Susp_Dropper (Kaspersky), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: f484ec4c68597848d9621b91018adbda
SHA1: a95dea1797a6c4ef7f6f1ead1e0a717724078972
SHA256: 4540e4e7750c59d1492640a35560eae2da082be731ef8d214ae3abd9c1cd1e08
SSDeep: 49152:ZEvAaaKGd0gGdZlxeFmrgkjYpLq09POreuqoxVeChrNQfYKOrRV7jaKivcJD:aW9dZSeFigHJq6mr/qEVLQf2/ivAD
Size: 3208304 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: ASPackv212, UPolyXv05_v6
Company: Application Installer
Created at: 2015-01-23 11:18:24
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan-PSW. Trojan program intended for stealing users passwords.
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| EmailWorm | Worm can send e-mails. |
Process activity
The Trojan-PSW creates the following process(es):No processes have been created.The Trojan-PSW injects its code into the following process(es):
%original file name%.exe:412
Mutexes
The following mutexes were created/opened:
{1B655094-FE2A-433c-A877-FF9793445069}CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003ZonesLockedCacheCounterMutexZonesCounterMutexZonesCacheCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_RasPbFileShimCacheMutex
File activity
The process %original file name%.exe:412 makes changes in the file system.
The Trojan-PSW creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2[1].jpg (10248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (2261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\reset[1].css (10585 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA6J6JMX.htm (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cd[1].gif (1448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery.min[1].js (30109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.cycle.all.min[1].js (14237 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2024 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2b89_d7fe5f56_eb35_e9fe_8f18_ce641531226b_1[1].jpg (2520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-a[1].js (5500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@changyou[1].txt (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1[1].jpg (10272 bytes)
Registry activity
The process %original file name%.exe:412 makes changes in the system registry.
The Trojan-PSW creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9D C9 E1 6A 24 F9 DC 34 3E 49 F6 62 67 C2 42 78"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan-PSW modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan-PSW modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan-PSW modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan-PSW deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
There are no dropped PE files.
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan-PSW file.
- Delete or disinfect the following files created/modified by the Trojan-PSW:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2[1].jpg (10248 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\index[1].htm (2261 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\reset[1].css (10585 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA6J6JMX.htm (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cd[1].gif (1448 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery.min[1].js (30109 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery.cycle.all.min[1].js (14237 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (2024 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@163[1].txt (169 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\2b89_d7fe5f56_eb35_e9fe_8f18_ce641531226b_1[1].jpg (2520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-a[1].js (5500 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@changyou[1].txt (188 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\1[1].jpg (10272 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: Microsoft? Visual Studio .NET
Product Version: 3.14.12.30
Legal Copyright: ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3.14.12.30
File Description:
Comments: Microsoft Corporation
Language: English (United States)
Company Name: Product Name: Microsoft? Visual Studio .NETProduct Version: 3.14.12.30Legal Copyright: ????Legal Trademarks: Original Filename: Internal Name: File Version: 3.14.12.30File Description: Comments: Microsoft CorporationLanguage: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 2125824 | 915456 | 5.54446 | 3f0cb5a044088dd9379199629a9ba186 |
| .sedata | 2129920 | 1081344 | 815616 | 5.54483 | 2866a1fe1602638ed86de6fb0430a527 |
| .idata | 3211264 | 12288 | 4608 | 5.39475 | 5d4c03e0857fa7de0344f75c8edc01d5 |
| .rsrc | 3223552 | 16384 | 1024 | 1.45781 | 604e4db5568ef26456fc5fa2c8b49d4d |
| .sedata | 3239936 | 4096 | 3072 | 5.16874 | 65a39a2e5a5fb8f6646ec3004fedbf15 |
| .aspack | 3244032 | 20480 | 17408 | 3.9434 | e0e9f4c9b8838a28bd03d246f3469919 |
| .adata | 3264512 | 4096 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://blog.163.com/blog/static/2488610742015423102631147/ | |
| hxxp://aa133051993.blog.163.com/blog/static/2488610742015423102631147/ | 115.238.126.134 |
| mon.changyou.com | 180.149.155.170 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /blog/static/2488610742015423102631147/ HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: aa133051993.blog.163.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 20 Aug 2015 00:47:52 GMT
Content-Type: text/html;charset=GBK
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Set-Cookie: NTESBLOGSI=F3E8123E337C19A557F2842D6DCA0B62.blog2-8010; Domain=.blog.163.com; Path=/
Set-Cookie: usertrack=c 5 hlXVI7iVknvaFWw7Ag==; expires=Fri, 19-Aug-16 00:47:52 GMT; domain=.163.com; path=/
P3P: policyref="/w3c/p3p.xml", CP="CUR ADM OUR NOR STA NID"
501.. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">.. <html xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="zh" lang="zh">.. <head>.. <meta http-equiv="X-UA-Compatible" content="IE=7" />.. <meta http-equiv="content-type" content="text/html;charset=gbk"/>.. <meta http-equiv="content-style-type" content="text/css"/>.. <meta http-equiv="content-script-type" content="text/javascript"/>.. <meta name="version" content="neblog-1.0"/>.. <script type="text/javascript">.. .. .. document.uniqueID!=document.uniqueID&&!!location.hash&&(location.hash=location.hash); .. document.domain = location.hostname.replace(/^.*\.([\w] \.[\w] )$/,'$1');.. window.focus();.. window.getMusicTimeStamp=function(){return 'c12bd902b0cec40e1d7e2cdec3182898';};.. .. //BLOG-647:....OS.............................. (function(){.. window.setTimeout(function(){.. var _loginUserIcon = document.getElementById('loginUserIcon');.. var _rsavatarimg = document.getElementById('rsavatarimg');.. if(!!_loginUserIcon){.. var _loaded1 = false;.. var _img1 = new Image();.. _img1.onload = function(){.. _loaded1..5a8.. = true;.. _img1.onload = null;.. };.. _img1.src = _loginUserIcon.src;.. window.setTimeout(function(){.. if(!_loaded1){..
<<< skipped >>>
Map
The Trojan-PSW connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_412:
.text
.text
`.sedata
`.sedata
h.idata
h.idata
H.rsrc
H.rsrc
@.sedata
@.sedata
@.aspack
@.aspack
`.adata
`.adata
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
t.It It
t.It It
u$SShe
u$SShe
dbghelp.dll
dbghelp.dll
kernel32.dll
kernel32.dll
Mem|LzmaLib.dll
Mem|LzmaLib.dll
LzmaLib_32.dll
LzmaLib_32.dll
ws2_32.dll
ws2_32.dll
shlwapi.dll
shlwapi.dll
Ws2_32.dll
Ws2_32.dll
GetProcessHeap
GetProcessHeap
\Bin\System.cfg
\Bin\System.cfg
\Data\Interface.axp
\Data\Interface.axp
\Bin\data.axp
\Bin\data.axp
.rdata
.rdata
.data
.data
.idata
.idata
.rsrc
.rsrc
.reloc
.reloc
.adata
.adata
>.sLC
>.sLC
%uk>`
%uk>`
3iY#.%s
3iY#.%s
.sa/y,O
.sa/y,O
xp.En
xp.En
Invalid allocation size: %u bytes.
Invalid allocation size: %u bytes.
Client hook allocation failure at file %hs line %d.
Client hook allocation failure at file %hs line %d.
_CrtCheckMemory()
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Allocation too large or negative: %u bytes.
Client hook re-allocation failure at file %hs line %d.
Client hook re-allocation failure at file %hs line %d.
DAMAGE: after %hs block (#%d) at 0xX.
DAMAGE: after %hs block (#%d) at 0xX.
DAMAGE: before %hs block (#%d) at 0xX.
DAMAGE: before %hs block (#%d) at 0xX.
memory check error at 0xX = 0xX, should be 0xX.
memory check error at 0xX = 0xX, should be 0xX.
%hs located at 0xX is %u bytes long.
%hs located at 0xX is %u bytes long.
%hs allocated at file %hs(%d).
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0xX.
DAMAGE: on top of Free block at 0xX.
Bad memory block found at 0xX.
Bad memory block found at 0xX.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
_CrtMemDifference: NULL state pointer.
crt block at 0xX, subtype %x, %u bytes long.
crt block at 0xX, subtype %x, %u bytes long.
normal block at 0xX, %u bytes long.
normal block at 0xX, %u bytes long.
client block at 0xX, subtype %x, %u bytes long.
client block at 0xX, subtype %x, %u bytes long.
%hs(%d) :
%hs(%d) :
#File Error#(%d) :
#File Error#(%d) :
Data: %s
Data: %s
%s(%d) : %s
%s(%d) : %s
_CrtDbgReport: String too long or IO Error
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
Second Chance Assertion Failed: File %s, Line %d
user32.dll
user32.dll
Debug %s!
