Trojan.Win32.FlyStudio_d5daa0b13a – Adaware

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:652

Mutexes

The following mutexes were created/opened:

ZonesCacheCounterMutexZonesLockedCacheCounterMutexZonesCounterMutexWininetProxyRegistryMutexWininetConnectionMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!___DDrawCheckExclMode____DDrawExclMode__DDrawWindowListMutexDDrawDriverObjectListMutexRasPbFileShimCacheMutex

File activity

The process %original file name%.exe:652 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4820 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[2].txt (707 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[2].txt (0 bytes)

Registry activity

The process %original file name%.exe:652 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1416852656"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 FC AC 63 59 1F D4 DF B5 73 80 76 EC FC 33 4B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1276x846x32(BGR 0)" = "31,31,31,31"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[1].txt (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (4820 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@baidu[2].txt (707 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: ?????
Product Version: 1.0.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ?????
Comments: ??????????(http://www.eyuyan.com)
Language: Language Neutral

Company Name: Product Name: ?????Product Version: 1.0.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ?????Comments: ??????????(http://www.eyuyan.com)Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	1658880	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	1662976	1298432	1298432	5.44347	f3f626f8c5b67bbd1a3498fc774439ab
.rsrc	2961408	368640	368640	2.53863	b89c0c6b647e6e784573992e6a04a63d

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.a.shifen.com/
hxxp://hi.n.shifen.com/jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d
hxxp://feb6c18be9948571a829a023220be53a.360wzb.cn/JYECFF/JY-VIP-EC.txt
hxxp://hi.n.shifen.com/index.html
hxxp://www.160bc.com/jyecff/jy-vip-ec.txt	125.88.190.24
hxxp://hi.baidu.com/index.html	111.13.12.63
hxxp://hi.baidu.com/jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d	111.13.12.63
hxxp://www.160bc.com/JYECFF/JY-VIP-EC.txt	125.88.190.24
hxxp://www.baidu.com/

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /index.html HTTP/1.1

Cookie: BAIDUID=1938F04A66D7F33FEAD61ED1F92DFC51:FG=1; BIDUPSID=1938F04A66D7F33FEAD61ED1F92DFC51; PSTM=1433811381;

Referer: hXXp://hi.baidu.com/jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d

Accept: */*

Accept-Language: zh-cn

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Host: hi.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

ETag: "187268915"

Accept-Ranges: bytes

Last-Modified: Thu, 07 May 2015 08:37:16 GMT

Content-Length: 2964

Connection: close

Date: Tue, 09 Jun 2015 00:56:24 GMT

Server: apache

<!DOCTYPE html>.<html>.<head>. <title>......_............</title>. <meta http-equiv=Content-Type content="text/html; charset=utf-8">. <link rel="shortcut icon" href="hXXp://hi.bdimg.com/static/qbase/img/mod/16_favicon.ico?v=116ba471.ico" type=image/x-icon>. <meta name=viewport content="user-scalable=no, width=764px, minimum-scale=1.0, maximum-scale=1.0">. <link href="css/index.css" type=text/css rel=stylesheet>.</head>.<body>. <div class="box">. . <div class="headerBox">. <div class="header">. <a href="hXXp://hi.baidu.com" class="logoBox">. <span id="baiduSpaceLogo" class="qLogo"></span>. </a>.. <a class="ask" target="_blank" href="hXXp://qingting.baidu.com/index?pid=26">............</a>. </div>. </div>.. . <div class="main">. <div class="mainTop">. <div class="mainBody">. <div class="content">. <h1 class="postTitle">.................................</h3>. <p><span class="black">...</span>...........................................................................................................................................................................

<<< skipped >>>

GET /index.html HTTP/1.1

Cookie: BAIDUID=1938F04A66D7F33FEAD61ED1F92DFC51:FG=1; BIDUPSID=1938F04A66D7F33FEAD61ED1F92DFC51; PSTM=1433811381;

Referer: hXXp://hi.baidu.com/jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d

Accept: */*

Accept-Language: zh-cn

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Host: hi.baidu.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

ETag: "187269078"

Accept-Ranges: bytes

Last-Modified: Thu, 07 May 2015 08:37:23 GMT

Content-Length: 2964

Connection: close

Date: Tue, 09 Jun 2015 00:56:23 GMT

Server: apache

<!DOCTYPE html>.<html>.<head>. <title>......_............</title>. <meta http-equiv=Content-Type content="text/html; charset=utf-8">. <link rel="shortcut icon" href="hXXp://hi.bdimg.com/static/qbase/img/mod/16_favicon.ico?v=116ba471.ico" type=image/x-icon>. <meta name=viewport content="user-scalable=no, width=764px, minimum-scale=1.0, maximum-scale=1.0">. <link href="css/index.css" type=text/css rel=stylesheet>.</head>.<body>. <div class="box">. . <div class="headerBox">. <div class="header">. <a href="hXXp://hi.baidu.com" class="logoBox">. <span id="baiduSpaceLogo" class="qLogo"></span>. </a>.. <a class="ask" target="_blank" href="hXXp://qingting.baidu.com/index?pid=26">............</a>. </div>. </div>.. . <div class="main">. <div class="mainTop">. <div class="mainBody">. <div class="content">. <h1 class="postTitle">.................................</h3>. <p><span class="black">...</span>...........................................................................................................................................................................

<<< skipped >>>

GET /jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d HTTP/1.1

Cookie: BAIDUID=1938F04A66D7F33FEAD61ED1F92DFC51:FG=1; BIDUPSID=1938F04A66D7F33FEAD61ED1F92DFC51; PSTM=1433811381;

Referer: hXXp://hi.baidu.com/jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d

Accept: */*

Accept-Language: zh-cn

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Type: application/x-www-form-urlencoded

Host: hi.baidu.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXp://hi.baidu.com/index.html

Connection: close

Date: Tue, 09 Jun 2015 00:56:23 GMT

Server: apache

GET /jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d HTTP/1.1

Cookie: BAIDUID=1938F04A66D7F33FEAD61ED1F92DFC51:FG=1; BIDUPSID=1938F04A66D7F33FEAD61ED1F92DFC51; PSTM=1433811381;

Referer: hXXp://hi.baidu.com/jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d

Accept: */*

Accept-Language: zh-cn

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Type: application/x-www-form-urlencoded

Host: hi.baidu.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXp://hi.baidu.com/index.html

Connection: close

Date: Tue, 09 Jun 2015 00:56:22 GMT

Server: apache

GET /JYECFF/JY-VIP-EC.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.160bc.com

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Server: nginx

Date: Tue, 09 Jun 2015 00:56:23 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

Location: hXXp://VVV.160bc.com/jyecff/jy-vip-ec.txt

X-Powered-By: ASP.NET

a4..<head><title>...............</title></head>.<body><h1>...............</h1>......<a HREF="http://VVV.160bc.com/jyecff/jy-vip-ec.txt">......</a>...............</body>..0......

GET /jyecff/jy-vip-ec.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.160bc.com

Cache-Control: no-cache

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Server: nginx

Date: Tue, 09 Jun 2015 00:56:23 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By-360WZB: wangzhan.360.cn

X-Powered-By: ASP.NET

48b..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=gb2312"/>..<title>404 - ..................</title>..<style type="text/css">....</style>..</head>..<body>..<div id="header"><h1>..........</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - ..................</h2>.. <h3>......................................................</h3>.. </fieldset></div>..</div>..</body>..</html>..0..HTTP/1.1 404 Not Found..Server: nginx..Date: Tue, 09 Jun 2015 00:56:23 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..X-Powered-By-360WZB: wangzhan.360.cn..X-Powered-By

<<< skipped >>>

GET / HTTP/1.1

User-Agent: test

Host: VVV.baidu.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 09 Jun 2015 00:56:21 GMT

Content-Type: text/html

Content-Length: 14613

Last-Modified: Wed, 03 Sep 2014 02:48:32 GMT

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=1938F04A66D7F33FEAD61ED1F92DFC51:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=1938F04A66D7F33FEAD61ED1F92DFC51; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: PSTM=1433811381; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BDSVRTM=0; path=/

