MD5: dbbf9b4c36f9c74a4ba7436108683ef7
SHA1: f4c57429c024610bea504b9e673751b8c1bbc484
SHA256: 2f4c49d8f02cfefcf8b0200bf01e7e299136664a3051abc7bcff0562c7075eba
SSDeep: 98304:XmVQU/se1aO8bC2W7UJCc5Z88NYRBNOy4V5SJBAUZLBn5DunlQ:XmVQ9e112WLc6LmIJVVnYlQ
Size: 8098816 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, ACProtect141
Company: no certificate found
Created at: 1992-06-20 01:22:17
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

No specific payload has been found.

Process activity

The MemScan creates the following process(es):

%original file name%.exe:1388

The MemScan injects its code into the following process(es):

Steamhack.exe:1196
STEAMGODBOG.exe:244

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process Steamhack.exe:1196 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\PSE11\php\modules\php_bcompiler.dll (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\devels\28f5b52c27c2ce4c97f1ff1919e090bf.phpe2 (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PSE11\28F5B52C27C2CE4C97F1FF1919E090BF\php.ini (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\devels\28f5b52c27c2ce4c97f1ff1919e090bf\engine.php (10216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PSE11\php\modules\php_bz2.dll (69 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PSE11\php\php5ts.dll (34007 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\57295517.~ph (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\devels\28f5b52c27c2ce4c97f1ff1919e090bf\include.php (80 bytes)

The MemScan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\57295517.~ph (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PSE11\28F5B52C27C2CE4C97F1FF1919E090BF (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\PSE11\28F5B52C27C2CE4C97F1FF1919E090BF\php.ini (0 bytes)

The process STEAMGODBOG.exe:244 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%System%\drivers\etc\hosts (34 bytes)

The process %original file name%.exe:1388 makes changes in the file system.
The MemScan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\msvcr71.dll (167 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Steamhack.exe (47888 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\STEAMGODBOG.exe (3847 bytes)

Registry activity

The process Steamhack.exe:1196 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "85 2E 28 EA 66 3D 33 C6 2A FE B6 C1 8D 63 97 B3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

The process STEAMGODBOG.exe:244 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B C3 2B 35 E6 74 1F AE BA 47 9F F3 EC D9 09 4D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Firewall notifications are enabled:

"DisableNotifications" = "0"

The process %original file name%.exe:1388 makes changes in the system registry.
The MemScan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C7 32 FF A5 79 32 25 3F 0D 3E 8B 97 30 4D 31 3D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"Steamhack.exe" = "Steamhack"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"STEAMGODBOG.exe" = "Remote Service Application"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

The MemScan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The MemScan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The MemScan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Dropped PE files

HOSTS file anomalies

The MemScan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses.
The modified file is 34 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Valve Corporation
Product Name: Steam Client Bootstrapper
Product Version: 01.00.00.01
Legal Copyright: Copyright (C) 2010 Valve Corporation
Legal Trademarks:
Original Filename: steam.exe
Internal Name: steamcmd (buildbot_steam-rel-win32-builder_steam_rel_client_win32@steam-rel-win32-builder)
File Version: 02.58.33.56
File Description: Steam Client Bootstrapper
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

No activity has been detected.

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

Web Traffic was not found.

The MemScan connects to the servers at the folowing location(s):

.text

`.itext

`.data

.idata

.rdata

@.reloc

B.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

%s_%d

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

%s, ClassID: %s

%s, ProgID: "%s"

ole32.dll

USER32.DLL

uxtheme.dll

DWMAPI.DLL

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

comctl32.dll

AutoHotkeysd-C

AutoHotkeys

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDownL

OnKeyPress

OnKeyUpH

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.Top

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

Uh.ID

User32.dll

TKeyEvent

TKeyPressEvent

HelpKeyword nA

crSQLWait

%s (%s)

imm32.dll

TSocketPort

%d.%d.%d.%d

0.0.0.0

PSAPI.dll

TDCWebCam

127.0.0.1

BuildImportTable: can't load library:

BuildImportTable: ReallocMemory failed

BuildImportTable: GetProcAddress failed

BTMemoryLoadLibary: BuildImportTable failed

BTMemoryGetProcAddress: no export table found

BTMemoryGetProcAddress: DLL doesn't export anything

BTMemoryGetProcAddress: exported symbol not found

1.2.3

127.0.0.1:1604

#KCMDDC51#-

5.3.0

cmd.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

hkey

\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

*.torrent

\Internet Explorer\iexplore.exe

explorer.exe

wlanapi.dll

80211_SHARED_KEY

user32.dll

TUploadFTP

notepad.exe

KEYNAME

%ShortCut#

RELATEDCMD

ping 127.0.0.1 -n 4 > NUL && "

DRKey

CRKey

DelMSKey

InstallHKEY

ActiveOnlineKeylogger

UnActiveOnlineKeylogger

KeylogOn

ActiveOfflineKeylogger

UnActiveOfflineKeylogger

ActiveOnlineKeyStrokes

UnActiveOnlineKeyStrokes

OpenWebPage

tmpprint.txt

URLUpdate

MSGBOX

#BOT#VisitUrl

#BOT#OpenUrl

HTTP://

hXXp://

BTRESULTOpen URL|

Command successfully executed!|

#BOT#URLUpdate

BTERRORUpdate from URL| Error on downloading file check if you type the correct url...|

BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|

#BOT#URLDownload

GetActivePorts

out.txt

tmp.txt

DDOSHTTPFLOOD

DDOSUDPFLOOD

%IPPORTSCAN

SAPI.SpVoice

WEBCAMLIVE

WEBCAMSTOP

PASSWORD

FTPFILEUPLOAD

URLDOWNLOADTOFILE

UPLOADEXEC

UPANDEXEC

FTPPORT

FTPPASS

FTPUSER

FTPHOST

FTPROOT

FTPUPLOADK

FTPSIZE

BTRESULTUDP Flood|UDP Flood task finished!|

PortScanAdd

BTRESULTVisit URL|finished to visit

BTERRORVisit URL|An exception occured in the thread|

POST /index.php/1.0

BTRESULTHTTP Flood|Http Flood task finished!|

Mozilla

BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|

BTERRORDownload File| Error on downloading file check if you type the correct url...|

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows NT\CurrentVersion\Winlogon

ERR|Cannot listen to port, try another one..|

TCaptureWebcam

taskmgr.exe

\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

DC3_FEXEC

Windows NT 4.0

Windows 2000

Windows XP

Windows Server 2003

Windows Vista

Windows 7

Windows 95

Windows 98

Windows Me

S-%u-

FAKEMSG

MSGICON

MSGTITLE

MSGCORE

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

%Documents and Settings%\%current user%\Application Data\dclogs\2015-06-10-4.dc

advapi32.dll

RegOpenKeyExA

RegCloseKey

GetKeyboardType

keybd_event

VkKeyScanA

UnhookWindowsHookEx

SetWindowsHookExA

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

ExitWindowsEx

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

version.dll

WinExec

PeekNamedPipe

GetWindowsDirectoryA

GetProcessHeap

GetCPInfo

CreatePipe

RegQueryInfoKeyA

RegOpenKeyA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

RegCreateKeyA

wsock32.dll

shell32.dll

ShellExecuteExA

ShellExecuteA

SHFileOperationA

URLMON.DLL

URLDownloadToFileA

wininet.dll

InternetOpenUrlA

HttpQueryInfoA

FtpPutFileA

winmm.dll

netapi32.dll

gdiplus.dll

GdiplusShutdown

msacm32.dll

ntdll.dll

WS2_32.DLL

SHFolder.dll

SHELL32.DLL

AVICAP32.DLL

1!1,1=1|1

6 6$6(6,606

=!=$=)=-=1=

01m1

0 0$0(0,0004080<0@0

<!=$=)=-=4=

;"<?<_<|<

; ;$;(;,;0;4;8;<;@;

7 8$888<8

= =$=(=,=0=4=8=

UntKeylogger

KWindows

UntActivePorts

UntControlKey

UntCaptureWebcam

UntWebCam

UrlMon

(UntUploadFTPThread

UntFTP

_UntUDPFlood

YUntScanPorts

0UntPasswordAndData

XUntHTTPFlood

UntCPU

66006666

No help found for %s#No context-sensitive help installed

No help found for context$No topic-based help system installedNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Invalid clipboard format Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Not enough timers available@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Unsupported clipboard format

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Invalid stream format$''%s'' is not a valid component name

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

No argument for format '%s'"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Operation not supported

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

!'%s' is not a valid integer value('%s' is not a valid floating point value!'%s' is not a valid date and time

'%s' is not a valid GUID value

I/O error %d

1, 0, 0, 1

MSRSAAP.EXE

4, 0, 0, 0

Steamhack.exe_1196:

.text

`.itext

`.data

.idata

.edata

@.tls

.rdata

@.reloc

B.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

%s[%d]

%s_%d

.Owner

USER32.DLL

comctl32.dll

TaskDialogIndirect

EInvalidGraphicOperation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes

uxtheme.dll

DWMAPI.DLL

shell32.dll

PasswordChar@YF

OnKeyDown

OnKeyPress

OnKeyUp

ssHorizontal

OnKeyUp`

Uhz%D

poPortrait

windows

clWebSnow

clWebFloralWhite

clWebLavenderBlush

clWebOldLace

clWebIvory

clWebCornSilk

clWebBeige

clWebAntiqueWhite

clWebWheat

clWebAliceBlue

clWebGhostWhite

clWebLavender

clWebSeashell

clWebLightYellow

clWebPapayaWhip

clWebNavajoWhite

clWebMoccasin

clWebBurlywood

clWebAzure

clWebMintcream

clWebHoneydew

clWebLinen

clWebLemonChiffon

clWebBlanchedAlmond

clWebBisque

clWebPeachPuff

clWebTan

clWebYellow

clWebDarkOrange

clWebRed

clWebDarkRed

clWebMaroon

clWebIndianRed

clWebSalmon

clWebCoral

clWebGold

clWebTomato

clWebCrimson

clWebBrown

clWebChocolate

clWebSandyBrown

clWebLightSalmon

clWebLightCoral

clWebOrange

clWebOrangeRed

clWebFirebrick

clWebSaddleBrown

clWebSienna

clWebPeru

clWebDarkSalmon

clWebRosyBrown

clWebPaleGoldenrod

clWebLightGoldenrodYellow

clWebOlive

clWebForestGreen

clWebGreenYellow

clWebChartreuse

clWebLightGreen

clWebAquamarine

clWebSeaGreen

clWebGoldenRod

clWebKhaki

clWebOliveDrab

clWebGreen

clWebYellowGreen

clWebLawnGreen

clWebPaleGreen

clWebMediumAquamarine

clWebMediumSeaGreen

clWebDarkGoldenRod

clWebDarkKhaki

clWebDarkOliveGreen

clWebDarkgreen

clWebLimeGreen

clWebLime

clWebSpringGreen

clWebMediumSpringGreen

clWebDarkSeaGreen

clWebLightSeaGreen

clWebPaleTurquoise

clWebLightCyan

clWebLightBlue

clWebLightSkyBlue

clWebCornFlowerBlue

clWebDarkBlue

clWebIndigo

clWebMediumTurquoise

clWebTurquoise

clWebCyan

clWebPowderBlue

clWebSkyBlue

clWebRoyalBlue

clWebMediumBlue

clWebMidnightBlue

clWebDarkTurquoise

clWebCadetBlue

clWebDarkCyan

clWebTeal

clWebDeepskyBlue

clWebDodgerBlue

clWebBlue

clWebNavy

clWebDarkViolet

clWebDarkOrchid

clWebMagenta

clWebDarkMagenta

clWebMediumVioletRed

clWebPaleVioletRed

clWebBlueViolet

clWebMediumOrchid

clWebMediumPurple

clWebPurple

clWebDeepPink

clWebLightPink

clWebViolet

clWebOrchid

clWebPlum

clWebThistle

clWebHotPink

clWebPink

clWebLightSteelBlue

clWebMediumSlateBlue

clWebLightSlateGray

clWebWhite

clWebLightgrey

clWebGray

clWebSteelBlue

clWebSlateBlue

clWebSlateGray

clWebWhiteSmoke

clWebSilver

clWebDimGray

clWebMistyRose

clWebDarkSlateBlue

clWebDarkSlategray

clWebGainsboro

clWebDarkGray

clWebBlack

msimg32.dll

Proportional

OnExecute$

{43826d1e-e718-42ee-bc55-a1e261c37bfe}

%s%s%s%s%s%s%s%s%s%s

AutoHotkeysXOF

AutoHotkeys

\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreviewx

WindowState

tagMSG

GlassFrame.Bottom

GlassFrame.Enabled

GlassFrame.Left

GlassFrame.Right

GlassFrame.SheetOfGlass

GlassFrame.Top

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

User32.dll

%s not found

zend_hash_del_key_or_index

zend_hash_get_current_key_ex

zend_hash_get_current_key_type_ex

zend_get_executed_filename

php_execute_script

php_url_free

php_url_parse

php_url_decode

php_raw_url_decode

php_url_encode

php_raw_url_encode

TPHPExecute

OnExecute

phpfunction%d

Duplicate function name: %s

Param%d

ReportDLLErrorT

BeforeExecute`

AfterExecute

MaxExecutionTimeX

Variables support

Constants support

Classes support

hXXp://users.chello.be/ws36637

Returns the drive portion of a file name.

Returns the extension portions of a file name.

Returns Windows system directory

%s: %s in %s on line %d

File %s does not exists

<? %s ?>

application/x-www-form-urlencoded

max_execution_time

Wrong parameter type for %s()

php5ts.dll

MAPI32.DLL

msShiftSelect

OnKeyUp(

ArrowKeys

THKInvalidKey

THKInvalidKeys

TCustomHotKey

TCustomHotKeyX

THotKey

HotKey

InvalidKeys`

vsReport

acoUpDownKeyDropsList

RICHED32.DLL

msctls_hotkey32

%s.%.8X:%.8X

TComboBoxExEnumerator

ole32.dll

OnKeyDownl

TSizeCtrl.Create: Owner must be a TWinControl

%s_%s

TExeStream

OnActionExecute

LeftPopup

EInvalidGridOperation

goAlwaysShowEditor

%s, ClassID: %s

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

support

TMonochromeLookup

E:\Projects\Multimedia\Mess Box PHP\GifImage.pas

1.2.3

Uh.cT

olepro32.dll

IWebBrowser

IWebBrowserAppL

IWebBrowser2

TWebBrowserStatusTextChange

TWebBrowserProgressChange

TWebBrowserCommandStateChange

TWebBrowserTitleChange

TWebBrowserPropertyChange

TWebBrowserBeforeNavigate2

TWebBrowserNewWindow2

TWebBrowserNavigateComplete2

TWebBrowserDocumentComplete

TWebBrowserOnVisible

TWebBrowserOnToolBar

TWebBrowserOnMenuBar

TWebBrowserOnStatusBar

TWebBrowserOnFullScreen

TWebBrowserOnTheaterMode

TWebBrowserWindowSetResizable

TWebBrowserWindowSetLeft

TWebBrowserWindowSetTop

TWebBrowserWindowSetWidth

TWebBrowserWindowSetHeight

TWebBrowserWindowClosing

TWebBrowserClientToHostWindow

TWebBrowserSetSecureLockIcon

TWebBrowserFileDownload

TWebBrowserNavigateError

%TWebBrowserPrintTemplateInstantiation

TWebBrowserPrintTemplateTeardown

TWebBrowserUpdatePageStatus

%TWebBrowserPrivacyImpactedStateChange

TWebBrowser

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetTop\

OnWindowSetWidth

OnWindowSetHeight

x_include.pse

$PHPSOULENGINE\inc.php

HotKey::event(

PSAPI.dll

_ExeMod

_WebBrowser

PHPLibraryFunctions0Execute

PHPLibraryFunctions4Execute"

PHPLibraryFunctions5Execute

libFormsFunctions0Execute

libFormsFunctions1Execute"

PHPLibraryFunctions3Execute"

PHPLibraryFunctions6Execute

libFormsFunctions2Execute

gui_eventsFunctions0Execute"

gui_eventsFunctions1Execute"

gui_eventsFunctions2Execute

guiFunctions4Execute

guiFunctions3Execute"

PHPLibraryFunctions7Execute"

PHPLibraryFunctions1Execute

guiFunctions5Execute

ScreenFunctions0Execute!

libScreenFunctions1Execute!

libScreenFunctions2Execute

libFormsFunctions3Execute

guiFunctions7Execute&

libApplicationFunctions0Execute&

libApplicationFunctions1Execute&

libApplicationFunctions2Execute&

libApplicationFunctions3Execute&

libApplicationFunctions4Execute"

libDialogsFunctions0Execute&

libApplicationFunctions5Execute

guiFunctions8Execute

guiFunctions9Execute

winApiFunctions0Execute

winApiFunctions1Execute"

PHPLibraryFunctions2Execute"

PHPLibraryFunctions8Execute#

TStringsLibFunctions0Execute#

TStringsLibFunctions1Execute#

TStringsLibFunctions2Execute"

PHPLibraryFunctions9Execute"

TStreamLibFunctions0Execute"

TStreamLibFunctions1Execute"

TStreamLibFunctions2Execute"

TStreamLibFunctions3Execute"

TStreamLibFunctions4Execute"

TStreamLibFunctions5Execute"

TStreamLibFunctions6Execute"

TStreamLibFunctions7Execute"

TStreamLibFunctions8Execute"

TStreamLibFunctions9Execute#

TStreamLibFunctions10Execute#

TStreamLibFunctions11Execute#

TStreamLibFunctions12Execute#

TStreamLibFunctions13Execute

winApiFunctions2Execute#

PHPLibraryFunctions10Execute!

idHTTPLibFunctions1Execute

guiFunctions10Execute#

TPictureLibFunctions0Execute#

TPictureLibFunctions1Execute#

TPictureLibFunctions2Execute#

TPictureLibFunctions3Execute#

TPictureLibFunctions4Execute!

TSizeCtrlFunctions0Execute!

TSizeCtrlFunctions1Execute!

TSizeCtrlFunctions2Execute!

TSizeCtrlFunctions3Execute

libScreenFunctions0Execute"

TImageListFunctions0Execute"

TImageListFunctions1Execute"

TImageListFunctions2Execute"

TImageListFunctions3Execute#

TPictureLibFunctions5Execute#

TPictureLibFunctions6Execute#

TPictureLibFunctions7Execute#

TPictureLibFunctions8Execute#

TPictureLibFunctions9Execute#

TStreamLibFunctions14Execute#

TStreamLibFunctions15Execute#

TStreamLibFunctions16Execute&

libApplicationFunctions6Execute&

libApplicationFunctions7Execute#

TStreamLibFunctions17Execute#

TStreamLibFunctions18Execute"

TImageListFunctions4Execute

libFormsFunctions4Execute"

_TSizeCtrlFunctions4Execute#

PHPLibraryFunctions11Execute"

_TSizeCtrlFunctions5Execute"

_TSizeCtrlFunctions6Execute"

_TSizeCtrlFunctions7Execute

guiFunctions6Execute!

_RegistryFunctions0Execute!

_RegistryFunctions1Execute

OSApiFunctions0Execute

OSApiFunctions1Execute

OSApiFunctions2Execute

OSApiFunctions3Execute

OSApiFunctions4Execute

OSApiFunctions5Execute

OSApiFunctions6Execute

libFormsFunctions5Execute#

PHPLibraryFunctions12Execute#

PHPLibraryFunctions13Execute

winApiFunctions3Execute"

_TSizeCtrlFunctions8Execute"

_TSizeCtrlFunctions9Execute#

PHPLibraryFunctions14Execute#

PHPLibraryFunctions15Execute

_MenusFunctions0Execute

_MenusFunctions1Execute

_MenusFunctions2Execute

_MenusFunctions3Execute

_MenusFunctions4Execute

_MenusFunctions5Execute

_MenusFunctions6Execute

libFormsFunctions6Execute#

PHPLibraryFunctions16Execute!

libScreenFunctions3Execute!

libScreenFunctions4Execute

_MenusFunctions7Execute#

PHPLibraryFunctions17Execute

libFormsFunctions7Execute

_ExeModFunctions0Execute

_ExeModFunctions1Execute

_ExeModFunctions2Execute

_ExeModFunctions3Execute

_ExeModFunctions4Execute

_ExeModFunctions5Execute

OSApiFunctions7Execute

OSApiFunctions8Execute#

PHPLibraryFunctions18Execute#

PHPLibraryFunctions19Execute#

PHPLibraryFunctions20Execute#

PHPLibraryFunctions21Execute#

PHPLibraryFunctions22Execute#

PHPLibraryFunctions23Execute#

PHPLibraryFunctions24Execute$

_TStreamLibFunctions19Execute

_ExeModFunctions6Execute

_ExeModFunctions7Execute

OSApiFunctions9Execute#

PHPLibraryFunctions25Execute%

_TPictureLibFunctions10Execute#

PHPLibraryFunctions26Execute#

PHPLibraryFunctions27Execute

_TListsFunctions0Execute

_TListsFunctions1Execute#

PHPLibraryFunctions28Execute#

PHPLibraryFunctions29Execute#

PHPLibraryFunctions30Execute

_TListsFunctions2Execute#

_TImageListFunctions5Execute

_MenusFunctions8Execute%

_TPictureLibFunctions11Execute#

PHPLibraryFunctions31Execute

_TListsFunctions3Execute

_TListsFunctions4Execute#

_TImageListFunctions6Execute#

_TImageListFunctions7Execute#

_TImageListFunctions8Execute#

_TImageListFunctions9Execute$

_TImageListFunctions10Execute

_MenusFunctions9Execute&

libApplicationFunctions8Execute

OSApiFunctions10Execute

OSApiFunctions11Execute

OSApiFunctions12Execute

_TListsFunctions5Execute

OSApiFunctions13Execute!

_TSynEditFunctions0Execute!

_TSynEditFunctions1Execute!

_TSynEditFunctions2Execute!

_TSynEditFunctions3Execute!

_TSynEditFunctions4Execute

_TListsFunctions6Execute

OSApiFunctions14Execute

OSApiFunctions15Execute#

PHPLibraryFunctions33Execute

libFormsFunctions8Execute#

PHPLibraryFunctions34Execute#

PHPLibraryFunctions35Execute

OSApiFunctions16Execute

OSApiFunctions17Execute&

libApplicationFunctions9Execute#

_TSizeCtrlFunctions10Execute#

PHPLibraryFunctions36Execute%

_TPictureLibFunctions12Execute%

_TPictureLibFunctions13Execute#

PHPLibraryFunctions37Execute

_MenusFunctions10Execute

_MenusFunctions11Execute#

PHPLibraryFunctions38Execute#

PHPLibraryFunctions39Execute

_CanvasFunctions0Execute

_CanvasFunctions1Execute

_CanvasFunctions2Execute%

_TPictureLibFunctions14Execute%

_TPictureLibFunctions15Execute%

_TPictureLibFunctions16Execute#

PHPLibraryFunctions40Execute#

PHPLibraryFunctions41Execute

OSApiFunctions18Execute

OSApiFunctions19Execute

OSApiFunctions20Execute

OSApiFunctions21Execute"

libDialogsFunctions1Execute%

_TPictureLibFunctions17Execute#

PHPLibraryFunctions42Execute#

PHPLibraryFunctions43Execute#

PHPLibraryFunctions44Execute#

_WebBrowserFunctions0Execute#

_WebBrowserFunctions1Execute#

_WebBrowserFunctions2Execute#

_WebBrowserFunctions3Execute#

_WebBrowserFunctions5Execute#

_WebBrowserFunctions4Execute#

_WebBrowserFunctions6Execute#

_WebBrowserFunctions7Execute

OSApiFunctions22Execute$

_TStreamLibFunctions20Execute%

_TPictureLibFunctions18Execute#

PHPLibraryFunctions45Execute#

PHPLibraryFunctions46Execute

OSApiFunctions23Execute

OSApiFunctions24Execute#

_TSizeCtrlFunctions11Execute#

_TSizeCtrlFunctions12Execute$

_TStringGridFunctions0Execute$

_TStringGridFunctions1Execute$

_TStringGridFunctions2Execute$

_TStringGridFunctions3Execute$

_TStringGridFunctions4Execute$

_TStringGridFunctions5Execute$

_TStringGridFunctions6Execute

_CanvasFunctions3Execute

_CanvasFunctions4Execute

_CanvasFunctions5Execute

_CanvasFunctions6Execute

_CanvasFunctions7Execute

_CanvasFunctions8Execute

_CanvasFunctions9Execute

_CanvasFunctions10Execute

_CanvasFunctions11Execute

_CanvasFunctions12Execute

_CanvasFunctions13Execute

_CanvasFunctions14Execute

_CanvasFunctions15Execute

_CanvasFunctions16Execute

_CanvasFunctions17Execute

_CanvasFunctions18Execute

_CanvasFunctions19Execute

_CanvasFunctions20Execute

_MenusFunctions12Execute#

PHPLibraryFunctions47Execute#

PHPLibraryFunctions48Execute#

_BackWorkerFunctions1Execute#

_BackWorkerFunctions2Execute#

_BackWorkerFunctions3Execute#

_BackWorkerFunctions0Execute#

_BackWorkerFunctions4Execute#

_BackWorkerFunctions5Execute#

_BackWorkerFunctions6Execute!

_TSynEditFunctions5Execute!

_TSynEditFunctions6Execute#

PHPLibraryFunctions50Execute#

_WebBrowserFunctions8Execute#

_WebBrowserFunctions9Execute$

_WebBrowserFunctions10Execute!

_TSynEditFunctions7Execute!

_TSynEditFunctions8Execute!

_TSynEditFunctions9Execute"

_TSynEditFunctions10Execute#

PHPLibraryFunctions51Execute#

PHPLibraryFunctions52Execute#

PHPLibraryFunctions53Execute"

_TSynEditFunctions11Execute

guiFunctions11Execute

guiFunctions12Execute#

PHPLibraryFunctions54Execute#

PHPLibraryFunctions55Execute#

_BackWorkerFunctions7Execute#

_BackWorkerFunctions9Execute#

PHPLibraryFunctions56Execute#

PHPLibraryFunctions57Execute"

_TSynEditFunctions12Execute"

_TSynEditFunctions13Execute"

_TSynEditFunctions14Execute"

_TSynEditFunctions15Execute

winApiFunctions4Execute

winApiFunctions5Execute"

_TSynEditFunctions16Execute"

_TSynEditFunctions17Execute"

_TSynEditFunctions18Execute"

_TSynEditFunctions19Execute"

_TSynEditFunctions20Execute"

_TSynEditFunctions21Execute"

_TSynEditFunctions22Execute"

_TSynEditFunctions23Execute

_MenusFunctions13Execute

_MenusFunctions14Execute

_MenusFunctions15Execute

_MenusFunctions16Execute

_MenusFunctions17Execute

_ExeModFunctions8Execute

_ExeModFunctions9Execute%

_TPictureLibFunctions19Execute$

_TStreamLibFunctions21Execute$

_TStreamLibFunctions22Execute$

_TStreamLibFunctions23Execute$

_TStreamLibFunctions24Execute$

_WebBrowserFunctions11Execute$

_WebBrowserFunctions12Execute$

_WebBrowserFunctions13Execute$

_WebBrowserFunctions14Execute

_TTreeFunctions0Execute

_TTreeFunctions1Execute

_TTreeFunctions2Execute

_TTreeFunctions3Execute#

PHPLibraryFunctions58Execute

_TTreeFunctions4Execute

_TTreeFunctions5Execute

_TTreeFunctions6Execute

_TTreeFunctions7Execute

OSApiFunctions25Execute"

libDialogsFunctions2Execute$

_BackWorkerFunctions10Execute$

_BackWorkerFunctions11Execute$

_BackWorkerFunctions12Execute$

_BackWorkerFunctions13Execute$

_BackWorkerFunctions14Execute$

_BackWorkerFunctions15Execute$

_BackWorkerFunctions16Execute$

_BackWorkerFunctions17Execute$

_BackWorkerFunctions18Execute$

_BackWorkerFunctions19Execute$

_BackWorkerFunctions20Execute$

_BackWorkerFunctions21Execute

_SkinsFunctions0Execute

_SkinsFunctions1Execute#

PHPLibraryFunctions59Execute#

_TSizeCtrlFunctions13Execute#

PHPLibraryFunctions60Execute#

PHPLibraryFunctions61Execute$

_TStringsLibFunctions3Execute$

_TStringsLibFunctions4Execute$

_TStringsLibFunctions5Execute'

libApplicationFunctions10Execute'

libApplicationFunctions11Execute#

PHPLibraryFunctions62Execute

guiFunctions13Execute$

_WebBrowserFunctions15Execute

OSApiFunctions26Execute$

_BackWorkerFunctions22Execute#

PHPLibraryFunctions63Execute

OSApiFunctions27Execute

_DockingFunctions0Execute

_DockingFunctions1Execute

_DockingFunctions2Execute

_DockingFunctions3Execute

_DockingFunctions4Execute

_DockingFunctions5Execute

_DockingFunctions6Execute

_DockingFunctions7Execute

_DockingFunctions8Execute

_DockingFunctions9Execute!

_DockingFunctions10Execute

libFormsFunctions9Execute!

_DockingFunctions11Execute!

_DockingFunctions12Execute%

_TPictureLibFunctions20Execute

OSApiFunctions28Execute!

_DockingFunctions13Execute"

__WinUtilsFunctions0Execute"

__WinUtilsFunctions1Execute"

__WinUtilsFunctions2Execute#

PHPLibraryFunctions64Execute#

PHPLibraryFunctions65Execute

OSApiFunctions29Execute

OSApiFunctions30Execute

OSApiFunctions31Execute

OSApiFunctions32Execute

OSApiFunctions33Execute

guiFunctions14Execute

guiFunctions15Execute

guiFunctions16Execute

guiFunctions17Execute"

_TSynEditFunctions24Execute"

_TSynEditFunctions25Execute"

__WinUtilsFunctions3Execute#

PHPLibraryFunctions66Execute#

PHPLibraryFunctions67Execute

UhB%U

hint.pause

hint.hidepause

hint.shortpause

hint.color

createkey

closekey

deletekey

hassubkeys

loadkey

keyexists

openkey

openkeyreadonly

restorekey

savekey

unloadkey

currentkey

rootkey

!$$@!#!5

onKeyDown

onKeyUp

onKeyEnter

'."<".chr(

OnKeyEnter

ONKEYDOWN

ONKEYUP

ONKEYPRESS

\include.php

logo.png

code.php

\php\php5ts.dll

\php.ini

include.php

\php5ts.dll

Portable Network Graphics

deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly

inflate 1.2.3 Copyright 1995-2005 Mark Adler

advapi32.dll

RegOpenKeyExA

RegCloseKey

user32.dll

GetKeyboardType

keybd_event

VkKeyScanA

UnregisterHotKey

UnhookWindowsHookEx

SetWindowsHookExA

SetKeyboardState

RegisterHotKey

MsgWaitForMultipleObjects

MapVirtualKeyA

LoadKeyboardLayoutA

GetKeyboardState

GetKeyboardLayoutNameA

GetKeyboardLayoutList

GetKeyboardLayout

GetKeyState

GetKeyNameTextA

GetAsyncKeyState

ExitWindowsEx

EnumWindows

EnumThreadWindows

EnumChildWindows

ActivateKeyboardLayout

gdi32.dll

SetViewportOrgEx

SetViewportExtEx

version.dll

GetCPInfo

RegUnLoadKeyA

RegSaveKeyA

RegRestoreKeyA

RegQueryInfoKeyA

RegLoadKeyA

RegFlushKey

RegEnumKeyExA

RegDeleteKeyA

RegCreateKeyExA

URLMON.DLL

UrlMkSetSessionOption

ShellExecuteA

winspool.drv

comdlg32.dll

msvcrt.dll

wsock32.dll

winmm.dll

soulEngine.exe

4"474$585

9 9$9(9,9094989<9@9`9

; ;$;(;,;0;4;8;<;@;\;|;

6#7'7 7/777|7

1 1$1(1,1014181<1@1

4L4O4Z4d4n4}4

:!:%:8:@:`:

5'5 5>5`5

; ;$;(;,;0;4;8;<;@;

=#=(=2=8=@=

>'>1>@>~>

: :$:(:,:0:4:8:<:@:^:

8!8%8)8-8185898=8

;*;4;>;|;

4&5^5(6@7

> >$>(>,>0>4>8>

707?7[7|7

6 6,696=6

<&>0>:>?>

6%7U7e7

2)3-35393@3

4!4B4S4e4t4

1"1&1*1.1

78{8

8 8$8(8,8

1-2q4

7%8s8

0%0U0c0

0&0<0`0}0

2-3I3}3

<"<'<,<9<><[<

333333333333333333

33333833

3333339

3333333333333338

:*"*"$3338

3333333

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

33333333330

3333338

3333333330

3333833330

3333330

333333330

3333333333

338333?330

33383?3330

3833830

%%%X(((

KWindows

UrlMon

 IdTCPServer

IdTCPConnection

IdTCPStream

PHPLibraryFunctions2Execute

PHPLibraryFunctions3Execute

PHPLibraryFunctions4Execute

PHPLibraryFunctions5Execute

PHPLibraryFunctions6Execute

PHPLibraryFunctions7Execute

PHPLibraryFunctions8Execute

PHPLibraryFunctions9Execute

PHPLibraryFunctions10Execute

PHPLibraryFunctions11Execute

PHPLibraryFunctions12Execute

PHPLibraryFunctions14Execute

PHPLibraryFunctions16Execute

PHPLibraryFunctions17Execute

control_helpkeyword

PHPLibraryFunctions18Execute

PHPLibraryFunctions19Execute

PHPLibraryFunctions20Execute

PHPLibraryFunctions21Execute

PHPLibraryFunctions22Execute

PHPLibraryFunctions23Execute

PHPLibraryFunctions24Execute

PHPLibraryFunctions25Execute

PHPLibraryFunctions26Execute

PHPLibraryFunctions28Execute

PHPLibraryFunctions29Execute

PHPLibraryFunctions33Execute

PHPLibraryFunctions34Execute

PHPLibraryFunctions36Execute

PHPLibraryFunctions38Execute

PHPLibraryFunctions40Execute

PHPLibraryFunctions42Execute

PHPLibraryFunctions43Execute

PHPLibraryFunctions44Execute

PHPLibraryFunctions45Execute

PHPLibraryFunctions47Execute

PHPLibraryFunctions48Execute

PHPLibraryFunctions50Execute

scrollbox_vsshowing

PHPLibraryFunctions51Execute

scrollbox_hsshowing

PHPLibraryFunctions52Execute

PHPLibraryFunctions53Execute

PHPLibraryFunctions54Execute

PHPLibraryFunctions55Execute

PHPLibraryFunctions56Execute

PHPLibraryFunctions57Execute

PHPLibraryFunctions59Execute

PHPLibraryFunctions60Execute

PHPLibraryFunctions61Execute

PHPLibraryFunctions64Execute

PHPLibraryFunctions66Execute

gui_eventsFunctions0Execute

gui_eventsFunctions1Execute

guiFunctions3Execute

guiFunctions6Execute

guiFunctions7Execute

guiFunctions10Execute

guiFunctions12Execute

guiFunctions13Execute

guiFunctions17Execute

libFormsFunctions0Execute

libFormsFunctions4Execute

libFormsFunctions5Execute

libFormsFunctions6Execute

libFormsFunctions8Execute

libFormsFunctions9Execute

libScreenFunctions0Execute

libScreenFunctions1Execute

libScreenFunctions2Execute

libScreenFunctions3Execute

libApplicationFunctions0Execute

libApplicationFunctions1Execute

libApplicationFunctions2Execute

libApplicationFunctions3Execute

libApplicationFunctions4Execute

libApplicationFunctions6Execute

libApplicationFunctions7Execute

libApplicationFunctions9Execute

libApplicationFunctions10Execute

libApplicationFunctions11Execute

dialog_execute

libDialogsFunctions0Execute

libDialogsFunctions1Execute

libDialogsFunctions2Execute

winApiFunctions1Execute

get_key_state

winApiFunctions2Execute

reg_hot_key

winApiFunctions3Execute

sendkeys

winApiFunctions5Execute

TStringsLibFunctions0Execute

TStringsLibFunctions1Execute

TStringsLibFunctions2Execute

_TStringsLibFunctions3Execute

_TStringsLibFunctions4Execute

_TStringsLibFunctions5Execute

TStreamLibFunctions0Execute

TStreamLibFunctions1Execute

TStreamLibFunctions2Execute

TStreamLibFunctions3Execute

TStreamLibFunctions4Execute

TStreamLibFunctions5Execute

TStreamLibFunctions6Execute

TStreamLibFunctions7Execute

TStreamLibFunctions8Execute

TStreamLibFunctions9Execute

TStreamLibFunctions10Execute

TStreamLibFunctions11Execute

TStreamLibFunctions12Execute

TStreamLibFunctions14Execute

TStreamLibFunctions15Execute

TStreamLibFunctions16Execute

TStreamLibFunctions17Execute

TStreamLibFunctions18Execute

_TStreamLibFunctions20Execute

_TStreamLibFunctions21Execute

_TStreamLibFunctions22Execute

_TStreamLibFunctions23Execute

_TStreamLibFunctions24Execute

TPictureLibFunctions0Execute

TPictureLibFunctions1Execute

TPictureLibFunctions2Execute

TPictureLibFunctions3Execute

TPictureLibFunctions4Execute

TPictureLibFunctions5Execute

TPictureLibFunctions6Execute

TPictureLibFunctions7Execute

TPictureLibFunctions8Execute

TPictureLibFunctions9Execute

_TPictureLibFunctions10Execute

_TPictureLibFunctions11Execute

_TPictureLibFunctions12Execute

_TPictureLibFunctions13Execute

_TPictureLibFunctions14Execute

_TPictureLibFunctions15Execute

_TPictureLibFunctions16Execute

_TPictureLibFunctions17Execute

_TPictureLibFunctions18Execute

_TPictureLibFunctions19Execute

TSizeCtrlFunctions0Execute

TSizeCtrlFunctions1Execute

TSizeCtrlFunctions2Execute

_TSizeCtrlFunctions4Execute

_TSizeCtrlFunctions5Execute

_TSizeCtrlFunctions6Execute

_TSizeCtrlFunctions8Execute

_TSizeCtrlFunctions9Execute

_TSizeCtrlFunctions10Execute

_TSizeCtrlFunctions11Execute

_TSizeCtrlFunctions12Execute

_TSizeCtrlFunctions13Execute

TImageListFunctions0Execute

TImageListFunctions1Execute

TImageListFunctions2Execute

TImageListFunctions3Execute

TImageListFunctions4Execute

_TImageListFunctions6Execute

_TImageListFunctions7Execute

_TImageListFunctions8Execute

_TImageListFunctions9Execute

ReportDLLError

_RegistryFunctions0Execute

win_exit_windows

OSApiFunctions6Execute

OSApiFunctions8Execute

shell_execute

OSApiFunctions9Execute

shell_execute_wait

OSApiFunctions13Execute

OSApiFunctions15Execute

OSApiFunctions17Execute

OSApiFunctions21Execute

OSApiFunctions22Execute

OSApiFunctions24Execute

OSApiFunctions25Execute

OSApiFunctions26Execute

OSApiFunctions27Execute

OSApiFunctions28Execute

shell_execute_wait2

_MenusFunctions6Execute

_MenusFunctions7Execute

_MenusFunctions8Execute

_MenusFunctions9Execute

_MenusFunctions11Execute

popup_isshow

_MenusFunctions12Execute

exemod_saveexe

_ExeModFunctions9Execute

_TListsFunctions1Execute

_TListsFunctions2Execute

_TListsFunctions4Execute

_TSynEditFunctions0Execute

_TSynEditFunctions1Execute

_TSynEditFunctions2Execute

_TSynEditFunctions3Execute

_TSynEditFunctions5Execute

_TSynEditFunctions6Execute

_TSynEditFunctions7Execute

_TSynEditFunctions8Execute

_TSynEditFunctions9Execute

_TSynEditFunctions10Execute

_TSynEditFunctions12Execute

_TSynEditFunctions13Execute

_TSynEditFunctions14Execute

_TSynEditFunctions16Execute

_TSynEditFunctions17Execute

_TSynEditFunctions18Execute

_TSynEditFunctions19Execute

_TSynEditFunctions20Execute

_TSynEditFunctions21Execute

_TSynEditFunctions22Execute

_TSynEditFunctions24Execute

_TSynEditFunctions25Execute

_CanvasFunctions2Execute

_CanvasFunctions9Execute

_CanvasFunctions10Execute

_CanvasFunctions11Execute

_CanvasFunctions12Execute

_CanvasFunctions13Execute

_CanvasFunctions14Execute

_CanvasFunctions15Execute

_CanvasFunctions16Execute

_CanvasFunctions17Execute

_CanvasFunctions18Execute

_CanvasFunctions19Execute

web_navigate

_WebBrowserFunctions0Execute

web_execwb

_WebBrowserFunctions1Execute

web_post

_WebBrowserFunctions2Execute

web_sethtml

_WebBrowserFunctions3Execute

web_savefile

_WebBrowserFunctions4Execute

web_location

_WebBrowserFunctions5Execute

web_free

_WebBrowserFunctions6Execute

web_create

web_width

_WebBrowserFunctions8Execute

web_height

_WebBrowserFunctions9Execute

web_busy

_WebBrowserFunctions10Execute

web_back

_WebBrowserFunctions11Execute

web_forward

_WebBrowserFunctions12Execute

web_refresh

_WebBrowserFunctions13Execute

web_protocol

web_proxy

_TStringGridFunctions0Execute

_TStringGridFunctions1Execute

_TStringGridFunctions2Execute

_TStringGridFunctions3Execute

_TStringGridFunctions4Execute

_TStringGridFunctions5Execute

backworker_execute

_BackWorkerFunctions0Execute

_BackWorkerFunctions1Execute

_BackWorkerFunctions2Execute

_BackWorkerFunctions3Execute

_BackWorkerFunctions4Execute

_BackWorkerFunctions5Execute

_BackWorkerFunctions6Execute

_BackWorkerFunctions7Execute

_BackWorkerFunctions9Execute

_BackWorkerFunctions10Execute

_BackWorkerFunctions11Execute

_BackWorkerFunctions12Execute

_BackWorkerFunctions13Execute

_BackWorkerFunctions14Execute

_BackWorkerFunctions15Execute

_BackWorkerFunctions16Execute

_BackWorkerFunctions17Execute

_BackWorkerFunctions18Execute

_BackWorkerFunctions19Execute

_BackWorkerFunctions20Execute

_BackWorkerFunctions22Execute

_TTreeFunctions3Execute

_SkinsFunctions1Execute

_DockingFunctions0Execute

_DockingFunctions1Execute

_DockingFunctions2Execute

_DockingFunctions3Execute

_DockingFunctions4Execute

_DockingFunctions5Execute

_DockingFunctions6Execute

_DockingFunctions7Execute

_DockingFunctions8Execute

_DockingFunctions9Execute

_DockingFunctions10Execute

_DockingFunctions11Execute

_DockingFunctions12Execute

_DockingFunctions13Execute

__WinUtilsFunctions0Execute

__WinUtilsFunctions1Execute

__WinUtilsFunctions2Execute

__WinUtilsFunctions3Execute

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

VVV.dim-s.net

VVV.soulstream.ru

%PHP Scripts|*.php|All files (*.*)|*.*

version="1.0.0.0"

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

<requestedExecutionLevel

PLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.nThis "Portable Network Graphics" image is not supported or it might be invalid.

This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.

There is no such palette entry.dThis "Portable Network Graphics" image contains an unknown critical part which could not be decoded.pThis "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.cThis "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.-The chunks must be compatible to be assigned.jThis "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.8This "Portable Network Graphics" image contains no data.oSome operation could not be performed because the system is out of resources. Close some windows and try again.OThis operation is not valid because the current image contains no valid header.4The new size provided for image resizing is invalid.

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalid

JPEG error #%d

JPEG Image FilejThis "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)yThe "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corruptedUThis "Portable Network Graphics" image is invalid because it has missing image parts.[Could not decompress the image because it contains invalid compressed data.

Description: BThe "Portable Network Graphics" image contains an invalid palette.

Unknown GIF block type'Object type not supported for operation

Unsupported PixelFormat

Invalid stream operation

Unsupported GIF version

Invalid extension introducerúiled to allocate memory for GIF DIB

Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Resolving hostname %s.

Connecting to %s.

%s is not a valid service.

Socket Error # %d

%s is not a valid IP address.

Operation would block.

Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or timeúiled to set maximum selection range$Failed to set calendar min/max rangeúiled to set calendar selected range

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

Thread Class Not Specified.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s) Failed to get object at index %d"Failed to set tab "%s" at index %d Failed to set object at index %d<MultiLine must be True when TabPosition is tpLeft or tpRight

Invalid item level assignment Invalid level (%d) for item "%s"

Failed to Save Stream %s is already associated with %sE%d is an invalid PageIndex value. PageIndex must be between 0 and %d=This control requires version 4.70 or greater of COMCTL32.DLL

Date exceeds maximum of %s

Failed to clear tab control Failed to delete tab at index %d"Failed to retrieve tab at index %d

"%s" is an invalid path

UTF-7"PageControl must first be assigned"%s requires Windows Vista or later

Teal.There is no default printer currently selected/Menu '%s' is already being used by another form

- Dock zone has no controlLError loading dock zone from the stream. Expecting version %d, but found %d.

Error setting %s.Count8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned

Value must be between %d and %d

Invalid clipboard format Clipboard does not support Icons

Text exceeds memo capacity Operation not supported on selected printer

Invalid input value7Invalid input value. Use escape key to abandon changes

%s on %s@GroupIndex cannot be less than a previous menu item's GroupIndex5Cannot create form. No MDI forms are currently active0Can only modify an image if it contains a bitmap*A control cannot have itself as its parent

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window$Parent given is not a parent of '%s'

%s property out of range

Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic$Unknown picture file extension (.%s)

Unsupported clipboard format

%s expected Too many rows or columns deleted$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)"Unable to find a Table of Contents

No help found for %s#No context-sensitive help installed

List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

%s on line %d.Component name '%s' exceeds 64 character limit

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list

Cannot open file "%s". %s

Grid too large for operation

Invalid stream format$''%s'' is not a valid component name

Invalid property element: %s

Invalid property type: %s

Invalid data type for '%s'

Ancestor for '%s' not found

Cannot assign a %s to a %s

''%s'' expectedECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s1Fixed column count must be less than column count Fixed row count must be less than row count

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

No argument for format '%s'"Variant method calls not supported

Invalid variant operation

Invalid NULL variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

Application Error1Format '%s' invalid or incompatible with argument

!'%s' is not a valid integer value('%s' is not a valid floating point value!'%s' is not a valid date and time

'%s' is not a valid GUID value

I/O error %d

1.0.0.0

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1388

2. Delete the original MemScan file.
   
3. Delete or disinfect the following files created/modified by the MemScan:
   

   %Documents and Settings%\%current user%\Local Settings\Temp\PSE11\php\modules\php_bcompiler.dll (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\devels\28f5b52c27c2ce4c97f1ff1919e090bf.phpe2 (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\PSE11\28F5B52C27C2CE4C97F1FF1919E090BF\php.ini (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\devels\28f5b52c27c2ce4c97f1ff1919e090bf\engine.php (10216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\PSE11\php\modules\php_bz2.dll (69 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\PSE11\php\php5ts.dll (34007 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\57295517.~ph (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\devels\28f5b52c27c2ce4c97f1ff1919e090bf\include.php (80 bytes)
   %System%\drivers\etc\hosts (34 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\msvcr71.dll (167 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Steamhack.exe (47888 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\STEAMGODBOG.exe (3847 bytes)

4. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts):
   127.0.0.1 localhost
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.