Analysis Date2014-09-09 05:40:27
MD5c609e9b829ce7c3ecdc72d5e5d2c2b70
SHA117415cbe6efc959cdd21c403e9790d2988c80fe0

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 5a86b934277df7771add8de7ce586f7a sha1: b1987bb462258be9462503ec431446c5ce17e64c size: 548864
Section.rdata md5: 31eefdf0d79c3da1eed6ab6088345f4f sha1: a8cb115d1dbb0817c66dd2f7eb7415b83b5be5f3 size: 1118208
Section.data md5: 2e974563281643d56729e95842004766 sha1: 163b9dbbd83f76bfa8441cd7dd3be934d4065127 size: 65536
Section.rsrc md5: 6d3ce65c0e2c0e0c02a5d3234ddb0e06 sha1: 14eaefdf7993a65067be326cfb62750e80a32b89 size: 40960
Timestamp2011-08-07 07:03:51
VersionLegalCopyright: 9173wg
FileVersion: 1.0.11.29
CompanyName: 9173wg
Comments: 9173wg
ProductName: 9173wg
ProductVersion: 1.0.11.29
FileDescription: www.9173wg.com
PackerMicrosoft Visual C++ v6.0
PEhashb436d2c02d75a5cf2637e6cd48af785eb861f569
IMPhash6f354268aac33fb5b22015b28df94245

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\logo[1].gif
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012014090920140910\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\9173wg[1].htm
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temp\3269_appcompat.txt
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Deletes FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013061320130614\index.dat
Deletes FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012013052720130603\index.dat
Creates ProcessC:\WINDOWS\system32\dwwin.exe -x -s 424
Creates ProcessC:\WINDOWS\system32\drwtsn32 -p 1228 -e 300 -g
Creates Mutex_!SHMSFTHISTORY!_
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexMSIMGSIZECacheMutex
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!mshist012014090920140910!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNS9173wg.com
Winsock DNS------.com
Winsock URLhttp://www.baidu.com

Process
↳ C:\WINDOWS\system32\dwwin.exe -x -s 424

Process
↳ C:\WINDOWS\system32\drwtsn32 -p 1228 -e 300 -g

Network Details:

DNS9173wg.com
Type: A
23.239.102.186
DNSwww.a.shifen.com
Type: A
180.76.3.151
DNSwww9.9173wg.com
Type: A
23.239.102.186
DNS------.com
Type: A
DNSwww.baidu.com
Type: A
HTTP GEThttp://9173wg.com/?
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://9173wg.com/logo.gif
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.baidu.com/
User-Agent: test
HTTP GEThttp://www9.9173wg.com/gf.txt?
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Flows TCP192.168.1.1:1032 ➝ 23.239.102.186:80
Flows TCP192.168.1.1:1033 ➝ 23.239.102.186:80
Flows TCP192.168.1.1:1034 ➝ 180.76.3.151:80
Flows TCP192.168.1.1:1035 ➝ 23.239.102.186:80

Raw Pcap
0x00000000 (00000)   47455420 2f3f2048 5454502f 312e310d   GET /? HTTP/1.1.
0x00000010 (00016)   0a416363 6570743a 202a2f2a 0d0a4163   .Accept: */*..Ac
0x00000020 (00032)   63657074 2d4c616e 67756167 653a2065   cept-Language: e
0x00000030 (00048)   6e2d7573 0d0a4163 63657074 2d456e63   n-us..Accept-Enc
0x00000040 (00064)   6f64696e 673a2067 7a69702c 20646566   oding: gzip, def
0x00000050 (00080)   6c617465 0d0a5573 65722d41 67656e74   late..User-Agent
0x00000060 (00096)   3a204d6f 7a696c6c 612f342e 30202863   : Mozilla/4.0 (c
0x00000070 (00112)   6f6d7061 7469626c 653b204d 53494520   ompatible; MSIE 
0x00000080 (00128)   362e303b 2057696e 646f7773 204e5420   6.0; Windows NT 
0x00000090 (00144)   352e313b 20535631 3b202e4e 45542043   5.1; SV1; .NET C
0x000000a0 (00160)   4c522032 2e302e35 30373237 290d0a48   LR 2.0.50727)..H
0x000000b0 (00176)   6f73743a 20393137 3377672e 636f6d0d   ost: 9173wg.com.
0x000000c0 (00192)   0a436f6e 6e656374 696f6e3a 204b6565   .Connection: Kee
0x000000d0 (00208)   702d416c 6976650d 0a0d0a              p-Alive....

0x00000000 (00000)   47455420 2f6c6f67 6f2e6769 66204854   GET /logo.gif HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a526566 65726572 3a206874   */*..Referer: ht
0x00000030 (00048)   74703a2f 2f393137 3377672e 636f6d2f   tp://9173wg.com/
0x00000040 (00064)   3f0d0a41 63636570 742d4c61 6e677561   ?..Accept-Langua
0x00000050 (00080)   67653a20 656e2d75 730d0a41 63636570   ge: en-us..Accep
0x00000060 (00096)   742d456e 636f6469 6e673a20 677a6970   t-Encoding: gzip
0x00000070 (00112)   2c206465 666c6174 650d0a55 7365722d   , deflate..User-
0x00000080 (00128)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000090 (00144)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x000000a0 (00160)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x000000b0 (00176)   73204e54 20352e31 3b205356 313b202e   s NT 5.1; SV1; .
0x000000c0 (00192)   4e455420 434c5220 322e302e 35303732   NET CLR 2.0.5072
0x000000d0 (00208)   37290d0a 486f7374 3a203931 37337767   7)..Host: 9173wg
0x000000e0 (00224)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x000000f0 (00240)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x00000100 (00256)                                         

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   55736572 2d416765 6e743a20 74657374   User-Agent: test
0x00000020 (00032)   0d0a486f 73743a20 7777772e 62616964   ..Host: www.baid
0x00000030 (00048)   752e636f 6d0d0a43 61636865 2d436f6e   u.com..Cache-Con
0x00000040 (00064)   74726f6c 3a206e6f 2d636163 68650d0a   trol: no-cache..
0x00000050 (00080)   0d0a3a20 656e2d75 730d0a41 63636570   ..: en-us..Accep
0x00000060 (00096)   742d456e 636f6469 6e673a20 677a6970   t-Encoding: gzip
0x00000070 (00112)   2c206465 666c6174 650d0a55 7365722d   , deflate..User-
0x00000080 (00128)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000090 (00144)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x000000a0 (00160)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x000000b0 (00176)   73204e54 20352e31 3b205356 313b202e   s NT 5.1; SV1; .
0x000000c0 (00192)   4e455420 434c5220 322e302e 35303732   NET CLR 2.0.5072
0x000000d0 (00208)   37290d0a 486f7374 3a203931 37337767   7)..Host: 9173wg
0x000000e0 (00224)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x000000f0 (00240)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x00000100 (00256)                                         

0x00000000 (00000)   47455420 2f67662e 7478743f 20485454   GET /gf.txt? HTT
0x00000010 (00016)   502f312e 310d0a55 7365722d 4167656e   P/1.1..User-Agen
0x00000020 (00032)   743a204d 6f7a696c 6c612f34 2e302028   t: Mozilla/4.0 (
0x00000030 (00048)   636f6d70 61746962 6c653b20 4d534945   compatible; MSIE
0x00000040 (00064)   20362e30 3b205769 6e646f77 73204e54    6.0; Windows NT
0x00000050 (00080)   20352e30 290d0a41 63636570 743a202a    5.0)..Accept: *
0x00000060 (00096)   2f2a0d0a 486f7374 3a207777 77392e39   /*..Host: www9.9
0x00000070 (00112)   31373377 672e636f 6d0d0a43 61636865   173wg.com..Cache
0x00000080 (00128)   2d436f6e 74726f6c 3a206e6f 2d636163   -Control: no-cac
0x00000090 (00144)   68650d0a 0d0a6d70 61746962 6c653b20   he....mpatible; 
0x000000a0 (00160)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x000000b0 (00176)   73204e54 20352e31 3b205356 313b202e   s NT 5.1; SV1; .
0x000000c0 (00192)   4e455420 434c5220 322e302e 35303732   NET CLR 2.0.5072
0x000000d0 (00208)   37290d0a 486f7374 3a203931 37337767   7)..Host: 9173wg
0x000000e0 (00224)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x000000f0 (00240)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x00000100 (00256)                                         


Strings
 
\
 
....  ................
"#
....
.........
10/.-,+*)('&%$#"! ..............
.....
..........
..
.........
-
..
x
\
==
...
.
 
