Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Banker, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 00abcb10cd9186f09e404e1332177f19
SHA1: d45ebf504ba7915dd7154b033322990c0af07ab3
SHA256: b5d9f8b00bdd72c940cfef5b1f8c624a586859b24b7af43b8907938871169624
SSDeep: 196608:7D9TS w0I2K7loMC7 AmU2czivGalcziKXv:3r1IQ9ivGfi
Size: 6717440 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, ACProtect141, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 2015-07-15 07:05:57
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:980
Mutexes
The following mutexes were created/opened:
ZonesLockedCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!oleacc-msaa-loaded_!MSFTHISTORY!_RasPbFileShimCacheMutex
File activity
The process %original file name%.exe:980 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\peas.dll (9606 bytes)
Registry activity
The process %original file name%.exe:980 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 4D 63 D8 34 88 C2 C3 DC 49 66 FE BE 4B 14 52"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
5677c1da8700c28f6968f96363277dfd | c:\peas.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\peas.dll (9606 bytes)
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: ???
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ???
Comments: ???
Language: English (United States)
Company Name: Product Name: ???Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ???Comments: ???Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 2043994 | 2048000 | 4.46299 | 34eeb8c1c70cb6659b7320e5375502c1 |
.rdata | 2052096 | 4479704 | 4481024 | 4.7072 | 36fdb43ca443ce0d4dbd67045f9133a4 |
.data | 6533120 | 521482 | 139264 | 3.59886 | 3231caaa70233c86ffb7299ff0fc87f9 |
.rsrc | 7057408 | 42432 | 45056 | 3.65308 | c67ba250e8b62b3a35d2cdb5aaaebca8 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://34a710a7a1a86d73.cdn.jiashule.com/Api-V1-gettime | |
hxxp://34a710a7a1a86d73.cdn.jiashule.com/Api-V1-setup | |
hxxp://34a710a7a1a86d73.cdn.jiashule.com/Api-V1-info | |
hxxp://api.peasyun.com/Api-V1-setup | 113.207.76.103 |
hxxp://api.peasyun.com/Api-V1-gettime | 113.207.76.103 |
hxxp://api.peasyun.com/Api-V1-info | 113.207.76.103 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /Api-V1-gettime HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Accept: */*
Host: api.peasyun.com
HTTP/1.1 200 OK
Date: Tue, 01 Sep 2015 03:15:59 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: PHPSESSID=kheu0njvta9vticckorse8k945; path=/
Vary: Accept-Encoding
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: loingran=yixdYh; path=/
Set-Cookie: __jsluid=ba9cbe7a0220de29165b9a64b51fe622; path=/
X-Cache: pass
6..yixdYh..0......
POST /Api-V1-setup HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Accept: */*
Host: api.peasyun.com
Content-Length: 118
Cookie: PHPSESSID=kheu0njvta9vticckorse8k945; loingran=yixdYh; __jsluid=ba9cbe7a0220de29165b9a64b51fe622; path=/
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
mac=C969E40C8F300E8A6AC83E3C6CDD9C4F&api_version=1.0&appid=1650258&appkey=1A047D6F07955E007D1F5FC61ED2FB7F&version=2.1
HTTP/1.1 200 OK
Date: Tue, 01 Sep 2015 03:16:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: gettim=1441077360; path=/
Set-Cookie: mac=C969E40C8F300E8A6AC83E3C6CDD9C4F; path=/
Set-Cookie: appid=1650258; path=/
Set-Cookie: appkey=1A047D6F07955E007D1F5FC61ED2FB7F; path=/
Set-Cookie: version=2.1; path=/
X-Cache: pass
1..1..0......
GET /Api-V1-gettime HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Accept: */*
Host: api.peasyun.com
Cookie: PHPSESSID=kheu0njvta9vticckorse8k945; loingran=yixdYh; __jsluid=ba9cbe7a0220de29165b9a64b51fe622; gettim=1441077360; mac=C969E40C8F300E8A6AC83E3C6CDD9C4F; appid=1650258; appkey=1A047D6F07955E007D1F5FC61ED2FB7F; version=2.1; path=/
HTTP/1.1 200 OK
Date: Tue, 01 Sep 2015 03:16:00 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Cache: pass
6..yixdYh..0......
