Skip to main content

Trojan.Generic.9209300_3e0a17e547


Trojan.Generic.9209300 (B) (Emsisoft), Trojan.Generic.9209300 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 3e0a17e547ae60cd9af545c3d723ad0b

SHA1: c23458b1fef5c45513f15f2dafe781813e22291d

SHA256: 1202042d36ff2d8cec1de4f4917c0f913a80e0ce008d0139dc21593b9bc6500f

SSDeep: 98304:XPP0rqD3KzXwIffHy2G/WDLlt8V12Ges:X0rqd4PVGmb8V12Ge

Size: 3257384 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: ????????

Created at: 2013-06-01 10:09:04

Analyzed on: WindowsXPESX SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour Description
EmailWormWorm can send e-mails.


Process activity

The Trojan creates the following process(es):

mscorsvw.exe:1912
DetectionUpdates.exe:1120

The Trojan injects its code into the following process(es):

%original file name%.exe:1696

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1696 makes changes in the file system.


The Trojan creates and/or writes to the following file(s):

C:\skins\skining.txt (11 bytes)
C:\xsDesktop.exe (31 bytes)
C:\icoSD\logo3.ico (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\apptext2013428[1].txt (242 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\SoftwareManagerTasks[1].xml (523 bytes)
C:\Software.exe (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
C:\icoSD\logo2.ico (34 bytes)
C:\DetectionUpdates.exe (3865 bytes)
C:\Establish.exe (313 bytes)
C:\singls.txt (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\access\deta.mdb (114 bytes)
C:\icoSD\logo1.ico (34 bytes)
C:\CommuniCationEx.exe (22 bytes)
C:\Taskdata.sdb (17468 bytes)
C:\access\deta.ldb (64 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
C:\logo.ico (158 bytes)
C:\Current.txt (26 bytes)
C:\WriteDate.sdb (13 bytes)
C:\skins\Alternate.jpg (26 bytes)
C:\config\update.txt (38 bytes)
C:\skins\config.txt (28 bytes)

Registry activity

The process mscorsvw.exe:1912 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGenService\State]
"AccumulatedWaitIdleTime" = "2340000"

The process DetectionUpdates.exe:1120 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E8 E1 9F 2A 43 D5 67 93 33 05 1F E1 0F F6 C5 F2"

The process %original file name%.exe:1696 makes changes in the system registry.


The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"DetectionUpdates.exe" = "DetectionUpdates"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C D6 25 94 F3 C9 A7 A3 47 F0 4A 4C A1 80 B2 D9"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\SD WallpaperSettings]
"Path" = "c:\Wallpaper\Wallpaper"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ÍøÖ·ËÙ´ï" = "c:\%original file name%.exe MBKKDLJDNCVKLSOJEIMVIBBKSWJKBMMDMJB"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5 File path
2eacdbca17d3562143a773b6c444a20cc:\CommuniCationEx.exe
bb1127cd0f24ce8ef8db3ae162f6c62bc:\DetectionUpdates.exe
4234fbd5e1f54b5c15233a89b9ca9566c:\Establish.exe
629fd6de7b3d99b08a952d6fa2629721c:\Software.exe
482d3b7ba815bba0fa0285b757a5d754c:\xsDesktop.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    mscorsvw.exe:1912
    DetectionUpdates.exe:1120

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\skins\skining.txt (11 bytes)
    C:\xsDesktop.exe (31 bytes)
    C:\icoSD\logo3.ico (34 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\apptext2013428[1].txt (242 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\SoftwareManagerTasks[1].xml (523 bytes)
    C:\Software.exe (31 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    C:\icoSD\logo2.ico (34 bytes)
    C:\DetectionUpdates.exe (3865 bytes)
    C:\Establish.exe (313 bytes)
    C:\singls.txt (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    C:\access\deta.mdb (114 bytes)
    C:\icoSD\logo1.ico (34 bytes)
    C:\CommuniCationEx.exe (22 bytes)
    C:\Taskdata.sdb (17468 bytes)
    C:\access\deta.ldb (64 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    C:\logo.ico (158 bytes)
    C:\Current.txt (26 bytes)
    C:\WriteDate.sdb (13 bytes)
    C:\skins\Alternate.jpg (26 bytes)
    C:\config\update.txt (38 bytes)
    C:\skins\config.txt (28 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ÍøÖ·ËÙ´ï" = "c:\%original file name%.exe MBKKDLJDNCVKLSOJEIMVIBBKSWJKBMMDMJB"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ????????
Product Name: ?????
Product Version: 1.3.6.1
Legal Copyright: ????????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.3.6.1
File Description: ????????
Comments: ????????
Language: English (United Kingdom)

Company Name: ????????Product Name: ?????Product Version: 1.3.6.1Legal Copyright: ???????? Legal Trademarks: Original Filename: Internal Name: File Version: 1.3.6.1File Description: ????????Comments: ????????Language: English (United Kingdom)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
UPX04096500940800d41d8cd98f00b204e9800998ecf8427e
UPX15013504308838430853125.54513a3d5bdf85a766f42e802f4e53ce78ba2
.rsrc81018881638401633284.01027ac34b50a36c3bdfe4f27ef7fb71296a1

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL IP
hxxp://vip2014.souweng.com/desk/apptext2.txt
hxxp://vip2014.souweng.com/desk/apptext2013428.txt
hxxp://vip2014.souweng.com/desk/SoftwareManagerTasks.xml
hxxp://www.suda123.com/desk/apptext2013428.txt122.227.0.163
hxxp://www.suda123.com/desk/apptext2.txt122.227.0.163
hxxp://www.suda123.com/desk/SoftwareManagerTasks.xml122.227.0.163

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /desk/apptext2.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.suda123.com

Cache-Control: no-cache

GET /desk/apptext2.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Accept: */*

Host: VVV.suda123.com

Cache-Control: no-cache

<<< skipped >>>

GET /desk/apptext2013428.txt HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.suda123.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 4334

Content-Type: text/plain

Last-Modified: Fri, 18 Apr 2014 13:06:49 GMT

Accept-Ranges: bytes

ETag: "d84329f75bcf1:106f"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sat, 01 Nov 2014 16:44:16 GMT

[qq=hXXp://VVV.souweng.com/vip/soft/qq/qq.zip]..[360....=hXXp://VVV.souweng.com/vip/soft/360/new/new.zip]..[360....=hXXp://VVV.souweng.com/vip/soft/360sd/setup.zip]..[360......=hXXp://VVV.souweng.com/vip/soft/360elp/360elp.zip]..[........=hXXp://VVV.souweng.com/vip/soft/duba/new/new.zip]..[....7=hXXp://VVV.souweng.com/vip/soft/thunderV7/thunder.zip]..[..........=hXXp://VVV.souweng.com/vip/soft/kwmusic/kwmusic.zip]..[....2014=hXXp://VVV.souweng.com/vip/soft/kugou7/kugou7.zip]..[....2012=hXXp://VVV.souweng.com/vip/soft/kugou7/kugou7.zip]..[..........=http://VVV.souweng.com/vip/soft/baidubro.zip]..[........=hXXp://VVV.souweng.com/vip/soft/baidupy.zip]..[pptv=hXXp://VVV.souweng.com/vip/soft/pplive/pplive.zip]..[........=hXXp://VVV.souweng.com/vip/soft/haozipnew/haozipnew.zip]..[........=hXXp://VVV.souweng.com/vip/soft/Funshion/Funshion.zip]..[........=hXXp://VVV.souweng.com/vip/soft/storm/storm.zip]..[PPS......=hXXp://VVV.souweng.com/vip/soft/pps/pps.zip]..[........=http://VVV.souweng.com/vip/soft/0001.zip]..[........=hXXp://VVV.souweng.com/vip/soft/0002.zip]..[....GHOST=hXXp://VVV.souweng.com/vip/soft/0003.zip]..[..........=hXXp://VVV.souweng.com/vip/soft/0004.zip]..[........=hXXp://VVV.souweng.com/vip/soft/0005.zip]..[..........=hXXp://VVV.souweng.com/vip/soft/0006.zip]..[WINRAR....=hXXp://VVV.souweng.com/vip/soft/0007.zip]..[7ZIP....=hXXp://VVV.souweng.com/vip/soft/0008.zip]..[........=hXXp://VVV.souweng.com/vip/soft/0009.zip]..[........=hXXp://www.souweng.com/vip/soft/0010.zip]..[QQ....=hXXp://VVV.souweng.com/v

<<< skipped >>>

GET /desk/SoftwareManagerTasks.xml HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.suda123.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Length: 523

Content-Type: text/xml

Last-Modified: Sat, 04 Jan 2014 09:12:23 GMT

Accept-Ranges: bytes

ETag: "0667e142d9cf1:106f"

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

Date: Sat, 01 Nov 2014 16:44:16 GMT

<?xml version="1.0" encoding="utf-8"?>...<xparam>... <attributes>..<Software Manager one> <Taskid>6</Taskid><Award>50</Award></Software Manager one>..<Software Manager two> <Taskid>3</Taskid><Award>50</Award></Software Manager two>..<Software Manager three> <Taskid>36</Taskid><Award>50</Award></Software Manager three>... <star>1.223.436</star>...<updateneedpoints>3118</updateneedpoints>... <level>17</level>.. <Function variables>true</Function variables>.....</item>....</xparam>..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1696:

`.rsrc

`.rsrc

{82B46959-3065-46a0-8340-3BB58B77A259}

{82B46959-3065-46a0-8340-3BB58B77A259}

bywayboy@gmail.com

bywayboy@gmail.com

hXXp://VVV.ecodeproject.cn/bbs

hXXp://VVV.ecodeproject.cn/bbs

:16882569

:16882569

kernel32.dll

kernel32.dll

ole32.dll

ole32.dll

msvcrt.dll

msvcrt.dll

fne.dll

fne.dll

t%SVh

t%SVh

t$(SSh

t$(SSh

|$D.tm

|$D.tm

~%UVW

~%UVW

u$SShe

u$SShe

gdiplus.dll

gdiplus.dll

GdiPlus.dll

GdiPlus.dll

user32.dll

user32.dll

Kernel32.dll

Kernel32.dll

shell32.dll

shell32.dll

shlwapi.dll

shlwapi.dll

wininet.dll

wininet.dll

WinINet.dll

WinINet.dll

Wininet.dll

Wininet.dll

User32.dll

User32.dll

Gdiplus.dll

Gdiplus.dll

Ole32.dll

Ole32.dll

gdi32.dll

gdi32.dll

msimg32.dll

msimg32.dll

imm32.dll

imm32.dll

UxTheme.dll

UxTheme.dll

comctl32.dll

comctl32.dll

Gdi32.dll

Gdi32.dll

winmm.dll

winmm.dll

dwmapi.dll

dwmapi.dll

ShellExecuteEx

ShellExecuteEx

UnhookWindowsHookEx

UnhookWindowsHookEx

SetWindowsHookExA

SetWindowsHookExA

HttpOpenRequestA

HttpOpenRequestA

HttpSendRequestA

HttpSendRequestA

HttpQueryInfoA

HttpQueryInfoA

InternetOpenUrlA

InternetOpenUrlA

GdipSetPenLineJoin

GdipSetPenLineJoin

GdipGetPenLineJoin

GdipGetPenLineJoin

GetKeyState

GetKeyState

ShellExecuteA

ShellExecuteA

GdipSetStringFormatHotkeyPrefix

GdipSetStringFormatHotkeyPrefix

GdipSetImageAttributesColorKeys

GdipSetImageAttributesColorKeys

GdipGetStringFormatHotkeyPrefix

GdipGetStringFormatHotkeyPrefix

{B6F7542F-B8FE-46a8-9605-98856A687097}

{B6F7542F-B8FE-46a8-9605-98856A687097}

az4%c

az4%c

Ex_DirectUI_MsgBox

Ex_DirectUI_MsgBox

msg_wnd

msg_wnd

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\GUIFont.Facename

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\GUIFont.Facename

\PropsImages\Border2.png

\PropsImages\Border2.png

\PropsImages\Border1.png

\PropsImages\Border1.png

*.ico|*.ico

*.ico|*.ico

hXXp://VVV.

hXXp://VVV.

hXXp://

hXXp://

\icoSD\logo1.ico

\icoSD\logo1.ico

\icoSD\logo2.ico

\icoSD\logo2.ico

\icoSD\logo3.ico

\icoSD\logo3.ico

screensnapshot.exe

screensnapshot.exe

hXXp://VVV.suda123.com/desk/apptext2.txt

hXXp://VVV.suda123.com/desk/apptext2.txt

[adslpass=

[adslpass=

hXXp://my.suda123.com/Wallpaper/Store/skin_

hXXp://my.suda123.com/Wallpaper/Store/skin_

\Wallpaper\WallpaperChanger.bmp

\Wallpaper\WallpaperChanger.bmp

desksd123_configure.exe

desksd123_configure.exe

\desksd123_configure.exe

\desksd123_configure.exe

\singls.txt

\singls.txt

\xsDesktop.exe

\xsDesktop.exe

.text

.text

.rdata

.rdata

.data

.data

.rsrc

.rsrc

.aspack

.aspack

.adata

.adata

The procedure entry point %s could not be located in the dynamic link library %s

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

"hXXp://crl.verisign.com/tss-ca.crl0

"hXXp://crl.verisign.com/tss-ca.crl0

hXXp://ocsp.verisign.com0

hXXp://ocsp.verisign.com0

Thawte Certification1

Thawte Certification1

0hXXp://crl.verisign.com/ThawteTimestampingCA.crl0

0hXXp://crl.verisign.com/ThawteTimestampingCA.crl0

#hXXp://logo.verisign.com/vslogo.gif0

#hXXp://logo.verisign.com/vslogo.gif0

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

/hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

hXXps://VVV.verisign.com/rpa0

hXXps://VVV.verisign.com/rpa0

hXXp://ocsp.verisign.com0;

hXXp://ocsp.verisign.com0;

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

/hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

hXXps://VVV.verisign.com/cps0*

hXXps://VVV.verisign.com/cps0*

#hXXp://logo.verisign.com/vslogo.gif04

#hXXp://logo.verisign.com/vslogo.gif04

#hXXp://crl.verisign.com/pca3-g5.crl04

#hXXp://crl.verisign.com/pca3-g5.crl04

\Software.exe

\Software.exe

@Windows2000

@Windows2000

@WindowsXP

@WindowsXP

@WindowsServer2003

@WindowsServer2003

@WindowsVista

@WindowsVista

@Windows7

@Windows7

@Windows8

@Windows8

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

\Current.txt

\Current.txt

\skins\config.txt

\skins\config.txt

\skins\Alternate.jpg

\skins\Alternate.jpg

d.kDf

d.kDf

\xJ.Rc

\xJ.Rc

%SPC$SRI 5,

%SPC$SRI 5,

X&(J.Zb

X&(J.Zb

LpZ.Zc

LpZ.Zc

(Z.Zc

(Z.Zc

LpZ.Rc

LpZ.Rc

d.qVK!zh

d.qVK!zh

\skins\Alternate.jpg]

\skins\Alternate.jpg]

\skins\skining.txt

\skins\skining.txt

\CommuniCationEx.exe

\CommuniCationEx.exe

2.DXQ

2.DXQ

\logo.ico

\logo.ico

.NL3V$_

.NL3V$_

"N`A%6Sq

"N`A%6Sq

N}.GEK

N}.GEK

-

-

--""""%%%

--""""%%%

';77

';77

WWW.%F#%

WWW.%F#%

\config\update.txt

\config\update.txt

N.WQz

N.WQz

.Le4Z-

.Le4Z-

{AccessKey}

{AccessKey}

{operateName}

{operateName}

{AccessKey}

{AccessKey}

{operateName}

{operateName}

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

http=

http=

HTTP/1.1

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Content-Type: application/x-www-form-urlencoded

\TaobaoMall.exe

\TaobaoMall.exe

\adslpass.exe

\adslpass.exe

\win7oem.exe

\win7oem.exe

\HomeLock.exe

\HomeLock.exe

\Networkname.exe

\Networkname.exe

\Signature.exe

\Signature.exe

\Grouping.exe

\Grouping.exe

\Dictionary.exe

\Dictionary.exe

\Express.exe

\Express.exe

\PPLive.exe

\PPLive.exe

\DoubanFM.exe

\DoubanFM.exe

\Dishes.exe

\Dishes.exe

\Manning.exe

\Manning.exe

\Lianliankan.exe

\Lianliankan.exe

\PlantvsZombies.exe

\PlantvsZombies.exe

\Chess.exe

\Chess.exe

\Meituxiu.exe

\Meituxiu.exe

\Recharge.exe

\Recharge.exe

\Hooklock.exe

\Hooklock.exe

\Memorandum.exe

\Memorandum.exe

\Weather.exe

\Weather.exe

\Perpetual.exe

\Perpetual.exe

\suda.exe

\suda.exe

\Clear.exe

\Clear.exe

\Establish.exe

\Establish.exe

\Timing.exe

\Timing.exe

\Query.exe

\Query.exe

\Search.exe

\Search.exe

\screensnapshot.exe

\screensnapshot.exe

System32\calc.exe

System32\calc.exe

\Today.exe

\Today.exe

\sol.exe

\sol.exe

\NewsApplication.exe

\NewsApplication.exe

hXXp://web2.qq.com/

hXXp://web2.qq.com/

AppData\Roaming\wzsd123\TaobaoMall.zip

AppData\Roaming\wzsd123\TaobaoMall.zip

AppData\Roaming\wzsd123\TaobaoMall.zip.tmp

AppData\Roaming\wzsd123\TaobaoMall.zip.tmp

AppData\Roaming\wzsd123\TaobaoMall.exe

AppData\Roaming\wzsd123\TaobaoMall.exe

User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

Y@AppData\Roaming\wzsd123\adslpass.zip

Y@AppData\Roaming\wzsd123\adslpass.zip

AppData\Roaming\wzsd123\adslpass.zip.tmp

AppData\Roaming\wzsd123\adslpass.zip.tmp

AppData\Roaming\wzsd123\adslpass.exe

AppData\Roaming\wzsd123\adslpass.exe

AppData\Roaming\wzsd123\win7oem.zip

AppData\Roaming\wzsd123\win7oem.zip

AppData\Roaming\wzsd123\win7oem.zip.tmp

AppData\Roaming\wzsd123\win7oem.zip.tmp

AppData\Roaming\wzsd123\win7oem.exe

AppData\Roaming\wzsd123\win7oem.exe

AppData\Roaming\wzsd123\HomeLock.zip

AppData\Roaming\wzsd123\HomeLock.zip

AppData\Roaming\wzsd123\HomeLock.zip.tmp

AppData\Roaming\wzsd123\HomeLock.zip.tmp

AppData\Roaming\wzsd123\HomeLock.exe

AppData\Roaming\wzsd123\HomeLock.exe

AppData\Roaming\wzsd123\Networkname.zip

AppData\Roaming\wzsd123\Networkname.zip

AppData\Roaming\wzsd123\Networkname.zip.tmp

AppData\Roaming\wzsd123\Networkname.zip.tmp

AppData\Roaming\wzsd123\Networkname.exe

AppData\Roaming\wzsd123\Networkname.exe

AppData\Roaming\wzsd123\Signature.zip

AppData\Roaming\wzsd123\Signature.zip

AppData\Roaming\wzsd123\Signature.zip.tmp

AppData\Roaming\wzsd123\Signature.zip.tmp

AppData\Roaming\wzsd123\Signature.exe

AppData\Roaming\wzsd123\Signature.exe

\Grouping.zip

\Grouping.zip

\Grouping.zip.tmp

\Grouping.zip.tmp

AppData\Roaming\wzsd123\Dictionary.zip

AppData\Roaming\wzsd123\Dictionary.zip

AppData\Roaming\wzsd123\Dictionary.zip.tmp

AppData\Roaming\wzsd123\Dictionary.zip.tmp

AppData\Roaming\wzsd123\Dictionary.exe

AppData\Roaming\wzsd123\Dictionary.exe

AppData\Roaming\wzsd123\Express.zip

AppData\Roaming\wzsd123\Express.zip

AppData\Roaming\wzsd123\Express.zip.tmp

AppData\Roaming\wzsd123\Express.zip.tmp

AppData\Roaming\wzsd123\Express.exe

AppData\Roaming\wzsd123\Express.exe

AppData\Roaming\wzsd123\PPLive.zip

AppData\Roaming\wzsd123\PPLive.zip

AppData\Roaming\wzsd123\PPLive.zip.tmp

AppData\Roaming\wzsd123\PPLive.zip.tmp

AppData\Roaming\wzsd123\PPLive.exe

AppData\Roaming\wzsd123\PPLive.exe

AppData\Roaming\wzsd123\DoubanFM.zip

AppData\Roaming\wzsd123\DoubanFM.zip

AppData\Roaming\wzsd123\DoubanFM.zip.tmp

AppData\Roaming\wzsd123\DoubanFM.zip.tmp

AppData\Roaming\wzsd123\DoubanFM.exe

AppData\Roaming\wzsd123\DoubanFM.exe

AppData\Roaming\wzsd123\Dishes.zip

AppData\Roaming\wzsd123\Dishes.zip

AppData\Roaming\wzsd123\Dishes.zip.tmp

AppData\Roaming\wzsd123\Dishes.zip.tmp

AppData\Roaming\wzsd123\Dishes.exe

AppData\Roaming\wzsd123\Dishes.exe

AppData\Roaming\wzsd123\Manning.zip

AppData\Roaming\wzsd123\Manning.zip

AppData\Roaming\wzsd123\Manning.zip.tmp

AppData\Roaming\wzsd123\Manning.zip.tmp

AppData\Roaming\wzsd123\Manning.exe

AppData\Roaming\wzsd123\Manning.exe

AppData\Roaming\wzsd123\Lianliankan.zip

AppData\Roaming\wzsd123\Lianliankan.zip

AppData\Roaming\wzsd123\Lianliankan.zip.tmp

AppData\Roaming\wzsd123\Lianliankan.zip.tmp

AppData\Roaming\wzsd123\Lianliankan.exe

AppData\Roaming\wzsd123\Lianliankan.exe

AppData\Roaming\wzsd123\PlantvsZombies.zip

AppData\Roaming\wzsd123\PlantvsZombies.zip

AppData\Roaming\wzsd123\PlantvsZombies.zip.tmp

AppData\Roaming\wzsd123\PlantvsZombies.zip.tmp

AppData\Roaming\wzsd123\PlantvsZombies.exe

AppData\Roaming\wzsd123\PlantvsZombies.exe

AppData\Roaming\wzsd123\Chess.zip

AppData\Roaming\wzsd123\Chess.zip

AppData\Roaming\wzsd123\Chess.zip.tmp

AppData\Roaming\wzsd123\Chess.zip.tmp

AppData\Roaming\wzsd123\Chess.exe

AppData\Roaming\wzsd123\Chess.exe

AppData\Roaming\wzsd123\Meituxiu.zip

AppData\Roaming\wzsd123\Meituxiu.zip

AppData\Roaming\wzsd123\Meituxiu.zip.tmp

AppData\Roaming\wzsd123\Meituxiu.zip.tmp

AppData\Roaming\wzsd123\Meituxiu.exe

AppData\Roaming\wzsd123\Meituxiu.exe

AppData\Roaming\wzsd123\Recharge.zip

AppData\Roaming\wzsd123\Recharge.zip

AppData\Roaming\wzsd123\Recharge.zip.tmp

AppData\Roaming\wzsd123\Recharge.zip.tmp

AppData\Roaming\wzsd123\Recharge.exe

AppData\Roaming\wzsd123\Recharge.exe

AppData\Roaming\wzsd123\Hooklock.zip

AppData\Roaming\wzsd123\Hooklock.zip

AppData\Roaming\wzsd123\Hooklock.zip.tmp

AppData\Roaming\wzsd123\Hooklock.zip.tmp

AppData\Roaming\wzsd123\Hooklock.exe

AppData\Roaming\wzsd123\Hooklock.exe

AppData\Roaming\wzsd123\Memorandum.zip

AppData\Roaming\wzsd123\Memorandum.zip

AppData\Roaming\wzsd123\Memorandum.zip.tmp

AppData\Roaming\wzsd123\Memorandum.zip.tmp

AppData\Roaming\wzsd123\Memorandum.exe

AppData\Roaming\wzsd123\Memorandum.exe

AppData\Roaming\wzsd123\Weather.zip

AppData\Roaming\wzsd123\Weather.zip

AppData\Roaming\wzsd123\Weather.zip.tmp

AppData\Roaming\wzsd123\Weather.zip.tmp

AppData\Roaming\wzsd123\Weather.exe

AppData\Roaming\wzsd123\Weather.exe

AppData\Roaming\wzsd123\Perpetual.zip

AppData\Roaming\wzsd123\Perpetual.zip

AppData\Roaming\wzsd123\Perpetual.zip.tmp

AppData\Roaming\wzsd123\Perpetual.zip.tmp

AppData\Roaming\wzsd123\Perpetual.exe

AppData\Roaming\wzsd123\Perpetual.exe

AppData\Roaming\wzsd123\suda.zip

AppData\Roaming\wzsd123\suda.zip

AppData\Roaming\wzsd123\suda.zip.tmp

AppData\Roaming\wzsd123\suda.zip.tmp

AppData\Roaming\wzsd123\suda.exe

AppData\Roaming\wzsd123\suda.exe

AppData\Roaming\wzsd123\Clear.zip

AppData\Roaming\wzsd123\Clear.zip

AppData\Roaming\wzsd123\Clear.zip.tmp

AppData\Roaming\wzsd123\Clear.zip.tmp

AppData\Roaming\wzsd123\Clear.exe

AppData\Roaming\wzsd123\Clear.exe

AppData\Roaming\wzsd123\Establish.zip

AppData\Roaming\wzsd123\Establish.zip

AppData\Roaming\wzsd123\Establish.zip.tmp

AppData\Roaming\wzsd123\Establish.zip.tmp

AppData\Roaming\wzsd123\Establish.tmp

AppData\Roaming\wzsd123\Establish.tmp

AppData\Roaming\wzsd123\Establish.exe

AppData\Roaming\wzsd123\Establish.exe

AppData\Roaming\wzsd123\Timing.zip

AppData\Roaming\wzsd123\Timing.zip

AppData\Roaming\wzsd123\Timing.zip.tmp

AppData\Roaming\wzsd123\Timing.zip.tmp

AppData\Roaming\wzsd123\Timing.exe

AppData\Roaming\wzsd123\Timing.exe

AppData\Roaming\wzsd123\Query.zip

AppData\Roaming\wzsd123\Query.zip

AppData\Roaming\wzsd123\Query.zip.tmp

AppData\Roaming\wzsd123\Query.zip.tmp

AppData\Roaming\wzsd123\Query.exe

AppData\Roaming\wzsd123\Query.exe

AppData\Roaming\wzsd123\Search.zip

AppData\Roaming\wzsd123\Search.zip

AppData\Roaming\wzsd123\Search.zip.tmp

AppData\Roaming\wzsd123\Search.zip.tmp

AppData\Roaming\wzsd123\Search.exe

AppData\Roaming\wzsd123\Search.exe

AppData\Roaming\wzsd123\screensnapshot.zip

AppData\Roaming\wzsd123\screensnapshot.zip

AppData\Roaming\wzsd123\screensnapshot.zip.tmp

AppData\Roaming\wzsd123\screensnapshot.zip.tmp

AppData\Roaming\wzsd123\screensnapshot.exe

AppData\Roaming\wzsd123\screensnapshot.exe

AppData\Roaming\wzsd123\Today.zip

AppData\Roaming\wzsd123\Today.zip

AppData\Roaming\wzsd123\Today.zip.tmp

AppData\Roaming\wzsd123\Today.zip.tmp

AppData\Roaming\wzsd123\Today.exe

AppData\Roaming\wzsd123\Today.exe

AppData\Roaming\wzsd123\sol.zip

AppData\Roaming\wzsd123\sol.zip

AppData\Roaming\wzsd123\sol.zip.tmp

AppData\Roaming\wzsd123\sol.zip.tmp

AppData\Roaming\wzsd123\sol.exe

AppData\Roaming\wzsd123\sol.exe

AppData\Roaming\wzsd123\NewsApplication.zip

AppData\Roaming\wzsd123\NewsApplication.zip

AppData\Roaming\wzsd123\NewsApplication.zip.tmp

AppData\Roaming\wzsd123\NewsApplication.zip.tmp

AppData\Roaming\wzsd123\NewsApplication.exe

AppData\Roaming\wzsd123\NewsApplication.exe

HTTPREAD

HTTPREAD

\setup.exe

\setup.exe

\inno.exe

\inno.exe

\nsis.exe

\nsis.exe

hXXp://VVV.souweng.com/vip/soft/0001.zip

hXXp://VVV.souweng.com/vip/soft/0001.zip

hXXp://VVV.souweng.com/vip/soft/0002.zip

hXXp://VVV.souweng.com/vip/soft/0002.zip

hXXp://VVV.souweng.com/vip/soft/0003.zip

hXXp://VVV.souweng.com/vip/soft/0003.zip

hXXp://VVV.souweng.com/vip/soft/0004.zip

hXXp://VVV.souweng.com/vip/soft/0004.zip

hXXp://VVV.souweng.com/vip/soft/0005.zip

hXXp://VVV.souweng.com/vip/soft/0005.zip

hXXp://VVV.souweng.com/vip/soft/0006.zip

hXXp://VVV.souweng.com/vip/soft/0006.zip

hXXp://VVV.souweng.com/vip/soft/0007.zip

hXXp://VVV.souweng.com/vip/soft/0007.zip

hXXp://VVV.souweng.com/vip/soft/0008.zip

hXXp://VVV.souweng.com/vip/soft/0008.zip

hXXp://VVV.souweng.com/vip/soft/0009.zip

hXXp://VVV.souweng.com/vip/soft/0009.zip

hXXp://VVV.souweng.com/vip/soft/0010.zip

hXXp://VVV.souweng.com/vip/soft/0010.zip

hXXp://VVV.souweng.com/vip/soft/0011.zip

hXXp://VVV.souweng.com/vip/soft/0011.zip

hXXp://VVV.souweng.com/vip/soft/0012.zip

hXXp://VVV.souweng.com/vip/soft/0012.zip

hXXp://VVV.souweng.com/vip/soft/0013.zip

hXXp://VVV.souweng.com/vip/soft/0013.zip

hXXp://VVV.souweng.com/vip/soft/0014.zip

hXXp://VVV.souweng.com/vip/soft/0014.zip

hXXp://VVV.souweng.com/vip/soft/0015.zip

hXXp://VVV.souweng.com/vip/soft/0015.zip

hXXp://VVV.souweng.com/vip/soft/0016.zip

hXXp://VVV.souweng.com/vip/soft/0016.zip

hXXp://VVV.souweng.com/vip/soft/0017.zip

hXXp://VVV.souweng.com/vip/soft/0017.zip

hXXp://VVV.souweng.com/vip/soft/0018.zip

hXXp://VVV.souweng.com/vip/soft/0018.zip

hXXp://VVV.souweng.com/vip/soft/0019.zip

hXXp://VVV.souweng.com/vip/soft/0019.zip

hXXp://VVV.souweng.com/vip/soft/0020.zip

hXXp://VVV.souweng.com/vip/soft/0020.zip

hXXp://VVV.souweng.com/vip/soft/0021.zip

hXXp://VVV.souweng.com/vip/soft/0021.zip

hXXp://VVV.souweng.com/vip/soft/0022.zip

hXXp://VVV.souweng.com/vip/soft/0022.zip

hXXp://VVV.souweng.com/vip/soft/0023.zip

hXXp://VVV.souweng.com/vip/soft/0023.zip

hXXp://VVV.souweng.com/vip/soft/0024.zip

hXXp://VVV.souweng.com/vip/soft/0024.zip

hXXp://VVV.souweng.com/vip/soft/0025.zip

hXXp://VVV.souweng.com/vip/soft/0025.zip

hXXp://VVV.souweng.com/vip/soft/0026.zip

hXXp://VVV.souweng.com/vip/soft/0026.zip

hXXp://VVV.souweng.com/vip/soft/0027.zip

hXXp://VVV.souweng.com/vip/soft/0027.zip

hXXp://VVV.souweng.com/vip/soft/0028.zip

hXXp://VVV.souweng.com/vip/soft/0028.zip

hXXp://VVV.souweng.com/vip/soft/0029.zip

hXXp://VVV.souweng.com/vip/soft/0029.zip

hXXp://VVV.souweng.com/vip/soft/0030.zip

hXXp://VVV.souweng.com/vip/soft/0030.zip

hXXp://VVV.souweng.com/vip/soft/0031.zip

hXXp://VVV.souweng.com/vip/soft/0031.zip

hXXp://VVV.souweng.com/vip/soft/0032.zip

hXXp://VVV.souweng.com/vip/soft/0032.zip

hXXp://VVV.souweng.com/vip/soft/0033.zip

hXXp://VVV.souweng.com/vip/soft/0033.zip

hXXp://VVV.souweng.com/vip/soft/0034.zip

hXXp://VVV.souweng.com/vip/soft/0034.zip

hXXp://VVV.souweng.com/vip/soft/0035.zip

hXXp://VVV.souweng.com/vip/soft/0035.zip

hXXp://VVV.souweng.com/vip/soft/0036.zip

hXXp://VVV.souweng.com/vip/soft/0036.zip

hXXp://VVV.souweng.com/vip/soft/0037.zip

hXXp://VVV.souweng.com/vip/soft/0037.zip

hXXp://VVV.souweng.com/vip/soft/0038.zip

hXXp://VVV.souweng.com/vip/soft/0038.zip

hXXp://VVV.souweng.com/vip/soft/0039.zip

hXXp://VVV.souweng.com/vip/soft/0039.zip

hXXp://VVV.souweng.com/vip/soft/0040.zip

hXXp://VVV.souweng.com/vip/soft/0040.zip

hXXp://VVV.souweng.com/vip/soft/0041.zip

hXXp://VVV.souweng.com/vip/soft/0041.zip

hXXp://VVV.souweng.com/vip/soft/0042.zip

hXXp://VVV.souweng.com/vip/soft/0042.zip

hXXp://VVV.souweng.com/vip/soft/0043.zip

hXXp://VVV.souweng.com/vip/soft/0043.zip

hXXp://VVV.souweng.com/vip/soft/0044.zip

hXXp://VVV.souweng.com/vip/soft/0044.zip

hXXp://VVV.souweng.com/vip/soft/0045.zip

hXXp://VVV.souweng.com/vip/soft/0045.zip

hXXp://VVV.suda123.com/ie.asp?uid=wzsd123_

hXXp://VVV.suda123.com/ie.asp?uid=wzsd123_

hXXp://bbs.suda123.com/handler/connect.html?op=qqlogin

hXXp://bbs.suda123.com/handler/connect.html?op=qqlogin

hXXp://bbs.suda123.com/recoverpassword.html

hXXp://bbs.suda123.com/recoverpassword.html

hXXp://bbs.suda123.com/register.html

hXXp://bbs.suda123.com/register.html

\aneia.cfg

\aneia.cfg

\reij3.cfg

\reij3.cfg

T@\Config.xml

T@\Config.xml

3532.542

3532.542

1445.235

1445.235

|*.jpg;*.jpeg;*.png;*.bmp

|*.jpg;*.jpeg;*.png;*.bmp

\scoe.txt

\scoe.txt

\wzsd123_url.exe

\wzsd123_url.exe

\config\Website.txt

\config\Website.txt

HomeLock.exe

HomeLock.exe

VVV.suda123.com/disk.htm

VVV.suda123.com/disk.htm

setup.exe

setup.exe

inno.exe

inno.exe

nsis.exe

nsis.exe

Referer: hXXp://

Referer: hXXp://

HTTP/1.1 404

HTTP/1.1 404

HTTP/1.0 404

HTTP/1.0 404

\Download.sde

\Download.sde

DownloadUrl

DownloadUrl

C@\Images\\Join.png

C@\Images\\Join.png

\nigle.sde

\nigle.sde

hXXp://my.suda123.com/Wallpaper/Store/NewWallpaper.txt

hXXp://my.suda123.com/Wallpaper/Store/NewWallpaper.txt

hXXp://my.suda123.com/Wallpaper/Store/NewWallpaper.zip

hXXp://my.suda123.com/Wallpaper/Store/NewWallpaper.zip

\Wallpaper\Thumb\NewWallpaper.zip

\Wallpaper\Thumb\NewWallpaper.zip

.sdtmp

.sdtmp

.Ip.!I

.Ip.!I

!#.nK

!#.nK

:B.hh

:B.hh

Vf%U[

Vf%U[

$Z'H%%X

$Z'H%%X

"%F;; X

"%F;; X

.ZD*4

.ZD*4

,.Anm

,.Anm

E=YS"%u

E=YS"%u

.DZWi

.DZWi

b%X]K1

b%X]K1

.cwz(g

.cwz(g

. H.lF

. H.lF

:)d2Tl.dY

:)d2Tl.dY

%c!>[

%c!>[

q[SsH&

q[SsH&

TCP56>ma

TCP56>ma

2010-02-11T14:32:03-06:00%x

2010-02-11T14:32:03-06:00%x

Å“LN

Å“LN

N<.bm2>

N<.bm2>

%C$-|

%C$-|

%upu&

%upu&

T@H6%d

T@H6%d

(&7.AX_

(&7.AX_

.KALB

.KALB

S}^.xB

S}^.xB

.FF:U

.FF:U

\nE.XyX

\nE.XyX

.kN\#-

.kN\#-

.Mh&X\

.Mh&X\

[%X;r

[%X;r

yÄ;

yÄ;

?m%SQ

?m%SQ

.tN|b

.tN|b

&NQ.ME

&NQ.ME

;y.Kv)

;y.Kv)

!.KXx

!.KXx

\DetectionUpdates.exe

\DetectionUpdates.exe

nN[%u@

nN[%u@

xVt

xVt

J

J

!,-q}

!,-q}

{%x&NC

{%x&NC

y|lT&.XO

y|lT&.XO

W.zQq

W.zQq

%ul|B

%ul|B

Q{3$.eU

Q{3$.eU

.ll6x

.ll6x

G=r.LZ

G=r.LZ

,%6XL

,%6XL

u%fZt

u%fZt

-3}\||7A

-3}\||7A

*ûN

*ûN

.cm3:

.cm3:

1.aL1Iu

1.aL1Iu

kp-K}m

kp-K}m

Z.KO'

Z.KO'

jL"(u.qlcB

jL"(u.qlcB

~Q%%f

~Q%%f

(.EWQ

(.EWQ

| .kD,

| .kD,

z%uDQ

z%uDQ

#JK.ZDeb5@

#JK.ZDeb5@

u-%xS

u-%xS

Ly%X$

Ly%X$

Z.ex.

Z.ex.

(ÏO &

(ÏO &

--Pz}

--Pz}

.Cet0#=M

.Cet0#=M

W|.tu?@";

W|.tu?@";

%5SN3\

%5SN3\

d"^%d=ff"W

d"^%d=ff"W

*.fABM

*.fABM

.Zola

.Zola

m.jv5

m.jv5

s%s@d

s%s@d

%6SX

%6SX

<:>

<:>

.BV~ -

.BV~ -

6!.FW

6!.FW

i'udp

i'udp

I.mS4[

I.mS4[

_0.Ge

_0.Ge

.PgW!_

.PgW!_

.Awz5

.Awz5

V"8,yu%d$N

V"8,yu%d$N

x%C=/S8

x%C=/S8

A.DcO

A.DcO

.jOQ>

.jOQ>

s.Sb

s.Sb

,.UizH

,.UizH

`-.oz

`-.oz

EU^.su

EU^.su

~^.gr

~^.gr

y.FDO

y.FDO

.Wkkz

.Wkkz

7jG%F

7jG%F

.iCGw

.iCGw

uxtheme.dll

uxtheme.dll

iphlpapi.dll

iphlpapi.dll

mpr.dll

mpr.dll

ws2_32.dll

ws2_32.dll

version.dll

version.dll

comdlg32.dll

comdlg32.dll

winspool.drv

winspool.drv

advapi32.dll

advapi32.dll

rasapi32.dll

rasapi32.dll

SetViewportOrgEx

SetViewportOrgEx

FtpGetCurrentDirectoryA

FtpGetCurrentDirectoryA

hXXp://ocsp.thawte.com0

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

hXXp://ts-ocsp.ws.symantec.com07

hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

9%ui6

9%ui6

\access\deta.mdb

\access\deta.mdb

ID="{E38C4E72-5BC9-441C-A257-248C2BFEC5DF}"

ID="{E38C4E72-5BC9-441C-A257-248C2BFEC5DF}"

&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000

&H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000

6}#2.0#0

6}#2.0#0

.rbt*r

.rbt*r

ep.Oww

ep.Oww

\.LPTX8

\.LPTX8

.QVRWNM

.QVRWNM

be.QA

be.QA

Q .VjV%P

Q .VjV%P

sshtFlt

sshtFlt

EjP.DN

EjP.DN

S%j.Zs

S%j.Zs

%Xi]G

%Xi]G

$(9999,04

$(9999,04

W.UV[

W.UV[

?0012345678

?0012345678

ZC#%S

ZC#%S

n.WQj

n.WQj

.\OJ9%X

.\OJ9%X

\AIL%UW;

\AIL%UW;

S\Xh.i.LQLGP

S\Xh.i.LQLGP

\.CwK

\.CwK

Mp.Fh

Mp.Fh

%UH\[{

%UH\[{

j<.vpk> 5{x

j<.vpk> 5{x

2222$(,00

2222$(,00

;4%S(

;4%S(

lvH-D}HLr

lvH-D}HLr

r@.vkF8R

r@.vkF8R

At.%S

At.%S

3S9 0%s&

3S9 0%s&

.yJGh

.yJGh

%UtnM

%UtnM

.Ft!3

.Ft!3

]%u6p

]%u6p

owStA.UF

owStA.UF

ageBoxvSER32.DL=

ageBoxvSER32.DL=

JSc.Xm

JSc.Xm

.GjGC

.GjGC

;X%Fj[s

;X%Fj[s

KeyEx~ Z

KeyEx~ Z

zcÁ

zcÁ

W[.jo$

W[.jo$

].bod

].bod

K[SubÃŽ

K[SubÃŽ

KERNEL32.DLL

KERNEL32.DLL

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

COMDLG32.dll

COMDLG32.dll

GDI32.dll

GDI32.dll

MPR.dll

MPR.dll

OLEAUT32.dll

OLEAUT32.dll

PSAPI.DLL

PSAPI.DLL

SHELL32.dll

SHELL32.dll

USER32.dll

USER32.dll

USERENV.dll

USERENV.dll

VERSION.dll

VERSION.dll

WININET.dll

WININET.dll

WINMM.dll

WINMM.dll

WSOCK32.dll

WSOCK32.dll

FtpOpenFileW

FtpOpenFileW

.Class 3 Public Primary Certification Authority0

.Class 3 Public Primary Certification Authority0

hXXp://crl.verisign.com/pca3.crl0

hXXp://crl.verisign.com/pca3.crl0

hXXps://VVV.verisign.com/cps0

hXXps://VVV.verisign.com/cps0

hXXp://ocsp.verisign.com0>

hXXp://ocsp.verisign.com0>

^@SD Desktop InterprocessCommunicationSystem Msg

^@SD Desktop InterprocessCommunicationSystem Msg

\LoginConfig

\LoginConfig

[Download'&'/Initializing'{WindowsAsynchronousDisplay}

[Download'&'/Initializing'{WindowsAsynchronousDisplay}

\Taskdata.sdb

\Taskdata.sdb

\WriteDate.sdb

\WriteDate.sdb

hXXp://VVV.suda123.com/desk/SoftwareManagerTasks.xml

hXXp://VVV.suda123.com/desk/SoftwareManagerTasks.xml

hXXp://VVV.suda123.com/desk/apptext2013428.txt

hXXp://VVV.suda123.com/desk/apptext2013428.txt

setup.zip

setup.zip

{password}

{password}

{password}

{password}

\Complete.sde

\Complete.sde

@\Images\Gradient.png

@\Images\Gradient.png

F@\Images\Control button.Shut.1.png

F@\Images\Control button.Shut.1.png

\Images\Control button.Shut.2.png

\Images\Control button.Shut.2.png

\Images\Control button.Shut.3.png

\Images\Control button.Shut.3.png

R@\Images\Control button.Minimized.1.png

R@\Images\Control button.Minimized.1.png

\Images\Control button.Minimized.2.png

\Images\Control button.Minimized.2.png

\Images\Control button.Minimized.3.png

\Images\Control button.Minimized.3.png

\Images\HeadBillBack.png

\Images\HeadBillBack.png

4@\Images\Classification.Personal.png

4@\Images\Classification.Personal.png

\Images\Classification.Task.png

\Images\Classification.Task.png

\Images\Classification.Props.png

\Images\Classification.Props.png

hXXp://bbs.suda123.com/my/default.html

hXXp://bbs.suda123.com/my/default.html

\TaskImages\Gold.png

\TaskImages\Gold.png

\Images\Picture frame.Task.png

\Images\Picture frame.Task.png

6@\Images\Picture frame.Props.png

6@\Images\Picture frame.Props.png

kuwo.zip

kuwo.zip

haoya.zip

haoya.zip

kugou.zip

kugou.zip

baof.zip

baof.zip

{AccessKey}

{AccessKey}

hXXp://bbs.suda123.com/my/avatar_client.aspx

hXXp://bbs.suda123.com/my/avatar_client.aspx

`h@\LoginImages\

`h@\LoginImages\

Logon.background.png

Logon.background.png

Logon.Logo.png

Logon.Logo.png

Logon.Text.png

Logon.Text.png

MeT_Panel_MainMenuButton_QQ.png

MeT_Panel_MainMenuButton_QQ.png

Q@bbs.suda123.com

Q@bbs.suda123.com

@W@Login.Button.Mioel.1.png

@W@Login.Button.Mioel.1.png

Login.Button.Mioel.2.png

Login.Button.Mioel.2.png

Login.Button.Mioel.3.png

Login.Button.Mioel.3.png

SUDAZUOMIAN-ClassModule-34895-[cmd]-[AccesKey]

SUDAZUOMIAN-ClassModule-34895-[cmd]-[AccesKey]

scripting.FileSystemObject

scripting.FileSystemObject

Shell.Application

Shell.Application

{00020404-0000-0000-C000-000000000046}

{00020404-0000-0000-C000-000000000046}

bdllq.zip

bdllq.zip

\Eitoele.sds

\Eitoele.sds

pptv.zip

pptv.zip

sgllq.zip

sgllq.zip

QQLogin.Ring.gif

QQLogin.Ring.gif

ppsbfq.zip

ppsbfq.zip

|*.jpg;*.jpeg;*.gif;*.png;*.bmp

|*.jpg;*.jpeg;*.gif;*.png;*.bmp

_Large.jpg

_Large.jpg

hXXp://my.suda123.com/lz/

hXXp://my.suda123.com/lz/

jsdb.zip

jsdb.zip

sougou.zip

sougou.zip

hXXp://bbs.suda123.com/login.html?mod=bindaccess_token=

hXXp://bbs.suda123.com/login.html?mod=bindaccess_token=

360sd.zip

360sd.zip

###{].WLGG

###{].WLGG

D4(111

D4(111

%cymYY

%cymYY

fTPZ

fTPZ

..NKNNV

..NKNNV

\TaskImages\to.png

\TaskImages\to.png

\Images\Pictures.Ask.png

\Images\Pictures.Ask.png

\Images\Immediately.png

\Images\Immediately.png

\Images\Immediately2.png

\Images\Immediately2.png

\Images\Immediately3.png

\Images\Immediately3.png

txqq.zip

txqq.zip

360llq.zip

360llq.zip

bdpy.zip

bdpy.zip

(sdbak,zip)|*.zip;*.sdbak

(sdbak,zip)|*.zip;*.sdbak

*.url

*.url

xunlei7.zip

xunlei7.zip

\.Gtn

\.Gtn

B.gs{

B.gs{

,I.UU]

,I.UU]

\.GMMM

\.GMMM

^Z*e2.EQR

^Z*e2.EQR

^`@h0.WQ

^`@h0.WQ

3.AP].

3.AP].

{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}

{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}

360ws.zip

360ws.zip

hXXp://union.suda123.com

hXXp://union.suda123.com

].sdbak

].sdbak

hXXp://bbs.suda123.com/desk_gjjy/list-1.html

hXXp://bbs.suda123.com/desk_gjjy/list-1.html

AppData\Roaming\wzsd123\wzsd123_url.exe

AppData\Roaming\wzsd123\wzsd123_url.exe

hXXp://bbs.suda123.com/register.html?mod=bindaccess_token=

hXXp://bbs.suda123.com/register.html?mod=bindaccess_token=

hXXp://bbs.suda123.com/api.asmx

hXXp://bbs.suda123.com/api.asmx

hXXp://bbs.suda123.com

hXXp://bbs.suda123.com

\TaskImages\Border2.png

\TaskImages\Border2.png

\TaskImages\Border1.png

\TaskImages\Border1.png

\TaskImages\new.png

\TaskImages\new.png

{B96B3CAB-0728-11D3-9D7B-0000F81EF32E}

{B96B3CAB-0728-11D3-9D7B-0000F81EF32E}

X.ULn

X.ULn

\PropsImages\sign.png

\PropsImages\sign.png

{B96B3CB0-0728-11D3-9D7B-0000F81EF32E}

{B96B3CB0-0728-11D3-9D7B-0000F81EF32E}

http\shell\open\command\

http\shell\open\command\

\Internet Explorer\iexplore.exe

\Internet Explorer\iexplore.exe

%S~-D

%S~-D

TT:)n%S

TT:)n%S

.TTB`

.TTB`

E.Gi&

E.Gi&

Adobe Photoshop CS5 Windows

Adobe Photoshop CS5 Windows

2012:05:26 23:11:04

2012:05:26 23:11:04

IEC hXXp://VVV.iec.ch

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

CRT curv

urlTEXT

urlTEXT

MsgeTEXT

MsgeTEXT

hXXp://ns.adobe.com/xap/1.0/

hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • Adobe Photoshop CS2 Windows

    Adobe Photoshop CS2 Windows

    2012:12:13 19:55:25

    2012:12:13 19:55:25

    xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">

    xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">

    Adobe Photoshop CS2 Windows

    Adobe Photoshop CS2 Windows

    xmlns:xapMM="hXXp://ns.adobe.com/xap/1.0/mm/"

    xmlns:xapMM="hXXp://ns.adobe.com/xap/1.0/mm/"

    xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"

    xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"

    xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#">

    xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#">

    xmp.did:3B5D91660071E11188B8FC618424A310

    xmp.did:3B5D91660071E11188B8FC618424A310

    xmp.iid:3B5D91660071E11188B8FC618424A310

    xmp.iid:3B5D91660071E11188B8FC618424A310

    Adobe Photoshop CS5 Windows

    Adobe Photoshop CS5 Windows

    xmp.iid:3C5D91660071E11188B8FC618424A310

    xmp.iid:3C5D91660071E11188B8FC618424A310

    xmp.iid:F8D91603E4F8E111BD1F922CDD38E2C4

    xmp.iid:F8D91603E4F8E111BD1F922CDD38E2C4

    xmp.iid:09728703EBF8E1119DD78D81E2BBF94B

    xmp.iid:09728703EBF8E1119DD78D81E2BBF94B

    xmp.iid:0A728703EBF8E1119DD78D81E2BBF94B

    xmp.iid:0A728703EBF8E1119DD78D81E2BBF94B

    xmlns:dc="hXXp://purl.org/dc/elements/1.1/">

    xmlns:dc="hXXp://purl.org/dc/elements/1.1/">

    xmlns:crs="hXXp://ns.adobe.com/camera-raw-settings/1.0/">

    xmlns:crs="hXXp://ns.adobe.com/camera-raw-settings/1.0/">

    xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/">

    xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/">

  • xmp.did:3B5D91660071E11188B8FC618424A310

  • xmp.did:3B5D91660071E11188B8FC618424A310

  • xmp.did:3D5D91660071E11188B8FC618424A310

  • xmp.did:3D5D91660071E11188B8FC618424A310

    • xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/">

    xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/">

    xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">

    xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">

    i6.go

    i6.go

    2012:12:13 20:58:39

    2012:12:13 20:58:39

    .mouv;

    .mouv;

    2012:12:11 20:45:49

    2012:12:11 20:45:49

    xmp.iid:0A728703EBF8E1119DD78D81E2BBF94B

    xmp.iid:0A728703EBF8E1119DD78D81E2BBF94B

    xmp.did:3B5D91660071E11188B8FC618424A310

    xmp.did:3B5D91660071E11188B8FC618424A310

    2012:12:11 20:39:57

    2012:12:11 20:39:57

    2012:09:07 20:53:25

    2012:09:07 20:53:25

    r0n.mYU>

    r0n.mYU>

    PhXXp://ns.adobe.com/xap/1.0/

    PhXXp://ns.adobe.com/xap/1.0/

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310
  • xmp.did:3D5D91660071E11188B8FC618424A310

    • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310
  • xmp.did:3D5D91660071E11188B8FC618424A310

    • 2012:09:07 21:01:44

    2012:09:07 21:01:44

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310
  • xmp.did:3D5D91660071E11188B8FC618424A310

    • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310
  • xmp.did:3D5D91660071E11188B8FC618424A310

    • 2012:07:22 13:34:20

    2012:07:22 13:34:20

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • q%XTwV

    q%XTwV

    >%S]G

    >%S]G

    2012:07:22 13:34:52

    2012:07:22 13:34:52

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • .WnnLuF3)H

    .WnnLuF3)H

    -%umLUr,

    -%umLUr,

    }E.le

    }E.le

    2012:07:22 13:30:26

    2012:07:22 13:30:26

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:07:22 13:31:15

    2012:07:22 13:31:15

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 21:58:39

    2012:03:18 21:58:39

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 21:58:00

    2012:03:18 21:58:00

    %Ui]_I

    %Ui]_I

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:14:33

    2012:03:18 22:14:33

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:14:02

    2012:03:18 22:14:02

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:05:45

    2012:03:18 22:05:45

    lz.oW

    lz.oW

    K.nXmO{n

    K.nXmO{n

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:06:11

    2012:03:18 22:06:11

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:22:00

    2012:03:18 22:22:00

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:22:37

    2012:03:18 22:22:37

    -gg}P

    -gg}P

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:09:07 20:03:18

    2012:09:07 20:03:18

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:09:07 20:04:39

    2012:09:07 20:04:39

    LhXXp://ns.adobe.com/xap/1.0/

    LhXXp://ns.adobe.com/xap/1.0/

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310

    • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310

    • ÿ*B

    ÿ*B

    %UV/lTa

    %UV/lTa

    Ss9.VA

    Ss9.VA

    .gll9vF

    .gll9vF

    2012:03:18 21:53:25

    2012:03:18 21:53:25

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 21:54:12

    2012:03:18 21:54:12

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • |8gy%f

    |8gy%f

    hXXp://VVV.suda123.com

    hXXp://VVV.suda123.com

    : 20130601

    : 20130601

    Copyright 2012-2013 VVV.suda123.com

    Copyright 2012-2013 VVV.suda123.com

    2012:12:13 19:58:45

    2012:12:13 19:58:45

    @LhXXp://ns.adobe.com/xap/1.0/

    @LhXXp://ns.adobe.com/xap/1.0/

    xmp.did:6BAFFB4E450AE211B554804AE8C594B7

    xmp.did:6BAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6BAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6BAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6CAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6CAFFB4E450AE211B554804AE8C594B7

    xmp.did:6BAFFB4E450AE211B554804AE8C594B7

    xmp.did:6BAFFB4E450AE211B554804AE8C594B7

    Kv.grn

    Kv.grn

    2012:12:13 19:59:34

    2012:12:13 19:59:34

    .Photoshop 3.0

    .Photoshop 3.0

    2012:12:11 20:16:10

    2012:12:11 20:16:10

    @OhXXp://ns.adobe.com/xap/1.0/

    @OhXXp://ns.adobe.com/xap/1.0/

    xmp.iid:6CAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6CAFFB4E450AE211B554804AE8C594B7

    2012:12:11 20:50:58

    2012:12:11 20:50:58

    xmp.did:6AAFFB4E450AE211B554804AE8C594B7

    xmp.did:6AAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6AAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6AAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6AAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6AAFFB4E450AE211B554804AE8C594B7

    xmp.did:66AFFB4E450AE211B554804AE8C594B7

    xmp.did:66AFFB4E450AE211B554804AE8C594B7

    2012:09:29 22:52:36

    2012:09:29 22:52:36

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • .coER

    .coER

    2012:09:29 22:54:56

    2012:09:29 22:54:56

    -k}

    -k}

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • X.giM$"

    X.giM$"

    .PpB0

    .PpB0

    ```___@@@???///

    ```___@@@???///

    vh%S*

    vh%S*

    N.aqXshC

    N.aqXshC

    PasswordText

    PasswordText

    Webbrowser

    Webbrowser

    inflate 1.1.3 Copyright 1995-1998 Mark Adler

    inflate 1.1.3 Copyright 1995-1998 Mark Adler

    1.2.18

    1.2.18

    %*.*f

    %*.*f

    CNotSupportedException

    CNotSupportedException

    commctrl_DragListMsg

    commctrl_DragListMsg

    Afx:%x:%x:%x:%x:%x

    Afx:%x:%x:%x:%x:%x

    Afx:%x:%x

    Afx:%x:%x

    COMCTL32.DLL

    COMCTL32.DLL

    CCmdTarget

    CCmdTarget

    MSWHEEL_ROLLMSG

    MSWHEEL_ROLLMSG

    __MSVCRT_HEAP_SELECT

    __MSVCRT_HEAP_SELECT

    >0123456789ABCDEF deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

    >0123456789ABCDEF deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

    F%D,3

    F%D,3

    SHLWAPI.dll

    SHLWAPI.dll

    .PAVCException@@

    .PAVCException@@

    .PAVCNotSupportedException@@

    .PAVCNotSupportedException@@

    .PAVCFileException@@

    .PAVCFileException@@

    (*.prn)|*.prn|

    (*.prn)|*.prn|

    (*.*)|*.*||

    (*.*)|*.*||

    Shell32.dll

    Shell32.dll

    Mpr.dll

    Mpr.dll

    Advapi32.dll

    Advapi32.dll

    (&07-034/)7 '

    (&07-034/)7 '

    ?? / %d]

    ?? / %d]

    %d / %d]

    %d / %d]

    : %d]

    : %d]

    (*.WAV;*.MID)|*.WAV;*.MID|WAV

    (*.WAV;*.MID)|*.WAV;*.MID|WAV

    (*.WAV)|*.WAV|MIDI

    (*.WAV)|*.WAV|MIDI

    (*.MID)|*.MID|

    (*.MID)|*.MID|

    (*.txt)|*.txt|

    (*.txt)|*.txt|

    (*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

    (*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

    (*.JPG)|*.JPG|BMP

    (*.JPG)|*.JPG|BMP

    (*.BMP)|*.BMP|GIF

    (*.BMP)|*.BMP|GIF

    (*.GIF)|*.GIF|

    (*.GIF)|*.GIF|

    (*.ICO)|*.ICO|

    (*.ICO)|*.ICO|

    (*.CUR)|*.CUR|

    (*.CUR)|*.CUR|

    %s:%d

    %s:%d

    windows

    windows

    out.prn

    out.prn

    %d.%d

    %d.%d

    %d / %d

    %d / %d

    %d/%d

    %d/%d

    Bogus message code %d

    Bogus message code %d

    (%d-%d):

    (%d-%d):

    %ld%c

    %ld%c

    VVV.dywt.com.cn

    VVV.dywt.com.cn

    USER32.DLL

    USER32.DLL

    HTTP/1.0

    HTTP/1.0

    %s

    %s

    Reply-To: %s

    Reply-To: %s

    From: %s

    From: %s

    To: %s

    To: %s

    Subject: %s

    Subject: %s

    Date: %s

    Date: %s

    Cc: %s

    Cc: %s

    %a, %d %b %Y %H:%M:%S

    %a, %d %b %Y %H:%M:%S

    SMTP

    SMTP

    code %d bits %d->%d

    code %d bits %d->%d

    gen_codes: max_code %d

    gen_codes: max_code %d

    bl code -

    bl code -

    opt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u

    opt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u

    last_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%)

    last_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%)

    1.1.3

    1.1.3

    %Y-%m-%d %H:%M:%S

    %Y-%m-%d %H:%M:%S

    FADODB.Connection

    FADODB.Connection

    ;Jet OLEDB:Database Password=

    ;Jet OLEDB:Database Password=

    Provider=Microsoft.Jet.OLEDB.4.0; Data Source=

    Provider=Microsoft.Jet.OLEDB.4.0; Data Source=

    Description: %s

    Description: %s

    State: %s, Native: %d, Source: %s

    State: %s, Native: %d, Source: %s

    FADODB.Recordset

    FADODB.Recordset

    (*.avi)|*.avi

    (*.avi)|*.avi

    WPFT532.CNV

    WPFT532.CNV

    WPFT632.CNV

    WPFT632.CNV

    EXCEL32.CNV

    EXCEL32.CNV

    write32.wpc

    write32.wpc

    Windows Write

    Windows Write

    mswrd632.wpc

    mswrd632.wpc

    Word for Windows 6.0

    Word for Windows 6.0

    wword5.cnv

    wword5.cnv

    Word for Windows 5.0

    Word for Windows 5.0

    mswrd832.cnv

    mswrd832.cnv

    mswrd632.cnv

    mswrd632.cnv

    Word 6.0/95 for Windows & Macintosh

    Word 6.0/95 for Windows & Macintosh

    html32.cnv

    html32.cnv

    %d%d%d

    %d%d%d

    rundll32.exe shell32.dll,

    rundll32.exe shell32.dll,

    1.0.6

    1.0.6

    \shell32.dll

    \shell32.dll

    hXXp://VVV.eyuyan.com

    hXXp://VVV.eyuyan.com

    service@dywt.com.cn

    service@dywt.com.cn

    86(0411)39895834

    86(0411)39895834

    86(0411)39895831

    86(0411)39895831

    This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info

    This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info

    DelAllKeyValues

    DelAllKeyValues

    DelKeyValue

    DelKeyValue

    GetAllKeys

    GetAllKeys

    GetKeyValue

    GetKeyValue

    AddKeyValue

    AddKeyValue

    DSGetErrMsg

    DSGetErrMsg

    BiTreeGetCurNodeKey

    BiTreeGetCurNodeKey

    ListGetCurNodeKey

    ListGetCurNodeKey

    ListUpdateNodeFromKey

    ListUpdateNodeFromKey

    ListRemoveNodeFromKey

    ListRemoveNodeFromKey

    edatastructure_fnMapDelAllKeyValues

    edatastructure_fnMapDelAllKeyValues

    edatastructure_fnMapDelKeyValue

    edatastructure_fnMapDelKeyValue

    edatastructure_fnMapGetAllKeys

    edatastructure_fnMapGetAllKeys

    edatastructure_fnMapGetKeyValue

    edatastructure_fnMapGetKeyValue

    edatastructure_fnMapAddKeyValue

    edatastructure_fnMapAddKeyValue

    edatastructure_fnBiTreeGetCurNodeKey

    edatastructure_fnBiTreeGetCurNodeKey

    edatastructure_fnListGetCurNodeKey

    edatastructure_fnListGetCurNodeKey

    edatastructure_fnListUpdateNodeFromKey

    edatastructure_fnListUpdateNodeFromKey

    edatastructure_fnListRemoveNodeFromKey

    edatastructure_fnListRemoveNodeFromKey

    ;3 #>6.&

    ;3 #>6.&

    '2, / 0&7!4-)1#

    '2, / 0&7!4-)1#

    (*.htm;*.html)|*.htm;*.html

    (*.htm;*.html)|*.htm;*.html

    .PAVCOleException@@

    .PAVCOleException@@

    .PAVCObject@@

    .PAVCObject@@

    .PAVCSimpleException@@

    .PAVCSimpleException@@

    .PAVCMemoryException@@

    .PAVCMemoryException@@

    .?AVCNotSupportedException@@

    .?AVCNotSupportedException@@

    .PAVCResourceException@@

    .PAVCResourceException@@

    .PAVCUserException@@

    .PAVCUserException@@

    .?AVCCmdTarget@@

    .?AVCCmdTarget@@

    .?AVCCmdUI@@

    .?AVCCmdUI@@

    .?AVCTestCmdUI@@

    .?AVCTestCmdUI@@

    .PAVCOleDispatchException@@

    .PAVCOleDispatchException@@

    .PAVCArchiveException@@

    .PAVCArchiveException@@

    Corrupt JPEG data: found marker 0xx instead of RST%d

    Corrupt JPEG data: found marker 0xx instead of RST%d

    Warning: unknown JFIF revision number %d.d

    Warning: unknown JFIF revision number %d.d

    Corrupt JPEG data: %u extraneous bytes before marker 0xx

    Corrupt JPEG data: %u extraneous bytes before marker 0xx

    Inconsistent progression sequence for component %d coefficient %d

    Inconsistent progression sequence for component %d coefficient %d

    Unknown Adobe color transform code %d

    Unknown Adobe color transform code %d

    Obtained XMS handle %u

    Obtained XMS handle %u

    Freed XMS handle %u

    Freed XMS handle %u

    Unrecognized component IDs %d %d %d, assuming YCbCr

    Unrecognized component IDs %d %d %d, assuming YCbCr

    JFIF extension marker: RGB thumbnail image, length %u

    JFIF extension marker: RGB thumbnail image, length %u

    JFIF extension marker: palette thumbnail image, length %u

    JFIF extension marker: palette thumbnail image, length %u

    JFIF extension marker: JPEG-compressed thumbnail image, length %u

    JFIF extension marker: JPEG-compressed thumbnail image, length %u

    Opened temporary file %s

    Opened temporary file %s

    Closed temporary file %s

    Closed temporary file %s

    Ss=%d, Se=%d, Ah=%d, Al=%d

    Ss=%d, Se=%d, Ah=%d, Al=%d

    Component %d: dc=%d ac=%d

    Component %d: dc=%d ac=%d

    Start Of Scan: %d components

    Start Of Scan: %d components

    Component %d: %dhx%dv q=%d

    Component %d: %dhx%dv q=%d

    Start Of Frame 0xx: width=%u, height=%u, components=%d

    Start Of Frame 0xx: width=%u, height=%u, components=%d

    Smoothing not supported with nonstandard sampling ratios

    Smoothing not supported with nonstandard sampling ratios

    RST%d

    RST%d

    At marker 0xx, recovery action %d

    At marker 0xx, recovery action %d

    Selected %d colors for quantization

    Selected %d colors for quantization

    Quantizing to %d colors

    Quantizing to %d colors

    Quantizing to %d = %d*%d*%d colors

    Quantizing to %d = %d*%d*%d colors

    %4u %4u %4u %4u %4u %4u %4u %4u

    %4u %4u %4u %4u %4u %4u %4u %4u

    Unexpected marker 0xx

    Unexpected marker 0xx

    Miscellaneous marker 0xx, length %u

    Miscellaneous marker 0xx, length %u

    with %d x %d thumbnail image

    with %d x %d thumbnail image

    JFIF extension marker: type 0xx, length %u

    JFIF extension marker: type 0xx, length %u

    Warning: thumbnail image size does not match data length %u

    Warning: thumbnail image size does not match data length %u

    JFIF APP0 marker: version %d.d, density %dx%d %d

    JFIF APP0 marker: version %d.d, density %dx%d %d

    = = = = = = = =

    = = = = = = = =

    Obtained EMS handle %u

    Obtained EMS handle %u

    Freed EMS handle %u

    Freed EMS handle %u

    Define Restart Interval %u

    Define Restart Interval %u

    Define Quantization Table %d precision %d

    Define Quantization Table %d precision %d

    Define Huffman Table 0xx

    Define Huffman Table 0xx

    Define Arithmetic Table 0xx: 0xx

    Define Arithmetic Table 0xx: 0xx

    Unknown APP14 marker (not Adobe), length %u

    Unknown APP14 marker (not Adobe), length %u

    Unknown APP0 marker (not JFIF), length %u

    Unknown APP0 marker (not JFIF), length %u

    Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

    Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

    Unsupported marker type 0xx

    Unsupported marker type 0xx

    Failed to create temporary file %s

    Failed to create temporary file %s

    Unsupported JPEG process: SOF type 0xx

    Unsupported JPEG process: SOF type 0xx

    Cannot quantize to more than %d colors

    Cannot quantize to more than %d colors

    Cannot quantize to fewer than %d colors

    Cannot quantize to fewer than %d colors

    Cannot quantize more than %d color components

    Cannot quantize more than %d color components

    Insufficient memory (case %d)

    Insufficient memory (case %d)

    Not a JPEG file: starts with 0xx 0xx

    Not a JPEG file: starts with 0xx 0xx

    Quantization table 0xx was not defined

    Quantization table 0xx was not defined

    Huffman table 0xx was not defined

    Huffman table 0xx was not defined

    Backing store not supported

    Backing store not supported

    Arithmetic table 0xx was not defined

    Arithmetic table 0xx was not defined

    Cannot transcode due to multiple use of quantization table %d

    Cannot transcode due to multiple use of quantization table %d

    Maximum supported image dimension is %u pixels

    Maximum supported image dimension is %u pixels

    Empty JPEG image (DNL not supported)

    Empty JPEG image (DNL not supported)

    Bogus DQT index %d

    Bogus DQT index %d

    Bogus DHT index %d

    Bogus DHT index %d

    Bogus DAC value 0x%x

    Bogus DAC value 0x%x

    Bogus DAC index %d

    Bogus DAC index %d

    Unsupported color conversion request

    Unsupported color conversion request

    Too many color components: %d, max %d

    Too many color components: %d, max %d

    Buffer passed to JPEG library is too small

    Buffer passed to JPEG library is too small

    JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

    JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

    Improper call to JPEG library in state %d

    Improper call to JPEG library in state %d

    Invalid scan script at entry %d

    Invalid scan script at entry %d

    Invalid progressive parameters at scan script entry %d

    Invalid progressive parameters at scan script entry %d

    Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

    Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

    Unsupported JPEG data precision %d

    Unsupported JPEG data precision %d

    Invalid memory pool code %d

    Invalid memory pool code %d

    Wrong JPEG library version: library is %d, caller expects %d

    Wrong JPEG library version: library is %d, caller expects %d

    Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

    Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

    DCT scaled block size %dx%d not supported

    DCT scaled block size %dx%d not supported

    Invalid component ID %d in SOS

    Invalid component ID %d in SOS

    NULL row buffer for row %ld, pass %d

    NULL row buffer for row %ld, pass %d

    libpng error: %s

    libpng error: %s

    libpng warning: %s

    libpng warning: %s

    Unknown zTXt compression type %d

    Unknown zTXt compression type %d

    gamma = (%d/100000)

    gamma = (%d/100000)

    gx=%f, gy=%f, bx=%f, by=%f

    gx=%f, gy=%f, bx=%f, by=%f

    wx=%f, wy=%f, rx=%f, ry=%f

    wx=%f, wy=%f, rx=%f, ry=%f

    incorrect gamma=(%d/100000)

    incorrect gamma=(%d/100000)

    %s: Cannot open

    %s: Cannot open

    %s: Write error at scanline %lu

    %s: Write error at scanline %lu

    %s: Seek error at scanline %lu

    %s: Seek error at scanline %lu

    %u: Sample out of range, max %u

    %u: Sample out of range, max %u

    %s: Cannot modify tag "%s" while writing

    %s: Cannot modify tag "%s" while writing

    %s: Unknown %stag %u

    %s: Unknown %stag %u

    %f: Bad value for "%s"

    %f: Bad value for "%s"

    %s: Invalid %stag "%s" (not supported by codec)

    %s: Invalid %stag "%s" (not supported by codec)

    TIFFVSetField ... pass by value not imp.

    TIFFVSetField ... pass by value not imp.

    %ld: Bad value for "%s"

    %ld: Bad value for "%s"

    %d: Bad value for "%s"

    %d: Bad value for "%s"

    Nonstandard tile length %d, convert file

    Nonstandard tile length %d, convert file

    Nonstandard tile width %d, convert file

    Nonstandard tile width %d, convert file

    Bad value %ld for "%s" tag ignored

    Bad value %ld for "%s" tag ignored

    %s: Invalid InkNames value; expecting %d names, found %d

    %s: Invalid InkNames value; expecting %d names, found %d

    TIFFVGetField ... pass by value not imp.

    TIFFVGetField ... pass by value not imp.

    Sorry, can not handle images with %d-bit samples

    Sorry, can not handle images with %d-bit samples

    Sorry, can not handle LogLuv images with %s=%d

    Sorry, can not handle LogLuv images with %s=%d

    Sorry, LogLuv data must have %s=%d or %d

    Sorry, LogLuv data must have %s=%d or %d

    Sorry, can not handle image with %s=%d

    Sorry, can not handle image with %s=%d

    Sorry, LogL data must have %s=%d

    Sorry, LogL data must have %s=%d

    Sorry, can not handle separated image with %s=%d

    Sorry, can not handle separated image with %s=%d

    Sorry, can not handle RGB image with %s=%d

    Sorry, can not handle RGB image with %s=%d

    Sorry, can not handle YCbCr images with %s=%d

    Sorry, can not handle YCbCr images with %s=%d

    Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

    Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

    Missing needed %s tag

    Missing needed %s tag

    Sorry, can not image with %d-bit samples

    Sorry, can not image with %d-bit samples

    "%s": Bad mode

    "%s": Bad mode

    Not a TIFF file, bad version number %d (0x%x)

    Not a TIFF file, bad version number %d (0x%x)

    Not a TIFF file, bad magic number %d (0x%x)

    Not a TIFF file, bad magic number %d (0x%x)

    %s: Out of memory (TIFF structure)

    %s: Out of memory (TIFF structure)

    Sample %d out of range, max %u

    Sample %d out of range, max %u

    Internal error, unknown tag 0x%x

    Internal error, unknown tag 0x%x

    Tag %d

    Tag %d

    %s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

    %s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

    %s: Read error at scanline %lu; got %lu bytes, expected %lu

    %s: Read error at scanline %lu; got %lu bytes, expected %lu

    %s: Seek error at scanline %lu, strip %lu

    %s: Seek error at scanline %lu, strip %lu

    %s: Data buffer too small to hold strip %lu

    %s: Data buffer too small to hold strip %lu

    %s: Read error on strip %lu; got %lu bytes, expected %lu

    %s: Read error on strip %lu; got %lu bytes, expected %lu

    %s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

    %s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

    %s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

    %s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

    %s: Seek error at row %ld, col %ld, tile %ld

    %s: Seek error at row %ld, col %ld, tile %ld

    %s: Data buffer too small to hold tile %ld

    %s: Data buffer too small to hold tile %ld

    %s: No space for data buffer at scanline %ld

    %s: No space for data buffer at scanline %ld

    Compression scheme %u %s encoding is not implemented

    Compression scheme %u %s encoding is not implemented

    %s %s encoding is not implemented

    %s %s encoding is not implemented

    %s %s encoding is no longer implemented due to Unisys patent enforcement

    %s %s encoding is no longer implemented due to Unisys patent enforcement

    Compression scheme %u %s decoding is not implemented

    Compression scheme %u %s decoding is not implemented

    %s %s decoding is not implemented

    %s %s decoding is not implemented

    Compression algorithm does not support random access

    Compression algorithm does not support random access

    Bogus "%s" field, ignoring and calculating from imagelength

    Bogus "%s" field, ignoring and calculating from imagelength

    TIFF directory is missing required "%s" field, calculating from imagelength

    TIFF directory is missing required "%s" field, calculating from imagelength

    wrong data type %d for "%s"; tag ignored

    wrong data type %d for "%s"; tag ignored

    unknown field with tag %d (0x%x) encountered

    unknown field with tag %d (0x%x) encountered

    No space %s

    No space %s

    TIFF directory is missing required "%s" field

    TIFF directory is missing required "%s" field

    incorrect count for field "%s" (%lu, expecting %lu); tag ignored

    incorrect count for field "%s" (%lu, expecting %lu); tag ignored

    Error fetching data for field "%s"

    Error fetching data for field "%s"

    %s: Rational with zero denominator (num = %lu)

    %s: Rational with zero denominator (num = %lu)

    Cannot handle different per-sample values for field "%s"

    Cannot handle different per-sample values for field "%s"

    cannot read TIFF_ANY type %d for field "%s"

    cannot read TIFF_ANY type %d for field "%s"

    "%s": Information lost writing value (%g) as (unsigned) RATIONAL

    "%s": Information lost writing value (%g) as (unsigned) RATIONAL

    Error writing data for field "%s"

    Error writing data for field "%s"

    %s: Error writing SubIFD directory link

    %s: Error writing SubIFD directory link

    %s compression support is not configured

    %s compression support is not configured

    ?%s: No space for LogLuv state block

    ?%s: No space for LogLuv state block

    Inappropriate photometric interpretation %d for SGILog compression; %s

    Inappropriate photometric interpretation %d for SGILog compression; %s

    LogL16Decode: Not enough data at row %d (short %d pixels)

    LogL16Decode: Not enough data at row %d (short %d pixels)

    LogLuvDecode24: Not enough data at row %d (short %d pixels)

    LogLuvDecode24: Not enough data at row %d (short %d pixels)

    LogLuvDecode32: Not enough data at row %d (short %d pixels)

    LogLuvDecode32: Not enough data at row %d (short %d pixels)

    %s: No space for SGILog translation buffer

    %s: No space for SGILog translation buffer

    No support for converting user data format to LogL

    No support for converting user data format to LogL

    No support for converting user data format to LogLuv

    No support for converting user data format to LogLuv

    SGILog compression supported only for %s, or raw data

    SGILog compression supported only for %s, or raw data

    Unknown data format %d for LogLuv compression

    Unknown data format %d for LogLuv compression

    Unknown encoding %d for LogLuv compression

    Unknown encoding %d for LogLuv compression

    %s: No space for state block

    %s: No space for state block

    %s: Bad code word at scanline %d (x %lu)

    %s: Bad code word at scanline %d (x %lu)

    %s: %s at scanline %d (got %lu, expected %lu)

    %s: %s at scanline %d (got %lu, expected %lu)

    %s: Premature EOF at scanline %d (x %lu)

    %s: Premature EOF at scanline %d (x %lu)

    %s: No space for Group 3/4 reference line

    %s: No space for Group 3/4 reference line

    %s: No space for Group 3/4 run arrays

    %s: No space for Group 3/4 run arrays

    %s: Uncompressed data (not supported) at scanline %d (x %lu)

    %s: Uncompressed data (not supported) at scanline %d (x %lu)

    Fax SubAddress: %s

    Fax SubAddress: %s

    (%u = 0x%x)

    (%u = 0x%x)

    %suncompressed data

    %suncompressed data

    %sEOL padding

    %sEOL padding

    %s2-d encoding

    %s2-d encoding

    Improper JPEG sampling factors %d,%d

    Improper JPEG sampling factors %d,%d

    Apparently should be %d,%d,decompressor will try reading with sampling %d,%d

    Apparently should be %d,%d,decompressor will try reading with sampling %d,%d

    Improper JPEG strip/tile size, expected %dx%d, got %dx%d

    Improper JPEG strip/tile size, expected %dx%d, got %dx%d

    RowsPerStrip must be multiple of %d for JPEG

    RowsPerStrip must be multiple of %d for JPEG

    JPEG tile width must be multiple of %d

    JPEG tile width must be multiple of %d

    JPEG tile height must be multiple of %d

    JPEG tile height must be multiple of %d

    BitsPerSample %d not allowed for JPEG

    BitsPerSample %d not allowed for JPEG

    PhotometricInterpretation %d not allowed for JPEG

    PhotometricInterpretation %d not allowed for JPEG

    ThunderDecode: %s data at scanline %ld (%lu != %lu)

    ThunderDecode: %s data at scanline %ld (%lu != %lu)

    PackBitsDecode: discarding %d bytes to avoid buffer overrun

    PackBitsDecode: discarding %d bytes to avoid buffer overrun

    LZWDecode: Not enough data at scanline %d (short %d bytes)

    LZWDecode: Not enough data at scanline %d (short %d bytes)

    LZWDecode: Strip %d not terminated with EOI code

    LZWDecode: Strip %d not terminated with EOI code

    LZWDecode: Bogus encoding, loop in the code table; scanline %d

    LZWDecode: Bogus encoding, loop in the code table; scanline %d

    LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

    LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

    DumpModeDecode: Not enough data for scanline %d

    DumpModeDecode: Not enough data for scanline %d

    Horizontal differencing "Predictor" not supported with %d-bit samples

    Horizontal differencing "Predictor" not supported with %d-bit samples

    "Predictor" value %d not supported

    "Predictor" value %d not supported

    %u (0x%x)

    %u (0x%x)

    suda123.com

    suda123.com

    c:\%original file name%.exe

    c:\%original file name%.exe

    #include "l.chs\afxres.rc" // Standard components

    #include "l.chs\afxres.rc" // Standard components

    GetCPInfo

    GetCPInfo

    GetWindowsDirectoryA

    GetWindowsDirectoryA

    WinExec

    WinExec

    GetProcessHeap

    GetProcessHeap

    RegDeleteKeyA

    RegDeleteKeyA

    RegCreateKeyA

    RegCreateKeyA

    RegOpenKeyExA

    RegOpenKeyExA

    RegCloseKey

    RegCloseKey

    RegCreateKeyExA

    RegCreateKeyExA

    OffsetViewportOrgEx

    OffsetViewportOrgEx

    SetViewportExtEx

    SetViewportExtEx

    ScaleViewportExtEx

    ScaleViewportExtEx

    GetViewportExtEx

    GetViewportExtEx

    GetViewportOrgEx

    GetViewportOrgEx

    CreateDialogIndirectParamA

    CreateDialogIndirectParamA

    UnregisterHotKey

    UnregisterHotKey

    RegisterHotKey

    RegisterHotKey

    EnumChildWindows

    EnumChildWindows

    InternetCanonicalizeUrlA

    InternetCanonicalizeUrlA

    InternetCrackUrlA

    InternetCrackUrlA

    `.rdata

    `.rdata

    @.data

    @.data

    .Rfnt

    .Rfnt

    PAD

    PAD

    AVIFIL32.dll

    AVIFIL32.dll

    MSIMG32.dll

    MSIMG32.dll

    MSVFW32.dll

    MSVFW32.dll

    oledlg.dll

    oledlg.dll

    RASAPI32.dll

    RASAPI32.dll

    WINSPOOL.DRV

    WINSPOOL.DRV

    WLDAP32.dll

    WLDAP32.dll

    WS2_32.dll

    WS2_32.dll

    f.gWgrg

    f.gWgrg

    1.2.9.18

    1.2.9.18

    Reports

    Reports

    88888888886

    88888888886

    22222222220

    22222222220

    44444444442

    44444444442

    Cmdbars

    Cmdbars

    *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications

    *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications

    *\G{4AFFC9A0-5F99-101B-AF4E-00AA003F0F07}#9.0#0#%Program Files%\M

    *\G{4AFFC9A0-5F99-101B-AF4E-00AA003F0F07}#9.0#0#%Program Files%\M

    icrosoft Office\OFFICE11\MSACC.OLB#Microsoft Access 11.0 Object Library

    icrosoft Office\OFFICE11\MSACC.OLB#Microsoft Access 11.0 Object Library

    *\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\system32\stdole2.tlb#OLE Automation

    *\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\system32\stdole2.tlb#OLE Automation

    *\G{00000201-0000-0010-8000-00AA006D2EA4}#2.1#0#%Program Files%\Common Files\System\ado\msado21.tlb#Microsoft ActiveX Data Objects 2.1 Library

    *\G{00000201-0000-0010-8000-00AA006D2EA4}#2.1#0#%Program Files%\Common Files\System\ado\msado21.tlb#Microsoft ActiveX Data Objects 2.1 Library

    3, 3, 6, 1

    3, 3, 6, 1

    1.3.6.1

    1.3.6.1

    %original file name%.exe_1696_rwx_00401000_007B7000:

    {82B46959-3065-46a0-8340-3BB58B77A259}

    {82B46959-3065-46a0-8340-3BB58B77A259}

    bywayboy@gmail.com

    bywayboy@gmail.com

    hXXp://VVV.ecodeproject.cn/bbs

    hXXp://VVV.ecodeproject.cn/bbs

    :16882569

    :16882569

    kernel32.dll

    kernel32.dll

    ole32.dll

    ole32.dll

    msvcrt.dll

    msvcrt.dll

    fne.dll

    fne.dll

    t%SVh

    t%SVh

    t$(SSh

    t$(SSh

    |$D.tm

    |$D.tm

    ~%UVW

    ~%UVW

    u$SShe

    u$SShe

    gdiplus.dll

    gdiplus.dll

    GdiPlus.dll

    GdiPlus.dll

    user32.dll

    user32.dll

    Kernel32.dll

    Kernel32.dll

    shell32.dll

    shell32.dll

    shlwapi.dll

    shlwapi.dll

    wininet.dll

    wininet.dll

    WinINet.dll

    WinINet.dll

    Wininet.dll

    Wininet.dll

    User32.dll

    User32.dll

    Gdiplus.dll

    Gdiplus.dll

    Ole32.dll

    Ole32.dll

    gdi32.dll

    gdi32.dll

    msimg32.dll

    msimg32.dll

    imm32.dll

    imm32.dll

    UxTheme.dll

    UxTheme.dll

    comctl32.dll

    comctl32.dll

    Gdi32.dll

    Gdi32.dll

    winmm.dll

    winmm.dll

    dwmapi.dll

    dwmapi.dll

    ShellExecuteEx

    ShellExecuteEx

    UnhookWindowsHookEx

    UnhookWindowsHookEx

    SetWindowsHookExA

    SetWindowsHookExA

    HttpOpenRequestA

    HttpOpenRequestA

    HttpSendRequestA

    HttpSendRequestA

    HttpQueryInfoA

    HttpQueryInfoA

    InternetOpenUrlA

    InternetOpenUrlA

    GdipSetPenLineJoin

    GdipSetPenLineJoin

    GdipGetPenLineJoin

    GdipGetPenLineJoin

    GetKeyState

    GetKeyState

    ShellExecuteA

    ShellExecuteA

    GdipSetStringFormatHotkeyPrefix

    GdipSetStringFormatHotkeyPrefix

    GdipSetImageAttributesColorKeys

    GdipSetImageAttributesColorKeys

    GdipGetStringFormatHotkeyPrefix

    GdipGetStringFormatHotkeyPrefix

    {B6F7542F-B8FE-46a8-9605-98856A687097}

    {B6F7542F-B8FE-46a8-9605-98856A687097}

    az4%c

    az4%c

    Ex_DirectUI_MsgBox

    Ex_DirectUI_MsgBox

    msg_wnd

    msg_wnd

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\GUIFont.Facename

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\GUIFont.Facename

    \PropsImages\Border2.png

    \PropsImages\Border2.png

    \PropsImages\Border1.png

    \PropsImages\Border1.png

    *.ico|*.ico

    *.ico|*.ico

    hXXp://VVV.

    hXXp://VVV.

    hXXp://

    hXXp://

    \icoSD\logo1.ico

    \icoSD\logo1.ico

    \icoSD\logo2.ico

    \icoSD\logo2.ico

    \icoSD\logo3.ico

    \icoSD\logo3.ico

    screensnapshot.exe

    screensnapshot.exe

    hXXp://VVV.suda123.com/desk/apptext2.txt

    hXXp://VVV.suda123.com/desk/apptext2.txt

    [adslpass=

    [adslpass=

    hXXp://my.suda123.com/Wallpaper/Store/skin_

    hXXp://my.suda123.com/Wallpaper/Store/skin_

    \Wallpaper\WallpaperChanger.bmp

    \Wallpaper\WallpaperChanger.bmp

    desksd123_configure.exe

    desksd123_configure.exe

    \desksd123_configure.exe

    \desksd123_configure.exe

    \singls.txt

    \singls.txt

    \xsDesktop.exe

    \xsDesktop.exe

    .text

    .text

    .rdata

    .rdata

    .data

    .data

    .rsrc

    .rsrc

    .aspack

    .aspack

    .adata

    .adata

    The procedure entry point %s could not be located in the dynamic link library %s

    The procedure entry point %s could not be located in the dynamic link library %s

    The ordinal %u could not be located in the dynamic link library %s

    The ordinal %u could not be located in the dynamic link library %s

    "hXXp://crl.verisign.com/tss-ca.crl0

    "hXXp://crl.verisign.com/tss-ca.crl0

    hXXp://ocsp.verisign.com0

    hXXp://ocsp.verisign.com0

    Thawte Certification1

    Thawte Certification1

    0hXXp://crl.verisign.com/ThawteTimestampingCA.crl0

    0hXXp://crl.verisign.com/ThawteTimestampingCA.crl0

    #hXXp://logo.verisign.com/vslogo.gif0

    #hXXp://logo.verisign.com/vslogo.gif0

    2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

    2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

    /hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

    /hXXp://csc3-2010-crl.verisign.com/CSC3-2010.crl0D

    hXXps://VVV.verisign.com/rpa0

    hXXps://VVV.verisign.com/rpa0

    hXXp://ocsp.verisign.com0;

    hXXp://ocsp.verisign.com0;

    /hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

    /hXXp://csc3-2010-aia.verisign.com/CSC3-2010.cer0

    hXXps://VVV.verisign.com/cps0*

    hXXps://VVV.verisign.com/cps0*

    #hXXp://logo.verisign.com/vslogo.gif04

    #hXXp://logo.verisign.com/vslogo.gif04

    #hXXp://crl.verisign.com/pca3-g5.crl04

    #hXXp://crl.verisign.com/pca3-g5.crl04

    \Software.exe

    \Software.exe

    @Windows2000

    @Windows2000

    @WindowsXP

    @WindowsXP

    @WindowsServer2003

    @WindowsServer2003

    @WindowsVista

    @WindowsVista

    @Windows7

    @Windows7

    @Windows8

    @Windows8

    SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

    SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

    \Current.txt

    \Current.txt

    \skins\config.txt

    \skins\config.txt

    \skins\Alternate.jpg

    \skins\Alternate.jpg

    d.kDf

    d.kDf

    \xJ.Rc

    \xJ.Rc

    %SPC$SRI 5,

    %SPC$SRI 5,

    X&(J.Zb

    X&(J.Zb

    LpZ.Zc

    LpZ.Zc

    (Z.Zc

    (Z.Zc

    LpZ.Rc

    LpZ.Rc

    d.qVK!zh

    d.qVK!zh

    \skins\Alternate.jpg]

    \skins\Alternate.jpg]

    \skins\skining.txt

    \skins\skining.txt

    \CommuniCationEx.exe

    \CommuniCationEx.exe

    2.DXQ

    2.DXQ

    \logo.ico

    \logo.ico

    .NL3V$_

    .NL3V$_

    "N`A%6Sq

    "N`A%6Sq

    N}.GEK

    N}.GEK

    -

    -

    --""""%%%

    --""""%%%

    ';77

    ';77

    WWW.%F#%

    WWW.%F#%

    \config\update.txt

    \config\update.txt

    N.WQz

    N.WQz

    .Le4Z-

    .Le4Z-

    {AccessKey}

    {AccessKey}

    {operateName}

    {operateName}

    {AccessKey}

    {AccessKey}

    {operateName}

    {operateName}

    Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

    Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

    http=

    http=

    HTTP/1.1

    HTTP/1.1

    Content-Type: application/x-www-form-urlencoded

    Content-Type: application/x-www-form-urlencoded

    \TaobaoMall.exe

    \TaobaoMall.exe

    \adslpass.exe

    \adslpass.exe

    \win7oem.exe

    \win7oem.exe

    \HomeLock.exe

    \HomeLock.exe

    \Networkname.exe

    \Networkname.exe

    \Signature.exe

    \Signature.exe

    \Grouping.exe

    \Grouping.exe

    \Dictionary.exe

    \Dictionary.exe

    \Express.exe

    \Express.exe

    \PPLive.exe

    \PPLive.exe

    \DoubanFM.exe

    \DoubanFM.exe

    \Dishes.exe

    \Dishes.exe

    \Manning.exe

    \Manning.exe

    \Lianliankan.exe

    \Lianliankan.exe

    \PlantvsZombies.exe

    \PlantvsZombies.exe

    \Chess.exe

    \Chess.exe

    \Meituxiu.exe

    \Meituxiu.exe

    \Recharge.exe

    \Recharge.exe

    \Hooklock.exe

    \Hooklock.exe

    \Memorandum.exe

    \Memorandum.exe

    \Weather.exe

    \Weather.exe

    \Perpetual.exe

    \Perpetual.exe

    \suda.exe

    \suda.exe

    \Clear.exe

    \Clear.exe

    \Establish.exe

    \Establish.exe

    \Timing.exe

    \Timing.exe

    \Query.exe

    \Query.exe

    \Search.exe

    \Search.exe

    \screensnapshot.exe

    \screensnapshot.exe

    System32\calc.exe

    System32\calc.exe

    \Today.exe

    \Today.exe

    \sol.exe

    \sol.exe

    \NewsApplication.exe

    \NewsApplication.exe

    hXXp://web2.qq.com/

    hXXp://web2.qq.com/

    AppData\Roaming\wzsd123\TaobaoMall.zip

    AppData\Roaming\wzsd123\TaobaoMall.zip

    AppData\Roaming\wzsd123\TaobaoMall.zip.tmp

    AppData\Roaming\wzsd123\TaobaoMall.zip.tmp

    AppData\Roaming\wzsd123\TaobaoMall.exe

    AppData\Roaming\wzsd123\TaobaoMall.exe

    User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

    User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

    Y@AppData\Roaming\wzsd123\adslpass.zip

    Y@AppData\Roaming\wzsd123\adslpass.zip

    AppData\Roaming\wzsd123\adslpass.zip.tmp

    AppData\Roaming\wzsd123\adslpass.zip.tmp

    AppData\Roaming\wzsd123\adslpass.exe

    AppData\Roaming\wzsd123\adslpass.exe

    AppData\Roaming\wzsd123\win7oem.zip

    AppData\Roaming\wzsd123\win7oem.zip

    AppData\Roaming\wzsd123\win7oem.zip.tmp

    AppData\Roaming\wzsd123\win7oem.zip.tmp

    AppData\Roaming\wzsd123\win7oem.exe

    AppData\Roaming\wzsd123\win7oem.exe

    AppData\Roaming\wzsd123\HomeLock.zip

    AppData\Roaming\wzsd123\HomeLock.zip

    AppData\Roaming\wzsd123\HomeLock.zip.tmp

    AppData\Roaming\wzsd123\HomeLock.zip.tmp

    AppData\Roaming\wzsd123\HomeLock.exe

    AppData\Roaming\wzsd123\HomeLock.exe

    AppData\Roaming\wzsd123\Networkname.zip

    AppData\Roaming\wzsd123\Networkname.zip

    AppData\Roaming\wzsd123\Networkname.zip.tmp

    AppData\Roaming\wzsd123\Networkname.zip.tmp

    AppData\Roaming\wzsd123\Networkname.exe

    AppData\Roaming\wzsd123\Networkname.exe

    AppData\Roaming\wzsd123\Signature.zip

    AppData\Roaming\wzsd123\Signature.zip

    AppData\Roaming\wzsd123\Signature.zip.tmp

    AppData\Roaming\wzsd123\Signature.zip.tmp

    AppData\Roaming\wzsd123\Signature.exe

    AppData\Roaming\wzsd123\Signature.exe

    \Grouping.zip

    \Grouping.zip

    \Grouping.zip.tmp

    \Grouping.zip.tmp

    AppData\Roaming\wzsd123\Dictionary.zip

    AppData\Roaming\wzsd123\Dictionary.zip

    AppData\Roaming\wzsd123\Dictionary.zip.tmp

    AppData\Roaming\wzsd123\Dictionary.zip.tmp

    AppData\Roaming\wzsd123\Dictionary.exe

    AppData\Roaming\wzsd123\Dictionary.exe

    AppData\Roaming\wzsd123\Express.zip

    AppData\Roaming\wzsd123\Express.zip

    AppData\Roaming\wzsd123\Express.zip.tmp

    AppData\Roaming\wzsd123\Express.zip.tmp

    AppData\Roaming\wzsd123\Express.exe

    AppData\Roaming\wzsd123\Express.exe

    AppData\Roaming\wzsd123\PPLive.zip

    AppData\Roaming\wzsd123\PPLive.zip

    AppData\Roaming\wzsd123\PPLive.zip.tmp

    AppData\Roaming\wzsd123\PPLive.zip.tmp

    AppData\Roaming\wzsd123\PPLive.exe

    AppData\Roaming\wzsd123\PPLive.exe

    AppData\Roaming\wzsd123\DoubanFM.zip

    AppData\Roaming\wzsd123\DoubanFM.zip

    AppData\Roaming\wzsd123\DoubanFM.zip.tmp

    AppData\Roaming\wzsd123\DoubanFM.zip.tmp

    AppData\Roaming\wzsd123\DoubanFM.exe

    AppData\Roaming\wzsd123\DoubanFM.exe

    AppData\Roaming\wzsd123\Dishes.zip

    AppData\Roaming\wzsd123\Dishes.zip

    AppData\Roaming\wzsd123\Dishes.zip.tmp

    AppData\Roaming\wzsd123\Dishes.zip.tmp

    AppData\Roaming\wzsd123\Dishes.exe

    AppData\Roaming\wzsd123\Dishes.exe

    AppData\Roaming\wzsd123\Manning.zip

    AppData\Roaming\wzsd123\Manning.zip

    AppData\Roaming\wzsd123\Manning.zip.tmp

    AppData\Roaming\wzsd123\Manning.zip.tmp

    AppData\Roaming\wzsd123\Manning.exe

    AppData\Roaming\wzsd123\Manning.exe

    AppData\Roaming\wzsd123\Lianliankan.zip

    AppData\Roaming\wzsd123\Lianliankan.zip

    AppData\Roaming\wzsd123\Lianliankan.zip.tmp

    AppData\Roaming\wzsd123\Lianliankan.zip.tmp

    AppData\Roaming\wzsd123\Lianliankan.exe

    AppData\Roaming\wzsd123\Lianliankan.exe

    AppData\Roaming\wzsd123\PlantvsZombies.zip

    AppData\Roaming\wzsd123\PlantvsZombies.zip

    AppData\Roaming\wzsd123\PlantvsZombies.zip.tmp

    AppData\Roaming\wzsd123\PlantvsZombies.zip.tmp

    AppData\Roaming\wzsd123\PlantvsZombies.exe

    AppData\Roaming\wzsd123\PlantvsZombies.exe

    AppData\Roaming\wzsd123\Chess.zip

    AppData\Roaming\wzsd123\Chess.zip

    AppData\Roaming\wzsd123\Chess.zip.tmp

    AppData\Roaming\wzsd123\Chess.zip.tmp

    AppData\Roaming\wzsd123\Chess.exe

    AppData\Roaming\wzsd123\Chess.exe

    AppData\Roaming\wzsd123\Meituxiu.zip

    AppData\Roaming\wzsd123\Meituxiu.zip

    AppData\Roaming\wzsd123\Meituxiu.zip.tmp

    AppData\Roaming\wzsd123\Meituxiu.zip.tmp

    AppData\Roaming\wzsd123\Meituxiu.exe

    AppData\Roaming\wzsd123\Meituxiu.exe

    AppData\Roaming\wzsd123\Recharge.zip

    AppData\Roaming\wzsd123\Recharge.zip

    AppData\Roaming\wzsd123\Recharge.zip.tmp

    AppData\Roaming\wzsd123\Recharge.zip.tmp

    AppData\Roaming\wzsd123\Recharge.exe

    AppData\Roaming\wzsd123\Recharge.exe

    AppData\Roaming\wzsd123\Hooklock.zip

    AppData\Roaming\wzsd123\Hooklock.zip

    AppData\Roaming\wzsd123\Hooklock.zip.tmp

    AppData\Roaming\wzsd123\Hooklock.zip.tmp

    AppData\Roaming\wzsd123\Hooklock.exe

    AppData\Roaming\wzsd123\Hooklock.exe

    AppData\Roaming\wzsd123\Memorandum.zip

    AppData\Roaming\wzsd123\Memorandum.zip

    AppData\Roaming\wzsd123\Memorandum.zip.tmp

    AppData\Roaming\wzsd123\Memorandum.zip.tmp

    AppData\Roaming\wzsd123\Memorandum.exe

    AppData\Roaming\wzsd123\Memorandum.exe

    AppData\Roaming\wzsd123\Weather.zip

    AppData\Roaming\wzsd123\Weather.zip

    AppData\Roaming\wzsd123\Weather.zip.tmp

    AppData\Roaming\wzsd123\Weather.zip.tmp

    AppData\Roaming\wzsd123\Weather.exe

    AppData\Roaming\wzsd123\Weather.exe

    AppData\Roaming\wzsd123\Perpetual.zip

    AppData\Roaming\wzsd123\Perpetual.zip

    AppData\Roaming\wzsd123\Perpetual.zip.tmp

    AppData\Roaming\wzsd123\Perpetual.zip.tmp

    AppData\Roaming\wzsd123\Perpetual.exe

    AppData\Roaming\wzsd123\Perpetual.exe

    AppData\Roaming\wzsd123\suda.zip

    AppData\Roaming\wzsd123\suda.zip

    AppData\Roaming\wzsd123\suda.zip.tmp

    AppData\Roaming\wzsd123\suda.zip.tmp

    AppData\Roaming\wzsd123\suda.exe

    AppData\Roaming\wzsd123\suda.exe

    AppData\Roaming\wzsd123\Clear.zip

    AppData\Roaming\wzsd123\Clear.zip

    AppData\Roaming\wzsd123\Clear.zip.tmp

    AppData\Roaming\wzsd123\Clear.zip.tmp

    AppData\Roaming\wzsd123\Clear.exe

    AppData\Roaming\wzsd123\Clear.exe

    AppData\Roaming\wzsd123\Establish.zip

    AppData\Roaming\wzsd123\Establish.zip

    AppData\Roaming\wzsd123\Establish.zip.tmp

    AppData\Roaming\wzsd123\Establish.zip.tmp

    AppData\Roaming\wzsd123\Establish.tmp

    AppData\Roaming\wzsd123\Establish.tmp

    AppData\Roaming\wzsd123\Establish.exe

    AppData\Roaming\wzsd123\Establish.exe

    AppData\Roaming\wzsd123\Timing.zip

    AppData\Roaming\wzsd123\Timing.zip

    AppData\Roaming\wzsd123\Timing.zip.tmp

    AppData\Roaming\wzsd123\Timing.zip.tmp

    AppData\Roaming\wzsd123\Timing.exe

    AppData\Roaming\wzsd123\Timing.exe

    AppData\Roaming\wzsd123\Query.zip

    AppData\Roaming\wzsd123\Query.zip

    AppData\Roaming\wzsd123\Query.zip.tmp

    AppData\Roaming\wzsd123\Query.zip.tmp

    AppData\Roaming\wzsd123\Query.exe

    AppData\Roaming\wzsd123\Query.exe

    AppData\Roaming\wzsd123\Search.zip

    AppData\Roaming\wzsd123\Search.zip

    AppData\Roaming\wzsd123\Search.zip.tmp

    AppData\Roaming\wzsd123\Search.zip.tmp

    AppData\Roaming\wzsd123\Search.exe

    AppData\Roaming\wzsd123\Search.exe

    AppData\Roaming\wzsd123\screensnapshot.zip

    AppData\Roaming\wzsd123\screensnapshot.zip

    AppData\Roaming\wzsd123\screensnapshot.zip.tmp

    AppData\Roaming\wzsd123\screensnapshot.zip.tmp

    AppData\Roaming\wzsd123\screensnapshot.exe

    AppData\Roaming\wzsd123\screensnapshot.exe

    AppData\Roaming\wzsd123\Today.zip

    AppData\Roaming\wzsd123\Today.zip

    AppData\Roaming\wzsd123\Today.zip.tmp

    AppData\Roaming\wzsd123\Today.zip.tmp

    AppData\Roaming\wzsd123\Today.exe

    AppData\Roaming\wzsd123\Today.exe

    AppData\Roaming\wzsd123\sol.zip

    AppData\Roaming\wzsd123\sol.zip

    AppData\Roaming\wzsd123\sol.zip.tmp

    AppData\Roaming\wzsd123\sol.zip.tmp

    AppData\Roaming\wzsd123\sol.exe

    AppData\Roaming\wzsd123\sol.exe

    AppData\Roaming\wzsd123\NewsApplication.zip

    AppData\Roaming\wzsd123\NewsApplication.zip

    AppData\Roaming\wzsd123\NewsApplication.zip.tmp

    AppData\Roaming\wzsd123\NewsApplication.zip.tmp

    AppData\Roaming\wzsd123\NewsApplication.exe

    AppData\Roaming\wzsd123\NewsApplication.exe

    HTTPREAD

    HTTPREAD

    \setup.exe

    \setup.exe

    \inno.exe

    \inno.exe

    \nsis.exe

    \nsis.exe

    hXXp://VVV.souweng.com/vip/soft/0001.zip

    hXXp://VVV.souweng.com/vip/soft/0001.zip

    hXXp://VVV.souweng.com/vip/soft/0002.zip

    hXXp://VVV.souweng.com/vip/soft/0002.zip

    hXXp://VVV.souweng.com/vip/soft/0003.zip

    hXXp://VVV.souweng.com/vip/soft/0003.zip

    hXXp://VVV.souweng.com/vip/soft/0004.zip

    hXXp://VVV.souweng.com/vip/soft/0004.zip

    hXXp://VVV.souweng.com/vip/soft/0005.zip

    hXXp://VVV.souweng.com/vip/soft/0005.zip

    hXXp://VVV.souweng.com/vip/soft/0006.zip

    hXXp://VVV.souweng.com/vip/soft/0006.zip

    hXXp://VVV.souweng.com/vip/soft/0007.zip

    hXXp://VVV.souweng.com/vip/soft/0007.zip

    hXXp://VVV.souweng.com/vip/soft/0008.zip

    hXXp://VVV.souweng.com/vip/soft/0008.zip

    hXXp://VVV.souweng.com/vip/soft/0009.zip

    hXXp://VVV.souweng.com/vip/soft/0009.zip

    hXXp://VVV.souweng.com/vip/soft/0010.zip

    hXXp://VVV.souweng.com/vip/soft/0010.zip

    hXXp://VVV.souweng.com/vip/soft/0011.zip

    hXXp://VVV.souweng.com/vip/soft/0011.zip

    hXXp://VVV.souweng.com/vip/soft/0012.zip

    hXXp://VVV.souweng.com/vip/soft/0012.zip

    hXXp://VVV.souweng.com/vip/soft/0013.zip

    hXXp://VVV.souweng.com/vip/soft/0013.zip

    hXXp://VVV.souweng.com/vip/soft/0014.zip

    hXXp://VVV.souweng.com/vip/soft/0014.zip

    hXXp://VVV.souweng.com/vip/soft/0015.zip

    hXXp://VVV.souweng.com/vip/soft/0015.zip

    hXXp://VVV.souweng.com/vip/soft/0016.zip

    hXXp://VVV.souweng.com/vip/soft/0016.zip

    hXXp://VVV.souweng.com/vip/soft/0017.zip

    hXXp://VVV.souweng.com/vip/soft/0017.zip

    hXXp://VVV.souweng.com/vip/soft/0018.zip

    hXXp://VVV.souweng.com/vip/soft/0018.zip

    hXXp://VVV.souweng.com/vip/soft/0019.zip

    hXXp://VVV.souweng.com/vip/soft/0019.zip

    hXXp://VVV.souweng.com/vip/soft/0020.zip

    hXXp://VVV.souweng.com/vip/soft/0020.zip

    hXXp://VVV.souweng.com/vip/soft/0021.zip

    hXXp://VVV.souweng.com/vip/soft/0021.zip

    hXXp://VVV.souweng.com/vip/soft/0022.zip

    hXXp://VVV.souweng.com/vip/soft/0022.zip

    hXXp://VVV.souweng.com/vip/soft/0023.zip

    hXXp://VVV.souweng.com/vip/soft/0023.zip

    hXXp://VVV.souweng.com/vip/soft/0024.zip

    hXXp://VVV.souweng.com/vip/soft/0024.zip

    hXXp://VVV.souweng.com/vip/soft/0025.zip

    hXXp://VVV.souweng.com/vip/soft/0025.zip

    hXXp://VVV.souweng.com/vip/soft/0026.zip

    hXXp://VVV.souweng.com/vip/soft/0026.zip

    hXXp://VVV.souweng.com/vip/soft/0027.zip

    hXXp://VVV.souweng.com/vip/soft/0027.zip

    hXXp://VVV.souweng.com/vip/soft/0028.zip

    hXXp://VVV.souweng.com/vip/soft/0028.zip

    hXXp://VVV.souweng.com/vip/soft/0029.zip

    hXXp://VVV.souweng.com/vip/soft/0029.zip

    hXXp://VVV.souweng.com/vip/soft/0030.zip

    hXXp://VVV.souweng.com/vip/soft/0030.zip

    hXXp://VVV.souweng.com/vip/soft/0031.zip

    hXXp://VVV.souweng.com/vip/soft/0031.zip

    hXXp://VVV.souweng.com/vip/soft/0032.zip

    hXXp://VVV.souweng.com/vip/soft/0032.zip

    hXXp://VVV.souweng.com/vip/soft/0033.zip

    hXXp://VVV.souweng.com/vip/soft/0033.zip

    hXXp://VVV.souweng.com/vip/soft/0034.zip

    hXXp://VVV.souweng.com/vip/soft/0034.zip

    hXXp://VVV.souweng.com/vip/soft/0035.zip

    hXXp://VVV.souweng.com/vip/soft/0035.zip

    hXXp://VVV.souweng.com/vip/soft/0036.zip

    hXXp://VVV.souweng.com/vip/soft/0036.zip

    hXXp://VVV.souweng.com/vip/soft/0037.zip

    hXXp://VVV.souweng.com/vip/soft/0037.zip

    hXXp://VVV.souweng.com/vip/soft/0038.zip

    hXXp://VVV.souweng.com/vip/soft/0038.zip

    hXXp://VVV.souweng.com/vip/soft/0039.zip

    hXXp://VVV.souweng.com/vip/soft/0039.zip

    hXXp://VVV.souweng.com/vip/soft/0040.zip

    hXXp://VVV.souweng.com/vip/soft/0040.zip

    hXXp://VVV.souweng.com/vip/soft/0041.zip

    hXXp://VVV.souweng.com/vip/soft/0041.zip

    hXXp://VVV.souweng.com/vip/soft/0042.zip

    hXXp://VVV.souweng.com/vip/soft/0042.zip

    hXXp://VVV.souweng.com/vip/soft/0043.zip

    hXXp://VVV.souweng.com/vip/soft/0043.zip

    hXXp://VVV.souweng.com/vip/soft/0044.zip

    hXXp://VVV.souweng.com/vip/soft/0044.zip

    hXXp://VVV.souweng.com/vip/soft/0045.zip

    hXXp://VVV.souweng.com/vip/soft/0045.zip

    hXXp://VVV.suda123.com/ie.asp?uid=wzsd123_

    hXXp://VVV.suda123.com/ie.asp?uid=wzsd123_

    hXXp://bbs.suda123.com/handler/connect.html?op=qqlogin

    hXXp://bbs.suda123.com/handler/connect.html?op=qqlogin

    hXXp://bbs.suda123.com/recoverpassword.html

    hXXp://bbs.suda123.com/recoverpassword.html

    hXXp://bbs.suda123.com/register.html

    hXXp://bbs.suda123.com/register.html

    \aneia.cfg

    \aneia.cfg

    \reij3.cfg

    \reij3.cfg

    T@\Config.xml

    T@\Config.xml

    3532.542

    3532.542

    1445.235

    1445.235

    |*.jpg;*.jpeg;*.png;*.bmp

    |*.jpg;*.jpeg;*.png;*.bmp

    \scoe.txt

    \scoe.txt

    \wzsd123_url.exe

    \wzsd123_url.exe

    \config\Website.txt

    \config\Website.txt

    HomeLock.exe

    HomeLock.exe

    VVV.suda123.com/disk.htm

    VVV.suda123.com/disk.htm

    setup.exe

    setup.exe

    inno.exe

    inno.exe

    nsis.exe

    nsis.exe

    Referer: hXXp://

    Referer: hXXp://

    HTTP/1.1 404

    HTTP/1.1 404

    HTTP/1.0 404

    HTTP/1.0 404

    \Download.sde

    \Download.sde

    DownloadUrl

    DownloadUrl

    C@\Images\\Join.png

    C@\Images\\Join.png

    \nigle.sde

    \nigle.sde

    hXXp://my.suda123.com/Wallpaper/Store/NewWallpaper.txt

    hXXp://my.suda123.com/Wallpaper/Store/NewWallpaper.txt

    hXXp://my.suda123.com/Wallpaper/Store/NewWallpaper.zip

    hXXp://my.suda123.com/Wallpaper/Store/NewWallpaper.zip

    \Wallpaper\Thumb\NewWallpaper.zip

    \Wallpaper\Thumb\NewWallpaper.zip

    .sdtmp

    .sdtmp

    .Ip.!I

    .Ip.!I

    !#.nK

    !#.nK

    :B.hh

    :B.hh

    Vf%U[

    Vf%U[

    $Z'H%%X

    $Z'H%%X

    "%F;; X

    "%F;; X

    .ZD*4

    .ZD*4

    ,.Anm

    ,.Anm

    E=YS"%u

    E=YS"%u

    .DZWi

    .DZWi

    b%X]K1

    b%X]K1

    .cwz(g

    .cwz(g

    . H.lF

    . H.lF

    :)d2Tl.dY

    :)d2Tl.dY

    %c!>[

    %c!>[

    q[SsH&

    q[SsH&

    TCP56>ma

    TCP56>ma

    2010-02-11T14:32:03-06:00%x

    2010-02-11T14:32:03-06:00%x

    Å“LN

    Å“LN

    N<.bm2>

    N<.bm2>

    %C$-|

    %C$-|

    %upu&

    %upu&

    T@H6%d

    T@H6%d

    (&7.AX_

    (&7.AX_

    .KALB

    .KALB

    S}^.xB

    S}^.xB

    .FF:U

    .FF:U

    \nE.XyX

    \nE.XyX

    .kN\#-

    .kN\#-

    .Mh&X\

    .Mh&X\

    [%X;r

    [%X;r

    yÄ;

    yÄ;

    ?m%SQ

    ?m%SQ

    .tN|b

    .tN|b

    &NQ.ME

    &NQ.ME

    ;y.Kv)

    ;y.Kv)

    !.KXx

    !.KXx

    \DetectionUpdates.exe

    \DetectionUpdates.exe

    nN[%u@

    nN[%u@

    xVt

    xVt

    J

    J

    !,-q}

    !,-q}

    {%x&NC

    {%x&NC

    y|lT&.XO

    y|lT&.XO

    W.zQq

    W.zQq

    %ul|B

    %ul|B

    Q{3$.eU

    Q{3$.eU

    .ll6x

    .ll6x

    G=r.LZ

    G=r.LZ

    ,%6XL

    ,%6XL

    u%fZt

    u%fZt

    -3}\||7A

    -3}\||7A

    *ûN

    *ûN

    .cm3:

    .cm3:

    1.aL1Iu

    1.aL1Iu

    kp-K}m

    kp-K}m

    Z.KO'

    Z.KO'

    jL"(u.qlcB

    jL"(u.qlcB

    ~Q%%f

    ~Q%%f

    (.EWQ

    (.EWQ

    | .kD,

    | .kD,

    z%uDQ

    z%uDQ

    #JK.ZDeb5@

    #JK.ZDeb5@

    u-%xS

    u-%xS

    Ly%X$

    Ly%X$

    Z.ex.

    Z.ex.

    (ÏO &

    (ÏO &

    --Pz}

    --Pz}

    .Cet0#=M

    .Cet0#=M

    W|.tu?@";

    W|.tu?@";

    %5SN3\

    %5SN3\

    d"^%d=ff"W

    d"^%d=ff"W

    *.fABM

    *.fABM

    .Zola

    .Zola

    m.jv5

    m.jv5

    s%s@d

    s%s@d

    %6SX

    %6SX

    <:>

    <:>

    .BV~ -

    .BV~ -

    6!.FW

    6!.FW

    i'udp

    i'udp

    I.mS4[

    I.mS4[

    _0.Ge

    _0.Ge

    .PgW!_

    .PgW!_

    .Awz5

    .Awz5

    V"8,yu%d$N

    V"8,yu%d$N

    x%C=/S8

    x%C=/S8

    A.DcO

    A.DcO

    .jOQ>

    .jOQ>

    s.Sb

    s.Sb

    ,.UizH

    ,.UizH

    `-.oz

    `-.oz

    EU^.su

    EU^.su

    ~^.gr

    ~^.gr

    y.FDO

    y.FDO

    .Wkkz

    .Wkkz

    7jG%F

    7jG%F

    .iCGw

    .iCGw

    uxtheme.dll

    uxtheme.dll

    iphlpapi.dll

    iphlpapi.dll

    mpr.dll

    mpr.dll

    ws2_32.dll

    ws2_32.dll

    version.dll

    version.dll

    comdlg32.dll

    comdlg32.dll

    winspool.drv

    winspool.drv

    advapi32.dll

    advapi32.dll

    rasapi32.dll

    rasapi32.dll

    SetViewportOrgEx

    SetViewportOrgEx

    FtpGetCurrentDirectoryA

    FtpGetCurrentDirectoryA

    hXXp://ocsp.thawte.com0

    hXXp://ocsp.thawte.com0

    .hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

    .hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

    hXXp://ts-ocsp.ws.symantec.com07

    hXXp://ts-ocsp.ws.symantec.com07

    hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

    hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

    hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

    hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

    9%ui6

    9%ui6

    \access\deta.mdb

    \access\deta.mdb

    ID="{E38C4E72-5BC9-441C-A257-248C2BFEC5DF}"

    ID="{E38C4E72-5BC9-441C-A257-248C2BFEC5DF}"

    &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000

    &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000

    6}#2.0#0

    6}#2.0#0

    .rbt*r

    .rbt*r

    ep.Oww

    ep.Oww

    \.LPTX8

    \.LPTX8

    .QVRWNM

    .QVRWNM

    be.QA

    be.QA

    Q .VjV%P

    Q .VjV%P

    sshtFlt

    sshtFlt

    EjP.DN

    EjP.DN

    S%j.Zs

    S%j.Zs

    %Xi]G

    %Xi]G

    $(9999,04

    $(9999,04

    W.UV[

    W.UV[

    ?0012345678

    ?0012345678

    ZC#%S

    ZC#%S

    n.WQj

    n.WQj

    .\OJ9%X

    .\OJ9%X

    \AIL%UW;

    \AIL%UW;

    S\Xh.i.LQLGP

    S\Xh.i.LQLGP

    \.CwK

    \.CwK

    Mp.Fh

    Mp.Fh

    %UH\[{

    %UH\[{

    j<.vpk> 5{x

    j<.vpk> 5{x

    2222$(,00

    2222$(,00

    ;4%S(

    ;4%S(

    lvH-D}HLr

    lvH-D}HLr

    r@.vkF8R

    r@.vkF8R

    At.%S

    At.%S

    3S9 0%s&

    3S9 0%s&

    .yJGh

    .yJGh

    %UtnM

    %UtnM

    .Ft!3

    .Ft!3

    ]%u6p

    ]%u6p

    owStA.UF

    owStA.UF

    ageBoxvSER32.DL=

    ageBoxvSER32.DL=

    JSc.Xm

    JSc.Xm

    .GjGC

    .GjGC

    ;X%Fj[s

    ;X%Fj[s

    KeyEx~ Z

    KeyEx~ Z

    zcÁ

    zcÁ

    W[.jo$

    W[.jo$

    ].bod

    ].bod

    K[SubÃŽ

    K[SubÃŽ

    KERNEL32.DLL

    KERNEL32.DLL

    ADVAPI32.dll

    ADVAPI32.dll

    COMCTL32.dll

    COMCTL32.dll

    COMDLG32.dll

    COMDLG32.dll

    GDI32.dll

    GDI32.dll

    MPR.dll

    MPR.dll

    OLEAUT32.dll

    OLEAUT32.dll

    PSAPI.DLL

    PSAPI.DLL

    SHELL32.dll

    SHELL32.dll

    USER32.dll

    USER32.dll

    USERENV.dll

    USERENV.dll

    VERSION.dll

    VERSION.dll

    WININET.dll

    WININET.dll

    WINMM.dll

    WINMM.dll

    WSOCK32.dll

    WSOCK32.dll

    FtpOpenFileW

    FtpOpenFileW

    .Class 3 Public Primary Certification Authority0

    .Class 3 Public Primary Certification Authority0

    hXXp://crl.verisign.com/pca3.crl0

    hXXp://crl.verisign.com/pca3.crl0

    hXXps://VVV.verisign.com/cps0

    hXXps://VVV.verisign.com/cps0

    hXXp://ocsp.verisign.com0>

    hXXp://ocsp.verisign.com0>

    ^@SD Desktop InterprocessCommunicationSystem Msg

    ^@SD Desktop InterprocessCommunicationSystem Msg

    \LoginConfig

    \LoginConfig

    [Download'&'/Initializing'{WindowsAsynchronousDisplay}

    [Download'&'/Initializing'{WindowsAsynchronousDisplay}

    \Taskdata.sdb

    \Taskdata.sdb

    \WriteDate.sdb

    \WriteDate.sdb

    hXXp://VVV.suda123.com/desk/SoftwareManagerTasks.xml

    hXXp://VVV.suda123.com/desk/SoftwareManagerTasks.xml

    hXXp://VVV.suda123.com/desk/apptext2013428.txt

    hXXp://VVV.suda123.com/desk/apptext2013428.txt

    setup.zip

    setup.zip

    {password}

    {password}

    {password}

    {password}

    \Complete.sde

    \Complete.sde

    @\Images\Gradient.png

    @\Images\Gradient.png

    F@\Images\Control button.Shut.1.png

    F@\Images\Control button.Shut.1.png

    \Images\Control button.Shut.2.png

    \Images\Control button.Shut.2.png

    \Images\Control button.Shut.3.png

    \Images\Control button.Shut.3.png

    R@\Images\Control button.Minimized.1.png

    R@\Images\Control button.Minimized.1.png

    \Images\Control button.Minimized.2.png

    \Images\Control button.Minimized.2.png

    \Images\Control button.Minimized.3.png

    \Images\Control button.Minimized.3.png

    \Images\HeadBillBack.png

    \Images\HeadBillBack.png

    4@\Images\Classification.Personal.png

    4@\Images\Classification.Personal.png

    \Images\Classification.Task.png

    \Images\Classification.Task.png

    \Images\Classification.Props.png

    \Images\Classification.Props.png

    hXXp://bbs.suda123.com/my/default.html

    hXXp://bbs.suda123.com/my/default.html

    \TaskImages\Gold.png

    \TaskImages\Gold.png

    \Images\Picture frame.Task.png

    \Images\Picture frame.Task.png

    6@\Images\Picture frame.Props.png

    6@\Images\Picture frame.Props.png

    kuwo.zip

    kuwo.zip

    haoya.zip

    haoya.zip

    kugou.zip

    kugou.zip

    baof.zip

    baof.zip

    {AccessKey}

    {AccessKey}

    hXXp://bbs.suda123.com/my/avatar_client.aspx

    hXXp://bbs.suda123.com/my/avatar_client.aspx

    `h@\LoginImages\

    `h@\LoginImages\

    Logon.background.png

    Logon.background.png

    Logon.Logo.png

    Logon.Logo.png

    Logon.Text.png

    Logon.Text.png

    MeT_Panel_MainMenuButton_QQ.png

    MeT_Panel_MainMenuButton_QQ.png

    Q@bbs.suda123.com

    Q@bbs.suda123.com

    @W@Login.Button.Mioel.1.png

    @W@Login.Button.Mioel.1.png

    Login.Button.Mioel.2.png

    Login.Button.Mioel.2.png

    Login.Button.Mioel.3.png

    Login.Button.Mioel.3.png

    SUDAZUOMIAN-ClassModule-34895-[cmd]-[AccesKey]

    SUDAZUOMIAN-ClassModule-34895-[cmd]-[AccesKey]

    scripting.FileSystemObject

    scripting.FileSystemObject

    Shell.Application

    Shell.Application

    {00020404-0000-0000-C000-000000000046}

    {00020404-0000-0000-C000-000000000046}

    bdllq.zip

    bdllq.zip

    \Eitoele.sds

    \Eitoele.sds

    pptv.zip

    pptv.zip

    sgllq.zip

    sgllq.zip

    QQLogin.Ring.gif

    QQLogin.Ring.gif

    ppsbfq.zip

    ppsbfq.zip

    |*.jpg;*.jpeg;*.gif;*.png;*.bmp

    |*.jpg;*.jpeg;*.gif;*.png;*.bmp

    _Large.jpg

    _Large.jpg

    hXXp://my.suda123.com/lz/

    hXXp://my.suda123.com/lz/

    jsdb.zip

    jsdb.zip

    sougou.zip

    sougou.zip

    hXXp://bbs.suda123.com/login.html?mod=bindaccess_token=

    hXXp://bbs.suda123.com/login.html?mod=bindaccess_token=

    360sd.zip

    360sd.zip

    ###{].WLGG

    ###{].WLGG

    D4(111

    D4(111

    %cymYY

    %cymYY

    fTPZ

    fTPZ

    ..NKNNV

    ..NKNNV

    \TaskImages\to.png

    \TaskImages\to.png

    \Images\Pictures.Ask.png

    \Images\Pictures.Ask.png

    \Images\Immediately.png

    \Images\Immediately.png

    \Images\Immediately2.png

    \Images\Immediately2.png

    \Images\Immediately3.png

    \Images\Immediately3.png

    txqq.zip

    txqq.zip

    360llq.zip

    360llq.zip

    bdpy.zip

    bdpy.zip

    (sdbak,zip)|*.zip;*.sdbak

    (sdbak,zip)|*.zip;*.sdbak

    *.url

    *.url

    xunlei7.zip

    xunlei7.zip

    \.Gtn

    \.Gtn

    B.gs{

    B.gs{

    ,I.UU]

    ,I.UU]

    \.GMMM

    \.GMMM

    ^Z*e2.EQR

    ^Z*e2.EQR

    ^`@h0.WQ

    ^`@h0.WQ

    3.AP].

    3.AP].

    {6AEDBD6D-3FB5-418A-83A6-7F45229DC872}

    {6AEDBD6D-3FB5-418A-83A6-7F45229DC872}

    360ws.zip

    360ws.zip

    hXXp://union.suda123.com

    hXXp://union.suda123.com

    ].sdbak

    ].sdbak

    hXXp://bbs.suda123.com/desk_gjjy/list-1.html

    hXXp://bbs.suda123.com/desk_gjjy/list-1.html

    AppData\Roaming\wzsd123\wzsd123_url.exe

    AppData\Roaming\wzsd123\wzsd123_url.exe

    hXXp://bbs.suda123.com/register.html?mod=bindaccess_token=

    hXXp://bbs.suda123.com/register.html?mod=bindaccess_token=

    hXXp://bbs.suda123.com/api.asmx

    hXXp://bbs.suda123.com/api.asmx

    hXXp://bbs.suda123.com

    hXXp://bbs.suda123.com

    \TaskImages\Border2.png

    \TaskImages\Border2.png

    \TaskImages\Border1.png

    \TaskImages\Border1.png

    \TaskImages\new.png

    \TaskImages\new.png

    {B96B3CAB-0728-11D3-9D7B-0000F81EF32E}

    {B96B3CAB-0728-11D3-9D7B-0000F81EF32E}

    X.ULn

    X.ULn

    \PropsImages\sign.png

    \PropsImages\sign.png

    {B96B3CB0-0728-11D3-9D7B-0000F81EF32E}

    {B96B3CB0-0728-11D3-9D7B-0000F81EF32E}

    http\shell\open\command\

    http\shell\open\command\

    \Internet Explorer\iexplore.exe

    \Internet Explorer\iexplore.exe

    %S~-D

    %S~-D

    TT:)n%S

    TT:)n%S

    .TTB`

    .TTB`

    E.Gi&

    E.Gi&

    Adobe Photoshop CS5 Windows

    Adobe Photoshop CS5 Windows

    2012:05:26 23:11:04

    2012:05:26 23:11:04

    IEC hXXp://VVV.iec.ch

    IEC hXXp://VVV.iec.ch

    .IEC 61966-2.1 Default RGB colour space - sRGB

    .IEC 61966-2.1 Default RGB colour space - sRGB

    CRT curv

    CRT curv

    urlTEXT

    urlTEXT

    MsgeTEXT

    MsgeTEXT

    hXXp://ns.adobe.com/xap/1.0/

    hXXp://ns.adobe.com/xap/1.0/

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • Adobe Photoshop CS2 Windows

    Adobe Photoshop CS2 Windows

    2012:12:13 19:55:25

    2012:12:13 19:55:25

    xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">

    xmlns:xap="hXXp://ns.adobe.com/xap/1.0/">

    Adobe Photoshop CS2 Windows

    Adobe Photoshop CS2 Windows

    xmlns:xapMM="hXXp://ns.adobe.com/xap/1.0/mm/"

    xmlns:xapMM="hXXp://ns.adobe.com/xap/1.0/mm/"

    xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"

    xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"

    xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#">

    xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#">

    xmp.did:3B5D91660071E11188B8FC618424A310

    xmp.did:3B5D91660071E11188B8FC618424A310

    xmp.iid:3B5D91660071E11188B8FC618424A310

    xmp.iid:3B5D91660071E11188B8FC618424A310

    Adobe Photoshop CS5 Windows

    Adobe Photoshop CS5 Windows

    xmp.iid:3C5D91660071E11188B8FC618424A310

    xmp.iid:3C5D91660071E11188B8FC618424A310

    xmp.iid:F8D91603E4F8E111BD1F922CDD38E2C4

    xmp.iid:F8D91603E4F8E111BD1F922CDD38E2C4

    xmp.iid:09728703EBF8E1119DD78D81E2BBF94B

    xmp.iid:09728703EBF8E1119DD78D81E2BBF94B

    xmp.iid:0A728703EBF8E1119DD78D81E2BBF94B

    xmp.iid:0A728703EBF8E1119DD78D81E2BBF94B

    xmlns:dc="hXXp://purl.org/dc/elements/1.1/">

    xmlns:dc="hXXp://purl.org/dc/elements/1.1/">

    xmlns:crs="hXXp://ns.adobe.com/camera-raw-settings/1.0/">

    xmlns:crs="hXXp://ns.adobe.com/camera-raw-settings/1.0/">

    xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/">

    xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/">

  • xmp.did:3B5D91660071E11188B8FC618424A310

  • xmp.did:3B5D91660071E11188B8FC618424A310

  • xmp.did:3D5D91660071E11188B8FC618424A310

  • xmp.did:3D5D91660071E11188B8FC618424A310

    • xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/">

    xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/">

    xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">

    xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">

    i6.go

    i6.go

    2012:12:13 20:58:39

    2012:12:13 20:58:39

    .mouv;

    .mouv;

    2012:12:11 20:45:49

    2012:12:11 20:45:49

    xmp.iid:0A728703EBF8E1119DD78D81E2BBF94B

    xmp.iid:0A728703EBF8E1119DD78D81E2BBF94B

    xmp.did:3B5D91660071E11188B8FC618424A310

    xmp.did:3B5D91660071E11188B8FC618424A310

    2012:12:11 20:39:57

    2012:12:11 20:39:57

    2012:09:07 20:53:25

    2012:09:07 20:53:25

    r0n.mYU>

    r0n.mYU>

    PhXXp://ns.adobe.com/xap/1.0/

    PhXXp://ns.adobe.com/xap/1.0/

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310
  • xmp.did:3D5D91660071E11188B8FC618424A310

    • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310
  • xmp.did:3D5D91660071E11188B8FC618424A310

    • 2012:09:07 21:01:44

    2012:09:07 21:01:44

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310
  • xmp.did:3D5D91660071E11188B8FC618424A310

    • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310
  • xmp.did:3D5D91660071E11188B8FC618424A310

    • 2012:07:22 13:34:20

    2012:07:22 13:34:20

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • q%XTwV

    q%XTwV

    >%S]G

    >%S]G

    2012:07:22 13:34:52

    2012:07:22 13:34:52

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • .WnnLuF3)H

    .WnnLuF3)H

    -%umLUr,

    -%umLUr,

    }E.le

    }E.le

    2012:07:22 13:30:26

    2012:07:22 13:30:26

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:07:22 13:31:15

    2012:07:22 13:31:15

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 21:58:39

    2012:03:18 21:58:39

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 21:58:00

    2012:03:18 21:58:00

    %Ui]_I

    %Ui]_I

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:14:33

    2012:03:18 22:14:33

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:14:02

    2012:03:18 22:14:02

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:05:45

    2012:03:18 22:05:45

    lz.oW

    lz.oW

    K.nXmO{n

    K.nXmO{n

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:06:11

    2012:03:18 22:06:11

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:22:00

    2012:03:18 22:22:00

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 22:22:37

    2012:03:18 22:22:37

    -gg}P

    -gg}P

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:09:07 20:03:18

    2012:09:07 20:03:18

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:09:07 20:04:39

    2012:09:07 20:04:39

    LhXXp://ns.adobe.com/xap/1.0/

    LhXXp://ns.adobe.com/xap/1.0/

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310

    • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • xmp.did:3B5D91660071E11188B8FC618424A310

    • ÿ*B

    ÿ*B

    %UV/lTa

    %UV/lTa

    Ss9.VA

    Ss9.VA

    .gll9vF

    .gll9vF

    2012:03:18 21:53:25

    2012:03:18 21:53:25

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • 2012:03:18 21:54:12

    2012:03:18 21:54:12

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • |8gy%f

    |8gy%f

    hXXp://VVV.suda123.com

    hXXp://VVV.suda123.com

    : 20130601

    : 20130601

    Copyright 2012-2013 VVV.suda123.com

    Copyright 2012-2013 VVV.suda123.com

    2012:12:13 19:58:45

    2012:12:13 19:58:45

    @LhXXp://ns.adobe.com/xap/1.0/

    @LhXXp://ns.adobe.com/xap/1.0/

    xmp.did:6BAFFB4E450AE211B554804AE8C594B7

    xmp.did:6BAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6BAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6BAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6CAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6CAFFB4E450AE211B554804AE8C594B7

    xmp.did:6BAFFB4E450AE211B554804AE8C594B7

    xmp.did:6BAFFB4E450AE211B554804AE8C594B7

    Kv.grn

    Kv.grn

    2012:12:13 19:59:34

    2012:12:13 19:59:34

    .Photoshop 3.0

    .Photoshop 3.0

    2012:12:11 20:16:10

    2012:12:11 20:16:10

    @OhXXp://ns.adobe.com/xap/1.0/

    @OhXXp://ns.adobe.com/xap/1.0/

    xmp.iid:6CAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6CAFFB4E450AE211B554804AE8C594B7

    2012:12:11 20:50:58

    2012:12:11 20:50:58

    xmp.did:6AAFFB4E450AE211B554804AE8C594B7

    xmp.did:6AAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6AAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6AAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6AAFFB4E450AE211B554804AE8C594B7

    xmp.iid:6AAFFB4E450AE211B554804AE8C594B7

    xmp.did:66AFFB4E450AE211B554804AE8C594B7

    xmp.did:66AFFB4E450AE211B554804AE8C594B7

    2012:09:29 22:52:36

    2012:09:29 22:52:36

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • .coER

    .coER

    2012:09:29 22:54:56

    2012:09:29 22:54:56

    -k}

    -k}

    " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • " id="W5M0MpCehiHzreSzNTczkc9d"?>

  • X.giM$"

    X.giM$"

    .PpB0

    .PpB0

    ```___@@@???///

    ```___@@@???///

    vh%S*

    vh%S*

    N.aqXshC

    N.aqXshC

    PasswordText

    PasswordText

    Webbrowser

    Webbrowser

    inflate 1.1.3 Copyright 1995-1998 Mark Adler

    inflate 1.1.3 Copyright 1995-1998 Mark Adler

    1.2.18

    1.2.18

    %*.*f

    %*.*f

    CNotSupportedException

    CNotSupportedException

    commctrl_DragListMsg

    commctrl_DragListMsg

    Afx:%x:%x:%x:%x:%x

    Afx:%x:%x:%x:%x:%x

    Afx:%x:%x

    Afx:%x:%x

    COMCTL32.DLL

    COMCTL32.DLL

    CCmdTarget

    CCmdTarget

    MSWHEEL_ROLLMSG

    MSWHEEL_ROLLMSG

    __MSVCRT_HEAP_SELECT

    __MSVCRT_HEAP_SELECT

    >0123456789ABCDEF deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

    >0123456789ABCDEF deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

    F%D,3

    F%D,3

    SHLWAPI.dll

    SHLWAPI.dll

    .PAVCException@@

    .PAVCException@@

    .PAVCNotSupportedException@@

    .PAVCNotSupportedException@@

    .PAVCFileException@@

    .PAVCFileException@@

    (*.prn)|*.prn|

    (*.prn)|*.prn|

    (*.*)|*.*||

    (*.*)|*.*||

    Shell32.dll

    Shell32.dll

    Mpr.dll

    Mpr.dll

    Advapi32.dll

    Advapi32.dll

    (&07-034/)7 '

    (&07-034/)7 '

    ?? / %d]

    ?? / %d]

    %d / %d]

    %d / %d]

    : %d]

    : %d]

    (*.WAV;*.MID)|*.WAV;*.MID|WAV

    (*.WAV;*.MID)|*.WAV;*.MID|WAV

    (*.WAV)|*.WAV|MIDI

    (*.WAV)|*.WAV|MIDI

    (*.MID)|*.MID|

    (*.MID)|*.MID|

    (*.txt)|*.txt|

    (*.txt)|*.txt|

    (*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

    (*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

    (*.JPG)|*.JPG|BMP

    (*.JPG)|*.JPG|BMP

    (*.BMP)|*.BMP|GIF

    (*.BMP)|*.BMP|GIF

    (*.GIF)|*.GIF|

    (*.GIF)|*.GIF|

    (*.ICO)|*.ICO|

    (*.ICO)|*.ICO|

    (*.CUR)|*.CUR|

    (*.CUR)|*.CUR|

    %s:%d

    %s:%d

    windows

    windows

    out.prn

    out.prn

    %d.%d

    %d.%d

    %d / %d

    %d / %d

    %d/%d

    %d/%d

    Bogus message code %d

    Bogus message code %d

    (%d-%d):

    (%d-%d):

    %ld%c

    %ld%c

    VVV.dywt.com.cn

    VVV.dywt.com.cn

    USER32.DLL

    USER32.DLL

    HTTP/1.0

    HTTP/1.0

    %s

    %s

    Reply-To: %s

    Reply-To: %s

    From: %s

    From: %s

    To: %s

    To: %s

    Subject: %s

    Subject: %s

    Date: %s

    Date: %s

    Cc: %s

    Cc: %s

    %a, %d %b %Y %H:%M:%S

    %a, %d %b %Y %H:%M:%S

    SMTP

    SMTP

    code %d bits %d->%d

    code %d bits %d->%d

    gen_codes: max_code %d

    gen_codes: max_code %d

    bl code -

    bl code -

    opt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u

    opt %lu(%lu) stat %lu(%lu) stored %lu lit %u dist %u

    last_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%)

    last_lit %u, last_dist %u, in %ld, out ~%ld(%ld%%)

    1.1.3

    1.1.3

    %Y-%m-%d %H:%M:%S

    %Y-%m-%d %H:%M:%S

    FADODB.Connection

    FADODB.Connection

    ;Jet OLEDB:Database Password=

    ;Jet OLEDB:Database Password=

    Provider=Microsoft.Jet.OLEDB.4.0; Data Source=

    Provider=Microsoft.Jet.OLEDB.4.0; Data Source=

    Description: %s

    Description: %s

    State: %s, Native: %d, Source: %s

    State: %s, Native: %d, Source: %s

    FADODB.Recordset

    FADODB.Recordset

    (*.avi)|*.avi

    (*.avi)|*.avi

    WPFT532.CNV

    WPFT532.CNV

    WPFT632.CNV

    WPFT632.CNV

    EXCEL32.CNV

    EXCEL32.CNV

    write32.wpc

    write32.wpc

    Windows Write

    Windows Write

    mswrd632.wpc

    mswrd632.wpc

    Word for Windows 6.0

    Word for Windows 6.0

    wword5.cnv

    wword5.cnv

    Word for Windows 5.0

    Word for Windows 5.0

    mswrd832.cnv

    mswrd832.cnv

    mswrd632.cnv

    mswrd632.cnv

    Word 6.0/95 for Windows & Macintosh

    Word 6.0/95 for Windows & Macintosh

    html32.cnv

    html32.cnv

    %d%d%d

    %d%d%d

    rundll32.exe shell32.dll,

    rundll32.exe shell32.dll,

    1.0.6

    1.0.6

    \shell32.dll

    \shell32.dll

    hXXp://VVV.eyuyan.com

    hXXp://VVV.eyuyan.com

    service@dywt.com.cn

    service@dywt.com.cn

    86(0411)39895834

    86(0411)39895834

    86(0411)39895831

    86(0411)39895831

    This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info

    This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info

    DelAllKeyValues

    DelAllKeyValues

    DelKeyValue

    DelKeyValue

    GetAllKeys

    GetAllKeys

    GetKeyValue

    GetKeyValue

    AddKeyValue

    AddKeyValue

    DSGetErrMsg

    DSGetErrMsg

    BiTreeGetCurNodeKey

    BiTreeGetCurNodeKey

    ListGetCurNodeKey

    ListGetCurNodeKey

    ListUpdateNodeFromKey

    ListUpdateNodeFromKey

    ListRemoveNodeFromKey

    ListRemoveNodeFromKey

    edatastructure_fnMapDelAllKeyValues

    edatastructure_fnMapDelAllKeyValues

    edatastructure_fnMapDelKeyValue

    edatastructure_fnMapDelKeyValue

    edatastructure_fnMapGetAllKeys

    edatastructure_fnMapGetAllKeys

    edatastructure_fnMapGetKeyValue

    edatastructure_fnMapGetKeyValue

    edatastructure_fnMapAddKeyValue

    edatastructure_fnMapAddKeyValue

    edatastructure_fnBiTreeGetCurNodeKey

    edatastructure_fnBiTreeGetCurNodeKey

    edatastructure_fnListGetCurNodeKey

    edatastructure_fnListGetCurNodeKey

    edatastructure_fnListUpdateNodeFromKey

    edatastructure_fnListUpdateNodeFromKey

    edatastructure_fnListRemoveNodeFromKey

    edatastructure_fnListRemoveNodeFromKey

    ;3 #>6.&

    ;3 #>6.&

    '2, / 0&7!4-)1#

    '2, / 0&7!4-)1#

    (*.htm;*.html)|*.htm;*.html

    (*.htm;*.html)|*.htm;*.html

    .PAVCOleException@@

    .PAVCOleException@@

    .PAVCObject@@

    .PAVCObject@@

    .PAVCSimpleException@@

    .PAVCSimpleException@@

    .PAVCMemoryException@@

    .PAVCMemoryException@@

    .?AVCNotSupportedException@@

    .?AVCNotSupportedException@@

    .PAVCResourceException@@

    .PAVCResourceException@@

    .PAVCUserException@@

    .PAVCUserException@@

    .?AVCCmdTarget@@

    .?AVCCmdTarget@@

    .?AVCCmdUI@@

    .?AVCCmdUI@@

    .?AVCTestCmdUI@@

    .?AVCTestCmdUI@@

    .PAVCOleDispatchException@@

    .PAVCOleDispatchException@@

    .PAVCArchiveException@@

    .PAVCArchiveException@@

    Corrupt JPEG data: found marker 0xx instead of RST%d

    Corrupt JPEG data: found marker 0xx instead of RST%d

    Warning: unknown JFIF revision number %d.d

    Warning: unknown JFIF revision number %d.d

    Corrupt JPEG data: %u extraneous bytes before marker 0xx

    Corrupt JPEG data: %u extraneous bytes before marker 0xx

    Inconsistent progression sequence for component %d coefficient %d

    Inconsistent progression sequence for component %d coefficient %d

    Unknown Adobe color transform code %d

    Unknown Adobe color transform code %d

    Obtained XMS handle %u

    Obtained XMS handle %u

    Freed XMS handle %u

    Freed XMS handle %u

    Unrecognized component IDs %d %d %d, assuming YCbCr

    Unrecognized component IDs %d %d %d, assuming YCbCr

    JFIF extension marker: RGB thumbnail image, length %u

    JFIF extension marker: RGB thumbnail image, length %u

    JFIF extension marker: palette thumbnail image, length %u

    JFIF extension marker: palette thumbnail image, length %u

    JFIF extension marker: JPEG-compressed thumbnail image, length %u

    JFIF extension marker: JPEG-compressed thumbnail image, length %u

    Opened temporary file %s

    Opened temporary file %s

    Closed temporary file %s

    Closed temporary file %s

    Ss=%d, Se=%d, Ah=%d, Al=%d

    Ss=%d, Se=%d, Ah=%d, Al=%d

    Component %d: dc=%d ac=%d

    Component %d: dc=%d ac=%d

    Start Of Scan: %d components

    Start Of Scan: %d components

    Component %d: %dhx%dv q=%d

    Component %d: %dhx%dv q=%d

    Start Of Frame 0xx: width=%u, height=%u, components=%d

    Start Of Frame 0xx: width=%u, height=%u, components=%d

    Smoothing not supported with nonstandard sampling ratios

    Smoothing not supported with nonstandard sampling ratios

    RST%d

    RST%d

    At marker 0xx, recovery action %d

    At marker 0xx, recovery action %d

    Selected %d colors for quantization

    Selected %d colors for quantization

    Quantizing to %d colors

    Quantizing to %d colors

    Quantizing to %d = %d*%d*%d colors

    Quantizing to %d = %d*%d*%d colors

    %4u %4u %4u %4u %4u %4u %4u %4u

    %4u %4u %4u %4u %4u %4u %4u %4u

    Unexpected marker 0xx

    Unexpected marker 0xx

    Miscellaneous marker 0xx, length %u

    Miscellaneous marker 0xx, length %u

    with %d x %d thumbnail image

    with %d x %d thumbnail image

    JFIF extension marker: type 0xx, length %u

    JFIF extension marker: type 0xx, length %u

    Warning: thumbnail image size does not match data length %u

    Warning: thumbnail image size does not match data length %u

    JFIF APP0 marker: version %d.d, density %dx%d %d

    JFIF APP0 marker: version %d.d, density %dx%d %d

    = = = = = = = =

    = = = = = = = =

    Obtained EMS handle %u

    Obtained EMS handle %u

    Freed EMS handle %u

    Freed EMS handle %u

    Define Restart Interval %u

    Define Restart Interval %u

    Define Quantization Table %d precision %d

    Define Quantization Table %d precision %d

    Define Huffman Table 0xx

    Define Huffman Table 0xx

    Define Arithmetic Table 0xx: 0xx

    Define Arithmetic Table 0xx: 0xx

    Unknown APP14 marker (not Adobe), length %u

    Unknown APP14 marker (not Adobe), length %u

    Unknown APP0 marker (not JFIF), length %u

    Unknown APP0 marker (not JFIF), length %u

    Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

    Adobe APP14 marker: version %d, flags 0xx 0xx, transform %d

    Unsupported marker type 0xx

    Unsupported marker type 0xx

    Failed to create temporary file %s

    Failed to create temporary file %s

    Unsupported JPEG process: SOF type 0xx

    Unsupported JPEG process: SOF type 0xx

    Cannot quantize to more than %d colors

    Cannot quantize to more than %d colors

    Cannot quantize to fewer than %d colors

    Cannot quantize to fewer than %d colors

    Cannot quantize more than %d color components

    Cannot quantize more than %d color components

    Insufficient memory (case %d)

    Insufficient memory (case %d)

    Not a JPEG file: starts with 0xx 0xx

    Not a JPEG file: starts with 0xx 0xx

    Quantization table 0xx was not defined

    Quantization table 0xx was not defined

    Huffman table 0xx was not defined

    Huffman table 0xx was not defined

    Backing store not supported

    Backing store not supported

    Arithmetic table 0xx was not defined

    Arithmetic table 0xx was not defined

    Cannot transcode due to multiple use of quantization table %d

    Cannot transcode due to multiple use of quantization table %d

    Maximum supported image dimension is %u pixels

    Maximum supported image dimension is %u pixels

    Empty JPEG image (DNL not supported)

    Empty JPEG image (DNL not supported)

    Bogus DQT index %d

    Bogus DQT index %d

    Bogus DHT index %d

    Bogus DHT index %d

    Bogus DAC value 0x%x

    Bogus DAC value 0x%x

    Bogus DAC index %d

    Bogus DAC index %d

    Unsupported color conversion request

    Unsupported color conversion request

    Too many color components: %d, max %d

    Too many color components: %d, max %d

    Buffer passed to JPEG library is too small

    Buffer passed to JPEG library is too small

    JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

    JPEG parameter struct mismatch: library thinks size is %u, caller expects %u

    Improper call to JPEG library in state %d

    Improper call to JPEG library in state %d

    Invalid scan script at entry %d

    Invalid scan script at entry %d

    Invalid progressive parameters at scan script entry %d

    Invalid progressive parameters at scan script entry %d

    Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

    Invalid progressive parameters Ss=%d Se=%d Ah=%d Al=%d

    Unsupported JPEG data precision %d

    Unsupported JPEG data precision %d

    Invalid memory pool code %d

    Invalid memory pool code %d

    Wrong JPEG library version: library is %d, caller expects %d

    Wrong JPEG library version: library is %d, caller expects %d

    Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

    Component index %d: mismatching sampling ratio %d:%d, %d:%d, %c

    DCT scaled block size %dx%d not supported

    DCT scaled block size %dx%d not supported

    Invalid component ID %d in SOS

    Invalid component ID %d in SOS

    NULL row buffer for row %ld, pass %d

    NULL row buffer for row %ld, pass %d

    libpng error: %s

    libpng error: %s

    libpng warning: %s

    libpng warning: %s

    Unknown zTXt compression type %d

    Unknown zTXt compression type %d

    gamma = (%d/100000)

    gamma = (%d/100000)

    gx=%f, gy=%f, bx=%f, by=%f

    gx=%f, gy=%f, bx=%f, by=%f

    wx=%f, wy=%f, rx=%f, ry=%f

    wx=%f, wy=%f, rx=%f, ry=%f

    incorrect gamma=(%d/100000)

    incorrect gamma=(%d/100000)

    %s: Cannot open

    %s: Cannot open

    %s: Write error at scanline %lu

    %s: Write error at scanline %lu

    %s: Seek error at scanline %lu

    %s: Seek error at scanline %lu

    %u: Sample out of range, max %u

    %u: Sample out of range, max %u

    %s: Cannot modify tag "%s" while writing

    %s: Cannot modify tag "%s" while writing

    %s: Unknown %stag %u

    %s: Unknown %stag %u

    %f: Bad value for "%s"

    %f: Bad value for "%s"

    %s: Invalid %stag "%s" (not supported by codec)

    %s: Invalid %stag "%s" (not supported by codec)

    TIFFVSetField ... pass by value not imp.

    TIFFVSetField ... pass by value not imp.

    %ld: Bad value for "%s"

    %ld: Bad value for "%s"

    %d: Bad value for "%s"

    %d: Bad value for "%s"

    Nonstandard tile length %d, convert file

    Nonstandard tile length %d, convert file

    Nonstandard tile width %d, convert file

    Nonstandard tile width %d, convert file

    Bad value %ld for "%s" tag ignored

    Bad value %ld for "%s" tag ignored

    %s: Invalid InkNames value; expecting %d names, found %d

    %s: Invalid InkNames value; expecting %d names, found %d

    TIFFVGetField ... pass by value not imp.

    TIFFVGetField ... pass by value not imp.

    Sorry, can not handle images with %d-bit samples

    Sorry, can not handle images with %d-bit samples

    Sorry, can not handle LogLuv images with %s=%d

    Sorry, can not handle LogLuv images with %s=%d

    Sorry, LogLuv data must have %s=%d or %d

    Sorry, LogLuv data must have %s=%d or %d

    Sorry, can not handle image with %s=%d

    Sorry, can not handle image with %s=%d

    Sorry, LogL data must have %s=%d

    Sorry, LogL data must have %s=%d

    Sorry, can not handle separated image with %s=%d

    Sorry, can not handle separated image with %s=%d

    Sorry, can not handle RGB image with %s=%d

    Sorry, can not handle RGB image with %s=%d

    Sorry, can not handle YCbCr images with %s=%d

    Sorry, can not handle YCbCr images with %s=%d

    Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

    Sorry, can not handle contiguous data with %s=%d, and %s=%d and Bits/Sample=%d

    Missing needed %s tag

    Missing needed %s tag

    Sorry, can not image with %d-bit samples

    Sorry, can not image with %d-bit samples

    "%s": Bad mode

    "%s": Bad mode

    Not a TIFF file, bad version number %d (0x%x)

    Not a TIFF file, bad version number %d (0x%x)

    Not a TIFF file, bad magic number %d (0x%x)

    Not a TIFF file, bad magic number %d (0x%x)

    %s: Out of memory (TIFF structure)

    %s: Out of memory (TIFF structure)

    Sample %d out of range, max %u

    Sample %d out of range, max %u

    Internal error, unknown tag 0x%x

    Internal error, unknown tag 0x%x

    Tag %d

    Tag %d

    %s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

    %s: Read error at scanline %lu, strip %lu; got %lu bytes, expected %lu

    %s: Read error at scanline %lu; got %lu bytes, expected %lu

    %s: Read error at scanline %lu; got %lu bytes, expected %lu

    %s: Seek error at scanline %lu, strip %lu

    %s: Seek error at scanline %lu, strip %lu

    %s: Data buffer too small to hold strip %lu

    %s: Data buffer too small to hold strip %lu

    %s: Read error on strip %lu; got %lu bytes, expected %lu

    %s: Read error on strip %lu; got %lu bytes, expected %lu

    %s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

    %s: Read error at row %ld, col %ld, tile %ld; got %lu bytes, expected %lu

    %s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

    %s: Read error at row %ld, col %ld; got %lu bytes, expected %lu

    %s: Seek error at row %ld, col %ld, tile %ld

    %s: Seek error at row %ld, col %ld, tile %ld

    %s: Data buffer too small to hold tile %ld

    %s: Data buffer too small to hold tile %ld

    %s: No space for data buffer at scanline %ld

    %s: No space for data buffer at scanline %ld

    Compression scheme %u %s encoding is not implemented

    Compression scheme %u %s encoding is not implemented

    %s %s encoding is not implemented

    %s %s encoding is not implemented

    %s %s encoding is no longer implemented due to Unisys patent enforcement

    %s %s encoding is no longer implemented due to Unisys patent enforcement

    Compression scheme %u %s decoding is not implemented

    Compression scheme %u %s decoding is not implemented

    %s %s decoding is not implemented

    %s %s decoding is not implemented

    Compression algorithm does not support random access

    Compression algorithm does not support random access

    Bogus "%s" field, ignoring and calculating from imagelength

    Bogus "%s" field, ignoring and calculating from imagelength

    TIFF directory is missing required "%s" field, calculating from imagelength

    TIFF directory is missing required "%s" field, calculating from imagelength

    wrong data type %d for "%s"; tag ignored

    wrong data type %d for "%s"; tag ignored

    unknown field with tag %d (0x%x) encountered

    unknown field with tag %d (0x%x) encountered

    No space %s

    No space %s

    TIFF directory is missing required "%s" field

    TIFF directory is missing required "%s" field

    incorrect count for field "%s" (%lu, expecting %lu); tag ignored

    incorrect count for field "%s" (%lu, expecting %lu); tag ignored

    Error fetching data for field "%s"

    Error fetching data for field "%s"

    %s: Rational with zero denominator (num = %lu)

    %s: Rational with zero denominator (num = %lu)

    Cannot handle different per-sample values for field "%s"

    Cannot handle different per-sample values for field "%s"

    cannot read TIFF_ANY type %d for field "%s"

    cannot read TIFF_ANY type %d for field "%s"

    "%s": Information lost writing value (%g) as (unsigned) RATIONAL

    "%s": Information lost writing value (%g) as (unsigned) RATIONAL

    Error writing data for field "%s"

    Error writing data for field "%s"

    %s: Error writing SubIFD directory link

    %s: Error writing SubIFD directory link

    %s compression support is not configured

    %s compression support is not configured

    ?%s: No space for LogLuv state block

    ?%s: No space for LogLuv state block

    Inappropriate photometric interpretation %d for SGILog compression; %s

    Inappropriate photometric interpretation %d for SGILog compression; %s

    LogL16Decode: Not enough data at row %d (short %d pixels)

    LogL16Decode: Not enough data at row %d (short %d pixels)

    LogLuvDecode24: Not enough data at row %d (short %d pixels)

    LogLuvDecode24: Not enough data at row %d (short %d pixels)

    LogLuvDecode32: Not enough data at row %d (short %d pixels)

    LogLuvDecode32: Not enough data at row %d (short %d pixels)

    %s: No space for SGILog translation buffer

    %s: No space for SGILog translation buffer

    No support for converting user data format to LogL

    No support for converting user data format to LogL

    No support for converting user data format to LogLuv

    No support for converting user data format to LogLuv

    SGILog compression supported only for %s, or raw data

    SGILog compression supported only for %s, or raw data

    Unknown data format %d for LogLuv compression

    Unknown data format %d for LogLuv compression

    Unknown encoding %d for LogLuv compression

    Unknown encoding %d for LogLuv compression

    %s: No space for state block

    %s: No space for state block

    %s: Bad code word at scanline %d (x %lu)

    %s: Bad code word at scanline %d (x %lu)

    %s: %s at scanline %d (got %lu, expected %lu)

    %s: %s at scanline %d (got %lu, expected %lu)

    %s: Premature EOF at scanline %d (x %lu)

    %s: Premature EOF at scanline %d (x %lu)

    %s: No space for Group 3/4 reference line

    %s: No space for Group 3/4 reference line

    %s: No space for Group 3/4 run arrays

    %s: No space for Group 3/4 run arrays

    %s: Uncompressed data (not supported) at scanline %d (x %lu)

    %s: Uncompressed data (not supported) at scanline %d (x %lu)

    Fax SubAddress: %s

    Fax SubAddress: %s

    (%u = 0x%x)

    (%u = 0x%x)

    %suncompressed data

    %suncompressed data

    %sEOL padding

    %sEOL padding

    %s2-d encoding

    %s2-d encoding

    Improper JPEG sampling factors %d,%d

    Improper JPEG sampling factors %d,%d

    Apparently should be %d,%d,decompressor will try reading with sampling %d,%d

    Apparently should be %d,%d,decompressor will try reading with sampling %d,%d

    Improper JPEG strip/tile size, expected %dx%d, got %dx%d

    Improper JPEG strip/tile size, expected %dx%d, got %dx%d

    RowsPerStrip must be multiple of %d for JPEG

    RowsPerStrip must be multiple of %d for JPEG

    JPEG tile width must be multiple of %d

    JPEG tile width must be multiple of %d

    JPEG tile height must be multiple of %d

    JPEG tile height must be multiple of %d

    BitsPerSample %d not allowed for JPEG

    BitsPerSample %d not allowed for JPEG

    PhotometricInterpretation %d not allowed for JPEG

    PhotometricInterpretation %d not allowed for JPEG

    ThunderDecode: %s data at scanline %ld (%lu != %lu)

    ThunderDecode: %s data at scanline %ld (%lu != %lu)

    PackBitsDecode: discarding %d bytes to avoid buffer overrun

    PackBitsDecode: discarding %d bytes to avoid buffer overrun

    LZWDecode: Not enough data at scanline %d (short %d bytes)

    LZWDecode: Not enough data at scanline %d (short %d bytes)

    LZWDecode: Strip %d not terminated with EOI code

    LZWDecode: Strip %d not terminated with EOI code

    LZWDecode: Bogus encoding, loop in the code table; scanline %d

    LZWDecode: Bogus encoding, loop in the code table; scanline %d

    LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

    LZWDecodeCompat: Not enough data at scanline %d (short %d bytes)

    DumpModeDecode: Not enough data for scanline %d

    DumpModeDecode: Not enough data for scanline %d

    Horizontal differencing "Predictor" not supported with %d-bit samples

    Horizontal differencing "Predictor" not supported with %d-bit samples

    "Predictor" value %d not supported

    "Predictor" value %d not supported

    %u (0x%x)

    %u (0x%x)

    suda123.com

    suda123.com

    c:\%original file name%.exe

    c:\%original file name%.exe

    #include "l.chs\afxres.rc" // Standard components

    #include "l.chs\afxres.rc" // Standard components

    GetCPInfo

    GetCPInfo

    GetWindowsDirectoryA

    GetWindowsDirectoryA

    WinExec

    WinExec

    GetProcessHeap

    GetProcessHeap

    RegDeleteKeyA

    RegDeleteKeyA

    RegCreateKeyA

    RegCreateKeyA

    RegOpenKeyExA

    RegOpenKeyExA

    RegCloseKey

    RegCloseKey

    RegCreateKeyExA

    RegCreateKeyExA

    OffsetViewportOrgEx

    OffsetViewportOrgEx

    SetViewportExtEx

    SetViewportExtEx

    ScaleViewportExtEx

    ScaleViewportExtEx

    GetViewportExtEx

    GetViewportExtEx

    GetViewportOrgEx

    GetViewportOrgEx

    CreateDialogIndirectParamA

    CreateDialogIndirectParamA

    UnregisterHotKey

    UnregisterHotKey

    RegisterHotKey

    RegisterHotKey

    EnumChildWindows

    EnumChildWindows

    InternetCanonicalizeUrlA

    InternetCanonicalizeUrlA

    InternetCrackUrlA

    InternetCrackUrlA

    `.rdata

    `.rdata

    @.data

    @.data

    f.gWgrg

    f.gWgrg

    1.2.9.18

    1.2.9.18

    Reports

    Reports

    88888888886

    88888888886

    22222222220

    22222222220

    44444444442

    44444444442

    Cmdbars

    Cmdbars

    *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications

    *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications

    *\G{4AFFC9A0-5F99-101B-AF4E-00AA003F0F07}#9.0#0#%Program Files%\M

    *\G{4AFFC9A0-5F99-101B-AF4E-00AA003F0F07}#9.0#0#%Program Files%\M

    icrosoft Office\OFFICE11\MSACC.OLB#Microsoft Access 11.0 Object Library

    icrosoft Office\OFFICE11\MSACC.OLB#Microsoft Access 11.0 Object Library

    *\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\system32\stdole2.tlb#OLE Automation

    *\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\system32\stdole2.tlb#OLE Automation

    *\G{00000201-0000-0010-8000-00AA006D2EA4}#2.1#0#%Program Files%\Common Files\System\ado\msado21.tlb#Microsoft ActiveX Data Objects 2.1 Library

    *\G{00000201-0000-0010-8000-00AA006D2EA4}#2.1#0#%Program Files%\Common Files\System\ado\msado21.tlb#Microsoft ActiveX Data Objects 2.1 Library

    3, 3, 6, 1

    3, 3, 6, 1