..
--% BbmHpAadYySMI \
.-E-0-0..
00-+ 
e
 
00...........?-  
0
0 
0
?
...
H
=
    
 ......
 (*.*)
#####
#######
080404b0
080404B0
 %1 
1, 0, 0, 1
1.0.1.0
1.0.11.29
	1uM
9173wg
(&C)
(C) 2009
cfdami.com
Comments
CompanyName
	Ctrl+
	Ctrl+D
	Ctrl+End
	Ctrl+G
	Ctrl+Home
	Ctrl+N
	Ctrl+PageDown
	Ctrl+PageUp
	&D.
DEFAULT_ICON
 DLL 
(&E)
FileDescription
FileVersion
         (((((                  H
(&H)
hd37
hd37 imedllhost09
Hjjj
Hjjjh
Hjjjj
Hjjjjjjjj
(&I)
IEXT_IDB_STATEIMAGES
imedllhost09
imedllhost09.ime
 INI 
InternalName
jjjj
jjjjj
LegalCopyright
LegalTrademarks
msctls_progress32
msctls_updown32
MS Shell Dlg
(&N)
(null)
(&O)
OriginalFilename
(&P)
	PageDown
	PageUp
PrivateBuild
ProductName
ProductVersion
Progress1
 %s 
(&S)
	Shift+Tab
SpecialBuild
Spin1
StringFileInfo
(&T)
	Tab/Enter
TEXTINCLUDE
Translation
VarFileInfo
VS_VERSION_INFO
\v~v
Windows
www.9173wg.com
xxxx
^,_^][
^$_^[]
        
 (*.*)|*.*||
? ?$?(?,?
/+!@_#
\~\\~\
	!	!	!	!	
0/,'+)
0%&-:	
0(0.0:0J0Q0X0^0
0&0-040;0C0I0P0
=0,$0EwHj
0123456789ABCDEF
04<4H4T4`4l4
= =$=(=,=0=4=8=
> >'>,>0>4>Q>{>
0524sp3
05@yqn
(&07-034/)7 '
0807sp3
0807sp3.exe
@-0A`yP*
0dk:ghV
$(0eLbi
$*0eo}
_/0"H	
0h3n3u3
0%h]E:H
}0I-#[
#0i:7Nh3
0R>\W[
=0s/sp:
-}0+u&
}0U! `m-
0Wtyc|
0xa$sqY
	*0XP`:$
;0y4)h'=3
*]0z`]
<10[kT
1!11171Y1^1c1h1m1r1
1$1,141<1D1d1t1
1)161D1O1b1
12kA{lBH
,1"52.*
1.9K}0
1C`9yX/8
1-Co_u
"1F5F`~0AZu
1kMcm5
1p){!9
1P@d7&
1#QNAN
1#SNAN
1t.96n
1ujf(3
^1Uu^o
~2@(||
{2/ %]
}?20.t
2$252Q2_3
2?2D2L2
242I2_2f2p2v2~2
	2	5	5	5	5	5
27bb20fdd3e145e4bee3db39ddd6e64c
*2)A"M
2CEM+^I
<$<,<2<:<C<L<
%2\CLSID
2CUTFs(SO
%+.2d%.2d
%2\DocObject
2fu&bkC
2~H?h9
%2\Insertable
2i|?t8&"
%2\protocol\StdFileEditing\server
%2\protocol\StdFileEditing\verb\0
2q$gjZ
<~*}^!2:/s
2S2e2x2
2YcC?]w;
^'.3`|
3!4j4p4~4
]3	5;e
385<5`8h8l8p8t8x8|8
:):3:9:|:
3A3\3l3r3~3
-3AFy5*lM7
3	<cGJ
(/3D6Dp
3dH?x3f
3E3q8`P
&3E].7=_w
{3G	]s
3JDi`oz[
+3	~k@
\3MaIc
';}{3O
3)qE1%
3q,ry1
3}rZ%r
3Vpmzn1A
!}3w#fx
--3)xX
3Y_4vA
41`14k1
@41kPh{
41P!j5ho9
42474A4[4i4q4w4
4  4cU
4(5C5R5n5v5
4\6M"W
495%1oL
4-\Axy
:%:4:C:u:
4$h>6m
4iI.R4a
4II/;t'
!@4|I}TAf4
4N5;1"G
4r0m<&fyq4Ts0q<
\$4t|Ht@H
4V(i)QM
\$4VWh
4X!HEM
</_5=+		
|?5^<@
5	!	!	!	!
5014D8FA6DCA40b68FA626D8183666EB
5]{1Y_
52F260023059454187AF826A3C07AF2A
54;)rsup
	5	5	5
56ct\w
$57hIT
5)8~t/
;5<9}!
5@a?A	
5aHQ_xw
 	5!C!
=5=;=C=R=
[5}	e?
5	[FS=)
5HJe*I
5MTU"6
5-oAsy
5P01'G
5P x/Q~
5Qa.sL
5rxNPi
}5:&u8
5UAd	JmV
5WXW~y
[5z&*	t
61ma Wi
@<62L"
646Q6i6
6;5PoZ
6.636B6H6X6c6u6
	6	6	6	6
	6	6	6	6	6	6	6	6	6	6	,	,	,	,	,	,	,	,	+	+	+	+	+	/	/	/	'	'	'	'	'	'	'	'	'	'	(	(	(	(	(	(	(	(	(	(	(	(	(	
6 6(6-696>6[6a6
678)QA
6&a 1!
6a:S{4
#6!(B9
6e	nEC
)+6hKH+
6H	Mr*Cj
6j2	DL
:6lhD$
.6nwE@
6N$>xy
6)+SOJ*
<%<6<x<
6y"G9k}
	6ZX2+
7|0% 3]w$
707ca37322474f6ca841f0e224f4b620
>7|`2!
 76$AE
	7	7	7	7	7	7	7	7	7	7	7	*	*	-	-	-	-
7"7*7H7N7_7v7
;79D[U
/	7ci3
7	cK]b)
7d}%0#
	7}d>?L
7H#2)h
{{7I`Ck
#7jvG-
-|7kNh
7L_)T`B
[7)=]m
7npLq:
7N 	x>k
7PU(Q.XE
7Q7](q
}7u>|v#'
|7YS{E
?:('_[8
81888J8R8b8s8
.!8@5I
8	9*9?9c9
89=T<^
@8AG~	
-8A#yH*
8	b"ish
8C8I8k8
:!:(:.:8:>:C:I:Y:b:|:
8gv8:~
8H%C%.
.8-i1F
[8iVjs'	
`8IZKL
8)"KV$
>8L )A
8*\MpI
8MThdu
<8O&*h
8oh?	sE
8o	U!:
@ 8{P@(
:8;P;W;_;d;h;l;
8Q+- JB
8_:r2~
\$8UVW
8VkDc`
]~8WY9
8[x+_I
8+XkyO
=8=@=Z=f=v=
90cNp+
9^0u/j
     9173wg.com..      
 9173wg.com..
9173wg.com/?
91Qf5FU^
{	93?>
^}%95D
95L9[Y!
^}%95 OZ
%9, %8
98GCng
9 9$9(9,9094989<9@9D9P9
9:9@9a9k9v9{9
9&9N9i9q9w9}9
9[9oee
9aL[15
'9A`u"9
9C6Y!=
9ct}!@
9dk~i$
9D$$t+
9E?BK/
9Eig3poa_7;@I
9G4_^d
)/9hQ]w
9^Ht}3
=""9i"9
9)IEMY!
 9iRHrv
9k07%	rN
_9=l<^
9L$x~e
9l$xtU9
_9	%Moq
9nPu	9^T
9o4u'V
	9oTtc
9!|Pk/
]9Q\	tr
	9<;+r
9S9d33
_;9\S	*@R
9~@St99~8~
_9=`T^
9t$0v8
9^@t53
9u ^t	
)]9vA9
';9v]?y\
_9W t 
9^xu5j
9x u	f
9yA9$'
9-]yciiP
9YDwNE5y
+!a#. _
A1^8g*
a-1AAy
a\&20,
<A|2<Z
%!<a3\
A?_3'm		
A$3wXYvS~
a4MYqiK
-a_.4Ndnv
a+4NtUq4
a!% 4z/
A512548E76954B6E92C21055517615B0
`A5Po~
A9B9*Xy
A$9{Ti
	.A9^w
a-=AIy)*
A-]A}y
abcddefghijklmnoopqrrsstuvvwwxyyz;
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
ab CL-
abnormal program termination
aC8 ?e'
Accept: */*
Accept: */* 
ActivateKeyboardLayout
AdA4iP
%a, %d %b %Y %H:%M:%S 
AdjustWindowRectEx
Advapi32.dll
ADVAPI32.dll
AeyM*%
AfxControlBar42s
AfxFrameOrView42s
AfxMDIFrame42s
AfxOldWndProc423
AfxOleControl42s
AfxWnd42s
Afx:%x:%x
Afx:%x:%x:%x:%x:%x
a|Gh7;
|agL	q
Ag|;,W
a-h[]9{
aHAf.2
A	IL+>
A#I	<Z
AK9(1xi
&Akx}C
aKY(Qx
A;LMLy
AlyL*,M
-&A*^m
)!a`MI#h
aMm#L?
#<aNXj
A;ny	9
 {A	;P
ap<a8<
!a}PMA
AppendMenuA
!a@	qh
\arV=)
	/~Ato
aTz87l@%
.?AUCThreadData@@
A]u,G?4z`IA
August
.?AUIBoundObjectSite@@
.?AUIDispatch@@
.?AUIEnumVOID@@
.?AUIMessageFilter@@
.?AUINotifyDBEvents@@
.?AUIOleClientSite@@
.?AUIOleContainer@@
.?AUIOleControlSite@@
.?AUIOleInPlaceFrame@@
.?AUIOleInPlaceSite@@
.?AUIOleInPlaceUIWindow@@
.?AUIOleWindow@@
.?AUIParseDisplayName@@
.?AUIPropertyNotifySink@@
.?AUIRowsetNotify@@
.?AUISequentialStream@@
.?AUIStream@@
.?AUIUnknown@@
.?AV_AFX_BASE_MODULE_STATE@@
.?AV_AFX_CHECKLIST_STATE@@
.?AV_AFX_COLOR_STATE@@
.?AV_AFX_CTL3D_STATE@@
.?AV_AFX_CTL3D_THREAD@@
.?AVAFX_MODULE_STATE@@
.?AVAFX_MODULE_THREAD_STATE@@
.?AV_AFX_OLE_STATE@@
.?AV_AFX_SOCK_STATE@@
.?AV_AFX_THREAD_STATE@@
.?AV_AFX_WIN_STATE@@
.?AVCArchiveException@@
.?AVCArchiveStream@@
.?AVCBitmap@@
.?AVCBrush@@
.?AVCButton@@
.?AVCByteArray@@
.?AVCClientDC@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCColorDialog@@
.?AVCComboBox@@
.?AVCCommonDialog@@
.?AVCCriticalSection@@
.?AVCDataSourceControl@@
.?AVCDC@@
.?AVCDialog@@
.?AVCDWordArray@@
.?AVCEdit@@
.?AVCEnumArray@@
.?AVCEnumUnknown@@
.?AVCException@@
.?AVCFile@@
.?AVCFileDialog@@
.?AVCFileException@@
.?AVCFont@@
.?AVCGdiObject@@
.?AVCHandleMap@@
.?AVCImageList@@
.?AVCMapPtrToPtr@@
.?AVCMapStringToPtr@@
.?AVCMemFile@@
.?AVCMemoryException@@
.?AVCMenu@@
.?AVCNoTrackObject@@
.?AVCNotSupportedException@@
.?AVCObject@@
.?AVCOccManager@@
.?AVCOleBusyDialog@@
.?AVCOleControlContainer@@
