Gen:Variant.Graftor.141244 (BitDefender), HEUR:Trojan.Win32.Generic (Kaspersky), DLOADER.Trojan (DrWeb), Gen:Variant.Graftor.141244 (B) (Emsisoft), Trojan:W32/DelfInject.R (FSecure), Win32:Malware-gen (Avast), Gen:Variant.Graftor.141244 (AdAware), Trojan.Win32.Delphi.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Sasfis.FD, VirTool.Win32.DelfInject.FD, GenericEmailWorm.YR, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm, VirTool, Malware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: b1482a893304d9cff0a8c846369a2299
SHA1: 7d780678bc02d175a05d9127e1162dfe2587bc35
SHA256: d3b9a45a973856b52f59827f452619660d31fe87cbe392bf202e33eb9c53fcdc
SSDeep: 49152:Xm5KDLL9rfQ2Ayo4WTr1onSvHa u9r7EqwIR51OKT6HBgwYEbSHr9Vt/0y3Cnpe6:OuL59oboSvHqhiG0bWJVtLynpVhY9oP
Size: 4448256 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC50, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, Armadillov171, UPolyXv05_v6
Company: Popeler.-.Installer
Created at: 2014-07-24 09:56:26
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
TSsafe.exe:164
%original file name%.exe:784
Mutexes
The following mutexes were created/opened:
ini_read_writeShimCacheMutex
File activity
The process TSsafe.exe:164 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
The process %original file name%.exe:784 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\TSsafe.exe (23407 bytes)
Registry activity
The process TSsafe.exe:164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKU\.DEFAULT\Software\Super-EC\½ûÖ¹ÖØ¸´Ãâ€ÂËÃÂÂÃÂÂ]
"tsloginsafe" = "35000378"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%System%\config\systemprofile\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k744606640"
[HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage" = "0"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "46 56 A6 4B 3D E6 13 8E 9B CA 1D 8E 55 65 5E C2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Microsoft\InternetExplorer\Main]
"Start Page" = "www.2345.com/?k744606640"
[HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ParseAutoexec" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
Proxy settings are disabled:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan deletes the following value(s) in system registry:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"
The process %original file name%.exe:784 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C 97 A7 B5 F2 38 95 E5 C2 7E 7C 94 05 EF BA 74"
[HKLM\SOFTWARE\Microsoft\InternetExplorer\Main]
"Start Page" = "www.2345.com/?k744606640I"
[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "www.2345.com/?k744606640"
[HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"HomePage" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
Dropped PE files
MD5 | File path |
---|---|
069c26de46fa4288359635c64ef402c0 | c:\TSsafe.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
C:\TSsafe.exe (23407 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: TSsafe??
Product Name: TSsafe??
Product Version: 1.0.0.0
Legal Copyright: TSsafe
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: TSsafe??
Comments: TSsafe??
Language: Language Neutral
Company Name: TSsafe??Product Name: TSsafe??Product Version: 1.0.0.0Legal Copyright: TSsafeLegal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: TSsafe??Comments: TSsafe??Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 502786 | 503808 | 4.52755 | cd5b2d74847b0fd9ecc5c793a3daf777 |
.rdata | 507904 | 3839726 | 3842048 | 5.19115 | c238cc97ec429b89d46f6ce00004b03a |
.data | 4349952 | 207978 | 65536 | 3.35265 | 6b42c009a67cc9c8ab54236db61e281a |
.rsrc | 4558848 | 29176 | 32768 | 3.30299 | eff968e2df6afd2e98ef0b083e644e38 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://aladdin.a.shifen.com/special/time/ | |
hxxp://open.baidu.com/special/time/ | 123.125.114.102 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
<font color="red">GET /special/time/ HTTP/1.0<br>
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)<br>
Accept: */*<br>
Host: open.baidu.com<br>
Pragma: no-cache<br>
<br>
</font><br><font color="blue">HTTP/1.1 200 OK<br>
Date: Thu, 14 Aug 2014 23:44:42 GMT<br>
Server: Apache<br>
X-Powered-By: PHP/5.2.9<br>
Vary: User-Agent<br>
Connection: Close<br>
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_784:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
advapi32.dll
advapi32.dll
ADVAPI32.DLL
ADVAPI32.DLL
KERNEL32.DLL
KERNEL32.DLL
shell32.dll
shell32.dll
ntdll.dll
ntdll.dll
winmm.dll
winmm.dll
shlwapi.dll
shlwapi.dll
RegOpenKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyA
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
GetAsyncKeyState
GetAsyncKeyState
GetProcessHeap
GetProcessHeap
RegCreateKeyA
RegCreateKeyA
1970-1-1 00:00:01
1970-1-1 00:00:01
001A2B3C4D5Ec:\kss.ini
001A2B3C4D5Ec:\kss.ini
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\
ServiceName\\.\
ServiceName\\.\
\.pL.
\.pL.
Windows
Windows
0,8999($
0,8999($
.SCK_LINES/9
.SCK_LINES/9
.jJ^\
.jJ^\
.ERZDLL$
.ERZDLL$
%fLH^A
%fLH^A
n.ef"
n.ef"
g%s_%d
g%s_%d
=.Xh"
=.Xh"
.Hjsp"
.Hjsp"
ANSI_CHARSE.Dc
ANSI_CHARSE.Dc
O7E(AL("%s
O7E(AL("%s
KeywnF
KeywnF
.cu%t
.cu%t
\-ú
\-ú
.NDFR8P
.NDFR8P
Ix.Lv?h]#
Ix.Lv?h]#
keysK
keysK
A.DHq*-
A.DHq*-
8X%Fx
8X%Fx
L.@%u
L.@%u
.QunW
.QunW
.da]o
.da]o
.PP`
.PP`
.pas8
.pas8
6.Pob
6.Pob
oOV?.DD@
oOV?.DD@
.ChS-v
.ChS-v
#yfP.re
#yfP.re
comctl32.dll
comctl32.dll
gdi32.dll
gdi32.dll
oleaut32.dll
oleaut32.dll
user32.dll
user32.dll
version.dll
version.dll
wsock32.dll
wsock32.dll
rsadll.dll
rsadll.dll
@\TSsafe.exe
@\TSsafe.exe
t%SVh
t%SVh
ole32.dll
ole32.dll
CrackCaptchaAPI.dll
CrackCaptchaAPI.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
GetKeyState
GetKeyState
MapVirtualKeyA
MapVirtualKeyA
EnumWindows
EnumWindows
tsloginsafe
tsloginsafe
c:\tssafe.ini
c:\tssafe.ini
!regsvr32 C:\yunzhongjun.dll -s
!regsvr32 C:\yunzhongjun.dll -s
ts.haq
ts.haq
!!"#$%&'(0
!!"#$%&'(0
%U!il
%U!il
_%.EhO^
_%.EhO^
{u%UWS
{u%UWS
KÜn$
KÜn$
\.gh
\.gh
\.rvicy
\.rvicy
\.\%s
\.\%s
.rBvi
.rBvi
iy..MzSL
iy..MzSL
u0r$.bu
u0r$.bu
wn.%c
wn.%c
D.EUi
D.EUi
.lkmene
.lkmene
ZI%9UCo$
ZI%9UCo$
-mqM}i
-mqM}i
%s*RB
%s*RB
w6N6.MMN
w6N6.MMN
.MulF
.MulF
V.RZk
V.RZk
4M$%s
4M$%s
RV5.qQ
RV5.qQ
4M%d]
4M%d]
%d,Ã
%d,Ã
s^%s$%d
s^%s$%d
f~.su
f~.su
F@.RZDWd
F@.RZDWd
v%u5bT
v%u5bT
\%x%-
\%x%-
K.Wvt|
K.Wvt|
[%C!y
[%C!y
%s,%.
