Analysis Date2013-11-10 08:01:59
MD50adee6d4a9e9752b355e616464051681
SHA10abf06939b3d3da524b3219c08420d8feacdb101

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: d19474ec3bbbe5a0f39fb4ea1876cf44 sha1: 07df1b8d9cb0023e9f708bf08fedb812445b1e21 size: 561152
Section.rdata md5: 9a870a2f0641f2d58a69181122943ae4 sha1: c4a92e818a7fcc24a58c9808ac9cbb61832480ad size: 258048
Section.data md5: 34e6e94533e43e1a2e190358cb4c3a64 sha1: 08aabdfc12b09020fd189f0ffaa31740bfb4873b size: 65536
Section.rsrc md5: be72b7634f7a9efdea5ae91cc60401a8 sha1: 9f2f8366127f49159d693ce181554e966883ccb4 size: 114688
Timestamp2013-10-03 08:45:27
VersionLegalCopyright: 本软件 小金专属
FileVersion: 1.0.0.0
CompanyName: 本软件 小金专属
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
ProductName: 本软件 小金专属
ProductVersion: 1.0.0.0
FileDescription: 易语言程序
PackerMicrosoft Visual C++ v6.0
PEhash7eb017f35e953e4e55c310b758ab6cd91e0905ef
AVclamavWin.Trojan.Agent-204211
AVavgHider.WZR
AVaviraTR/Rootkit.Gen2

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_USER\Software\Microsoft\Multimedia\DrawDib\vga.drv 1024x768x24(BGR 0) ➝
31,31,31,31\\x00
RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\57b8_appcompat.txt
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates ProcessC:\WINDOWS\system32\dwwin.exe -x -s 364
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSxui.ptlogin2.qq.com
Winsock DNSwww.eyybc.com

Process
↳ C:\WINDOWS\system32\dwwin.exe -x -s 364

Network Details:

DNS8d5022a5aa50ee3429a899f5f0766bd5.360wzb.cn
Type: A
101.226.4.134
DNSui.ptlogin2.qq.com
Type: A
112.90.83.106
DNSwww.eyybc.com
Type: A
DNSxui.ptlogin2.qq.com
Type: A
HTTP GEThttp://www.eyybc.com/ec-jh.php?username=lu2423&password=123456&string=FC069BF755E32948E8A8210FCD3E52D9
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://xui.ptlogin2.qq.com/cgi-bin/qlogin?domain=qq.com&lang=2052&qtarget=1&jumpname=&appid=549000912&ptcss=undefined&param=u1%253Dhttp%25253A%25252F%25252Fqun.qzone.qq.com%25252Fgroup&css=&mibao_css=&s_url=http%253A%252F%252Fqun.qzone.qq.com%252Fgroup&low_login=0&style=12&authParamUrl=&needVip=0&ptui_version=10031
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1032 ➝ 101.226.4.134:80
Flows TCP192.168.1.1:1033 ➝ 112.90.83.106:80

Raw Pcap
0x00000000 (00000)   47455420 2f65632d 6a682e70 68703f75   GET /ec-jh.php?u
0x00000010 (00016)   7365726e 616d653d 6c753234 32332670   sername=lu2423&p
0x00000020 (00032)   61737377 6f72643d 31323334 35362673   assword=123456&s
0x00000030 (00048)   7472696e 673d4643 30363942 46373535   tring=FC069BF755
0x00000040 (00064)   45333239 34384538 41383231 30464344   E32948E8A8210FCD
0x00000050 (00080)   33453532 44392048 5454502f 312e310d   3E52D9 HTTP/1.1.
0x00000060 (00096)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000070 (00112)   63657074 2d456e63 6f64696e 673a2067   cept-Encoding: g
0x00000080 (00128)   7a69702c 20646566 6c617465 0d0a5573   zip, deflate..Us
0x00000090 (00144)   65722d41 67656e74 3a204d6f 7a696c6c   er-Agent: Mozill
0x000000a0 (00160)   612f342e 30202863 6f6d7061 7469626c   a/4.0 (compatibl
0x000000b0 (00176)   653b204d 53494520 362e303b 2057696e   e; MSIE 6.0; Win
0x000000c0 (00192)   646f7773 204e5420 352e313b 20535631   dows NT 5.1; SV1
0x000000d0 (00208)   3b202e4e 45542043 4c522032 2e302e35   ; .NET CLR 2.0.5
0x000000e0 (00224)   30373237 290d0a48 6f73743a 20777777   0727)..Host: www
0x000000f0 (00240)   2e657979 62632e63 6f6d0d0a 436f6e6e   .eyybc.com..Conn
0x00000100 (00256)   65637469 6f6e3a20 4b656570 2d416c69   ection: Keep-Ali
0x00000110 (00272)   76650d0a 0d0a                         ve....

0x00000000 (00000)   47455420 2f636769 2d62696e 2f716c6f   GET /cgi-bin/qlo
0x00000010 (00016)   67696e3f 646f6d61 696e3d71 712e636f   gin?domain=qq.co
0x00000020 (00032)   6d266c61 6e673d32 30353226 71746172   m&lang=2052&qtar
0x00000030 (00048)   6765743d 31266a75 6d706e61 6d653d26   get=1&jumpname=&
0x00000040 (00064)   61707069 643d3534 39303030 39313226   appid=549000912&
0x00000050 (00080)   70746373 733d756e 64656669 6e656426   ptcss=undefined&
0x00000060 (00096)   70617261 6d3d7531 25323533 44687474   param=u1%253Dhtt
0x00000070 (00112)   70253235 32353341 25323532 35324625   p%25253A%25252F%
0x00000080 (00128)   32353235 32467175 6e2e717a 6f6e652e   25252Fqun.qzone.
0x00000090 (00144)   71712e63 6f6d2532 35323532 4667726f   qq.com%25252Fgro
0x000000a0 (00160)   75702663 73733d26 6d696261 6f5f6373   up&css=&mibao_cs
0x000000b0 (00176)   733d2673 5f75726c 3d687474 70253235   s=&s_url=http%25
0x000000c0 (00192)   33412532 35324625 32353246 71756e2e   3A%252F%252Fqun.
0x000000d0 (00208)   717a6f6e 652e7171 2e636f6d 25323532   qzone.qq.com%252
0x000000e0 (00224)   4667726f 7570266c 6f775f6c 6f67696e   Fgroup&low_login
0x000000f0 (00240)   3d302673 74796c65 3d313226 61757468   =0&style=12&auth
0x00000100 (00256)   50617261 6d55726c 3d266e65 65645669   ParamUrl=&needVi
0x00000110 (00272)   703d3026 70747569 5f766572 73696f6e   p=0&ptui_version
0x00000120 (00288)   3d313030 33312048 5454502f 312e310d   =10031 HTTP/1.1.
0x00000130 (00304)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000140 (00320)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000150 (00336)   6e2d7573 0d0a4163 63657074 2d456e63   n-us..Accept-Enc
0x00000160 (00352)   6f64696e 673a2067 7a69702c 20646566   oding: gzip, def
0x00000170 (00368)   6c617465 0d0a5573 65722d41 67656e74   late..User-Agent
0x00000180 (00384)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000190 (00400)   6f6d7061 7469626c 653b204d 53494520   ompatible; MSIE 
0x000001a0 (00416)   362e303b 2057696e 646f7773 204e5420   6.0; Windows NT 
0x000001b0 (00432)   352e313b 20535631 3b202e4e 45542043   5.1; SV1; .NET C
0x000001c0 (00448)   4c522032 2e302e35 30373237 290d0a48   LR 2.0.50727)..H
0x000001d0 (00464)   6f73743a 20787569 2e70746c 6f67696e   ost: xui.ptlogin
0x000001e0 (00480)   322e7171 2e636f6d 0d0a436f 6e6e6563   2.qq.com..Connec
0x000001f0 (00496)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x00000200 (00512)   0d0a0d0a                              ....


Strings
VitulPotctLodLibyAVitulAllocVitulFIsBdRdPtGtPocssHpFLibyHpFHpAllocHpRAlloc
    
 ......
 (*.*)
#####
#######
080404B0
 %1 
1.0.0.0
	1uM
(&C)
Comments
CompanyName
	Ctrl+
	Ctrl+D
	Ctrl+End
	Ctrl+G
	Ctrl+Home
	Ctrl+N
	Ctrl+PageDown
	Ctrl+PageUp
	&D.
DEFAULT_ICON
\Device\
\Device\ialdnwxf
 DLL 
\DosDevices\ialdnwxf
(&E)
FileDescription
FileVersion
         (((((                  H
(&H)
Hjjj
Hjjjh
Hjjjj
Hjjjjjjjj
(http://www.eyuyan.com)
(&I)
 INI 
jjjj
jjjjj
LegalCopyright
msctls_progress32
msctls_updown32
MS Shell Dlg
(&N)
(null)
(&O)
(&P)
	PageDown
	PageUp
ProductName
ProductVersion
Progress1
 %s 
(&S)
	Shift+Tab
Spin1
StringFileInfo
(&T)
	Tab/Enter
TEXTINCLUDE
Translation
VarFileInfo
VS_VERSION_INFO
xxxx
^,_^][
^$|<!$
^$_^[]
<>	.%	
               
 (*.*)|*.*||
	!	!	!	!	
0123456789ABCDEF
0123456789ABCDEF0
01441B18+30+43c+10c=
01441B18+30+43c+116=
01441B18+30+43c+11d=
(&07-034/)7 '
0A4)VP
0dk:ghV
0gNK_I
0"gQPwFo
0j%4NTR
0R>\W[
0-%@ `u!
("/{	1
123456
1440590+8+8=0
1440590+8+8=1
1441B18+30+4dc+5E=2931423642
1441B18+30+74e=553039170
144C82C+C08+0+767=3021062128
,1"52.*
16038FC+42C=0
16038FC+42C=1
1}{{9AZ
1ac{1]cc1YcR9MZ19<R!90J
1ac{9<R190J
1ack90J!90J
1ack9EZR90JB90JJ90JJ90JJ90JJ90JJ90JJ90JJ90JJ90JB90JB90J990J990J990J990J990J190J190J990J990JB90JB90JB90JJ90JJ90JR90JR9MZs1ik
1acZ1EZ
1akJ1Uc
1akk9<RB90J)90J!90J
1akZ90J
1akZ9<R
1AZ!90J
1B7Ue5
1>{Bqd
%1c%-^
1]c194R
1]c1)}s
1]c{1Uck1QcZ1UcR1acR1ikR1Uc990J
1]cB1Uc9
1]cB94R
1]cR98R190J!90J!90J
1]cZ1AR190J
1]cZ1AR)90J
1ek{1QZJ94R190J)90J!90J!90J!90J
1ek91EZ
1ek{94R!90J
1ek{9EZ990J!90J
1ekk1ack98R
1ekk94R
1ekR98R!90J
1eks9,J
1ek!)yss)
1ekZ90J
1ekZ94R190J190J990JB90JB90JB90JB90JB90JB90JB90JB90J990J990J190J190J190J)90J)90J)90J)90J)90J)90J190J190J990J990JB90JB90JB90JJ94RJ9IZc1ek{98RR90JB90J990J190J190J)90J!90J!90J
1ekZ9AR)90J
1ik91Yc
1ik{9EZ
1ikc9AR
1ikc9AR!90J
1ikc9<R
1ikJ1}{
1ikk1IZ190J
1ikR)}s
1iks1EZ19<R
1IZ))qkc)
1mk{90J
1mkc9MZ198R
1mk{)qk
1mks94R
1mks9IZ!90J
1mkZ9QZ
1ms11ysk1
1msJ9MZ!94R
1msR94R
1msR9IZ
1MZB90J
1MZs1Ycs1qk
1QcJ)qk
1#QNAN
1qs{1akB9IZ
1qs{9AR)90J
1qsc9EZ
{{1qsk9]kc9]kZ9]kR9]kR9]kR9]kZ9akk1qs
1qsk9MZ!90J
1qsZ9MZ
1qsZ9Qc)98R
1QZ)9EZ
1QZB)us
1}s)1}s)1mk
1}{s1y{R1us19]k
1}s{9Qc198R
1}{s9Uc998R
1}sk1]c190J
1}sk9QZ)94R
1#SNAN
1Uc{90JJ90JB90J190J)90J!90J
1UcB94R
1UcJ94R
1Uck1YcJ9,J
1Uck9IZJ9<R!9,J
1UcR90J!90J
1Ucs)qk
1us{9Qc
1us{9Yc
1usk1Uc!98R
1uss1YcR9IZ99AR)98R
1uss94R)90J!90J
1uss9MZ190J
1usZ9MZ)9AR
1Uuy6o
1y{{9<R
1y{c9Uc)90J
1YcB98R
1YcZ9ARc90JB90JB9MZ{90J990J)9<Rc1
1ys)9EZ
1ysc9AR)90J
1ysk9MZ)90J
1ysR9MZ
1ysR9MZ!94R
1zISj5v
207787568
	2	5	5	5	5	5
;#;2;;;B;
%2\CLSID
%2\DocObject
%2\Insertable
%2\protocol\StdFileEditing\server
%2\protocol\StdFileEditing\verb\0
2>^" w
2	,(z 
33{s3w
3738w378
3A3E2C90E571C7C7939604CF3924FFFC
@[3$<K
3Pyz{#
3s7;73s0
3s7873s777
'`3V>UR
3zs770
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
:45m8|YE
[,45ZA:Q
4{:=f3v
}&-4}v
|?5^<@
5	!	!	!	!
5014D8FA6DCA40b68FA626D8183666EB
	5	5	5
5$5=5G5L5Q5s5
&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
5Z2P" Z"
6;5`{M
	6	6	6	6
	6	6	6	6	6	6	6	6	6	6	,	,	,	,	,	,	,	,	+	+	+	+	+	/	/	/	'	'	'	'	'	'	'	'	'	'	(	(	(	(	(	(	(	(	(	(	(	(	(	
6%676x6
=6?JK 
6 #@SdP]OI
73{;s8
{773w7:{z
776VzE
	7	7	7	7	7	7	7	7	7	7	7	*	*	-	-	-	-
7fffffff
7`RKqM
&:7VIh
,\7YU<
8)808;8@8a8h8o8u8
8A>V.	XJ
$8FXM$t:
8MThdu
;8;s3{77
8;{ss{s77
\$8UVW
8wI%4%
*8X({|L
90J190J
90J194RZ1
90J19AZc1y{
90J19,J
90J19Yc
90J!1ek
90J!90J
90J)90J
90J)90J190J990JB90JJ90JR9EZs1ik
90J!90J190J990JB90JR9]k
90J!90J190J99ek{1
90J)90J198RJ1us
90J!90J!90J
90J!90J)90J190J190J990JB90JJ90JR90JZ90Jc90Jk90Jk9MZ
90J!90J)90J190J190J990JB90JJ94RZ98Rc9ek
90J!90J)90J190J990J91mk
90J!90J)90J190J990JB90JJ90JR90Jc9ARs1y{
90J!90J)90J190J990JB90JJ90JZ9IZ{1
90J!90J)90J190J990JB90JR90JZ94Rc1qs
90J!90J)90J190J990JB90JR90JZ9ak
90J!90J)90J190J990JB98RJ1us
90J!90J)90J190J990JB98RJ1Yck1
90J!90J)90J190J990JJ90JR1ms
90J!90J)90J190J990JJ90JR90JZ9mk
90J!90J)90J190J990JJ90JR9AZk1
90J!90J)90J190J990JJ90JR9]c
90J!90J)90J190J990JJ90JR9<Rc9ms
90J!90J)90J190J99Qcc1}{
90J!90J)90J190JB90JJ90JR90JZ1Uc
90J!90J)90J190JB90JJ90JR9Uc
90J!90J)90J190JB90JJ9<RZ1qk
90J!90J)90J190JB9ARR1ms
90J!90J)90J190JB9EZc1}{
90J!90J)90J194RB9Qcc1
90J{90J{90J{90J
90J!90J)90J)90J11akc1}s
90J!90J!90J)90J190J11ik
90J!90J!90J)90J190J190J990JB90JJ90JR90JZ90Jc90Jk90Jk9Qc
90J!90J!90J)90J190J190J990JB90JJ90JR90JZ90Jc90Jk90Js9IZ
90J!90J!90J)90J190J990J990JB90JJ90JR90JZ90Jc90Jk94Rs9EZ
90J!90J!90J)90J190J990J990JB90JJ90JR90JZ90Jc98Rs9Uc
90J!90J!90J)90J190J990JB90JB90JJ90JR90JZ90Jc90Jk94Rs9IZ
90J!90J!90J)90J190J990JB90JJ90JR90JR90JZ90Rk9<Rs9ak
90J!90J!90J)90J190J990JB90JJ90JR90JZ90Jc94Rs1mk
90J!90J)90J)90J190J990JB90JJ90JR90JZ90Jk9<R{1}{
90J!90J!90J)90J190J990JB90JJ90JR90JZ94Rk9ak
90J!90J)90J)90J190J990JB90JJ90JR90JZ9ARk9Qc
90J!90J!90J)90J190J990JJ90JR90JZ90Jc9QZ
90J!90J!90J)90J190J990JJ90JR90JZ94Rk1ek
90J!90J!90J)90J190J998RB9Uck1us
90J!90J!90J)90J)90J190J190J190J190J190J190J190J190J)90J!90J!90J
90J!90J!90J!90J!90J!90J!90J
90J!90J!90J!90J!90J)90J!90J!90J!90J!90J
90J{90J{90J{90J{90J{90J{90J{90J{90J{90J
90J!90J!90J!90J)90J)90J)90J)90J)90J)90J!90J!90J
90J!90J!90J)90J)90J)90J)90J)90J)90J)90J)90J!90J!90J!90J
90J!90J)90J91us
90J!90J)90J990JB90JJ90JZ1ms
90J!90J)90J990JB90JJ90JZ9]c
90J!90J)90J990JB90JJ90JZ9ik
90J!90J)90J990JB90RR9<Rc1
90J!90J)90J990JB98RR1us
90J{90J{90J{9<R
90J{90J{90Js90Js90Js90Js90Js90J{90J{94R
90J!90J)94R19MZZ1qs
90J!90J990JZ1
90J!90J99IZk1
90J!90J)9<RB1
90J)90JB90Jc9ek
90J)90JB90JZ1us
90J)90JJ9ek
90J{90Js90Js90Jk90Jk90Jk90Jk90Jk90Jk90Jk90Js90Js90J{94R
90J91]c
90J)94RZ1
90J!98R19YcZ1
90J!98R)9UcR1}{
90J990J
90J990J!9,J
90J99Uc
90J!9akZ1
90J!9ARR1ik
90J!9ek
90J!9EZB1
90J!9IZ99YcR9eks1ms
90J!9IZs1
90J!9,J990JJ90JZ9IZ
90J!9MZ{1
90J!9MZR1
90J!9Qc91y{
90J)9<R99Ycc1
90JB90J)90J
90Jc90JR90JB90J990J190J)90J!90J
90Jc90JZ90JR90JB90J990J190J)90J!90J!90J
90Jc90JZ90JR90JJ90JB90J990J190J)90J!90J
90Jc90JZ90JZ90JR90JJ90JB90JB90J990J990J990J990J990JB90JB90JJ90JJ90JR90JZ90Jc90Jk9<R{1]c
90Jc9,JR9,JB9,J99,J99,JJ9,JZ98Rs1}s
90JJ90J!90J
90JJ90J)90J
90JJ90J990J190J)90J
90JJ90JB90J190J)90J!90J
90JJ94R
90JJ9,J190J
90JJ9,J)9,J
90Jk90Jc90Jk9QZ
90Jk90Jc90JZ90JR90JJ90JB90J990J190J)90J!90J!90J
90Jk90Jc90JZ90JR90JJ90JB90J990J)90J!90J!90J
90Jk90JR9,J990J!90J
90Jk9,Jc90JZ90JZ9,Jc94R{1mk
90Jk9,JR9,JB9,J)9,J
90JR90J990J190J990JZ1]c
90JR90J990J)9,J
90JR90JB90J990J190J!90J
90JR90JB90J990J190J)90J!90J
90JR90JJ90JB90J990J190J)90J!90J
90Js90Jk90Jc90Jc90JZ90JZ90JR90JR90JR90JR90JR90JZ90JZ90Jc90Jc90Jk90Js94R{9IZ
90Js90Jk90Jc90JZ90JR90JJ90JB90J190J)90J!90J
90Js90Jk90Jc90JZ90JR90JJ90JB90J990J190J)90J!90J
90Js90Jk90Jc90JZ90JR90JJ90JB90J990J190J)90J!90J!90J
90JZ90JJ90JB90J990J)90J!90J
90JZ90JR90JJ90JB90J990J190J)90J!90J
90Rk90JB94R!90J
92(y/z
94R190J
94R190J!98R)1MZB)ys
94R)1ms
94R!1usZ1
94R)90J
94R{90J{90J{9AR
94R{90Js90Js90Jk90Jk90Jc90Jc90Jc90Jc90Jc90Jc90Jc90Jc90Jk90Jk90Js90J{9EZ
94R{90Js90Js90Js90Js90Js90Js90Js90Js90Js90Js90J{90J{9<R
94R994R)1QcZ)}s
94R!9akR1
94R!9AZ19QcR1ys
94R!9EZ11
94RB90J990J)90J!90J
94Rc9,JB9,J19,J!9,J
94Rk90JJ90J)90J
94Rk9,Jc9,Jc9,JZ9,JZ9,Jc9,Jk9AR
94Rs90Jk90Jc90JZ90JJ90JB90J99IZ99AR190J
94Rs90Jk90Jc90JZ90JR90JJ90JB90J990J190J)90J!90J
^}%950[M
%9, %8
98R!90J
98R{90Jk90Jc90JZ90JR90JJ90JB90J990J190J)90J!90J!90J
98R{90Js90Jk90Jc90JZ90JR90JJ90J990J190J)90J!90J
98R{90JZ90JB9<R190J
98R)94R
98R!9akc1
98R!9<R
98RB1Uck)qs
98Rk90JZ90JR90JR90JZ9IZ
98R))mk
98RR90JR90JR9,JJ90JB90J99,J990JB90JJ90JR1Yc
98Rs90JJ90J)90J
98Rs90Jk90Jc90JZ90JR90JJ90JB90J990J190J)90J!90J!90J
98Rs90Js90Js90Jk90Jk90Jk90Jk90Jk90Jk90Jk90Jk90Jk90Jk90Jk90Js90Js90Js9<R
98RZ90JJ90JB90J190J)90J!90J
9akZ9AR!90J
9AR{98Rk98Rc9<RZ9ARZ9IZZ1ikk1UcJ90J
9AR!9ikc1
9ARc90J
9ARJ90J190J)90J!90J
9ARJ90J)90J!90J
9ARk90J)90J
9ARR90J990J190J)90J!90J
9ARs94RZ90JJ90JB90J990J190J!90J
9ARZ90J990J190J)90J!90J
'9A`u"9
9AZ19akc1
9AZ!94R
9AZ!94R!90J!90J)90J)90J190J190J190J190J190J190J190J190J)90J)90J!90J!90J!90J
9]c11qsc1
9]c99Yc
9D$$t+
9ekc90J
9ekc98R
9EZ11}{
9EZ190J
9EZ)1ikR1
9EZ)1msc1
9EZ{90Jc90JZ90JJ90JB90J990J190J190J)90J!90J
9EZ{90JZ90JR90JJ90J990J190J)90J!90J!90J
9EZ99iks1
9EZ!9EZ990J190J990J990J19,J)90J!90J!9,J!90J!90J)9,J990J994R990J)90J!9,J
9EZ!9EZ)9IZ99IZJ1msk1
9EZ)9ikc1
9EZ)9ikJ1y{
9EZ!9IZ11msJ1
9EZ!9MZ19ekB1
9EZ)9UcR1}{
9EZJ94R990J)90J!90J
9EZk90J99,J!90J
9EZk94Rc90JZ90Jc90Jc90Jc90JZ90JZ90JZ90JZ90JR90JR90JR90JJ90JJ90JR90JR90JR90JR90JZ90JZ90Jc90Jc90Jk9<Rs1us
9EZR90J)90J!90J
9EZs90Rk90Jc90Jk90Jc90Jc90Jc90Jc90Jc90JZ90JZ90JZ90JZ90JZ90JZ90Jc90Jc90Jc90Jk90Jk90Jk9<R{1ik
9G4_^d
9^Ht}3
9ik11}{c1
9ikc9]cR1qs
9ikR98R
9iks90J
9ikZ94R)90J
9IZ194R
9IZ{94RZ90JR90JJ90JB90J990J990J190J)90J)90J!90J!90J!90J)90J)90J190J190J990JB90JJ90JR90JZ90Jc98Rs9MZ
9IZ990J
9IZk90JB90J990J)90J)90J!90J
9IZR94R
9IZZ90J)90J!90J
9,J190JR1
9,J198RR1
9,J!90J11qk
9,J!90J91}{
9,J!90J91qs
9,J)90J990JJ9,JZ9<R{1
9,J)90J99AZc1ms
9,J)90JB90JZ1}{
9,J!9,J19,JB9,JZ9EZ
9,J!9,J!9,J!9,J
9,J)9,JB9MZ{1
9,J)9,JJ1qs
9,JZ90JJ90J19,J!90J
9l$\w_
9L$x~e
9l$xtU9
9=MT01OD
9MZ194R
9MZ)1}{Z1
9MZ994R
9MZ)9]kJ1
9MZc90JB90J990J190J)90J!90J
9MZJ90J
9MZs90JR90JB90J990J190J)90J
9MZs9ARZ94RR90JR90JR90JZ90JR90JR90JR90JR90JJ90JJ90JJ90JB90JB90JB90JB90JB90JB90JB90JJ90JJ90JR90JR90JZ90JZ90Jc1ek
9nPu	9^T
9o4u'V
	9oTtc
9Qc19ARB90J990J990J190J)90J)90J190JB9<RR90J190J
9Qc990J
9QcJ90J
9QZ190J!90J
{{9QZ19<R
9QZ{90JB90J19,J)90J!90J!9,J)90JB90JR9IZ
9QZB9EZ
9QZk90J)90J
9<R!1us
9<R{90Jc90JJ9,J190J!90J
9<R{94Rs94Rc94RZ94RR94RB94R994R194R)94R!90J
9<R!9akB1
9<R!9ekJ1
9<R!9YcB1
9<RB90J
9<RB90J)90J!90J!90J
9<Rc90JJ90JB90JB90J990J190J)90J)90J!90J!90J
9<Rk90JR90JJ90JB90J190J)90J!90J
9<Rk90JZ90JR90JJ90JJ90JB90J990J990J190J190J190J190J190J190J990J990JB90JJ90JR90JZ90Jc90Jk9IZ
9<Rs90Jk90Jc90JZ90JR90JR90JJ90JJ90JJ90JJ90JJ90JJ90JJ90JR90JR90JZ90Jc90Jc90Jk94Rs1Yc
9~@St99~8~
9t$0v8
9^@t53
9Uc19<R
9Uc!1ikZ1
9Uc)1yss1
9Uc!9ak99ikZ1uss1
9u ^t	
9^xu5j
9x u	f
9Yc!1ekB9MZ99<R190J)90J190J190J990J990J990J990J990J990J990J190J190J190J)90J)90J!90J!90J!90J!90J!90J!90J!90J)90J)90J)90J190J190J990J990J990JB94RB9<RJ90JB90J990J190J)90J)90J!90J
9Yc!1qsk1
9YcB90J
9YcB9msk1
~9zLB1?
<A|2<Z
a4IfQ"
A512548E76954B6E92C21055517615B0
abcddefghijklmnoopqrrsstuvvwwxyyz;
abnormal program termination
Accept: */*
Accept-Language: zh-cn
ad5S@)
AdjustWindowRectEx
Advapi32.dll
ADVAPI32.dll
]a\e][
AfxControlBar42s
AfxFrameOrView42s
AfxMDIFrame42s
AfxOldWndProc423
AfxOleControl42s
AfxWnd42s
Afx:%x:%x
Afx:%x:%x:%x:%x:%x
a:>oCM
AppendMenuA
.?AUCThreadData@@
August
.?AUIBoundObjectSite@@
.?AUIDispatch@@
.?AUIEnumVOID@@
.?AUIMessageFilter@@
.?AUINotifyDBEvents@@
.?AUIOleClientSite@@
.?AUIOleContainer@@
.?AUIOleControlSite@@
.?AUIOleInPlaceFrame@@
.?AUIOleInPlaceSite@@
.?AUIOleInPlaceUIWindow@@
.?AUIOleWindow@@
.?AUIParseDisplayName@@
.?AUIPropertyNotifySink@@
.?AUIRowsetNotify@@
.?AUISequentialStream@@
.?AUIStream@@
.?AUIUnknown@@
.?AV_AFX_BASE_MODULE_STATE@@
.?AV_AFX_CHECKLIST_STATE@@
.?AV_AFX_COLOR_STATE@@
.?AV_AFX_CTL3D_STATE@@
.?AV_AFX_CTL3D_THREAD@@
.?AVAFX_MODULE_STATE@@
.?AVAFX_MODULE_THREAD_STATE@@
.?AV_AFX_OLE_STATE@@
.?AV_AFX_THREAD_STATE@@
.?AV_AFX_WIN_STATE@@
.?AVCArchiveException@@
.?AVCArchiveStream@@
.?AVCBitmap@@
.?AVCBrush@@
.?AVCButton@@
.?AVCByteArray@@
.?AVCClientDC@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCColorDialog@@
.?AVCComboBox@@
.?AVCCommonDialog@@
.?AVCDataSourceControl@@
.?AVCDC@@
.?AVCDialog@@
.?AVCDWordArray@@
.?AVCEdit@@
.?AVCEnumArray@@
.?AVCEnumUnknown@@
.?AVCException@@
.?AVCFile@@
.?AVCFileDialog@@
.?AVCFileException@@
.?AVCFont@@
.?AVCGdiObject@@
.?AVCHandleMap@@
.?AVCImageList@@
.?AVCMapPtrToPtr@@
.?AVCMapStringToPtr@@
.?AVCMemFile@@
.?AVCMemoryException@@
.?AVCMenu@@
.?AVCNoTrackObject@@
.?AVCNotSupportedException@@
.?AVCObject@@
.?AVCOccManager@@
.?AVCOleBusyDialog@@
.?AVCOleControlContainer@@
.?AVCOleControlSite@@
.?AVCOleDialog@@
.?AVCOleDispatchException@@
.?AVCOleException@@
.?AVCOleMessageFilter@@
.?AVCPaintDC@@
.?AVCPen@@
.?AVCProgressCtrl@@
.?AVCPtrArray@@
.?AVCPtrList@@
.?AVCResourceException@@
.?AVCRgn@@
.?AVCSharedFile@@
.?AVCSimpleException@@
.?AVCStatic@@
.?AVCStringArray@@
.?AVCTempDC@@
.?AVCTempGdiObject@@
.?AVCTempImageList@@
.?AVCTempMenu@@
.?AVCTempWnd@@
.?AVCTestCmdUI@@
.?AVCToolTipCtrl@@
.?AVCUserException@@
.?AVCWinApp@@
.?AVCWindowDC@@
.?AVCWinThread@@
.?AVCWnd@@
.?AVCWordArray@@
.?AVtype_info@@
.?AVXAmbientProps@COleControlSite@@
.?AVXBoundObjectSite@COleControlSite@@
.?AVXEnumVOID@CEnumArray@@
.?AVXEventSink@COleControlSite@@
.?AVXMessageFilter@COleMessageFilter@@
.?AVXNotifyDBEvents@COleControlSite@@
.?AVXOleClientSite@COleControlSite@@
.?AVXOleContainer@COleControlContainer@@
.?AVXOleControlSite@COleControlSite@@
.?AVXOleIPFrame@COleControlContainer@@
.?AVXOleIPSite@COleControlSite@@
.?AVXPropertyNotifySink@COleControlSite@@
.?AVXRowsetNotify@COleControlSite@@
<A|@<Z
+aZ.mO
b}_>]*
B 02CV
bcdfghijklmnpqrstuvwxyz
BeginPaint
BeginPath
b;fXd	
B"}Gy:
b)?i^/
BitBlt
BJY.8U
BKbhTb~XBK!;
 (*.BMP)|*.BMP|GIF
Bogus message code %d
bpPG0+
Button
BUTTON
{B)ysc)}s
< (_'=]C
C =02CVu
@c"0pS^
;C,0Xz
%=^c1$
CallNextHookEx
CallWindowProcA
Caption
CArchiveException
CBitmap
CBrush
CButton
CByteArray
CClientDC
C$%cmb
CCmdTarget
CColorDialog
CColourPicker
CComboBox
CDialog
CDWordArray
CET3^h
CException
CFileDialog
CFileException
CGdiObject
CharNextA
CharUpperA
CheckBox
CheckMenuItem
ChildWindowFromPointEx
ChooseColorA
CImageList
ck(WSbpS
ClientToScreen
CloseClipboard
CloseDatabase
CloseHandle
ClosePrinter
CloseServiceHandle
CLSID\%1
CLSID\%1\AuxUserType\2
CLSID\%1\AuxUserType\3
CLSID\%1\DefaultExtension
CLSID\%1\DefaultIcon
CLSID\%1\DocObject
CLSID\%1\InprocHandler32
CLSID\%1\InProcServer32
CLSID\%1\Insertable
CLSID\%1\LocalServer32
CLSID\%1\MiscStatus
CLSID\%1\Printable
CLSID\%1\ProgID
CLSID\%1\Verb\0
CLSID\%1\Verb\1
CLSIDFromProgID
CLSIDFromString
$";c?m
CMapPtrToPtr
CMapStringToPtr
CMemFile
CMemoryException
c&mq$X
CNotSupportedException
CObject
CoCreateInstance
CoFreeUnusedLibraries
CoGetClassObject
CoInitialize
COleBusyDialog
COleDialog
COleDispatchException
COleException
CombineRgn
combobox
COMCTL32.dll
COMCTL32.DLL
comdlg32.dll
commctrl_DragListMsg
commdlg_ColorOK
commdlg_FileNameOK
commdlg_help
commdlg_LBSelChangedNotify
commdlg_SetRGBColor
commdlg_ShareViolation
ComObject
CompareStringA
CompareStringW
Content-Type: application/x-www-form-urlencoded
ControlService
Cookie
CopyAcceleratorTableA
CopyRect
CoRegisterMessageFilter
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CPaintDC
CPalette
CProgressCtrl
CPtrArray
CPtrList
CreateAcceleratorTableA
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDialogIndirectParamA
CreateDIBitmap
CreateEllipticRgn
CreateEventA
CreateFileA
CreateFontIndirectA
CreateIconFromResource
CreateIconFromResourceEx
CreateILockBytesOnHGlobal
CreateMenu
CreatePalette
CreatePen
CreatePolygonRgn
CreatePopupMenu
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSemaphoreA
CreateServiceA
CreateSolidBrush
CreateThread
CreateToolhelp32Snapshot
CreateWindowExA
CResourceException
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
CSharedFile
CStatic
CStringArray
CTempDC
CTempGdiObject
CTempImageList
CTempMenu
CTempWnd
CToolTipCtrl
Ctrl+A
Ctrl+B
Ctrl+C
Ctrl+D
Ctrl+E
Ctrl+F
Ctrl+F1
Ctrl+F10
Ctrl+F11
Ctrl+F12
Ctrl+F2
Ctrl+F3
Ctrl+F4
Ctrl+F5
Ctrl+F6
Ctrl+F7
Ctrl+F8
Ctrl+F9
Ctrl+G
Ctrl+H
Ctrl+I
Ctrl+J
Ctrl+K
Ctrl+L
Ctrl+M
Ctrl+N
Ctrl+O
Ctrl+P
Ctrl+Q
Ctrl+R
Ctrl+S
Ctrl+Shift+F1
Ctrl+Shift+F10
Ctrl+Shift+F11
Ctrl+Shift+F12
Ctrl+Shift+F2
Ctrl+Shift+F3
Ctrl+Shift+F4
Ctrl+Shift+F5
Ctrl+Shift+F6
Ctrl+Shift+F7
Ctrl+Shift+F8
Ctrl+Shift+F9
Ctrl+T
Ctrl+U
Ctrl+V
Ctrl+W
Ctrl+X
Ctrl+Y
Ctrl+Z
 (*.CUR)|*.CUR|
CUserException
CWinApp
CWindowDC
CWinFormUnit
CWinThread
CWordArray
c=Z)he
`\	Cz>I
?? / %d]
D$ _^][
D$,_^]
D$,;\$|
D$(_^]
D$(_^][
D$$_^[
D$$_^]
d09f2340818511d396f6aaf844c7e325
D$0SUV
D$0UVW
D$0WPQ
D$ |2;
d 3Z|v
D$49D$$}
D$4peK
D$4SUV
D$4teK
d6.*_!
D$89Vdu
D$8peK
D$8QRPh4QN
D$8RPj
D$8VPQ
D$$~9+
@.data
DbgPrint
D+\bnX
D]+bXo
D$(CUSWP
 %d/%d 
(%d-%d):
%d / %d
%d / %d]
dddd, MMMM dd, yyyy
d:\dk\rwm\objfre_wxp_x86\i386\rwm.pdb
D$dpeK
D$dPQV
D$dQUWRP
D$dSUVW
D$DSWRPQ
D$DURP
December
DEFAULT_ICON
#define _AFX_NO_OLE_RESOURCES
#define _AFX_NO_PROPERTY_RESOURCES
#define _AFX_NO_TRACKER_RESOURCES
DefWindowProcA
DeleteCriticalSection
=deleted
DeleteDC
DeleteFileA
DeleteMenu
DeleteObject
DeleteService
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
device
\Device\\\.\
DeviceIoControl
devices
.)D$H)
D$H_^][
D$hQRP
D$hRPQ
D$hSUV3
D$hUPQ
D$HUPQ
D$HUSj
Dim cpuSet,cpu
disable
DispatchMessageA
DISPLAY
DjHGc%I!z
DjOienWR+y
D$(;l$ 
DllRegisterServer
DllUnregisterServer
D$LpeK
D$LPUj
D$LteK
D$LUSWP
<[DM4Rd#_
DocumentPropertiesA
DOMAIN error
D$,peK
D$$peK
D$,Pj<j
D$ PQR
D$PQRP
D$PRPQ
DPtoLP
D$(QPW
D$(QRP
D$$QUP
DrawDibOpen
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawTextA
D$@RPQj
D$ RPUhD
D$,RVh
D$,SPh
D$(SUV
D$$SUV
D$(t,;
D$t+D$\
D$t#D$h
D$TRPW
D$TVPW
D/UP~D
DuplicateHandle
D$@UPQ
|$D UV
dV92DV
DweY}z)
D$@WPS
Dw=|:s
D$xpeK
D$XpeK
D$XPQU
D$XQRWP
D$XSUV
;D$xt&
D,ZaG5[
dz,j{3
d-zO]tW
)e=0z[5
E	"9|e
ech1Y%
)ec#LK7#
&Edit,0,2
EEhyuk
EHPWVS
Ej:B8;7
Ellipse
}em4Im"
Em65x.i
Embedded Object
Embed Source
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndDoc
end Function<th><label for="field_1new"><font color=red>USB
#endif
#endif //_WIN32
EndPage
EndPaint
EndPath
EnterCriticalSection
EnumDisplayMonitors
EnumDisplaySettingsA
ePq$kc
E%q}8=3
]E\qA:\>
eQpenc
EqualRect
ER\Jlz56
Escape
ExAllocatePoolWithTag
_except_handler3
ExcludeClipRect
ExFreePoolWithTag
      exit for
ExitProcess
ExtSelectClipRgn
ExtTextOutA
EzOWEA
F<_^][
F,_^][
F\_^][
$f4C)ij
F7FC1AE45C5C4758AF03EF19F18A395D
F89^8u&j
F8+N,+F0
,f9=TiO
F(9V8tQ
&:,FA,75
FD@ul9L$(}f
FD uy9D$$}s
February
F%*.*f
F(_+F$^[;E
?fff&ff23
F$@;F(v
F$@@;F(v
FileName
FileNameW
FileTimeToLocalFileTime
FileTimeToSystemTime
FillRect
FillRgn
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FindWindowA
fi<%z_
F\jLSP
- floating point not loaded
FlushFileBuffers
</font></label></th>
FontSize
    For Each cpu In cpuSet
FormatMessageA
FpHt&Ht
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
Friday
[/fS_MR
Fxt_;FTu@
g4GO&>?
g4r:\5
GAIsProcessorFeaturePresent
gameapp.exe
GameApp.exe
g~b1Y%
'g`Bc\
Gdi32.dll
GDI32.dll
GdiTransparentBlt
GetACP
GetActiveWindow
GetallResponseHeaders
GetBkColor
GetBkMode
GetCapture
GetClassInfoA
GetClassLongA
GetClassNameA
GetClientRect
GetClipboardData
GetClipBox
GetClipRgn
GetCommandLineA
GetConnectString
GetCPInfo
      getcpuid=cpu.ProcessorId
GetCurrentObject
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetCursorPos
GetDesktopWindow
GetDeviceCaps
GetDIBits
GetDlgCtrlID
GetDlgItem
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetFileAttributesA
GetFileSize
GetFileTime
GetFileTitleA
GetFileType
GetFocus
GetForegroundWindow
GetFullPathNameA
GetKeyState
GetLastActivePopup
GetLastError
GetLocalTime
GetMapMode
GetMenu
GetMenuCheckMarkDimensions
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMessageA
GetMessagePos
GetMessageTime
GetModuleFileNameA
GetModuleHandleA
GetMonitorInfoA
GetNextDlgGroupItem
GetNextDlgTabItem
GetObjectA
GetOEMCP
GetOpenFileNameA
GetParent
GetPolyFillMode
GetProcAddress
GetProcessHeap
GetProcessVersion
GetProfileStringA
GetPropA
GetROP2
GetSaveFileNameA
GetScrollPos
GetScrollRange
GetStartupInfoA
GetStdHandle
GetStockObject
GetStretchBltMode
GetStringTypeA
GetStringTypeW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetSystemPaletteEntries
GetSystemTime
GetTabList
GetTextColor
GetTextExtentPoint32A
GetTextMetricsA
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetTopWindow
GetUserDefaultLCID
GetVersion
GetVersionExA
GetViewportExtEx
GetViewportOrgEx
GetVolumeInformationA
GetWindow
GetWindowDC
GetWindowExtEx
GetWindowLongA
GetWindowOrgEx
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GetWindowThreadProcessId
G"G)Ck
 (*.GIF)|*.GIF|
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalHandle
__GLOBAL_HEAP_SELECTED
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
} GqYD
GrayStringA
&groupid=
&g_tk=
:~GyXq
`h````
h9n`u;
H.data
Hdhzk[8
Hd"lZX
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
height
hgjlkbrfzaoe
HHtpHHtl
{HMkF7
H:mm:ss
H\!q5&c
h.rdata
::\hrO
HSVHWtgHHtF
Ht#HHt
HtHHuz
 (*.htm;*.html)|*.htm;*.html
HtmlViewer
http://
http://qun.qzone.qq.com/
http://qun.qzone.qq.com/cgi-bin/get_group_member?callbackFun=_GroupMember&uin=
http://qun.qzone.qq.com/group
https://
http://www.eyybc.com/ec-jh.php?username=
 http://www.super-ec.cn
http://xui.ptlogin2.qq.com/cgi-bin/qlogin?domain=qq.com&lang=2052&qtarget=1&jumpname=&appid=549000912&ptcss=undefined&param=u1%253Dhttp%25253A%25252F%25252Fqun.qzone.qq.com%25252Fgroup&css=&mibao_css=&s_url=http%253A%252F%252Fqun.qzone.qq.com%252Fgroup&low_login=0&style=12&authParamUrl=&needVip=0&ptui_version=10031
HtYHt6H
hWj@_;
H?\@*|X
_hypot
I@(=&<
ialdnwxf
i[+b~2
 (*.ICO)|*.ICO|
#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)
#ifdef _WIN32
Ik|Fb.
ImageList_Destroy
ImageList_Draw
#include "l.chs\afxres.rc"          // Standard components
InflateRect
InitCommonControlsEx
InitializeCriticalSection
<input type="text" name="field_1new" size="25" value="" disabled class="txt" />"  class="txt" />
<input type="text" name="field_2new" size="25" value="" disabled class="txt" />"  class="txt" />Function Getcpuid() 
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
InternetGetCookieA
InternetSetCookieA
IntersectRect
InvalidateRect
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
iphlpapi.dll
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
+Isy3M+
IsZoomed
ithXXD
It#Iu%
!(IuGa
IUOY3=^
!,i?*,v
\$\}-j
`j1Kjp[
j<1XD,
J1yss1}{
<J5e]D
JanFebMarAprMayJunJulAugSepOctNovDec
January
jBWVSSQ
\jMO+b
jM	Q(ao
jok^17
JPEGMEM
 (*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
 (*.JPG)|*.JPG|BMP
j\R*4<	!/
}JsBR|>
Jt`6T!
J-!tq,
+j/v&9
Jv(kERrc
j VUPWQ
j \"#%wa`2
k>|aSE
k>C-rTk{
KERNEL32
kernel32.dll
Kernel32.dll
KERNEL32.dll
KERNEL32.DLL
KeStackAttachProcess
KeTickCount
KeUnstackDetachProcess
KH1_la
KillTimer
K_LH7T
KTOof-
k=%V`I
kXEQ>\u
K+)"Y57w2
^l_^][
;l$ }:
L$ ]_^
L$$_^]
L$0PQR
L$0PQS
L$0SUV@W
L23fff&ff
L$,_^]3
L$,_[3
L$4_^3
L$4_^[d
L$4S+L$0Qj
L$4UQWP
L$4VQUP
L$4WPQR
L$4WQUVS
L=5M-hd
l(,#=7
L$8^]_3
L$89l$8}
L$8_^][d
l8i"gg'j
L$8WPQR
LANGUAGE 4, 2
L$(CH;
LCMapStringA
LCMapStringW
L$`_^][d
L$|_^][d
L$ ^][d
L$ _^d
L$ _^][d
L$,_^][d
L$(_^][d
L$@^[d
L$@^]d
L$@_^][d
L$$^[d
L$$^]d
L$$^][d
L$$_^d
L$$_^]d
L$$_^][d
L$\_^][d
L$D_^[d
L$D_^][d
L$D_]d
L$DPQj
L$DSVQ
LeaveCriticalSection
lFV6$4
l	g~b0R 
l	g~b0Rdk
L$h_^]3
L$h_^][d
L$H_^][d
L$H][d
L$Hj&Q
l$HQRVU
L$HSUVWP
LineTo
Link Source
Link Source Descriptor
L$L_^]3
L$l_^][d
L$L^[d
L$L_^][d
Ll`I9l
	LLLLLK
L$LPQR
L$lRVQ
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadLibraryA
LoadResource
LoadStringA
LocalAlloc
LocalFree
LocalReAlloc
Location:
LockFile
LockResource
Loo5MHC
+ LOOP 
L$P_^d
L$P_]^[d
L$ PQh
L$(PQR
L$@PQR
L$<PQVV
L$pRPQ
LPtoDP
L$(PVQ
L$ QSR
L$ QUS
L$,RPQ
L$(RPQ
L$<RPQW
L$@RQj
L$@RUQ
L$<SQR
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpyn
lstrcpynA
lstrlenA
lstrlenW
L$,SUV
L$(SUV
L$T_^]
L$t_^d
L$t][d
L$T_^]d
L$T_^][d
|$LtE;
L$TSWQ
>'l_U]
lu2423
L$(UUh
\$lUV3
L$(VQRSP
L$(VQVj
l$@VW3
l$<VWj
L$ WPQ
L$(WQR
L$(WSR
L$X_^]3
L$x_^d
L$x_^][d
L$X_^d
L$X;L$
L$XSQh
@;l$\~Z
mailto:
MapDialogRect
MapViewOfFile
MapWindowPoints
MBFi$X
M bFX`
+Mc[}<
M;=dfO
M/d/yy
MessageBeep
MessageBoxA
MGridCells
Microsoft Visual C++ Runtime Library
Microsoft.XMLHTTP
midiOutPrepareHeader
midiOutReset
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamProperty
midiStreamRestart
midiStreamStop
 (*.MID)|*.MID|
)mkR1AR)90J
MmIsAddressValid
?MN*~6
ModifyMenuA
Monday
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MousePointer
MoveToEx
MoveWindow
Mp2@90F
Mpr.dll
MPR.dll
MSIMG32.dll
MS Sans Serif
MS Shell Dlg
MSVCRT.dll
__MSVCRT_HEAP_SELECT
MSVFW32.dll
Mt'utg
MulDiv
MultiByteToWideChar
mWIME'
n0SSSSU
N8+F,+N0
Native
-NbkSbpS
-NbkSbpS(
nd9~dt
 &neednum=1&r=0.
Neqt0?
    Next
N/f@b	g
NH_^][
Nh;NX|
-'`N*I
n@Mg&M
-N"N1Y
N*Ncktepe
N(;N,r
N*Ntepe
N*N(W%
N*N(W0
- not enough space for arguments
- not enough space for environment
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
NS<V8s
nt2Ht#Ht
ntoskrnl.exe
NTRPQj
(null)
N$~	WU
NX9NXu 
Nyt2S	W	w	w
nzzpenc
O(_^][
o0SSSSU
o7~QsJ
Object Descriptor
ObjectLink
October
O=Df_63
Offline
OffsetRect
OffsetViewportOrgEx
o$FG`Ih
ole32.dll
OLEAUT32.dll
oledlg.dll
OleFlushClipboard
OleInitialize
OleIsCurrentClipboard
OleRun
OleUninitialize
&Open,0,2
OpenClipboard
OpenDatabase
OpenFileMappingA
OpenPrinterA
OpenProcess
OpenSCManagerA
OpenServiceA
Option
out.prn
OwnerLink
OX[0R 
%oY4;F
~P9~Pun
&#pA15`
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
PA#define _AFX_NO_SPLITTER_RESOURCES
&password=
PatBlt
PathToRegion
.PAVCArchiveException@@
.PAVCException@@
.PAVCFileException@@
.PAVCMemoryException@@
.PAVCNotSupportedException@@
.PAVCObject@@
.PAVCOleDispatchException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCSimpleException@@
.PAVCUserException@@
-p`bf.
PEa-dP1
PeekMessageA
Ph_^][Y
P#include "afxres.h"
PostMessageA
PostQuitMessage
PostThreadMessageA
PPPPhd
PPPPPPPP
P<PuWSV
ppxxxx
PQj WUS
PQQQQQ
\$ PQV
#pragma code_page(936)
PreviewPages
 (*.prn)|*.prn|
ProbeForRead
ProbeForWrite
Process32First
Process32Next
Program: 
<program name unknown>
P$RWPhP
P&|"}s+
PsLookupProcessByProcessId
~'PSQR
PtInRect
; ptisp=
PtVisible
- pure virtual function call
\$PVUUS
PWVWWW
,Py9c[L7
pZJKi7
q'6q:1
qE`iLG
`qJYL$
QLe/KK
QMq?Z!X
QPSWVR
QQSVW3
QQSVWd
QQSVWj
QQUWSS
QSUVWj
QSZU:|
QT"Y%l-
QX[gbL
r4c<1Q
RaiseException
R^CIHg
>Rc]W0m
`.rdata
ReadFile
RealizePalette
Rectangle
RectVisible
RedrawWindow
Referer: 
RegCloseKey
RegCreateKeyExA
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
RegOpenKeyExA
RegQueryValueA
RegSetValueExA
ReleaseCapture
ReleaseDC
ReleaseSemaphore
.reloc
RemovePlayer
RemovePropA
resource.h
responseBody
ResponseBody
RestoreDC
ResumeThread
RichEdit Text and Objects
Rich~EI
Rich Text Format
,r^Ks,
{rMe*w7
rocA9F
RoundRect
|$,RPQ
RQh<2M
RSbpS\O
RtlInitUnicodeString
RtlMoveMemory
RtlUnwind
runtime error 
Runtime Error!
RVim+~
RVPUSQ
+RY=@:
{s1Yc190J
s3s;3x
s{3:s8
+S5`	/
s733{sz83wp
s77737
s77737:s
S7EQ.~
s7w3{szw
{:{s{8
Saturday
SaveDC
SbpS0R
SbpS@b	gu
SbpS:g:
SbpS\O
ScaleViewportExtEx
ScaleWindowExtEx
SCh8BG+sU
ScreenToClient
ScrollWindowEx
:$'S~EI
SelectClipRgn
SelectObject
SelectPalette
SendDlgItemMessageA
SendMessageA
September
SetActiveWindow
SetBkColor
SetBkMode
SetCapture
SetClipboardData
Set-Cookie
Set-Cookie:
    Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
SetCurrentDirectoryA
SetCursor
SetCursorPos
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetFocus
SetForegroundWindow
SetHandleCount
SetLastError
SetMapMode
SetMenu
SetMenuItemBitmaps
SetParent
SetPolyFillMode
SetPropA
SetProxy
SetProxyCredentials
SetRect
SetRectEmpty
SetRequestHeader
SetROP2
SetScrollPos
SetScrollRange
SetStdHandle
SetStretchBltMode
SetTextColor
@SetTimeouts
SetTimer
Settings
SetUnhandledExceptionFilter
SetViewportExtEx
SetViewportOrgEx
SetWindowContextHelpId
SetWindowExtEx
SetWindowLongA
SetWindowOrgEx
SetWindowPos
SetWindowRgn
SetWindowsHookExA
SetWindowTextA
ShapeBox
Shell32.dll
SHELL32.dll
ShellExecuteA
Shell_NotifyIconA
\shell\open\command
Shift+F1
Shift+F10
Shift+F11
Shift+F12
Shift+F2
Shift+F3
Shift+F4
Shift+F5
Shift+F6
Shift+F7
Shift+F8
Shift+F9
shlwapi.dll
SHLWAPI.dll
ShowWindow
Silent
SING error
sk9Qc198R
SkinH_AdjustAero
SkinH_AdjustHSV
SkinH_Attach
SkinH_AttachEx
SkinH_AttachExt
SkinH_AttachRes
SkinH_AttachResEx
SkinH_Detach
SkinH_DetachEx
SkinH_EL.dll
SkinH_GetColor
SkinH_LockUpdate
SkinH_Map
SkinH_NineBlt
SkinH_SetAero
SkinH_SetBackColor
SkinH_SetFont
SkinH_SetFontEx
SkinH_SetForeColor
SkinH_SetMenuAlpha
SkinH_SetTitleMenuBar
SkinH_SetWindowAlpha
SkinH_SetWindowMovable
SkinH_VerifySign
SkP&\5NfQ
s`)L$4
sO;>|C;~
software
s$R?7Tp
ss77;73s{3s
SS@SSPVSS
_SSSSU
;s{sw;s
sszsss
sszszsx
StartDocA
StartPage
StartServiceA
StatusText
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
s]tgRm
StretchBlt
&string=
StrToIntExA
Sunday
SunMonTueWedThuFriSat
Super-EC
Super-EChttp://www.super-ec.cnhttp://www.eyybc.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php
SVWSQRV3
SWVVVRPV
System
SystemParametersInfoA
;sz3zw:{3s7
sz{zsz3s3z{ss7p
T$$_^]
T"+00[
T$0PjdR
T$0PQR
T$0SUV
@t4Ht1Ht_Ht
T$8QRP
T$8RWj
t$ 90t
t	9A8u
t	9p$u
t&9^$t
TabbedTextOutA
T$$+D$4
tD9_Pt?
T$dPQR
T$DPQRW
TdQB[>
T$DQRU
T$DQSR
T$DWRh
T$\;D$Xu
t(ENEN;
TenSafe.exe
TenSafe.exe_1
TenSafe.exe_2
TerminateProcess
TextOutA
T/f&Tcknx
TGkcnJ
<]t_G<-uA
Thfvz'
!This program cannot be run in DOS mode.
<th><label for="field_2new"><font color=red>CPU
t>Ht Ht
t*Ht"Ht
t+Ht$Ht
Thursday
T$H} VP
tI;Ftr
T$\jdSR
+tJHt:Ht*
TLOSS error
T$lPRh
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t$LUPh
T$LWUQVR
tM,1{4
tOdIQpm
tooltips_class32
T$pPQR
t$PPVS
T$(PQR
T$\PQR
T$PQRP
T$ PQWWR
T$$PRV
t$ PUSVV
tq9~Dt
tq9w(tlSj
tQPH,/
T$(QVURWP
TranslateAcceleratorA
TranslateMessage
TransparentBlt
tRHt}H
T$$RhX
T$,RQP
t%RSQP
t$$RVP
T$<RVW
tS9~@uN
T$ SRh
T$,SRh
t$(SSh
t#SSUP
T$ SWRP
t!< t	<
+ttHHtd
t.;t$$t(
t$t#t$l
Tuesday
T$\URP
t$$VSS
tvWWWWU
T$\WVR
t/WWUPj
TXPlatform.exe
 (*.txt)|*.txt|
T$XUSR
;t$Xu";\$\u
t*\xV&4M
t$XWVS
?u='@^
u._^][
u09=0dO
u29l$xu,
u"8D$yu
u]9B uX
u	9~@u
uA;5d{M
ue;=`fO
>:u#FV
uh9^8uX
[=u]i~
 U :km= 
- unable to initialize heap
- unable to open console device
- unexpected heap error
- unexpected multithread lock error
>:uNFV
UnhandledExceptionFilter
UnhookWindowsHookEx
UnlockFile
UnregisterClassA
UpdateWindow
uR9BxuM
uRFGHt
)us{1]cc1QcR1QcB1QZ91EZ
USER32
user32.dll
User32.dll
USER32.dll
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
)usk1ek
u$SShe
@u+;t$
\$(UVW
#uYlWw
V0+zN=-i
v.#7&O
v@8r-RU
ValidateRect
var g_iLoginUin = 
Variant
V%aU!M
VC20XC00U
V#D$,WPQ
-V,e9LC
VERSION.dll
VeTBR6
Vh;VX|
VirtualAlloc
VirtualFree
VirtualProtect
visible
Vj@>$R
VMProtect end
/[vN@v
VVUSVV
VVVPQR
\$<VW3
V@W@PQ
V,_^[Y
W42XZ$
W9^du-
WaitForMultipleObjects
WaitForSingleObject
waveOutClose
waveOutGetNumDevs
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
 (*.WAV;*.MID)|*.WAV;*.MID|WAV
 (*.WAV)|*.WAV|MIDI
WBn^]U
Wednesday
	WG!2S(
w%G]g&
WideCharToMultiByte
window
WindowFromPoint
windows
WinExec
WinHelpA
WinHttp.WinHttpRequest.5.1
wininet.dll
WININET.dll
WINMM.dll
WINSPOOL.DRV
|w(.j1F
WjdjdPQh
Wj(_Wj
wmK!t{
|$$}$WP
WqKPBv=D
(wqt\HHtS
WriteFile
WritePrivateProfileStringA
WriteProcessMemory
W\'s)@
WS2_32.dll
wsprintfA
WTWindow
|$@ Wu
WV2Gjb
;|wvQ|Y?4
"WWShH
wwwwww
	?wz;o
|$x=0r
+*]x7H
(;=XfO
xM?oD$
X%%)NJ:~=
x*O2CO
XPTPSW
+X@]}w
XY[Z[]
}\y&&%
Y;5D[M
YHYtLHt9
'YmqG2=
]y+qCs
Yw}nPu
YX[(W	
_^][YY
?/>z30
Z`6wTh(
z7773{;w
z7=x&3
}^zDF7
z;=\fO
ZL3aS5A^
~zLw=g
Z+<m+(
zn$}y'
Zt(Ht Ht
|z;^<}uWS
z@VKk|
~Zw`3Zt
ZXx;zU
\ZZ5"jh
<zzLJI