.?AVCOleControlSite@@
.?AVCOleDialog@@
.?AVCOleDispatchException@@
.?AVCOleException@@
.?AVCOleMessageFilter@@
.?AVCPaintDC@@
.?AVCPen@@
.?AVCProgressCtrl@@
.?AVCPtrArray@@
.?AVCPtrList@@
.?AVCResourceException@@
.?AVCRgn@@
.?AVCSessionMapPtrToPtr@@
.?AVCSharedFile@@
.?AVCSimpleException@@
.?AVCStatic@@
.?AVCStringArray@@
.?AVCSyncObject@@
.?AVCTempDC@@
.?AVCTempGdiObject@@
.?AVCTempImageList@@
.?AVCTempMenu@@
.?AVCTempWnd@@
.?AVCTestCmdUI@@
.?AVCToolTipCtrl@@
.?AVCUserException@@
.?AVCWinApp@@
.?AVCWindowDC@@
.?AVCWinThread@@
.?AVCWnd@@
.?AVCWordArray@@
aV#^d4
.?AVtype_info@@
a\v\'v
.?AVXAmbientProps@COleControlSite@@
.?AVXBoundObjectSite@COleControlSite@@
.?AVXEnumVOID@CEnumArray@@
.?AVXEventSink@COleControlSite@@
.?AVXMessageFilter@COleMessageFilter@@
.?AVXNotifyDBEvents@COleControlSite@@
.?AVXOleClientSite@COleControlSite@@
.?AVXOleContainer@COleControlContainer@@
.?AVXOleControlSite@COleControlSite@@
.?AVXOleIPFrame@COleControlContainer@@
.?AVXOleIPSite@COleControlSite@@
.?AVXPropertyNotifySink@COleControlSite@@
.?AVXRowsetNotify@COleControlSite@@
?~aW>3i
a_x1K5
&@aXbk
AX?.J8F
-+A!y/*
@-^A y\*
Ay	C&Z
A yJ*6M
A+y!*/M
Ay]*}M
}^AYMV'l
A yMy5s
A|yP*4M
A-yP*IMX
^aY,@q
<A|@<Z
B 02CV
)~!B0+m
b0VP^5
?B;5Q=
B9Z tK
?Bbn2	:
bcdfghijklmnpqrstuvwxyz
bd7H|.	
|Bd7N,7
BeginPaint
BeginPath
"@>)bf<HA
;B<H<L<P<T<
B+H,QU
B>	+I}
BitBlt
BiULJiI
b,~iU_v
bi+%'xj
BKbhTb~XBK!;
B,Kr-"
[bL 4,;
Bl-!U#>	r_
 (*.BMP)|*.BMP|GIF
Bogus message code %d
B:O^N?y
b	p2x3
b& `;Pa\
BRPj+S
bToE9)v
&B>!!T |TG9p
":BX}+
bX		1A-
B/>xZ2
BZFQ!j
C =02CVu
?\c0>jw5
C1-_e:
|C3!M;
[%]C73
CallNextHookEx
CallWindowProcA
CandWndProc
Caption
CArchiveException
-CAwyE*
CBitmap
+_@c<Bq
CBrush
CButton
CByteArray
cCg/A 
CcJ8y)
CClientDC
CCmdTarget
CColorDialog
CColourPicker
CComboBox
CCriticalSection
Cc: %s
CDialog
CDWordArray
"ceM&6
CEq.R	
CException
cfhuoyan@qq.com
CFileDialog
CFileException
CGdiObject
CharNextA
CharUpperA
CheckMenuItem
ChildWindowFromPointEx
%c/h]:L
ChooseColorA
ci(~>0!
CImageList
c:j8KD
CkK!;QC
ck"!M0/B
ck(WSbpS
ClientToScreen
CloseClipboard
CloseDatabase
CloseHandle
ClosePrinter
CLSID\%1
CLSID\%1\AuxUserType\2
CLSID\%1\AuxUserType\3
CLSID\%1\DefaultExtension
CLSID\%1\DefaultIcon
CLSID\%1\DocObject
CLSID\%1\InprocHandler32
CLSID\%1\InProcServer32
CLSID\%1\Insertable
CLSID\%1\LocalServer32
CLSID\%1\MiscStatus
CLSID\%1\Printable
CLSID\%1\ProgID
CLSID\%1\Verb\0
CLSID\%1\Verb\1
CLSIDFromProgID
CLSIDFromString
CMapPtrToPtr
CMapStringToPtr
CMemFile
CMemoryException
cM$o{5q
+c:nEl
CNotSupportedException
CObject
CoCreateInstance
CoFreeUnusedLibraries
CoGetClassObject
COleBusyDialog
COleDialog
COleDispatchException
COleException
CombineRgn
combobox
ComboBox
COMBOBOX
COMCTL32.dll
COMCTL32.DLL
comdlg32.dll
commctrl_DragListMsg
commdlg_ColorOK
commdlg_FileNameOK
commdlg_help
commdlg_LBSelChangedNotify
commdlg_SetRGBColor
commdlg_ShareViolation
CompareStringA
CompareStringW
CompWndProc
Content-Transfer-Encoding: base64
Content-type: multipart/mixed; boundary="#BOUNDARY#"
Content-type: text/plain; charset="
CopyAcceleratorTableA
CopyRect
CoRegisterMessageFilter
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CPaintDC
CPalette
CProgressCtrl
CPtrArray
CPtrList
}Cq1gf:
CreateAcceleratorTableA
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDialogIndirectParamA
CreateDIBitmap
CreateDIBSection
CreateEllipticRgn
CreateEventA
CreateFileA
CreateFontA
CreateFontIndirectA
CreateIconFromResource
CreateIconFromResourceEx
CreateILockBytesOnHGlobal
CreateMenu
CreatePalette
CreatePen
CreatePolygonRgn
CreatePopupMenu
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSemaphoreA
CreateSolidBrush
CreateThread
CreateToolhelp32Snapshot
CreateWindowExA
CResourceException
CrossFire
crossfire.exe
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
CSharedFile
CStatic
CStringArray
CSyncObject
CTempDC
CTempGdiObject
CTempImageList
CTempMenu
CTempWnd
CToolTipCtrl
Ctrl+A
Ctrl+B
Ctrl+C
Ctrl+D
Ctrl+E
Ctrl+F
Ctrl+F1
Ctrl+F10
Ctrl+F11
Ctrl+F12
Ctrl+F2
Ctrl+F3
Ctrl+F4
Ctrl+F5
Ctrl+F6
Ctrl+F7
Ctrl+F8
Ctrl+F9
Ctrl+G
Ctrl+H
Ctrl+I
Ctrl+J
Ctrl+K
Ctrl+L
Ctrl+M
Ctrl+N
Ctrl+O
Ctrl+P
Ctrl+Q
Ctrl+R
Ctrl+S
Ctrl+Shift+F1
Ctrl+Shift+F10
Ctrl+Shift+F11
Ctrl+Shift+F12
Ctrl+Shift+F2
Ctrl+Shift+F3
Ctrl+Shift+F4
Ctrl+Shift+F5
Ctrl+Shift+F6
Ctrl+Shift+F7
Ctrl+Shift+F8
Ctrl+Shift+F9
Ctrl+T
Ctrl+U
Ctrl+V
Ctrl+W
Ctrl+X
Ctrl+Y
Ctrl+Z
CUg%0q
 (*.CUR)|*.CUR|
CUserException
CWinApp
CWindowDC
C:\Windows\System32\Drivers\etc\hostshttp://www.super-ec.cnhttp://wghai.com/echttp://qsyou.com/echttp://www.wghai.comhttp://bbs.wghai.com/forum-17-1.html/forum-12-1.html/memcp.php/ip.asp/time.asp/ec-user5.phphttp://down.wghai.com/up/super-ec/
CWinFormUnit
CWinThread
CWordArray
CYdzv%
/C]yIYZiQ5
Cz	bBT
?? / %d]
D$ _^][
D$,_^]
D$,;\$|
D$(_^]
D$(_^][
D$$_^[
D$$_^]
d09f2340818511d396f6aaf844c7e325
D$0SUV
D$0UVW
D$0WPQ
D$ |2;
d_2GW{
D$49D$$}
D6Sn	a&e
}/D7n	
D$89Vdu
D$8FtdW
D$8QRPh
D$8RPj
D$8UPj
D$8VPQ
D$$~9+
~d.a'J!
@.data
Date: %s
d?a	wb
&>	db\TZ2J
DcHFm<
D$(CUSWP
 %d/%d 
(%d-%d):
%d / %d
%d / %d]
dddd, MMMM dd, yyyy
D$dPQV
D$dQUWRP
D$dSUVW
D$DSWRPQ
D$DURP
de9I'R
December
DEFAULT_ICON
#define _AFX_NO_OLE_RESOURCES
#define _AFX_NO_PROPERTY_RESOURCES
#define _AFX_NO_SPLITTER_RESOURCES
#define _AFX_NO_TRACKER_RESOURCES
DefWindowProcA
DELETE
DeleteCriticalSection
DeleteDC
DeleteFileA
DeleteMenu
DeleteObject
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
de=uk"
device
devices
DeYr3FT
D$H_^][
Dhdl6B1"
D$hQRP
D$hRPQ
D$hSUV3
D$hUPQ
D$HUPQ
D$HUSj
"?d+*i
Dim cpuSet,cpu
disable
DispatchMessageA
DISPLAY
?d%kGlN
DK|Vo<	
	(d}L	
D$(;l$ 
#Dl,F	
DLLISUI
DllRegisterServer
DllUnregisterServer
d=	lN\
D$LPUj
D$LUSWP
DocumentPropertiesA
DOMAIN error
/down.htmlt
dP !Huj
D$,Pj<j
D$ PQR
D$PQRP
D$PRPQ
D`^PT(d:H(
DPtoLP
D$(QPW
D$(QRP
D$$QUP
 DQWPh
DragAcceptFiles
DragFinish
DragQueryFileA
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawTextA
DriverBox
D$@RPQj
D$ RPUhD
D$,RVh
D$,SPh
D$(SUV
D$$SUV
D$(t,;
D$TRPW
D$TVPW
/)D~u$
dU,%&G
DuplicateHandle
D$@UPQ
|$D UV
D$$VPj
@dVRl 
DW'JFC
dWM:CH
D$@WPS
Dw=|:s
D$$=XmX
D$XPQU
D$XQRWP
D$XSUV
;D$xt&
*D)XWP;q
D$\$ Z
;}"E(/
e+1I=&
E<1`Uo
e2Y{%|
E]3=e|am
e%@3US%(-
e|9}u4r3
E'9+%y
){ea<+
-eAMy%
EBTWh!
ech1Y%
E~~C~TRcc
&Edit,0,2
eGmL97h
EHPWVS
e	Hq[rC
eI+C$l
[=e	Im
 ejwoiagtujw0tu-43w09ugjopsmdz/vm,.d/mvkls;ajgoi[hopwehgioerjgbkldfvnklfdamvkld/amgb;elhuj3894yhu-34890yug0wejgklsda;mvkdsmvkldamhl;erhrthjrt
<$eKO8L
Ellipse
Embedded Object
Embed Source
EmptyClipboard
emrV	o
e[mUIY
En#'3h
EnableMenuItem
EnableWindow
EndDialog
EndDoc
end Function<th><label for="field_1new"><font color=red>USB
#endif
#endif //_WIN32
EndPage
EndPaint
EndPath
EnterCriticalSection
EnumDisplayMonitors
EnumDisplaySettingsA
E^o'	}9
eOc*axo
eQpenc
e'Q^r;iSu
EqualRect
Escape
ESGU#IX
E''ULV
ewr'_]
E*'$'x
E|X6i`I
ExcludeClipRect
e%<X{G
      exit for
ExitProcess
ExpandEnvironmentStringsA
(eX`|Q1
#`exQe
ExtCreateRegion
ExtSelectClipRgn
ExtTextOutA
Ey7KxKMD
F<_^][
F,_^][
F\_^][
F09^4u*j
      F11
                F12 
F36590D517C9760A59BDDCBF219ECA11
F49^8u&j
      F5 
      F6 
F6	d\f:
      F7 
F7FC1AE45C5C4758AF03EF19F18A395D
-f7jMdI
      F8 
F89^8u&j
F8+N,+F0
F(9V8tQ
fAyEF	
Fb7*'h
#f BKq;
F</bmS
FD@ul9L$(}f
FD uy9D$$}s
February
  fewakgiewug904u-9403ujgosdvkldsmv,.ds/amv,./sajgwe[jgiow[ugy04[hgioerjgkfdlsfkdlsmhbkljhoihygo9phyg9pwehg9ovhewiaoH
F(_+F$^[;E
?fff&ff23
ffffff
ffffff`
fffffffff
fffffffffffhwww
fffffffffffo
fffffffffo
ffffff`ffo
fffffffh
F$@;F(v
F$@@;F(v
`{Fgi	
*!&FgY
File corrupted!. This program has been manipulated and maybe
FileName
FileNameW
FileTimeToLocalFileTime
FileTimeToSystemTime
FillRect
FillRgn
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FindWindowA
\fI;nhI^
F\jLSP
"FjlZ^
fJU\*	=
- floating point not loaded
FlushFileBuffers
FO >*4+
foffffff
</font></label></th>
FontSize
    For Each cpu In cpuSet
FormatMessageA
FpHt&Ht
FQdYL=H
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
Friday
From: %s
f&#RVb
[/fS_MR
!ft	eO
-;'FWa
f;w]E(A
Fxt_;FTu@
([Fy'/
	\>,G*
#!G{8!
?	G9cy
GAIsProcessorFeaturePresent
gAn#[rp
g~b1Y%
gb2312
=?gb2312?B?
GB:L&\
<\GBO|
gBtL1UJU
#gCU	c
Gdi32.dll
GDI32.dll
g|]{em	
GetACP
GetActiveWindow
GetAsyncKeyState
GetBkColor
GetBkMode
GetCapture
GetClassInfoA
GetClassLongA
GetClassNameA
GetClientRect
GetClipboardData
GetClipBox
GetClipRgn
GetCommandLineA
GetConnectString
GetCPInfo
      getcpuid=cpu.ProcessorId
GetCurrentDirectoryA
GetCurrentObject
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetCursorPos
GetDesktopWindow
GetDeviceCaps
GetDIBits
GetDlgCtrlID
GetDlgItem
GetDriveTypeA
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetFileAttributesA
GetFileSize
GetFileTime
GetFileTitleA
GetFileType
GetFocus
GetForegroundWindow
GetFullPathNameA
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardLayoutNameA
GetKeyState
GetLastActivePopup
GetLastError
GetLocalTime
GetLogicalDriveStringsA
GetMapMode
GetMenu
GetMenuCheckMarkDimensions
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMessageA
GetMessagePos
GetMessageTime
GetModuleFileNameA
GetModuleHandleA
GetMonitorInfoA
GetNextDlgGroupItem
GetNextDlgTabItem
GetObjectA
GetOEMCP
GetOpenFileNameA
GetParent
GetPixel
GetPolyFillMode
GetProcAddress
GetProcessHeap
GetProcessVersion
GetProfileStringA
GetPropA
GetROP2
GetSaveFileNameA
GetScrollPos
GetScrollRange
GetStartupInfoA
GetStdHandle
GetStockObject
GetStretchBltMode
GetStringTypeA
GetStringTypeW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemDirectoryA
GetSystemMenu
GetSystemMetrics
GetSystemPaletteEntries
GetSystemTime
GetTabList
GetTempPathA
GetTextColor
GetTextExtentPoint32A
GetTextMetricsA
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetTopWindow
GetUserDefaultLCID
GetVersion
GetVersionExA
GetViewportExtEx
GetViewportOrgEx
GetVolumeInformationA
GetWindow
GetWindowDC
GetWindowExtEx
GetWindowLongA
GetWindowOrgEx
GetWindowPlacement
GetWindowRect
GetWindowsDirectoryA
GetWindowTextA
GetWindowTextLengthA
GetWindowThreadProcessId
GG*9E@
gg&y!S
 (*.GIF)|*.GIF|
@G&J"a+M
          g    jkdla;sugtioewag;jmdz/.v,.x/zmv,.c/xzm,/fewjaioptuifjkldsk'fa58032=8q90
G*K.#M
^"'GLa
(GLNHE
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalHandle
__GLOBAL_HEAP_SELECTED
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
gm(+1!zg
G@.%MV
(G$(qju
	_Gqt}
GrayStringA
grKm0B
G'RV	x/
Gs vv:;
G;=`T^
G+THX[U
g>uL+8
guLc	vbrn\
_`]Gw	j
gwsy.QD/(
:#;);G;X;k;
GXKn'iF
)GX<O@)
GYqEVy
GyT`	-s
`h````
	H	;@]
)%H0mc
&H?8#	
h%88j%
H8qs%HC
 H/8!uPy
?h8"XX|
h9n`u;
	HaoG<
,HB>[jd
h*|BJM
h,^c	#<;
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
height
h/ESLa
h^}EY,
hFhy{e
hgjlkbrfzaoe
HHtiHtGH
HHtpHHtl
H^/Ik)P
HJ97CykP
hji[v~
/-^h.K,U
$]hKy9p
)HL<#* z.
h]{?mA
Hma}j|
HMigGG
H:mm:ss
HnH2hty
<$h@OK
.?Hp3L 
hP!ls1
[	{HpM
]+H$Q"
hq(%f;a
HR4%CJ
}h;R7x&)B@G
HrCg@b	g(
"<hsl:a
HSVHWtgHHtF
Ht#HHt
HtHHt(
HtHHuz
 (*.htm;*.html)|*.htm;*.html
HtmlViewer
HtOHt)H
HtTHtFHt8Ht*Ht
HTTP/1.0
http://9173wg.com/?
http://------.com/?/
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
http://www9.9173wg.com/gf.txt?
http://www.baidu.com
http://www.baidu.com/s?wd=www.9173wg.com&rsv_bp=0&inputT=5734???:
 http://www.super-ec.cn
HtYHt6H
H!@vMc4
hvQ, Ah
HVt}lk
Hv@z8FHh
hWj@_;
_h;	Wy7
H,@x!h
hYGiL#h
hYJmE]H3
HyperLinker
_hypot
#)<(hz!pR
HzQGk%6
HZX>!O
I0`AI 
i1_W7Q
\[I>	39r5`G
.>#i3MVV
i3YqW[
-+\ i4
 I^56Qx
I:5I(7
i|80s}
I)8V&i
I-9Ep;J7
I9k=5;;
(<,I9V
i-AAIy
*{IaV>
=-IA)y
`ic>{!
i-cA]y
 (*.ICO)|*.ICO|
?icwy)|7
iC[yT9(
iexplore.exe
#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)
#ifdef _WIN32
Ii?" 	
"ii0`B
#ii0iB9*
II CLUr
iIy'yA
I|IZ/'<
IJXO-h
&!\ikaRh7w
]I`kG	
IKx)VP
ILb 8TH0Iz
il@I3(FL
-i<L)LI
imab9:
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
iMa+Y)
.ime.bak
IMEClearPubString
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
imehost.dll
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
IMESetPubString
@IMESetPubString
ImeToAsciiEx
ImeUnregisterWord
imm32.dll
IMM32.dll
I{mm]E#
ImmGetDescriptionA
ImmInstallIMEA
ImmLockIMC
ImmUnlockIMC
IMrYB0J
i,nawMY
#include "afxres.h"
#include "l.chs\afxres.rc"          // Standard components
InflateRect
InitCommonControlsEx
InitializeCriticalSection
<input type="text" name="field_1new" size="25" value="" disabled class="txt" />"  class="txt" />
<input type="text" name="field_2new" size="25" value="" disabled class="txt" />"  class="txt" />Function Getcpuid() 
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
InternetCanonicalizeUrlA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetSetOptionA
IntersectRect
InvalidateRect
&ip;h<A
iphlpapi.dll
+.?Iq/
IQh\.Z
`ir0euHX
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
It#Iu%
it's infected by a Virus or cracked. This file won't work anymore.
	i{Ugywsv	}
IUK,gs
I(![UQC
Ivm\p	
/[[Ix!@[
ixQ*9O)V
iX^wEJp
izUpi_
\$\}-j
.J82d^
JanFebMarAprMayJunJulAugSepOctNovDec
January
Jaq_-wA
J`b	W=
jBWVSSQ
j-\Czo
[_,]jE
J	FH=WF
,JF>nbh
jI*1fz
,J|M5 
jMBG!O
_jMuQ7
JPEGMEM
 (*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
 (*.JPG)|*.JPG|BMP
Jq_-_Rm'
jsO	h[
J>Uf).
J`Urv]
)j_Uy~
j VUPWQ
JWkM1~
;JXB_F
Jx(*|@I
Jy|S;i
~#_,jzf
$Jzn=i
=j^zTWn
K+#)!@
}K0ajO\
K0(Ht@/V
K3}aVx
K4k1I4
K])4Ki
%k5[!<
	K6z-w
k8]	2s{
 ~k=C?
kD9&S!
+KDC7'(l
kd&i)o	HC7
KERNEL32
Kernel32.dll
KERNEL32.dll
Keyboard Layout
Keyboard Layout\Preload
\K?-FK5
kG2",9k_
*+]K?H>
K+i`]4xP
kiChIi
KillTimer
K/IlQA
Kiq6P?3
kkm'3/:a
&Kk+Q 7l1
k*+KVW
`KlI9$9
kOCg	u
)kopA<
)/K,ouMJ
KS	Dz<Z
KTKdK4KDUypL
K	tkuU8
Ktll"uk
/K't!$Y
kXEQ>\u
kxI+*f
]K{XiM
KXkp5s|
K*XO>(
Kx{O}C1P
kX!WeI
K.X	XZ
k Y0&'
k]\zE5
K|z!{yA
^l_^][
;l$ }:
L$ ]_^
L$$_^]
L$0PQR
L$0PQS
L$0SUV@W
L23fff&ff
L$,_^]3
L$,_[3
l3?m0oM
L$4_^3
L$4_^[d
L$4S+L$0Qj
L$4UQWP
L$4VQUP
L$4WPQR
L$4WQUVS
*L-6bP
L$8^]_3
L$8_^[d
L$8_^][d
L$8WPQR
l	$~ae
lAm(mAo(
LANGUAGE 4, 2
LCMapStringA
LCMapStringW
L$`_^][d
L$<^[_]d
L$|_^][d
L$ ^][d
L$ _^d
L$ _^][d
L$,_^][d
L$(_^][d
L$@^[d
L$@^]d
L$@_^][d
L$$^[d
L$$^]d
L$$_^d
L$$_^]d
L$$_^][d
L$\_^][d
L$d_^][d
L$D_^[d
L$D_^][d
L$D_]d
L$DPQj
L$DSVQ
LeaveCriticalSection
L	ei,7
=/)L`G
l	g~b0R 
l	g~b0Rdk
L#/,gp
L$@h,0Z
L$h_^]3
L$h_^][d
L$H_^][d
L$H][d
-lH((E_H
L$Hj&Q
l$HQRVU
L$HSUVWP
+:lHVwdS
LineTo
Link Source
Link Source Descriptor
 liuwP8
;_lIv)
lkAY?.
L$L_^]3
l-LA,y
L$l_^][d
L$L^[d
L$L_^][d
	LLLLLK
L$LPQR
LL+![q
L$lRVQ
!	lLv?
	l^n0N,
#L O?/7
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadKeyboardLayoutA
LoadLibraryA
LoadResource
LoadStringA
LocalAlloc
LocalFree
LocalReAlloc
LockFile
LockResource
+ LOOP 
L$P_^d
L$P_]^[d
L\PdkF
l-PETk
}L<pHo
L_;/PMJ
L$ PQh
L$<PQR
L$(PQR
L$@PQR
L$<PQVV
L$pRPQ
LPtoDP
L$(PVQ
l|q 7x
lqqX	(l
L$ QSR
L$,RPQ
L$(RPQ
L$<RPQW
L$@RQj
L$@RUQ
L$<SQR
L$`SQV
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpyn
lstrcpynA
lstrlenA
lstrlenW
L$,SUV
L$(SUV
Ls%ZVN_5
L$T_^]
L-TC+(
L$t_^d
L$t][d
L$T_^]d
L$T_^][d
|$LtE;
L$TSWQ
lu5 i0w
	luhp'w
L$(UUh
\$lUV3
luz	7V
lV1R_7~
l>Vh/e
L$(VQRSP
L$(VQVj
l$@VW3