%s,%.
)/.yp
)/.yp
47R.uv
47R.uv
.At5B
.At5B
4W key
4W key
J%D%C
J%D%C
.Hxc!2es
.Hxc!2es
i,Â
i,Â
P1udPfE
P1udPfE
u.vwxMS%
u.vwxMS%
x%
x%
.DP4V=
.DP4V=
@%D=HL
@%D=HL
.Ae~D_$
.Ae~D_$
QU.FAS
QU.FAS
%uM441"h
%uM441"h
nÂj
nÂj
U^.lo
U^.lo
=}'@"` /
=}'@"` /
].Nd8
].Nd8
.ac2T6'
.ac2T6'
C.SM0
C.SM0
ut8.dt
ut8.dt
.za|c
.za|c
\.gxo
\.gxo
5.zu 0X$
5.zu 0X$
.sm^8
.sm^8
hc.QI
hc.QI
F7a%sW
F7a%sW
6e.fgtC2
6e.fgtC2
p(.vpd
p(.vpd
.hl(p
.hl(p
.nn5P
.nn5P
NNN.qrstNNNNuvwxNNNNyz{|NNNN}~
NNN.qrstNNNNuvwxNNNNyz{|NNNN}~
1.2.3 Copyright
1.2.3 Copyright
H.yW 7
H.yW 7
cesrs when executednWin9
cesrs when executednWin9
MSG.N
MSG.N
%d\_:
%d\_:
r`t%C
r`t%C
=%d
=%d
x=%f,Ty
x=%f,Ty
?keyw
?keyw
.%fW'
.%fW'
Y:z%u
Y:z%u
%4uZ)
%4uZ)
f.rZz
f.rZz
OeXE
OeXE
HF=%U
HF=%U
.PxJ
.PxJ
p?B%f
p?B%f
.JV~9
.JV~9
%FVMcc|&t
%FVMcc|&t
Zv%.S
Zv%.S
^.Vk[
^.Vk[
X6.Vf
X6.Vf
.CN=~
.CN=~
(bP.ojZ
(bP.ojZ
]zjH%c
]zjH%c
O .KC
O .KC
d.uE~
d.uE~
-a}HU0uH
-a}HU0uH
A%xFh
A%xFh
h.IB
h.IB
N-9}qF[
N-9}qF[
M t%D
M t%D
Q%Ch>
Q%Ch>
.PrLp
.PrLp
U$:%CrV
U$:%CrV
"%x\Pu
"%x\Pu
A
A
8.Wv] HA
8.Wv] HA
.NO$H\ P
.NO$H\ P
%s5uh
%s5uh
7?.Un
7?.Un
yMask.SQueryDo
yMask.SQueryDo
tod.bene
tod.bene
i:|%f`p
i:|%f`p
CMsg#
CMsg#
'Omci%XV
'Omci%XV
E!.nWSPu-
E!.nWSPu-
7.qPn
7.qPn
281 60-")
281 60-")
>j.PHG
>j.PHG
{5894428C-A025-5FAF-402F-21DEF9E3A748} = s 'ts'
{5894428C-A025-5FAF-402F-21DEF9E3A748} = s 'ts'
'ts.EXE'
'ts.EXE'
val AppID = s {5894428C-A025-5FAF-402F-21DEF9E3A748}
val AppID = s {5894428C-A025-5FAF-402F-21DEF9E3A748}
ts.haq = s 'ts.haq'
ts.haq = s 'ts.haq'
CLSID = s '{20D12E19-8A53-F356-B3BE-8E9C6165C2FF}'
CLSID = s '{20D12E19-8A53-F356-B3BE-8E9C6165C2FF}'
CurVer = s 'ts.haq'
CurVer = s 'ts.haq'
ForceRemove {20D12E19-8A53-F356-B3BE-8E9C6165C2FF} = s 'ts.haq'
ForceRemove {20D12E19-8A53-F356-B3BE-8E9C6165C2FF} = s 'ts.haq'
ProgID = s 'ts.haq'
ProgID = s 'ts.haq'
stdole2.tlbWWW
stdole2.tlbWWW
%fNZxPR_uBVaLk_jSireHW
%fNZxPR_uBVaLk_jSireHW
AzVMTAs_zxkeYdNWWW
AzVMTAs_zxkeYdNWWW
YfSkqgs_nuRLfyWWd
YfSkqgs_nuRLfyWWd
^.aLbCbB40d
^.aLbCbB40d
jNYqqs_nexeapp
jNYqqs_nexeapp
nudPIAI_qNXISf_94d
nudPIAI_qNXISf_94d
XeCv_UDPgtWW
XeCv_UDPgtWW
.VtirWQ_Cvrgk_nbCTDbW
.VtirWQ_Cvrgk_nbCTDbW
^kshFi_keyOLFt
^kshFi_keyOLFt
ROciw_TCPWmjo_14d
ROciw_TCPWmjo_14d
6.YHlt_rLAjNWW
6.YHlt_rLAjNWW
sXnw_VZqHTyD_cRtiSQW
sXnw_VZqHTyD_cRtiSQW
%xBRe39WWd
%xBRe39WWd
.bdHkY_ilBMfPy_EAQRMtNWWW
.bdHkY_ilBMfPy_EAQRMtNWWW
IEGkF_ObtC_kkcmdvWWW
IEGkF_ObtC_kkcmdvWWW
.jzRQB_SjVOR_29WWd
.jzRQB_SjVOR_29WWd
.azUkMDUPPqcwLfzLW
.azUkMDUPPqcwLfzLW
kudPoPR_rivhU_ZvebErWd
kudPoPR_rivhU_ZvebErWd
ADVAPI32.dll
ADVAPI32.dll
GDI32.dll
GDI32.dll
IMM32.dll
IMM32.dll
MFC42.DLL
MFC42.DLL
MSVCP60.dll
MSVCP60.dll
MSVCRT.dll
MSVCRT.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
x2H%U
x2H%U
-%d$
-%d$
D.HJH
D.HJH
Bp.Tu
Bp.Tu
? %Uf
? %Uf
f-%SG
f-%SG
Anm%dQ
Anm%dQ
cL.CI
cL.CI
p%x]Ks
p%x]Ks
xPG)o%Sc
xPG)o%Sc
..asz
..asz
.EuD\
.EuD\
A[.Sh
A[.Sh
f;Je%6U
f;Je%6U
s
s
ddN-%s/
ddN-%s/
8*c.Jd
8*c.Jd
6}A8ZX.Dq
6}A8ZX.Dq
~%Dr6
~%Dr6
.hn.C
.hn.C
.wV0WA.r(
.wV0WA.r(
!F|.eA
!F|.eA
8M.kt
8M.kt
(OrZli:`%d
(OrZli:`%d
-nFqa}$
-nFqa}$
yËo
yËo
U.AJ~
U.AJ~
z.PX;z
z.PX;z
V%dim
V%dim
{.kkK
{.kkK
%dzWx
%dzWx
Q@.zd}|cli
Q@.zd}|cli
N.nRT
N.nRT
T%D#8U'S=7O
T%D#8U'S=7O
.yHd]
.yHd]
%f#.)oc
%f#.)oc
AT.UQ
AT.UQ
*]1%U
*]1%U
M}.mu
M}.mu
SH%D
SH%D
'6%Cq?