POST /Api-V1-info HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Accept: */*
Host: api.peasyun.com
Content-Length: 118
Cookie: PHPSESSID=kheu0njvta9vticckorse8k945; loingran=yixdYh; __jsluid=ba9cbe7a0220de29165b9a64b51fe622; gettim=1441077360; mac=C969E40C8F300E8A6AC83E3C6CDD9C4F; appid=1650258; appkey=1A047D6F07955E007D1F5FC61ED2FB7F; version=2.1; path=/
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
mac=C969E40C8F300E8A6AC83E3C6CDD9C4F&api_version=1.0&appid=1650258&appkey=1A047D6F07955E007D1F5FC61ED2FB7F&version=2.1
HTTP/1.1 200 OK
Date: Tue, 01 Sep 2015 03:16:01 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: mac=C969E40C8F300E8A6AC83E3C6CDD9C4F; path=/
Set-Cookie: appid=1650258; path=/
Set-Cookie: appkey=1A047D6F07955E007D1F5FC61ED2FB7F; path=/
Set-Cookie: version=2.1; path=/
X-Cache: pass
199.............................::3.9::hXXp://pan.baidu.com/s/1kT8CSQF::............18........................................................................................................................................................................Q...........................3......4................................................WIN7 32............................................................::1::0::0..0..HTTP/1.1 200 OK..Date: Tue, 01 Sep 2015 03:16:01 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..Vary: Accept-Encoding..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0..Pragma: no-cache..Set-Cookie: mac=C969E40C8F300E8A6AC83E3C6CDD9C4F; path=/..Set-Cookie: appid=1650258; path=/..Set-Cookie: appkey=1A047D6F07955E007D1F5FC61ED2FB7F; path=/..Set-Cookie: version=2.1; path=/..X-Cache: pass..199.............................::3.9::http://pan.baidu.com/s/1kT8CSQF::............18........................................................................................................................................................................Q...........................3......4................................................WIN7 32............................................................::1::0::0..0..
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_980:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
|$D.tm
|$D.tm
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
PEAS.dll
PEAS.dll
wininet.dll
wininet.dll
ole32.dll
ole32.dll
AntiVC.dll
AntiVC.dll
user32.dll
user32.dll
UUWiseHelper.dll
UUWiseHelper.dll
shlwapi.dll
shlwapi.dll
advapi32.dll
advapi32.dll
HID.DLL
HID.DLL
SetupApi.dll
SetupApi.dll
HID.dll
HID.dll
Kernel32.dll
Kernel32.dll
gdi32.dll
gdi32.dll
OLEACC.DLL
OLEACC.DLL
User32.dll
User32.dll
oleaut32.dll
oleaut32.dll
gdiplus.dll
gdiplus.dll
winmm.dll
winmm.dll
ws2_32.dll
ws2_32.dll
WinINet.dll
WinINet.dll
rasapi32.dll
rasapi32.dll
Wininet.dll
Wininet.dll
urlmon.dll
urlmon.dll
Ole32.dll
Ole32.dll
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
uu_loginA
uu_loginA
GetUrlCacheEntryInfoA
GetUrlCacheEntryInfoA
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
RegCloseKey
RegCloseKey
RegCreateKeyA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyA
GetWindowsDirectoryA
GetWindowsDirectoryA
GdiplusShutdown
GdiplusShutdown
HttpAddRequestHeadersA
HttpAddRequestHeadersA
keybd_event
keybd_event
UrlMkSetSessionOption
UrlMkSetSessionOption
RegEnumKeyA
RegEnumKeyA
RegFlushKey
RegFlushKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
{B6F7542F-B8FE-46a8-9605-98856A687097}
{B6F7542F-B8FE-46a8-9605-98856A687097}
WebBrowser
WebBrowser
%System%\ntdll.dll
%System%\ntdll.dll
%System%\kernel32.dll
%System%\kernel32.dll
%System%\USER32.dll
%System%\USER32.dll
%System%\GDI32.dll
%System%\GDI32.dll
%System%\ADVAPI32.dll
%System%\ADVAPI32.dll
%System%\RPCRT4.dll
%System%\RPCRT4.dll
%System%\Secur32.dll
%System%\Secur32.dll
%System%\IMM32.DLL
%System%\IMM32.DLL
%System%\LPK.DLL
%System%\LPK.DLL
%System%\USP10.dll
%System%\USP10.dll
%System%\WINMM.dll
%System%\WINMM.dll
%System%\comdlg32.dll
%System%\comdlg32.dll
%System%\msvcrt.dll
%System%\msvcrt.dll
%System%\SHLWAPI.dll
%System%\SHLWAPI.dll
%System%\SHELL32.dll
%System%\SHELL32.dll
%System%\WINSPOOL.DRV
%System%\WINSPOOL.DRV
%System%\ole32.dll
%System%\ole32.dll
%System%\OLEPRO32.DLL
%System%\OLEPRO32.DLL
%System%\OLEAUT32.dll
