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

RST%d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

Obtained EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC index %d

Unsupported color conversion request

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

IDCT output block size %d not supported

Invalid component ID %d in SOS

Bogus message code %d

%ld%c

%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

%s: Read error at scanline %lu; got %lu bytes, expected %lu

%s: Seek error at scanline %lu, strip %lu

%s: Data buffer too small to hold strip %lu

%s: Read error on strip %lu; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

%s: Seek error at row %ld, col %ld, tile %ld

%s: Data buffer too small to hold tile %ld

%s: No space for data buffer at scanline %ld

%u: Sample out of range, max %u

Sample %d out of range, max %u

"%s": Bad mode

Not a TIFF file, bad version number %d (0x%x)

Not a TIFF file, bad magic number %d (0x%x)

%s: Out of memory (TIFF structure)

Sorry, can not handle YCbCr images with %s=%d

Sorry, LogL data must have %s=%d

Sorry, can not handle LogLuv images with %s=%d

Sorry, LogLuv data must have %s=%d or %d

Sorry, can not handle image with %s=%d

Sorry, can not handle separated image with %s=%d

Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

Sorry, can not handle RGB image with %s=%d

Missing needed %s tag

%s: Cannot modify tag "%s" while writing

%s: Unknown %stag %u

%f: Bad value for "%s"

%s: Invalid %stag "%s" (not supported by codec)

%ld: Bad value for "%s"

%d: Bad value for "%s"

Nonstandard tile length %d, convert file

Nonstandard tile width %d, convert file

Bad value %ld for "%s" tag ignored

%s: Invalid InkNames value; expecting %d names, found %d

%s: Error fetching directory count

%s: Error fetching directory link

"%s": Information lost writing value (%g) as (unsigned) RATIONAL

Error writing data for field "%s"

%s: Error writing SubIFD directory link

%d: Sample out of range, max %d

%s: No space for %s arrays

%s: Must set "PlanarConfiguration" before writing data

%s: Must set "ImageWidth" before writing data

%s: File not open for writing

%s: No space for output buffer

%s: No space to expand strip arrays

%s: Write error at scanline %lu

%s: Seek error at scanline %lu

Bogus "%s" field, ignoring and calculating from imagelength

TIFF directory is missing required "%s" field, calculating from imagelength

unknown field with tag %d (0x%x) ignored

wrong data type %d for "%s"; tag ignored

No space %s

TIFF directory is missing required "%s" field

incorrect count for field "%s" (%lu, expecting %lu); tag ignored

Error fetching data for field "%s"

%s: Rational with zero denominator (num = %lu)

Cannot handle different per-sample values for field "%s"

Cannot read TIFF_ANY type %d for field "%s"

Compression scheme %u %s encoding is not implemented

%s %s encoding is not implemented

%s %s encoding is no longer implemented due to Unisys patent enforcement

Compression scheme %u %s decoding is not implemented

%s %s decoding is not implemented

Compression algorithm does not support random access

Internal error, unknown tag 0x%x

%s compression support is not configured

?%s: No space for LogLuv state block

Inappropriate photometric interpretation %d for SGILog compression; %s

LogL16Decode: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

%s: No space for SGILog translation buffer

No support for converting user data format to LogL

No support for converting user data format to LogLuv

SGILog compression supported only for %s, or raw data

Unknown data format %d for LogLuv compression

Unknown encoding %d for LogLuv compression

%s: %s

%s: Not enough data at scanline %d (short %d bytes)

%s: zlib error: %s

%s: Decoding error at scanline %d, %s

%s: Encoder error: %s

%s: No space for state block

%s: Bad code word at scanline %d (x %lu)

%s: %s at scanline %d (got %lu, expected %lu)

%s: Premature EOF at scanline %d (x %lu)

%s: No space for Group 3/4 reference line

%s: No space for Group 3/4 run arrays

%s: Uncompressed data (not supported) at scanline %d (x %lu)

Fax SubAddress: %s

(%u = 0x%x)

%suncompressed data

%sEOL padding

%s2-d encoding

%s compression is not supported

Tiled Wang image not supported

Does not support lossless Huffman coding

RowsPerStrip must be multiple of %d for JPEG

JPEG tile width must be multiple of %d

JPEG tile height must be multiple of %d

BitsPerSample %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

ThunderDecode: %s data at scanline %ld (%lu != %lu)

PackBitsDecode: discarding %d bytes to avoid buffer overrun

LZWDecode: Not enough data at scanline %d (short %d bytes)

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

DumpModeDecode: Not enough data for scanline %d

Horizontal differencing "Predictor" not supported with %d-bit samples

"Predictor" value %d not supported

%u (0x%x)

Portable Graymap/Pixmap (PNM)

error: BMP format does not support color space

%s %s %d %ld %ld

hXXp://VVV.ijg.org

The IJG JPEG library is required for JPEG decoding support.

The IJG JPEG library is required for JPEG encoding support.

len = %d;

type = 0xx (%s);

tileno = %d; len = %d; partno = %d; numparts = %d

prec[%d] = %d; sgnd[%d] = %d; hsamp[%d] = %d; vsamp[%d] = %d

tilewidth = %d; tileheight = %d; tilexoff = %d; tileyoff = %d;

width = %d; height = %d; xoff = %d; yoff = %d;

caps = 0xx;

prcwidth[%d] = %d, prcheight[%d] = %d

cblkwidthval = %d; cblkheightval = %d; cblksty = 0xx;

prg = %d; numlyrs = %d;

numdlvls = %d; qmfbid = %d; mctrans = %d

csty = 0xx;

cblkwidthval = %d; cblkheightval = %d; cblksty = 0xx; qmfbid = %d;

compno = %d; csty = 0xx; numdlvls = %d;

compno = %d; roisty = %d; roishift = %d

expn[%d] = 0xx; mant[%d] = 0xx;

qntsty = %d; numguard = %d; numstepsizes = %d

compno = %d; qntsty = %d; numguard = %d; numstepsizes = %d

seqno = %d;

ind=%d; len = %d;

le[%d] = %d

rs[%d] = %d; re[%d] = %d;

cs[%d] = %d; ce[%d] = %d;

po[%d] = %d;

hoff[%d] = %d; voff[%d] = %d

regid = %d;

invalid code block width %d

invalid code block height %d

warning: ignoring invalid option %s

warning: invalid intermediate layer rates specifier ignored (%s)

ignoring bad rate specifier %s

ignoring invalid progression order %s

ignoring invalid mode %s

unsupported image type

Creator: JasPer Version %s

error: too few guard bits (need at least %d)

lyrno=d cmptno=d rlvlno=d bandno=d prcno=d cblkno=d passno=d

lyrno = d

success %d goodthresh %f

maxlen=ld actuallen=ld thresh=%f

min rdslope = %f max rdslope = %f

cblk ] ] ] ]

prc ] ] ] ] (] ])

band ] ] ] ]

rlvl ] ] ] ]

tcmpt ] ] ] ]

CODE BLOCK %d

CODE BLOCK GROUP %d

BAND %d

xs =%d, ys = %d, xe = %d, ye = %d, w = %d, h = %d

RESOLUTION LEVEL %d

ICC Profile CS x

error: unsupported compression type

box type %s

error: encoding method not supported

error: RLE encoding method not supported

warning: palettized images not fully supported

error: unsupported color space

error: unsupported BMP encoding

THE BMP FORMAT IS NOT FULLY SUPPORTED!

unsupported BMP encoding

no palettized image support for BMP format

warning: support for signed sample data requires use of nonstandard extension to PNM format

%s%ld

error: PNM support required

warning: ignoring unsupported options

data=%s

component tlx=%ld tly=%ld sampperx=%ld samppery=%ld width=%ld height=%ld prec=%d sgnd=%d

(%f, %f, %f)

entry[%d] = %f

gamma = %f

number of entires = %d

maclen = %d

sccode = %d

uclangcode = %d; uclen = %d

ascii = "%s"

string = "%s"

numintabents=%d, numouttabents=%d

e[%d][%d]=%f

numinchans=%d, numoutchans=%d, clutlen=%d

1.900.1

packet offset=ld prg=%d cmptno=d rlvlno=d prcno=d lyrno=d

coding pass failed passtype=%d segtype=%d

type=%c%s%c (0xx); length=%d

csid=%d

method=%d; pri=%d; approx=%d

channo=%d; type=%d; assoc=%d

cmptno=%d; map=%d; pcol=%d

numchans = %d

LUT[%d][%d]=%d

numents=%d; numchans=%d

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

The delta operation is invalid (mismatched color_types?)

Requested nEED resources are not supported

MHDR simplicity indicates unsupported feature(s)

Keyword cannot be zero-length

%s: Out of memory in %s

%s: decoder table overflow

%d %d

%d,%d

%d %d %d

/.badpixels

%s is not a valid PGM file!

%s has the wrong dimensions!

Scaling with p->black %d, multipliers

%s: Cannot use camera p->white balance.

Median filter pass %d...

11124811248488

012347800000005896

%d:%d:%d %d:%d:%d

%f %f %f

Ixpress %d-Mp

50132467

Failed to read metadata from %s

Reading metadata from %s ...

0134567028

023457000000006000

012346000000000000

%d:%d:%d

%d.%d.%d

%*s %s %d %d:%d:%d %d

v%d %dx%d

%s %s

%s: You must link dcraw with libjpeg!!

%dx%d

Converting to %s colorspace...

d:d:d d:d:d

12435867

Unknown option "-%c".

Non-numeric argument to "-%c"

1141111142

Created by MIDL version 6.00.0361 at Wed Nov 05 22:09:21 2014

,0004080

3!3(31363

: :$:(:,:0:4:]:,;[;|;

=$=0=7=>=

;%@>

?0?4?8?@?

748:8?8_8

; ;$;(;,;

\qadati.dll

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

USER32.DLL

X%c

112.124.55.239

password

oldPassword

newPassword

__NOT_LOGIN

115.29.173.200

__TCP_CONNECT_%d

__TCP_SEND_%d

__TCP_RECV_%d

__TCP_RECV_ERROR

D:\My Datas\Dropbox\QACloubProductization\QACloub\Release\qadati.pdb

WinHttpOpen

WinHttpSetTimeouts

WinHttpConnect

WinHttpOpenRequest

WinHttpAddRequestHeaders

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpQueryDataAvailable

WinHttpReadData

WinHttpCloseHandle

WINHTTP.dll

GetConsoleOutputCP

QACloubChangePassword

QACloubLoginKey

QACloubLoginRegCode

8&858:8[8`8

.toString()

.splice(

.push(

get__key(

pt_login_sig

hXXp://check.

&u1=http://bbs.lol.qq.com/member.php?mod=logging&action=loginsucc&r=0.

&appid=710032918&js_ver=10034&js_type=1&login_sig=

ptlogin2.qq.com/check?regmaster=&pt_tea=1&pt_vcode=1&uin=

captcha.qq.com/cap_union_show?clientype=2&aid=710032918&uin=

&js_ver=10034&js_type=1&login_sig=

&pt_randsalt=0&ptredirect=0&u1=http://bbs.lol.qq.com/member.php?mod=logging&action=loginsucc&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=

ptlogin2.qq.com/login?u=

captcha.qq.com/cap_union_verify?aid=710032918&uin=

aq.qq.com

while (z aD

t = aC.substring(z, z aD) "\n";

return t aC.substring(z, aC.length)

return "0" t.toString(16)

return t.toString(16)

if (aG

var aC = aD.length - 1;

var aE = aD.charCodeAt(aC--);

z.nextBytes(t)

this.dmp1 = null;

this.dmq1 = null;

this.coeff = null

if (z != null && t != null && z.length > 0 && t.length > 0) {

uv_alert("Invalid RSA public key")

return t.modPowInt(this.e, this.n)

var t = ah(aC, (this.n.bitLength() 7) >> 3);

var aD = this.doPublic(t);

var z = aD.toString(16);

if ((z.length & 1) == 0) {

N.prototype.doPublic = Y;

N.prototype.setPublic = q;

N.prototype.encrypt = r;

this.fromNumber(z, t, aC)

this.fromString(z, 256)

this.fromString(z, t)

aG = Math.floor(aC / 67108864);

au.prototype.am = aA;

au.prototype.DB = ay;

au.prototype.DM = ((1

au.prototype.DV = (1

au.prototype.FV = Math.pow(2, ac);

au.prototype.F1 = ac - ay;

au.prototype.F2 = 2 * ay - ac;

ar = "0".charCodeAt(0);

ar = "a".charCodeAt(0);

ar = "A".charCodeAt(0);

return ag.charAt(t)

var aC = ai[z.charCodeAt(t)];

z.fromInt(t);

this.fromRadix(aG, z);

var aF = aG.length,

if (aG.charAt(aF) == "-") {

if (aE aD > this.DB) {

this[this.t - 1] |= (t & ((1

this[this.t ] = (t >> (this.DB - aE))

if (aE >= this.DB) {

aE -= this.DB

this[this.t - 1] |= ((1

this.clamp();

au.ZERO.subTo(this, this)

var t = this.s & this.DM;

return "-" this.negate().toString(z)

return this.toRadix(z)

var aG = this.DB - (aD * this.DB) % aC;

if (aG > aG) > 0) {

aH |= this[--aD] >> (aG = this.DB - aC)

aG = this.DB; --aD

au.ZERO.subTo(this, t);

return (this.s

return this.DB * (this.t - 1) l(this[this.t - 1] ^ (this.s & this.DM))

z.t = Math.max(this.t - aC, 0);

var z = aH % this.DB;

var t = this.DB - z;

var aE = Math.floor(aH / this.DB),

aG = (this.s

aD.clamp()

var aE = Math.floor(aG / this.DB);

var z = aG % this.DB;

t = Math.min(z.t, this.t);

aD[aC ] = aE & this.DM;

aE >>= this.DB

aD[aC ] = aE & this.DM;

aE >>= this.DB

aD[aC ] = this.DV aE

var t = this.abs(),

aE = z.abs();

aD[aC t.t] = t.am(0, aE[aC], aD, aC, 0, t.t)

aD.clamp();

au.ZERO.subTo(aD, aD)

var t = this.abs();

var aD = t.am(z, t[z], aC, 2 * z, 0, 1);

if ((aC[z t.t] = t.am(z 1, 2 * t[z], aC, 2 * z 1, aD, t.t - z - 1)) >= t.DV) {

aC[z t.t] -= t.DV;

aC[aC.t - 1] = t.am(z, t[z], aC, 2 * z, 0, 1)

aC.clamp()

var aQ = aK.abs();

var aI = this.abs();

aH.fromInt(0)

this.copyTo(aG)

var aP = this.DB - l(aQ[aQ.t - 1]);

aQ.lShiftTo(aP, aE);

aI.lShiftTo(aP, aG)

aQ.copyTo(aE);

aI.copyTo(aG)

var aT = this.FV / aL,

aE.dlShiftTo(aN, aF);

if (aG.compareTo(aF) >= 0) {

aG.subTo(aF, aG)

au.ONE.dlShiftTo(aM, aF);

aF.subTo(aE, aE);

var aD = (aG[--aO] == aC) ? this.DM: Math.floor(aG[aO] * aT (aG[aO - 1] aR) * aS);

if ((aG[aO] = aE.am(0, aD, aG, aN, 0, aM))

aE.dlShiftTo(aN, aF);

aG.subTo(aF, aG);

aG.subTo(aF, aG)

aG.drShiftTo(aM, aH);

au.ZERO.subTo(aH, aH)

aG.clamp();

aG.rShiftTo(aP, aG)

au.ZERO.subTo(aG, aG)

this.abs().divRemTo(t, null, z);

if (this.s 0) {

t.subTo(z, z)

if (t.s = 0) {

return t.mod(this.m)

t.divRemTo(this.m, null, t)

t.multiplyTo(aC, z);

this.reduce(z)

t.squareTo(z);

M.prototype.convert = X;

M.prototype.revert = am;

M.prototype.reduce = L;

M.prototype.mulTo = J;

M.prototype.sqrTo = aw;

z = (z * (2 - t * z % this.DV)) % this.DV;

return (z > 0) ? this.DV - z: -z

this.mp = t.invDigit();

this.mpl = this.mp & 32767;

this.mph = this.mp >> 15;

this.um = (1

this.mt2 = 2 * t.t

t.abs().dlShiftTo(this.m.t, z);

z.divRemTo(this.m, null, z);

if (t.s 0) {

this.m.subTo(z, z)

t.copyTo(z);

this.reduce(z);

while (t.t

var aD = (z * this.mpl (((z * this.mph (t[aC] >> 15) * this.mpl) & this.um)

t[z] = this.m.am(0, aD, t, aC, 0, this.m.t);

while (t[z] >= t.DV) {

t[z] -= t.DV;

t.clamp();

t.drShiftTo(this.m.t, t);

if (t.compareTo(this.m) >= 0) {

t.subTo(this.m, t)

g.prototype.convert = al;

g.prototype.revert = av;

g.prototype.reduce = R;

g.prototype.mulTo = B;

g.prototype.sqrTo = ao;

return au.ONE

aF = aI.convert(this),

aF.copyTo(aG);

aI.sqrTo(aG, aC);

aI.mulTo(aC, aF, aG)

return aI.revert(aG)

if (aC

return this.exp(aC, aD)

au.prototype.copyTo = aa;

au.prototype.fromInt = p;

au.prototype.fromString = y;

au.prototype.clamp = Q;

au.prototype.dlShiftTo = at;

au.prototype.drShiftTo = Z;

au.prototype.lShiftTo = v;

au.prototype.rShiftTo = n;

au.prototype.subTo = ad;

au.prototype.multiplyTo = F;

au.prototype.squareTo = S;

au.prototype.divRemTo = G;

au.prototype.invDigit = D;

au.prototype.isEven = k;

au.prototype.exp = A;

au.prototype.toString = s;

au.prototype.negate = T;

au.prototype.abs = an;

au.prototype.compareTo = I;

au.prototype.bitLength = w;

au.prototype.mod = P;

au.prototype.modPowInt = ap;

au.ZERO = c(0);

au.ONE = c(1);

d(new Date().getTime())

/*if(navigator.appName=="Netscape"&&navigator.appVersion

K = Math.floor(65536 * Math.random());

o.init(W);

for (ae = 0; ae

return o.next()

for (t = 0; t

af.prototype.nextBytes = ax;

z = (z this.S[aD] aE[aD % aE.length]) & 255;

m.prototype.init = f;

m.prototype.next = a;

t.setPublic(aC, z);

return t.encrypt(aD)

return Math.round(Math.random() * 4294967295)

for (var B = 0; B

var C = Number(D[B]).toString(16);

if (C.length == 1) {

for (var A = 0; A

C = String.fromCharCode(parseInt(B.substr(A, 2), 16))

for (var A = 0; A

B[A] = C.charCodeAt(A)

var A = C.length;

var A = E.length;

for (var C = 0; C

var A = u.length;

for (var B = 0; B

C[B] = E.charCodeAt(B) & 255

for (var B = 0; B

C[A ] = parseInt(E.substr(B, 2), 16)

for (var B = 0; B

A = String.fromCharCode(C[B])

return d.encode(A)

initkey: function(A, B) {

d.PADCHAR = "=";

d.ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";

d.getbyte = function(C, B) {

var A = C.charCodeAt(B);

d.encode = function(E) {

if (arguments.length != 1) {

var B = d.PADCHAR;

var G = d.ALPHA;

var F = d.getbyte;

var C = E.length - E.length % 3;

if (E.length == 0) {

A.push(G.charAt(H >> 18));

A.push(G.charAt((H >> 12) & 63));

A.push(G.charAt((H >> 6) & 63));

A.push(G.charAt(H & 63))

switch (E.length - C) {

A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) B B);

A.push(G.charAt(H >> 18) G.charAt((H >> 12) & 63) G.charAt((H >> 6) & 63) B);

return A.join("")

return binl2hex(core_md5(str2binl(s), s.length * chrsz))

return binl2str(core_md5(str2binl(s), s.length * chrsz))

function hex_hmac_md5(key, data) {

return binl2hex(core_hmac_md5(key, data))

function b64_hmac_md5(key, data) {

return binl2b64(core_hmac_md5(key, data))

function str_hmac_md5(key, data) {

return binl2str(core_hmac_md5(key, data))

for (var i = 0; i

function core_hmac_md5(key, data) {

var bkey = str2binl(key);

if (bkey.length > 16) {

bkey = core_md5(bkey, key.length * chrsz)

ipad[i] = bkey[i] ^ 909522486;

opad[i] = bkey[i] ^ 1549556828

var hash = core_md5(ipad.concat(str2binl(data)), 512 data.length * chrsz);

return core_md5(opad.concat(hash), 512 128)

for (var i = 0; i

bin[i >> 5] |= (str.charCodeAt(i / chrsz) & mask)

for (var i = 0; i

str = String.fromCharCode((bin[i >> 5] >>> (i % 32)) & mask)

for (var i = 0; i

str = hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8 4)) & 15) hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8)) & 15)

for (var i = 0; i

if (i * 8 j * 6 > binarray.length * 32) {

str = tab.charAt((triplet >> 6 * (3 - j)) & 63)

for (var i = 0; i

arr.push("\\x" str.substr(i, 2))

arr = arr.join("");

if (Math.random() > (probability || 1)) {

var url = location.protocol "//ui.ptlogin2.qq.com/cgi-bin/report?id=" mid;

var s = document.createElement("img");

s.src = url;

function getEncryption(password, salt, vcode) {

var md5Pwd = md5(password),

rsaH1 = RSA.rsa_encrypt(h1),

rsaH1Len = (rsaH1.length / 2).toString(16),

hexVcode = TEA.strToBytes(vcode.toUpperCase()),

vcodeLen = "000" vcode.length.toString(16);

while (rsaH1Len.length

TEA.initkey(s2);

var saltPwd = TEA.enAsBase64(rsaH1Len rsaH1 TEA.strToBytes(salt) vcodeLen hexVcode);

TEA.initkey("");

return saltPwd.replace(/[\/\ =]/g,

"/": "-",

" ": "*",

"=": "_"

{pass}

getEncryption("{pass}","{salt}","{code}")

TEAKEY

SESSIONkEY

-12027,TEAKEY

&password=

&softkey=

Content-Disposition: form-data; name="password"

Content-Disposition: form-data; name="softkey"

{softkey}

Content-Disposition: form-data; name="image"; filename="System.Byte[]"

&appid=21000110&js_ver=10034&js_type=0&login_sig=&u1=http://gamevip.qq.com/hhb/index.shtml?ADTAG=IM.XINXI&aid=7000201&r=0.

ptlogin2.qq.com/check?pt_tea=1&uin=

&mibao_css=&t=1&g=1&js_type=0&js_ver=10034&login_sig=

&aid=21000110&u1=http://gamevip.qq.com/hhb/index.shtml?ADTAG=IM.XINXI&aid=7000201&h=1&ptredirect=1&ptlang=2052&daid=176&from_ui=1&dumy=&fp=loginerroralert&action=

&u1=http://xinyue.qq.com/comm-htdocs/login/logincallback.htm&r=0.

&appid=21000127&js_ver=10034&js_type=1&login_sig=

captcha.qq.com/cap_union_show?clientype=2&aid=21000127&uin=

&pt_randsalt=0&ptredirect=0&u1=http://xinyue.qq.com/comm-htdocs/login/logincallback.htm&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=

captcha.qq.com/cap_union_verify?aid=21000127&uin=

&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&r=0.

&appid=549000912&js_ver=10144&js_type=1&login_sig=

captcha.qq.com/cap_union_show?clientype=2&aid=549000912&uin=

&js_ver=10144&js_type=1&login_sig=

&pt_randsalt=0&u1=http://qzs.qq.com/qzone/v5/loginsucc.html?para=izone&ptredirect=0&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=

captcha.qq.com/cap_union_verify?aid=549000912&uin=

ui.ptlogin2.qq.com/cgi-bin/login?appid=7000201&f_url=loginerroralert&s_url=http://meigui.qq.com/&ptopt=1&qlogin_param=u1=http%3A//meigui.qq.com/%26ptopt%3D1&daid=49&style=11

&u1=http://meigui.qq.com/&ptopt=1&r=0.

&appid=7000201&js_ver=10034&js_type=1&login_sig=

ptlogin2.qq.com/check?regmaster=&pt_tea=1&uin=

&mibao_css=&t=1&g=1&js_ver=10034&js_type=1&login_sig=

&aid=7000201&u1=http://meigui.qq.com/&ptopt=1&h=1&ptredirect=1&ptlang=2052&daid=49&from_ui=1&dumy=&low_login_enable=0&regmaster=&fp=loginerroralert&action=

xui.ptlogin2.qq.com/cgi-bin/xlogin?proxy_url=hXXp://game.qq.com/comm-htdocs/milo/proxy.html&appid=21000501&target=top&s_url=http://daoju.qq.com/mall/&daid=8

&u1=http://daoju.qq.com/mall/&r=0.

&appid=21000501&js_ver=10138&js_type=1&login_sig=

captcha.qq.com/cap_union_show?clientype=2&aid=21000501&uin=

captcha.qq.com/getimgbysig?aid=21000501&uin=

&js_ver=10138&js_type=1&login_sig=

&pt_randsalt=0&ptredirect=1&u1=http://daoju.qq.com/mall/&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=

captcha.qq.com/cap_union_verify?aid=21000501&uin=

SetClientCertificate

admin@52dfg.com

5ugg%u

09/27/12

admin@52dfg.com

%d&&'

123456789

00003333

1.2.18

?456789:;

!"#$%&'()* ,-./0123

%*.*f

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

MSWHEEL_ROLLMSG

__MSVCRT_HEAP_SELECT

iphlpapi.dll

MPR.dll

VERSION.dll

Shell32.dll

Mpr.dll

User32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

;3 #>6.&

'2, / 0&7!4-)1#

VVV.dywt.com.cn

%s,%d

%s.lnk

(*.avi)|*.avi

RICHED32.DLL

RICHED20.DLL

WPFT532.CNV

WPFT632.CNV

EXCEL32.CNV

write32.wpc

Windows Write

mswrd632.wpc

Word for Windows 6.0

wword5.cnv

Word for Windows 5.0

mswrd832.cnv

mswrd632.cnv

Word 6.0/95 for Windows & Macintosh

html32.cnv

keywords

(%S)%M%D %y-%m-%d

After RemoveDC(), pen counter: %d, bursh counter: %d, font counter: %d

!!! Create pen ERROR! ErrNo.[%d]

Create pen No.%d

!!! Create brush ERROR! ErrNo.[%d]

Create brush No.%d

!!! Create font ERROR! ErrNo.[%d]

Create font No.%d

- Delete pen No.%d

- Delete brush No.%d

- Delete font No.%d

TrayIcon event: %x

hXXp://VVV.eyuyan.com

service@dywt.com.cn

86(0411)39895834

86(0411)39895831

This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info

DelAllKeyValues

DelKeyValue

GetAllKeys

GetKeyValue

AddKeyValue

DSGetErrMsg

BiTreeGetCurNodeKey

ListGetCurNodeKey

ListUpdateNodeFromKey

ListRemoveNodeFromKey

edatastructure_fnMapDelAllKeyValues

edatastructure_fnMapDelKeyValue

edatastructure_fnMapGetAllKeys

edatastructure_fnMapGetKeyValue

edatastructure_fnMapAddKeyValue

edatastructure_fnBiTreeGetCurNodeKey

edatastructure_fnListGetCurNodeKey

edatastructure_fnListUpdateNodeFromKey

edatastructure_fnListRemoveNodeFromKey

1.1.4

%d%d%d

rundll32.exe shell32.dll,

.PAVCResourceException@@

[13:55:44][

[13:55:44]

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

1, 0, 6, 6

- Skin.dll

CCaptchaRecognizer::recognizeByCodeTypeAndUrl

hXXp://s1.uudati.com:

hXXp://s1.taskok.com:

hXXp://s1.uudama.com:

hXXp://s1.uuwise.com:

/Api/config.aspx

2.0.0.5

WiseClientAPI-2.0.0.5

CCaptchaRecognizer::__UpdateTKEY

CCaptchaRecognizer::_IsNeedLogin

/Api/DecodeImg.aspx

xxxxxxxxxxx

hXXp://p1.uuwise.net:

hXXp://p1.uudama.net:

hXXp://p1.taskok.com:

hXXp://p1.uuwise.com:

hXXp://p1.uudama.com:

CCaptchaRecognizer::easyRecognizeUrl

%d%d%d%d%d

CCaptchaRecognizer::_CalcRandomPort

/Api/VerifyAPIFile.aspx

/Api/UserLogin.aspx

CCaptchaRecognizer::login

/Api/UserReg.aspx

/Api/PayCard.aspx

/Api/ReportError.aspx

CCaptchaRecognizer::reportError

/Api/UserPoint.aspx

|2.0.0.5|

/Api/DecodeResult.aspx

ID/KEY/

ByTypeBytes.JPG

%d-%d-%d

CHttpRequestHelper::_ReadResponse

User-Agent:WiseClient-2.0.0.5;

WiseClient-2.0.0.5

CHttpRequestHelper::_InternalRequest

CHttpRequestHelper::RequestGetImage

CHttpRequestHelper::RequestPost

ServerPort

UUExtConfig.ini

-:-:-.%d

tCRYPTDLL.DLL

3.cn.pool.ntp.org

2.cn.pool.ntp.org

1.cn.pool.ntp.org

0.cn.pool.ntp.org

cn.pool.ntp.org

\\.\PHYSICALDRIVE0

Microsoft Windows Millennium Edition

Microsoft Windows 98

Microsoft Windows 95

%s (Build %d)

Service Pack 6a (Build %d)

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009

Web Edition

Service Pack %d (Build %d)

Microsoft Windows NT

Microsoft Windows 2000

Microsoft Windows XP

Microsoft Windows Server 2003,

Microsoft Windows XP Professional x64 Edition

Microsoft Windows Server 2003 "R2"

Windows Server 2008

Windows Vista

Windows Server 2008 R2

Windows 7

ox-x-x-x-x-x

\Tencent\Users\*.*

nKERNEL32.DLL

WUSER32.DLL

!"#$%&'()* ,-.

uuwise.com

2, 0, 0, 5

1.0.0.1

!"#$%&'()* ,-

25, 0, 0, 1

Windows

s:%d MyCloseSocket

\ZMException.txt

addr.sa_family != AF_INET,

s:%d ConnetToServer

%d.%d.%d.%d

[%d] %s

\ZMApi.ini

Mysql

ERROR_DATABASE_USERORPASSWORD

ERROR_DATABASE_MYSQL_INIT

ERROR_DATABASE_MYSQL_ERROR

ERROR_CUSTOMER_REPORT

hXXp://VVV.zhima365.com/jump/api_new_version.php

hXXp://VVV.zm60.com/jump/jump_new_version.php

ERROR_ANOTHER_PLACE_LOGIN

ERROR_PASSWORD_EMPTY

ERROR_PASSWORD_ERROR

\ZMError.ini

%.2d.txt

%s IP %d.%d.%d.%d

%.3d.zm60.com

2147516317

\ZMConnect.ini

. s:%d nPacketLen:%d

%s\%.4d%.2d%.2d\%.2d\%.2d

xxxUpdate.exe

\ZMApiUpdate.exe

\ZMWorkerUpdate.exe

AfxParseURL()

s:%d MySend()

: nResultLen %d

: nPicIDLen %d

PicID: %s

cRecognizeState: %d

Report

Customer_Send_Report()

: nNoticeLen %d

Host: ssl.zhima365.com

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

/user/reg_user_vc .php?loginname=%s&password=%s&repassword=%s&email=%s&qq=%s&phone=%s&name=%s&softwareid=%d HTTP/1.1

hXXps://ssl.zhima365.com/user/reg_user_vc .php?loginname=%s&password=%s&repassword=%s&email=%s&qq=%s&phone=%s&name=%s&softwareid=%d

11111111111

Reg@163.com

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

/user/user_card_recharge.php?loginname=%s&password=%s&prepaid_card=%s&softwareid=%d HTTP/1.1

hXXps://ssl.zhima365.com/user/user_card_recharge.php?loginname=%s&password=%s&prepaid_card=%s&softwareid=%d

/user/user_api_statistic.php?loginname=%s&password=%s HTTP/1.1

hXXps://ssl.zhima365.com/user/user_api_statistic.php?loginname=%s&password=%s

Customer_Send_Login()

nErrorCode:%d

IP %u

s:%d Customer_Recv_Response_QueryBalance()

: ZMApiUpdate.exe

ZM_QueryBalanceW() NULL == pszPassword

Customer_Recv_Response_Login()

s:%d Customer_Recv_Report_OK()

s:%d Customer_Recv_Result()

s:%d Customer_Recv_Response_Login()

s:%d Customer_Recv_Report_OK()

ZM_ReByBufferW() NULL == pszPassword

sbtm %d

nJPGSize:%d

nPicSize:%d

ZM_ReByBufferW() NULL == pszSoftwareKey

ZM_ReByFileW() NULL == pszPassword

ZM_ReByFileW() NULL == pszSoftwareKey

ZM_ReByScreenW() NULL == pszPassword

ZM_ReByScreenW() NULL == pszSoftwareKey

ZM_ReportErrorW() pszPicID

ZM_ReportErrorW() NULL == pszPicID

ZM_QueryBalanceA() NULL == pszPassword

ZM_ReByBufferA() NULL == pszPassword

ZM_ReByBufferA() NULL == pszSoftwareKey

ZM_ReByFileA() NULL == pszPassword

ZM_ReByFileA() NULL == pszSoftwareKey

ZM_ReByScreenA() NULL == pszPassword

ZM_ReByScreenA() NULL == pszSoftwareKey

ZM_ReportErrorA() pszPicID

ZM_ReportErrorA() NULL == pszPicID

\%.4d%.2d%.2d_%.2d%.2d%.2d_%s

WININET.DLL

HTTP/1.0

Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32

Software\Microsoft\Windows\CurrentVersion\Policies\Network

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

%s.dll

TYPELIB\%s

accKeyboardShortcut

CxImage 6.0.0

!"#$%&'()* ,-./01234567

2, 1, 1, 0

All Files (*.*)

No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.

Access to %1 was denied..An invalid file handle was associated with %1.

Seek failed on A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.

Disk full while accessing %1..An attempt was made to access %1 past its end.

#Unable to load mail system support.

proxy8.qadati.cn

proxy7.qadati.cn

proxy6.qadati.cn

proxy5.qadati.cn

proxy4.qadati.cn

proxy3.qadati.com

datiapi2.qacloub.com

datiapi.qacloub.com

G/User/Login

y/User/LoginKey

e/User/LoginRegCode

d/User/ChangePassword

D/Code/ReportError

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729)

C:\QAClOUB_LOG.txt

Cookie: ASP.NET_SessionId=QACloub12f948b017d1;software_id=%s;login_session=%s;

Cookie: ASP.NET_SessionId=QACloub12f948b017d1

(*.*)

%original file name%.exe_348_rwx_00823000_00001000:

SHELL32.dll

%original file name%.exe_348_rwx_0082C000_00005000:

MSVCRT.dll

IPHLPAPI.DLL

PSAPI.DLL

KERNEL32.dll

USER32.dll

RegDeleteKeyA

ADVAPI32.dll

RegCreateKeyExA

RegCloseKey

RegOpenKeyExA

SHELL32.dll

%original file name%.exe_348_rwx_008C1000_0009D000:

KERNEL32.dll

USER32.dll

ADVAPI32.dll

WS2_32.dll

OLEAUT32.dll

ole32.dll

GDI32.dll

SHELL32.dll

<.vz1>

WINMM.dll

WINSPOOL.DRV

COMCTL32.dll

AVIFIL32.dll

MSVFW32.dll

.Du'rk}

comdlg32.dll

/M0%F

/-p%F

/[pY%0S7

%TN_7[Udp

/=/6!`0*

=.IhY~

%original file name%.exe_348_rwx_0095F000_00002000:

GetProcessHeap

USER32.dll

SetWindowsHookExA

UnregisterHotKey

RegisterHotKey

EnumChildWindows

CreateDialogIndirectParamA

GetKeyState

GDI32.dll

UnhookWindowsHookEx

SetViewportExtEx

SetViewportOrgEx

GetViewportExtEx

%original file name%.exe_348_rwx_00E50000_0001D000:

iphlpapi.dll

AllocateAndGetTcpExTable2FromStack

AllocateAndGetTcpExTableFromStack

AllocateAndGetTcpTableFromStack

AllocateAndGetUdpExTable2FromStack

AllocateAndGetUdpExTableFromStack

AllocateAndGetUdpTableFromStack

GetExtendedTcpTable

GetExtendedUdpTable

GetOwnerModuleFromTcp6Entry

GetOwnerModuleFromTcpEntry

GetOwnerModuleFromUdp6Entry

GetOwnerModuleFromUdpEntry

GetTcpExTable2FromStack

GetTcpStatistics

GetTcpStatisticsEx

GetTcpStatsFromStack

GetTcpStatsFromStackEx

GetTcpTable

GetTcpTableFromStack

GetUdpExTable2FromStack

GetUdpStatistics

GetUdpStatisticsEx

GetUdpStatsFromStack

GetUdpStatsFromStackEx

GetUdpTable

GetUdpTableFromStack

InternalGetTcpTable

InternalGetUdpTable

InternalSetTcpEntry

SetTcpEntry

SetTcpEntryToStack

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\

\Device\NetBT_Tcpip_

%d.%d.%d.%d

\\.\Ip

TCP/IP not bound to any adapters

Cannot access adapter bindings registry key

TCP/IP is not running on this system

SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\

SYSTEM\CurrentControlSet\Services\Tcpip\Linkage

PSSSSh8

wsock32.dll

\\.\Ip6

SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\

advapi32.dll

PSSSSh

uÃ¹H

{lX-X-X-XX-XXXXXX}

DHCPCSVC.DLL

MPRAPI.dll

netman.dll

ole32.dll

PSAPI.DLL

RASAPI32.dll

ADVAPI32.dll

KERNEL32.dll

msvcrt.dll

ntdll.dll

USER32.dll

WS2_32.dll

RegOpenKeyExA

RegOpenKeyExW

RegCloseKey

GetProcessHeap

iphlpapi.pdb

MS TCP Loopback interface

1!2C2V2

\Device\Tcp6

\Device\Tcp

rundll32.exe

wininet.dll

ipnathlp.dll

ntoskrnl.exe

RPCRT4.dll

ws2_32.dll

\DEVICE\TCPIP_

svchost.exe

System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\%s\Connection

\ras\router.pbk

router.pbk

System\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces

5.1.2600.5512 (xpsp.080413-0852)

Windows

Operating System

5.1.2600.5512

Destination port unreachable.

Parallel Port

ATM Logical Port

ISO 802.5r DTR$Ext Position Locaction Report System Appletalk Remote Access Protocol#Proprietary Connectionless Protocol

IBM multi-proto channel support

Transport HDLP

%original file name%.exe_348_rwx_00F40000_000B0000:

ntdll.dll

LdrQueryImageFileExecutionOptions

NtAcceptConnectPort

NtCompactKeys

NtCompleteConnectPort

NtCompressKey

NtConnectPort

NtCreateKey

NtCreateKeyedEvent

NtCreateNamedPipeFile

NtCreatePort

NtCreateWaitablePort

NtDelayExecution

NtDeleteKey

NtDeleteValueKey

NtEnumerateKey

NtEnumerateValueKey

NtFlushKey

NtImpersonateClientOfPort

NtListenPort

NtLoadKey

NtLoadKey2

NtLockProductActivationKeys

NtLockRegistryKey

NtNotifyChangeKey

NtNotifyChangeMultipleKeys

NtOpenKey

NtOpenKeyedEvent

NtQueryInformationPort

NtQueryKey

NtQueryMultipleValueKey

NtQueryOpenSubKeys

NtQueryPortInformationProcess

NtQueryValueKey

NtRegisterThreadTerminatePort

NtReleaseKeyedEvent

NtRenameKey

NtReplaceKey

NtReplyPort

NtReplyWaitReceivePort

NtReplyWaitReceivePortEx

NtReplyWaitReplyPort

NtRequestPort

NtRequestWaitReplyPort

NtRestoreKey

NtSaveKey

NtSaveKeyEx

NtSaveMergedKeys

NtSecureConnectPort

NtSetDefaultHardErrorPort

NtSetInformationKey

NtSetThreadExecutionState

NtSetValueKey

NtUnloadKey

NtUnloadKeyEx

NtWaitForKeyedEvent

NtYieldExecution

RtlCheckRegistryKey

RtlComputeImportTableHash

RtlCreateRegistryKey

RtlEnumProcessHeaps

RtlFormatCurrentUserKeyPath

RtlGetProcessHeaps

RtlQueryProcessHeapInformation

RtlValidateProcessHeaps

RtlpNtCreateKey

RtlpNtEnumerateSubKey

RtlpNtMakeTemporaryKey

RtlpNtOpenKey

RtlpNtQueryValueKey

RtlpNtSetValueKey

ZwAcceptConnectPort

ZwCompactKeys

ZwCompleteConnectPort

ZwCompressKey

ZwConnectPort

ZwCreateKey

ZwCreateKeyedEvent

ZwCreateNamedPipeFile

ZwCreatePort

ZwCreateWaitablePort

ZwDelayExecution

ZwDeleteKey

ZwDeleteValueKey

ZwEnumerateKey

ZwEnumerateValueKey

ZwFlushKey

ZwImpersonateClientOfPort

ZwListenPort

ZwLoadKey

ZwLoadKey2

ZwLockProductActivationKeys

ZwLockRegistryKey

ZwNotifyChangeKey

ZwNotifyChangeMultipleKeys

ZwOpenKey

ZwOpenKeyedEvent

ZwQueryInformationPort

ZwQueryKey

ZwQueryMultipleValueKey

ZwQueryOpenSubKeys

ZwQueryPortInformationProcess

ZwQueryValueKey

ZwRegisterThreadTerminatePort

ZwReleaseKeyedEvent

ZwRenameKey

ZwReplaceKey

ZwReplyPort

ZwReplyWaitReceivePort

ZwReplyWaitReceivePortEx

ZwReplyWaitReplyPort

ZwRequestPort

ZwRequestWaitReplyPort

ZwRestoreKey

ZwSaveKey

ZwSaveKeyEx

ZwSaveMergedKeys

ZwSecureConnectPort

ZwSetDefaultHardErrorPort

ZwSetInformationKey

ZwSetThreadExecutionState

ZwSetValueKey

ZwUnloadKey

ZwUnloadKeyEx

ZwWaitForKeyedEvent

ZwYieldExecution

?SsHd

>SsHd

secserv.dll

.aspack

.pcle

.sforce

|BaseProcessInitPostImport

.txt2

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions

CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database

CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ

LDR: %s - failing because LdrpLoadDll(%wZ) returned status %x

LDR: %s - Exception lx thrown running initialization routines for %wZ

LDR: exception lx thrown within function %s

|_CorExeMain

Invalid flags (x) specified to RtlCreateHeap

LDR: LdrpWalkImportDescriptor() failed to probe %wZ for its manifest, ntstatus 0xlx

LDR: %s - failed to allocate dynamic array of %u DLL initializers to run

[%x,%x] LDR: Real INIT LIST for process %wZ pid %u 0x%x

[%x,%x] %wZ init routine %p

[%x,%x] LDR: %wZ loaded

[%x,%x] LDR: calling init routine %p for DLL_PROCESS_ATTACH

[%x,%x] LDR: DLL_PROCESS_ATTACH for dll "%wZ" (InitRoutine: %p) failed

LDR: %s - caught exception lx snapping thunks (#1)

LDR: %s - caught exception lx snapping thunks (#2)

LDR: TlsVector %x Index %d = %x copied from %x to %x

LDR: %s - caught exception lx calling TLS callbacks

Failed to initialize a new segment (%x)

Abandoning uncommitted range (%x for %x)

Failing creating uncommitted range (%x for %x)

NAME - %s

LDR: %s - Exception %x thrown by LdrpRunInitializeRoutines

LDR: %s - caught exception lx while checking image checksums

LDR: %s - Caught exception lx

(%d) [%ws] %ws (%lx) deinit %lx

LDR: %s - exception lx caught while sending DLL_PROCESS_DETACH

LDR: %s - Dll name missing extension; with extension added the length is too long

DllName->Length: %u

LDR: %s - Exception %x thrown by LdrpWalkImportDescriptor

LDR: Unloading %wZ due to error %x walking import descriptors

LDR: Unloading %wZ because either its init routine or one of its static imports failed; status = 0xlx

LDR: failed to load mscoree.dll, status=%x

LDR: PID: 0x%x finished - '%wZ'

LDR: %s - failing because we were unable to map the image base address (%p) to the PIMAGE_NT_HEADERS

LDR: PID: 0x%x started - '%wZ'

LDR: Stack trace database size is %u Mb

LDR: %s - unable to create process heap

LDR: %s failing process initialization due to inability to create loader private heap.

LDR: %s - failed call to NtQuerySymbolicLinkObject with status %x

LDR: %s - unable to allocate current working directory buffer

LDR: %s - failed to allocate PEB_LDR_DATA

LDR: %s - failing process initialization due to inability allocate "%wZ"'s LDR_DATA_TABLE_ENTRY

LDR: %s - failing process initialization due to inability to allocate NTDLL's LDR_DATA_TABLE_ENTRY

LDR: %s - unable to set current directory to "%wZ"; status = %x

LDR: %s - unable to set current directory to NtSystemRoot; status = %x

LDR: %s - unable to allocate heap for the image's .local path

LDR: Unable to load kernel32.dll. Status=%x

LDR: Failed to find post-import process init function in kernel32; ntstatus 0xlx

LDR: %s - call to LdrpWalkImportDescriptor failed with status %x

LDR: %s - call to LdrpSetProtection(%p, FALSE, TRUE) failed with status %x

LDR: %s - call to LdrRelocateImage failed with status %x

LDR: %s - call to LdrpSetProtection(%p, TRUE, TRUE) failed with status %x

LDR: %s - failed to initialize TLS slots; status %x

LDR: %s - Failed running kernel32 post-import function; status 0xlx

LDR: %s - Failed running initialization routines; status %x

LDR: %s - failed call to NtOpenSymbolicLinkObject with status %x

LDR: ***NONFATAL*** %s - call to NtDelayExecution waiting on loader lock failed; ntstatus = %x

LDR: %s - Call to NtQueryVirtualMemory failed with ntstaus %x

LDR: %s - call to LdrpInitializeProcess() failed with ntstatus %x

because path search required %u bytes

LDR: %s - NtOpenFile failed; status = %x

LDR: %s %wZ (%lx)

LDR: %s call to RtlComputePrivatizedDllName_U() failed with status %lx

LDR: %s calling LdrpCopyUnicodeString() failed; exiting with status %lx

LDR: %s failed calling LdrpResolveDllNameForAppPrivateRediretion with status %lx

LDR: %s failed call to LdrpCopyUnicodeString() in redirected case; status = %lx

LDR: %s - call to RtlDosSearchPath_U failed

LDR: LdrResolveDllName - Failing resolution because found path too long (%u bytes; max is %u bytes)

LDR: %s - failed to allocate string for full dll name; length requested: %u

LDR: %s - Required path length required for %ws changed from %lu to %lu; try launching the app again.

LDR: %s - failing because RtlFindCharInUnicodeString failed with status %x

LDR: %s - call back to app compat redirection function @ %p (cb data: %p) failed with status %x

LDR: %s - call to LdrpCheckForKnownDll("%ws", ...) failed with status %x

LDR: %s - call to LdrpResolveDllName on dll "%ws" failed with status %x

LDR: Loading (%s, %s) %wZ

LDR: %s - call to RtlDosPathNameToNtPathName_U on path "%wZ" failed; returning status %x

LDR: %s - LdrpCreateDllSection (%wZ) failed with status %x

LDR: %s - failed to map view of section; status = %x

LDR: %s - unable to map ViewBase (%p) to image headers; failing with status %x

LDR: %s - failed to allocate new data table entry for %p

[%x,%x] LDR: Failed to map view of section; ntstatus = %x

[%x,%x] LDR: %s - NtMapViewOfSection on no reloc needed dll failed with status %x

LdrpLoadImportModule

LDR: %s - RtlDosApplyFileIsolationRedirection_Ustr failed with status %x

LDR: %s - LdrpMapDll(%p, %ls, NULL, TRUE, %d, %p) failed with status %x

LDR: %s - LdrpWalkImportDescriptor [dll %ls] failed with status %x

LDR: %wZ bound to %s

LDR: %wZ failed to load import module %s; status = %x

LDR: %wZ has correct binding to %s

LDR: %wZ has stale binding to %s

LDR: %wZ bound to %s via forwarder(s) from %wZ

LDR: LdrpWalkImportTable - failing with STATUS_OBJECT_NAME_INVALID due to no import descriptor name

LDR: Stale Bind %s from %wZ

LDR: LdrpWalkImportTable - LdrpSnapIAT failed with status %x

LDR: %s used by %wZ

LDR: LdrpWalkImportTable - LdrpLoadImportModule failed on import %s with status %x

LDR: Snapping imports for %wZ from %s

LDR: LdrpWalkImportTable - LdrpSnapIAT #2 failed with status %x

Execute '.cxr %p' to dump context

RTL: Acquire Shared Sem Timeout %d(%I64u secs)

RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)

RTL: Convert Exclusive Sem Timeout %d (%I64u secs)

RTL: Enter Critical Section Timeout (%I64u secs) %d

RTL: Pid.Tid %x.%x, owner tid %x Critical Section %p - ContentionCount == %lu

SXS: %s() passed the empty activation context data

SXS: %s() called with invalid flags 0xlx

SXS: %s() called with invalid cookie type 0xI64x

SXS: %s() called with invalid cookie tid 0xI64x - should be lx

SXS: %s() Active frame is not the frame being deactivated %p != %p

SXS/RTL: Extended TOC section TOC %d (offset: %ld, size: %u) is outside activation context data bounds (%lu bytes)

SXS/RTL: Extended TOC entry array (starting at offset %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)

SXS/RTL: TOC entry array (offset: %ld; count = %lu; entry size = %u) is outside bounds of activation context data (%lu bytes)

SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0xlx.

SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0xlx.

RtlpFindUnicodeStringInSection: Unsupported hash algorithm %lu found in string section.

SXS: String hash table entry at %p has invalid key offset (= %ld)

8SsHdu

SXS: %s() received invalid non-zero sub-instance index %lu

SXS: %s() found activation context data at %p with assembly roster that has no root

SXS: %s() - Caller passed invalid flags (0xlx)

SXS: %s() - Caller passed meaningless flags/class combination (0xlx/0xlx)

SXS: %s() - caller asked for unknown information class %lu

SXS: %s() - caller passed nonzero buffer length but NULL buffer pointer

SXS: %s() - caller supplied no buffer to populate and no place to return required byte count

SXS: %s() - Caller asked to use activation context from address in .dll but passed NULL

SXS: %s() - Caller passed invalid address, not in any .dll (%p)

SXS: %s() - Caller asked to use activation context from hmodule but passed NULL

SXS: %s() - Caller passed invalid hmodule (%p)

SXS: %s() - caller asked to use active activation context but passed %p

SXS: %s() - internal coding error; missing switch statement branch for InfoClass == %lu

SXS: Unable to expand %%SystemRoot%%\WinSxS\ Status = 0x08lx

SXS: Unable to enumerate assembly storage subkey #%lu Status = 0xlx

SXS: Attempt to get storage location from subkey %wZ failed; Status = 0xlx

SXS: Unable to open registry key %wZ Status = 0xlx

SXS: %s() bad parameters:

SXS: %s() bad parameters

SXS: StorageLocation->Length: 0x%x

SXS: Assembly storage resolution failing probe because attempt to allocate %u bytes failed.

SXS: Attempt to translate DOS path name "%S" to NT format failed

SXS: Unable to open assembly directory under storage root "%S"; Status = 0xlx

SXS: %s() passed the empty activation context

SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx

d:\xpsp\base\ntdll\sxsisol.cpp

rUS.Length PrivatePreallocatedString->MaximumLength

[%x.%x] SXS: %s - Relative redirection plus env var expansion.

!(askd.Flags & ACTIVATION_CONTEXT_SECTION_KEYED_DATA_FLAG_FOUND_IN_SYSTEM_DEFAULT)

%s: %s() failed 0x%lx

%s: OldBase : %p

%s: NewBase : %p

%s: Diff : 0x%I64x

%s: NextOffset : %p

%s: *NextOffset : 0x%x

%s: SizeOfBlock : 0x%lx

Heap missing last entry in committed range near %x

RTL: Expand variables for %wZ failed - Status == %lx Size %x > %x

RtlpCallQueryRegistryRoutine: skipping expansion. Status=%x RequiredLength=%x

RtlpCallQueryRegistryRoutine: skipping environment expansion. ValueLength=%x

RtlQueryRegistryValues: Miscomputed buffer size at line %d

Invalid heap signature for heap at %x

, passed to %s

Unable to release memory at %p for %p bytes - Status == %x

ProcessHeapsListIndex

i9\\.\WMIDataDevice

Set 0x%X protection for %p section for %d bytes, old protection 0x%X

CLIENT(ntdll): Tyring to fix protection for %ws section in %wZ module to 0x%X

LDR: %s - exception lx caught while copying %u bytes from %p to %p

Last checkpoint: %s line %d

NTDLL: Calling thread (%X) not owner of CritSect: %p Owner ThreadId: %X

AVRF: chain: thunk: %s == %s ?

AVRF: Found duplicate for (%ws: %s) in %ws

AVRF: Checking %ws for duplicate (%ws: %s)

AVRF: Chaining (%ws: %s) to %ws

AVRF: Unable to unprotect IAT to modify thunks (status X).

AVRF:SilviuC: New thunk for %s is null.

AVRF: Snapped (%ws: %s) with (%ws: %p).

AVRF: found verified export %s @ %p

AVRF: failed to enable handle checking (status %X)

VERIFIER INTERNAL ERROR %p: pid 0x%X: %s

%p : %s

VERIFIER INTERNAL WARNING %p: pid 0x%X: %s

VERIFIER STOP %p: pid 0x%X: %s

Page heap: found %s @ address %p

Page heap: detected CRT heap @ %p

AVRF: %ws: failed to load provider `%ws' (status X) from %ws

AVRF: provider %ws passed an invalid descriptor @ %p

AVRF: pid 0x%X: found dll descriptor for `%ws' with verified exports

Snapped (%ws) operator new ...

Snapped (%ws) operator delete ...

Snapped (%ws) operator new[] ...

Snapped (%ws) operator delete[] ...

AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled

AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.

SsHd;

SXS: %s() passed string section at %p only %lu bytes long; that's not even enough for the 4-byte magic and 4-byte header length!

SXS: %s() found assembly information section with wrong magic value

SXS: %s() passed string section at %p claims %lu byte header size; that doesn't even include the HeaderSize member!

SXS: %s() passed string section at %p with too small of a header

SXS: %s() found assembly information section with element list overlapping section header

SXS: %s() found assembly information section with search structure overlapping section header

SXS: %s() found assembly information section with user data overlapping section header

SXS: %s() found assembly information section with user data too small

SXS: %s() found assembly information section with user data extending beyond section data

SXS: %s() received invalid sub-instance index %lu out of %lu Assemblies in the Acitvation Context

SXS: %s() received invalid file index (%d) in Assembly (%d)

|SXS: Unable to open storage root subkey %wZ; Status = 0xlx

SXS: Unabel to query location from storage root subkey %wZ; Status = 0xlx

*** Assertion failed: %s%s

*** %s%s%sSource File: %s, line %ld

VirtualQuery Failed 0xx %x

VirtualProtect Failed 0xx %x

::%hs%u.%u.%u.%u

::ffff:0:%u.%u.%u.%u

:%u.%u.%u.%u

%u.%u.%u.%u

>%u}F

Trace database: failing attempt to save biiiiig trace (size %u)

*** Unhandled exception 0xlx, hit in %ws:%s

*** A stack buffer overrun occurred in %ws:%s

The stack trace should show the guilty function (the function directly above __report_gsfailure).

*** Resource timeout (%p) in %ws:%s

The resource is owned exclusively by thread %x

The resource is owned shared by %d threads

*** Critical Section Timeout (%p) in %ws:%s

The critical section is owned by thread %x.

*** Inpage error in %ws:%s

This failed because of error %x.

This means that the I/O device reported an I/O error. Check your hardware.

*** An Access Violation occurred in %ws:%s

The instruction at %p tried to %s

*** enter .exr %p for the exception record

*** enter .cxr %p for the context

*** Restarting wait on critsec or resource at %p (in %ws:%s)

.hotp1

I64X: VA64 6I64X -> 6I64X %s

I64X: PC32 X -> X (target X) %s

I64X: VA32 X -> X %s

None%s

Validation failed for global range %u of %u

I64X: jmp X (PC X) {

Inserting %u hooks into target image

Header too large (%u>%u) for copy/normalize/validate

PAGE_EXECUTE

0xX

PAGE_EXECUTE_WRITECOPY

PAGE_EXECUTE_READWRITE

PAGE_EXECUTE_READ

Page heap: Failed changing VM at X size 0x%X

from %s to %s (Status X)

Exception record (.exr on 1st word, .cxr on 2nd word)

Page heap: pid 0x%X: vm limit: vspace: disabling full page heap

Page heap: pid 0x%X: vm limit: pfile: disabling full page heap

Page heap: pid 0x%X: vm limit: reenabling full page heap

Page heap: enabling fault injection for process 0x%X

Page heap: assert: (SystemInfo.PageSize == PAGE_SIZE)

Page heap: assert: (SystemInfo.AllocationGranularity == VM_UNIT_SIZE)

HEAP %p (Seg %p) At %p Error: %s

Heap %x - headers modified (%x is %x instead of %x)

This is located in the %s field of the heap header.

Heap block at %p is not last block in segment (%x)

Heap Segment at %p contains invalid NumberOfUnCommittedPages (%x != %x)

Heap entry %p is beyond uncommited range [%x .. %x)

Heap entry %p has incorrect PreviousSize field (x instead of x)

Heap block at %p has incorrect segment index (%x)

Heap block at %p does not match address of next uncommitted address (%x)

Heap Segment at %p contains invalid NumberOfUnCommittedRanges (%x != %x)

Invalid Address specified to %s( %p, %p )

dedicated (x) free list empty but marked as non-empty

dedicated (x) free list non-empty but marked as empty

dedicated (x) free list element %p is marked busy

Dedicated (x) free list element %p is wrong size (x)

Non-Dedicated free list element %p with too small size (x)

Pseudo Tag x size incorrect (%x != %x) %x

Tag x (%ws) size incorrect (%x != %x) %x

May not destroy the process heap at %x

Just allocated block at %p for 0x%x bytes

Just allocated block at %p for 0x%x bytes with tag %ws

Invalid allocation size - %p (exceeded %x)

About to reallocate block at %p to 0x%x bytes

About to rellocate block at %p to 0x%x bytes with tag %ws

Just reallocated block at %p to 0x%x bytes

Just reallocated block at %p to 0x%x bytes with tag %ws

ntdll.pdb

: :$:(:,:

2-3}6

:&: :6:?:

3 3(3.343]3

5_5P5

2#3 3;3^3|3

1(1/161@1

5 5$505?6

&0\00181

\\.\CON

{lx-x-x-xx-xxxxxx}

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\

kernel32.dll

user32.dll

.Local\

%SystemRoot%\WinSxS\

\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots

.Local

ApiPort

!CSRPORT

CSRPORT!

\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

\Registry\User\.Default

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion

\bootstat.dat

\system32\mscoree.dll

mscoree.dll

DebugProcessHeapOnly

\WindowsSS

%%%u!%s!

\\?\UNC\

\\?\UNC

ADVAPI32.DLL

"/\[]:| =;,?*

Objects>%4u

Objects=%4u

verifier.dll

msvcrt.dll

ole32.dll

Software\Microsoft\Windows\CurrentVersion

\system32\kernel32.dll

%s_%d

lX-X-X-XX-XXXXXX

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards

%ws\%u

\Registry\Machine\Hardware\DeviceMap\Scsi\Scsi Port %d\Scsi Bus %d\Target ID %d\Logical Unit Id %d

\Device\Harddisk%d\Partition0

5.1.2600.5512 (xpsp.080413-2111)

Windows

Operating System

5.1.2600.5512

The operation that was requested is pending completion.

An open/create operation completed while an oplock break is underway.

{Connect Failure on Primary Transport}

An attempt was made to connect to the remote server %hs on the primary transport, but the connection failed.

The computer WAS able to connect on a secondary transport.

Cached page was locked during operation.

An operation is blocked waiting for an oplock.

{Local Session Key}

A user session key was requested for a local RPC connection. The session key returned is a constant value and not unique to this connection.

A serial I/O operation was completed by another write to a serial port.

A serial I/O operation completed because the time-out period expired.

{Password Too Complex}

The Windows password is too complex to be converted to a LAN Manager password.

The LAN Manager password returned is a NULL string.

The network transport returned partial data to its client. The remaining data will be sent later.

The network transport returned data to its client that was marked as expedited by the remote system.

The network transport returned partial data to its client and this data was marked as expedited by the remote system. The remaining data will be sent later.

The specified registry key is referenced by a predefined handle.

A yield execution was performed and no thread was available to run.

The operating system will currently accept only 16-bit (R2) pc-cards on this controller.

The CPUs in this multiprocessor system are not all the same revision level. To use all processors the operating system restricts itself to the features of the least capable processor in the system. Should problems occur with this system, contact

the CPU manufacturer to see if this mix of processors is supported.

A single step or trace operation has just been completed.

Handles to objects have been automatically closed as a result of the requested operation.

During the translation of a global identifier (GUID) to a Windows security ID (SID), no administratively-defined GUID prefix was found.

The media has changed and a verify operation is in progress so no reads or writes may be performed to the device, except those used in the verify operation.

No more entries are available from an enumeration operation.

A long jump has been executed.

The Plug and Play query operation was not successful.

A frame consolidation has been executed.

The device has indicated that it's door is open. Further operations require it closed and secured.

{Operation Failed}

The requested operation was unsuccessful.

The requested operation is not implemented.

The instruction at "0xlx" referenced memory at "0xlx". The memory could not be "%s".

An invalid parameter was passed to a service or function.

The specified request is not a valid operation for the target device.

The specified I/O request packet (IRP) cannot be disposed of because the I/O operation is not complete.

Not enough virtual memory or paging file quota is available to complete the specified operation.

An attempt was made to execute an illegal instruction.

An attempt was made to execute an invalid lock sequence.

There is a mismatch between the type of object required by the requested operation and the type of object that is specified in the request.

Windows cannot continue from this exception.

An invalid or unaligned stack was encountered during an unwind operation.

An invalid unwind target was encountered during an unwind operation.

Device parity error on I/O operation.

Invalid Object Attributes specified to NtCreatePort or invalid Port Attributes specified to NtConnectPort

Length of message passed to NtRequestPort or NtRequestWaitReplyPort was longer than the maximum message allowed by the port.

Attempt to send a message to a disconnected communication port.

The NtConnectPort request is refused.

The type of port handle is invalid for the operation requested.

Insufficient quota exists to complete the operation

An attempt to set a processes DebugPort or ExceptionPort was made, but a port already exists in the process.

An operation involving EAs failed because the file system does not support EAs.

An EA operation failed because EA set is too large.

An EA operation failed because the name or EA index is invalid.

A non close operation has been requested of a file object with a delete pending.

An attempt was made to set the control attribute on a file. This attribute is not supported in the target file system.

An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client.

Indicates the requested operation would disable or delete the last remaining administration account.

When trying to update a password, this return status indicates that the value provided as the current password is not correct.

When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords.

When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria.

The user account's password has expired.

The application or DLL %hs is not a valid Windows image. Please check this against your installation diskette.

An operation failed because the disk was full.

Floating-point denormal operand.

Floating-point invalid operation.

An attempt was made to install more paging files than the system supports.

An attempt was made to execute an instruction at an unaligned address and the host system does not support unaligned instruction references.

The maximum named pipe instance count has been reached.

An instance of a named pipe cannot be found in the listening state.

The named pipe is not in the connected or closing state.

The specified pipe is set to complete operations and there are current I/O operations queued so it cannot be changed to queue operations.

The specified handle is not open to the server end of the named pipe.

The specified named pipe is in the disconnected state.

The specified named pipe is in the closing state.

The specified named pipe is in the connected state.

The specified named pipe is in the listening state.

The specified named pipe is not in message mode.

The specified I/O operation on %hs was not completed before the time-out period expired.

The passed ACL did not contain the minimum required information.

The request is not supported.

Indicates an attempt was made to operate on the security of an object that does not have security associated with it.

Used to indicate that an operation cannot continue without blocking for I/O.

Used to indicate that a read operation was done on an empty pipe.

Indicates the Sam Server was in the wrong state to perform the desired operation.

Indicates the Domain was in the wrong state to perform the desired operation.

This operation is only allowed for the Primary Domain Controller of the domain.

This error indicates that the requested operation cannot be completed due to a catastrophic media failure or on-disk data structure corruption.

An invalid parameter was passed to a service or function as the first argument.

An invalid parameter was passed to a service or function as the second argument.

An invalid parameter was passed to a service or function as the third argument.

An invalid parameter was passed to a service or function as the fourth argument.

An invalid parameter was passed to a service or function as the fifth argument.

An invalid parameter was passed to a service or function as the sixth argument.

An invalid parameter was passed to a service or function as the seventh argument.

An invalid parameter was passed to a service or function as the eighth argument.

An invalid parameter was passed to a service or function as the ninth argument.

An invalid parameter was passed to a service or function as the tenth argument.

An invalid parameter was passed to a service or function as the eleventh argument.

An invalid parameter was passed to a service or function as the twelfth argument.

A malformed function table was encountered during an unwind operation.

The logon session is not in a state that is consistent with the requested operation.

Indicates that an attempt has been made to impersonate via a named pipe that has not yet been read from.

Indicates that the transaction state of a registry sub-tree is incompatible with the requested operation.

This error should only be returned by the Windows redirector on a remote drive.

Indicates an operation has been attempted on a built-in (special) SAM account which is incompatible with built-in accounts.

The operation requested may not be performed on the specified group because it is a built-in special group.

The operation requested may not be performed on the specified user because it is a built-in special user.

An I/O request other than close and several other special case operations was attempted using a file object that had already been closed.

An attempt was made to operate on a thread within a specific process, but the thread specified is not in the process specified.

Your system is low on virtual memory. To ensure that Windows runs properly, increase the size of your virtual memory paging file. For more information, see Help.

The specified image file did not have the correct format, it appears to be a 16-bit Windows image.

The SAM database on a Windows Server is significantly out of synchronization with the copy on the Domain Controller. A complete synchronization is required.

The NtCreateFile API failed. This error should never be returned to an application, it is a place holder for the Windows Lan Manager Redirector to use in its internal error mapping routines.

The network transport on your computer has closed a network connection. There may or may not be I/O requests outstanding.

The network transport on a remote computer has closed a network connection. There may or may not be I/O requests outstanding.

The network transport on your computer has closed a network connection because it had to wait too long for a response from the remote computer.

The connection handle given to the transport was invalid.

The address handle given to the transport was invalid.

The exception %s (0xlx) occurred in the application at location 0xlx.

An invalid level was passed into the specified system call.

{Incorrect Password to LAN Manager Server}

You specified an incorrect password to a LAN Manager 2.x or MS-NET server.

The pipe operation has failed because the other end of the pipe has been closed.

An I/O operation initiated by the Registry failed unrecoverably.

An event pair synchronization operation was performed using the thread specific client/server event pair object, but no event pair object was associated with the thread.

The maximum number of secrets that may be stored in a single system has been exceeded. The length and number of secrets is limited to satisfy United States State Department export restrictions.

The length of a secret exceeds the maximum length allowed. The length and number of secrets is limited to satisfy United States State Department export restrictions.

The requested operation cannot be performed in fullscreen mode.

An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password.

A Windows Server has an incorrect configuration.

The floppy disk controller reported an error that is not recognized by the floppy disk driver.

While accessing the hard disk, a recalibrate operation failed, even after retries.

While accessing the hard disk, a disk operation failed even after retries.

Two concurrent opens of devices that share an IRQ and only work via interrupts is not supported for the particular bus type that the devices use.

Illegal operation attempted on a registry key which has been marked for deletion.

An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password.

An attempt was made to create a symbolic link in a registry key that already has subkeys or values.

An attempt was made to create a Stable subkey under a Volatile parent key.

The I/O device reported an I/O error.

Log file space is insufficient to support this operation.

A write operation was attempted to a volume after it was dismounted.

The SAM database on the Windows Server does not have a computer account for this workstation trust relationship.

There is no user session key for the specified logon session.

The size of the buffer is invalid for the specified operation.

The transport rejected the network address specified as invalid.

The transport rejected the network address specified due to an invalid use of a wildcard.

The transport address could not be opened because all the available addresses are in use.

The transport address could not be opened because it already exists.

The transport address is now closed.

The transport connection is now disconnected.

The transport connection has been reset.

The transport cannot dynamically acquire any more nodes.

The transport aborted a pending transaction.

The transport timed out a request waiting for a response.

The transport did not receive a release for a pending response.

The transport did not find a transaction matching the specific

The transport had previously responded to a transaction request.

The transport does not recognized the transaction request identifier specified.

The transport does not recognize the transaction request type specified.

The transport can only process the specified request on the server side of a session.

The transport can only process the specified request on the client side of a session.

The %hs system process terminated unexpectedly with a status of 0xx (0xx 0xx).

Windows was unable to save all the data for the file %hs. The data has been lost.

The parameter(s) passed to the server in the client/server shared memory window were invalid. Too much data may have been put in the shared memory window.

The user's password must be changed before logging on the first time.

Internal OFS status codes indicating how an allocation operation is handled. Either it is retried after the containing onode is moved or the extent stream is converted to a large stream.

The attempt to find the object found an object matching by ID on the volume but it is out of the scope of the handle used for the operation.

The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested.

The transport connection attempt was refused by the remote system.

The transport connection was gracefully closed.

The transport endpoint already has an address associated with it.

An address has not yet been associated with the transport endpoint.

An operation was attempted on a nonexistent transport connection.

An invalid operation was attempted on an active transport connection.

The remote network is not reachable by the transport.

The remote system is not reachable by the transport.

The remote system does not support the transport protocol.

No service is operating at the destination port of the transport on the remote system.

The transport connection was aborted by the local system.

The requested operation cannot be performed on a file with a user mapped section open.

Attempting to login during an unauthorized time of day for this account.

The account is not authorized to login from this station.

The entrypoint should be declared as WINAPI or STDCALL. Select YES to fail the DLL load. Select NO to continue execution. Selecting NO may cause the application to operate incorrectly.

The callback entrypoint should be declared as WINAPI or STDCALL. Selecting OK will cause the service to continue operation. However, the service process may operate incorrectly.

The contacted server does not support the indicated part of the DFS namespace.

A callback return system service cannot be executed when no callback is active.

The password provided is too short to meet the policy of your user account.

Please choose a longer password.

The policy of your user account does not allow you to change passwords too frequently.

This is done to prevent users from changing back to a familiar, but potentially discovered, password.

If you feel your password has been compromised then please contact your administrator immediately to have a new one assigned.

You have attempted to change your password to one that you have used in the past.

The policy of your user account does not allow this. Please select a password that you have not previously used.

The specified compression format is unsupported.

An attempt was made to create more links on a file than the file system supports.

{Windows Evaluation Notification}

The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, please upgrade this installation using a licensed distribution of this product.

The relocation occurred because the DLL %hs occupied an address range reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL.

Error Status was 0x%x

An operation was attempted to a volume after it was dismounted.

There was no match for the specified key in the index.

The Windows I/O reparse tag passed for the NTFS reparse point is invalid.

The Windows I/O reparse tag does not match the one present in the NTFS reparse point.

The user data passed for the NTFS reparse point is invalid.

There are no EFS keys defined for the user.

The specified file is not in the defined EFS export format.

The guid passed was not recognized as valid by a WMI data provider.

The instance name passed was not recognized as valid by a WMI data provider.

The data item id passed was not recognized as valid by a WMI data provider.

The remote storage service is not operational at this time.

The requested operation could not be performed because the directory service is not the master for that type of operation.

The requested operation did not satisfy one or more constraints associated with the class of the object.

The directory service can perform the requested operation only on a leaf object.

The directory service cannot perform the requested operation on the Relatively Defined Name (RDN) attribute of an object.

An error occurred while performing a cross domain move operation.

The requested operation requires a directory service, and none was available.

The requested interface is not supported.

The driver %hs does not support standby mode. Updating this driver may allow the system to go to standby mode.

Mutual Authentication failed. The server's password is out of date at the domain controller.

Your system is low on virtual memory. Windows is increasing the size of your virtual memory paging file.

The medium changer's transport element contains media, which is causing the operation to fail.

Error Status: 0x%x.

This operation is supported only when you are connected to the server.

The system image %s is not properly signed.

Current device power state cannot support this request.

The WMI operation is not supported by the data block or method.

There is not enough power to complete the requested operation.

Security Account Manager needs to get the boot password.

Security Account Manager needs to get the boot key from floppy disk.

The requested operation can be performed only on a global catalog server.

Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased.

This operation can not be performed on the current domain.

The other end of the security negotiation is requires strong crypto but it is not supported on the local machine.

The client cert name does not matches the user name or the KDC name is incorrect.

The encryption type requested is not supported by the KDC.

This operation is not supported on a Microsoft Small Business Server

The Master File Table on the volume is too fragmented to complete this operation.

Copy protection error - The given sector does not contain a valid key.

Copy protection error - DVD session key not established.

The kerberos protocol encountered an error while validating the KDC certificate during smartcard Logon

The transport determined that the remote system is down.

An unsupported preauthentication mechanism was presented to the kerberos package.

The encryption algorithm used on the source file needs a bigger key buffer than the one used on the destination file.

An attempt to remove a processes DebugPort was made, but a port was not already associated with the process.

An attempt to do an operation on a debug port failed because the port is in the process of being deleted.

This version of Windows is not compatible with the behavior version of directory forest, domain or domain controller.

The specified image file did not have the correct format, it appears to be a 32-bit Windows image.

The specified image file did not have the correct format, it appears to be a 64-bit Windows image.

The SID filtering operation removed all SIDs.

The create operation failed because the name contained at least one mount point which resolves to a volume to which the specified device object is not attached.

A dynamic link library (DLL) referenced a module that was neither a DLL nor the process's executable image.

The requested key container does not exist on the smart card

The requested certificate does not exist on the smart card

The requested keyset does not exist

The smartcard certificate used for authentication has been revoked.

An untrusted certificate authority was detected While processing the

smartcard certificate used for authentication. Please contact your system

The revocation status of the smartcard certificate used for

The smartcard certificate used for authentication was not trusted. Please

The smartcard certificate used for authentication has expired. Please

The RPC protocol sequence is not supported.

Not enough resources are available to complete this operation.

The RPC server is too busy to complete this operation.

The remote procedure call failed and did not execute.

The transfer syntax is not supported by the RPC server.

The type UUID is not supported.

The name syntax is not supported.

The operation cannot be performed.

No interfaces have been exported.

There is nothing to unexport.

The requested operation is not supported.

A floating point operation at the RPC server caused a divide by zero.

The requested authentication level is not supported.

The error specified is not a valid Windows RPC error code.

Invalid asynchronous RPC call handle for this operation.

A null context handle is passed as an [in] parameter.

The binding handles passed to a remote procedure call do not match.

A null reference pointer was passed to the stub.

Invalid operation on the encoding/decoding handle.

The RPC pipe object is invalid or corrupted.

An invalid operation was attempted on an RPC pipe object.

Unsupported RPC pipe version.

The RPC pipe object has already been closed.

The RPC call completed before all pipes were processed.

No more data is available from the RPC pipe.

A close operation is pending on the Terminal Connection.

The MODEM.INF file was not found.

The modem (%1) was not found in MODEM.INF.

Transport driver error

The requested operation cannot be completed because the Terminal Connection is currently busy processing a connect, disconnect, reset, or delete operation.

An attempt has been made to connect to a session whose video mode is not supported by the current client.

DOS graphics mode is not supported.

The requested operation can be performed only on the system console.

Disconnecting the console session is not supported.

Reconnecting a disconnected session to the console is not supported.

The remote control of the console was terminated because the display mode was changed. Changing the display mode in a remote control session is not supported.

A node is in the process of joining the cluster.

A cluster join operation is not in progress.

Windows was not able to process the application binding information.

The requested lookup key was not found in any active activation context.

Lack of system resources has required isolated activation to be disabled for the current thread of execution.

The activation context being deactivated is not active for the current thread of execution.

%original file name%.exe_348_rwx_00FF0000_00092000:

ImmProcessKey

USER32.dll

ActivateKeyboardLayout

ArrangeIconicWindows

CallMsgFilter

CallMsgFilterA

CallMsgFilterW

CascadeChildWindows

CascadeWindows

CliImmSetHotKey

CloseWindowStation

CreateDialogIndirectParamA

CreateDialogIndirectParamAorW

CreateDialogIndirectParamW

CreateWindowStationA

CreateWindowStationW

DisableProcessWindowsGhosting

DisplayExitWindowsWarnings

EnumChildWindows

EnumDesktopWindows

EnumThreadWindows

EnumWindowStationsA

EnumWindowStationsW

EnumWindows

ExitWindowsEx

GetAsyncKeyState

GetKeyNameTextA

GetKeyNameTextW

GetKeyState

GetKeyboardLayout

GetKeyboardLayoutList

GetKeyboardLayoutNameA

GetKeyboardLayoutNameW

GetKeyboardState

GetKeyboardType

GetProcessWindowStation

LoadKeyboardLayoutA

LoadKeyboardLayoutEx

LoadKeyboardLayoutW

LockWindowStation

MapVirtualKeyA

MapVirtualKeyExA

MapVirtualKeyExW

MapVirtualKeyW

MsgWaitForMultipleObjects

MsgWaitForMultipleObjectsEx

OemKeyScan

OpenWindowStationA

OpenWindowStationW

RegisterHotKey

SetConsoleReserveKeys

SetKeyboardState

SetProcessWindowStation

SetWindowStationUser

SetWindowsHookA

SetWindowsHookExA

SetWindowsHookExW

SetWindowsHookW

TileChildWindows

TileWindows

UnhookWindowsHook

UnhookWindowsHookEx

UnloadKeyboardLayout

UnlockWindowStation

UnregisterHotKey

VkKeyScanA

VkKeyScanExA

VkKeyScanExW

VkKeyScanW

WINNLSGetIMEHotkey

keybd_event

=.cmd

=.pif

=.lnk

=.com

=.bat

F\ FTP

s.RPRP

tcPV

*9]0t#SSh

u.KKt*

~,SSSh

SSSSh

SSSh$6A~P

6SSSSh

t>SSh`

u"SSh`

ADVAPI32.dll

MSIMG32.dll

POWRPROF.dll

WINSTA.dll

RegCreateKeyExW

RegCloseKey

RegDeleteKeyW

ReportEventW

RegQueryInfoKeyW

GDI32.dll

KERNEL32.dll

ntdll.dll

GetViewportOrgEx

SetViewportOrgEx

GetViewportExtEx

GetCPInfo

GetSystemWindowsDirectoryW

NtQueryKey

NtEnumerateValueKey

NtYieldExecution

NtCreateKey

NtSetValueKey

NtDeleteValueKey

NtEnumerateKey

NtOpenKey

NtQueryValueKey

user32.pdb

windows.hlp

cOXY/P.Z0.0.QR00/ZPP0000000/0PPZR.BI@/DE0,

$$$006666

&$%Uooqkezs

['$$#%&(4

0 00@0[0

0V0

9Å“9S9|9

;";&;*;.;2;6;:;

8$8-858E8L8S8Z8a8h8o8v8}8

;(;7;>;};

2$3 363@3

7 8$8(8,8|8

IMM32.DLL

SETUPAPI.DLL

&%d %ws

Control Panel\Input Method\Hot Keys

Virtual Key

Key Modifiers

kbdus.dll

\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\

$winnt$.inf

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Font Drivers

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Fonts

Keyboard Layout\Preload

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\LastFontSweep

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\Type 1 Fonts

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\Upgraded Type1

keyboardlayout.ini

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Type 1 Installer\LastType1Sweep

\Windows\WindowStations

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows

\Windows

Keyboard Layout

kbdkor.dll

kbdjpn.dll

\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout

imm32.dll

Hot Keys

00000409

x:\...\

OLE32.DLL

%SystemRoot%\System32\user32.dll

Software\Microsoft\Windows\CurrentVersion\Reliability

hh.exe

indicdll.dll

\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout\

IgnoreRemoteKeyboardLayout

\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\Reliability

\snapshot.dll

Windows XP USER API Client DLL

5.1.2600.5512 (xpsp.080413-2105)

Windows

Operating System

5.1.2600.5512

Error Instrument: ProcessName: %1 WindowTitle: %2 MsgCaption: %3 MsgText: %4 CallerModuleName: %5 BaseAddr: %6 ImageSize: %7 ReturnAddr: %8

Zero width &joiner

Zero width &non-joiner

&More Windows...gInsufficient memory to create the bitmap. Close one or more applications to increase available memory.

Op&en Soft Keyboard

Close So&ft Keyboard

Windows

Other people are logged on to this remote computer. Shutting down Windows might cause them to lose data. Also, someone at the remote location will have to restart the computer manually.

Other people are logged on to this computer. Shutting down Windows might cause them to lose data.

Other people are logged on to this computer. Restarting Windows might cause them to lose data.

Hardware: Maintenance (Planned)"Hardware: Installation (Unplanned) Hardware: Installation (Planned)%Operating System: Upgrade (Unplanned)#Operating System: Upgrade (Planned)

-Operating System: Reconfiguration (Unplanned) Operating System: Reconfiguration (Planned)

8A restart or shutdown to service hardware on the system.AA restart or shutdown to begin or complete hardware installation.6A restart or shutdown to upgrade the operating system.CA restart or shutdown to change the operating system configuration.BA restart or shutdown to troubleshoot an unresponsive application.>A restart or shutdown to troubleshoot an unstable application.0A restart or shutdown to service an application. A shutdown or restart for an unknown reason1The computer displayed a blue screen crash event.

The system became unresponsive.GA restart or shutdown to perform planned maintenance on an application.

%original file name%.exe_348_rwx_010F0000_000F7000:

KERNEL32.dll

BaseCleanupAppcompatCacheSupport

BaseInitAppcompatCacheSupport

BaseProcessInitPostImport

CallNamedPipeA

CallNamedPipeW

CmdBatNotification

ConnectNamedPipe

CreateIoCompletionPort

CreateNamedPipeA

CreateNamedPipeW

CreatePipe

DisconnectNamedPipe

GetCPFileNameFromRegistry

GetCPInfo

GetCPInfoExA

GetCPInfoExW

GetConsoleAliasExesA

GetConsoleAliasExesLengthA

GetConsoleAliasExesLengthW

GetConsoleAliasExesW

GetConsoleInputExeNameA

GetConsoleInputExeNameW

GetConsoleKeyboardLayoutNameA

GetConsoleKeyboardLayoutNameW

GetConsoleOutputCP

GetDefaultSortkeySize

GetLargestConsoleWindowSize

GetNamedPipeHandleStateA

GetNamedPipeHandleStateW

GetNamedPipeInfo

GetProcessHandleCount

GetProcessHeap

GetProcessHeaps

GetProcessShutdownParameters

GetSystemWindowsDirectoryA

GetSystemWindowsDirectoryW

GetWindowsDirectoryA

GetWindowsDirectoryW

PeekNamedPipe

RegisterWowExec

SetCPGlobal

SetConsoleInputExeNameA

SetConsoleInputExeNameW

SetConsoleKeyShortcuts

SetConsoleMaximumWindowSize

SetConsoleOutputCP

SetNamedPipeHandleState

SetProcessShutdownParameters

SetThreadExecutionState

TransactNamedPipe

VDMConsoleOperation

VDMOperationStarted

WaitNamedPipeA

WaitNamedPipeW

WinExec

NTDLL.RtlAddVectoredExceptionHandler

NTDLL.RtlDecodePointer

NTDLL.RtlDecodeSystemPointer

NTDLL.RtlDeleteCriticalSection

NTDLL.RtlEncodePointer

NTDLL.RtlEncodeSystemPointer

NTDLL.RtlEnterCriticalSection

NTDLL.RtlGetLastWin32Error

NTDLL.RtlAllocateHeap

NTDLL.RtlFreeHeap

NTDLL.RtlReAllocateHeap

NTDLL.RtlSizeHeap

NTDLL.RtlInitializeSListHead

NTDLL.RtlInterlockedFlushSList

NTDLL.RtlInterlockedPopEntrySList

NTDLL.RtlInterlockedPushEntrySList

NTDLL.RtlLeaveCriticalSection

NTDLL.RtlQueryDepthSList

NTDLL.RtlRemoveVectoredExceptionHandler

NTDLL.RtlRestoreLastWin32Error

NTDLL.RtlCaptureContext

NTDLL.RtlCaptureStackBackTrace

NTDLL.RtlFillMemory

NTDLL.RtlMoveMemory

NTDLL.RtlUnwind

NTDLL.RtlZeroMemory

NTDLL.RtlSetCriticalSectionSpinCount

NTDLL.RtlSetLastWin32Error

NTDLL.RtlTryEnterCriticalSection

NTDLL.VerSetConditionMask

DirOperationControl

UrlCanonicalizeW

SHDeleteKeyW

PathCreateFromUrlW

SetProcessWindowStation

OpenWindowStationA

GetProcessWindowStation

EnumDesktopWindows

CloseWindowStation

twain_32.dll

Jt.HH;

midiOutShortMsg

SXS: %s() LdrFindOutOfProcessResource failed; nt status = lx

advapi32.dll

ReportEventW

RegSaveKeyW

RegSaveKeyExW

RegSaveKeyA

RegRestoreKeyW

RegQueryInfoKeyW

RegOpenKeyW

RegOpenKeyExW

RegOpenKeyExA

RegOpenKeyA

RegNotifyChangeKeyValue

RegEnumKeyW

RegEnumKeyExW

RegDeleteKeyW

RegCreateKeyW

RegCreateKeyExW

RegCloseKey

ElfReportEventW

CryptExportKey

CryptDestroyKey

\Device\NamedPipe\Win32Pipes.x.x

CM_Open_DevNode_Key

CryptCATCatalogInfoFromContext

SetPortW

EnumPrinterKeyW

EnumPortsW

DeletePrinterKeyW

DeletePortW

ConfigurePortW

AddPortW

ShellExecuteW

ShellExecuteExW

ShellExecuteExA

ShellExecuteA

SHFileOperationW

SHFileOperationA

FindExecutableW

FindExecutableA

ImportPrivacySettings

MprConfigTransportGetInfo

MprConfigTransportGetHandle

MprConfigTransportDelete

MprConfigTransportCreate

MprConfigInterfaceTransportRemove

MprConfigInterfaceTransportGetInfo

MprConfigInterfaceTransportGetHandle

MprConfigInterfaceTransportEnum

MprConfigInterfaceTransportAdd

MprAdminTransportCreate

MprAdminPortGetInfo

MprAdminPortEnum

MprAdminInterfaceTransportAdd

MimeOleParseMhtmlUrl

ImmGetVirtualKey

ImageGetCertificateHeader

ImageGetCertificateData

ImageEnumerateCertificates

GdiplusShutdown

|CAGetCertTypePropertyEx

CAGetCertTypeProperty

CAGetCertTypeKeySpec

CAGetCertTypeFlagsEx

CAGetCertTypeFlags

CAGetCertTypeExtensionsEx

CAGetCertTypeExtensions

CAGetCertTypeExpiration

CAGetCACertificate

CAFreeCertTypeProperty

CAFreeCertTypeExtensions

CAFindCertTypeByName

CAEnumNextCertType

CAEnumCertTypesForCAEx

CAEnumCertTypesForCA

CACountCertTypes

CACloseCertType

CACertTypeAccessCheck

ApphelpCheckExe

WZCPassword2Key

EapcfgNodeFromKey

SetupDiOpenDevRegKey

SetupDiCreateDevRegKeyW

SXS: %s() BasepSxsCreateStreams() failed

winlogon.EXE

PWVSSh

SXS: %s - Failing thread create because RtlActivateActivationContextEx() failed with status lx

SXS: %s - Failing thread create because RtlQueryInformationActivationContext() failed with status lx

SXS: %s - Failing thread create becuase NtQueryInformationThread() failed with status lx

u\SSh

kernel32: No mapping for ImageInformation.Machine == x

TermsrvLogInstallIniFile

TermsrvGetWindowsDirectoryW

TermsrvGetWindowsDirectoryA

SXS: %s failing because RtlQueryInformationActivationContext() returned status lx

SXS: %s - Failure getting active activation context; ntstatus lx

SXS: %s() LdrAccessOutOfProcessResource failed; nt status = lx

SXS: %s() LdrCreateOutOfProcessImage failed

SXS: %s() NtQueryInformationFile failed

SXS: %s() empty lpSource %ls

SXS: %s() Calling csrss server failed

SXS: %s() RtlMultiAppendUnicodeStringBuffer failed

SXS: %s() NtMapViewOfSection failed

SXS: %s() AssemblyDirectory is not null terminated

SXS: %s() BaseDllMapResourceIdW failed

SXS: %s() ACTCTX_FLAG_RESOURCE_NAME_VALID set but lpResourceName == 0

SXS: %s() Bad lpAssemblyDirectory %ls

SXS: %s() Bad lpSource PathType %ls, 0x%lx

SXS: %s() Bad lpAssemblyDirectory PathType %ls, 0x%lx

SXS: %s() bad wProcessorArchitecture 0x%x

SXS: Invalid parameter(s) passed to FindActCtxSection*()

->cbSize = %u

SXS: %s() CsrCaptureMessageMultiUnicodeStringsInPlace failed

QSSSSh

\twain_32.dll

ReportFault

SXS: %s() NtCreateSection() failed

SXS: %s() NtOpenFile(%wZ) failed

SXS: %s() Null %p or size 0x%lx too small

SXS: %s() Bad flags/size 0x%lx/0x%lx

.debug

.reloc

.rsrc1

.rsrc

|wzcsapi.dll

wzcdlg.dll

wtsapi32.dll

ws2_32.dll

wmvcore.dll

wmi.dll

wldap32.dll

wintrust.dll

winsta.dll

winspool.drv

winscard.dll

winmm.dll

wininet.dll

winhttp.dll

version.dll

uxtheme.dll

utildll.dll

usp10.dll

userenv.dll

user32.dll

urlmon.dll

tapi32.dll

syssetup.dll

sti.dll

shsvcs.dll

shlwapi.dll

shell32.dll

shdocvw.dll

sfc.dll

setupapi.dll

secur32.dll

scecli.dll

samlib.dll

rtutils.dll

rpcrt4.dll

regapi.dll

rasman.dll

rasdlg.dll

rasapi32.dll

query.dll

pstorec.dll

psapi.dll

printui.dll

powrprof.dll

pidgen.dll

pautoenr.dll

oleaut32.dll

oleacc.dll

ole32.dll

odbc32.dll

ocmanage.dll

ntmarta.dll

ntlsapi.dll

ntlanman.dll

ntdsapi.dll

ntdsa.dll

netshell.dll

netrap.dll

netplwiz.dll

netman.dll

netcfgx.dll

netapi32.dll

mswsock.dll

mssign32.dll

msrating.dll

msimg32.dll

msi.dll

mshtml.dll

msgina.dll

mscat32.dll

msacm32.dll

mprui.dll

mprapi.dll

mpr.dll

mobsync.dll

mlang.dll

lz32.dll

linkinfo.dll

keymgr.dll

kdcsvc.dll

iphlpapi.dll

inetcomm.dll

imm32.dll

imgutil.dll

imagehlp.dll

hnetcfg.dll

gdiplus.dll

gdi32.dll

esent.dll

efsadu.dll

duser.dll

dnsapi.dll

dhcpcsvc.dll

devmgr.dll

ddraw.dll

d3dxof.dll

cscdll.dll

cryptui.dll

crypt32.dll

credui.dll

comdlg32.dll

comctl32.dll

certcli.dll

cdfview.dll

cabinet.dll

browseui.dll

authz.dll

apphelp.dll

advpack.dll

activeds.dll

WinStationIsHelpAssistantSession

WinStationEnumerate_IndexedW

|UnlockUrlCacheEntryStream

UnlockUrlCacheEntryFileW

UnlockUrlCacheEntryFileA

SetUrlCacheEntryInfoW

SetUrlCacheEntryGroupW

SetUrlCacheConfigInfoA

RetrieveUrlCacheEntryStreamW

RetrieveUrlCacheEntryFileW

RetrieveUrlCacheEntryFileA

RegisterUrlCacheNotification

ReadUrlCacheEntryStream

LoadUrlCacheContent

IsHostInProxyBypassList

InternetShowSecurityInfoByURLW

InternetOpenUrlW

InternetOpenUrlA

InternetCreateUrlW

InternetCreateUrlA

InternetCrackUrlW

InternetCrackUrlA

InternetCombineUrlW

InternetCanonicalizeUrlW

InternetCanonicalizeUrlA

HttpSendRequestW

HttpSendRequestExW

HttpSendRequestExA

HttpSendRequestA

HttpQueryInfoW

HttpQueryInfoA

HttpOpenRequestW

HttpOpenRequestA

HttpEndRequestW

HttpEndRequestA

HttpAddRequestHeadersW

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

GetUrlCacheEntryInfoExW

GetUrlCacheEntryInfoExA

GetUrlCacheEntryInfoA

GetUrlCacheConfigInfoW

GetUrlCacheConfigInfoA

FtpSetCurrentDirectoryW

FtpSetCurrentDirectoryA

FtpRenameFileA

FtpRemoveDirectoryA

FtpPutFileEx

FtpOpenFileW

FtpOpenFileA

FtpGetFileSize

FtpGetFileEx

FtpGetCurrentDirectoryW

FtpGetCurrentDirectoryA

FtpFindFirstFileW

FtpFindFirstFileA

FtpDeleteFileW

FtpDeleteFileA

FtpCreateDirectoryW

FtpCreateDirectoryA

FtpCommandA

FreeUrlCacheSpaceW

FindNextUrlCacheEntryW

FindNextUrlCacheEntryExW

FindNextUrlCacheEntryExA

FindNextUrlCacheEntryA

FindNextUrlCacheContainerW

FindNextUrlCacheContainerA

FindFirstUrlCacheEntryW

FindFirstUrlCacheEntryExW

FindFirstUrlCacheEntryExA

FindFirstUrlCacheEntryA

FindFirstUrlCacheContainerW

FindFirstUrlCacheContainerA

FindCloseUrlCache

DeleteUrlCacheGroup

DeleteUrlCacheEntryW

DeleteUrlCacheEntryA

DeleteUrlCacheContainerA

CreateUrlCacheGroup

CreateUrlCacheEntryW

CreateUrlCacheEntryA

CreateUrlCacheContainerW

CreateUrlCacheContainerA

CommitUrlCacheEntryW

CommitUrlCacheEntryA

|WinHttpSetTimeouts

WinHttpSetStatusCallback

WinHttpSendRequest

WinHttpReceiveResponse

WinHttpQueryHeaders

WinHttpOpenRequest

WinHttpOpen

WinHttpCrackUrl

WinHttpConnect

WinHttpCloseHandle

|UrlMkSetSessionOption

UrlMkGetSessionOption

URLOpenBlockingStreamW

URLDownloadToFileW

URLDownloadToCacheFileW

IsValidURL

GetMarkOfTheWeb

CreateURLMoniker

CoInternetParseUrl

CoInternetIsFeatureEnabledForUrl

CoInternetGetSecurityUrl

CoInternetCombineUrl

SceSetupUpdateSecurityKey

RasShareConnection

RasIsSharedConnection

DsMakePasswordCredentialsW

DsFreePasswordCredentials

|NetpUpgradePreNT5JoinInfo

NetUserChangePassword

NetUnjoinDomain

NetJoinDomain

NetGetJoinInformation

|SpcGetCertFromKey

GetCryptProvFromCert

FreeCryptProvFromCert

|ShowModelessHTMLDialog

MPRUI_DoPasswordDialog

PRShowSaveFromMsginaW

PRShowRestoreFromMsginaW

KRShowKeyMgr

GetUdpStatistics

GetTcpStatistics

|IcfGetOperationalMode

SetViewportOrgEx

SetViewportExtEx

JetMakeKey

CryptUIDlgViewCertificateW

CryptVerifyCertificateSignature

CryptSignAndEncodeCertificate

CryptMsgGetParam

CryptMsgGetAndVerifySigner

CryptMsgClose

CryptImportPublicKeyInfoEx

CryptImportPublicKeyInfo

CryptHashPublicKeyInfo

CryptExportPublicKeyInfo

CertVerifySubjectCertificateContext

CertVerifyCertificateChainPolicy

CertStrToNameW

CertSetCertificateContextProperty

CertRegisterPhysicalStore

CertRDNValueToStrW

CertOpenSystemStoreW

CertOpenStore

CertNameToStrW

CertGetPublicKeyLength

CertGetNameStringW

CertGetIssuerCertificateFromStore

CertGetEnhancedKeyUsage

CertGetCertificateContextProperty

CertGetCertificateChain

CertFreeCertificateContext

CertFreeCertificateChain

CertFreeCTLContext

CertFindSubjectInCTL

CertFindExtension

CertFindCertificateInStore

CertFindCTLInStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

CertDuplicateCTLContext

CertDeleteCertificateFromStore

CertCreateCertificateContext

CertCreateCTLContext

CertControlStore

CertCompareCertificateName

CertCloseStore

CertAddCertificateContextToStore

CredUICmdLinePromptForCredentialsW

SSSSh

PSSSSSSh

t.PSW

mem16.dll

ImpersonateNamedPipeClient

VWSSh

t.hlt

hypertrm.exe"

hypertrm.exe

.exr (exception record)

.cxr (context record)

serialui.dll

mekr386.exe

PVWSSh

SXS: %s() BaseDllMapResourceIdA failed

-. "%ls" %ld

(LRU) (Exe Name) (FileSize)

Total Entries = 0x%x

xpsp2res.dll

xpsp3res.dll

?456789:;

!"#$%&'()* ,-./0123

|CertAutoEnrollment

VSSHP

ntdll.dll

NtQueryValueKey

NtOpenKey

NtFlushKey

NtSetValueKey

NtCreateKey

NtEnumerateKey

NtEnumerateValueKey

RtlFormatCurrentUserKeyPath

NtQueryKey

NtDeleteValueKey

RtlGetProcessHeaps

NtCreateNamedPipeFile

NtSetThreadExecutionState

LdrQueryImageFileExecutionOptions

NtDelayExecution

NtYieldExecution

kernel32.pdb

0!1'1;1|1

2,242

: :$:(:,:0:4:8:<:>

8 8$8(8,8084888

$0(040:0

1!202

4 4$4(4,4044484

sShortDate

win.ini

.Config

.Manifest

\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

\Windows

\NLS\NlsSectionSortkey

\system32\Apphelp.dll

\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls

\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

ADVAPI32.DLL

\\.\MountPointManager

\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters

hotkey.%u %s

wowexec.pif

cmd /c

hotkey.

setup.exe

\DosDevices\pipe\

\\.\pipe\

\REGISTRY\USER\.DEFAULT

WUSER32.DLL

~RF%4x.TMP

netmsg.dll

pipe\

c:\temp\

EmbdTrst.DLL

\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

%ws%u\DosDevices\%ws

WINDOWS

\\?\GLOBALROOT

Application.Manifest

"/\[]:| =;,?

\REGISTRY\Machine\Software\Microsoft\Windows NT\currentVersion\Time Zones

\Registry\Machine\Software\Policies\Microsoft\Windows\System

AppCertDlls

tsappcmp.dll

\inifile.upd

t\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug

DRMHeader.SubscriptionContentID

DRMHeader.ContentDistributor

DRMHeader.SECURITYVERSION

DRMHeader.CID

DRMHeader.LAINFO

DRMHeader.KID

LicenseStateData.Transfer.NONSDMI

LicenseStateData.Transfer.SDMI

LicenseStateData.Print.redbook

LicenseStateData.Play

ActionAllowed.Backup

ActionAllowed.Transfer.NONSDMI

ActionAllowed.Transfer.SDMI

ActionAllowed.Print.redbook

ActionAllowed.Play

BaseLAURL

Transfer.NONSDMI

Transfer.SDMI

Print.redbook

Software\Microsoft\Windows NT\CurrentVersion\Time Zones

TimeZoneKeyName

PendingFileRenameOperations%d

PendingFileRenameOperations

%s\system32\

\system32\faultrep.dll

mwowcmdline

cmdline

CONSOLE.DLL

conime.exe

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Console

\INF\INTL.INF

DNSAPI.DLL

cfgmgr32.dll

The operation completed successfully.

Not enough storage is available to complete this operation.

The process cannot access the file because another process has locked a portion of the file.

The request is not supported.

Windows cannot find the network path. Verify that the network path is correct and the destination computer is not busy or turned off. If Windows still cannot find the network path, contact your network administrator.

The specified server cannot perform the requested operation.

The specified network password is not correct.

The pipe has been ended.

The system does not support the command requested.

This function is not supported on this system.

The data area passed to a system call is too small.

Attempt to use a file handle to an open disk partition for an operation other than raw disk I/O.

A JOIN or SUBST command cannot be used for a drive that contains previously joined drives.

An attempt was made to use a JOIN or SUBST command on a drive that has already been joined.

An attempt was made to use a JOIN or SUBST command on a drive that has already been substituted.

The system tried to delete the JOIN of a drive that is not joined.

The system tried to join a drive to a directory on a joined drive.

The system tried to join a drive to a directory on a substituted drive.

The system tried to SUBST a drive to a directory on a joined drive.

The system cannot perform a JOIN or SUBST at this time.

The system cannot join or substitute a drive to or for a directory on the same drive.

An attempt was made to join or substitute a drive for which a directory on the drive is the target of a previous substitute.

System trace information was not specified in your CONFIG.SYS file, or tracing is disallowed.

DosMuxSemWait did not execute; too many semaphores are already set.

The file system does not support atomic changes to the lock type.

The operating system cannot run %1.

The flag passed is not correct.

The operating system cannot run this application program.

The operating system is not presently configured to run this application.

The pipe state is invalid.

All pipe instances are busy.

The pipe is being closed.

No process is on the other end of the pipe.

The wait operation timed out.

The mounted file system does not support extended attributes.

The volume is too fragmented to complete this operation.

There is a process on other end of the pipe.

Waiting for a process to open the other end of the pipe.

The I/O operation has been aborted because of either a thread exit or an application request.

Overlapped I/O operation is in progress.

Error performing inpage operation.

The requested operation cannot be performed in full-screen mode.

The configuration registry key is invalid.

The configuration registry key could not be opened.

The configuration registry key could not be read.

The configuration registry key could not be written.

An I/O operation initiated by the registry failed unrecoverably. The registry could not read in, or write out, or flush, one of the files that contain the system's image of the registry.

Illegal operation attempted on a registry key that has been marked for deletion.

Cannot create a symbolic link in a registry key that already has subkeys or values.

Cannot create a stable subkey under a volatile parent key.

The account name is invalid or does not exist, or the password is invalid for the account name specified.

The executable program that this service is configured to run in does not implement the service.

A serial I/O operation was completed by another write to the serial port.

A serial I/O operation completed because the timeout period expired.

The floppy disk controller reported an error that is not recognized by the floppy disk driver.

While accessing the hard disk, a recalibrate operation failed, even after retries.

While accessing the hard disk, a disk operation failed even after retries.

An attempt was made to create more links on a file than the file system supports.

The specified program requires a newer version of Windows.

The specified program is not a Windows or MS-DOS program.

The specified program was written for an earlier version of Windows.

No application is associated with the specified file for this operation.

The message can be used only with synchronous operations.

The device has indicated that cleaning is required before further operations are attempted.

There was no match for the specified key in the index.

The point passed to GetMouseMovePoints is not in the buffer.

The format of the specified password is invalid.

The operation was canceled by the user.

The requested operation cannot be performed on a file with a user-mapped section open.

The network transport endpoint already has an address associated with it.

An operation was attempted on a nonexistent network connection.

An invalid operation was attempted on an active network connection.

The network location cannot be reached. For information about network troubleshooting, see Windows Help.

No service is operating at the destination network endpoint on the remote system.

The operation could not be completed. A retry should be performed.

The network address could not be used for the operation requested.

The operation being requested was not performed because the user has not been authenticated.

The operation being requested was not performed because the user has not logged on to the network.

An attempt was made to perform an initialization operation when initialization has already been completed.

This operation is supported only when you are connected to the server.

This operation is not supported on a Microsoft Small Business Server

The remote system is not available. For information about network troubleshooting, see Windows Help.

Windows cannot open this program because it has been prevented by a software restriction policy. For more information, open Event Viewer or contact your system administrator.

KDC certificate during smartcard logon.

The smartcard certificate used for authentication has been revoked.

An untrusted certificate authority was detected While processing the

smartcard certificate used for authentication. Please contact your system

The revocation status of the smartcard certificate used for

The smartcard certificate used for authentication was not trusted. Please

The smartcard certificate used for authentication has expired. Please

A dynamic link library (DLL) referenced a module that was neither a DLL nor the process's executable image.

No encryption key is available. A well-known encryption key was returned.

The password is too complex to be converted to a LAN Manager password. The LAN Manager password returned is a NULL string.

An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client.

Unable to update the password. The value provided as the current password is incorrect.

Unable to update the password. The value provided for the new password contains values that are not allowed in passwords.

Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirement of the domain.

Logon failure: unknown user name or bad password.

Logon failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy restriction has been enforced.

Logon failure: the specified account password has expired.

Unable to perform a security operation on an object that has no associated security.

The security account manager (SAM) or local security authority (LSA) server was in the wrong state to perform the security operation.

The domain was in the wrong state to perform the security operation.

This operation is only allowed for the Primary Domain Controller of the domain.

Unable to complete the requested operation because of either a catastrophic media failure or a data structure corruption on the disk.

The logon session is not in a state that is consistent with the requested operation.

Unable to impersonate using a named pipe until data has been read from that pipe.

The transaction state of a registry subtree is incompatible with the requested operation.

Cannot perform this operation on built-in accounts.

Cannot perform this operation on this built-in special group.

Cannot perform this operation on this built-in special user.

A cross-encrypted password is necessary to change a user password.

A cross-encrypted password is necessary to change this user password.

There is no user session key for the specified logon session.

Mutual Authentication failed. The server's password is out of date at the domain controller.

This operation can not be performed on the current domain.

Hot key is already registered.

Class still has open windows.

Hot key is not registered.

This list box does not support tab stops.

Child windows cannot have menus.

All handles to windows in a multiple-window position structure must have the same parent.

The paging file is too small for this operation to complete.

Invalid keyboard layout handle.

This operation requires an interactive window station.

This operation returned because the timeout period expired.

The event log file has changed between read operations.

The Windows Installer Service could not be accessed. This can occur if you are running Windows in safe mode, or if the Windows Installer is not correctly installed. Contact your support personnel for assistance.

The configuration data for this product is corrupt. Contact your support personnel.

This installation package cannot be installed by the Windows Installer service. You must install a Windows service pack that contains a newer version of the Windows Installer service.

SQL query syntax invalid or unsupported.

This installation package could not be opened. Verify that the package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer package.

This installation package could not be opened. Contact the application vendor to verify that this is a valid Windows Installer package.

There was an error starting the Windows Installer service user interface. Contact your support personnel.

The language of this installation package is not supported by your system.

Function could not be executed.

Function failed during execution.

Data of this type is not supported.

The Windows Installer service failed to start. Contact your support personnel.

This installation package is not supported by this processor type. Contact your product vendor.

This patch package could not be opened. Verify that the patch package exists and that you can access it, or contact the application vendor to verify that this is a valid Windows Installer patch package.

This patch package could not be opened. Contact the application vendor to verify that this is a valid Windows Installer patch package.

This patch package cannot be processed by the Windows Installer service. You must install a Windows service pack that contains a newer version of the Windows Installer service.

Invalid command line argument. Consult the Windows Installer SDK for detailed command line help.

The requested operation completed successfully. The system will be restarted so the changes can take effect.

The upgrade patch cannot be installed by the Windows Installer service because the program to be upgraded may be missing, or the upgrade patch may update a different version of the program. Verify that the program to be upgraded exists on your computer an

The RPC protocol sequence is not supported.

Not enough resources are available to complete this operation.

The RPC server is too busy to complete this operation.

The remote procedure call failed and did not execute.

The transfer syntax is not supported by the RPC server.

The universal unique identifier (UUID) type is not supported.

The name syntax is not supported.

The server endpoint cannot perform the operation.

No interfaces have been exported.

There is nothing to unexport.

The requested operation is not supported.

A floating-point operation at the RPC server caused a division by zero.

A null context handle was passed from the client to the host during a remote procedure call.

The binding handles passed to a remote procedure call do not match.

A null reference pointer was passed to the stub.

The supplied user buffer is not valid for the requested operation.

The specified port is unknown.

The requested authentication level is not supported.

The error specified is not a valid Windows RPC error code.

Invalid operation on the encoding/decoding handle.

The RPC pipe object is invalid or corrupted.

An invalid operation was attempted on an RPC pipe object.

Unsupported RPC pipe version.

The user's password must be changed before logging on the first time.

The object exporter specified was not found.

Invalid asynchronous RPC call handle for this operation.

The RPC pipe object has already been closed.

The RPC call completed before all pipes were processed.

No more data is available from the RPC pipe.

Not all object UUIDs could be exported to the specified entry.

Interface could not be exported to the specified entry.

The window style or class attribute is invalid for this operation.

The requested metafile operation is not supported.

The requested transformation operation is not supported.

The requested clipping operation is not supported.

The network connection was made successfully, but the user had to be prompted for a password other than the one originally specified.

The requested operation is not allowed when there are jobs queued to the printer.

The requested operation is successful. Changes will not be effective until the system is rebooted.

The requested operation is successful. Changes will not be effective until the service is restarted.

The importation from the file failed.

The GUID passed was not recognized as valid by a WMI data provider.

The instance name passed was not recognized as valid by a WMI data provider.

The data item ID passed was not recognized as valid by a WMI data provider.

The medium currently exists in an offline library and must be online to perform this operation.

The operation cannot be performed on an offline library.

The library, drive, or media pool must be empty to perform this operation.

A resource required for this operation is disabled.

The drive cannot be cleaned or does not support cleaning.

The resource required for this operation does not exist.

The operation identifier is not valid.

The operator or administrator has refused the request.

The transport cannot access the medium.

Unable to retrieve status about the transport.

Cannot use the transport because it is already in use.

Unable to open or close the inject/eject port.

The media type cannot be removed from this library since at least one drive in the library reports it can support this media type.

The remote storage service is not operational at this time.

A cluster node is not available for this operation.

The operation could not be completed because the cluster group is not online.

The operation could not be completed because the cluster resource is online.

The group or resource is not in the correct state to perform the requested operation.

A cluster network is not available for this operation.

All cluster nodes must be running to perform this operation.

A node is in the process of joining the cluster.

A cluster join operation is not in progress.

This operation cannot be performed on the cluster resource as it the quorum resource. You may not bring the quorum resource offline or modify its possible owners list.

The cluster node is not ready to perform the requested operation.

The cluster join operation was aborted.

The cluster join operation failed due to incompatible software versions between the joining node and its sponsor.

The system configuration changed during the cluster join or form operation. The join or form operation was aborted.

The specified node does not support a resource of this type. This may be due to version inconsistencies or due to the absence of the resource DLL on this node.

The specified resource name is not supported by this resource DLL. This may be due to a bad (or changed) name supplied to the resource DLL.

The join operation failed because the cluster database sequence number has changed or is incompatible with the locker node. This may happen during a join operation if the cluster database was changing during the join.

The resource monitor will not allow the fail operation to be performed while the resource is in its current state. This may happen if the resource is in a pending state.

An operation was attempted that is incompatible with the current membership state of the node.

The join operation failed because the cluster instance ID of the joining node does not match the cluster instance ID of the sponsor node.

This computer cannot be made a member of a cluster because it does not have the correct version of Windows installed.

There are no EFS keys defined for the user.

The specified file is not in the defined EFS export format.

The server is not trusted for remote encryption operation.

Recovery policy configured for this system contains invalid recovery certificate.

The encryption algorithm used on the source file needs a bigger key buffer than the one on the destination file.

The disk partition does not support file encryption.

A registry key for event logging could not be created for this session.

A close operation is pending on the session.

The MODEM.INF file was not found.

The modem name was not found in MODEM.INF.

Transport driver error

The requested operation cannot be completed because the terminal connection is currently busy processing a connect, disconnect, reset, or delete operation.

An attempt has been made to connect to a session whose video mode is not supported by the current client.

DOS graphics mode is not supported.

The requested operation can be performed only on the system console.

Disconnecting the console session is not supported.

Reconnecting a disconnected session to the console is not supported.

The remote control of the console was terminated because the display mode was changed. Changing the display mode in a remote control session is not supported.

The requested operation could not be performed because the directory service is not the master for that type of operation.

The requested operation did not satisfy one or more constraints associated with the class of the object.

The directory service can perform the requested operation only on a leaf object.

The directory service cannot perform the requested operation on the RDN attribute of an object.

The requested cross-domain move operation could not be performed.

An operations error occurred.

The requested authentication method is not supported by the server.

The server does not support the requested critical extension.

The operation affects multiple DSAs

The server is not operational.

The specified method is not supported.

The specified control is not supported by the server.

The add replica operation cannot be performed. The naming context must be writable in order to create the replica.

The attribute specified in the operation is not present on the object.

Illegal modify operation. Some aspect of the modification is not permitted.

The operation must be performed at a master DSA.

The operation could not be performed because the object's parent is either uninstantiated or deleted.

The operation cannot be performed because child objects exist. This operation can only be performed on a leaf object.

The operation is out of scope.

The operation cannot continue because the object is in the process of being removed.

The operation can only be performed on an internal master DSA object.

Insufficient access rights to perform the operation.

The operation cannot be performed on a back link.

The operation could not be performed because the directory service is shutting down.

The requested FSMO operation failed. The current FSMO holder could not be contacted.

Subtree notifications are only supported on NC heads.

The requested delete operation could not be performed.

The global catalog verification failed. The global catalog is not available or does not support the operation. Some part of the directory is currently not available.

The replication operation failed because of a schema mismatch between the servers involved.

The operation cannot replace the hidden record.

This directory server is shutting down, and cannot take ownership of new floating single-master operation roles.

The directory service is missing mandatory configuration information, and is unable to determine the ownership of floating single-master operation roles.

The directory service was unable to transfer ownership of one or more floating single-master operation roles to other servers.

The replication operation failed.

An invalid parameter was specified for this replication operation.

The directory service is too busy to complete the replication operation at this time.

The distinguished name specified for this replication operation is invalid.

The naming context specified for this replication operation is invalid.

The distinguished name specified for this replication operation already exists.

The replication operation encountered a database inconsistency.

The server specified for this replication operation could not be contacted.

The replication operation encountered an object with an invalid instance type.

The replication operation failed to allocate memory.

The replication operation encountered an error with the mail system.

The replication operation encountered a database error.

The requested operation is not supported by this version of the directory service.

The replication operation failed due to a collision of object names.

The replication operation failed because a required parent object is missing.

The replication operation was preempted.

The replication operation was terminated because the system is shutting down.

The server specified for this replication operation was contacted, but that server was unable to contact an additional server needed to complete the operation.

The version of the Active Directory schema of the source forest is not compatible with the version of Active Directory on this computer. You must upgrade the operating system on a domain controller in the source forest before this computer can be added as a domain controller to that forest.

The requested operation requires a directory service, and none was available.

The requested search operation is only supported for base searches.

The schema update operation tried to add a backward link attribute that has no corresponding forward link.

Source and destination for the cross-domain move operation are identical. Caller should use local move operation instead of cross-domain move operation.

Another operation which requires exclusive access to the PDC FSMO is already in progress.

A cross-domain move operation failed such that two versions of the moved object exist - one each in the source and destination domains. The destination object needs to be removed to restore the system to a consistent state.

The directory cannot validate the proposed naming context name because it does not hold a replica of the naming context above the proposed naming context. Please ensure that the domain naming master role is held by a server that is configured as a global catalog server, and that the server is up to date with its replication partners. (Applies only to Windows 2000 Domain Naming masters)

The operation can not be performed because the server does not have an infrastructure container in the domain of interest.

The replica/child install failed to read the objectVersion attribute in the SCHEMA section of the file schema.ini in the system32 directory.

Only DSAs configured to be Global Catalog servers should be allowed to hold the Domain Naming Master FSMO role. (Applies only to Windows 2000 servers)

The DSA operation is unable to proceed because of a DNS lookup failure.

The object requested was not found, but an object with that key was found.

The syntax of the linked attribute being added is incorrect. Forward links can only have syntax 2.5.5.1, 2.5.5.7, and 2.5.5.14, and backlinks can only have syntax 2.5.5.1

Security Account Manager needs to get the boot password.

Security Account Manager needs to get the boot key from floppy disk.

The operation requires that destination domain auditing be enabled.

The operation couldn't locate a DC for the source domain.

The replication operation could not be completed due to a schema incompatibility.

The replication operation could not be completed due to a previous schema incompatibility.

The replication update could not be applied because either the source or the destination has not yet received information regarding a recent cross-domain move operation.

The requested operation can be performed only on a global catalog server.

The operation requires that source domain auditing be enabled.

A Filter was passed that uses constructed attributes.

For security reasons, the operation must be run on the destination DC.

Critical Directory Service System objects cannot be deleted during tree delete operations. The tree delete may have been partially performed.

This version of Windows is too old to support the current directory forest behavior. You must upgrade the operating system on this server before it can become a domain controller in this forest.

This version of Windows is too old to support the current domain behavior. You must upgrade the operating system on this server before it can become a domain controller in this domain.

This version of Windows no longer supports the behavior version in use in this directory forest. You must advance the forest behavior version before this server can become a domain controller in the forest.

This version of Windows no longer supports the behavior version in use in this domain. You must advance the domain behavior version before this server can become a domain controller in the domain.

The version of Windows is incompatible with the behavior version of the domain or forest.

The sort order requested is not supported.

Unable to continue operation because multiple conflicting controls were used.

Rename or move operations on naming context heads or read-only objects are not allowed.

Move operations on objects in the schema naming context are not allowed.

The requested action is not supported on standard server.

The directory service cannot perform the requested operation because the servers

Operation not allowed on a disabled cross ref.

Schema update failed: Duplicate msDS-INtId. Retry the operation.

The remote create cross reference operation failed on the Domain Naming Master FSMO. The operation's error is in the extended data.

DNS request not supported by name server.

DNS operation refused.

DNS bad key.

Try DNS operation again later.

The operation requested is not permitted on a DNS root server.

Invalid operation for DNS zone.

The operation cannot be performed because this zone is shutdown.

TCP/IP network protocol not installed.

A blocking operation was interrupted by a call to WSACancelBlockingCall.

A non-blocking socket operation could not be completed immediately.

A blocking operation is currently executing.

An operation was attempted on a non-blocking socket that already had an operation in progress.

An operation was attempted on something that is not a socket.

A required address was omitted from an operation on a socket.

A protocol was specified in the socket function call that does not support the semantics of the socket type requested.

An unknown, invalid, or unsupported option or level was specified in a getsockopt or setsockopt call.

The support for the specified socket type does not exist in this address family.

The attempted operation is not supported for the type of object referenced.

Only one usage of each socket address (protocol/network address/port) is normally permitted.

A socket operation encountered a dead network.

A socket operation was attempted to an unreachable network.

The connection has been broken due to keep-alive activity detecting a failure while the operation was in progress.

An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full.

A socket operation failed because the destination host was down.

A socket operation was attempted to an unreachable host.

A Windows Sockets implementation may have a limit on the number of applications that may use it simultaneously.

The Windows Sockets version requested is not supported.

The specified transport mode filter already exists.

The specified transport mode filter does not exist.

The requested lookup key was not found in any active activation context.

The transport filter is pending deletion.

IKE failed to find valid machine certificate

Certificate Revocation Check failed

Invalid certificate key usage

Invalid certificate type

No private key associated with machine certificate

Peer's certificate did not have a public key

Error processing Cert payload

Error processing Certificate Request payload

Peer failed to send valid machine certificate

Certification Revocation check of peer's certificate failed

Failed to load SECURITY.DLL.

Unsupported ID

Invalid certificate signature

The lifetime value received in the Responder Lifetime Notify is below the Windows 2000 configured minimum value. Please fix the policy on the peer machine.

Key length in certificate is too small for configured security requirements.

Lack of system resources has required isolated activation to be disabled for the current thread of execution.

Manifest Parse Error : System does not support the specified encoding.

Manifest Parse Error : Switch from current encoding to specified encoding not supported.

Assembly Protection Error : The public key for an assembly was too short to be allowed.

The storage operation should block until more data is available.

The storage operation should retry immediately.

The notified event sink will not influence the storage operation.

Drag-drop operation canceled

FORMATETC not supported

Invalid window handle passed

An asynchronous operation was specified. The operation has begun, but its outcome is not known yet.

The transaction was successfully aborted. However, this is a coordinated transaction, and some number of enlisted resources were aborted outright because they could not support abort-retaining semantics

An abort operation was already in progress.

No such interface supported

Operation aborted

The data necessary to complete this operation is not yet available.

Use of Ole1 services requiring DDE windows is disabled

The server process could not be started because the configured identity is incorrect. Check the username and password.

The operation attempted is not supported.

Unable to complete the call since there is no COM security context inside IObjectControl.Activate.

The callee (server [not server application]) is not available and disappeared; all connections are invalid. The call may have executed.

The callee (server [not server application]) is not available and disappeared; all connections are invalid. The call did not execute.

Impersonate on unsecure calls is not supported.

Unable to obtain the Windows directory

The version of ACL format in the stream is not supported by this implementation of IAccessControl

Does not support a collection.

Wrong module kind for the operation.

Unable to perform requested operation.

Attempted an operation on an invalid object.

There is insufficient memory available to complete operation.

An error occurred during a seek operation.

A disk error occurred during a write operation.

A disk error occurred during a read operation.

There is insufficient disk space to complete operation.

Share.exe or equivalent is required for operation.

Illegal operation called on non-file based storage.

Illegal operation called on object with extant marshallings.

OLE32.DLL has been loaded at the wrong address.

Copy Protection Error - The given sector does not have a valid CSS key.

Copy Protection Error - DVD session key not established.

Need to run the object to perform this operation

There is no cache to operate on

Object is static; operation not allowed

compobj.dll is too old for the ole2.dll initialized

Not able to perform the operation because object is not given storage yet

Object doesn't support IViewObject interface

Class does not support aggregation (or class object is remote)

Could not read key from registry

Could not write key to registry

Could not find the key in the registry

A network error interrupted the operation.

There was an error in a Windows GDI call while converting the bitmap to a DIB

There was an error in a Windows GDI call while converting the DIB to a bitmap.

Operation exceeded deadline

Operation unavailable

Intermediate operation failed

User input required for operation to succeed

COM is required for this operation, but is not installed

Task Scheduler security services are available only on Windows NT.

The task object version is either unsupported or invalid.

The task has been configured with an unsupported combination of account settings and run time options.

A retaining commit or abort is not supported

The requested isolation level is not valid or supported.

The transaction manager doesn't support an asynchronous operation for this method.

The requested semantics of retention of isolation across retaining commit and abort boundaries cannot be supported by this transaction implementation, or isoFlags was not equal to zero.

An import object for the transaction could not be found.

A time-out was specified, but time-outs are not supported.

The requested operation is already in progress for the transaction.

The Transaction Manager has disabled its support for TIP.

The transaction manager has disabled its support for remote/network transactions.

The partner transaction manager has disabled its support for remote/network transactions.

The transaction manager has disabled its support for XA transactions.

The requested operation requires that JIT be in the current context and it is not

The requested operation requires that the current context have a Transaction, and it does not

Server execution failed

Bad Key.

Key not valid for use in specified state.

Key does not exist.

Insufficient memory available for the operation.

Provider's public key is invalid.

Keyset does not exist

The keyset is not defined.

Keyset as registered is invalid.

The Keyset parameter is invalid.

The key parameters could not be set because the CSP uses fixed parameters.

The function requested is not supported

The per-message Quality of Protection is not supported by the security package

The certificate chain was issued by an authority that is not trusted.

An unknown error occurred while processing the certificate.

The received certificate has expired.

The other end of the security negotiation is requires strong crypto but it is not supported on the local machine.

The client cert name does not matches the user name or the KDC name is incorrect.

The encryption type requested is not supported by the KDC.

An unsupported preauthentication mechanism was presented to the kerberos package.

The requested operation requires delegation to be enabled on the machine.

The received certificate was mapped to multiple accounts.

SEC_E_NO_KERB_KEY

An error occurred while performing an operation on a cryptographic message.

The streamed cryptographic message requires more data to complete the decode operation.

An error occurred during encode or decode operation.

The specified certificate is self signed.

The previous certificate or CRL context was deleted.

The certificate does not have a property that references a private key.

Cannot find the certificate and private key for decryption.

Cannot find the certificate and private key to use for decryption.

The certificate is revoked.

No Dll or exported function was found to verify revocation.

The revocation function was unable to check revocation for the certificate.

The certificate is not in the revocation server's database.

The string contains an invalid X500 name attribute key, oid, value or delimiter.

The dwValueType for the CERT_NAME_VALUE is not one of the character strings. Most likely it is either a CERT_RDN_ENCODED_BLOB or CERT_TDN_OCTED_STRING.

The Put operation can not continue. The file needs to be resized. However, there is already a signature present. A complete signing operation must be done.

The cryptographic operation failed due to a local security option setting.

No DLL or exported function was found to verify subject usage.

The subject was not found in a Certificate Trust List (CTL).

None of the signers of the cryptographic message or certificate trust list is trusted.

The public key's algorithm parameters are missing.

OSS Certificate encode/decode error code base

OSS ASN.1 Error: Unsupported BER indefinite-length encoding.

ASN1 Certificate encode/decode error code base.

ASN1 function not supported for this PDU.

The request's current status does not allow this operation.

The certification authority's certificate contains invalid data.

Certificate service has been suspended for a database restore operation.

The certificate contains an encoded length that is potentially incompatible with older enrollment software.

The operation is denied. The user has multiple roles assigned and the certification authority is configured to enforce role separation.

The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.

Cannot archive private key. The certification authority is not configured for key archival.

Cannot archive private key. The certification authority could not verify one or more key recovery certificates.

The request is incorrectly formatted. The encrypted private key must be in an unauthenticated attribute in an outermost signature.

The request contains an invalid renewal certificate attribute.

An attempt was made to open a Certification Authority database session, but there are already too many active sessions. The server may need to be configured to allow additional sessions.

The permissions on this certification authority do not allow the current user to enroll for certificates.

The permissions on the certificate template do not allow the current user to enroll for this type of certificate.

The requested certificate template is not supported by this CA.

The request contains no certificate template information.

The request is missing a required private key for archival by the server.

The request was made on behalf of a subject other than the caller. The certificate template must be configured to require at least one signature to authorize the request.

The request template version is newer than the supported template version.

The request includes a private key for archival by the server, but key archival is not enabled for the specified certificate template.

The public key does not meet the minimum size required by the specified certificate template.

The key is not exportable.

You cannot add the root CA certificate into your local store.

The key archival hash attribute was not found in the response.

An unexpetced key archival hash attribute was found in the response.

There is a key archival hash mismatch between the request and the response.

Signing certificate cannot include SMIME extension.

The certificate for the signer of the message is invalid or not found.

The signature of the certificate can not be verified.

The timestamp signature and/or certificate could not be verified or is malformed.

A certificate's basic constraint extension has not been observed.

The certificate does not meet or contain the Authenticode financial extensions.

The file did not pass the hints check.

Failed on a file operation (open, map, read, write).

The trust verification action specified is not supported by the specified trust provider.

The form specified for the subject is not one supported or known by the specified trust provider.

A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

The validity periods of the certification chain do not nest correctly.

A certificate that can only be used as an end-entity is being used as a CA or visa versa.

A path length constraint in the certification chain has been violated.

A certificate contains an unknown extension that is marked 'critical'.

A certificate being used for a purpose other than the ones specified by its CA.

A parent of a given certificate in fact did not issue that child certificate.

A certificate is missing or has an empty value for an important field, such as a subject or issuer name.

A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

An internal certificate chaining error has occurred.

A certificate was explicitly revoked by its issuer.

The certification path terminates with the test root which is not trusted with the current policy settings.

The revocation process could not continue - the certificate(s) could not be checked.

The certificate's CN name does not match the passed value.

The certificate is not valid for the requested usage.

The certificate was explicitly marked as untrusted by the user.

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.

The certificate has invalid policy.

The certificate has an invalid name. The name is not included in the permitted list or is explicitly excluded.

The requested device registry key does not exist.

The operation cannot be performed on a device information element that has not been registered.

The operation does not require any files to be copied.

The operation cannot be performed because the device information set is locked.

The operation cannot be performed because the device information element is locked.

The operation cannot be performed because the file queue is locked.

The operation cannot be performed because the device interface is currently active.

The operation cannot be performed because the device interface has been removed from the system.

The driver selected for this device does not support Windows XP.

The driver selected for this device does not support Windows.

Operation not allowed in WOW64.

The operation involving unsigned file copying was rolled back, so that a system restore point could be set.

An INF was copied into the Windows INF directory in an improper manner.

The operation requires a Smart Card, but no Smart Card is currently in the device.

The operation has been aborted to allow the server application to exit.

The reader driver does not meet minimal requirements for support.

The smart card does not meet minimal requirements for support.

The requested order of object creation is not supported.

This smart card does not support the requested feature.

The requested certificate does not exist.

The requested certificate could not be obtained.

A communications error with the smart card has been detected. Retry the operation.

The requested key container does not exist on the smart card.

The identity or password set on the application is not valid

The DLL does not support the components listed in the TypeLib

The server catalog version is not supported

This operation can not be performed on the system application

This operation is not enabled on this platform

Application Proxy is not exportable

System application is not exportable

Can not subscribe to this component (the component may have been imported)

The partition cannot be exported, because one or more components in the partition have the same file name

Applications that contain one or more imported components cannot be installed into a non-base partition

The COM Catalog Server threw an exception during execution

MSMQ is required for the requested operation and is not installed

Unable to marshal an interface that does not support IPersistStream

The ProgID provided to the copy operation is invalid. The ProgID is in use by another registered CLSID.

Only Application Files (*.MSI files) can be installed into partitions.

Applications containing one or more legacy components may not be exported to 1.0 format.

The SID filtering operation removed all SIDs.

Windows NT BASE API Client DLL

5.1.2600.5512 (xpsp.080413-2111)

Windows

Operating System

5.1.2600.5512

$$$$Guinea$Republic of Guinea)$$$$Guyana$Cooperative Republic of Guyana

$$$$Panama$Republic of Panama $$$$Portugal$Portuguese Republic:$$$$Papua New Guinea$Independent State of Papua New Guinea

$$$$Turkey$Republic of Turkey

$$$860 (OEM - Portuguese)

Portuguese (Brazil)$Brazil $$$1047 (IBM EBCDIC - Latin-1/Open System)

Turkish$Turkey

Portuguese (Portugal)$Portugal

%original file name%.exe_348_rwx_011F0000_0009C000:

ADVAPI32.dll

CryptDeriveKey

CryptDestroyKey

CryptDuplicateKey

CryptExportKey

CryptGenKey

CryptGetKeyParam

CryptGetUserKey

CryptHashSessionKey

CryptImportKey

CryptSetKeyParam

ElfReportEventA

ElfReportEventW

EncryptedFileKeyInfo

FreeEncryptedFileKeyInfo

FreeEncryptionCertificateHashList

GetEventLogInformation

GetMultipleTrusteeOperationA

GetMultipleTrusteeOperationW

GetServiceKeyNameA

GetServiceKeyNameW

GetWindowsAccountDomainSid

ImpersonateNamedPipeClient

MSChapSrvChangePassword

MSChapSrvChangePassword2

QueryWindows31FilesMigration

RegCloseKey

RegCreateKeyA

RegCreateKeyExA

RegCreateKeyExW

RegCreateKeyW

RegDeleteKeyA

RegDeleteKeyW

RegEnumKeyA

RegEnumKeyExA

RegEnumKeyExW

RegEnumKeyW

RegFlushKey

RegGetKeySecurity

RegLoadKeyA

RegLoadKeyW

RegNotifyChangeKeyValue

RegOpenKeyA

RegOpenKeyExA

RegOpenKeyExW

RegOpenKeyW

RegOverridePredefKey

RegQueryInfoKeyA

RegQueryInfoKeyW

RegReplaceKeyA

RegReplaceKeyW

RegRestoreKeyA

RegRestoreKeyW

RegSaveKeyA

RegSaveKeyExA

RegSaveKeyExW

RegSaveKeyW

RegSetKeySecurity

RegUnLoadKeyA

RegUnLoadKeyW

ReportEventA

ReportEventW

SaferiIsExecutableFileType

SetUserFileEncryptionKey

SynchronizeWindows31FilesAndWindowsNTRegistry

WmiExecuteMethodA

WmiExecuteMethodW

PSSSSSSh

PSSSSSSh#

PSSSSSSh

(PSSSSSSh

0PSSSSSSh

8PSSSSSSh

SSSSSSh

PSSSSSSh!

CPDuplicateKey

CPGetUserKey

CPHashSessionKey

CPImportKey

CPExportKey

CPGetKeyParam

CPSetKeyParam

CPDestroyKey

CPDeriveKey

CPGenKey

kernel32.dll

PSSSh

PSShZ

CloseWindowStation

GetProcessWindowStation

MsgWaitForMultipleObjects

8.YYu

TermsrvSetKeySecurity

TermsrvRestoreKey

TermsrvDeleteKey

TermsrvSetValueKey

tsappcmp.dll

Windows Setup

user32.dll

sndrec32.exe

soundrec.exe

packgr32.exe

packager.exe

mplay32.exe

mplayer.exe

mciole16.dll

mciole.dll

$Microsoft Root Certificate Authority

Windows 3.1 Migration

t%SVW)E

mpr.dll

Unable to locate init routine, error = %d

Unable to load client dll, error = %d

ldap_msgfree

1.2.840.113556.1.4.529

wldap32.dll

SamiChangePasswordUser2

SamiChangePasswordUser

SetProcessWindowStation

OpenWindowStationW

It.Iu

PSShL

t.Ht#Ht Ht

ShellExecuteExW

AccProvGetOperationResults

AccProvCancelOperation

WINREG: Frame %d = 0x%x

Frames %d

WINREG: Name: %S

WINREG: Unable to retrieve object name error 0x%x

WINREG: Tracked key data for object 0x%x

imagehlp.dll

SSSSSh

WINTRUST.dll

Secur32.dll

KERNEL32.dll

ntdll.dll

RPCRT4.dll

GetWindowsDirectoryW

GetSystemWindowsDirectoryW

SetNamedPipeHandleState

GetProcessHeap

WaitNamedPipeW

NtQueryKey

NtEnumerateKey

RtlFormatCurrentUserKeyPath

NtNotifyChangeKey

NtDeleteValueKey

NtEnumerateValueKey

NtDeleteKey

NtQueryValueKey

NtSetValueKey

NtOpenKey

NtCreateKey

NtFlushKey

NtLoadKey

NtUnloadKey

NtReplaceKey

NtNotifyChangeMultipleKeys

NtQueryMultipleValueKey

NtRestoreKey

NtSaveKey

NtSaveMergedKeys

NtSaveKeyEx

advapi32.pdb

0p.yx

%x~O>

%D$#>

7,7

9#:*:@:{:

3 3%3.3=3

8$9(90949@9

1&2,263@3

:,:0:<:_:>

3 3$303;3

3M4H4Z4`4e4

3"3'333

\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Software\Microsoft\Windows NT\CurrentVersion\Diagnostics

\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

\Registry\Machine\Software\Policies\Microsoft\Windows\Safer

\Software\Policies\Microsoft\Windows\Safer

\UrlZones

%HKEY_CURRENT_USER

\PIPE\

NTMARTA.DLL

%SystemRoot%\

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir%

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%System32\*.exe

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%*.exe

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%

%s\u

REG.DAT

Windows 3.1 Migration Status

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

t\\.\pipe\net\NtControlPipe

lX-X-X-XX-XXXXXX

\\.\WMIDataDevice

Software\Microsoft\Windows\CurrentVersion\Group Policy\Appmgmt

nuser32.dll

msi.dll

\PIPE\InitShutdown

system.ini

reg.dat

%SystemRoot%\Debug\UserMode\appmgmt.log

%SystemRoot%\Debug\UserMode\appmgmt.bak

%HKEY_LOCAL_MACHINE

%s%s%d%s%s%s%s%s%s%s{lx-x-x-xx-xxxxxx}

certificate

%SystemRoot%\System32\Drivers\

\pipe\svcctl

Group%d

ncacn_ip_tcp

UrlZones

DisallowExecution

iphlpapi.dll

\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib

perfh004.dat

perfc004.dat

progman.ini

SoftWare\Microsoft\Windows NT\CurrentVersion\Program Manager\Settings

SoftWare\Microsoft\Windows NT\CurrentVersion\Program Manager\UNICODE Groups

Windows NT Network Provider

\\.\Pipe\TerminalServer\SystemExecSrvr\%d

W\winsta.dll

feclient.dll

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Compatibility\Applications\

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server

samlib.dll

SupportUrl

Wshell32.dll

CEvents::Report called with more params then expected!

APPMGMT (%x.%x) d:d:d:d

appmgmts.dll

%s_%d

{x-x-x-xx-xxxxxx}

setupapi.dll

%ws\%u

\\.\%s

\Registry\Machine\Hardware\DeviceMap\Scsi\Scsi Port %d\Scsi Bus %d\Target ID %d\Logical Unit Id %d

\Device\Harddisk%d\Partition0

\\.\PhysicalDrive%d

W%s\%s

\Device\Video%d

DefaultSettings.YResolution

DefaultSettings.XResolution

DefaultSettings.VRefresh

DefaultSettings.BitsPerPel

HardwareInformation.BiosString

HardwareInformation.AdapterString

HardwareInformation.DacType

HardwareInformation.ChipType

HardwareInformation.MemorySize

SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3

PerfDbg.Etl

C:\perfdbg.etl

$winnt$.inf

Export

ncacn_nb_tcp

\PIPE\winreg

\SystemRoot\system32\perf0000.dat

\SystemRoot\system32\prf00000.dat

Advanced Windows 32 Base API

5.1.2600.5512 (xpsp.080413-2113)

advapi32.dll

Windows

Operating System

5.1.2600.5512

An exception occurred while performing Windows 3.1 migration. Some data

The entire contents of %1 was migrated into the Windows NT registry.

Windows NT registry.

the Windows NT registry.

The contents of the Windows 3.X Program Manager group file %1 was not

migrated into the Windows NT registry, as a group of that name, %2,

Contents of %1 migrated to the Windows NT registry.

Unable to migrate all or part of the %1 file into the Windows NT registry.

Unable to migrate all or part of the %1 section of %2 into the Windows

into the Windows NT registry.

Unable to load the contents of the Windows 3.1 Program Manager group file %1.

Error Code was %2. Group not migrated to the Windows NT registry.

Unable to convert the contents of the Windows 3.1 Program Manager group

file %1. into the Windows NT format. Error Code was %2. Group not

migrated to the Windows NT registry.

Unable to migrate all or part of %1 to the Windows NT registry.

the Windows NT registry. It is incompatible with Windows NT.

Allows programs to execute with only access to resources granted to open well-known groups, blocking access Administrator and Power User privileges, and personally granted rights.

Software cannot access certain resources, such as cryptographic keys and credentials, regardless of the access rights of the user.

Allows programs to execute as a user that does not have Administrator or Power User access rights, but can still access resouces accessible by normal users.

%original file name%.exe_348_rwx_01C90000_0003E000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

%original file name%.exe_348_rwx_10001000_00060000:

f9z.vk

CCmdTarget

%*.*f

CNotSupportedException

commctrl_DragListMsg

COMCTL32.DLL

ole32.dll

__MSVCRT_HEAP_SELECT

user32.dll

phlpapi.dll

OLEPRO32.DLL

WINMM.dll

HLWAPI.dll

MPR.dll

WS2_32.dll

VERSION.dll

comdlg32.dll

ININET.dll

Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko QQBrowser/8.1.3700.400

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36

Mozilla/5.0 (Windows NT 6.3; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36

hXXps://apisoft.df0535.com/Dfgapi/startpage.html

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProfilesDirectory

*.lnk

\r.log

WinHttp.WinHttpRequest.5.1

application/x-www-form-urlencoded

].browsername

qqbrowser.exe

wshom.ocx

].startpage

MSScriptControl.ScriptControl

function get__key(o) {

a.push(i);

//return JSON.stringify(jsonobj);

if (Object.prototype.toString.apply(O) === '[object Array]') {

for (var i = 0; i

S.push(O2String(O[i]));

J = '[' S.join(',') ']';

else if (Object.prototype.toString.apply(O) === '[object String]') {

J = '"' O.replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"';

else if (Object.prototype.toString.apply(O) === '[object Number]') {

else if (Object.prototype.toString.apply(O) === '[object Date]') {

J = "new Date(" O.getTime() ")";

else if (Object.prototype.toString.apply(O) === '[object RegExp]' || Object.prototype.toString.apply(O) === '[object Function]') {

J = O.toString();

else if (Object.prototype.toString.apply(O) === '[object Object]') {

t = typeof (O[i]) == 'string' ? '"' O[i].replace(/"/g,"\\\"").replace(/\r/g,"\\r").replace(/\n/g,"\\n") '"' : (typeof (O[i]) === 'object' ? O2String(O[i]) : O[i]);

S.push(i ':' t);

J = '{' S.join(',') '}';

.splice(

get__key(

ntdll.dll

program internal error number is %d. (0x%Xh)

:"%s"

:"%s".

%s,%d

%s.lnk

.?AVCCmdTarget@@

.PAVCException@@

.?AVCCmdUI@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCUserException@@

.PAVCArchiveException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCTestCmdUI@@

zcÃ

c:\%original file name%.exe

GetWindowsDirectoryA

GetCPInfo

GetProcessHeap

RegOpenKeyExA

RegCreateKeyExA

RegOpenKeyA

RegCloseKey

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

UnhookWindowsHookEx

CreateDialogIndirectParamA

GetKeyState

SetWindowsHookExA

8B/..LLLXLV

.text

`.rdata

@.data

.rsrc

@.reloc

B.sedata

.reloc

WindowsDirecto

RegOpenKey

ewport#