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
Program: %s%s%s%s%s%s%s%s%s%s%s
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
portuguese-brazilian
portuguese-brazilian
LZMA.dll
LZMA.dll
The procedure entry point %s could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
E:\Lzma465-Good\LzmaLib\Debug\LZMA.pdb
E:\Lzma465-Good\LzmaLib\Debug\LZMA.pdb
LzmaLib.dll
LzmaLib.dll
\Data\Model.axp
\Data\Model.axp
1.yF&p:j
1.yF&p:j
3%cQ:,7k
3%cQ:,7k
.DB$e2&
.DB$e2&
%xB-\B-
%xB-\B-
$0.jCD
$0.jCD
tj%SI
tj%SI
Z\.vM
Z\.vM
K.YJl
K.YJl
\Bin\lpk.dll
\Bin\lpk.dll
\lpk.dll
\lpk.dll
\DirectX9\lpk.dll
\DirectX9\lpk.dll
\Bin\USP10.DLL
\Bin\USP10.DLL
\USP10.DLL
\USP10.DLL
\DirectX9\USP10.DLL
\DirectX9\USP10.DLL
tConfig.exe
tConfig.exe
,WepSpy,WpASpy,WpeSpy.dll,monitor.dll,theworld.dll,tcp-z.dll,dutool.dll,alchemy.dll,cmdial32.dll,cyshock.dll,kUserHook.dll,xiprad.dll
,WepSpy,WpASpy,WpeSpy.dll,monitor.dll,theworld.dll,tcp-z.dll,dutool.dll,alchemy.dll,cmdial32.dll,cyshock.dll,kUserHook.dll,xiprad.dll
,127.0.0.1:
,127.0.0.1:
,1,201,3,1,0,
,1,201,3,1,0,
\Patch\LoginServer.txt
\Patch\LoginServer.txt
Bin\Game.exe
Bin\Game.exe
Function Getcpuid()
Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
getcpuid=cpu.ProcessorId
Getcpuid
Getcpuid
\\.\PhysicalDrive0
\\.\PhysicalDrive0
0.0.0.0
0.0.0.0
127.0.0.1
127.0.0.1
\Bin\Game.log
\Bin\Game.log
profile@game.sohu.com,
profile@game.sohu.com,
,.!-0!/3
,.!-0!/3
DG"FI&CI&?K&=L'>O(?Q)@R*AT*CW-EX.FX-GV*KR&MS"MS#OV)LZ,J].I^1J^4M\5QZ1W_ \c,Y` T^.O`0Lb0Kc1Lc1Ne3Oe4Pf4Rh3Tk4Tm5Tn6Tk8Ti;Ui=Xk;Wm:Xo9Yq9Yr8Yt9Zu:\v9_w7et7ju7nx:g{]v?^w@_wBayBcyBh}@d
DG"FI&CI&?K&=L'>O(?Q)@R*AT*CW-EX.FX-GV*KR&MS"MS#OV)LZ,J].I^1J^4M\5QZ1W_ \c,Y` T^.O`0Lb0Kc1Lc1Ne3Oe4Pf4Rh3Tk4Tm5Tn6Tk8Ti;Ui=Xk;Wm:Xo9Yq9Yr8Yt9Zu:\v9_w7et7ju7nx:g{]v?^w@_wBayBcyBh}@d
j CrT1
j CrT1
anonymous@123.com
anonymous@123.com
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
Y.pon)-m
Y.pon)-m
\%f./1
\%f./1
1F>=.LA:Zk>
1F>=.LA:Zk>
8 . .=}
8 . .=}
8 8 8 8 8..8[=8=}
8 8 8 8 8..8[=8=}
08.[..8 8
08.[..8 8
88=[[..88[8
88=[[..88[8
6588.Sd
6588.Sd
4%uEhZ
4%uEhZ
.JJJT
.JJJT
;; ;; . .2..22}
;; ;; . .2..22}
8),.025>
8),.025>
~?841002?
~?841002?
%d@@9@@:(U
%d@@9@@:(U
?841002?
?841002?
pmc.qUUeqeqo
pmc.qUUeqeqo
)* )* ).5:
)* )* ).5:
, ,,26
, ,,26
--..-..03
--..-..03
}=62/..0=
}=62/..0=
?$)-035>
?$)-035>
2222221
2222221
"("" (""
"("" (""
5>95>...)
5>95>...)
`.@..55-:
`.@..55-:
s.%..%sU
s.%..%sU
;==???
;==???
=??@
=??@
?
?
1111111
1111111
@88//***""#
@88//***""#
78///** #"
78///** #"
""**3376
""**3376
733/*##8
733/*##8
@@
@@
. -((
. -((
15.01.30 - KDD|
15.01.30 - KDD|
t^.cI
t^.cI
?1/)/-&/,&/,%. $-*#.,%0-&. $/,&0-&,)"0-'/,%. $0-&-*#0-&-*#,(!. %/,&.,%.,%0-'0.'0.'0.'0.'0-'0-'0-'0.'0-&/,&/,&/,&. %,)" ( /,%0-'. $. %/-&. $. $/-&.,%/,&/,&/,&,)". $0-'-*#. %/-&. $*&
?1/)/-&/,&/,%. $-*#.,%0-&. $/,&0-&,)"0-'/,%. $0-&-*#0-&-*#,(!. %/,&.,%.,%0-'0.'0.'0.'0.'0-'0-'0-'0.'0-&/,&/,&/,&. %,)" ( /,%0-'. $. %/-&. $. $/-&.,%/,&/,&/,&,)". $0-'-*#. %/-&. $*&
@game.sohu.com
@game.sohu.com
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.2.18
1.2.18
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
ole32.dll
ole32.dll
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
\\.\Scsi0:
\\.\Scsi0:
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
VVV.dywt.com.cn
VVV.dywt.com.cn
x86 Family %s Model %s Stepping %s
x86 Family %s Model %s Stepping %s
X-X-X-X
X-X-X-X
\\.\Smartvsd
\\.\Smartvsd
\\.\PhysicalDrive%d
\\.\PhysicalDrive%d
\\.\Scsi%d:
\\.\Scsi%d:
[%s:%d]
[%s:%d]
Range: bytes=%s-
Range: bytes=%s-
[%s:%d]
[%s:%d]
PASS %s
PASS %s
PASS ******
PASS ******
USER %s
USER %s
E:\e5\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
E:\e5\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
SIZE %s
SIZE %s
PORT
PORT
User-Agent: %s
User-Agent: %s
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Referer: %s
Referer: %s
Host: %s
Host: %s
GET %s HTTP/1.1
GET %s HTTP/1.1
HTTP/1.1
HTTP/1.1
hXXp://
hXXp://
Cookie: %s
Cookie: %s
%d, %s
%d, %s
\\192.168.0.129\TCP\1037
\\192.168.0.129\TCP\1037
NSPlayer/9.0.0.2980; {%s}; Host: %s
NSPlayer/9.0.0.2980; {%s}; Host: %s
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
%s %s %s
%s %s %s
Session: %s
Session: %s
Cseq: %u
Cseq: %u
%*s %s
%*s %s
%*s %u
%*s %u
CSeq: %u
CSeq: %u
rtsp://%s:%i
rtsp://%s:%i
rtsp://%s:%i/%s
rtsp://%s:%i/%s
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
GUID: 00000000-0000-0000-0000-000000000000
GUID: 00000000-0000-0000-0000-000000000000
[%s:%d]
[%s:%d]
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
Range: npt=%s-
Range: npt=%s-
%s/streamid=1
%s/streamid=1
%s/streamid=0
%s/streamid=0
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
If-Match: %s
If-Match: %s
RealChallenge2: %s, sd=%s
RealChallenge2: %s, sd=%s
Title: %s
Title: %s
Copyright: %s
Copyright: %s
Author: %s
Author: %s
real: Content-length for description too big (> %uMB)!
real: Content-length for description too big (> %uMB)!
Require: com.real.retain-entity-for-setup
Require: com.real.retain-entity-for-setup
SupportsMaximumASMBandwidth: 1
SupportsMaximumASMBandwidth: 1
Bandwidth: %u
Bandwidth: %u
Challenge1: %s
Challenge1: %s
hash output: %x %x %x %x
hash output: %x %x %x %x
hash input: %x %x %x %x
hash input: %x %x %x %x
stream=%u;rule=%u,
stream=%u;rule=%u,
Illegal character '%c' in input.
Illegal character '%c' in input.
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
9.oTec
9.oTec
8%Se*E
8%Se*E
ntdll.dll
ntdll.dll
advapi32.dll
advapi32.dll
hid.dll
hid.dll
mscoree.dll
mscoree.dll
mscorwks.dll
mscorwks.dll
mscorsvr.dll
mscorsvr.dll
KernelBase.dll
KernelBase.dll
mscoreei.dll
mscoreei.dll
clr.dll
clr.dll
diasymreader.dll
diasymreader.dll
SEGetNumExecUsed
SEGetNumExecUsed
SEGetNumExecLeft
SEGetNumExecLeft
SESetNumExecUsed
SESetNumExecUsed
SEGetExecTimeUsed
SEGetExecTimeUsed
SEGetExecTimeLeft
SEGetExecTimeLeft
SESetExecTime
SESetExecTime
SEGetTotalExecTimeUsed
SEGetTotalExecTimeUsed
SEGetTotalExecTimeLeft
SEGetTotalExecTimeLeft
SESetTotalExecTime
SESetTotalExecTime
SECheckExecTime
SECheckExecTime
SECheckTotalExecTime
SECheckTotalExecTime
&&&&6666????
&&&&6666????
""""****
""""****
2222::::
2222::::
$$$$\\\\
$$$$\\\\
00006666
00006666
####====
####====
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
PSAPI.DLL
PSAPI.DLL
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
n\JqYQ7%x
n\JqYQ7%x
)Qh%X~
)Qh%X~
..Qe:
..Qe:
Lw%c)
Lw%c)
`tQI%X
`tQI%X
mh%X~
mh%X~
%Fz;Pc
%Fz;Pc
%Fz&=~Y
%Fz&=~Y
&%U|M^
&%U|M^
c.AM (
c.AM (
1).Uk
1).Uk
Id.DB_
Id.DB_
.Rv/ 6
.Rv/ 6
""Â
""Â
m-U}k*
m-U}k*
i.ck~
i.ck~
.lAubH
.lAubH
V.Ss^v)
V.Ss^v)
FtpLK
FtpLK
y:.Vm
y:.Vm
Tly
Tly
&R.ts
&R.ts
%SBb'
%SBb'
4'N.OA
4'N.OA
.PYF`
.PYF`
OmZRG?%Se
OmZRG?%Se
?.Jza
?.Jza
R.Jx7y
R.Jx7y
.LjQ 1
.LjQ 1
WS2_32.dll
WS2_32.dll
OLEAUT32.dll
OLEAUT32.dll
GDI32.dll
GDI32.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
COMCTL32.dll
COMCTL32.dll
RASAPI32.dll
RASAPI32.dll
WININET.dll
WININET.dll
AVIFIL32.dll
AVIFIL32.dll
MSVFW32.dll
MSVFW32.dll
comdlg32.dll
comdlg32.dll
oledlg.dll
oledlg.dll
Safengine Shielden v2.3.3.0
Safengine Shielden v2.3.3.0
GetCPInfo
GetCPInfo
GetWindowsDirectoryA
GetWindowsDirectoryA
WinExec
WinExec
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
CreateDialogIndirectParamA
CreateDialogIndirectParamA
GetKeyState
GetKeyState
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
ShellExecuteA
ShellExecuteA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
rasapi32.dll
rasapi32.dll
winmm.dll
winmm.dll
msvfw32.dll
msvfw32.dll
avifil32.dll
avifil32.dll
gdi32.dll
gdi32.dll
winspool.drv
winspool.drv
shell32.dll
shell32.dll
oleaut32.dll
oleaut32.dll
comctl32.dll
comctl32.dll
wininet.dll
wininet.dll
msvcrt.dll
msvcrt.dll
psapi.dll
psapi.dll
3.14.12.30
3.14.12.30
Microsoft? Visual Studio .NET
Microsoft? Visual Studio .NET
%original file name%.exe_412_rwx_00401000_0030F000:
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
t.It It
t.It It
u$SShe
u$SShe
dbghelp.dll
dbghelp.dll
kernel32.dll
kernel32.dll
Mem|LzmaLib.dll
Mem|LzmaLib.dll
LzmaLib_32.dll
LzmaLib_32.dll
ws2_32.dll
ws2_32.dll
shlwapi.dll
shlwapi.dll
Ws2_32.dll
Ws2_32.dll
GetProcessHeap
GetProcessHeap
\Bin\System.cfg
\Bin\System.cfg
\Data\Interface.axp
\Data\Interface.axp
\Bin\data.axp
\Bin\data.axp
.text
.text
.rdata
.rdata
.data
.data
.idata
.idata
.rsrc
.rsrc
.reloc
.reloc
.adata
.adata
>.sLC
>.sLC
%uk>`
%uk>`
3iY#.%s
3iY#.%s
.sa/y,O
.sa/y,O
xp.En
xp.En
Invalid allocation size: %u bytes.
Invalid allocation size: %u bytes.
Client hook allocation failure at file %hs line %d.
Client hook allocation failure at file %hs line %d.
_CrtCheckMemory()
_CrtCheckMemory()
_CrtIsValidHeapPointer(pUserData)
_CrtIsValidHeapPointer(pUserData)
Allocation too large or negative: %u bytes.
Allocation too large or negative: %u bytes.
Client hook re-allocation failure at file %hs line %d.
Client hook re-allocation failure at file %hs line %d.
DAMAGE: after %hs block (#%d) at 0xX.
DAMAGE: after %hs block (#%d) at 0xX.
DAMAGE: before %hs block (#%d) at 0xX.
DAMAGE: before %hs block (#%d) at 0xX.
memory check error at 0xX = 0xX, should be 0xX.
memory check error at 0xX = 0xX, should be 0xX.
%hs located at 0xX is %u bytes long.
%hs located at 0xX is %u bytes long.
%hs allocated at file %hs(%d).
%hs allocated at file %hs(%d).
DAMAGE: on top of Free block at 0xX.
DAMAGE: on top of Free block at 0xX.
Bad memory block found at 0xX.
Bad memory block found at 0xX.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemCheckPoint: NULL state pointer.
_CrtMemDifference: NULL state pointer.
_CrtMemDifference: NULL state pointer.
crt block at 0xX, subtype %x, %u bytes long.
crt block at 0xX, subtype %x, %u bytes long.
normal block at 0xX, %u bytes long.
normal block at 0xX, %u bytes long.
client block at 0xX, subtype %x, %u bytes long.
client block at 0xX, subtype %x, %u bytes long.
%hs(%d) :
%hs(%d) :
#File Error#(%d) :
#File Error#(%d) :
Data: %s
Data: %s
%s(%d) : %s
%s(%d) : %s
_CrtDbgReport: String too long or IO Error
_CrtDbgReport: String too long or IO Error
Second Chance Assertion Failed: File %s, Line %d
Second Chance Assertion Failed: File %s, Line %d
user32.dll
user32.dll
Debug %s!
Debug %s!
Program: %s%s%s%s%s%s%s%s%s%s%s
Program: %s%s%s%s%s%s%s%s%s%s%s
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
portuguese-brazilian
portuguese-brazilian
LZMA.dll
LZMA.dll
The procedure entry point %s could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
E:\Lzma465-Good\LzmaLib\Debug\LZMA.pdb
E:\Lzma465-Good\LzmaLib\Debug\LZMA.pdb
LzmaLib.dll
LzmaLib.dll
\Data\Model.axp
\Data\Model.axp
1.yF&p:j
1.yF&p:j
3%cQ:,7k
3%cQ:,7k
.DB$e2&
.DB$e2&
%xB-\B-
%xB-\B-
$0.jCD
$0.jCD
tj%SI
tj%SI
Z\.vM
Z\.vM
K.YJl
K.YJl
\Bin\lpk.dll
\Bin\lpk.dll
\lpk.dll
\lpk.dll
\DirectX9\lpk.dll
\DirectX9\lpk.dll
\Bin\USP10.DLL
\Bin\USP10.DLL
\USP10.DLL
\USP10.DLL
\DirectX9\USP10.DLL
\DirectX9\USP10.DLL
tConfig.exe
tConfig.exe
,WepSpy,WpASpy,WpeSpy.dll,monitor.dll,theworld.dll,tcp-z.dll,dutool.dll,alchemy.dll,cmdial32.dll,cyshock.dll,kUserHook.dll,xiprad.dll
,WepSpy,WpASpy,WpeSpy.dll,monitor.dll,theworld.dll,tcp-z.dll,dutool.dll,alchemy.dll,cmdial32.dll,cyshock.dll,kUserHook.dll,xiprad.dll
,127.0.0.1:
,127.0.0.1:
,1,201,3,1,0,
,1,201,3,1,0,
\Patch\LoginServer.txt
\Patch\LoginServer.txt
Bin\Game.exe
Bin\Game.exe
Function Getcpuid()
Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
getcpuid=cpu.ProcessorId
Getcpuid
Getcpuid
\\.\PhysicalDrive0
\\.\PhysicalDrive0
0.0.0.0
0.0.0.0
127.0.0.1
127.0.0.1
\Bin\Game.log
\Bin\Game.log
profile@game.sohu.com,
profile@game.sohu.com,
,.!-0!/3
,.!-0!/3
DG"FI&CI&?K&=L'>O(?Q)@R*AT*CW-EX.FX-GV*KR&MS"MS#OV)LZ,J].I^1J^4M\5QZ1W_ \c,Y` T^.O`0Lb0Kc1Lc1Ne3Oe4Pf4Rh3Tk4Tm5Tn6Tk8Ti;Ui=Xk;Wm:Xo9Yq9Yr8Yt9Zu:\v9_w7et7ju7nx:g{]v?^w@_wBayBcyBh}@d
DG"FI&CI&?K&=L'>O(?Q)@R*AT*CW-EX.FX-GV*KR&MS"MS#OV)LZ,J].I^1J^4M\5QZ1W_ \c,Y` T^.O`0Lb0Kc1Lc1Ne3Oe4Pf4Rh3Tk4Tm5Tn6Tk8Ti;Ui=Xk;Wm:Xo9Yq9Yr8Yt9Zu:\v9_w7et7ju7nx:g{]v?^w@_wBayBcyBh}@d
j CrT1
j CrT1
anonymous@123.com
anonymous@123.com
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
.exe|.rar|.zip|.gif|.jpg|.mp3|.rm
Y.pon)-m
Y.pon)-m
\%f./1
\%f./1
1F>=.LA:Zk>
1F>=.LA:Zk>
8 . .=}
8 . .=}
8 8 8 8 8..8[=8=}
8 8 8 8 8..8[=8=}
08.[..8 8
08.[..8 8
88=[[..88[8
88=[[..88[8
6588.Sd
6588.Sd
4%uEhZ
4%uEhZ
.JJJT
.JJJT
;; ;; . .2..22}
;; ;; . .2..22}
8),.025>
8),.025>
~?841002?
~?841002?
%d@@9@@:(U
%d@@9@@:(U
?841002?
?841002?
pmc.qUUeqeqo
pmc.qUUeqeqo
)* )* ).5:
)* )* ).5:
, ,,26
, ,,26
--..-..03
--..-..03
}=62/..0=
}=62/..0=
?$)-035>
?$)-035>
2222221
2222221
"("" (""
"("" (""
5>95>...)
5>95>...)
`.@..55-:
`.@..55-:
s.%..%sU
s.%..%sU
;==???
;==???
=??@
=??@
?
?
1111111
1111111
@88//***""#
@88//***""#
78///** #"
78///** #"
""**3376
""**3376
733/*##8
733/*##8
@@
@@
. -((
. -((
15.01.30 - KDD|
15.01.30 - KDD|
t^.cI
t^.cI
?1/)/-&/,&/,%. $-*#.,%0-&. $/,&0-&,)"0-'/,%. $0-&-*#0-&-*#,(!. %/,&.,%.,%0-'0.'0.'0.'0.'0-'0-'0-'0.'0-&/,&/,&/,&. %,)" ( /,%0-'. $. %/-&. $. $/-&.,%/,&/,&/,&,)". $0-'-*#. %/-&. $*&
?1/)/-&/,&/,%. $-*#.,%0-&. $/,&0-&,)"0-'/,%. $0-&-*#0-&-*#,(!. %/,&.,%.,%0-'0.'0.'0.'0.'0-'0-'0-'0.'0-&/,&/,&/,&. %,)" ( /,%0-'. $. %/-&. $. $/-&.,%/,&/,&/,&,)". $0-'-*#. %/-&. $*&
@game.sohu.com
@game.sohu.com
%d&&'
%d&&'
123456789
123456789
00003333
00003333
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
1.2.18
1.2.18
%*.*f
%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
ole32.dll
ole32.dll
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
VERSION.dll
VERSION.dll
.PAVCException@@
.PAVCException@@
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
.PAVCFileException@@
.PAVCFileException@@
: %d]
: %d]
(*.*)|*.*||
(*.*)|*.*||
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|PNG
(*.JPG)|*.JPG|PNG
(*.PNG)|*.PNG|BMP
(*.PNG)|*.PNG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
\\.\Scsi0:
\\.\Scsi0:
%s:%d
%s:%d
windows
windows
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
out.prn
out.prn
(*.prn)|*.prn|
(*.prn)|*.prn|
%d.%d
%d.%d
%d/%d
%d/%d
1.6.9
1.6.9
unsupported zlib version
unsupported zlib version
png_read_image: unsupported transformation
png_read_image: unsupported transformation
%d / %d
%d / %d
Bogus message code %d
Bogus message code %d
libpng error: %s
libpng error: %s
libpng warning: %s
libpng warning: %s
1.1.3
1.1.3
bad keyword
bad keyword
libpng does not support gamma background rgb_to_gray
libpng does not support gamma background rgb_to_gray
Palette is NULL in indexed image
Palette is NULL in indexed image
(%d-%d):
(%d-%d):
%ld%c
%ld%c
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
VVV.dywt.com.cn
VVV.dywt.com.cn
x86 Family %s Model %s Stepping %s
x86 Family %s Model %s Stepping %s
X-X-X-X
X-X-X-X
\\.\Smartvsd
\\.\Smartvsd
\\.\PhysicalDrive%d
\\.\PhysicalDrive%d
\\.\Scsi%d:
\\.\Scsi%d:
[%s:%d]
[%s:%d]
Range: bytes=%s-
Range: bytes=%s-
[%s:%d]
[%s:%d]
PASS %s
PASS %s
PASS ******
PASS ******
USER %s
USER %s
E:\e5\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
E:\e5\dev\e\static_link\static_libs\source\downlib\mystrlib.cpp
SIZE %s
SIZE %s
PORT
PORT
User-Agent: %s
User-Agent: %s
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)
Referer: %s
Referer: %s
Host: %s
Host: %s
GET %s HTTP/1.1
GET %s HTTP/1.1
HTTP/1.1
HTTP/1.1
hXXp://
hXXp://
Cookie: %s
Cookie: %s
%d, %s
%d, %s
\\192.168.0.129\TCP\1037
\\192.168.0.129\TCP\1037
NSPlayer/9.0.0.2980; {%s}; Host: %s
NSPlayer/9.0.0.2980; {%s}; Host: %s
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.size=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming data.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: assuming prop.num_packets=%i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: setting prop.data_offset from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.num_streams from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
rmff_fix_header: correcting prop.size from %i to %i
%s %s %s
%s %s %s
Session: %s
Session: %s
Cseq: %u
Cseq: %u
%*s %s
%*s %s
%*s %u
%*s %u
CSeq: %u
CSeq: %u
rtsp://%s:%i
rtsp://%s:%i
rtsp://%s:%i/%s
rtsp://%s:%i/%s
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
ClientID: Linux_2.4_6.0.9.1235_play32_RN01_EN_586
GUID: 00000000-0000-0000-0000-000000000000
GUID: 00000000-0000-0000-0000-000000000000
[%s:%d]
[%s:%d]
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
User-Agent: RealMedia Player Version 6.0.9.1235 (linux-2.0-libc6-i386-gcc2.95)
Range: npt=%s-
Range: npt=%s-
%s/streamid=1
%s/streamid=1
%s/streamid=0
%s/streamid=0
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
Transport: x-pn-tng/tcp;mode=play,rtp/avp/tcp;unicast;mode=play
If-Match: %s
If-Match: %s
RealChallenge2: %s, sd=%s
RealChallenge2: %s, sd=%s
Title: %s
Title: %s
Copyright: %s
Copyright: %s
Author: %s
Author: %s
real: Content-length for description too big (> %uMB)!
real: Content-length for description too big (> %uMB)!
Require: com.real.retain-entity-for-setup
Require: com.real.retain-entity-for-setup
SupportsMaximumASMBandwidth: 1
SupportsMaximumASMBandwidth: 1
Bandwidth: %u
Bandwidth: %u
Challenge1: %s
Challenge1: %s
hash output: %x %x %x %x
hash output: %x %x %x %x
hash input: %x %x %x %x
hash input: %x %x %x %x
stream=%u;rule=%u,
stream=%u;rule=%u,
Illegal character '%c' in input.
Illegal character '%c' in input.
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
(*.avi)|*.avi
(*.avi)|*.avi
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
.PAVCOleException@@
.PAVCOleException@@
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
c:\%original file name%.exe
c:\%original file name%.exe
9.oTec
9.oTec
8%Se*E
8%Se*E
ntdll.dll
ntdll.dll
advapi32.dll
advapi32.dll
hid.dll
hid.dll
mscoree.dll
mscoree.dll
mscorwks.dll
mscorwks.dll
mscorsvr.dll
mscorsvr.dll
KernelBase.dll
KernelBase.dll
mscoreei.dll
mscoreei.dll
clr.dll
clr.dll
diasymreader.dll
diasymreader.dll
SEGetNumExecUsed
SEGetNumExecUsed
SEGetNumExecLeft
SEGetNumExecLeft
SESetNumExecUsed
SESetNumExecUsed
SEGetExecTimeUsed
SEGetExecTimeUsed
SEGetExecTimeLeft
SEGetExecTimeLeft
SESetExecTime
SESetExecTime
SEGetTotalExecTimeUsed
SEGetTotalExecTimeUsed
SEGetTotalExecTimeLeft
SEGetTotalExecTimeLeft
SESetTotalExecTime
SESetTotalExecTime
SECheckExecTime
SECheckExecTime
SECheckTotalExecTime
SECheckTotalExecTime
&&&&6666????
&&&&6666????
""""****
""""****
2222::::
2222::::
$$$$\\\\
$$$$\\\\
00006666
00006666
####====
####====
MSVCRT.dll
MSVCRT.dll
IPHLPAPI.DLL
IPHLPAPI.DLL
PSAPI.DLL
PSAPI.DLL
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
n\JqYQ7%x
n\JqYQ7%x
)Qh%X~
)Qh%X~
..Qe:
..Qe:
Lw%c)
Lw%c)
`tQI%X
`tQI%X
mh%X~
mh%X~
%Fz;Pc
%Fz;Pc
%Fz&=~Y
%Fz&=~Y
&%U|M^
&%U|M^
c.AM (
c.AM (
1).Uk
1).Uk
Id.DB_
Id.DB_
.Rv/ 6
.Rv/ 6
""Â
""Â
m-U}k*
m-U}k*
i.ck~
i.ck~
.lAubH
.lAubH
V.Ss^v)
V.Ss^v)
FtpLK
FtpLK
y:.Vm
y:.Vm
Tly
Tly
&R.ts
&R.ts
%SBb'
%SBb'
4'N.OA
4'N.OA
.PYF`
.PYF`
OmZRG?%Se
OmZRG?%Se
?.Jza
?.Jza
R.Jx7y
R.Jx7y
.LjQ 1
.LjQ 1
WS2_32.dll
WS2_32.dll
OLEAUT32.dll
OLEAUT32.dll
GDI32.dll
GDI32.dll
WINMM.dll
WINMM.dll
WINSPOOL.DRV
WINSPOOL.DRV
COMCTL32.dll
COMCTL32.dll
RASAPI32.dll
RASAPI32.dll
WININET.dll
WININET.dll
AVIFIL32.dll
AVIFIL32.dll
MSVFW32.dll
MSVFW32.dll
comdlg32.dll
comdlg32.dll
oledlg.dll
oledlg.dll
Safengine Shielden v2.3.3.0
Safengine Shielden v2.3.3.0
%original file name%.exe_412_rwx_00718000_00002000:
kernel32.dll
kernel32.dll
user32.dll
user32.dll
The procedure entry point %s could not be located in the dynamic link library %s
The procedure entry point %s could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
The ordinal %u could not be located in the dynamic link library %s
rasapi32.dll
rasapi32.dll
winmm.dll
winmm.dll
ws2_32.dll
ws2_32.dll
msvfw32.dll
msvfw32.dll
avifil32.dll
avifil32.dll
gdi32.dll
gdi32.dll
winspool.drv
winspool.drv
comdlg32.dll
comdlg32.dll
advapi32.dll
advapi32.dll
shell32.dll
shell32.dll
ole32.dll
ole32.dll
oleaut32.dll
oleaut32.dll
comctl32.dll
comctl32.dll
oledlg.dll
oledlg.dll
wininet.dll
wininet.dll
msvcrt.dll
msvcrt.dll
iphlpapi.dll
iphlpapi.dll
psapi.dll
psapi.dll
RegCreateKeyExA
RegCreateKeyExA
3.14.12.30
3.14.12.30
Microsoft? Visual Studio .NET
Microsoft? Visual Studio .NET