%System%\OLEAUT32.dll
%System%\WS2_32.dll
%System%\WS2_32.dll
%System%\WS2HELP.dll
%System%\WS2HELP.dll
%System%\uxtheme.dll
%System%\uxtheme.dll
%System%\MSIMG32.dll
%System%\MSIMG32.dll
%System%\MSVCP60.dll
%System%\MSVCP60.dll
%System%\WININET.dll
%System%\WININET.dll
%System%\CRYPT32.dll
%System%\CRYPT32.dll
%System%\MSASN1.dll
%System%\MSASN1.dll
%System%\PSAPI.DLL
%System%\PSAPI.DLL
%System%\VERSION.dll
%System%\VERSION.dll
%System%\urlmon.dll
%System%\urlmon.dll
Web.dll
Web.dll
/peas.dll
/peas.dll
@.reloc
@.reloc
.QZ^&
.QZ^&
~$)~()|$
~$)~()|$
QSShp
QSShp
SSSSh
SSSSh
t'SShl
t'SShl
j%XtL9E
j%XtL9E
FtPW
FtPW
SSh@B
SSh@B
FTCP
FTCP
tAHt.HHt
tAHt.HHt
@ SSHPWj
@ SSHPWj
tWSShW
tWSShW
tl9_ tgSSh
tl9_ tgSSh
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
CNotSupportedException
CNotSupportedException
%s (%s:%d)
%s (%s:%d)
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
KERNEL32.DLL
KERNEL32.DLL
%s%s.dll
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
lX-X-x-XX-XXXXXX
RegOpenKeyTransactedA
RegOpenKeyTransactedA
Advapi32.dll
Advapi32.dll
RegCreateKeyTransactedA
RegCreateKeyTransactedA
RegDeleteKeyTransactedA
RegDeleteKeyTransactedA
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
comctl32.dll
comctl32.dll
comdlg32.dll
comdlg32.dll
shell32.dll
shell32.dll
CCmdTarget
CCmdTarget
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
RegDeleteKeyExA
RegDeleteKeyExA
lXXxXXXXXXXX
lXXxXXXXXXXX
Shell32.dll
Shell32.dll
%s:%x:%x:%x:%x
%s:%x:%x:%x:%x
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
Afx:%p:%x
commctrl_DragListMsg
commctrl_DragListMsg
CMDITabProxyWnd
CMDITabProxyWnd
CMDIChildWndEx
CMDIChildWndEx
CMDIFrameWndEx
CMDIFrameWndEx
%sMFCToolBar-%d%x
%sMFCToolBar-%d%x
%sMFCToolBar-%d
%sMFCToolBar-%d
%sMFCToolBarParameters
%sMFCToolBarParameters
TOOLBAR_RESETKEYBAORD
TOOLBAR_RESETKEYBAORD
KeyboardManager
KeyboardManager
MSG_CHECKEMPTYMINIFRAME
MSG_CHECKEMPTYMINIFRAME
%sDockingManager-%d
%sDockingManager-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
CMDIChildWnd
CMDIChildWnd
CMDIFrameWnd
CMDIFrameWnd
&%d %s
&%d %s
CMDIClientAreaWnd
CMDIClientAreaWnd
%sMDIClientArea-%d
%sMDIClientArea-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
%sBasePane-%d%x
%sBasePane-%d%x
%sBasePane-%d
%sBasePane-%d
%sPane-%d%x
%sPane-%d%x
%sPane-%d
%sPane-%d
windows
windows
ShowCmd
ShowCmd
Hex={X,X,X}
Hex={X,X,X}
%sMFCOutlookBar-%d%x
%sMFCOutlookBar-%d%x
%sMFCOutlookBar-%d
%sMFCOutlookBar-%d
MFCLink_UrlPrefix
MFCLink_UrlPrefix
MFCLink_Url
MFCLink_Url
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
%c%d%c%s
%c%d%c%s
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
%sDockablePaneAdapter-%d%x
%sDockablePaneAdapter-%d%x
%sDockablePaneAdapter-%d
%sDockablePaneAdapter-%d
ENABLE_KEYS
ENABLE_KEYS
KEYS_MENU
KEYS_MENU
KEYS
KEYS
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
CMFCToolBarsKeyboardPropertyPage
CMFCToolBarsKeyboardPropertyPage
RGB(%d, %d, %d)
RGB(%d, %d, %d)
%sMFCTasksPane-%d%x
%sMFCTasksPane-%d%x
%sMFCTasksPane-%d
%sMFCTasksPane-%d
operator
operator
GetProcessWindowStation
GetProcessWindowStation
portuguese-brazilian
portuguese-brazilian
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
HTTP/1.1 302 Found
HTTP/1.1 302 Found
Set-Cookie: %s
Set-Cookie: %s
HaiOu ProxyHttp
HaiOu ProxyHttp
HTTP/1.1
HTTP/1.1
Host: %s
Host: %s
CPUID:%s
CPUID:%s
DISK:%s
DISK:%s
MAC:%s
MAC:%s
MD5:%s
MD5:%s
hXXp://api.peasyun.com/Api-V1-gettime
hXXp://api.peasyun.com/Api-V1-gettime
hXXp://api.peasyun.com/Api-V1-
hXXp://api.peasyun.com/Api-V1-
appkey
appkey
%s%s%s
%s%s%s
mac=%s&api_version=%s&appid=%s&appkey=%s&version=%s
mac=%s&api_version=%s&appid=%s&appkey=%s&version=%s
login
login
: this object doesn't support resynchronization
: this object doesn't support resynchronization
StreamTransformation: this object doesn't support random access
StreamTransformation: this object doesn't support random access
XXXXXX
XXXXXX
XX
XX
: this object does't support a special last block
: this object does't support a special last block
: this object doesn't support multiple channels
: this object doesn't support multiple channels
is not a valid key length
is not a valid key length
?#%X.y
?#%X.y
E:\Visual Studio 2010\Projects\AuthorAPI\Release\PEAS.pdb
E:\Visual Studio 2010\Projects\AuthorAPI\Release\PEAS.pdb
GetProcessHeap
GetProcessHeap
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
UnhookWindowsHookEx
UnhookWindowsHookEx
GetKeyState
GetKeyState
SetWindowsHookExA
SetWindowsHookExA
GetAsyncKeyState
GetAsyncKeyState
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardLayout
GetKeyboardLayout
GetKeyboardState
GetKeyboardState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
GetKeyNameTextA
GetKeyNameTextA
MapVirtualKeyExA
MapVirtualKeyExA
USER32.dll
USER32.dll
GetViewportExtEx
GetViewportExtEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
COMDLG32.dll
COMDLG32.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegEnumKeyExA
RegEnumKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
COMCTL32.dll
COMCTL32.dll
UrlUnescapeA
UrlUnescapeA
SHLWAPI.dll
SHLWAPI.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
HttpSendRequestExA
HttpSendRequestExA
HttpEndRequestA
HttpEndRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
OLEACC.dll
OLEACC.dll
IMM32.dll
IMM32.dll
WINMM.dll
WINMM.dll
LOGIN
LOGIN
.PAVCOleException@@
.PAVCOleException@@
.PAVCException@@
.PAVCException@@
.PAVCObject@@
.PAVCObject@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.PAVCArchiveException@@
.PAVCArchiveException@@
.PAVCFileException@@
.PAVCFileException@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.?AVCMDITabProxyWnd@@
.?AVCMDITabProxyWnd@@
.?AVCMDIChildWndEx@@
.?AVCMDIChildWndEx@@
.?AVCMDIChildWnd@@
.?AVCMDIChildWnd@@
.?AVCMDIFrameWndEx@@
.?AVCMDIFrameWndEx@@
.?AVCMDIFrameWnd@@
.?AVCMDIFrameWnd@@
.?AVCMFCToolBarCmdUI@@
.?AVCMFCToolBarCmdUI@@
.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@
.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@
.?AVCMDIClientAreaWnd@@
.?AVCMDIClientAreaWnd@@
.?AVCMFCRibbonCmdUI@@
.?AVCMFCRibbonCmdUI@@
.?AVCMFCCmdUsageCount@@
.?AVCMFCCmdUsageCount@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@
.?AVCMFCColorBarCmdUI@@
.?AVCMFCColorBarCmdUI@@
.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AVCMFCAcceleratorKey@@
.?AVCMFCAcceleratorKey@@
.?AVCMFCRibbonKeyTip@@
.?AVCMFCRibbonKeyTip@@
.?AVCMFCToolBarsKeyboardPropertyPage@@
.?AVCMFCToolBarsKeyboardPropertyPage@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@
.?AVCMFCTasksPaneToolBarCmdUI@@
.?AVCMFCTasksPaneToolBarCmdUI@@
.?AVCMFCAcceleratorKeyAssignCtrl@@
.?AVCMFCAcceleratorKeyAssignCtrl@@
zcÃ
zcÃ
.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@
.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@
.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@
.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@
.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@
.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@
.?AVHexEncoder@CryptoPP@@
.?AVHexEncoder@CryptoPP@@
.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AVSimpleKeyingInterface@CryptoPP@@
.?AVSimpleKeyingInterface@CryptoPP@@
.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@
.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@
.?AVInvalidKeyLength@CryptoPP@@
.?AVInvalidKeyLength@CryptoPP@@
.PB_W
.PB_W
.PAV?$basic_istream@DU?$char_traits@D@std@@@std@@
.PAV?$basic_istream@DU?$char_traits@D@std@@@std@@
truePPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
truePPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
8"8:8?8/9
8"8:8?8/9
1*111@1|1
1*111@1|1
5'6-63696
5'6-63696
1%1x1
1%1x1
3
4-585J5S5Y5n5}5
2-2`2
8Â9U9J;
>.>5>[>|>40585`5~5=-=:=#>3>6*70747871 1$1(1,1014181> >$>(>,>0>4>> >$>(>,>0>4>8>@>5 5$5(5,50545855 5$5(5,51$10141GBj%c}&-4}v1650258\peas.ini&password=%S4WDhg%fpMS.Ac9SR0.I%3s,wAe.kIaiUy'4xu%c*@j.eH'y{&%U)lj%4Uxe%CNs9F.cLehJK.ZHO.qt0MSVCRT.dllMSVFW32.dllSkinH_EL.dll(*.txt)VVV.jd.comhXXps://passport.jd.com/uc/login?ltype=logouthXXps://authcode.jd.com/verify/image?a=1&acid=&ReturnUrl=http://VVV.jd.com/&r=hXXps://passport.jd.com/uc/loginService?uuid=&loginpwd=&nloginpwd=&loginname=({"success":"hXXp://VVV.jd.com/"})hXXp://hXXps://WinHttp.WinHttpRequest.5.1User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)780E5DA2-BB97-49CB-A1E7-0F753A8D3DC2\zz.cds32F1C86B-E64C-4EAF-8BC1-C142570008BCTEAKEYSESSIONkEY-12027,TEAKEYfunction time(){return Math.random()}hXXp://pv.sohu.com/cityjson?ie=gb2312httpsMozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)http=hXXp://ip.chinaz.com/?IP=search.jd.comitem.jd.comhXXps://passport.jd.com/new/login.aspxId==loginnameId==nloginpwdId==loginsubmit.htmlhXXp://item.jd.com/Id==InitCartUrlSoftware\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies\*.txt{"ventureRet":"hXXp://VVV.jd.com/",&addressInfoParam.easyBuy=undefined&addressInfoParam.phone=&addressInfoParam.email=&addressInfoParam.addressAlias=&addressInfoParam.fullAddress=&addressInfoParam.mobile=&addressInfoParam.consigneeAddress=&addressInfoParam.townId=&addressInfoParam.countyId=&addressInfoParam.cityId=&addressInfoParam.provinceId=addressInfoParam.consigneeName=hXXp://easybuy.jd.com/address/addAddress.actionhXXp://easybuy.jd.com/address/getEasyBuyList.actionhXXp://easybuy.jd.com/address/setAddressAllDefaultById.actionhXXp://easybuy.jd.com/address/deleteAddress.action13-2-5011385810565824-1-10215-4-60211-4-50217-1-4023-24-27210-2-602Q-SPORT22-1-70510-5-6022-2-150423-1-10110-2-1002166-2 1912-1-140218-6 39235-2-5021372073117412-6-10143-4-8020416-2821546hXXp://cart.jd.com/batchRemoveSkusFromCart.action&enc=utf-8#keyword=hXXp://search.jd.com/Search?keyword=hXXp://VVV.jd.com/hXXp://trade.jd.com/shopping/order/getOrderInfo.action?rid=hXXp://trade.jd.com/shopping/order/submitOrder.action&submitOrderParam.remark=&submitOrderParam.payPassword=&submitOrderParam.sopNotPutInvoice=truehXXp://gate.jd.com/InitCart.aspx?pid=@1970-01-01 08:00:00hXXp://trade.jd.com/shopping/dynamic/coupon/getCoupons.actioncouponParam.couponKey=hXXp://trade.jd.com/shopping/dynamic/coupon/useCoupon.actionhXXp://bean.jd.com/myJingBean/listjdBeanParam.usedJdBean=hXXp://trade.jd.com/shopping/dynamic/jdbean/useJdBean.actionhXXp://order.jd.com/center/list.actionhttps.*jd.compassport.jd.com(JD.COM)-Id==key\temp.jpg\\_1.jpgId==sendMsg\UUWiseHelper.dllByScreen.JPGE:\work\UUWiseHelper\UUWiseHelper.pdbRegOpenKeyExWdbghelp.dllIPHLPAPI.DLLWS2_32.dllUUWiseHelper.DLLuu_easyRecognizeUrlAuu_easyRecognizeUrlWuu_loginWuu_recognizeByCodeTypeAndUrlAuu_recognizeByCodeTypeAndUrlWuu_reportError"0,010708Â8J8R8x80#0'0-01070;0=*>0>4>8>5%6S63$3,383\3|3:-1014,URL:-19011,hXXp://VVV.jd.comhXXp://VVV.uudama.com/userReg.htmlhXXp://VVV.kuaidaili.com/free/inha/hXXp://usergrade.jd.com/user/gradehXXp://quan.jd.com/user_quan.actionhXXps://cashier.jd.com/payment/paymentConfirm.actionhttps:hXXps://authcode.jd.com/verify/imageVBScript.RegExphXXp://open.baidu.com/special/time/window.baidu_time(Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*1970-01-01 00:00:00hXXp://bbs.125.la/plugin.php?id=vip_ec:vipechXXp://bbs.125.la/forum.php?mod=forumdisplay&fid=60\\.\PHYSICALDRIVE\\.\SCSI\\.\SMARTVSD\\.\PhysicalDrive0bbs.125.labackground(?:-image)?:.*?[\s]*?url[\s]*?\([#']?(.*?)[#onkeydown|onkeyup|onkeypress|{0002DF05-0000-0000-C000-000000000046}{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}{6D5140C1-7436-11CE-8034-00AA006009FA}text|password|file?)-D%f`location.reload()window.location.href="{25336920-03F9-11CF-8FD0-00AA00686F13}hXXp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.jsdocument.all.retjs.innerText=javascript:document.body.contentEditable='true';document.designMode='on';void 0;javascript:document.body.contentEditable='false';document.designMode='on';void 0;javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};WarnOnHTTPSToHTTPRedirectHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet SettingsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet SettingsHKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERStype=password[password]var jies = document.getElementsByTagName('object');for(var jie in jies){if(jies[jie].classid=='clsid:D27CDB6E-AE6D-11cf-96B8-444553540000'){jies[jie].removeNode(true);}}user.qzone.qq.commail.qq.comonkeyuptype='password'type="password", 1, , ,var jie = document.createStyleSheet();jie.addRule('html','').value="document.getElementById('Winmm.dlldsound.dll@ping 127.0.0.1 -n\*.*"@ping 127.0.0.1 -n 1 >nuldel 123.bat\123.bat\TEMP.TMP{Reg}((?:src=)['"]?).*?\.js['"]{Reg}((?:hXXp://)['"]?).*?\.swf{Reg}((?:url\()|(?:src=)['"]?).*?\.[jpg|gif|png]{3}Host:HttpAddRequestHeadersAscripting.FileSystemObjectbbs.125.la_CookieAdodb.Streamdel C:\123.bat\Restart.bat(*.*)|*.*(*.txt)|*.txt|HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.CurrentSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\proxyserverSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\proxyenableSoftware\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\data\Config.ini;http=Mozilla/4.0 (compatible; MSIE 9.0; Windows NT6.1)Mozilla/4.0 (compatible; MSIE 8.0; Windows NT6.0)Mozilla/4.0 (compatible; MSIE 7.0; Windows NT5.2)Mozilla/4.0 (compatible; MSIE 6.0; Windows NT5.1)>Mozilla/5.0 (compatible) AppleWebKit/534.21 (KHTML, like Gecko) Chrome/11.0.682.0 Safari/534.21>Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2Mozilla/5.0(iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B314 Safari/531.21.10Mozilla/5.0 (iPhone; U; CPU OS 4_2_1 like Mac OS X) AppleWebKit/532.9 (KHTML, like Gecko) Version/5.0.3 Mobile/8B5097d Safari/6531.22.7Mozilla/5.0 (Linux; U; Android 2.3.3; zh-tw; HTC_Pyramid Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1Opera/9.80 (compatible; U) Presto/2.7.39 Version/11.00Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.12)Gecko/20080219 Firefox/2.0.0.12 Navigator/9.0.0.6Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_7) AppleWebKit/534.16 (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4window.location.reload()var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');{557CF400-1A04-11D3-9A73-0000F81EF32E}{557CF401-1A04-11D3-9A73-0000F81EF32E}{557CF402-1A04-11D3-9A73-0000F81EF32E}{557CF405-1A04-11D3-9A73-0000F81EF32E}{557CF406-1A04-11D3-9A73-0000F81EF32E}_1094927708_2_3101.69.199.99:802015 7.152015.7.132015.7.122015.7.102015.7.72015.7.4hXXp://pan.baidu.com/s/1kT8CSQF1878559086>0123456789ABCDEF deflate 1.1.3 Copyright 1995-1998 Jean-loup Gaillyinflate 1.1.3 Copyright 1995-1998 Mark Adler%*.*fAfx:%x:%x:%x:%x:%xAfx:%x:%xCOMCTL32.DLLMSH_SCROLL_LINES_MSGMSWHEEL_ROLLMSG__MSVCRT_HEAP_SELECTiphlpapi.dllMPR.dllVERSION.dllRASAPI32.dllWinExecEnumChildWindowsVkKeyScanExAoledlg.dllWSOCK32.dllDeleteUrlCacheEntryFindNextUrlCacheEntryAFindFirstUrlCacheEntryAWLDAP32.dll(*.prn)|*.prn|(*.*)|*.*||Mpr.dllGdi32.dll(&07-034/)7 '?? / %d]%d / %d]: %d](*.WAV;*.MID)|*.WAV;*.MID|WAV(*.WAV)|*.WAV|MIDI(*.MID)|*.MID|(*.txt)|*.txt|(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG(*.JPG)|*.JPG|BMP(*.BMP)|*.BMP|GIF(*.GIF)|*.GIF|(*.ICO)|*.ICO|(*.CUR)|*.CUR|%s:%dout.prn%d.%d%d / %d%d/%dBogus message code %d(%d-%d):%ld%cVVV.dywt.com.cnindex.datdesktop.ini%sReply-To: %sFrom: %sTo: %sSubject: %sDate: %sCc: %s%a, %d %b %Y %H:%M:%SSMTP\u00%c%cjson_tokener_parse_ex: error %s at offset %djson_tokener_comment: %sHTTP HTTPS.Excel.Application1.0.6\shell32.dll1.1.3;3 #>6.&'2, / 0&7!4-)1#Corrupt JPEG data: found marker 0xx instead of RST%dWarning: unknown JFIF revision number %d.dCorrupt JPEG data: %u extraneous bytes before marker 0xxInconsistent progression sequence for component %d coefficient %dUnknown Adobe color transform code %dObtained XMS handle %uFreed XMS handle %uUnrecognized component IDs %d %d %d, assuming YCbCrJFIF extension marker: RGB thumbnail image, length %uJFIF extension marker: palette thumbnail image, length %uJFIF extension marker: JPEG-compressed thumbnail image, length %uOpened temporary file %sClosed temporary file %sSs=%d, Se=%d, Ah=%d, Al=%dComponent %d: dc=%d ac=%dStart Of Scan: %d componentsComponent %d: %dhx%dv q=%dStart Of Frame 0xx: width=%u, height=%u, components=%dSmoothing not supported with nonstandard sampling ratiosRST%dAt marker 0xx, recovery action %dSelected %d colors for quantizationQuantizing to %d colorsQuantizing to %d = %d*%d*%d colors%4u %4u %4u %4u %4u %4u %4u %4uUnexpected marker 0xxMiscellaneous marker 0xx, length %uwith %d x %d thumbnail imageJFIF extension marker: type 0xx, length %uWarning: thumbnail image size does not match data length %uJFIF APP0 marker: version %d.d, density %dx%d %d= = = = = = = =Obtained EMS handle %uFreed EMS handle %uDefine Restart Interval %uDefine Quantization Table %d precision %dDefine Huffman Table 0xxDefine Arithmetic Table 0xx: 0xxUnknown APP14 marker (not Adobe), length %uUnknown APP0 marker (not JFIF), length %uAdobe APP14 marker: version %d, flags 0xx 0xx, transform %dUnsupported marker type 0xxFailed to create temporary file %sUnsupported JPEG process: SOF type 0xxCannot quantize to more than %d colorsCannot quantize to fewer than %d colorsCannot quantize more than %d color componentsInsufficient memory (case %d)Not a JPEG file: starts with 0xx 0xxQuantization table 0xx was not definedHuffman table 0xx was not definedBacking store not supportedArithmetic table 0xx was not definedCannot transcode due to multiple use of quantization table %dMaximum supported image dimension is %u pixelsEmpty JPEG image (DNL not supported)Bogus DQT index %dBogus DHT index %dBogus DAC value 0x%xBogus DAC index %dUnsupported color conversion requestToo many color components: %d, max %dBuffer passed to JPEG library is too smallJPEG parameter struct mismatch: library thinks size is %u, caller expects %uImproper call to JPEG library in state %dInvalid scan script at entry %dInvalid progressive parameters at scan script entry %dInvalid progressive parameters Ss=%d Se=%d Ah=%d Al=%dUnsupported JPEG data precision %dInvalid memory pool code %dWrong JPEG library version: library is %d, caller expects %dComponent index %d: mismatching sampling ratio %d:%d, %d:%d, %cDCT scaled block size %dx%d not supportedInvalid component ID %d in SOSNULL row buffer for row %ld, pass %dlibpng error: %slibpng warning: %sUnknown zTXt compression type %dgamma = (%d/100000)gx=%f, gy=%f, bx=%f, by=%fwx=%f, wy=%f, rx=%f, ry=%fincorrect gamma=(%d/100000)%s: Cannot open%s: Write error at scanline %lu%s: Seek error at scanline %lu%u: Sample out of range, max %u%s: Cannot modify tag "%s" while writing%s: Unknown %stag %u%f: Bad value for "%s"%s: Invalid %stag "%s" (not supported by codec)TIFFVSetField ... pass by value not imp.%ld: Bad value for "%s"%d: Bad value for "%s"Nonstandard tile length %d, convert fileNonstandard tile width %d, convert fileBad value %ld for "%s" tag ignored%s: Invalid InkNames value; expecting %d names, found %dTIFFVGetField ... pass by value not imp.Sorry, can not handle images with %d-bit samplesSorry, can not handle LogLuv images with %s=%dSorry, LogLuv data must have %s=%d or %dSorry, can not handle image with %s=%dSorry, LogL data must have %s=%dSorry, can not handle separated image with %s=%dSorry, can not handle RGB image with %s=%dSorry, can not handle YCbCr images with %s=%dSorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%dMissing needed %s tagSorry, can not image with %d-bit samples"%s": Bad modeNot a TIFF file, bad version number %d (0x%x)Not a TIFF file, bad magic number %d (0x%x)%s: Out of memory (TIFF structure)Sample %d out of range, max %uInternal error, unknown tag 0x%xTag %d%s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu%s: Read error at scanline %lu; got %lu bytes, expected %lu%s: Seek error at scanline %lu, strip %lu%s: Data buffer too small to hold strip %lu%s: Read error on strip %lu; got %lu bytes, expected %lu%s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu%s: Read error at row %ld, col %ld; got %lu bytes, expected %lu%s: Seek error at row %ld, col %ld, tile %ld%s: Data buffer too small to hold tile %ld%s: No space for data buffer at scanline %ldCompression scheme %u %s encoding is not implemented%s %s encoding is not implemented%s %s encoding is no longer implemented due to Unisys patent enforcementCompression scheme %u %s decoding is not implemented%s %s decoding is not implementedCompression algorithm does not support random accessBogus "%s" field, ignoring and calculating from imagelengthTIFF directory is missing required "%s" field, calculating from imagelengthwrong data type %d for "%s"; tag ignoredunknown field with tag %d (0x%x) encounteredNo space %sTIFF directory is missing required "%s" fieldincorrect count for field "%s" (%lu, expecting %lu); tag ignoredError fetching data for field "%s"%s: Rational with zero denominator (num = %lu)Cannot handle different per-sample values for field "%s"cannot read TIFF_ANY type %d for field "%s""%s": Information lost writing value (%g) as (unsigned) RATIONALError writing data for field "%s"%s: Error writing SubIFD directory link%s compression support is not configured?%s: No space for LogLuv state blockInappropriate photometric interpretation %d for SGILog compression; %sLogL16Decode: Not enough data at row %d (short %d pixels)LogLuvDecode24: Not enough data at row %d (short %d pixels)LogLuvDecode32: Not enough data at row %d (short %d pixels)%s: No space for SGILog translation bufferNo support for converting user data format to LogLNo support for converting user data format to LogLuvSGILog compression supported only for %s, or raw dataUnknown data format %d for LogLuv compressionUnknown encoding %d for LogLuv compression%s: No space for state block%s: Bad code word at scanline %d (x %lu)%s: %s at scanline %d (got %lu, expected %lu)%s: Premature EOF at scanline %d (x %lu)%s: No space for Group 3/4 reference line%s: No space for Group 3/4 run arrays%s: Uncompressed data (not supported) at scanline %d (x %lu)Fax SubAddress: %s(%u = 0x%x)%suncompressed data%sEOL padding%s2-d encodingImproper JPEG sampling factors %d,%dApparently should be %d,%d,decompressor will try reading with sampling %d,%dImproper JPEG strip/tile size, expected %dx%d, got %dx%dRowsPerStrip must be multiple of %d for JPEGJPEG tile width must be multiple of %dJPEG tile height must be multiple of %dBitsPerSample %d not allowed for JPEGPhotometricInterpretation %d not allowed for JPEGThunderDecode: %s data at scanline %ld (%lu != %lu)PackBitsDecode: discarding %d bytes to avoid buffer overrunLZWDecode: Not enough data at scanline %d (short %d bytes)LZWDecode: Strip %d not terminated with EOI codeLZWDecode: Bogus encoding, loop in the code table; scanline %dLZWDecodeCompat: Not enough data at scanline %d (short %d bytes)DumpModeDecode: Not enough data for scanline %dHorizontal differencing "Predictor" not supported with %d-bit samples"Predictor" value %d not supported%u (0x%x).PAVCOleDispatchException@@c:\%original file name%.exe#include "l.chs\afxres.rc" // Standard componentsSHELL32.DLLdwmapi.dllUxTheme.dllaccKeyboardShortcuthhctrl.ocxUSER32.DLLRICHED20.DLLekernel32.dllmscoree.dll- Attempt to initialize the CRT more than once.- CRT not initialized- floating point support not loaded1, 0, 6, 6- Skin.dllCCaptchaRecognizer::recognizeByCodeTypeAndUrlhXXp://s1.uudati.com:hXXp://s1.taskok.com:hXXp://s1.uudama.com:hXXp://s1.uuwise.com:/Api/config.aspx2.0.0.5WiseClientAPI-2.0.0.5CCaptchaRecognizer::__UpdateTKEYCCaptchaRecognizer::_IsNeedLogin/Api/DecodeImg.aspx
xxxxxxxxxxx
hXXp://p1.uuwise.net:
hXXp://p1.uudama.net:
hXXp://p1.taskok.com:
hXXp://p1.uuwise.com:
hXXp://p1.uudama.com:
CCaptchaRecognizer::easyRecognizeUrl
%d%d%d%d%d
CCaptchaRecognizer::_CalcRandomPort
/Api/VerifyAPIFile.aspx
/Api/UserLogin.aspx
CCaptchaRecognizer::login
/Api/UserReg.aspx
/Api/PayCard.aspx
/Api/ReportError.aspx
CCaptchaRecognizer::reportError
/Api/UserPoint.aspx
|2.0.0.5|
/Api/DecodeResult.aspx
ID/KEY/
ByTypeBytes.JPG
%d-%d-%d
CHttpRequestHelper::_ReadResponse
User-Agent:WiseClient-2.0.0.5;
WiseClient-2.0.0.5
CHttpRequestHelper::_InternalRequest
CHttpRequestHelper::RequestGetImage
CHttpRequestHelper::RequestPost
ServerPort
UUExtConfig.ini
-:-:-.%d
tCRYPTDLL.DLL
3.cn.pool.ntp.org
2.cn.pool.ntp.org
1.cn.pool.ntp.org
0.cn.pool.ntp.org
cn.pool.ntp.org
\\.\PHYSICALDRIVE0
Microsoft Windows Millennium Edition
Microsoft Windows 98
Microsoft Windows 95
%s (Build %d)
Service Pack 6a (Build %d)
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009
Web Edition
Service Pack %d (Build %d)
Microsoft Windows NT
Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003,
Microsoft Windows XP Professional x64 Edition
Microsoft Windows Server 2003 "R2"
Windows Server 2008
Windows Vista
Windows Server 2008 R2
Windows 7
ox-x-x-x-x-x
\Tencent\Users\*.*
nKERNEL32.DLL
WUSER32.DLL
!"#$%&'()* ,-.
uuwise.com
2, 0, 0, 5
1.0.0.1
(*.*)
1.0.0.0%original file name%.exe_980_rwx_10000000_0003E000:
`.rsrc
L$(h%f
SSh0j
msctls_hotkey32
TVCLHotKey
THotKey
\skinh.she
}uo,x6l5k%x-l h
9p%s m)t4`#b
e"m?c&y1`ÃSetViewportOrgExSetViewportExtExSetWindowsHookExAUnhookWindowsHookExEnumThreadWindowsEnumChildWindows`c%US.4/!#$.text`.rdata@.data.rsrc@.UPX0`.UPX1`.relochJK.ZHO.qt0KERNEL32.DLLCOMCTL32.dllGDI32.dllMSIMG32.dllMSVCRT.dllMSVFW32.dllUSER32.dllSkinH_EL.dll1, 0, 6, 6- Skin.dll3W3>