l$<VWj
L$ WPQ
L$(WQR
L$(WSR
L$x_^3
L$X_^]3
L$x_^d
L$x_^][d
L$X_^d
L$X;L$
L$XSQh
."L@yt
@;l$\~Z
_M(1[4
m;1e_uG
M%5D\7
[M5Z3+=
-MA1ye*
mailto:
MapDialogRect
MapViewOfFile
MapWindowPoints
 -MA(yO*
)M(!>+c!*
M/d/yy
 MEg}9
MessageBeep
MessageBoxA
-m+g!=
MGridCells
M~G	U6
mgUXxJ
\MH!;:+
mHe(K&
mH;uW(2
Microsoft Visual C++ Runtime Library
midiOutPrepareHeader
midiOutReset
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamProperty
midiStreamRestart
midiStreamStop
 (*.MID)|*.MID|
MIME-Version: 1.0
MiX9NP
mJ9iH5
*mjc9IQeF
MKp_?r@
%(mL	HC
M;LQ(;
M	,M9K+M
[$M"o9
ModifyMenuA
Module32First
Monday
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MousePointer
MoveFileA
MoveToEx
MoveWindow
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mpr.dll
MPR.dll
>m='@q
MS Sans Serif
MS Shell Dlg
__MSVCRT_HEAP_SELECT
=~m;?tAC
=;=m=t=x=|=
%mTYA5
{MTy-_yE
MulDiv
MultiByteToWideChar
MX)/PMg%*
?[Mydw
mysechx
M[z,->%
n0SSSSU
n[1%.Q5D!
n21.-!y
N2dX95
N8+F,+N0
n9&[*?
"@nAT`
Native
n`AY~#
-NbkSbpS
-NbkSbpS(
{N!@cy
nd9~dt
    Next
[n	FaM
N/f@b	g
NF:xH"
NH_^][
NHb|an	
$nH%K1i
Nh;NX|
NIIH)-W
,Nj`4V
N|k!9?
NL	VX\lB&
-N"N1Y
N*Ncktepe
N(;N,r
N*Ntepe
N*N(W%
N*N(W0
- not enough space for arguments
- not enough space for environment
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
NotifyIME
November
nt2Ht#Ht
NTRPQj
~N<(|u
)n	~ULg
(null)
N$~	WU
NX9NXu 
Nyg2	aDf
n\yJ)8h
Nyt2S	W	w	w
nzzpenc
`+.o.%&
>-!_O!
O(_^][
o0SSSSU
o18>;Bip
{O(	;4gXc
-O6gi!y
O?*7xk
%O=8aJ
`oAhMZ
Object Descriptor
ObjectLink
]O\Bu|
October
oE|hX_
offffff
Offline
OffsetRect
OffsetViewportOrgEx
OGtx&|
OH+:-	j
oIQ@9-
OI*YxQ
OK$kIA
ole32.dll
OLEAUT32.dll
oledlg.dll
OleFlushClipboard
OleInitialize
OleIsCurrentClipboard
OleRun
OleUninitialize
O+MA/ok%
oni(\2]
onSqx#
O	Oc`Y8	
&Open,0,2
OpenClipboard
OpenDatabase
OpenFileMappingA
OpenPrinterA
OpenProcess
OR3i*MT
o_t1u	
&.$@ou
ouAYKj
out.prn
 &&;OW
Owf	4u
OwnerLink
OX[0R 
}ox9Oq
O<Xp,@
oyqhk?v
O`'^Zf
ozGI |s*
p#0_($
]P1E) 
	p5YW[_.E	7
p	!#)8
p9}I{D
~P9~Pun
P-`A0y@*
P]{;aI
+P	A~mC_
pAo	P5(Rj
PatBlt
PathToRegion
.PAVCArchiveException@@
.PAVCException@@
.PAVCFileException@@
.PAVCMemoryException@@
.PAVCNotSupportedException@@
.PAVCObject@@
.PAVCOleDispatchException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCSimpleException@@
.PAVCUserException@@
$Pe"ai
PeekMessageA
:Peqrj	
phMU3!KPz
P_h"T^d
Ph_^][Y
PicBtn
piK**i
piL	7 }
P*I!-X
PJbsaj
$pnJck!
P!O.)}
Po8Q>B
PostMessageA
PostQuitMessage
PostThreadMessageA
PPPPhd
PPPPPPPP
P<PuWSV
ppxxxx
PQj WUS
PQQQQQ
\$ PQV
#pragma code_page(936)
Preload
PreviewPages
 (*.prn)|*.prn|
Process32First
Process32Next
Program: 
<program name unknown>
P$RWPh
p)S	FNoeQ
~'PSQR
Ps(?zC
Pt,eyG'N#K
PtInRect
PtVisible
Pu}F-V
\pull.dll
- pure virtual function call
pvIxPh>4	0
@PVj,S
	Pvp{HK
PVTM@I'
\$PVUUS
PWVWWW
px_1Yh
PY	_g*-1
pyy\W5
Pyz\	-3
[Q(] _
Q1D9yi}
Q1	@WZ
Q4*y>	~
Q-5AMy-*
Q.$(6k
q!8!zxb	+
q9QI*JB
()qA()
}-QA5y!
!q?_a8	
qfgbxK
QG?qU~9
q;H! 8
}qH>Ph
qhq!HF
*^qIE8
QI	ER+
{QkD`%
qK	%g9a
Q	Kihk
qK(lO%
Q !!K(W
q)lQy)
$qm:c8}K
	qm:g]
/qmIKB
&Qmn!7
;qn	9j
QO"$>e
qOH1!aEi`
Q=p7$A	
	qP+d-jp
{QpMX!
QPSWVR
qQI9Tp
Q/QNeA
Qq}N	*i0
]__QQoA'=$3
QQ?{P(
QQSVW3
QQSVWd
QQSVWj
QQUWSS
Q(S"UdW^W
QSUVWj
+qsyYO
Q.T0\ 
QVWWRP
qvy	BTV
Q(\w]-
$q	'=W5o
QX[gbL
QyF#	k
q.yG+iw
%q$YML
R,1}]T
&r37Ld
r(7	i[F
R	9v7d
RaiseException
RASAPI32.dll
RasGetConnectStatusA
RasHangUpA
(,	{rd
`.rdata
ReadFile
RealizePalette
Rectangle
RectVisible
RedrawWindow
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegFlushKey
RegisterClassA
RegisterClassExA
RegisterClipboardFormatA
RegisterHotKey
RegisterWindowMessageA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueA
RegQueryValueExA
RegSetValueExA
ReleaseCapture
ReleaseDC
ReleaseSemaphore
.reloc
@.reloc
RemovePlayer
RemovePropA
Reply-To: %s
resource.h
RestoreDC
ResumeThread
R`h2>T
RichEdit Text and Objects
Rich Text Format
RJpQdI	
R%@k+k
:r?mhb
rnh9DR
rNjltU
;R&Nwd	
RoundRect
|$,RPQ
<R&%Q1
RQhd"Z
RRz-/,
RSbpS\O
RtlMoveMemory
RtlUnwind
Ru.-&	
RunDllHostCallBack
runtime error 
Runtime Error!
rVI]E_
RVnYN 
RVPUSQ
RV/?yhK
RWe%	NB
r/{XO9cY
Ryb	;X
)\s){_
S2"r)+hX
+!s8k<
Saturday
SaveDC
s\B5\w
SbpS0R
SbpS@b	gu
SbpS:g:
SbpS\O
ScaleViewportExtEx
ScaleWindowExtEx
ScreenToClient
ScrollWindowEx
`s_Dp	
}^Se?#L
SelectClipRgn
SelectObject
SelectPalette
SendDlgItemMessageA
SendMessageA
September
SetActiveWindow
SetBkColor
SetBkMode
SetCapture
SetClipboardData
    Set cpuSet = GetObject("winmgmts:{impersonationLevel=impersonate}").InstancesOf("Win32_Processor")
SetCurrentDirectoryA
SetCursor
SetCursorPos
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetFocus
SetForegroundWindow
SetHandleCount
SetLastError
SetLayeredWindowAttributes
SetMapMode
SetMenu
SetMenuItemBitmaps
SetParent
SetPixel
SetPolyFillMode
SetPropA
SetRect
SetRectEmpty
SetROP2
SetScrollPos
SetScrollRange
SetStdHandle
SetStretchBltMode
SetTextColor
SetTimer
Settings
SetUnhandledExceptionFilter
SetViewportExtEx
SetViewportOrgEx
SetWindowContextHelpId
SetWindowExtEx
SetWindowLongA
SetWindowOrgEx
SetWindowPos
SetWindowRgn
SetWindowsHookExA
SetWindowTextA
SGK_-r
%s=gTi
ShapeBox
Shell32.dll
SHELL32.dll
ShellExecuteA
Shell_NotifyIconA
\shell\open\command
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
Shift+F1
Shift+F10
Shift+F11
Shift+F12
Shift+F2
Shift+F3
Shift+F4
Shift+F5
Shift+F6
Shift+F7
Shift+F8
Shift+F9
s))=HK
SHLWAPI.dll
ShowWindow
SHU@W8W0WhW`WXWPW
Silent
S#!=Im
SING error
	sj+yl
%s-*MuhE
sO;>|C;~
software
Software\
Software\Super-EC\
sOufy	`%
SouGou
%sp9-b
s;#;p$C
s!r$5{
%s <%s>
SS@SSPVSS
_SSSSU
!{#s	'T-5
StartDocA
StartPage
StatusText
StatusWndProc
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
StretchBlt
STY1uHN
S@U4WxW
Subject: %s
Sunday
SunMonTueWedThuFriSat
Super-EC
s~'\v\vv
.swc-_
s=w-u	%
SWVVVRPV
!sx#%	
System
SystemParametersInfoA
"	}T!{
T$$_^]
T$0PjdR
T$0PQR
T$0RPQ
T$0SUV
=T%3u.m1
@t4Ht1Ht_Ht
T$8hD0Z
T$8QRP
T$8RWj
t$ 90t
t	9A8u
T9l}Kv
t	9p$u
t&9^$t
T>a%3$
TabbedTextOutA
tAuQD3
t	A]~XZe
tA`y@*$M
Tb5<|#qU1
t	c,A7
tC%PQ]d
T$$+D$4
t	D5&!
tD9_Pt?
T$dPQR
T$DPQRW
T$DQRU
T$DQSR
~TDR1^
T$DWRh
T$\;D$Xu
t(ENEN;
TerminateProcess
TextOutA
T/f&Tcknx
"	)$Tg
<]t_G<-uA
tGXV	Lx
	tH9{Mlr*	0Z
!This program cannot be run in DOS mode.
<th><label for="field_2new"><font color=red>CPU
Thlgd&
t>Ht Ht
t*Ht"Ht
t+Ht$Ht
Thursday
T$H} VP
?TI,a0F
tI;Ftr
TIjt?vN
`tI[ke
T$\jdSR
+tJHt:Ht*
tKaOGt<]
tKSe_E
t`]LH~U
TLOSS error
T$lPRh
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t$LUPh
T$LWUQVR
]TMX5YE
tn<%t2
tooltips_class32
To: %s
T	O*y^5Q
Tp`ETz
T$pPQR
t$PPVS
T$(PQR
T$\PQR
T$PQRP
T$ PQWWR
T$$PRV
t$ PUSVV
t.	,PY
%Tq+)#|
tq9~Dt
tq9w(tlSj
T$(Qhx
T$ QRP
tq~V`d
T$(QVURWP
TransLabel
TranslateAcceleratorA
TranslateCharsetInfo
TranslateMessage
tRHt}H
T$$RhXxX
T$,RQP
t%RSQP
t$$RVP
T$<RVW
t	R.W?
tS9~@uN
T$ SRh
T$,SRh
t$(SSh
t#SSUP
T$ SWRP
tsZG	>a<
t!< t	<
Tt433P2z
~t	|T\^b,
+ttHHtd
	tTo"~N
,"TT+q
t.;t$$t(
T`uagy
Tuesday
T$\URP
t$$VSS
T(v#WG)[$ /
tvWWWWU
T"'$w2
)tw),<iIW
T$\WVR
t/WWUPj
t$Xc.;J	
.txthttp://down.wghai.com/up/super-ec/tongji.asphttp://down.wghai.com/up/super-ec/ec.txt
 (*.txt)|*.txt|
T$XUSR
;t$Xu";\$\u
t$XWVS
	Ty(c^
TyJ? }
ty`*@M$
$Ty!_n
tz$_w~/ 
?u='@^
u._^][
u29l$xu,
u3NS	2#Y~m	
*#U8-[C
u"8D$yu
u]9B uX
u	9~@u
uA;5ToZ
UAQo	%
-uA]y1*-
	UbD9_
|UC)	Ie
>:u#FV
uh9^8uX
UI)/H8
uiu]Aw2t;#
UIWndProc
UJIm"W
ukI%9_	
Ulb1T~
um9!rw
=_).u[n
- unable to initialize heap
- unable to open console device
U,\nc(
- unexpected heap error
- unexpected multithread lock error
>:uNFV
UnhandledExceptionFilter
UnhookWindowsHookEx
UNLINK
UnloadKeyboardLayout
UnlockFile
UnregisterClassA
UnregisterHotKey
uo'Xlz	
~	u/"P
UpdateWindow
U Q1St	
^UQpMt
;%UR&-
uR9BxuM
uRFGHt
us-ascii
USER32
user32.dll
User32.dll
USER32.dll
USER32.DLL
u$SShe
@u+;t$
<Ut(%%YT1
U!VjW O
uv/O!/|A
\$(UVW
u x\0V
;uX~'M
uye*MM!
UZ1&G_
uzi_/=lAu
 V1.0  
V`4O	&K
V5CP9 
'-V{8!=
-vA1yt*!Mr
ValidateRect
vB_IwU
VC20XC00U
v%_CNG"
VcUEkF7
vD\aY\q
VdC~a\
v^d*,i
V#D$,WPQ
v'\E~\
vEM~D\
VERSION.dll
vE\~~v~~
~~vG1n;
Vh;VX|
V)hxk-
VI0z	[
VirtualAlloc
VirtualFree
VirtualProtect
visible
%]vIwf(uL:.
@.vmp0
`.vmp1
 .vmp2
VMProtect begin
VMProtect end
.Vo5%C
V+ozmIx
VpEdJowm
Vr^Fd~
V*@s)LH#3
\v~\~~~t
vT-Xpg
vvOvkz
VVUSVV
VVVPQR
\$<VW3
V@W@PQ
VWtp9E
VWuBhX
V,_^[Y
Vy}o p
>	+W'=
}@w4xt
(W6uV?Y
)W/8%uY
W9^du-
WaitForMultipleObjects
WaitForSingleObject
waveOutClose
waveOutGetNumDevs
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
 (*.WAV;*.MID)|*.WAV;*.MID|WAV
 (*.WAV)|*.WAV|MIDI
	w`b:(
w-%;c	
wc#`	(}
wdn	L=d
w& 	$E
Wednesday
W	 @f&
wf>9idG
	WG!2S(
@/WHIdH
WHW8W2WlWXWV
WideCharToMultiByte
window
WindowFromPoint
windows
Windows
WinExec
WinHelpA
WININET.dll
WINMM.dll
WINSPOOL.DRV
WIWAW9W1Wi
WjdjdPQh
Wj(_Wj
?))wkM
WNAL-#=*
+w	&{>o
wo?3]u	
wOu*sxq
|$$}$WP
>~&wPHb\
W	PN!y
wpwpxp
W-]QS-
(wqt\HHtS
WriteFile
WritePrivateProfileStringA
WS2_32.dll
WSOCK32.dll
wsprintfA
WTG-$^	yc0S@
WTWindow
|$@ Wu
{w)	VR
wwwpwpwpxp
wwwwvf
wwwwvfo
wwwwwpwpxp
wwwwww
wwwwwww
wwwwwwww
wwwwwwwww
wwwwwwwwwwwww
wwwwwwwwwwwwwwwwwwwwwwww
wwwwwwwwwxwxp
<@Wxb-
wxEiwy
wxwxwxp
wyPF}`2p
* ]x"*
x?)~_|+
/\x[4(
X/5_rOg
x5z	E<
%)X8(5
X8l$J0
 ^@=xA
x%+.A(
XA0y@*
`-xAny *lM
*XAYU$y6G
xB4>^1
x<d<,;
Xd	uIw=
]x*!;F
._^xh1e
xhg,1(:
&XH%^(K
XI25fi
XiI@$XI
xIw)LY+
xl4C"2
->X!}lt
x-<:MC
xNcUg	a
X[p9GI
"XpM3K
XQoQ=Ek
xQRCQVU
xr&etY
x>}!RU
X%T5X	 
-Xt	E,|
X't?lH
xTl S9
<[x_x<
x-XA8y@*H
X'x/iB
X~Xj9#
xX><M=
XY[Z[]
x&zC&?
~y/+*^
Y>0%Qz
)(y2_4C
$@y2h}I
Y3 fO-
Y*3:g/
y:*4Mt
Y;54OZ
#Y5 MW
Y5!Z G
y!6'@/,
Y6*7kc
Y95`T^
ya*AM!
Y?AI-a
@Y%A-lH
-yA{y}*
Y/,cT^
YCzixot
Y-eAayg*ix1
|Yg!h9lYg(
YHF/L	
YHYtLHt9
Y'IH@A
Yk9"#hDi
yl+]Kw
[ym*?CAji%U
y/*pM!
yp*TM<
yq*sMu
Yq}T>3
yR$!}I
y\#RPG
Yrx~$NZ
 \Y)s3=
YtgtIP~
yT*pMR
yu*]M1
y~xW_.
YX[(W	
_^][YY
Y-yAqy
YYF;5`T^
\y YIKW
y@*$zh
yzm$I9
Z	).#;
z3-ZVO
Z5%g{>	D
)Z.A_0
%ZA	e@
	>ZeMW
zH1uXyt
}-{Zi>
 Z+K9%
ZK{_'M
zmS1L]
\Zn9F	
z<nAj!i
znN!bMj
	Zo2{L
	%Zqj.]
Z/	+rU
Zs3S5u6
Zt(Ht Ht
z>.tmp
Z^-U{p@Ix
|z;^<}uWS
,z$Ux_9A
zXkv)J
Zx\N{*
?ZxQ{A
!@zxs0
z{Y`GZ
z_	Y?L
:zzU*N51