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

Pragma: no-cache

Cache-control: no-cache

BDPAGETYPE: 1

BDQID: 0xabac3a170000974b

BDUSERID: 0

Accept-Ranges: bytes

<!DOCTYPE html>..<html>..<head>...<meta http-equiv="content-type" content="text/html;charset=utf-8">...<meta http-equiv="X-UA-Compatible" content="IE=Edge">...<link rel="dns-prefetch" href="//s1.bdstatic.com"/>...<link rel="dns-prefetch" href="//t1.baidu.com"/>...<link rel="dns-prefetch" href="//t2.baidu.com"/>...<link rel="dns-prefetch" href="//t3.baidu.com"/>...<link rel="dns-prefetch" href="//t10.baidu.com"/>...<link rel="dns-prefetch" href="//t11.baidu.com"/>...<link rel="dns-prefetch" href="//t12.baidu.com"/>...<link rel="dns-prefetch" href="//b1.bdstatic.com"/>...<title>...........................</title>...<link href="hXXp://s1.bdstatic.com/r/www/cache/static/home/css/index.css" rel="stylesheet" type="text/css" />.........<script>var hashMatch = document.location.href.match(/# (.*wd=[^&]. )/);if (hashMatch && hashMatch[0] && hashMatch[1]) {document.location.replace("hXXp://" location.host "/s?" hashMatch[1]);}var ns_c = function(){};</script>...<script>function h(obj){obj.style.behavior='url(#default#homepage)';var a = obj.setHomePage('//VVV.baidu.com/');}</script>...<noscript><meta http-equiv="refresh" conte

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_652:

`.rsrc

t$(SSh

~%UVW

u$SShe

user32.dll

ole32.dll

gzip.dll

WinINet.dll

wininet.dll

kernel32.dll

MsgWaitForMultipleObjects

ShellExecuteA

WinExec

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

youku.com

hXXp://hwuliao.com/y_iframe?vc=1&u=

?hXXp://hi.baidu.com/jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d

Wp.Iw

A.zkt@

5p|%U

Ã¹'p

oO.wm]b

L.qg6

ce_%D

%C@0H

@s .sk5

.njvX

ANH.aQ

;%c&!

\.HH^

*$:%d

%xYs]

[.PX{p

D0.cSxu

.NNR'

7J.yT

%XQn@

rz.yIL

EcT%x#

W.XZ~

..Xc&

2u.eKITFBp

.yk (Di

D.gbQP

GBj%c

}&-4}v

%s;7*

0%x@w

%C^L:

Ã•6m*

ccu.md!dd

f%.Vy

5r.KV}b

5.ch*

y.MMO}

tn!ay%F

2.kKX

I %d)

.aEd(

fTpe

.LLbX

hXXp://hwuliao.com/y_iframe?vc=3&u=

0.0.6.3

hXXp://VVV.youku.com/v_feelist#

hXXp://hwuliao.com/y_iframe?vc=2&u=

hXXp://hwuliao.com/y_iframe?vc=4&u=

.data

Speed.data

taskkill /f /im WScript.exe

function time(){return new Date().getTime()}

WinHttp.WinHttpRequest.5.1

MSXML2.ServerXMLHTTP.6.0

MSXML2.ServerXMLHTTP.5.0

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Type: application/x-www-form-urlencoded

i

) a[i] = ("00" str.charCodeAt(i ).toString(16)).slice(-4);

return "\\u" a.join("\\u");

return unescape(str.replace(/\\/g, "%"));

) a[i] = str.charCodeAt(i );

return "" a.join(";") ";";

return str.replace(/(x)?([^&]{1,5});?/g, function (a, b, c) {

return String.fromCharCode(parseInt(c,b?16:10));

this.add=function (key,value){

if(typeof(key)!="undefined"){

if(this.contains(key)==false){

this._hash[key]=typeof(value)=="undefined"?null:value;

this.remove=function (key){delete this._hash[key];};

this.count=function (){var i=0;for(var k in this._hash){i ;};return i;};

this.items=function (key){return this._hash[key];};

this.contains=function (key){return typeof(this._hash[key])!="undefined";};

this.clear=function (){for(var k in this._hash){delete this._hash[k];};};

this.str2hashtable=function (key,cs){

var _key=key.split(/,/g);

for(var i in _key){

_hash.add(_key[i]);

_hash.add((_key[i] "").toLowerCase());

this._blockElement=this.str2hashtable("switch,if,while,try,finally");

this._function=this.str2hashtable("function");

this._choiceElement=this.str2hashtable("else,catch");

this._singleEyeElement=this.str2hashtable("var,new,return,else,delete,in,case");

this._quotation=this.str2hashtable("\",'");

this.isCompress=false;

this.style=0;

this.format=function (){

if(this.isCompress){

for(var i=0;i

if(this._wordDelimiters.indexOf(this._codetxt.charAt(i))==-1){

codeArr[word_index] =this._codetxt.charAt(i);

if(typeof(codeArr[word_index])!='undefined'&&codeArr[word_index].length>0)

codeArr[word_index ]=this._codetxt.charAt(i);

if(typeof(codeArr[i])=="undefined"||codeArr[i].length==0){

htmlTxt[htmlTxt.length]=codeArr[i];

if(!this.isCompress){

htmlTxt[htmlTxt.length]="\r" this.getIdent();

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isFunction(codeArr[i])){

htmlTxt[htmlTxt.length]=codeArr[i] " ";

htmlTxt[htmlTxt.length]=codeArr[i] "\r\n" this.getIdent();

htmlTxt[htmlTxt.length]=codeArr[i] this.getIdent();

switch(this.style){

htmlTxt[htmlTxt.length]="\r\n" this.getIdent();

htmlTxt[htmlTxt.length]="\r\n" this.getIdent() codeArr[i];

htmlTxt[htmlTxt.length]=codeArr[i] this._rowEnd;

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isBlockElement(codeArr[i])){

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isSingleEyeElement(codeArr[i])){

htmlTxt[htmlTxt.length]=" ";

};else if(!slash_star_comment_opened&&!slash_slash_comment_opened&&this._quotation.contains(codeArr[i])){

if(codeArr[i 1].charCodeAt(0)>=32&&codeArr[i 1].charCodeAt(0)

htmlTxt[htmlTxt.length]=codeArr[i 1].substr(0,1);

htmlTxt[htmlTxt.length]=codeArr[i 1].substr(1);

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isStartWith(this._commentOn,codeArr,i)){

htmlTxt[htmlTxt.length]=this._commentOn;

i=i this.getSkipLength(this._commentOn);

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isStartWith(this._lineComment,codeArr,i)){

htmlTxt[htmlTxt.length]=this._lineComment;

i=i this.getSkipLength(this._lineComment);

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isStartWith(this._ignore,codeArr,i)){

htmlTxt[htmlTxt.length]=this._ignore;

i=i this.getSkipLength(this._ignore);

};else if(!quote_opened&&!slash_slash_comment_opened&&this.isStartWith(this._commentOff,codeArr,i)){

htmlTxt[htmlTxt.length]=this._commentOff;

i=i this.getSkipLength(this._commentOff);

return htmlTxt.join("");

this.isStartWith=function (str,code,index){

if(typeof(str)!="undefined"&&str.length>0){

for(var i=index;i

cc[cc.length]=code[i];

var c=cc.join("");

if(str.length>=code[index].length&&c.indexOf(str)==0){

if(str.length>=code[index].length&&c.toLowerCase().indexOf(str.toLowerCase())==0){

this.isFunction=function (val){

return this._function.contains(this._caseSensitive?val:val.toLowerCase());

this.isBlockElement=function (val){

return this._blockElement.contains(this._caseSensitive?val:val.toLowerCase());

this.isChoiceElement=function (val){

return this._choiceElement.contains(this._caseSensitive?val:val.toLowerCase());

this.isSingleEyeElement=function (val){

return this._singleEyeElement.contains(this._caseSensitive?val:val.toLowerCase());

this.isNextElement=function (from,word){

for(var i=from;i

return this.isChoiceElement(word[i]);

this.getSkipLength=function (val){

for(var i=0;i

if(this._wordDelimiters.indexOf(val.charAt(i))>=0){

this.getIdent=function (){

n[n.length]="\t";

return n.join("");

switch(o.tagName){

_codetxt=o.value;

_codetxt=o.innerText;

_codetxt=o.innerHTML;

htmltxt=_syn.format();

xx.isCompress=true;

xx.style=value;

return xx.format();

new Date().getTime()

Math.random()

hXXps://

hXXp://

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\cookies

\*.txt

Adodb.Stream

0@hXXp://pv.sohu.com/cityjson?ie=gb2312

hXXp://VVV.ip138.com/ips1388.asp

##% # # #

%""""%""""

"%%%"%"%%%

#""%"%%)

%"""%"%""%

"%%"%""%

%"%%"%"%"%

%""%"%"%

%"%"%"%*

/**%%%%{

# # %%*7

VVV.meitu.com

<.ak9>

fUrl

%d&&'

123456789

00003333

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

SHLWAPI.dll

MPR.dll

VERSION.dll

WSOCK32.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

(*.htm;*.html)|*.htm;*.html

VVV.dywt.com.cn

hXXp://VVV.baidu.com

;3 #>6.&

'2, / 0&7!4-)1#

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

\shell32.dll

glViewport

glTexEnvfv

glTexEnvf

\glu32.dll

\Opengl32.dll

glPassThrough

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

RST%d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

Obtained EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Arithmetic table 0xx was not defined

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC index %d

Unsupported color conversion request

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

DCT scaled block size %dx%d not supported

Invalid component ID %d in SOS

1.0.6

%s: Write error at scanline %lu

%s: Seek error at scanline %lu

%s: Cannot modify tag "%s" while writing

%s: Unknown %stag %u

Internal error, unknown tag 0x%x

%s compression support is not configured

?%s: No space for LogLuv state block

Inappropriate photometric interpretation %d for SGILog compression; %s

LogL16Decode: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

%s: No space for SGILog translation buffer

No support for converting user data format to LogL

No support for converting user data format to LogLuv

SGILog compression supported only for %s, or raw data

Unknown data format %d for LogLuv compression

Unknown encoding %d for LogLuv compression

%s: No space for state block

%s: Bad code word at scanline %d (x %lu)

%s: %s at scanline %d (got %lu, expected %lu)

%s: Premature EOF at scanline %d (x %lu)

%s: No space for Group 3/4 reference line

%s: No space for Group 3/4 run arrays

%s: Uncompressed data (not supported) at scanline %d (x %lu)

Fax SubAddress: %s

(%u = 0x%x)

%suncompressed data

%sEOL padding

%s2-d encoding

Improper JPEG sampling factors %d,%d

Apparently should be %d,%d,decompressor will try reading with sampling %d,%d

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

RowsPerStrip must be multiple of %d for JPEG

JPEG tile width must be multiple of %d

JPEG tile height must be multiple of %d

BitsPerSample %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

ThunderDecode: %s data at scanline %ld (%lu != %lu)

PackBitsDecode: discarding %d bytes to avoid buffer overrun

LZWDecode: Not enough data at scanline %d (short %d bytes)

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

DumpModeDecode: Not enough data for scanline %d

Horizontal differencing "Predictor" not supported with %d-bit samples

"Predictor" value %d not supported

%u (0x%x)

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

GetCPInfo

GetProcessHeap

RegOpenKeyExA

RegCreateKeyExA

RegCloseKey

GetViewportExtEx

GetViewportOrgEx

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

GetKeyState

SetWindowsHookExA

CreateDialogIndirectParamA

UnhookWindowsHookEx

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

InternetOpenUrlA

.text

`.rdata

@.data

'UrlA3lZ

ADVAPI32.dll

comdlg32.dll

OLEAUT32.dll

oledlg.dll

RASAPI32.dll

SHELL32.dll

WININET.dll

WINMM.dll

WINSPOOL.DRV

WS2_32.dll

1, 0, 6, 6

- Skin.dll

(*.*)

1.0.0.0

(hXXp://VVV.eyuyan.com)

%original file name%.exe_652_rwx_00401000_002D1000:

t$(SSh

~%UVW

u$SShe

user32.dll

ole32.dll

gzip.dll

WinINet.dll

wininet.dll

kernel32.dll

MsgWaitForMultipleObjects

ShellExecuteA

WinExec

.rsrc

%S4WD

hg%fpM

S.Ac9SR

0.I%3s

,wAe.kI

aiUy'4xu

%c*@j

.eH'y

{&%U)

lj%4U

xe%CNs

9F.cLe

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

youku.com

hXXp://hwuliao.com/y_iframe?vc=1&u=

?hXXp://hi.baidu.com/jtwzxpbjsvbakzd/item/a83d14ed57670aaace2d4f5d

Wp.Iw

A.zkt@

5p|%U

Ã¹'p

oO.wm]b

L.qg6

ce_%D

%C@0H

@s .sk5

.njvX

ANH.aQ

;%c&!

\.HH^

*$:%d

%xYs]

[.PX{p

D0.cSxu

.NNR'

7J.yT

%XQn@

rz.yIL

EcT%x#

W.XZ~

..Xc&

2u.eKITFBp

.yk (Di

D.gbQP

GBj%c

}&-4}v

%s;7*

0%x@w

%C^L:

Ã•6m*

ccu.md!dd

f%.Vy

5r.KV}b

5.ch*

y.MMO}

tn!ay%F

2.kKX

I %d)

.aEd(

fTpe

.LLbX

hXXp://hwuliao.com/y_iframe?vc=3&u=

0.0.6.3

hXXp://VVV.youku.com/v_feelist#

hXXp://hwuliao.com/y_iframe?vc=2&u=

hXXp://hwuliao.com/y_iframe?vc=4&u=

.data

Speed.data

taskkill /f /im WScript.exe

function time(){return new Date().getTime()}

WinHttp.WinHttpRequest.5.1

MSXML2.ServerXMLHTTP.6.0

MSXML2.ServerXMLHTTP.5.0

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)

Content-Type: application/x-www-form-urlencoded

i

) a[i] = ("00" str.charCodeAt(i ).toString(16)).slice(-4);

return "\\u" a.join("\\u");

return unescape(str.replace(/\\/g, "%"));

) a[i] = str.charCodeAt(i );

return "" a.join(";") ";";

return str.replace(/(x)?([^&]{1,5});?/g, function (a, b, c) {

return String.fromCharCode(parseInt(c,b?16:10));

this.add=function (key,value){

if(typeof(key)!="undefined"){

if(this.contains(key)==false){

this._hash[key]=typeof(value)=="undefined"?null:value;

this.remove=function (key){delete this._hash[key];};

this.count=function (){var i=0;for(var k in this._hash){i ;};return i;};

this.items=function (key){return this._hash[key];};

this.contains=function (key){return typeof(this._hash[key])!="undefined";};

this.clear=function (){for(var k in this._hash){delete this._hash[k];};};

this.str2hashtable=function (key,cs){

var _key=key.split(/,/g);

for(var i in _key){

_hash.add(_key[i]);

_hash.add((_key[i] "").toLowerCase());

this._blockElement=this.str2hashtable("switch,if,while,try,finally");

this._function=this.str2hashtable("function");

this._choiceElement=this.str2hashtable("else,catch");

this._singleEyeElement=this.str2hashtable("var,new,return,else,delete,in,case");

this._quotation=this.str2hashtable("\",'");

this.isCompress=false;

this.style=0;

this.format=function (){

if(this.isCompress){

for(var i=0;i

if(this._wordDelimiters.indexOf(this._codetxt.charAt(i))==-1){

codeArr[word_index] =this._codetxt.charAt(i);

if(typeof(codeArr[word_index])!='undefined'&&codeArr[word_index].length>0)

codeArr[word_index ]=this._codetxt.charAt(i);

if(typeof(codeArr[i])=="undefined"||codeArr[i].length==0){

htmlTxt[htmlTxt.length]=codeArr[i];

if(!this.isCompress){

htmlTxt[htmlTxt.length]="\r" this.getIdent();

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isFunction(codeArr[i])){

htmlTxt[htmlTxt.length]=codeArr[i] " ";

htmlTxt[htmlTxt.length]=codeArr[i] "\r\n" this.getIdent();

htmlTxt[htmlTxt.length]=codeArr[i] this.getIdent();

switch(this.style){

htmlTxt[htmlTxt.length]="\r\n" this.getIdent();

htmlTxt[htmlTxt.length]="\r\n" this.getIdent() codeArr[i];

htmlTxt[htmlTxt.length]=codeArr[i] this._rowEnd;

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isBlockElement(codeArr[i])){

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isSingleEyeElement(codeArr[i])){

htmlTxt[htmlTxt.length]=" ";

};else if(!slash_star_comment_opened&&!slash_slash_comment_opened&&this._quotation.contains(codeArr[i])){

if(codeArr[i 1].charCodeAt(0)>=32&&codeArr[i 1].charCodeAt(0)

htmlTxt[htmlTxt.length]=codeArr[i 1].substr(0,1);

htmlTxt[htmlTxt.length]=codeArr[i 1].substr(1);

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isStartWith(this._commentOn,codeArr,i)){

htmlTxt[htmlTxt.length]=this._commentOn;

i=i this.getSkipLength(this._commentOn);

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isStartWith(this._lineComment,codeArr,i)){

htmlTxt[htmlTxt.length]=this._lineComment;

i=i this.getSkipLength(this._lineComment);

};else if(!slash_slash_comment_opened&&!slash_star_comment_opened&&!quote_opened&&this.isStartWith(this._ignore,codeArr,i)){

htmlTxt[htmlTxt.length]=this._ignore;

i=i this.getSkipLength(this._ignore);

};else if(!quote_opened&&!slash_slash_comment_opened&&this.isStartWith(this._commentOff,codeArr,i)){

htmlTxt[htmlTxt.length]=this._commentOff;

i=i this.getSkipLength(this._commentOff);

return htmlTxt.join("");

this.isStartWith=function (str,code,index){

if(typeof(str)!="undefined"&&str.length>0){

for(var i=index;i

cc[cc.length]=code[i];

var c=cc.join("");

if(str.length>=code[index].length&&c.indexOf(str)==0){

if(str.length>=code[index].length&&c.toLowerCase().indexOf(str.toLowerCase())==0){

this.isFunction=function (val){

return this._function.contains(this._caseSensitive?val:val.toLowerCase());

this.isBlockElement=function (val){

return this._blockElement.contains(this._caseSensitive?val:val.toLowerCase());

this.isChoiceElement=function (val){

return this._choiceElement.contains(this._caseSensitive?val:val.toLowerCase());

this.isSingleEyeElement=function (val){

return this._singleEyeElement.contains(this._caseSensitive?val:val.toLowerCase());

this.isNextElement=function (from,word){

for(var i=from;i

return this.isChoiceElement(word[i]);

this.getSkipLength=function (val){

for(var i=0;i

if(this._wordDelimiters.indexOf(val.charAt(i))>=0){

this.getIdent=function (){

n[n.length]="\t";

return n.join("");

switch(o.tagName){

_codetxt=o.value;

_codetxt=o.innerText;

_codetxt=o.innerHTML;

htmltxt=_syn.format();

xx.isCompress=true;

xx.style=value;

return xx.format();

new Date().getTime()

Math.random()

hXXps://

hXXp://

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\cookies

\*.txt

Adodb.Stream

0@hXXp://pv.sohu.com/cityjson?ie=gb2312

hXXp://VVV.ip138.com/ips1388.asp

##% # # #

%""""%""""

"%%%"%"%%%

#""%"%%)

%"""%"%""%

"%%"%""%

%"%%"%"%"%

%""%"%"%

%"%"%"%*

/**%%%%{

# # %%*7

VVV.meitu.com

<.ak9>

fUrl

%d&&'

123456789

00003333

F%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

SHLWAPI.dll

MPR.dll

VERSION.dll

WSOCK32.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

(*.htm;*.html)|*.htm;*.html

VVV.dywt.com.cn

hXXp://VVV.baidu.com

;3 #>6.&

'2, / 0&7!4-)1#

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

HTTP/1.0

%s

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

\shell32.dll

glViewport

glTexEnvfv

glTexEnvf

\glu32.dll

\Opengl32.dll

glPassThrough

Corrupt JPEG data: found marker 0xx instead of RST%d

Warning: unknown JFIF revision number %d.d

Corrupt JPEG data: %u extraneous bytes before marker 0xx

Inconsistent progression sequence for component %d coefficient %d

Unknown Adobe color transform code %d

Obtained XMS handle %u

Freed XMS handle %u

Unrecognized component IDs %d %d %d, assuming YCbCr

JFIF extension marker: RGB thumbnail image, length %u

JFIF extension marker: palette thumbnail image, length %u

JFIF extension marker: JPEG-compressed thumbnail image, length %u

Opened temporary file %s

Closed temporary file %s

Ss=%d, Se=%d, Ah=%d, Al=%d

Component %d: dc=%d ac=%d

Start Of Scan: %d components

Component %d: %dhx%dv q=%d

Start Of Frame 0xx: width=%u, height=%u, components=%d

Smoothing not supported with nonstandard sampling ratios

RST%d

At marker 0xx, recovery action %d

Selected %d colors for quantization

Quantizing to %d colors

Quantizing to %d = %d*%d*%d colors

%4u %4u %4u %4u %4u %4u %4u %4u

Unexpected marker 0xx

Miscellaneous marker 0xx, length %u

with %d x %d thumbnail image

JFIF extension marker: type 0xx, length %u

Warning: thumbnail image size does not match data length %u

JFIF APP0 marker: version %d.d, density %dx%d %d

= = = = = = = =

Obtained EMS handle %u

Freed EMS handle %u

Define Restart Interval %u

Define Quantization Table %d precision %d

Define Huffman Table 0xx

Define Arithmetic Table 0xx: 0xx

Unknown APP14 marker (not Adobe), length %u

Unknown APP0 marker (not JFIF), length %u

Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

Unsupported marker type 0xx

Failed to create temporary file %s

Unsupported JPEG process: SOF type 0xx

Cannot quantize to more than %d colors

Cannot quantize to fewer than %d colors

Cannot quantize more than %d color components

Insufficient memory (case %d)

Not a JPEG file: starts with 0xx 0xx

Quantization table 0xx was not defined

Huffman table 0xx was not defined

Backing store not supported

Arithmetic table 0xx was not defined

Cannot transcode due to multiple use of quantization table %d

Maximum supported image dimension is %u pixels

Empty JPEG image (DNL not supported)

Bogus DQT index %d

Bogus DHT index %d

Bogus DAC value 0x%x

Bogus DAC index %d

Unsupported color conversion request

Too many color components: %d, max %d

Buffer passed to JPEG library is too small

JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

Improper call to JPEG library in state %d

Invalid scan script at entry %d

Invalid progressive parameters at scan script entry %d

Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

Unsupported JPEG data precision %d

Invalid memory pool code %d

Wrong JPEG library version: library is %d, caller expects %d

Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

DCT scaled block size %dx%d not supported

Invalid component ID %d in SOS

1.0.6

%s: Write error at scanline %lu

%s: Seek error at scanline %lu

%s: Cannot modify tag "%s" while writing

%s: Unknown %stag %u

Internal error, unknown tag 0x%x

%s compression support is not configured

?%s: No space for LogLuv state block

Inappropriate photometric interpretation %d for SGILog compression; %s

LogL16Decode: Not enough data at row %d (short %d pixels)

LogLuvDecode24: Not enough data at row %d (short %d pixels)

LogLuvDecode32: Not enough data at row %d (short %d pixels)

%s: No space for SGILog translation buffer

No support for converting user data format to LogL

No support for converting user data format to LogLuv

SGILog compression supported only for %s, or raw data

Unknown data format %d for LogLuv compression

Unknown encoding %d for LogLuv compression

%s: No space for state block

%s: Bad code word at scanline %d (x %lu)

%s: %s at scanline %d (got %lu, expected %lu)

%s: Premature EOF at scanline %d (x %lu)

%s: No space for Group 3/4 reference line

%s: No space for Group 3/4 run arrays

%s: Uncompressed data (not supported) at scanline %d (x %lu)

Fax SubAddress: %s

(%u = 0x%x)

%suncompressed data

%sEOL padding

%s2-d encoding

Improper JPEG sampling factors %d,%d

Apparently should be %d,%d,decompressor will try reading with sampling %d,%d

Improper JPEG strip/tile size, expected %dx%d, got %dx%d

RowsPerStrip must be multiple of %d for JPEG

JPEG tile width must be multiple of %d

JPEG tile height must be multiple of %d

BitsPerSample %d not allowed for JPEG

PhotometricInterpretation %d not allowed for JPEG

ThunderDecode: %s data at scanline %ld (%lu != %lu)

PackBitsDecode: discarding %d bytes to avoid buffer overrun

LZWDecode: Not enough data at scanline %d (short %d bytes)

LZWDecode: Strip %d not terminated with EOI code

LZWDecode: Bogus encoding, loop in the code table; scanline %d

LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

DumpModeDecode: Not enough data for scanline %d

Horizontal differencing "Predictor" not supported with %d-bit samples

"Predictor" value %d not supported

%u (0x%x)

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

GetCPInfo

GetProcessHeap

RegOpenKeyExA

RegCreateKeyExA

RegCloseKey

GetViewportExtEx

GetViewportOrgEx

ScaleViewportExtEx

SetViewportExtEx

OffsetViewportOrgEx

SetViewportOrgEx

GetKeyState

SetWindowsHookExA

CreateDialogIndirectParamA

UnhookWindowsHookEx

InternetCanonicalizeUrlA

InternetCrackUrlA

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

InternetOpenUrlA

.text

`.rdata

@.data

1, 0, 6, 6

- Skin.dll

(*.*)

%original file name%.exe_652_rwx_10000000_0003F000:

`.rsrc

L$(h%f

SSh0j

msctls_hotkey32

TVCLHotKey

THotKey

\skinh.she

}uo,x6l5k%x-l h

9p%s m)t4`#b

e"m?c&y1`Ã

SetViewportOrgEx

SetViewportExtEx

SetWindowsHookExA

UnhookWindowsHookEx

EnumThreadWindows

EnumChildWindows

`c%US.4/

!#$

.text

`.rdata

@.data

.rsrc

@.UPX0

`.UPX1

`.reloc

hJK.ZH

O.qt0

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

USER32.dll

SkinH_EL.dll

1, 0, 6, 6

- Skin.dll

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps