Analysis Date2014-04-07 04:22:42
MD5f2b332f6c1f549a9d498a93f510a5af2
SHA139daacef6e215e4c3fb4d252a7f625c9a8eaf3b1

Static Details:

File typePE32 executable for MS Windows (GUI) Intel 80386 32-bit
Section.text md5: 5cf574ac7269e59bd790f367635e7209 sha1: 088446fa83af1b2c18ed1a0315b15010f0924382 size: 524288
Section.rdata md5: dd0dab425dc33a1dedef5efbaf4ebc77 sha1: eaff878a360573309a2a4cdc3592a134311e0b90 size: 114688
Section.data md5: c7c53f2422d1d74292423e80645308f3 sha1: 3b12fcbe3ce7d9c15fcd49fa524f88b502bbed56 size: 65536
Section.rsrc md5: 879fc7ed74f520ec4597b295adff0573 sha1: 87303e2cfb75a4a522de6398d695d5662c9a7c99 size: 32768
Timestamp2011-12-31 12:57:21
VersionLegalCopyright: 作者版权所有 请尊重并使用正版
FileVersion: 1.0.0.0
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
ProductName: 易语言程序
ProductVersion: 1.0.0.0
FileDescription: 易语言程序
PackerMicrosoft Visual C++ v6.0
PEhash327fddcd7c1d687756b396d4ed574923e2355cc2
IMPhash10c2fd848e8aa32506cae30b64a5e49f
AVmcafeeFakeAlert.iv
AVavgPSW.Generic12.AHAI

Runtime Details:

Screenshot

Process
↳ C:\malware.exe

RegistryHKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable ➝
NULL
RegistryHKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass ➝
1
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\BSDHA97U\52shanhu[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\7799k[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
Creates Filec:\delus.bat
Creates File\Device\Afd\AsyncConnectHlp
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\feixiandao.uueasy[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\6699kan[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\3214[1].htm
Creates FileC:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\658HSJSD\6625[1].htm
Creates FileC:\Documents and Settings\Administrator\Cookies\index.dat
Creates FilePIPE\lsarpc
Creates File\Device\Afd\Endpoint
Creates Processc:\delus.bat
Creates Mutexc:!documents and settings!administrator!local settings!history!history.ie5!
Creates MutexWininetConnectionMutex
Creates Mutexc:!documents and settings!administrator!cookies!
Creates Mutexc:!documents and settings!administrator!local settings!temporary internet files!content.ie5!
Winsock DNSwww.5266.me
Winsock DNSfeixiandao.uueasy.com
Winsock DNSwww.7798k.com
Winsock DNSwww.5213dy.com
Winsock DNSwww.955wl.com
Winsock DNSwww.3214.cn
Winsock DNSwww.0419dj.com
Winsock DNSwww.lelev8.net
Winsock DNSwww.ewasai.com
Winsock DNSwww.3344dnf.com
Winsock DNSwww.dnfxq.com
Winsock DNS7798k.com
Winsock DNSwww.6stv.net
Winsock DNSwww.913dnf.com
Winsock DNSwww.87dyw.com
Winsock DNSwww.52shanhu.com
Winsock DNS7799k.com
Winsock DNSwww.sqiba.com
Winsock DNSwww.11111wg.com
Winsock DNSwww.6699kan.com
Winsock DNSwww.66iu.com
Winsock DNSwww.le6tv.com
Winsock DNSwww.6625.me
Winsock DNSwww.11111wg.net

Process
↳ c:\delus.bat

Network Details:

DNSwww.0419dj.com
Type: A
59.45.79.57
DNSwww.52shanhu.com
Type: A
208.73.211.177
DNSwww.52shanhu.com
Type: A
208.73.211.164
DNSwww.52shanhu.com
Type: A
208.73.211.249
DNSwww.52shanhu.com
Type: A
208.73.211.236
DNSwww.52shanhu.com
Type: A
208.73.211.182
DNSa.uueasy.com
Type: A
42.120.63.199
DNSwww.6625.me
Type: A
107.20.253.26
DNSwww.6699kan.com
Type: A
74.82.63.228
DNS66iu.com
Type: A
50.63.202.63
DNS3344dnf.com
Type: A
184.168.221.8
DNS7799k.com
Type: A
98.126.250.148
DNS39712.vhost13.cloudvhost.net
Type: A
116.255.200.174
DNSwww.5213dy.com
Type: A
DNSwww.11111wg.net
Type: A
DNS7798k.com
Type: A
DNSwww.11111wg.com
Type: A
DNSwww.7798k.com
Type: A
DNSwww.le6tv.com
Type: A
DNSwww.87dyw.com
Type: A
DNSfeixiandao.uueasy.com
Type: A
DNSwww.ewasai.com
Type: A
DNSwww.5266.me
Type: A
DNSwww.3214.cn
Type: A
DNSwww.lelev8.net
Type: A
DNSwww.sqiba.com
Type: A
DNSwww.dnfxq.com
Type: A
DNSwww.3344dnf.com
Type: A
DNSwww.66iu.com
Type: A
DNSwww.955wl.com
Type: A
DNSwww.6stv.net
Type: A
DNSwww.913dnf.com
Type: A
HTTP GEThttp://www.0419dj.com/nitian.htm
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.52shanhu.com/1.htm
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.52shanhu.com/jueai.htm
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://feixiandao.uueasy.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://feixiandao.uueasy.com/index-htm-m-bbs-cateid-6.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.6625.me/?jueai
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.6625.me/soft/Dn_YCM/1118-DnYCM.htm
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.6699kan.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.3344dnf.com/wuye1.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.66iu.com/520.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.66iu.com/wuye.html
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://7799k.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.3214.cn/?jueai
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
HTTP GEThttp://www.52shanhu.com/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)
Flows TCP192.168.1.1:1034 ➝ 59.45.79.57:80
Flows TCP192.168.1.1:1036 ➝ 208.73.211.177:80
Flows TCP192.168.1.1:1037 ➝ 208.73.211.177:80
Flows TCP192.168.1.1:1038 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1039 ➝ 42.120.63.199:80
Flows TCP192.168.1.1:1040 ➝ 107.20.253.26:80
Flows TCP192.168.1.1:1041 ➝ 107.20.253.26:80
Flows TCP192.168.1.1:1042 ➝ 74.82.63.228:80
Flows TCP192.168.1.1:1043 ➝ 184.168.221.8:80
Flows TCP192.168.1.1:1044 ➝ 50.63.202.63:80
Flows TCP192.168.1.1:1045 ➝ 50.63.202.63:80
Flows TCP192.168.1.1:1046 ➝ 98.126.250.148:80
Flows TCP192.168.1.1:1047 ➝ 116.255.200.174:80
Flows TCP192.168.1.1:1048 ➝ 208.73.211.177:80

Raw Pcap
0x00000000 (00000)   47455420 2f6e6974 69616e2e 68746d20   GET /nitian.htm 
0x00000010 (00016)   48545450 2f312e31 0d0a4163 63657074   HTTP/1.1..Accept
0x00000020 (00032)   3a202a2f 2a0d0a41 63636570 742d4c61   : */*..Accept-La
0x00000030 (00048)   6e677561 67653a20 656e2d75 730d0a41   nguage: en-us..A
0x00000040 (00064)   63636570 742d456e 636f6469 6e673a20   ccept-Encoding: 
0x00000050 (00080)   677a6970 2c206465 666c6174 650d0a55   gzip, deflate..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000090 (00144)   6e646f77 73204e54 20352e31 3b205356   ndows NT 5.1; SV
0x000000a0 (00160)   313b202e 4e455420 434c5220 322e302e   1; .NET CLR 2.0.
0x000000b0 (00176)   35303732 37290d0a 486f7374 3a207777   50727)..Host: ww
0x000000c0 (00192)   772e3034 3139646a 2e636f6d 0d0a436f   w.0419dj.com..Co
0x000000d0 (00208)   6e6e6563 74696f6e 3a204b65 65702d41   nnection: Keep-A
0x000000e0 (00224)   6c697665 0d0a0d0a                     live....

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7777772e 36363939 6b616e2e   st: www.6699kan.
0x000000c0 (00192)   636f6d0d 0a436f6e 6e656374 696f6e3a   com..Connection:
0x000000d0 (00208)   204b6565 702d416c 6976650d 0a0d0a      Keep-Alive....

0x00000000 (00000)   47455420 2f6a7565 61692e68 746d2048   GET /jueai.htm H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a4163 63657074 2d4c616e    */*..Accept-Lan
0x00000030 (00048)   67756167 653a2065 6e2d7573 0d0a4163   guage: en-us..Ac
0x00000040 (00064)   63657074 2d456e63 6f64696e 673a2067   cept-Encoding: g
0x00000050 (00080)   7a69702c 20646566 6c617465 0d0a5573   zip, deflate..Us
0x00000060 (00096)   65722d41 67656e74 3a204d6f 7a696c6c   er-Agent: Mozill
0x00000070 (00112)   612f342e 30202863 6f6d7061 7469626c   a/4.0 (compatibl
0x00000080 (00128)   653b204d 53494520 362e303b 2057696e   e; MSIE 6.0; Win
0x00000090 (00144)   646f7773 204e5420 352e313b 20535631   dows NT 5.1; SV1
0x000000a0 (00160)   3b202e4e 45542043 4c522032 2e302e35   ; .NET CLR 2.0.5
0x000000b0 (00176)   30373237 290d0a48 6f73743a 20777777   0727)..Host: www
0x000000c0 (00192)   2e353273 68616e68 752e636f 6d0d0a43   .52shanhu.com..C
0x000000d0 (00208)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000e0 (00224)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f312e68 746d2048 5454502f   GET /1.htm HTTP/
0x00000010 (00016)   312e310d 0a416363 6570743a 202a2f2a   1.1..Accept: */*
0x00000020 (00032)   0d0a4163 63657074 2d4c616e 67756167   ..Accept-Languag
0x00000030 (00048)   653a2065 6e2d7573 0d0a4163 63657074   e: en-us..Accept
0x00000040 (00064)   2d456e63 6f64696e 673a2067 7a69702c   -Encoding: gzip,
0x00000050 (00080)   20646566 6c617465 0d0a5573 65722d41    deflate..User-A
0x00000060 (00096)   67656e74 3a204d6f 7a696c6c 612f342e   gent: Mozilla/4.
0x00000070 (00112)   30202863 6f6d7061 7469626c 653b204d   0 (compatible; M
0x00000080 (00128)   53494520 362e303b 2057696e 646f7773   SIE 6.0; Windows
0x00000090 (00144)   204e5420 352e313b 20535631 3b202e4e    NT 5.1; SV1; .N
0x000000a0 (00160)   45542043 4c522032 2e302e35 30373237   ET CLR 2.0.50727
0x000000b0 (00176)   290d0a48 6f73743a 20777777 2e353273   )..Host: www.52s
0x000000c0 (00192)   68616e68 752e636f 6d0d0a43 6f6e6e65   hanhu.com..Conne
0x000000d0 (00208)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000e0 (00224)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f696e64 65782d68 746d2d6d   GET /index-htm-m
0x00000010 (00016)   2d626273 2d636174 6569642d 362e6874   -bbs-cateid-6.ht
0x00000020 (00032)   6d6c2048 5454502f 312e310d 0a416363   ml HTTP/1.1..Acc
0x00000030 (00048)   6570743a 202a2f2a 0d0a4163 63657074   ept: */*..Accept
0x00000040 (00064)   2d4c616e 67756167 653a2065 6e2d7573   -Language: en-us
0x00000050 (00080)   0d0a4163 63657074 2d456e63 6f64696e   ..Accept-Encodin
0x00000060 (00096)   673a2067 7a69702c 20646566 6c617465   g: gzip, deflate
0x00000070 (00112)   0d0a5573 65722d41 67656e74 3a204d6f   ..User-Agent: Mo
0x00000080 (00128)   7a696c6c 612f342e 30202863 6f6d7061   zilla/4.0 (compa
0x00000090 (00144)   7469626c 653b204d 53494520 362e303b   tible; MSIE 6.0;
0x000000a0 (00160)   2057696e 646f7773 204e5420 352e313b    Windows NT 5.1;
0x000000b0 (00176)   20535631 3b202e4e 45542043 4c522032    SV1; .NET CLR 2
0x000000c0 (00192)   2e302e35 30373237 290d0a48 6f73743a   .0.50727)..Host:
0x000000d0 (00208)   20666569 7869616e 64616f2e 75756561    feixiandao.uuea
0x000000e0 (00224)   73792e63 6f6d0d0a 436f6e6e 65637469   sy.com..Connecti
0x000000f0 (00240)   6f6e3a20 4b656570 2d416c69 76650d0a   on: Keep-Alive..
0x00000100 (00256)   0d0a                                  ..

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 66656978 69616e64 616f2e75   st: feixiandao.u
0x000000c0 (00192)   75656173 792e636f 6d0d0a43 6f6e6e65   ueasy.com..Conne
0x000000d0 (00208)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000e0 (00224)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f736f66 742f446e 5f59434d   GET /soft/Dn_YCM
0x00000010 (00016)   2f313131 382d446e 59434d2e 68746d20   /1118-DnYCM.htm 
0x00000020 (00032)   48545450 2f312e31 0d0a4163 63657074   HTTP/1.1..Accept
0x00000030 (00048)   3a202a2f 2a0d0a41 63636570 742d4c61   : */*..Accept-La
0x00000040 (00064)   6e677561 67653a20 656e2d75 730d0a41   nguage: en-us..A
0x00000050 (00080)   63636570 742d456e 636f6469 6e673a20   ccept-Encoding: 
0x00000060 (00096)   677a6970 2c206465 666c6174 650d0a55   gzip, deflate..U
0x00000070 (00112)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000080 (00128)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000090 (00144)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x000000a0 (00160)   6e646f77 73204e54 20352e31 3b205356   ndows NT 5.1; SV
0x000000b0 (00176)   313b202e 4e455420 434c5220 322e302e   1; .NET CLR 2.0.
0x000000c0 (00192)   35303732 37290d0a 486f7374 3a207777   50727)..Host: ww
0x000000d0 (00208)   772e3636 32352e6d 650d0a43 6f6e6e65   w.6625.me..Conne
0x000000e0 (00224)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000f0 (00240)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f3f6a75 65616920 48545450   GET /?jueai HTTP
0x00000010 (00016)   2f312e31 0d0a4163 63657074 3a202a2f   /1.1..Accept: */
0x00000020 (00032)   2a0d0a41 63636570 742d4c61 6e677561   *..Accept-Langua
0x00000030 (00048)   67653a20 656e2d75 730d0a41 63636570   ge: en-us..Accep
0x00000040 (00064)   742d456e 636f6469 6e673a20 677a6970   t-Encoding: gzip
0x00000050 (00080)   2c206465 666c6174 650d0a55 7365722d   , deflate..User-
0x00000060 (00096)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000070 (00112)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x00000080 (00128)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x00000090 (00144)   73204e54 20352e31 3b205356 313b202e   s NT 5.1; SV1; .
0x000000a0 (00160)   4e455420 434c5220 322e302e 35303732   NET CLR 2.0.5072
0x000000b0 (00176)   37290d0a 486f7374 3a207777 772e3636   7)..Host: www.66
0x000000c0 (00192)   32352e6d 650d0a43 6f6e6e65 6374696f   25.me..Connectio
0x000000d0 (00208)   6e3a204b 6565702d 416c6976 650d0a0d   n: Keep-Alive...
0x000000e0 (00224)   0a                                    .

0x00000000 (00000)   47455420 2f3f6a75 65616920 48545450   GET /?jueai HTTP
0x00000010 (00016)   2f312e31 0d0a4163 63657074 3a202a2f   /1.1..Accept: */
0x00000020 (00032)   2a0d0a41 63636570 742d4c61 6e677561   *..Accept-Langua
0x00000030 (00048)   67653a20 656e2d75 730d0a41 63636570   ge: en-us..Accep
0x00000040 (00064)   742d456e 636f6469 6e673a20 677a6970   t-Encoding: gzip
0x00000050 (00080)   2c206465 666c6174 650d0a55 7365722d   , deflate..User-
0x00000060 (00096)   4167656e 743a204d 6f7a696c 6c612f34   Agent: Mozilla/4
0x00000070 (00112)   2e302028 636f6d70 61746962 6c653b20   .0 (compatible; 
0x00000080 (00128)   4d534945 20362e30 3b205769 6e646f77   MSIE 6.0; Window
0x00000090 (00144)   73204e54 20352e31 3b205356 313b202e   s NT 5.1; SV1; .
0x000000a0 (00160)   4e455420 434c5220 322e302e 35303732   NET CLR 2.0.5072
0x000000b0 (00176)   37290d0a 486f7374 3a207777 772e3332   7)..Host: www.32
0x000000c0 (00192)   31342e63 6e0d0a43 6f6e6e65 6374696f   14.cn..Connectio
0x000000d0 (00208)   6e3a204b 6565702d 416c6976 650d0a0d   n: Keep-Alive...
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.

0x00000000 (00000)   47455420 2f777579 65312e68 746d6c20   GET /wuye1.html 
0x00000010 (00016)   48545450 2f312e31 0d0a4163 63657074   HTTP/1.1..Accept
0x00000020 (00032)   3a202a2f 2a0d0a41 63636570 742d4c61   : */*..Accept-La
0x00000030 (00048)   6e677561 67653a20 656e2d75 730d0a41   nguage: en-us..A
0x00000040 (00064)   63636570 742d456e 636f6469 6e673a20   ccept-Encoding: 
0x00000050 (00080)   677a6970 2c206465 666c6174 650d0a55   gzip, deflate..U
0x00000060 (00096)   7365722d 4167656e 743a204d 6f7a696c   ser-Agent: Mozil
0x00000070 (00112)   6c612f34 2e302028 636f6d70 61746962   la/4.0 (compatib
0x00000080 (00128)   6c653b20 4d534945 20362e30 3b205769   le; MSIE 6.0; Wi
0x00000090 (00144)   6e646f77 73204e54 20352e31 3b205356   ndows NT 5.1; SV
0x000000a0 (00160)   313b202e 4e455420 434c5220 322e302e   1; .NET CLR 2.0.
0x000000b0 (00176)   35303732 37290d0a 486f7374 3a207777   50727)..Host: ww
0x000000c0 (00192)   772e3333 3434646e 662e636f 6d0d0a43   w.3344dnf.com..C
0x000000d0 (00208)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000e0 (00224)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f353230 2e68746d 6c204854   GET /520.html HT
0x00000010 (00016)   54502f31 2e310d0a 41636365 70743a20   TP/1.1..Accept: 
0x00000020 (00032)   2a2f2a0d 0a416363 6570742d 4c616e67   */*..Accept-Lang
0x00000030 (00048)   75616765 3a20656e 2d75730d 0a416363   uage: en-us..Acc
0x00000040 (00064)   6570742d 456e636f 64696e67 3a20677a   ept-Encoding: gz
0x00000050 (00080)   69702c20 6465666c 6174650d 0a557365   ip, deflate..Use
0x00000060 (00096)   722d4167 656e743a 204d6f7a 696c6c61   r-Agent: Mozilla
0x00000070 (00112)   2f342e30 2028636f 6d706174 69626c65   /4.0 (compatible
0x00000080 (00128)   3b204d53 49452036 2e303b20 57696e64   ; MSIE 6.0; Wind
0x00000090 (00144)   6f777320 4e542035 2e313b20 5356313b   ows NT 5.1; SV1;
0x000000a0 (00160)   202e4e45 5420434c 5220322e 302e3530    .NET CLR 2.0.50
0x000000b0 (00176)   37323729 0d0a486f 73743a20 7777772e   727)..Host: www.
0x000000c0 (00192)   36366975 2e636f6d 0d0a436f 6e6e6563   66iu.com..Connec
0x000000d0 (00208)   74696f6e 3a204b65 65702d41 6c697665   tion: Keep-Alive
0x000000e0 (00224)   0d0a0d0a                              ....

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 37373939 6b2e636f 6d0d0a43   st: 7799k.com..C
0x000000c0 (00192)   6f6e6e65 6374696f 6e3a204b 6565702d   onnection: Keep-
0x000000d0 (00208)   416c6976 650d0a0d 0a                  Alive....

0x00000000 (00000)   47455420 2f777579 652e6874 6d6c2048   GET /wuye.html H
0x00000010 (00016)   5454502f 312e310d 0a416363 6570743a   TTP/1.1..Accept:
0x00000020 (00032)   202a2f2a 0d0a4163 63657074 2d4c616e    */*..Accept-Lan
0x00000030 (00048)   67756167 653a2065 6e2d7573 0d0a4163   guage: en-us..Ac
0x00000040 (00064)   63657074 2d456e63 6f64696e 673a2067   cept-Encoding: g
0x00000050 (00080)   7a69702c 20646566 6c617465 0d0a5573   zip, deflate..Us
0x00000060 (00096)   65722d41 67656e74 3a204d6f 7a696c6c   er-Agent: Mozill
0x00000070 (00112)   612f342e 30202863 6f6d7061 7469626c   a/4.0 (compatibl
0x00000080 (00128)   653b204d 53494520 362e303b 2057696e   e; MSIE 6.0; Win
0x00000090 (00144)   646f7773 204e5420 352e313b 20535631   dows NT 5.1; SV1
0x000000a0 (00160)   3b202e4e 45542043 4c522032 2e302e35   ; .NET CLR 2.0.5
0x000000b0 (00176)   30373237 290d0a48 6f73743a 20777777   0727)..Host: www
0x000000c0 (00192)   2e363669 752e636f 6d0d0a43 6f6e6e65   .66iu.com..Conne
0x000000d0 (00208)   6374696f 6e3a204b 6565702d 416c6976   ction: Keep-Aliv
0x000000e0 (00224)   650d0a0d 0a                           e....

0x00000000 (00000)   47455420 2f204854 54502f31 2e310d0a   GET / HTTP/1.1..
0x00000010 (00016)   41636365 70743a20 2a2f2a0d 0a416363   Accept: */*..Acc
0x00000020 (00032)   6570742d 4c616e67 75616765 3a20656e   ept-Language: en
0x00000030 (00048)   2d75730d 0a416363 6570742d 456e636f   -us..Accept-Enco
0x00000040 (00064)   64696e67 3a20677a 69702c20 6465666c   ding: gzip, defl
0x00000050 (00080)   6174650d 0a557365 722d4167 656e743a   ate..User-Agent:
0x00000060 (00096)   204d6f7a 696c6c61 2f342e30 2028636f    Mozilla/4.0 (co
0x00000070 (00112)   6d706174 69626c65 3b204d53 49452036   mpatible; MSIE 6
0x00000080 (00128)   2e303b20 57696e64 6f777320 4e542035   .0; Windows NT 5
0x00000090 (00144)   2e313b20 5356313b 202e4e45 5420434c   .1; SV1; .NET CL
0x000000a0 (00160)   5220322e 302e3530 37323729 0d0a486f   R 2.0.50727)..Ho
0x000000b0 (00176)   73743a20 7777772e 35327368 616e6875   st: www.52shanhu
0x000000c0 (00192)   2e636f6d 0d0a436f 6e6e6563 74696f6e   .com..Connection
0x000000d0 (00208)   3a204b65 65702d41 6c697665 0d0a0d0a   : Keep-Alive....
0x000000e0 (00224)   0a202020 203c703e 596f7572 2062726f   .    <p>Your bro
0x000000f0 (00240)   77736572 2073656e 74206120 72657175   wser sent a requ
0x00000100 (00256)   65737420 74686174 20746869 73207365   est that this se
0x00000110 (00272)   72766572 20636f75 6c64206e 6f742075   rver could not u
0x00000120 (00288)   6e646572 7374616e 642e3c2f 703e0a20   nderstand.</p>. 
0x00000130 (00304)   2020203c 703e4e6f 20737563 68206669      <p>No such fi
0x00000140 (00320)   6c65206f 72206469 72656374 6f72792e   le or directory.
0x00000150 (00336)   3c2f703e 0a20203c 6872202f 3e0a2020   </p>.  <hr />.  
0x00000160 (00352)   3c616464 72657373 3e4d6963 726f736f   <address>Microso
0x00000170 (00368)   66742d49 49532f37 2e303c2f 61646472   ft-IIS/7.0</addr
0x00000180 (00384)   6573733e 0a20203c 2f626f64 793e0a3c   ess>.  </body>.<
0x00000190 (00400)   2f68746d 6c3e0a                       /html>.


Strings
....  ................
"#
O7=DJx
....
.........
10/.-,+*)('&%$#"! ..............
.....
..........
..
.........
-
..
x
..
-- \
.-E-0-0..
00-+ 
e
 
00
...........?-  
0
0 
0
?
......  
u

    
 ......
 (*.*)
#####
#######
080404B0
 %1 
1.0.0.0
	1uM
(&C)
Comments
	Ctrl+
	Ctrl+D
	Ctrl+End
	Ctrl+G
	Ctrl+Home
	Ctrl+N
	Ctrl+PageDown
	Ctrl+PageUp
	&D.
DEFAULT_ICON
 DLL 
(&E)
FileDescription
FileVersion
         (((((                  H
(&H)
Hjjj
Hjjjj
Hjjjjjjjj
(http://www.eyuyan.com)
(&I)
 INI 
jjjj
jjjjjj
LegalCopyright
msctls_progress32
msctls_updown32
MS Shell Dlg
(&N)
(null)
(&O)
(&P)
	PageDown
	PageUp
ProductName
ProductVersion
Progress1
 %s 
(&S)
	Shift+Tab
Spin1
StringFileInfo
(&T)
	Tab/Enter
TEXTINCLUDE
Translation
VarFileInfo
VS_VERSION_INFO
xxxx
^,_^][
^$_^[]
 (*.*)|*.*||
	!	!	!	!	
(&07-034/)7 '
0dk:ghV
0R>\W[
,1"52.*
1#QNAN
1#SNAN
	2	5	5	5	5	5
%2\CLSID
%2\DocObject
%2\Insertable
%2\protocol\StdFileEditing\server
%2\protocol\StdFileEditing\verb\0
|?5^<@
5	!	!	!	!
	5	5	5
	6	6	6	6
	6	6	6	6	6	6	6	6	6	6	,	,	,	,	,	,	,	,	+	+	+	+	+	/	/	/	'	'	'	'	'	'	'	'	'	'	(	(	(	(	(	(	(	(	(	(	(	(	(	
	7	7	7	7	7	7	7	7	7	7	7	*	*	-	-	-	-
824F144B108A4bcbB966F45670D42A00
8MThdu
8	uQ9x
\$8UVW
%9, %8
'9A`u"9
9D$$t+
9G4_^d
9^Ht}3
9L$x~e
9l$xtU9
9nPu	9^T
9o4u'V
	9oTtc
9~@St99~8~
9t$0v8
9^@t53
9u ^t	
9^xu5j
9x u	f
<A|2<Z
abcddefghijklmnoopqrrsstuvvwwxyyz;
abnormal program termination
about:blank
Accordion
Acoustic Bass
Acoustic Grand Piano
Acoustic Guitar (nylon)
Acoustic Guitar (steel)Electric Guitar (jazz)
AdjustWindowRectEx
Advapi32.dll
ADVAPI32.dll
AfxControlBar42s
AfxFrameOrView42s
AfxMDIFrame42s
AfxOldWndProc423
AfxOleControl42s
AfxWnd42s
Afx:%x:%x
Afx:%x:%x:%x:%x:%x
Alto Sax
AppendMenuA
Applause
.?AUCThreadData@@
August
.?AUIBoundObjectSite@@
.?AUIDispatch@@
.?AUIEnumVOID@@
.?AUIMessageFilter@@
.?AUINotifyDBEvents@@
.?AUIOleClientSite@@
.?AUIOleContainer@@
.?AUIOleControlSite@@
.?AUIOleInPlaceFrame@@
.?AUIOleInPlaceSite@@
.?AUIOleInPlaceUIWindow@@
.?AUIOleWindow@@
.?AUIParseDisplayName@@
.?AUIPropertyNotifySink@@
.?AUIRowsetNotify@@
.?AUISequentialStream@@
.?AUIStream@@
.?AUIUnknown@@
.?AV_AFX_BASE_MODULE_STATE@@
.?AV_AFX_CHECKLIST_STATE@@
.?AV_AFX_COLOR_STATE@@
.?AV_AFX_CTL3D_STATE@@
.?AV_AFX_CTL3D_THREAD@@
.?AVAFX_MODULE_STATE@@
.?AVAFX_MODULE_THREAD_STATE@@
.?AV_AFX_OLE_STATE@@
.?AV_AFX_THREAD_STATE@@
.?AV_AFX_WIN_STATE@@
.?AVCArchiveException@@
.?AVCArchiveStream@@
.?AVCBitmap@@
.?AVCBrush@@
.?AVCButton@@
.?AVCByteArray@@
.?AVCClientDC@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCColorDialog@@
.?AVCComboBox@@
.?AVCCommonDialog@@
.?AVCDataSourceControl@@
.?AVCDC@@
.?AVCDialog@@
.?AVCDWordArray@@
.?AVCEdit@@
.?AVCEnumArray@@
.?AVCEnumUnknown@@
.?AVCException@@
.?AVCFile@@
.?AVCFileDialog@@
.?AVCFileException@@
.?AVCFont@@
.?AVCFormView@@
.?AVCGdiObject@@
.?AVCHandleMap@@
.?AVCHtmlView@@
.?AVCImageList@@
.?AVCMapPtrToPtr@@
.?AVCMapStringToPtr@@
.?AVCMemFile@@
.?AVCMemoryException@@
.?AVCMenu@@
.?AVCNoTrackObject@@
.?AVCNotSupportedException@@
.?AVCObject@@
.?AVCOccManager@@
.?AVCOleBusyDialog@@
.?AVCOleControlContainer@@
.?AVCOleControlSite@@
.?AVCOleDialog@@
.?AVCOleDispatchException@@
.?AVCOleDispatchImpl@@
.?AVCOleException@@
.?AVCOleMessageFilter@@
.?AVCPaintDC@@
.?AVCPen@@
.?AVCProgressCtrl@@
.?AVCPtrArray@@
.?AVCPtrList@@
.?AVCResourceException@@
.?AVCRgn@@
.?AVCScrollView@@
.?AVCSharedFile@@
.?AVCSimpleException@@
.?AVCStatic@@
.?AVCStringArray@@
.?AVCTempDC@@
.?AVCTempGdiObject@@
.?AVCTempImageList@@
.?AVCTempMenu@@
.?AVCTempWnd@@
.?AVCTestCmdUI@@
.?AVCToolTipCtrl@@
.?AVCUserException@@
.?AVCView@@
.?AVCWinApp@@
.?AVCWindowDC@@
.?AVCWinThread@@
.?AVCWnd@@
.?AVCWordArray@@
.?AVtype_info@@
.?AVXAmbientProps@COleControlSite@@
.?AVXBoundObjectSite@COleControlSite@@
.?AVXEnumVOID@CEnumArray@@
.?AVXEventSink@COleControlSite@@
.?AVXMessageFilter@COleMessageFilter@@
.?AVXNotifyDBEvents@COleControlSite@@
.?AVXOleClientSite@COleControlSite@@
.?AVXOleContainer@COleControlContainer@@
.?AVXOleControlSite@COleControlSite@@
.?AVXOleIPFrame@COleControlContainer@@
.?AVXOleIPSite@COleControlSite@@
.?AVXPropertyNotifySink@COleControlSite@@
.?AVXRowsetNotify@COleControlSite@@
<A|@<Z
B 02CV
BackColor
Bag pipe
Baritone Sax
Bassoon
bcdfghijklmnpqrstuvwxyz
BeginPaint
BeginPath
Bird Tweet
BitBlt
BKbhTb~XBK!;
Blown Bottle
 (*.BMP)|*.BMP|GIF
Bogus message code %d
Brass Section
Breath Noise
Bright Acoustic Piano
C =02CVu
CallNextHookEx
CallWindowProcA
CArchiveException
CBitmap
CBrush
CButton
CByteArray
CClientDC
CCmdTarget
CColorDialog
CColourPicker
CComboBox
c:\delus.bat
CDialog
CDWordArray
Celesta
CException
CFileDialog
CFileException
CFormView
CGdiObject
CharNextA
CharUpperA
CheckMenuItem
ChildWindowFromPointEx
Choir Aahs
ChooseColorA
CHtmlView
Church Organ
CImageList
ck(WSbpS
Clarinet
ClientToScreen
CloseClipboard
CloseDatabase
CloseHandle
ClosePrinter
CLSID\%1
CLSID\%1\AuxUserType\2
CLSID\%1\AuxUserType\3
CLSID\%1\DefaultExtension
CLSID\%1\DefaultIcon
CLSID\%1\DocObject
CLSID\%1\InprocHandler32
CLSID\%1\InProcServer32
CLSID\%1\Insertable
CLSID\%1\LocalServer32
CLSID\%1\MiscStatus
CLSID\%1\Printable
CLSID\%1\ProgID
CLSID\%1\Verb\0
CLSID\%1\Verb\1
CLSIDFromProgID
CLSIDFromString
CMapPtrToPtr
CMapStringToPtr
CMemFile
CMemoryException
CNotSupportedException
CObject
CoDisconnectObject
CoFreeUnusedLibraries
CoGetClassObject
COleBusyDialog
COleDialog
COleDispatchException
COleException
CombineRgn
combobox
ComboBox
COMBOBOX
COMCTL32.dll
COMCTL32.DLL
comdlg32.dll
commctrl_DragListMsg
commdlg_ColorOK
commdlg_FileNameOK
commdlg_help
commdlg_LBSelChangedNotify
commdlg_SetRGBColor
commdlg_ShareViolation
ComObject
CompareStringA
CompareStringW
Contrabass
Control Panel\Desktop
CopyAcceleratorTableA
CopyRect
CoRegisterMessageFilter
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CPaintDC
CPalette
CProgressCtrl
CPtrArray
CPtrList
CreateAcceleratorTableA
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDialogIndirectParamA
CreateDIBitmap
CreateEllipticRgn
CreateEventA
CreateFileA
CreateFontIndirectA
CreateIconFromResource
CreateIconFromResourceEx
CreateILockBytesOnHGlobal
CreateMenu
CreatePalette
CreatePen
CreatePolygonRgn
CreatePopupMenu
CreateProcessA
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSemaphoreA
CreateSolidBrush
CreateThread
CreateWindowExA
CResourceException
CScrollView
CSharedFile
CSplitterWnd
CStatic
CStringArray
CTempDC
CTempGdiObject
CTempImageList
CTempMenu
CTempWnd
CToolTipCtrl
Ctrl+A
Ctrl+B
Ctrl+C
Ctrl+D
Ctrl+E
Ctrl+F
Ctrl+F1
Ctrl+F10
Ctrl+F11
Ctrl+F12
Ctrl+F2
Ctrl+F3
Ctrl+F4
Ctrl+F5
Ctrl+F6
Ctrl+F7
Ctrl+F8
Ctrl+F9
Ctrl+G
Ctrl+H
Ctrl+I
Ctrl+J
Ctrl+K
Ctrl+L
Ctrl+M
Ctrl+N
Ctrl+O
Ctrl+P
Ctrl+Q
Ctrl+R
Ctrl+S
Ctrl+Shift+F1
Ctrl+Shift+F10
Ctrl+Shift+F11
Ctrl+Shift+F12
Ctrl+Shift+F2
Ctrl+Shift+F3
Ctrl+Shift+F4
Ctrl+Shift+F5
Ctrl+Shift+F6
Ctrl+Shift+F7
Ctrl+Shift+F8
Ctrl+Shift+F9
Ctrl+T
Ctrl+U
Ctrl+V
Ctrl+W
Ctrl+X
Ctrl+Y
Ctrl+Z
 (*.CUR)|*.CUR|
CUserException
CViewHtml
CWinApp
CWindowDC
CWinFormUnit
CWinThread
CWordArray
?? / %d]
D$ _^][
D$,_^]
D$,;\$|
D$(_^]
D$(_^][
D$$_^[
d09f2340818511d396f6aaf844c7e325
D$0UVW
D$0WPQ
D$ |2;
D$49D$$}
D$89Vdu
D$8RPj
D$8VPQ
D$$~9+
@.data
D$(CUSWP
 %d/%d 
(%d-%d):
%d / %d
%d / %d]
dddd, MMMM dd, yyyy
D$dPQV
D$dQUWRP
D$dSUVW
D$DSWRPQ
D$DURP
December
DEFAULT_ICON
#define _AFX_NO_OLE_RESOURCES
#define _AFX_NO_PROPERTY_RESOURCES
#define _AFX_NO_TRACKER_RESOURCES
DefWindowProcA
DeleteCriticalSection
DeleteDC
DeleteMenu
DeleteObject
DestroyAcceleratorTable
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
device
devices
D$H_^][
D$hQRP
D$hRPQ
D$hSUV3
D$hUPQ
D$HUPQ
D$HUSj
DispatchMessageA
DISPLAY
Distortion Guitar
D$(;l$ 
DllRegisterServer
DllUnregisterServer
D$LPUj
D$LUSWP
DocumentPropertiesA
D$\|oJ
DOMAIN error
D$,Pj<j
D$ PQR
D$PQRP
D$PRPQ
DPtoLP
D$(QPW
D$(QRP
D$$QUP
 DQWPht
Drawbar Organ
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIconEx
DrawTextA
D$@RPQj
D$ RPUhD
D$,RVh4
D$,SPh
D$(SUV
D$$SUV
D$TRPW
D$TVPW
Dulcimer
DuplicateHandle
D$@UPQ
|$D UV
D$@WPS
Dw=|:s
D$XPQU
D$XQRWP
;D$xt&
ech1Y%
&Edit,0,2
EditMode
EHPWVS
Electric Bass (finger)
Electric Bass (pick)
Electric Grand Piano
Electric Guitar (clean)
Electric Guitar (muted)
Electric Piano 1
Electric Piano 2
Ellipse
Embedded Object
Embed Source
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndDoc
#endif
#endif //_WIN32
EndPage
EndPaint
EndPath
English Horn
EnterCriticalSection
EnumDisplayMonitors
EnumDisplaySettingsA
eQpenc
EqualRect
Escape
E SVWP
ExcludeClipRect
ExitProcess
ExtSelectClipRgn
ExtTextOutA
F<_^][
F,_^][
F\_^][
F600363078DE49c5B10AF62C7A13B37E
F89^8u&j
F8+N,+F0
F\9~`u	
F(9V8tQ
FD@ul9L$(}f
FD uy9D$$}s
February
F(_+F$^[;E
?fff&ff23
F$@;F(v
F$@@;F(v
Fiddle
FileName
FileNameW
FileTimeToLocalFileTime
FileTimeToSystemTime
FillRect
FillRgn
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FindWindowA
F\jLSP
- floating point not loaded
FlushFileBuffers
FontName
FontSize
ForeColor
FormatMessageA
FpHt&Ht
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
French Horn
Fretless Bass
Friday
[/fS_MR
FX 1 (rain)
FX 2 (soundtrack)
FX 3 (crystal)
FX 4 (atmosphere)
FX 5 (brightness)
FX 6 (goblins)
FX 7 (echoes)
FX 8 (sci-fi)
Fxt_;FTu@
GAIsProcessorFeaturePresent
g~b1Y%
Gdi32.dll
GDI32.dll
GetACP
GetActiveWindow
GetBkColor
GetBkMode
GetCapture
GetClassInfoA
GetClassLongA
GetClassNameA
GetClientRect
GetClipboardData
GetClipBox
GetClipRgn
GetCommandLineA
GetConnectString
GetCPInfo
GetCurrentObject
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetCursorPos
GetDesktopWindow
GetDeviceCaps
GetDIBits
GetDlgCtrlID
GetDlgItem
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetFileAttributesA
GetFileSize
GetFileTime
GetFileTitleA
GetFileType
GetFocus
GetForegroundWindow
GetFullPathNameA
GetKeyState
GetLastActivePopup
GetLastError
GetLocalTime
GetMapMode
GetMenu
GetMenuCheckMarkDimensions
GetMenuItemCount
GetMenuItemID
GetMenuState
GetMessageA
GetMessagePos
GetMessageTime
GetModuleFileNameA
GetModuleHandleA
GetMonitorInfoA
GetNextDlgGroupItem
GetNextDlgTabItem
GetObjectA
GetOEMCP
GetOpenFileNameA
GetParent
GetPolyFillMode
GetProcAddress
GetProcessHeap
GetProcessVersion
GetProfileStringA
GetPropA
GetROP2
GetSaveFileNameA
GetScrollInfo
GetScrollPos
GetScrollRange
GetStartupInfoA
GetStdHandle
GetStockObject
GetStretchBltMode
GetStringTypeA
GetStringTypeW
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetSystemPaletteEntries
GetSystemTime
GetTabList
GetTextColor
GetTextExtentPoint32A
GetTextMetricsA
GetThreadLocale
GetTickCount
GetTimeZoneInformation
GetTopWindow
GetVersion
GetVersionExA
GetViewportExtEx
GetViewportOrgEx
GetVolumeInformationA
GetWindow
GetWindowDC
GetWindowExtEx
GetWindowLongA
GetWindowOrgEx
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
 (*.GIF)|*.GIF|
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFlags
GlobalFree
GlobalGetAtomNameA
GlobalHandle
__GLOBAL_HEAP_SELECTED
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
Glockenspiel
 goto Repeat
GrayStringA
Guitar Fret Noise
Guitar harmonics
Gunshot
`h````
h9n`u;
Harmonica
Harpsichord
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
Helicopter
hgjlkbrfzaoe
HHtpHHtl
H:mm:ss
Honky-tonk Piano
HrCg@b	g 
HSVHWtgHHtF
Ht#HHt
HtHHuz
http://7798k.com/
http://7799k.com/
http://feixiandao.uueasy.com
http://feixiandao.uueasy.com/index-htm-m-bbs-cateid-6.html
http://www.0419dj.com/nitian.htm
http://www.11111wg.com/nitiane.htm
http://www.11111wg.com/nitian.htm
http://www.11111wg.net/
http://www.11111wg.net/nitian.htm
http://www.3214.cn/?jueai
http://www.5213dy.com
http://www.5213dy.com/nitian.htm
http://www.5266.me/?jueai
http://www.52shanhu.com
http://www.6625.me/?jueai
http://www.6625.me/soft/Dn_YCM/1118-DnYCM.htm
http://www.6699kan.com/
http://www.66iu.com/520.html
http://www.6stv.net
http://www.6stv.net/123.html
http://www.7798k.com/gaga.htm
http://www.87dyw.com/tv/
http://www.87dyw.com/wstv
http://www.913dnf.com
http://www.913dnf.com/123.html
http://www.ewasai.com/iclk/?zoneid=91&uid=63
http://www.le6tv.com/5266.htm
http://www.le6tv.com/5266.html
http://www.le6tv.com/dj
http://www.le6tv.com/List.asp?ClassId=11
http://www.le6tv.com/tv
http://www.lelev8.net/?jueai
HtYHt6H
hWj@_;
_hypot
 (*.ICO)|*.ICO|
#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)
#ifdef _WIN32
if exist 
ImageList_Destroy
#include "l.chs\afxres.rc"          // Standard components
InflateRect
InitCommonControlsEx
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IntersectRect
InvalidateRect
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsChild
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
Italic
It#Iu%
\$\}-j
JanFebMarAprMayJunJulAugSepOctNovDec
January
jBWVSSQ
JPEGMEM
 (*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
 (*.JPG)|*.JPG|BMP
j VUPWQ
Kalimba
KERNEL32
Kernel32.dll
KERNEL32.dll
KillTimer
kXEQ>\u
^l_^][
;l$ }:
L$ ]_^
L$0PQR
L$0PQS
L$0SUV@W
L23fff&ff
L$,_^]3
L$,_[3
L$4_^3
L$4_^[d
L$4S+L$0Qj
L$4UQWP
L$4VQUP
L$4WPQR
L$4WQUVS
L$8^]_3
L$8_^][d
L$8WPQR
LANGUAGE 4, 2
LCMapStringA
LCMapStringW
L$`_^][d
L$<_^[d
L$|_^][d
L$ ^][d
L$ _^d
L$ _^][d
L$,_^][d
L$(_^][d
L$@^[d
L$@_^][d
L$$^[d
L$$^]d
L$$_^d
L$$_^]d
L$$_^][d
L$\_^][d
L$D_^[d
L$D_^][d
L$D_]d
L$DPQj
L$DSVQ
Lead 1 (square)
Lead 2 (sawtooth)
Lead 3 (calliope)
Lead 4 (chiff)
Lead 5 (charang)
Lead 6 (voice)
Lead 7 (fifths)
Lead 8 (bass + lead)
LeaveCriticalSection
l	g~b0R 
l	g~b0Rdk
L$h_^]3
L$h_^][d
L$H_^][d
L$H][d
L$$hhbJ
L$ hh|J
L$ h||J
L$Hj&Q
L$ hp|J
l$HQRVU
L$HSUVWP
L$$hXoJ
LineTo
Link Source
Link Source Descriptor
L$L_^]3
L$l_^][d
L$L^[d
L$L_^][d
	LLLLLK
L$LPQR
L$lRVQ
L$lUSVPQ
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadLibraryA
LoadResource
LoadStringA
LocalAlloc
LocalFree
LocalReAlloc
LockFile
LockResource
+ LOOP 
L$P_^d
L$P_]^[d
L$ PQh
L$@PQj
L$(PQR
L$@PQR
L$<PQVV
L$pRPQ
LPtoDP
L$(PVQ
L$ QSR
L$,RPQ
L$(RPQ
L$<RPQW
L$@RQj
L$@RUQ
L$<SQR
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
lstrlenW
L$,SUV
L$(SUV
L$T_^]
L$t_^d
L$t][d
L$T_^]d
L$T_^][d
|$LtE;
L$TSWQ
L$(UUh
\$lUV3
L$(VQRSP
L$(VQVj
l$@VW3
l$<VWj
L$ WPQ
L$(WQR
L$(WSR
L$x_^3
L$X_^]3
L$x_^d
L$x_^][d
L$X_^d
L$X;L$
L$XSQh
@;l$\~Z
Magellan MSWHEEL
mailto:
MapDialogRect
MapWindowPoints
Marimba
M/d/yy
Melodic Tom
MessageBeep
MessageBoxA
MGridCells
Microsoft Visual C++ Runtime Library
midiOutPrepareHeader
midiOutReset
midiOutUnprepareHeader
midiStreamClose
midiStreamOpen
midiStreamOut
midiStreamProperty
midiStreamRestart
midiStreamStop
 (*.MID)|*.MID|
mixerClose
mixerGetControlDetailsA
mixerGetDevCapsA
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetNumDevs
mixerOpen
mixerSetControlDetails
ModifyMenuA
Monday
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
MouseZ
MoveToEx
MoveWindow
Mpr.dll
MSH_SCROLL_LINES_MSG
MS Sans Serif
MS Shell Dlg
__MSVCRT_HEAP_SELECT
MSWHEEL_ROLLMSG
MulDiv
MultiByteToWideChar
Music Box
Muted Trumpet
n0SSSSU
N8+F,+N0
Native
-NbkSbpS
-NbkSbpS(
nd9~dt
N/f@b	g
NH_^][
Nh;NX|
-N"N1Y
N*Ncktepe
N(;N,r
N*Ntepe
N*N(W%
N*N(W0
- not enough space for arguments
- not enough space for environment
- not enough space for lowio initialization
- not enough space for _onexit/atexit table
- not enough space for stdio initialization
- not enough space for thread data
November
nt2Ht#Ht
NTRPQj
(null)
N$~	WU
NX9NXu 
Nyt2S	W	w	w
nzzpenc
O(_^][
o0SSSSU
Object Descriptor
ObjectLink
Ocarina
October
OffsetRect
OffsetViewportOrgEx
ole32.dll
OLEAUT32.dll
oledlg.dll
OleFlushClipboard
OleInitialize
OleIsCurrentClipboard
OleUninitialize
onclick
oncontextmenu
oncontrolselect
&Open,0,2
OpenClipboard
OpenDatabase
OpenPrinterA
Orchestra Hit
Orchestral Harp
O(uckHr
out.prn
Overdriven Guitar
OverWrite
OwnerLink
OX[0R 
~P9~Pun
Pad 1 (new age)
Pad 2 (warm)
Pad 3 (polysynth)
Pad 4 (choir)
Pad 5 (bowed)
Pad 6 (metallic)
Pad 7 (halo)
Pad 8 (sweep)
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD
PA#define _AFX_NO_SPLITTER_RESOURCES
Pan Flute
PatBlt
PathToRegion
.PAVCArchiveException@@
.PAVCException@@
.PAVCFileException@@
.PAVCMemoryException@@
.PAVCNotSupportedException@@
.PAVCObject@@
.PAVCOleDispatchException@@
.PAVCOleException@@
.PAVCResourceException@@
.PAVCSimpleException@@
.PAVCUserException@@
PeekMessageA
Percussive Organ
Ph_^][Y
Piccolo
P#include "afxres.h"
Pizzicato Strings
PostMessageA
PostQuitMessage
PostThreadMessageA
PPPPhd
PPPPPPPP
P<PuWSV
ppxxxx
PQj WUS
PQQQQQ
\$ PQV
#pragma code_page(936)
PreviewPages
 (*.prn)|*.prn|
Program: 
<program name unknown>
P$RWPh
~'PSQR
PtInRect
PtVisible
- pure virtual function call
\$PVUUS
PWVWWW
Q%*.*f
QPSWVR
QQSVW3
QQSVWd
QQSVWj
QQUWSS
QSUVWj
QX[gbL
RaiseException
`.rdata
ReadFile
RealizePalette
Recorder
Rectangle
RectVisible
RedrawWindow
Reed Organ
RegCloseKey
RegCreateKeyExA
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
RegOpenKeyExA
RegQueryValueA
RegQueryValueExA
RegSetValueExA
ReleaseCapture
ReleaseDC
ReleaseSemaphore
RemovePlayer
RemovePropA
:Repeat
resource.h
RestoreDC
ResumeThread
Reverse Cymbal
Rich9@
RichEdit Text and Objects
Rich Text Format
Rock Organ
RoundRect
RPCRT4.dll
|$,RPQ
RSbpS\O
RtlUnwind
runtime error 
Runtime Error!
RVPUSQ
RWh@nJ
Saturday
SaveDC
SbpS0R
SbpS@b	gu
SbpS:g:
SbpS\O
ScaleViewportExtEx
ScaleWindowExtEx
ScreenToClient
ScrollWindow
ScrollWindowEx
Seashore
SelectClipRgn
SelectObject
SelectPalette
SendDlgItemMessageA
SendMessageA
September
SetActiveWindow
SetBkColor
SetBkMode
SetCapture
SetClipboardData
SetCurrentDirectoryA
SetCursor
SetCursorPos
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetFocus
SetForegroundWindow
SetHandleCount
SetLastError
SetMapMode
SetMenu
SetMenuItemBitmaps
SetParent
SetPolyFillMode
SetPropA
SetRect
SetRectEmpty
SetROP2
SetScrollInfo
SetScrollPos
SetScrollRange
SetStdHandle
SetStretchBltMode
SetTextColor
SetTimer
Settings
SetUnhandledExceptionFilter
SetViewportExtEx
SetViewportOrgEx
SetWindowContextHelpId
SetWindowExtEx
SetWindowLongA
SetWindowOrgEx
SetWindowPos
SetWindowRgn
SetWindowsHookExA
SetWindowTextA
Shakuhachi
Shamisen
Shanai
Shell32.dll
SHELL32.dll
ShellExecuteA
Shell_NotifyIconA
\shell\open\command
Shift+F1
Shift+F10
Shift+F11
Shift+F12
Shift+F2
Shift+F3
Shift+F4
Shift+F5
Shift+F6
Shift+F7
Shift+F8
Shift+F9
ShowScrollBar
ShowWindow
SING error
Slap Bass 1
Slap Bass 2
sO;>|C;~
software
Soprano Sax
SS@SSPVSS
_SSSSU
StartDocA
StartPage
Steel Drums
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
StretchBlt
StrikeThrough
String Ensemble 1
String Ensemble 2
Subscript
Sunday
SunMonTueWedThuFriSat
Superscript
SWVVVRPV
Synth Bass 1
Synth Bass 2
SynthBrass 1
SynthBrass 2
Synth Drum
SynthStrings 1
SynthStrings 2
Synth Voice
System
SystemParametersInfoA
SysVolume
T$0PQR
T$0SUV
t2Ht*Ht"Ht
t2It*It"It
@t4Ht1Ht_Ht
T$8QRP
T$8RWj
t$ 90t
t	9A8u
t	9p$u
t&9^$t
TabbedTextOutA
Taiko Drum
Tango Accordion
T$$+D$4
tD9_Pt?
T$Dh0aJ
T$dPQR
T$DPQRW
T$DQRU
T$DQSR
T$Du	f
T$DWRh
T$\;D$Xu
Telephone Ring
Tenor Sax
TerminateProcess
TextOutA
T/f&Tcknx
<]t_G<-uA
!This program cannot be run in DOS mode.
t>Ht Ht
t*Ht"Ht
t+Ht$Ht
Thursday
T$H} VP
tI;Ftr
Timpani
Tinkle Bell
T$\jdSR
+tJHt:Ht*
TLOSS error
T$lPRh
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
t$LUPh
T$LWUQVR
tooltips_class32
T$pPQR
t$PPVS
T$(PQR
T$\PQR
T$PQRP
T$ PQWWR
T$$PRV
t$ PUSVV
tq9~Dt
tq9w(tlSj
T$(QVURWP
TranslateAcceleratorA
TranslateMessage
Tremolo Strings
tRHt}H
T$$Rhx
Trombone
T$,RQP
t%RSQP
Trumpet
t$$RVP
T$<RVW
tS9~@uN
T$ SRh
T$,SRh
t$(SSh
t#SSUP
T$ SWRP
t!< t	<
+ttHHtd
t.;t$$t(
Tubular Bells
Tuesday
T$\URP
t$$VSS
tvWWWWU
T$\WVR
t/WWUPj
 (*.txt)|*.txt|
T$XUSR
;t$Xu";\$\u
t$XWVS
?u='@^
u._^][
u29l$xu,
u"8D$yu
u]9B uX
u	9~@u
>:u#FV
uh9^8uX
u@h^vG
ujh(oJ
- unable to initialize heap
- unable to open console device
Underline
- unexpected heap error
- unexpected multithread lock error
>:uNFV
UnhandledExceptionFilter
UnhookWindowsHookEx
UnlockFile
UnregisterClassA
UpdateWindow
UQWRSP
uR9BxuM
uRFGHt
USER32
user32.dll
User32.dll
USER32.dll
u$SShe
@u+;t$
\$(UVW
ValidateRect
VC20XC00U
V#D$,WPQ
Vh;VX|
Vibraphone
Violin
VirtualAlloc
VirtualFree
Voice Oohs
VVUSVV
VVVPQR
\$<VW3
VWh^vG
V@W@PQ
V,_^[Y
W8_^][
W9^du-
WaitForInputIdle
WaitForMultipleObjects
WaitForSingleObject
WAVEfmt 
waveOutClose
waveOutGetNumDevs
waveOutOpen
waveOutPause
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite
 (*.WAV;*.MID)|*.WAV;*.MID|WAV
 (*.WAV)|*.WAV|MIDI
WebBrowser
Wednesday
	WG!2S(
WheelScrollLines
Whistle
w]h^vG
WideCharToMultiByte
window
WindowFromPoint
windows
WinExec
WinHelpA
WINMM.dll
WINSPOOL.DRV
WjdjdPQh
Wj(_Wj
Woodblock
|$$}$WP
(wqt\HHtS
WriteFile
WritePrivateProfileStringA
WS2_32.dll
wsprintfA
WTWindow
|$@ Wu
"WWShX
www.3344dnf.com/wuye1.html
www.52shanhu.com/1.htm
www.52shanhu.com/jueai.htm
www.66iu.com/wuye.html
www.87dyw.com
www.955wl.com
www.955wl.com/123.html
www.dnfxq.com//
www.sqiba.com/
wwwwww
Xylophone
XY[Z[]
YHYtLHt9
YX[(W	
_^][YY
Zt(Ht Ht
|z;^<}uWS