'6%Cq?
{]9Cz'FtP
{]9Cz'FtP
WI.Nx
WI.Nx
.MWNJ
.MWNJ
s,%DV
s,%DV
xQ%SY
xQ%SY
y-D4o}J
y-D4o}J
Gi,2.qQ
Gi,2.qQ
-ul
-ul
*.cl*
*.cl*
]V#%U
]V#%U
-> >&>->/
-> >&>->/
ePL%F
ePL%F
%uKX>
%uKX>
Q)aþ!
Q)aþ!
(9%SR&
(9%SR&
.Xgb>[@
.Xgb>[@
aMÿ
aMÿ
.Eo3}>
.Eo3}>
{.dT6
{.dT6
.yD=L
.yD=L
%s{g0 ?
%s{g0 ?
#.wG7
#.wG7
4.qq
4.qq
Hr.Chg
Hr.Chg
.hE*xe
.hE*xe
%XAyv
%XAyv
o%uC{
o%uC{
%xu^0
%xu^0
8g%x[d
8g%x[d
=aÃŒo
=aÃŒo
%6x\6
%6x\6
.ef*`&-
.ef*`&-
B.Gr9
B.Gr9
X:.Mc
X:.Mc
]R8.Yz
]R8.Yz
.LYuV
.LYuV
.cUIv
.cUIv
':-/:'=&,
':-/:'=&,
-:%!&)
-:%!&)
C:\yunzhongjun.dll
C:\yunzhongjun.dll
C:\lj.ini
C:\lj.ini
hXXp://open.baidu.com/special/time/
hXXp://open.baidu.com/special/time/
window.baidu_time(
window.baidu_time(
\update.exe
\update.exe
MSXML2.XMLHTTP.6.0
MSXML2.XMLHTTP.6.0
MSXML2.XMLHTTP.5.0
MSXML2.XMLHTTP.5.0
MSXML2.XMLHTTP.4.0
MSXML2.XMLHTTP.4.0
MSXML2.XMLHTTP.3.0
MSXML2.XMLHTTP.3.0
MSXML2.XMLHTTP
MSXML2.XMLHTTP
Microsoft.XMLHTTP.1.0
Microsoft.XMLHTTP.1.0
Can't create XMLHTTP connection object
Can't create XMLHTTP connection object
Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)
Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)
application/x-www-form-urlencoded
application/x-www-form-urlencoded
errmsg_s
errmsg_s
x.yvr
x.yvr
x.yvkd
x.yvkd
:|:czkey:|:
:|:czkey:|:
\1sprite_interface2_reward_ver2.0.NPK
\1sprite_interface2_reward_ver2.0.NPK
\1sprite_common_activestatus.NPK
\1sprite_common_activestatus.NPK
\1sprite_common_etc.NPK
\1sprite_common_etc.NPK
\1sprite_interface2_minimap_dungeon.NPK
\1sprite_interface2_minimap_dungeon.NPK
\1sprite_interface.NPK
\1sprite_interface.NPK
\1sprite_map_act2_sepa.NPK
\1sprite_map_act2_sepa.NPK
\1sprite_map_minimap.NPK
\1sprite_map_minimap.NPK
DNF.exe
DNF.exe
ws2_32.dll
ws2_32.dll
WinINet.dll
WinINet.dll
GLU32.DLL
GLU32.DLL
aclui.dll
aclui.dll
acsmib.dll
acsmib.dll
activeds.dll
activeds.dll
AcXtrnal.dll
AcXtrnal.dll
adimage.dll
adimage.dll
adptif.dll
adptif.dll
advpack.dll
advpack.dll
atl.dll
atl.dll
authz.dll
authz.dll
avicap32.dll
avicap32.dll
avifil32.dll
avifil32.dll
browseui.dll
browseui.dll
CABINET.DLL
CABINET.DLL
clusapi.dll
clusapi.dll
comdlg32.dll
comdlg32.dll
comsvcs.dll
comsvcs.dll
crtdll.dll
crtdll.dll
crypt32.dll
crypt32.dll
cryptnet.dll
cryptnet.dll
D3DRM.DLL
D3DRM.DLL
dbghelp.dll
dbghelp.dll
ddraw.dll
ddraw.dll
DHCPCSVC.DLL
DHCPCSVC.DLL
digest.dll
digest.dll
DINPUT.DLL
DINPUT.DLL
dplay.dll
dplay.dll
dplayx.dll
dplayx.dll
dsound.dll
dsound.dll
dsprop.dll
dsprop.dll
dsuiext.dll
dsuiext.dll
ftsrch.dll
ftsrch.dll
gpedit.dll
gpedit.dll
hhctrl.ocx
hhctrl.ocx
hlink.dll
hlink.dll
iasperf.dll
iasperf.dll
icm32.dll
icm32.dll
ICMP.DLL
ICMP.DLL
icmui.dll
icmui.dll
idq.dll
idq.dll
iedkcs32.dll
iedkcs32.dll
iissuba.dll
iissuba.dll
IMAGEHLP.DLL
IMAGEHLP.DLL
imm32.dll
imm32.dll
inetcpl.cpl
inetcpl.cpl
IPHLPAPI.DLL
IPHLPAPI.DLL
iprop.dll
iprop.dll
KSUSER.DLL
KSUSER.DLL
loadperf.dll
loadperf.dll
lz32.dll
lz32.dll
mapi32.dll
mapi32.dll
mgmtapi.dll
mgmtapi.dll
MOBSYNC.DLL
MOBSYNC.DLL
mpg4dmod.dll
mpg4dmod.dll
mpr.dll
mpr.dll
mprapi.dll
mprapi.dll
mqrt.dll
mqrt.dll
msacm32.dll
msacm32.dll
msafd.dll
msafd.dll
mscms.dll
mscms.dll
mscpxl32.dLL
mscpxl32.dLL
msgina.dll
msgina.dll
MSHTML.DLL
MSHTML.DLL
MSI.DLL
MSI.DLL
msimg32.dll
msimg32.dll
msorcl32.dll
msorcl32.dll
MSPATCHA.DLL
MSPATCHA.DLL
msrating.dll
msrating.dll
mstlsapi.dll
mstlsapi.dll
msvbvm50.dll
msvbvm50.dll
msvfw32.dll
msvfw32.dll
MSWSOCK.DLL
MSWSOCK.DLL
MTXDM.DLL
MTXDM.DLL
MTXOCI.DLL
MTXOCI.DLL
NDDEAPI.DLL
NDDEAPI.DLL
ndisnpp.dll
ndisnpp.dll
netapi32.dll
netapi32.dll
npptools.dll
npptools.dll
ntdsapi.dll
ntdsapi.dll
ntdsbcli.dll
ntdsbcli.dll
ntmsapi.dll
ntmsapi.dll
nwprovau.dll
nwprovau.dll
odbc32.dll
odbc32.dll
ODBCBCP.DLL
ODBCBCP.DLL
odbccp32.dll
odbccp32.dll
ODBCTRAC.DLL
ODBCTRAC.DLL
OLEACC.DLL
OLEACC.DLL
olecli32.dll
olecli32.dll
oledlg.dll
oledlg.dll
olesvr32.dll
olesvr32.dll
opengl32.dll
opengl32.dll
password.cpl
password.cpl
pdh.dll
pdh.dll
Powrprof.dll
Powrprof.dll
psapi.dll
psapi.dll
qosname.dll
qosname.dll
query.dll
query.dll
rasapi32.dll
rasapi32.dll
raschap.dll
raschap.dll
rasdlg.dll
rasdlg.dll
rasman.dll
rasman.dll
rassapi.dll
rassapi.dll
rastls.dll
rastls.dll
resutils.dll
resutils.dll
RICHED20.DLL
RICHED20.DLL
rpcns4.dll
rpcns4.dll
rpcrt4.dll
rpcrt4.dll
RSRC32.dll
RSRC32.dll
rtm.dll
rtm.dll
rtutils.dll
rtutils.dll
scarddlg.dll
scarddlg.dll
secur32.dll
secur32.dll
SENSAPI.DLL
SENSAPI.DLL
setupapi.dll
setupapi.dll
SFC.DLL
SFC.DLL
shdocvw.dll
shdocvw.dll
snmpapi.dll
snmpapi.dll
softpub.dll
softpub.dll
spoolss.dll
spoolss.dll
SVRAPI.DLL
SVRAPI.DLL
tapi32.dll
tapi32.dll
TLBINF32.dll
TLBINF32.dll
traffic.dll
traffic.dll
url.dll
url.dll
URLMON.DLL
URLMON.DLL
userenv.dll
userenv.dll
USP10.DLL
USP10.DLL
uxtheme.dll
uxtheme.dll
VB5STKIT.DLL
VB5STKIT.DLL
vba6.dll
vba6.dll
VDMDBG.DLL
VDMDBG.DLL
winfax.dll
winfax.dll
wininet.dll
wininet.dll
winscard.dll
winscard.dll
winspool.dll
winspool.dll
winspool.drv
winspool.drv
wintrust.dll
wintrust.dll
wldap32.dll
wldap32.dll
WOW32.DLL
WOW32.DLL
wsnmp32.dll
wsnmp32.dll
wtsapi32.dll
wtsapi32.dll
xolehlp.dll
xolehlp.dll
\TCLS\Client.exe
\TCLS\Client.exe
\TCLS\config\LoginQ.dat
\TCLS\config\LoginQ.dat
LastLogin
LastLogin
NoLoginUserRecord
NoLoginUserRecord
C:\gj.ini
C:\gj.ini
C:\yzm.bmp
C:\yzm.bmp
Function Getcpuid()
Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
getcpuid=cpu.ProcessorId
Getcpuid
Getcpuid
\\.\PhysicalDrive
\\.\PhysicalDrive
ch.bmp
ch.bmp
QQLogin.exe
QQLogin.exe
Tencentdl.exe
Tencentdl.exe
TXPlatform.exe
TXPlatform.exe
TenSafe.exe
TenSafe.exe
TenSafe_1.exe
TenSafe_1.exe
TenSafe_2.exe
TenSafe_2.exe
\rzxx.ini
\rzxx.ini
2.bmp
2.bmp
BOSS.bmp
BOSS.bmp
%WinDir%\ggg.ini
%WinDir%\ggg.ini
1.bmp
1.bmp
@.reloc
@.reloc
f9z.vk
f9z.vk
KERNEL32.dll
KERNEL32.dll
ts.dll
ts.dll
hXXp://116.255.195.191/tsjqm.htm
hXXp://116.255.195.191/tsjqm.htm
hXXp://116.255.195.191/tsverb.htm
hXXp://116.255.195.191/tsverb.htm
hXXp://blog.sina.com.cn/s/blog_ec98d81a0101ud6i.html
hXXp://blog.sina.com.cn/s/blog_ec98d81a0101ud6i.html
dnf.exe
dnf.exe
c:\windows\ggg.ini
c:\windows\ggg.ini
0000000
0000000
Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
hXXp://VVV.super-ec.cn
hXXp://VVV.super-ec.cn
" class="txt" />Function Getcpuid()
" class="txt" />Function Getcpuid()
User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)
User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)
InternetOpenUrlA
InternetOpenUrlA
HttpQueryInfoA
HttpQueryInfoA
eyybc.com
eyybc.com
super-ec.cn
super-ec.cn
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
http=
http=
HTTP/1.1
HTTP/1.1
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
hXXp://
hXXp://
HttpAddRequestHeadersA
HttpAddRequestHeadersA
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
\*.txt
\*.txt
scripting.FileSystemObject
scripting.FileSystemObject
%Documents and Settings%\IBM\Cookies\*.txt
%Documents and Settings%\IBM\Cookies\*.txt
Content.IE5\
Content.IE5\
program internal error number is %d.
program internal error number is %d.
:"%s"
:"%s"
:"%s".
:"%s".
;';0;
;';0;
454>4-5;5
454>4-5;5
Software\Policies\Microsoft\Internet Explorer\control Panel\HomePage.tmp
Software\Policies\Microsoft\Internet Explorer\control Panel\HomePage.tmp
google chrome
google chrome
Google Chrome
Google Chrome
VVV.2345.com/?k744606640
VVV.2345.com/?k744606640
VVV.2345.com/?keyybc
VVV.2345.com/?keyybc
VVV.duba.com/?un_4_447411
VVV.duba.com/?un_4_447411
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\MainHKEY_CLASSES_ROOT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\MainHKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
Kernel32.dll
Kernel32.dll
cmd.exe /c del
cmd.exe /c del
0123456789
0123456789
0123456789*
0123456789*
)!@#$%^&*(
)!@#$%^&*(
gdiplus.dll
gdiplus.dll
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
BUG! hXXp://VVV.super-ec.cn/
BUG! hXXp://VVV.super-ec.cn/
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
RASAPI32.dll
RASAPI32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
GetViewportOrgEx
GetViewportOrgEx
WINSPOOL.DRV
WINSPOOL.DRV
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
ShellExecuteA
ShellExecuteA
COMCTL32.dll
COMCTL32.dll
WSOCK32.dll
WSOCK32.dll
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
1.1.3
1.1.3
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
%s,%d
%s,%d
%s.lnk
%s.lnk
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
.AWINLOGON.EXE
.AWINLOGON.EXE
c:\%original file name%.exe
c:\%original file name%.exe
1.0.0.0
1.0.0.0
(hXXp://VVV.eyuyan.com)
(hXXp://VVV.eyuyan.com)
(*.*)
(*.*)
%original file name%.exe_784_rwx_00EB0000_00072000:
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
USER32.DLL
USER32.DLL
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s_%d
%s_%d
EInvalidGraphicOperation
EInvalidGraphicOperation
comctl32.dll
comctl32.dll
uxtheme.dll
uxtheme.dll
MAPI32.DLL
MAPI32.DLL
!"#$%xi
!"#$%xi
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
WindowState
WindowState
OnKeyDown
OnKeyDown
OnKeyPressl
OnKeyPressl
OnKeyUp
OnKeyUp
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
AutoHotkeys
AutoHotkeys
TMainMenuDp
TMainMenuDp
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword,
HelpKeyword,
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
readnowid.mtx
readnowid.mtx
D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas
D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
GetCPInfo
GetCPInfo
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
SetViewportOrgEx
SetViewportOrgEx
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyNameTextA
GetKeyNameTextA
EnumWindows
EnumWindows
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
GetKeyboardType
GetKeyboardType
38000=344
38000=344
.idata
.idata
.edata
.edata
P.reloc
P.reloc
P.rsrc
P.rsrc
#yfP.re
#yfP.re
KERNEL32.DLL
KERNEL32.DLL
advapi32.dll
advapi32.dll
gdi32.dll
gdi32.dll
user32.dll
user32.dll
version.dll
version.dll
wsock32.dll
wsock32.dll
rsadll.dll
rsadll.dll
No help keyword specified.
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Unsupported clipboard format
Unsupported clipboard format
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Interface not supported
Interface not supported
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
!'%s' is not a valid integer value
I/O error %d
I/O error %d
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
TSsafe.exe_164:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
t%SVh
t%SVh
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
kernel32.dll
kernel32.dll
advapi32.dll
advapi32.dll
ntdll.dll
ntdll.dll
ole32.dll
ole32.dll
KERNEL32.DLL
KERNEL32.DLL
user32.dll
user32.dll
CrackCaptchaAPI.dll
CrackCaptchaAPI.dll
winmm.dll
winmm.dll
shlwapi.dll
shlwapi.dll
GetAsyncKeyState
GetAsyncKeyState
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
GetProcessHeap
GetProcessHeap
GetKeyState
GetKeyState
MapVirtualKeyA
MapVirtualKeyA
EnumWindows
EnumWindows
RegOpenKeyA
RegOpenKeyA
RegEnumKeyA
RegEnumKeyA
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyA
RegCreateKeyA
tsloginsafe
tsloginsafe
c:\tssafe.ini
c:\tssafe.ini
!regsvr32 C:\yunzhongjun.dll -s
!regsvr32 C:\yunzhongjun.dll -s
ts.haq
ts.haq
!!"#$%&'(0
!!"#$%&'(0
%U!il
%U!il
_%.EhO^
_%.EhO^
{u%UWS
{u%UWS
KÜn$
KÜn$
\.gh
\.gh
\.rvicy
\.rvicy
\.\%s
\.\%s
.rBvi
.rBvi
iy..MzSL
iy..MzSL
u0r$.bu
u0r$.bu
wn.%c
wn.%c
D.EUi
D.EUi
.lkmene
.lkmene
ZI%9UCo$
ZI%9UCo$
-mqM}i
-mqM}i
%s*RB
%s*RB
w6N6.MMN
w6N6.MMN
.MulF
.MulF
V.RZk
V.RZk
4M$%s
4M$%s
RV5.qQ
RV5.qQ
4M%d]
4M%d]
%d,Ã
%d,Ã
s^%s$%d
s^%s$%d
f~.su
f~.su
F@.RZDWd
F@.RZDWd
v%u5bT
v%u5bT
\%x%-
\%x%-
K.Wvt|
K.Wvt|
[%C!y
[%C!y
%s,%.
%s,%.
)/.yp
)/.yp
47R.uv
47R.uv
.At5B
.At5B
4W key
4W key
J%D%C
J%D%C
.Hxc!2es
.Hxc!2es
i,Â
i,Â
P1udPfE
P1udPfE
u.vwxMS%
u.vwxMS%
x%
x%
.DP4V=
.DP4V=
@%D=HL
@%D=HL
.Ae~D_$
.Ae~D_$
QU.FAS
QU.FAS
%uM441"h
%uM441"h
nÂj
nÂj
U^.lo
U^.lo
=}'@"` /
=}'@"` /
].Nd8
].Nd8
.ac2T6'
.ac2T6'
C.SM0
C.SM0
ut8.dt
ut8.dt
.za|c
.za|c
\.gxo
\.gxo
5.zu 0X$
5.zu 0X$
.sm^8
.sm^8
hc.QI
hc.QI
F7a%sW
F7a%sW
6e.fgtC2
6e.fgtC2
p(.vpd
p(.vpd
.hl(p
.hl(p
.nn5P
.nn5P
NNN.qrstNNNNuvwxNNNNyz{|NNNN}~
NNN.qrstNNNNuvwxNNNNyz{|NNNN}~
1.2.3 Copyright
1.2.3 Copyright
H.yW 7
H.yW 7
cesrs when executednWin9
cesrs when executednWin9
MSG.N
MSG.N
%d\_:
%d\_:
r`t%C
r`t%C
=%d
=%d
x=%f,Ty
x=%f,Ty
?keyw
?keyw
.%fW'
.%fW'
Y:z%u
Y:z%u
%4uZ)
%4uZ)
f.rZz
f.rZz
OeXE
OeXE
HF=%U
HF=%U
.PxJ
.PxJ
p?B%f
p?B%f
.JV~9
.JV~9
%FVMcc|&t
%FVMcc|&t
Zv%.S
Zv%.S
^.Vk[
^.Vk[
X6.Vf
X6.Vf
.CN=~
.CN=~
(bP.ojZ
(bP.ojZ
]zjH%c
]zjH%c
O .KC
O .KC
d.uE~
d.uE~
-a}HU0uH
-a}HU0uH
A%xFh
A%xFh
h.IB
h.IB
N-9}qF[
N-9}qF[
M t%D
M t%D
Q%Ch>
Q%Ch>
.PrLp
.PrLp
U$:%CrV
U$:%CrV
"%x\Pu
"%x\Pu
A
A
8.Wv] HA
8.Wv] HA
.NO$H\ P
.NO$H\ P
%s5uh
%s5uh
7?.Un
7?.Un
yMask.SQueryDo
yMask.SQueryDo
tod.bene
tod.bene
i:|%f`p
i:|%f`p
CMsg#
CMsg#
'Omci%XV
'Omci%XV
E!.nWSPu-
E!.nWSPu-
7.qPn
7.qPn
281 60-")
281 60-")
>j.PHG
>j.PHG
{5894428C-A025-5FAF-402F-21DEF9E3A748} = s 'ts'
{5894428C-A025-5FAF-402F-21DEF9E3A748} = s 'ts'
'ts.EXE'
'ts.EXE'
val AppID = s {5894428C-A025-5FAF-402F-21DEF9E3A748}
val AppID = s {5894428C-A025-5FAF-402F-21DEF9E3A748}
ts.haq = s 'ts.haq'
ts.haq = s 'ts.haq'
CLSID = s '{20D12E19-8A53-F356-B3BE-8E9C6165C2FF}'
CLSID = s '{20D12E19-8A53-F356-B3BE-8E9C6165C2FF}'
CurVer = s 'ts.haq'
CurVer = s 'ts.haq'
ForceRemove {20D12E19-8A53-F356-B3BE-8E9C6165C2FF} = s 'ts.haq'
ForceRemove {20D12E19-8A53-F356-B3BE-8E9C6165C2FF} = s 'ts.haq'
ProgID = s 'ts.haq'
ProgID = s 'ts.haq'
stdole2.tlbWWW
stdole2.tlbWWW
%fNZxPR_uBVaLk_jSireHW
%fNZxPR_uBVaLk_jSireHW
AzVMTAs_zxkeYdNWWW
AzVMTAs_zxkeYdNWWW
YfSkqgs_nuRLfyWWd
YfSkqgs_nuRLfyWWd
^.aLbCbB40d
^.aLbCbB40d
jNYqqs_nexeapp
jNYqqs_nexeapp
nudPIAI_qNXISf_94d
nudPIAI_qNXISf_94d
XeCv_UDPgtWW
XeCv_UDPgtWW
.VtirWQ_Cvrgk_nbCTDbW
.VtirWQ_Cvrgk_nbCTDbW
^kshFi_keyOLFt
^kshFi_keyOLFt
ROciw_TCPWmjo_14d
ROciw_TCPWmjo_14d
6.YHlt_rLAjNWW
6.YHlt_rLAjNWW
sXnw_VZqHTyD_cRtiSQW
sXnw_VZqHTyD_cRtiSQW
%xBRe39WWd
%xBRe39WWd
.bdHkY_ilBMfPy_EAQRMtNWWW
.bdHkY_ilBMfPy_EAQRMtNWWW
IEGkF_ObtC_kkcmdvWWW
IEGkF_ObtC_kkcmdvWWW
.jzRQB_SjVOR_29WWd
.jzRQB_SjVOR_29WWd
.azUkMDUPPqcwLfzLW
.azUkMDUPPqcwLfzLW
kudPoPR_rivhU_ZvebErWd
kudPoPR_rivhU_ZvebErWd
ADVAPI32.dll
ADVAPI32.dll
GDI32.dll
GDI32.dll
IMM32.dll
IMM32.dll
MFC42.DLL
MFC42.DLL
MSVCP60.dll
MSVCP60.dll
MSVCRT.dll
MSVCRT.dll
OLEAUT32.dll
OLEAUT32.dll
SHELL32.dll
SHELL32.dll
USER32.dll
USER32.dll
VERSION.dll
VERSION.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
x2H%U
x2H%U
-%d$
-%d$
D.HJH
D.HJH
Bp.Tu
Bp.Tu
? %Uf
? %Uf
f-%SG
f-%SG
Anm%dQ
Anm%dQ
cL.CI
cL.CI
p%x]Ks
p%x]Ks
xPG)o%Sc
xPG)o%Sc
..asz
..asz
.EuD\
.EuD\
A[.Sh
A[.Sh
f;Je%6U
f;Je%6U
s
s
ddN-%s/
ddN-%s/
8*c.Jd
8*c.Jd
6}A8ZX.Dq
6}A8ZX.Dq
~%Dr6
~%Dr6
.hn.C
.hn.C
.wV0WA.r(
.wV0WA.r(
!F|.eA
!F|.eA
8M.kt
8M.kt
(OrZli:`%d
(OrZli:`%d
-nFqa}$
-nFqa}$
yËo
yËo
U.AJ~
U.AJ~
z.PX;z
z.PX;z
V%dim
V%dim
{.kkK
{.kkK
%dzWx
%dzWx
Q@.zd}|cli
Q@.zd}|cli
N.nRT
N.nRT
T%D#8U'S=7O
T%D#8U'S=7O
.yHd]
.yHd]
%f#.)oc
%f#.)oc
AT.UQ
AT.UQ
*]1%U
*]1%U
M}.mu
M}.mu
SH%D
SH%D
'6%Cq?
'6%Cq?
{]9Cz'FtP
{]9Cz'FtP
WI.Nx
WI.Nx
.MWNJ
.MWNJ
s,%DV
s,%DV
xQ%SY
xQ%SY
y-D4o}J
y-D4o}J
Gi,2.qQ
Gi,2.qQ
-ul
-ul
*.cl*
*.cl*
]V#%U
]V#%U
-> >&>->/
-> >&>->/
ePL%F
ePL%F
%uKX>
%uKX>
Q)aþ!
Q)aþ!
(9%SR&
(9%SR&
.Xgb>[@
.Xgb>[@
aMÿ
aMÿ
.Eo3}>
.Eo3}>
{.dT6
{.dT6
.yD=L
.yD=L
%s{g0 ?
%s{g0 ?
#.wG7
#.wG7
4.qq
4.qq
Hr.Chg
Hr.Chg
.hE*xe
.hE*xe
%XAyv
%XAyv
o%uC{
o%uC{
%xu^0
%xu^0
8g%x[d
8g%x[d
=aÃŒo
=aÃŒo
%6x\6
%6x\6
.ef*`&-
.ef*`&-
B.Gr9
B.Gr9
X:.Mc
X:.Mc
]R8.Yz
]R8.Yz
.LYuV
.LYuV
.cUIv
.cUIv
':-/:'=&,
':-/:'=&,
-:%!&)
-:%!&)
C:\yunzhongjun.dll
C:\yunzhongjun.dll
C:\lj.ini
C:\lj.ini
hXXp://open.baidu.com/special/time/
hXXp://open.baidu.com/special/time/
window.baidu_time(
window.baidu_time(
1970-1-1 00:00:01
1970-1-1 00:00:01
\update.exe
\update.exe
MSXML2.XMLHTTP.6.0
MSXML2.XMLHTTP.6.0
MSXML2.XMLHTTP.5.0
MSXML2.XMLHTTP.5.0
MSXML2.XMLHTTP.4.0
MSXML2.XMLHTTP.4.0
MSXML2.XMLHTTP.3.0
MSXML2.XMLHTTP.3.0
MSXML2.XMLHTTP
MSXML2.XMLHTTP
Microsoft.XMLHTTP.1.0
Microsoft.XMLHTTP.1.0
Can't create XMLHTTP connection object
Can't create XMLHTTP connection object
Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)
Mozilla/4.0 (compatible; MSiE 6.0; Windows NT 5.1;)
application/x-www-form-urlencoded
application/x-www-form-urlencoded
errmsg_s
errmsg_s
x.yvr
x.yvr
x.yvkd
x.yvkd
:|:czkey:|:
:|:czkey:|:
\1sprite_interface2_reward_ver2.0.NPK
\1sprite_interface2_reward_ver2.0.NPK
\1sprite_common_activestatus.NPK
\1sprite_common_activestatus.NPK
\1sprite_common_etc.NPK
\1sprite_common_etc.NPK
\1sprite_interface2_minimap_dungeon.NPK
\1sprite_interface2_minimap_dungeon.NPK
\1sprite_interface.NPK
\1sprite_interface.NPK
\1sprite_map_act2_sepa.NPK
\1sprite_map_act2_sepa.NPK
\1sprite_map_minimap.NPK
\1sprite_map_minimap.NPK
DNF.exe
DNF.exe
ws2_32.dll
ws2_32.dll
WinINet.dll
WinINet.dll
gdi32.dll
gdi32.dll
GLU32.DLL
GLU32.DLL
aclui.dll
aclui.dll
acsmib.dll
acsmib.dll
activeds.dll
activeds.dll
AcXtrnal.dll
AcXtrnal.dll
adimage.dll
adimage.dll
adptif.dll
adptif.dll
ADVAPI32.DLL
ADVAPI32.DLL
advpack.dll
advpack.dll
atl.dll
atl.dll
authz.dll
authz.dll
avicap32.dll
avicap32.dll
avifil32.dll
avifil32.dll
browseui.dll
browseui.dll
CABINET.DLL
CABINET.DLL
clusapi.dll
clusapi.dll
comctl32.dll
comctl32.dll
comdlg32.dll
comdlg32.dll
comsvcs.dll
comsvcs.dll
crtdll.dll
crtdll.dll
crypt32.dll
crypt32.dll
cryptnet.dll
cryptnet.dll
D3DRM.DLL
D3DRM.DLL
dbghelp.dll
dbghelp.dll
ddraw.dll
ddraw.dll
DHCPCSVC.DLL
DHCPCSVC.DLL
digest.dll
digest.dll
DINPUT.DLL
DINPUT.DLL
dplay.dll
dplay.dll
dplayx.dll
dplayx.dll
dsound.dll
dsound.dll
dsprop.dll
dsprop.dll
dsuiext.dll
dsuiext.dll
ftsrch.dll
ftsrch.dll
gpedit.dll
gpedit.dll
hhctrl.ocx
hhctrl.ocx
hlink.dll
hlink.dll
iasperf.dll
iasperf.dll
icm32.dll
icm32.dll
ICMP.DLL
ICMP.DLL
icmui.dll
icmui.dll
idq.dll
idq.dll
iedkcs32.dll
iedkcs32.dll
iissuba.dll
iissuba.dll
IMAGEHLP.DLL
IMAGEHLP.DLL
imm32.dll
imm32.dll
inetcpl.cpl
inetcpl.cpl
IPHLPAPI.DLL
IPHLPAPI.DLL
iprop.dll
iprop.dll
KSUSER.DLL
KSUSER.DLL
loadperf.dll
loadperf.dll
lz32.dll
lz32.dll
mapi32.dll
mapi32.dll
mgmtapi.dll
mgmtapi.dll
MOBSYNC.DLL
MOBSYNC.DLL
mpg4dmod.dll
mpg4dmod.dll
mpr.dll
mpr.dll
mprapi.dll
mprapi.dll
mqrt.dll
mqrt.dll
msacm32.dll
msacm32.dll
msafd.dll
msafd.dll
mscms.dll
mscms.dll
mscpxl32.dLL
mscpxl32.dLL
msgina.dll
msgina.dll
MSHTML.DLL
MSHTML.DLL
MSI.DLL
MSI.DLL
msimg32.dll
msimg32.dll
msorcl32.dll
msorcl32.dll
MSPATCHA.DLL
MSPATCHA.DLL
msrating.dll
msrating.dll
mstlsapi.dll
mstlsapi.dll
msvbvm50.dll
msvbvm50.dll
msvfw32.dll
msvfw32.dll
MSWSOCK.DLL
MSWSOCK.DLL
MTXDM.DLL
MTXDM.DLL
MTXOCI.DLL
MTXOCI.DLL
NDDEAPI.DLL
NDDEAPI.DLL
ndisnpp.dll
ndisnpp.dll
netapi32.dll
netapi32.dll
npptools.dll
npptools.dll
ntdsapi.dll
ntdsapi.dll
ntdsbcli.dll
ntdsbcli.dll
ntmsapi.dll
ntmsapi.dll
nwprovau.dll
nwprovau.dll
odbc32.dll
odbc32.dll
ODBCBCP.DLL
ODBCBCP.DLL
odbccp32.dll
odbccp32.dll
ODBCTRAC.DLL
ODBCTRAC.DLL
OLEACC.DLL
OLEACC.DLL
oleaut32.dll
oleaut32.dll
olecli32.dll
olecli32.dll
oledlg.dll
oledlg.dll
olesvr32.dll
olesvr32.dll
opengl32.dll
opengl32.dll
password.cpl
password.cpl
pdh.dll
pdh.dll
Powrprof.dll
Powrprof.dll
psapi.dll
psapi.dll
qosname.dll
qosname.dll
query.dll
query.dll
rasapi32.dll
rasapi32.dll
raschap.dll
raschap.dll
rasdlg.dll
rasdlg.dll
rasman.dll
rasman.dll
rassapi.dll
rassapi.dll
rastls.dll
rastls.dll
resutils.dll
resutils.dll
RICHED20.DLL
RICHED20.DLL
rpcns4.dll
rpcns4.dll
rpcrt4.dll
rpcrt4.dll
RSRC32.dll
RSRC32.dll
rtm.dll
rtm.dll
rtutils.dll
rtutils.dll
scarddlg.dll
scarddlg.dll
secur32.dll
secur32.dll
SENSAPI.DLL
SENSAPI.DLL
setupapi.dll
setupapi.dll
SFC.DLL
SFC.DLL
shdocvw.dll
shdocvw.dll
shell32.dll
shell32.dll
snmpapi.dll
snmpapi.dll
softpub.dll
softpub.dll
spoolss.dll
spoolss.dll
SVRAPI.DLL
SVRAPI.DLL
tapi32.dll
tapi32.dll
TLBINF32.dll
TLBINF32.dll
traffic.dll
traffic.dll
url.dll
url.dll
URLMON.DLL
URLMON.DLL
userenv.dll
userenv.dll
USP10.DLL
USP10.DLL
uxtheme.dll
uxtheme.dll
VB5STKIT.DLL
VB5STKIT.DLL
vba6.dll
vba6.dll
VDMDBG.DLL
VDMDBG.DLL
version.dll
version.dll
winfax.dll
winfax.dll
wininet.dll
wininet.dll
winscard.dll
winscard.dll
winspool.dll
winspool.dll
winspool.drv
winspool.drv
wintrust.dll
wintrust.dll
wldap32.dll
wldap32.dll
WOW32.DLL
WOW32.DLL
wsnmp32.dll
wsnmp32.dll
wtsapi32.dll
wtsapi32.dll
xolehlp.dll
xolehlp.dll
\TCLS\Client.exe
\TCLS\Client.exe
\TCLS\config\LoginQ.dat
\TCLS\config\LoginQ.dat
LastLogin
LastLogin
NoLoginUserRecord
NoLoginUserRecord
C:\gj.ini
C:\gj.ini
C:\yzm.bmp
C:\yzm.bmp
Function Getcpuid()
Function Getcpuid()
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
getcpuid=cpu.ProcessorId
getcpuid=cpu.ProcessorId
Getcpuid
Getcpuid
\\.\PhysicalDrive
\\.\PhysicalDrive
ch.bmp
ch.bmp
QQLogin.exe
QQLogin.exe
Tencentdl.exe
Tencentdl.exe
TXPlatform.exe
TXPlatform.exe
TenSafe.exe
TenSafe.exe
TenSafe_1.exe
TenSafe_1.exe
TenSafe_2.exe
TenSafe_2.exe
\rzxx.ini
\rzxx.ini
2.bmp
2.bmp
BOSS.bmp
BOSS.bmp
%WinDir%\ggg.ini
%WinDir%\ggg.ini
1.bmp
1.bmp
@.reloc
@.reloc
f9z.vk
f9z.vk
KERNEL32.dll
KERNEL32.dll
ts.dll
ts.dll
hXXp://116.255.195.191/tsjqm.htm
hXXp://116.255.195.191/tsjqm.htm
hXXp://116.255.195.191/tsverb.htm
hXXp://116.255.195.191/tsverb.htm
hXXp://blog.sina.com.cn/s/blog_ec98d81a0101ud6i.html
hXXp://blog.sina.com.cn/s/blog_ec98d81a0101ud6i.html
dnf.exe
dnf.exe
c:\windows\ggg.ini
c:\windows\ggg.ini
0000000
0000000
Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
Super-EChXXp://VVV.super-ec.cnhXXp://VVV.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
hXXp://VVV.super-ec.cn
hXXp://VVV.super-ec.cn
" class="txt" />Function Getcpuid()
" class="txt" />Function Getcpuid()
User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)
User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)
InternetOpenUrlA
InternetOpenUrlA
HttpQueryInfoA
HttpQueryInfoA
eyybc.com
eyybc.com
super-ec.cn
super-ec.cn
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
http=
http=
HTTP/1.1
HTTP/1.1
HttpOpenRequestA
HttpOpenRequestA
HttpSendRequestA
HttpSendRequestA
hXXp://
hXXp://
HttpAddRequestHeadersA
HttpAddRequestHeadersA
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies
\*.txt
\*.txt
scripting.FileSystemObject
scripting.FileSystemObject
%Documents and Settings%\IBM\Cookies\*.txt
%Documents and Settings%\IBM\Cookies\*.txt
Content.IE5\
Content.IE5\
program internal error number is %d.
program internal error number is %d.
:"%s"
:"%s"
:"%s".
:"%s".
;';0;
;';0;
454>4-5;5
454>4-5;5
001A2B3C4D5Ec:\kss.ini
001A2B3C4D5Ec:\kss.ini
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\
ServiceName\\.\
ServiceName\\.\
\.pL.
\.pL.
Windows
Windows
0,8999($
0,8999($
.SCK_LINES/9
.SCK_LINES/9
.jJ^\
.jJ^\
.ERZDLL$
.ERZDLL$
%fLH^A
%fLH^A
n.ef"
n.ef"
g%s_%d
g%s_%d
=.Xh"
=.Xh"
.Hjsp"
.Hjsp"
ANSI_CHARSE.Dc
ANSI_CHARSE.Dc
O7E(AL("%s
O7E(AL("%s
KeywnF
KeywnF
.cu%t
.cu%t
\-ú
\-ú
.NDFR8P
.NDFR8P
Ix.Lv?h]#
Ix.Lv?h]#
keysK
keysK
A.DHq*-
A.DHq*-
8X%Fx
8X%Fx
L.@%u
L.@%u
.QunW
.QunW
.da]o
.da]o
.PP`
.PP`
.pas8
.pas8
6.Pob
6.Pob
oOV?.DD@
oOV?.DD@
.ChS-v
.ChS-v
#yfP.re
#yfP.re
wsock32.dll
wsock32.dll
rsadll.dll
rsadll.dll
Software\Policies\Microsoft\Internet Explorer\control Panel\HomePage.tmp
Software\Policies\Microsoft\Internet Explorer\control Panel\HomePage.tmp
google chrome
google chrome
Google Chrome
Google Chrome
VVV.2345.com/?k744606640
VVV.2345.com/?k744606640
VVV.2345.com/?keyybc
VVV.2345.com/?keyybc
VVV.duba.com/?un_4_447411
VVV.duba.com/?un_4_447411
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\MainHKEY_CLASSES_ROOT
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InternetExplorer\MainHKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
Kernel32.dll
Kernel32.dll
cmd.exe /c del
cmd.exe /c del
0123456789
0123456789
0123456789*
0123456789*
)!@#$%^&*(
)!@#$%^&*(
gdiplus.dll
gdiplus.dll
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF400-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF401-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF402-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF405-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
{557CF406-1A04-11D3-9A73-0000F81EF32E}
BUG! hXXp://VVV.super-ec.cn/
BUG! hXXp://VVV.super-ec.cn/
F%*.*f
F%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
RASAPI32.dll
RASAPI32.dll
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WinExec
WinExec
GetWindowsDirectoryA
GetWindowsDirectoryA
GetViewportOrgEx
GetViewportOrgEx
WINSPOOL.DRV
WINSPOOL.DRV
RegDeleteKeyA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyExA
ShellExecuteA
ShellExecuteA
COMCTL32.dll
COMCTL32.dll
WSOCK32.dll
WSOCK32.dll
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
1.1.3
1.1.3
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
%s,%d
%s,%d
%s.lnk
%s.lnk
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
408059882016
408059882016
c:\TSsafe.exe
c:\TSsafe.exe
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
1.0.0.0
1.0.0.0
(hXXp://VVV.eyuyan.com)
(hXXp://VVV.eyuyan.com)
(*.*)
(*.*)
TSsafe.exe_164_rwx_01110000_00072000:
kernel32.dll
kernel32.dll
Windows
Windows
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
USER32.DLL
USER32.DLL
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s_%d
%s_%d
EInvalidGraphicOperation
EInvalidGraphicOperation
comctl32.dll
comctl32.dll
uxtheme.dll
uxtheme.dll
MAPI32.DLL
MAPI32.DLL
!"#$%xi
!"#$%xi
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
WindowState
WindowState
OnKeyDown
OnKeyDown
OnKeyPressl
OnKeyPressl
OnKeyUp
OnKeyUp
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
AutoHotkeys
AutoHotkeys
TMainMenuDp
TMainMenuDp
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword,
HelpKeyword,
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
readnowid.mtx
readnowid.mtx
D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas
D:\ksreg_delphi\V9\_rsa_delphi_dll\UnitSock.pas
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
GetCPInfo
GetCPInfo
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
SetViewportOrgEx
SetViewportOrgEx
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowsHookExA
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyNameTextA
GetKeyNameTextA
EnumWindows
EnumWindows
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
GetKeyboardType
GetKeyboardType
38000=344
38000=344
.idata
.idata
.edata
.edata
P.reloc
P.reloc
P.rsrc
P.rsrc
#yfP.re
#yfP.re
KERNEL32.DLL
KERNEL32.DLL
advapi32.dll
advapi32.dll
gdi32.dll
gdi32.dll
user32.dll
user32.dll
version.dll
version.dll
wsock32.dll
wsock32.dll
rsadll.dll
rsadll.dll
No help keyword specified.
No help keyword specified.
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
Alt Clipboard does not support Icons/Menu '%s' is already being used by another form
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Unsupported clipboard format
Unsupported clipboard format
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s
Cannot create file "%s". %s
Cannot open file "%s". %s
Cannot open file "%s". %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid property value List capacity out of bounds (%d)
Invalid property value List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
Invalid variant operation%Invalid variant operation (%s%.8x)
Invalid variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Operation not supported
Operation not supported
External exception %x
External exception %x
Interface not supported
Interface not supported
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
Application Error1Format '%s' invalid or incompatible with argument
Application Error1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
!'%s' is not a valid integer value
!'%s' is not a valid integer value
I/O error %d
I/O error %d
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation