Trojan.GenericKD.2228674_1afcf91ef9

by malwarelabrobot on April 7th, 2015 in Malware Descriptions.

Trojan.GenericKD.2228674 (B) (Emsisoft), Trojan.GenericKD.2228674 (AdAware), GenericInjector.YR (Lavasoft MAS)
Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 1afcf91ef9b5ea67712a8af96fc6287d
SHA1: 8a659b1984124bd1aa48db50e2f4586fe2502db4
SHA256: 8c7a24ffa259ee97013af2bee7fbada8b4f60470d1a7cdc3b869af4c1d9543d6
SSDeep: 98304:LRc ZwBJYPtJ83QTDmeC8UmgOev1emFGtv GEvtM:9cHBJY1J13dgOeYmaelM
Size: 4620288 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-03-16 11:30:06
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

FMOlsvr.exe:1872
%original file name%.exe:1844
fmol.exe:1984
ExAd.exe:464
FHSev.exe:1788
FHSev.exe:1676
FHSev.exe:1228

The Trojan injects its code into the following process(es):

FMOlsvr.exe:1716
FHSev.exe:828
YYTJ.exe:444

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1844 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\fmol_201504060706\201504060706\YYTJ.dll (6584 bytes)
%Program Files%\fmol_201504060706\201504060706\avcore.dll (2392 bytes)
%Program Files%\fmol_201504060706\201504060706\audio.dll (3616 bytes)
%Program Files%\fmol_201504060706\201504060706\fmol.exe (65976 bytes)
%Program Files%\fmol_201504060706\201504060706\libav.dll (6360 bytes)
%Program Files%\fmol_201504060706\201504060706\SysConfig.ini (760 bytes)
%Program Files%\fmol_201504060706\201504060706\avformat-54.dll (12088 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IT41S12B\desktop.ini (67 bytes)
%Program Files%\fmol_201504060706\201504060706\source.dll (6584 bytes)
%Program Files%\fmol_201504060706\201504060706\avcodec-54.dll (23424 bytes)
%Program Files%\fmol_201504060706\201504060706\swresample-0.dll (3312 bytes)
%Program Files%\fmol_201504060706\201504060706\FHSev.exe (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPARIDE3\desktop.ini (67 bytes)
%Program Files%\fmol_201504060706\201504060706\ExAd.exe (12024 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\user2.ini (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MFAN0XAD\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\fmol\fmol.lnk (880 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\fmol\Ãƒâ€¦ÃƒÂ¤Ãƒâ€“ÃƒÆ’Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸\ÃƒÂÃ‚Â¶Ãƒâ€ÃƒËœfmol.lnk (899 bytes)
%Program Files%\fmol_201504060706\201504060706\pthreadGC2.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\desktop.ini (67 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\client.ini (36 bytes)
%Program Files%\fmol_201504060706\201504060706\Unins.exe (9608 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\version.ini (32 bytes)
%Program Files%\fmol_201504060706\201504060706\avutil-52.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\stj[1].htm (3 bytes)
%Program Files%\fmol_201504060706\201504060706\favorfm.xml (440 bytes)
%Program Files%\fmol_201504060706\201504060706\FMOlsvr.exe (23936 bytes)
%Program Files%\fmol_201504060706\201504060706\channels.xml (784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\fmol\Ã‚Â¹Ãƒâ„¢Ã‚Â·Ã‚Â½Ãƒâ€“ÃƒÂ·Ãƒâ€™Ã‚Â³.lnk (334 bytes)
%Program Files%\fmol_201504060706\201504060706\YYTJ.exe (12536 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\setup.ini (56 bytes)
%Program Files%\fmol_201504060706\201504060706\DuiLib.dll (16288 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\stj[1].htm (0 bytes)

The process fmol.exe:1984 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\fmol_201504060706\201504060706\Data\server.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\1113[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MFAN0XAD\ver[1].txt (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\a[1].htm (3 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\user2.ini (384 bytes)
%Program Files%\fmol_201504060706\201504060706\SysConfig.ini (604 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\a[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\1113[1].htm (0 bytes)

The process ExAd.exe:464 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPARIDE3\getprocess[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\llq[1].htm (3 bytes)

The process FHSev.exe:828 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\Update2[1].rar (1497 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\0706.Tmp (1 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\fwtj[1].htm (3 bytes)

The Trojan deletes the following file(s):

%Program Files%\fmol_201504060706\201504060706\Data\0706.Tmp (0 bytes)

The process YYTJ.exe:444 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IT41S12B\qweasd[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\35bc841c.DAT (655 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\35bc841c.DAT (0 bytes)

Registry activity

The process FMOlsvr.exe:1872 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "27 E2 36 0E CC DB 54 B9 D1 2A 51 68 8E D1 E0 1A"

The process FMOlsvr.exe:1716 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F D8 A2 95 22 11 BC EB 13 F4 5D 1D 35 1E 8F CE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:1844 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D 00 3F E4 FF EF 65 F5 A5 A7 59 61 18 6E 1C 33"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\fmol_201504060706\201504060706]
"FHSev.exe" = "Ã©Å¸Â³Ã¤Â¹ÂÃ©â‚¬Å¡Ã§â€Â¨Ã¦Â£â‚¬Ã¦Âµâ€¹Ã¦Å Â¥Ã¥â€˜Å "

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process fmol.exe:1984 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"Publisher" = "Ãƒâ€™ÃƒÂ´Ãƒâ‚¬Ãƒâ€“FM"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"DisplayIcon" = "%Program Files%\fmol_201504060706\201504060706\Unins.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"DisplayName" = "Ãƒâ€™ÃƒÂ´Ãƒâ‚¬Ãƒâ€“FM"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\fmol]
"RD" = "_201504060706"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"DisplayVersion" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}]
"UninstallString" = "%Program Files%\fmol_201504060706\201504060706\Unins.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 B3 B0 B3 77 50 68 BC A1 A8 00 75 AC 64 97 F2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FMOLL_svr_201504060706" = "%Program Files%\fmol_201504060706\201504060706\FMOlsvr.exe -mini"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FMOLL_201504060706" = "%Program Files%\fmol_201504060706\201504060706\fmol.exe -mini"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"

"AutoConfigURL"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BoxNews"

"fmol_News"

"fmol"

"YyfmPlay"

The process ExAd.exe:464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "19 E2 F6 0E 9F C9 AD 42 CD AE DC A5 95 7A B4 D3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process FHSev.exe:1788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F5 BD 10 92 0E 52 E9 10 4B E6 2B C5 D3 58 6C AF"

The process FHSev.exe:1676 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB FB 6E 4B 4E B8 80 17 29 AF 0A 9D 4B DF B8 C9"

The process FHSev.exe:828 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D FF 87 CD 01 45 FA 30 CD C4 BB D6 07 18 BE 0E"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process FHSev.exe:1228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 3C 29 BF F1 B9 3F 21 4B 11 FB 0A AC F3 2A C2"

The process YYTJ.exe:444 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 22 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E1 41 F0 1A BE 69 5C 4B 16 59 C1 B6 18 2E 34 B5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
f9b5ed2c5e13e35b0b3ed4bae4c85b8c	c:\Program Files\fmol_201504060706\201504060706\DuiLib.dll
dcc9869f1ec4aca6ca5518c8ec241dc8	c:\Program Files\fmol_201504060706\201504060706\ExAd.exe
57628eb5ea469b2eec88bf8643e99a25	c:\Program Files\fmol_201504060706\201504060706\FHSev.exe
25e9c194d6d30583ea5eb363b4ad9a8a	c:\Program Files\fmol_201504060706\201504060706\FMOlsvr.exe
eb6e977deb48f1dc357cf865b3950632	c:\Program Files\fmol_201504060706\201504060706\Unins.exe
032a480382f4d855b7e4375691a42371	c:\Program Files\fmol_201504060706\201504060706\YYTJ.dll
e4d3769f9bd89acb1b7dbba7b568c1e5	c:\Program Files\fmol_201504060706\201504060706\YYTJ.exe
c9fa523af9810b275661015bc613141f	c:\Program Files\fmol_201504060706\201504060706\audio.dll
8d1eb0190ae2171d7e93b3afc7cfac66	c:\Program Files\fmol_201504060706\201504060706\avcodec-54.dll
656ea00ee943ad48fcbefd12d9b5871d	c:\Program Files\fmol_201504060706\201504060706\avcore.dll
97df90301a38b26cc52f5016708a09f4	c:\Program Files\fmol_201504060706\201504060706\avformat-54.dll
0ace41021f8a4cea7fd4b7f5692d0fe4	c:\Program Files\fmol_201504060706\201504060706\avutil-52.dll
3ae535c07eff6415e6aea71871fe335f	c:\Program Files\fmol_201504060706\201504060706\fmol.exe
d2a390ceb0d39b7d5d76a5d093311242	c:\Program Files\fmol_201504060706\201504060706\libav.dll
fd2354e9f16f29048da78cb265d4a92b	c:\Program Files\fmol_201504060706\201504060706\pthreadGC2.dll
9716e47a6027033075bcd5f319ac6326	c:\Program Files\fmol_201504060706\201504060706\source.dll
0227b18ac909acebed6e6f387f4a0c2e	c:\Program Files\fmol_201504060706\201504060706\swresample-0.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: STA
Product Name: FMOL????
Product Version: 1.15.316.1
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: Setup.exe
Internal Name: Setup.exe
File Version: 1.15.316.1
File Description: FMOL????
Comments:
Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	82712	82944	4.58494	0f1bb9dfe1273d16b7c45d8383df5d78
.rdata	90112	22898	23040	3.46002	6f9f1fde6f9a4ee2d282d6cb5112578c
.data	114688	12452	4608	2.42349	9aef44c681148ba8efe98aaa79028919
.rsrc	131072	4487432	4487680	5.52194	14e636c2b6324662c0337dc8bdf56d6a
.reloc	4620288	18572	18944	1.34198	e95559b8521a27d0e0d491eabc68702e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://update.163vv.com/1113.ashx?v=1.15.316.1&t=41
hxxp://update.yinyue.fm/DM15/DMSet.Xml	222.186.60.13
hxxp://tongji.yinyue.fm/a.ashx?v=51856086832E9ADBA8F11F5A520FDAF72730F8C1F8189D6301166D672D1F6D5DC0C8B1AB73BA45DEED104630DCBC32D1683F373E788B33870079C2970BD8B6BAF6F3B0A136564326493FA145FCF7975306CBA88F11CC7511747B3F871DB1E56058818D1F081F711377AB565C2E555EBB93030B018EF7120A	171.111.158.28
hxxp://update.163vv.com/fwtj.ashx?v=1.15.316.1
hxxp://update.163vv.com/llq.ashx?v=1.15.316.1&t=41
hxxp://update.yinyue.fm/appupdate/ver.txt	222.186.60.13
hxxp://load.yinyue.fm/api/getprocess	222.186.60.97
hxxp://update.yinyue.fm/Update2.rar	222.186.60.13
hxxp://update.yinyue.fm/db/db.zip	222.186.60.13
hxxp://update.163vv.com/qweasd.ashx?v=1.15.316.1
hxxp://updatetest.wuji.com/qweasd.ashx?v=1.15.316.1	219.232.241.199
hxxp://updatetest.wuji.com/llq.ashx?v=1.15.316.1&t=41	219.232.241.199
hxxp://updatetest.wuji.com/fwtj.ashx?v=1.15.316.1	219.232.241.199
hxxp://updatetest.wuji.com/1113.ashx?v=1.15.316.1&t=41	219.232.241.199

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /api/getprocess HTTP/1.1

Host: load.yinyue.fm

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: application/json; charset=utf-8

Server: Microsoft-IIS/8.0

X-AspNetMvc-Version: 5.1

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Mon, 06 Apr 2015 04:06:23 GMT

Content-Length: 1075
{"adurl":"hXXp://show.bianya.cc:6677/gg/wujiliu.html","width":300,"hei
ght":250,"show_interval":180,"pop_interval":900,"get_interval":3,"proc
ess":[{"proc":"iexplore.exe","proc_class":["IEFrame"]},{"proc":"360se.
exe","proc_class":[" SeWnd "]},{"proc":"TheWorld.exe","proc_class":[]}
,{"proc":"UCBrowser.exe","proc_class":[" Chrome_WidgetWin_0","Chrome_W
idgetWin_1"]},{"proc":"baiduBrowser.exe","proc_class":[]},{"proc":"Sog
ouExplorer.exe","proc_class":[]},{"proc":"QQBrowser.exe","proc_class":
["QQBrowserMainFrame"]},{"proc":"Maxthon.exe","proc_class":[]},{"proc"
:"chrome.exe","proc_class":[" Chrome_WidgetWin_0","Chrome_WidgetWin_1"
]},{"proc":"firefox.exe","proc_class":[]},{"proc":"lvseie.exe","proc_c
lass":["Internet Explorer_Server"]},{"proc":"360chrome.exe","proc_clas
s":["Chrome_RenderWidgetHostHWND"]},{"proc":"liebao.exe","proc_class":
["Chrome_RenderWidgetHostHWND"]},{"proc":"safari.exe","proc_class":[]}
,{"proc":"2345Explorer.exe","proc_class":[]},{"proc":"Juzi.exe","proc_
class":[]},{"proc":"krBrowser.exe","proc_class":[]},{"proc":"TaoBrowse
r.exe","proc_class":[]}]}HTTP/1.1 200 OK..Cache-Control: private..Cont
ent-Type: application/json; charset=utf-8..Server: Microsoft-IIS/8.0..
X-AspNetMvc-Version: 5.1..X-AspNet-Version: 4.0.30319..X-Powered-By: A
SP.NET..Date: Mon, 06 Apr 2015 04:06:23 GMT..Content-Length: 1075..{"a
durl":"hXXp://show.bianya.cc:6677/gg/wujiliu.html","width":300,"height
":250,"show_interval":180,"pop_interval":900,"get_interval":3,"process
":[{"proc":"iexplore.exe","proc_class":["IEFrame"]},{"proc":"360se<<< skipped >>>

GET /1113.ashx?v=1.15.316.1&t=41 HTTP/1.1

Host: updatetest.wuji.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.5.10

Date: Mon, 06 Apr 2015 04:06:18 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

3..0A0..0..HTTP/1.1 200 OK..Server: nginx/1.5.10..Date: Mon, 06 Apr 20
15 04:06:18 GMT..Content-Type: text/html..Transfer-Encoding: chunked..
Connection: keep-alive..3..0A0..0..

HEAD /DM15/DMSet.Xml HTTP/1.1

Content-Type: text/html

Host: update.yinyue.fm

Accept: text/html, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)


HTTP/1.1 200 OK

Content-Length: 5215

Content-Type: text/xml

Last-Modified: Wed, 25 Mar 2015 07:30:08 GMT

Accept-Ranges: bytes

ETag: "d3453d85cd66d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 06 Apr 2015 04:06:26 GMT

GET /qweasd.ashx?v=1.15.316.1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Host: updatetest.wuji.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.5.10

Date: Mon, 06 Apr 2015 04:06:59 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

3..0A0..0..HTTP/1.1 200 OK..Server: nginx/1.5.10..Date: Mon, 06 Apr 20
15 04:06:59 GMT..Content-Type: text/html..Transfer-Encoding: chunked..
Connection: keep-alive..3..0A0..0..

GET /a.ashx?v=51856086832E9ADBA8F11F5A520FDAF72730F8C1F8189D6301166D672D1F6D5DC0C8B1AB73BA45DEED104630DCBC32D1683F373E788B33870079C2970BD8B6BAF6F3B0A136564326493FA145FCF7975306CBA88F11CC7511747B3F871DB1E56058818D1F081F711377AB565C2E555EBB93030B018EF7120A HTTP/1.1

Host: tongji.yinyue.fm

Cache-Control: no-cache


HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Mon, 06 Apr 2015 04:04:25 GMT

Content-Length: 3

100HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; c
harset=utf-8..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..
X-Powered-By: ASP.NET..Date: Mon, 06 Apr 2015 04:04:25 GMT..Content-Le
ngth: 3..100..

GET /appupdate/ver.txt HTTP/1.1

Host: update.yinyue.fm

Cache-Control: no-cache


HTTP/1.1 200 OK

Content-Type: text/plain

Last-Modified: Tue, 18 Jun 2013 05:57:08 GMT

Accept-Ranges: bytes

ETag: "32a6e0aae86bce1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 06 Apr 2015 04:06:33 GMT

Content-Length: 36

[appver]..ver=1.0..ver2=20130606..HTTP/1.1 200 OK..Content-Type: text/
plain..Last-Modified: Tue, 18 Jun 2013 05:57:08 GMT..Accept-Ranges: by
tes..ETag: "32a6e0aae86bce1:0"..Server: Microsoft-IIS/7.5..X-Powered-B
y: ASP.NET..Date: Mon, 06 Apr 2015 04:06:33 GMT..Content-Length: 36..[
appver]..ver=1.0..ver2=20130606..

GET /llq.ashx?v=1.15.316.1&t=41 HTTP/1.1

Host: updatetest.wuji.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Mon, 06 Apr 2015 04:06:27 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

3..0A0..0..HTTP/1.1 200 OK..Server: nginx/1.6.1..Date: Mon, 06 Apr 201
5 04:06:27 GMT..Content-Type: text/html..Transfer-Encoding: chunked..C
onnection: keep-alive..3..0A0..0..

HEAD /DM15/DMSet.Xml HTTP/1.1

Content-Type: text/html

Host: update.yinyue.fm

Accept: text/html, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)


HTTP/1.1 200 OK

Content-Length: 5215

Content-Type: text/xml

Last-Modified: Wed, 25 Mar 2015 07:30:08 GMT

Accept-Ranges: bytes

ETag: "d3453d85cd66d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 06 Apr 2015 04:07:04 GMT

GET /fwtj.ashx?v=1.15.316.1 HTTP/1.0

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Host: updatetest.wuji.com

Pragma: no-cache


HTTP/1.1 200 OK

Server: nginx/1.6.1

Date: Mon, 06 Apr 2015 04:06:26 GMT

Content-Type: text/html

Connection: close

0A0..

GET /db/db.zip HTTP/1.1

Host: update.yinyue.fm

Accept: text/html, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)


HTTP/1.1 200 OK

Content-Type: application/x-zip-compressed

Last-Modified: Sun, 22 Mar 2015 16:28:58 GMT

Accept-Ranges: bytes

ETag: "22f9734cbd64d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 06 Apr 2015 04:06:51 GMT

Content-Length: 7051

[DB]..SGSG1=83C11CBA01116AB3CE2B7488D16BF8429DE16FF4485DEA70B5DE3B4652
ACCB..SGSG2=CC1FB9045EB2CBD02870899D3B80CD17A6FE489D217AF74D56BFDB3B45
5DB9..SGSG3=F84B9520BADE24798098E13A87DC6EF7475FE872F50F58ED375CA4FF18
66B1..SGSG4=E261FF5EE4354E57A2FE186CF54F9C26B1F573C81C61EE7489E23F5EB8
C0DC..SGSG5=A023BD18A2F60C1168B0C9DD7BC0025BFA034C91D42EBB011A738FEA37
415C..SGSG6=1654E27DC7287D869DE5334B942EBF0550549D27BEC7015AA3C8D02C4A
56A6..SGSG7=1BA93482D839425BA6F20C10A933B00A55A927BC0005429BE00A166DB5
C3D2..SGSG8=ED7CDA65FF10156EB5CD2B73CC1657EC485C952FB6CF19A2FB1169B4C2
DE3F..SGSG9=5FED48962D4D56AFCAD62064FD4784D965B9378CD329A63C41AAF6021E
7887..SGSG10=CE1DBB1AA0F00A136E8A97EF4992D369F409469F277CF54F54B9C1DC3
B4757..SGSG11=D86BF5409AFE041960B8C1C513A83A83D22BA43E819AD76DB6DF3847
51A9F5..SWSW1=F170CE69F3041962F34192EA37405EB9CD1BA0247992EF0B6BB1C8DF
3A405AA5..SWSW2=77F5409E25758E9725B6041860B9C7D62FB802455EB7C0DB384259
ACF60D1766..SWSW3=BF025CFA4151AAF341922064BCC5D3237BF44E91EA001960BCC6
DD217B819BFA..SWSW4=4785D362F81962BB19BA186CB4CD28778FD862E53F54ADF401
1B66B9C3D9207F..SWSW5=1557E17CC62B70B50754E13A4653ADC8DC6AF34B50A5F20E
6EB4CFD62D778DE8..SWSW6=B1308E29B3C7DC26B70556AECAD72671B53388DF254EAB
F6071D64BBC1DB2671..SWSW7=29BB1AA43F53A8FD5FFC5EA6F20C6AB5C9075CE33952
AFCA2B71889FE53C4651..SWSW8=2FBD18A63D5DA6FF5DFE5CA0F806106FB7318ADD27
4C55ACC8D22E718B91EB0B..SWSW9=66E473CD1464B9C210AD0F1763BCDA3A428FD468
BDD6207B9BE1394C56ACF606..SWSW10=A427B10C56BAC3D87ADB798D95E23D58AC3A8
3DA20758299E53C475EA4FE0510..SWSW11=2DBF1EB803176CB10350ED36425FB9

<<< skipped >>>

HEAD /db/db.zip HTTP/1.1

Host: update.yinyue.fm

Accept: text/html, */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)


HTTP/1.1 200 OK

Content-Length: 7051

Content-Type: application/x-zip-compressed

Last-Modified: Sun, 22 Mar 2015 16:28:58 GMT

Accept-Ranges: bytes

ETag: "22f9734cbd64d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 06 Apr 2015 04:06:47 GMT

GET /Update2.rar HTTP/1.0

Accept: */*

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: update.yinyue.fm

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Sat, 30 Aug 2014 00:25:57 GMT

Accept-Ranges: bytes

ETag: "529d6f7e8c3cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Mon, 06 Apr 2015 04:06:43 GMT

Connection: keep-alive

Content-Length: 1497
.....................khkh..',; V E.$..1.-<..)...A4;.',; V E.$..1.-&
lt;..)...A.D'O.:..5..*.P..A.D'O.:.A.D...6.\,O..A.D'O.:...6.\,O..A.D'O.
:.1)7.\,O..',; V E.khkh..A4;4%.& V E.$..1.-<..)..'..E V1,.1)7$U..5.
.*.P..A4;4%.&.$..1.-<..)..'..E V1,.1)7$U.\,O.'..E V1,.1)7$U..!@./.1
)7"X." V1,....4....7...R-=.&,(*@....khkh.'..E V1,.1)7$U.\,O4X(4.......
............................................................. V1,-..1)
7$U..T.....*.P~..~...~...khkh.........................................
.................A.D'O.:..khkh........................................
khkh.'-&".E0..*2. .9.'-&".E0.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~.*2. .9~.....~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~..............khkh.*J,"$V-Q..'-.J*J,"~- 4.$V-Q..Q48*J$V2.....
$V-Q2......3$V4(...............>.6.*J,"$V-Q(./G(0..Q48*J$V..5U(0.*J
$V ...5U(0.!2"A*J$V ...(.(.$V-Q5(/....3$V4(...>.6.kh.$V-Q.5.M.*J$V 
.'[.."..G..3$V4(........#-.5(/........................................
....................khkh.................Q48$V-Q..5.5..A18.Q48(.1!."*J
$V2......3$V4(.....D...=.................khkh.......0D%Q. .$..1.-<.
.)................................................................khkh
...4;*2*2)/.$..1.-<..)..*2*2)/.&.9. ...)...........................
....................................khkh..............................
......................................................................
...........................................................kh.........
,./G4.- 263[&...%I0.4....428,"54."5L.5....%I,N'..[...<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

fmol.exe_1984:

.text

`.rdata

@.data

.rsrc

@.reloc

u.jAh

t.HuZ

xSSSh

FTPjKS

FtPj;S

C.PjRV

Visual C   CRT: Not enough memory to complete call to strerror.

GetProcessWindowStation

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

operator

windows936

windows932

windows874

windows1257

windows1256

windows1255

windows1254

windows1253

windows1252

windows1251

windows1250

Invalid or unsupported charset:

%sData\user2.ini

Software\Microsoft\Windows\CurrentVersion\Uninstall

Software\Microsoft\Windows\CurrentVersion\Uninstall\{06F57725-D702-43A9-A8D4-40BB36C9B07F}

Unins.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\Run

AutoRunTipFrame.xml

FrmColor.xml

\SysConfig.ini

FrmConfig.xml

Data\dh.ini

ShowHideWindowKey

ExitWindowKey

tab_hotkey

Software\Microsoft\Windows\CurrentVersion\Run

BoxNews.exe

"%s%s" -mini

SysConfig.ini

"%s" -mini

%s\%s

favorfm.xml

channels.xml

E:\zhuyicheng\boost_1_53_0\boost/property_tree/detail/ptree_implementation.hpp

E:\zhuyicheng\boost_1_53_0\boost/property_tree/xml_parser.hpp

E:\zhuyicheng\boost_1_53_0\boost/property_tree/detail/xml_parser_read_rapidxml.hpp

E:\zhuyicheng\boost_1_53_0\boost/property_tree/detail/xml_parser_write.hpp

E:\zhuyicheng\boost_1_53_0\boost/property_tree/string_path.hpp

FrmFeedBack.xml

hXXp://tongji.yinyue.fm/feedback/b.html

Data/setup.ini

FrmHotKeyTip.xml

HotKeyTipFrame

hotkey

d:d:d

FrmLrcChild.xml

FrmLrc.xml

Source Files\LrcFrame.cpp

BtnLogin

fmol.exe

hXXp://updatetest.wuji.com/1113.ashx

1.0.0.1

hXXp://VVV.hao123.com/?tn=98868055_hao_pg

hXXp://update.yinyue.fm/goUrl.html?

Skin.rs

Skin\mainframeshadow.png

FHSev.exe

Skin\progresstooltip.png

__HotKeyTipWindow

__HotKeyTipClass

Skin\hotkeytipbk.png

ExAd.exe

YYTJ.exe

adb.exe

aapt.exe

apnews.exe

FrmPlayer.xml

60,8,100,118

60,24,100,134

Source Files\MainFrame.cpp

file='suspensiontopa.png'

file='suspensiontop.png'

file='suspensiontopahover.png'

file='btn-play.png' source='0,0,64,64'

file='btn-play.png' source='0,64,64,128'

file='btn-play.png' source='0,128,64,192'

file='lyrictoplay.png'

pl_play.png

file='btn-pause.png' source='0,0,64,64'

file='btn-pause.png' source='0,64,64,128'

file='btn-pause.png' source='0,128,64,192'

file='play0520.png' source='0,0,35,20'

file='play0520.png' source='0,20,35,40'

file='play0520.png' source='0,40,35,59'

pl_pause.png

file='loading0%d.png'

hXXp://load.yinyue.fm/API/GetNavgate?param=v2

-d:d:d

-d:d

file='play0520.png' source='0,0,35,20'

file='play0520.png' source='0,20,35,40'

file='play0520.png' source='0,40,35,59'

file='bk.png'

lyriclikea2.png

lyriclike.png

lyriclikea.png

MessageBox.xml

Source Files\MusicPlayer.cpp

hXXp://update.yinyue.fm/

<4,$?7/'

(3-!0,1'8"5.*2$

Data\server.ini

Data\Version.ini

appupdate/ver.txt

PlayerUpdate.exe

FrmPlayList.xml

FrmPopWnd.xml

WebBrowserEx

hXXp://update.yinyue.fm/url.txt

FrmProgressToolTip.xml

%d:d

hXXp://tongji.yinyue.fm/

a.ashx

00:00:00:00:00:00

%d-%d-%d %d:%d:%d

X:X:X:X:X:X

//./%s

Data/version.ini

2000-01-01

2000-01-01 00:00:00

Data/client.ini

Software\Microsoft\Windows NT\CurrentVersion

Data/user2.ini

%ProgramFiles%\Internet Explorer\iexplore.exe

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TheWorld.exe

\TheWorld.ini

urls_to_restore_on_startup

customized_url

\SogouExplorer\config.xml

%s 3%s

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Maxthon2

SharedAccount\Config\Config.ini

\Mozilla\Firefox\Profiles

user_pref("browser.startup.homepage", "

\prefs.js

user_pref("browser.startup.homepage",

SetTipFrame.xml

FrmSetWindowLrcFrame.xml

Source Files\SetWindowLrcFrame.cpp

FrmSystemMenuFrame.xml

event_edit_keydown_eshowhide

event_edit_keydown_eexit

file='list_play.png' dest='6,6,24,24'

file='list_pause.png' dest='6,6,24,24'

<i arrow_2.png>

<i arrow_1.png>

2-0-0|1-0-0

1-0-0|1-0-0

3-0-0|1-0-0

4-0-0|1-0-0

5-0-0|1-0-0

6-0-0|1-0-0

list_item.xml

operation

frmWindowLrc.xml

frmWindowLrcParent.xml

hXXp://VVV.9ku.com/lrc2/

hXXp://VVV.9ku.com/fm/

hXXp://img.9ku.com

hXXp://mp3.9ku.com

E:\zhuyicheng\boost_1_53_0\boost/property_tree/detail/json_parser_read.hpp

hXXp://player.kuwo.cn/webmusic/st/getMuiseDate?flag=3&r=&pd=

hXXp://fm.baidu.com/dev/api/?tn=playlist&id=

hXXp://music.baidu.com/data/music/fmlink?type=mp3&rate=320&songIds=

hXXp://fm.baidu.com

hXXp://pan.baidu.com

hXXp://live.hkuradio.com/radio2?download=1

hXXp://imgs.diantai.ifeng.com/images/channelimg/update_uradio_new_yy.png

hXXp://live.hkuradio.com/radio1?download=1

hXXp://imgs.diantai.ifeng.com/images/channelimg/update_uradio_new_zh.png

hXXp://live.3gv.ifeng.com/live/zhongwen?fmt=mp3_32k_mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/ifeng_zwt_new.png

hXXp://live.3gv.ifeng.com/live/zixun?fmt=mp3_32k_mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/ifeng_zxt_new.png

hXXp://live.3gv.ifeng.com/live/hongkong?fmt=mp3_32k_mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/ifeng_xgt_new.png

hXXp://moblive.rbc.cn/fm876.mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/bg_wy_new.png

hXXp://moblive.rbc.cn/fm1039.mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/bg_bgjt_new.png

hXXp://moblive.rbc.cn/fm1006.mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/bg_xw_new.png

hXXp://moblive.rbc.cn/am603.mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/bg_bggs_new.png

hXXp://moblive.rbc.cn/fm1025.mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/bg_bgty_new.png

hXXp://moblive.rbc.cn/am774.mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/bg_bgwy_new.png

hXXp://moblive.rbc.cn/am927.mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/bg_bgaj_new.png

hXXp://moblive.rbc.cn/fm1073.mp3

hXXp://imgs.diantai.ifeng.com/images/channelimg/bg_bgcsfw_new.png

hXXp://VVV.xiami.com/radio/play/type/6/oid/0

libfm::fm_douban_impl::login

hXXp://VVV.douban.com/j/app/login

&password=

hXXp://VVV.douban.com/j/app/radio/people?app_name=radio_desktop_win&version=100&user_id=

hXXp://VVV.douban.com/j/app/radio/people?app_name=radio_desktop_win&version=100&type=

hXXp://shopcgi.qqmusic.qq.com/fcgi-bin/shopsearch.fcg?out=json&value=

"msg":

_0.jpg

hXXp://imgcache.qq.com/music/photo/album/

hXXp://music.qq.com/miniportal/static/lyric/

libfm::fm_impl::get_song_url

WinExec

KERNEL32.dll

GetAsyncKeyState

RegisterHotKey

UnregisterHotKey

USER32.dll

GDI32.dll

RegDeleteKeyA

RegCreateKeyExA

RegOpenKeyExA

RegOpenKeyA

RegCloseKey

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEAUT32.dll

avcore.dll

HttpQueryInfoA

InternetOpenUrlA

WININET.dll

SHLWAPI.dll

gdiplus.dll

?OnKeyDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z

?GetMessageMap@WindowImplBase@DuiLib@@MBEPBUDUI_MSGMAP@2@XZ

?SetAutoNavigation@CWebBrowserUI@DuiLib@@QAEX_N@Z

?SetHomePage@CWebBrowserUI@DuiLib@@QAEXPBD@Z

?Download@CWebBrowserUI@DuiLib@@UAGJPAUIMoniker@@PAUIBindCtx@@KJPAU_tagBINDINFO@@PB_W3I@Z

?Exec@CWebBrowserUI@DuiLib@@UAGJPBU_GUID@@KKPAUtagVARIANT@@1@Z

?QueryStatus@CWebBrowserUI@DuiLib@@UAGJPBU_GUID@@KQAU_tagOLECMD@@PAU_tagOLECMDTEXT@@@Z

?QueryService@CWebBrowserUI@DuiLib@@UAGJABU_GUID@@0PAPAX@Z

?FilterDataObject@CWebBrowserUI@DuiLib@@UAGJPAUIDataObject@@PAPAU3@@Z

?TranslateUrl@CWebBrowserUI@DuiLib@@UAGJKPA_WPAPA_W@Z

?GetDropTarget@CWebBrowserUI@DuiLib@@UAGJPAUIDropTarget@@PAPAU3@@Z

?GetOptionKeyPath@CWebBrowserUI@DuiLib@@UAGJPAPA_WK@Z

?TranslateAcceleratorA@CWebBrowserUI@DuiLib@@UAGJPAUtagMSG@@PBU_GUID@@K@Z

?TranslateAcceleratorA@CWebBrowserUI@DuiLib@@UAEJPAUtagMSG@@@Z

?ResizeBorder@CWebBrowserUI@DuiLib@@UAGJPBUtagRECT@@PAUIOleInPlaceUIWindow@@H@Z

?OnFrameWindowActivate@CWebBrowserUI@DuiLib@@UAGJH@Z

?OnDocWindowActivate@CWebBrowserUI@DuiLib@@UAGJH@Z

?EnableModeless@CWebBrowserUI@DuiLib@@UAGJH@Z

?UpdateUI@CWebBrowserUI@DuiLib@@UAGJXZ

?HideUI@CWebBrowserUI@DuiLib@@UAGJXZ

?ShowUI@CWebBrowserUI@DuiLib@@UAGJKPAUIOleInPlaceActiveObject@@PAUIOleCommandTarget@@PAUIOleInPlaceFrame@@PAUIOleInPlaceUIWindow@@@Z

?GetHostInfo@CWebBrowserUI@DuiLib@@UAGJPAU_DOCHOSTUIINFO@@@Z

?ShowContextMenu@CWebBrowserUI@DuiLib@@UAGJKPAUtagPOINT@@PAUIUnknown@@PAUIDispatch@@@Z

?Invoke@CWebBrowserUI@DuiLib@@UAGJJABU_GUID@@KGPAUtagDISPPARAMS@@PAUtagVARIANT@@PAUtagEXCEPINFO@@PAI@Z

?GetIDsOfNames@CWebBrowserUI@DuiLib@@UAGJABU_GUID@@PAPA_WIKPAJ@Z

?GetTypeInfo@CWebBrowserUI@DuiLib@@UAGJIKPAPAUITypeInfo@@@Z

?GetTypeInfoCount@CWebBrowserUI@DuiLib@@UAGJPAI@Z

?QueryInterface@CWebBrowserUI@DuiLib@@UAGJABU_GUID@@PAPAX@Z

?Release@CWebBrowserUI@DuiLib@@UAGKXZ

?AddRef@CWebBrowserUI@DuiLib@@UAGKXZ

?GetInterface@CWebBrowserUI@DuiLib@@UAEPAXPBD@Z

?GetClass@CWebBrowserUI@DuiLib@@UBEPBDXZ

??1CWebBrowserUI@DuiLib@@UAE@XZ

??0CWebBrowserUI@DuiLib@@QAE@XZ

?SetKeyboardEnabled@CControlUI@DuiLib@@UAEX_N@Z

?IsKeyboardEnabled@CControlUI@DuiLib@@UBE_NXZ

?Navigate2@CWebBrowserUI@DuiLib@@QAEXPBD@Z

DuiLib.dll

PSAPI.DLL

IPHLPAPI.DLL

NETAPI32.dll

GetCPInfo

GetProcessHeap

zcÁ

.?AVCWebBrowserUI@DuiLib@@

.?AVCHotKeyTipFrameWnd@@

.?AVCWebBrowserUIEx@@

.?AVWebBrowserEventSinker@@

.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@D@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@D@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@D@classic@spirit@boost@@U?$optional@V?$chset@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@DV?$allocator@D@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@

.?AU?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$alternative@V?$action@V?$chset@_W@classic@spirit@boost@@Ua_escape@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@V?$action@U?$uint_parser@K$0BA@$03$03@classic@spirit@boost@@Ua_unicode@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$alternative@V?$action@U?$difference@U?$difference@Uanychar_parser@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@V?$strlit@PBD@234@@classic@spirit@boost@@Ua_char@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$positive@U?$contiguous@U?$confix_parser@U?$chlit@D@classic@spirit@boost@@U?$kleene_star@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@U?$no_skipper_iteration_policy@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@U1234@Uunary_parser_category@234@Unon_nested@234@Unon_lexeme@234@@classic@spirit@boost@@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$sequence@U?$optional@U?$chlit@D@classic@spirit@boost@@@classic@spirit@boost@@U?$alternative@U?$chlit@D@classic@spirit@boost@@U?$sequence@U?$range@_W@classic@spirit@boost@@U?$kleene_star@Udigit_parser@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$chlit@D@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$optional@U?$sequence@U?$sequence@V?$chset@_W@classic@spirit@boost@@U?$optional@V?$chset@_W@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$positive@Udigit_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$sequence@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@Ua_name@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$chlit@D@classic@spirit@boost@@@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$sequence@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_s@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$alternative@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@U?$sequence@U?$list_parser@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@U?$chlit@D@234@Uno_list_endtoken@234@Uplain_parser_category@234@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$action@U?$chlit@D@classic@spirit@boost@@Ua_object_e@?$context@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@@classic@spirit@boost@@@234@@234@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$abstract_parser@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@@impl@classic@spirit@boost@@

.?AU?$concrete_parser@U?$sequence@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$alternative@V?$rule@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@classic@spirit@boost@@Unil_t@234@U5234@@classic@spirit@boost@@V1234@@classic@spirit@boost@@@classic@spirit@boost@@U?$assertive_parser@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Uend_parser@classic@spirit@boost@@@234@@classic@spirit@boost@@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@Unil_t@234@@impl@classic@spirit@boost@@

.?AV?$sp_counted_impl_p@U?$grammar_helper@U?$grammar@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@boost@@U?$parser_context@Unil_t@classic@spirit@boost@@@classic@spirit@4@@classic@spirit@boost@@U?$json_grammar@V?$basic_ptree@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@property_tree@boost@@@json_parser@property_tree@4@V?$scanner@V?$_Vector_iterator@V?$_Vector_val@_WV?$allocator@_W@std@@@std@@@std@@U?$scanner_policies@V?$skip_parser_iteration_policy@U?$alternative@U?$alternative@Uspace_parser@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@U?$alternative@Ueol_parser@classic@spirit@boost@@Uend_parser@234@@234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@U?$confix_parser@V?$strlit@PBD@classic@spirit@boost@@U?$kleene_star@Uanychar_parser@classic@spirit@boost@@@234@V1234@Uunary_parser_category@234@Unon_nested@234@Uis_lexeme@234@@234@@classic@spirit@boost@@Uiteration_policy@234@@classic@spirit@boost@@Umatch_policy@234@Uaction_policy@234@@classic@spirit@boost@@@234@@impl@classic@spirit@boost@@@detail@boost@@

%Program Files%\fmol_201504060706\201504060706\fmol.exe

fiTXtXML:com.adobe.xmp

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:AF7207EBFCA7E211A4BAB609526B9429" xmpMM:DocumentID="xmp.did:0CCE7CECA7FD11E292E997ACCC5A275E" xmpMM:InstanceID="xmp.iid:0CCE7CEBA7FD11E292E997ACCC5A275E" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AF7207EBFCA7E211A4BAB609526B9429" stRef:documentID="xmp.did:AF7207EBFCA7E211A4BAB609526B9429"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

#%DSZ

k/.ea"#>Nn

W%u3>C

f9Ky.RW`

125x125.jpg

L.Xkj

320x225.png

astop.png}W

back.png

bg2.png}SOh

bg3.png

bg_2.png}S]H

bk.png|

I[CsS%SC

.qO9M

t%7UfEa

zC%f

]#%Sj

J%XDU@}T

8i.aV;

%fiHZZ9

3Nv%F

R%cV}V

mD%SK'l9

QC

bkcolor_1.png

bkcolor_2.png

bkcolor_3.png

bkcolor_4.png

bkcolor_5.png

bkcolor_6.png

bkcolor_7.png

border.png

L9q

btn-anonymity.png}

[).XF

'q.CAqK

btn-delete.png

btn-fav.png}Wy8

btn-login.png}

btn-login2.png

[%*,\4>66

%S;&DN

btn-next.png

btn-pause.png}X

btn-play.png

BtnHidePlayList.png

BtnRightTop.png

btn_9k.png}Wy8

btn_bd.png}Xy8

btn_close.png}Vy8

btn_comm.png

btn_db.png}W

btn_fh.png}XwT

btn_kw.png}

btn_ok.png}W

l[O{#. %x

btn_ok_blue.png

btn_ok_red.png}

btn_sc.png

=%uIS

btn_xm.png}X

button.png

channel.png

close.png

collection.png

ðxEuJxg

color_list_bk.png

\dl

dash.png}SM

DefaultUserImage.jpg

%S]wF

downd.png

downda.png

downdahover.png

DownLoadProgressForeImage.png

exit.png}U

fbcaptionbk.png

feedback.png}V

>/.Yhi

font_bkcolor.png

font_forecolor.png

forecolor_1.png

forecolor_2.png

forecolor_3.png

forecolor_4.png

.IDATx

forecolor_5.png

forecolor_6.png

forecolor_7.png

forgettt.jpg

frmdownmenu.xml

FrmDropDownMenuFrame.xml

FrmFeedBack.xmle

FrmHotKeyTip.xmlu

frmlogin.xml

FrmLrcChild.xmlU

FrmMenuFrame.xml

frmplayer.xml

frmplaylist.xml

frmProgressToolTip.xmlUPKN

frmWebBrowser.xml=

frmWindowLrc.xml%M1

frmWindowLrcParent.xml%

headimg.png}

d%U(.6

tG%C*

history.png

home.png}VgTS

hotkeytipbk.png

icon.png

input-password.png}U

input-user.png

like.png

!\Un%x

list.png

lista.png

D-wjÓ

listahover.png

list_item_bg.png}S

list_pause.png

list_play.png

list_scroll_bar.png}SmH

list_scroll_bar2.png}S_H

{òC

list_title_bg.png}S

loading01.png

loading02.png

loading03.png

loading04.png

LoginBk.png

%S%hu.Y

g).IQ

LrcBk.png

u-3H}.

lrclist.png}Xy8

@.xn?

lyricdelete.png

lyricdeletea.png

lyricdeletea2.png

LyricFrameVoice.png

lyricmute.png

lyrictoplay.png

mainframeshadow.png

3.jUj

max.png

menu.png

min.png}SOh

mine.png

minea.png

mineahover.png

mini.png

mE)iVA.nP

more.png}SOH

musiclibrary.png

next.png}ViTSg

next0520.png

normalVolume.png}U

%DZRlj

play0520.png

play2.png

playerbg01.png

playerbg02.png

playerlist.png}X

playersidebg.jpg

playinging.jpg

playinginga.jpg

".Wlm

playingnext.png

playingplaying.jpg

playingprev.jpg

playingpreva.jpg

playingrandom.jpg

playingrandoma.jpg

playingvoice.png}V

PlayProgressForeImage.png

pl_back.png}S_h

pl_bg.png

pl_big.png

pl_btn_down.png}Tih

pl_btn_on.png

pl_close.png}S[H

pl_color.png

pl_desktop.png

pl_feedback.png}SKL

pl_forward.png}S_H

pl_icon.png}Wy8

pl_itself.png

pl_mutevol.png

pl_next.png}S_h

pl_pause.png}SKh

pl_prev.png

pl_res.png

pl_set.png

pl_small.png}Tmh

pl_split.png}S_h

pl_vol.png

pop_bkimage.png}U

power.png}XgTS

,&.,&#/!./*

prev.png}ViTS

prev0520.png

prevention.png

progresstooltip.png

progresstooltipbk.png

.ZfDrhe

T%s61K

m;.rA

progress_fore.png

pushedVolume.png

random.jpg

random01.jpg

random01a.jpg

random01hover.jpg

random02.jpg

random02a.jpg

random02hover.jpg

random03.jpg

random03a.jpg

random03hover.jpg

random0520.png

reflash.png

remembertt.jpg

scrollbar.png

search.png

E.Eg/&

SelectColor_SliderBar_Thumb.png

5).uZ

slider_bg.png

sound (2).jpg

sound.jpg

sound100.jpg

steup.png}

suspensionbig.png

suspensionbiga.png

suspensionbigahover.png

suspensionclose.png

suspensionclosea.png

suspensioncloseahover.png

suspensionfeedback.png

suspensionfeedbacka.png

suspensionfeedbackahover.png

suspensionlogin.png

suspensionmin.png

suspensionmina.png

suspensionminahover.png

suspensionset.png

suspensionseta.png

suspensionsetahover.png

suspensiontop.png

suspensiontopa.png

suspensiontopahover.png

system_menu_btnexit.png

system_menu_btnfeedback.png}V

system_menu_btnmin.png

;7%2uf

system_menu_btnmini.png

system_menu_btnsteup.png}

system_menu_btntop.png}W

sys_check_btn.png

sys_check_btn_blue.png

sys_check_btn_red.png

sys_check_btn_whiter.png

tab_comm.png

tooltipbk.png

update.xml

voice00528.png

voice0520.png

voice0a0528.png

voice1000528.png

voiceall0528.png

astop.png

bg2.png

bg_2.png

bk.png

btn-anonymity.png

btn-fav.png

btn-login.png

btn-pause.png

btn_9k.png

btn_bd.png

btn_close.png

btn_db.png

btn_fh.png

btn_kw.png

btn_ok.png

btn_ok_red.png

btn_xm.png

dash.png

exit.png

feedback.png

frmProgressToolTip.xml

frmWebBrowser.xml

headimg.png

home.png

input-password.png

list_item_bg.png

list_scroll_bar.png

list_scroll_bar2.png

list_title_bg.png

lrclist.png

min.png

more.png

next.png

normalVolume.png

playerlist.png

playingvoice.png

pl_back.png

pl_btn_down.png

pl_close.png

pl_feedback.png

pl_forward.png

pl_icon.png

pl_next.png

pl_small.png

pl_split.png

pop_bkimage.png

power.png

prev.png

steup.png

system_menu_btnfeedback.png

system_menu_btnsteup.png

system_menu_btntop.png

.Zuxf

tCPS

$;y)#%s

.QsvC

.VvC v

lH)Qk%c

4n.Ei

,GA.GS

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

5(565#8)8

R081<1@1D1Y1k1{1,2H2p2

=)=.=_=|=

:$:):::}:

4#4*494^4

95:@:2;=;

9œ9\9j9

2(3-3x3}3

9–9C9Z9m9w9

= =$=(=,=

0-181?1[1)242;2

7 7$7(7,7074787<7

<*=0=4=8=<=

< <%<4<[<

:6:[:~: ;

8ˆ8D8u8

4 5$5(5@5

mscoree.dll

MKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

Skin\bkcolor_1.png

Skin\forecolor_1.png

Skin\bkcolor_2.png

Skin\forecolor_2.png

Skin\bkcolor_3.png

Skin\forecolor_3.png

Skin\bkcolor_4.png

Skin\forecolor_4.png

Skin\bkcolor_5.png

Skin\forecolor_5.png

Skin\bkcolor_6.png

Skin\forecolor_6.png

Skin\bkcolor_7.png

Skin\forecolor_7.png

E:\zhuyicheng\boost_1_53_0\boost/property_tree/detail/rapidxml.hpp

E:\zhuyicheng\boost_1_53_0\boost/optional/optional.hpp

!p.empty() && "Empty path not allowed for put_child."

errorUrl

E:\zhuyicheng\svn\trunk\MusicPlayerSrc\win32\MusicPlayer\Header Files\rapidxml/rapidxml.hpp

E:\zhuyicheng\svn\trunk\MusicPlayerSrc\win32\MusicPlayer\Header Files\rapidxml/rapidxml_print.hpp

E:\zhuyicheng\boost_1_53_0\boost/smart_ptr/shared_ptr.hpp

E:\zhuyicheng\boost_1_53_0\boost/smart_ptr/scoped_ptr.hpp

E:\zhuyicheng\boost_1_53_0\boost/spirit/home/classic/core/impl/match.ipp

val.is_initialized()

E:\zhuyicheng\boost_1_53_0\boost/spirit/home/classic/core/match.hpp

c.stack.size() >= 1

Song.music_id

Song.artid

Song.name

Song.artist

Song.special

Song.artist_pic240

Song.mp3path

Song.mp3dl

hXXp://

=data.xcode

data.songList

E:\zhuyicheng\boost_1_53_0\boost/spirit/home/classic/utility/impl/chset/range_run.ipp

r.is_valid()

tplayList.trackList

Assertion failed: %s, file %s, line %d

1.15.316.1

FMOlsvr.exe_1716:

.idata

.rdata

`.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

Uh.FB

USER32.DLL

comctl32.dll

uxtheme.dll

OnKeyDown

OnKeyPress

OnKeyUp

UrlMon

Proportional

%s%s%s%s%s%s%s%s%s%s

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordteA

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

AutoHotkeys8~D

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

tagMSG

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

%s, ClassID: %s

ole32.dll

olepro32.dll

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

Uh.AF

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

%s, %.2d %s %.4d %s %s

%s, %d %s %d %s %s

ftpTransfer

ftpReady

ftpAborted

ClientPortMin<

ClientPortMax

Port

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

saUsernamePassword

Password<

0.0.0.1

TIdTCPConnection

TIdTCPConnection0

IdTCPConnection

EIdTCPConnectionError

TIdTCPClient

IdTCPClient

BoundPort

PortU

password

Password

IdHTTPHeaderInfo

ProxyPassword<

ProxyPort

Mozilla/3.0 (compatible; Indy Library)

libeay32.dll

ssleay32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

des_set_key

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

RootCertFile,}@

CertFile,}@

KeyFile

OnGetPasswordTGG

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertError

EIdOSSLLoadingKeyError

CommentURL

TIdHTTPMethod

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

IdHTTPx

TIdHTTPOnHeadersAvailable

TIdHTTPOnRedirectEvent

TIdHTTPResponse

TIdHTTPRequest

TIdHTTPRequestd

TIdHTTPProtocolx

TIdCustomHTTP

TIdCustomHTTPx

TIdHTTP`

TIdHTTP

HTTPOptionst

EIdHTTPProtocolException

HTTPS

https

This request method is supported in HTTP 1.1

HTTP/1.0 200 OK

HTTP/

grfKeyState

TComTargetExecEvent

CmdGroup

nCmdID

nCmdexecopt

hhctrl.ocx

URLMON.DLL

SHDOCLC.DLL

IWebBrowser

IWebBrowserApph

IWebBrowser2

TEWBWindowSetResizable

TEWBWindowSetLeft

TEWBWindowSetTop

TEWBWindowSetWidth

TEWBWindowSetHeight

bstrUrlContext

bstrUrl

OnWindowSetResizable

OnWindowSetLeft

OnWindowSetTopT

OnWindowSetWidth

OnWindowSetHeight

rcmDefault

rcmDebug

DontExecuteScripts

DontExecuteJava

DontExecuteActiveX

DisableUrlIfEncodingUTF8

EnableUrlIfEncodingUTF8

CheckFontSupportsCodePage

DisableSubmitUrlInUTF8

EnableSubmitUrlInUTF8

lpMsg

PMsg

pguidCmdGroup

TTranslateUrlEvent

pchURLIn

ppchURLOut

CmdID

pszUrl

pszUrlContext

szPassWord

ErrorUrl

OptionKeyPath

OverrideOptionKeyPath`

OnTranslateUrl

OnCommandExec

'%s' is not supported.

WebocPopupManagement

ValidateNavigateUrl

HttpUsernamePasswordDisable

GetUrlDomFilePathUnencoded

XmlHttp

MAPI32.DLL

PTF://

hXXp://

hXXps://

AppEvents\Schemes\Apps\Explorer\Navigating\.Current

.Current

\ieframe.dll

\shdocvw.dll

\StringFileInfo\%0.4x%0.4x\%s

TMsgEvent

TKeyEventEx

Bypass

poPortrait

OnKeyDown<

0.750000

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent

\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)(

EmbeddedWB hXXp://bsalsa.com/

TFileOperation

FileOperation

[(*&[^%$#]@!)]

Uh.YJ

OnActionExecute

SysConfig.ini

WJHTTP

%d.%d

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

0123456789

DSound.dll

Winmm.dll

Uh.TM

Uh%fN

Data\User2.ini

88888888

Update2.zip

Update3.zip

00000000

Update.zip

Update.Zip

Update2.Zip

Update3.Zip

FMOL.exe

1.14.729.1

DMSet.Xml

/DM15/DMSet.Xml

hXXp://VVV.baidu.com

hXXp://update.yinyue.fm

8888-88-88

PlayerUpdate.exe

0000-00-00

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\

?456789:;<=

!"#$%&'()* ,-./0123

q%d*c

Ns,n)H%f

.Cqym~#a

.dYR~K

a,.Ve

5.jwez

L".Oh

3.Ciz

g*$y`)$x_)%x^)%x_)%x^'%w["&rR

333333333333333333

33333833

3333333333333338

:*"*"$3338

33333333

33333333333

3333333333338

33338?383

333333333333

:*3:"$3338

333333333333333

@4(@4(@4(@4(@4(@4(@4(@4(@4(@4(@4(@4(

@4(@4(@4(@4(@4(@4(@4(@4(@4(@4(@4(

=4'=4'=4'=4'=4'=4'=4'=4'=4'=4'=4'

=4'=4'=4'=4'=4'=4'=4'=4'=4'=4'

<3&<3&<3&<3&<3&<3&<3&<3&<3&<3&

<3&<3&<3&<3&

<3&<3&<3&<3&<3&<3&<3&<3&<3&

@4(@4(@4(@4(@4(@4(=4'=4'=4'=4'=4'

=4'=4'=4'=4'=4'<3&<3&<3&<3&

[email protected]

N?/N?/N?/N?/N?/N?/N?/N?/N?/O?.N?/M>.PA1

NA1PA.OA/

OA.SB-O@0OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2SC3RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB1RB1SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2RB1SC2RB1RB1QA0RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2TD3TD3TD3TD3TD3TD3TD3TD3TD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3UC2UC2UC2UC2UC2TB1UC2UC2UC2UC2UC2UC2UC2UC2UC2UC2VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3WF3WF3WF3WF3WF3VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2WF3VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3XG4XF5XF5XF5XF5XF5XF5XF5XF5XF5XF5XF5XF5VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4WH5WH5WH5WH5WH5WH5WH5WH5WH5WH5WH5WH5WH5XI6XI6VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4YH5YH5XG4XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]J5]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4^L5]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4^I3^J1^J1^J1^J1^J1^J1^J1^J1^J1^J1^J1_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2^J1^J1^J1^J1^J1^J1^J1^J1_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2^J1`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3_K2`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3aM4aM4aM4aM4aM4aM4aM4aM4cM4cM4cM4cM4cM4

zoaI>0K=1M=0M>.kbX

RH>J=/J=/J=/J=/K>0J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L=-L=-L=-L=-L>,L>,L=-L=-L=-L=-L=-M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@.OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/[email protected]@[email protected]@[email protected]@[email protected]/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/QA0QA0QA0QA0P@/QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0P@/P@/P@/P@/P@/P@/P@/P@/QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1UC2UC2UC2UC2UC2UC2UC2UC2UC2UC2UD1UD1UD1UD1UD1UD1UD1UD1VE2VE2VE2UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2TE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2WF3WF3VE2VE2VE2VE2VE2VE2WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3XG4XG4WF3WF3YE3XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1[F1]F0]F0

g]SF9 E8*E8*E8*E8*F9 E8*E8*E8*E8*E8*E8*E8*E8*E8*E8*E8*F9 F9 F9 F9 F9 G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,E:,E:,G:,G:,G:,F9 F9 F9 F9 F9 F9 F9 F9 G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:*H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,J; J; J; J; J; J; J; J; J; J; J; J; J; J; J; K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,J; J; J; J; J; J; J; J; J; J; J; J; J; J; J; K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-K<,K<,K<,K<,K<,K<,K<,K<,L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-M=-M=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.N>-N>-O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.N>-N>-N>-O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/RA.RA.R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/SA0SA0SA0SA0SA0TB1TB1TB1TB1TB1TB1TB1TB1SA0SA0SA0SA0SA0SA0SA0SA0R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/P@/P@/QB/QB/QB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/QB/QB/QB/QB/QB/QB/QB/QB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.PA.RA.RA.RA.RA.RA.RA.RA.RA.RA.PA.PA.PA.

?6)?6)?6)?6)?6)?6)?6)?6)<6)?6(?6)

@6,>6)?6)

?7*=5(>6)@7*@4(?5 ?5

>5(>5(>5(>5(>5(>5(>5(>5(>5(>5'=5(>5'>6)@5'

;2(;2(;2(;2(;2(;2(;2(;2(;2(;2(;2(92)

<3)?4&=4'=4'=4&

:1':1':1':1':1':1':1':1';1'<2(;2(7/(

93(;2%;3&;2(

mf]<3%>3%SLCng^

|sP@/O@0M@2O@0N?/peWO@0O@0O@0O@0O@0OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/PA.MA/zqc

ZM?OA.OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2SC3RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1QA1RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB2RB1RB1SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2RB1SC2RB1RB1QA0RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1RB1SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2SC2TD3TD3TD3TD3TD3TD3TD3TD3TD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3UC2UC2UC2UC2UC2TB1UC2UC2UC2UC2UC2UC2UC2UC2UC2UC2VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3VD3WF3WF3WF3WF3WF3VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2WF3VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3XG4XF5XF5XF5XF5XF5XF5XF5XF5XF5XF5XF5XF5VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4WH5WH5WH5WH5WH5WH5WH5WH5WH5WH5WH5WH5WH5XI6XI6VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4VG4YH5YH5XG4XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2XG2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2[I2\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3\J3]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]J5]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4^L5]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4]K4^I3^J1^J1^J1^J1^J1^J1^J1^J1^J1^J1^J1_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2^J1^J1^J1^J1^J1^J1^J1^J1_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2_K2^J1`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3_K2`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3`L3aM4aM4aM4aM4aM4aM4aM4aM4cM4cM4cM4cM4cM4

[email protected]@[email protected]?/[email protected]>.M>.YJ:

~J=/J=/J=/J=/J=/K>0J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/J=/L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L</L=-L=-L=-L=-L>,L>,L=-L=-L=-L=-L=-M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@0O@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@.OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/[email protected]@[email protected]@[email protected]@[email protected]/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/OA/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/QA0QA0QA0QA0P@/QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0P@/P@/P@/P@/P@/P@/P@/P@/QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0QA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0SA0TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1TB1UC2UC2UC2UC2UC2UC2UC2UC2UC2UC2UD1UD1UD1UD1UD1UD1UD1UD1VE2VE2VE2UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1UD1VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2TE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2VE2WF3WF3VE2VE2VE2VE2VE2VE2WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3WF3XG4XG4WF3WF3YE3XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0XE0YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1YF1[F1]F0]F0

zui_E8*E8*E8*E8*E8*F9 E8*E8*E8*E8*E8*E8*E8*E8*E8*E8*E8*F9 F9 F9 F9 F9 G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 F9 G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,E:,E:,G:,G:,G:,F9 F9 F9 F9 F9 F9 F9 F9 G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:,G:*H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; H; I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,I<,J; J; J; J; J; J; J; J; J; J; J; J; J; J; J; K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,J; J; J; J; J; J; J; J; J; J; J; J; J; J; J; K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,K<,L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-K<,K<,K<,K<,K<,K<,K<,K<,L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-M=-M=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-L=-M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.M>.N?/N?/N?/N?/N?/N?/N?/N?/N?/N?/O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.N>-N>-O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.N>-N>-N>-O?.O?.O?.O?.O?.O?.O?.O?.O?.O?.P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/P@/RA.RA.R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/SA0SA0SA0SA0SA0TB1TB1TB1TB1TB1TB1TB1TB1SA0SA0SA0SA0SA0SA0SA0SA0R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/R@/P@/P@/QB/QB/QB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/QB/QB/QB/QB/QB/QB/QB/QB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/SB/RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.RA.PA.RA.RA.RA.RA.RA.RA.RA.RA.RA.PA.PA.PA.

=5(;4$=5(=4'<4':4)=4&

;2(:1':1'<2(:1';2(:0&<2(:1'

KWindows

eEWB.IEConst

0IdHTTPHeaderInfo

 IdTCPServer

IdTCPStream

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

PrintOptions.Header

PrintOptions.HTMLHeader.Strings

PrintOptions.Footer

PrintOptions.Orientation

ProxyParams.BasicAuthentication

ProxyParams.ProxyPort

Request.ContentLength

Request.ContentRangeEnd

Request.ContentRangeStart

Request.ContentType

Request.Accept

Request.BasicAuthentication

Request.UserAgent

7Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

HTTPOptions

GetKeyboardLayoutList

DeleteUrlCacheEntry

GetKeyboardState

LoadKeyboardLayoutA

>R.NV

IuK%f

advapi32.dll

GetKeyboardLayout

The ordinal %u could not be located in the dynamic link library %s

GetCPInfo

GetKeyState

Pkernel32.dll

SetWindowsHookExA

GetKeyNameTextA

%FzGv

.qA(A

{.oPJx^

.hGY$AF

.iVU^}

%C Rkb$

!.Ovs/

..oc*q

.RW&vsI

"%dpB

.fSf^

PB.iA

*-.SZ

Oa.Rc

D.bTO[

R.FM~~D

.Gz5m

.djh9<X

.QoTK

#B.qV

l3 .NG

-?ieL%.c

.cCN"U

J%fZ}

.VB$?

GG.Gr

ËGqC

349.kz

vd&.Wt

RD.Lh

*&%6UlB?r

Wr.yA

K%F)~.

OSj%D

z>7}%FG

zNvl

z´%X

%FIZ,

%UU5D

=d~ò

1aCwNR.Dz¾d

.bCR#

InternetOpenUrlA

RegDeleteKeyA

ActivateKeyboardLayout

ShellExecuteA

GetKeyboardType

iphlpapi.dll

The procedure entry point %s could not be located in the dynamic link library %s

RegFlushKey

MsgWaitForMultipleObjects

wininet.dll

RegOpenKeyExA

version.dll

_q3oleaut32.dll

.cRoK

.jnzo

q&rZ%FQY

V.jd&

xYv.aT.Z

SHFileOperationA

RegCloseKey

MapVirtualKeyA

RegEnumKeyExA

6e.eS

UnhookWindowsHookEx

i%s1h&v

RegCreateKeyExA

GetWindowsDirectoryA

RegQueryInfoKeyA

CreateIoCompletionPort

.EgcX,*

SetViewportOrgEx

EnumWindows

gdi32.dll

EnumThreadWindows

shell32.dll

user32.dll

EEG%s/y

errorUrl

1.1.2.15

1.1.2.1115

JPEG error #%d

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

SSL status: "%s"

Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported.$Error accepting connection with SSL.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation now in progress.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Chunk StartedDThis authentication method is already registered with class name %s.

%s is not a valid service.

Socket Error # %d

%s is not a valid IP address.

Operation would block.

File "%s" not found1Only one TIdAntiFreeze can exist per application."%d: Circular links are not allowed

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

Max line length exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

OLE control activation failed*Could not obtain OLE control window handle%License information for %s is invalidPLicense information for %s not found. You cannot use this control in design modeNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.

No help keyword specified.

Alt  Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Thread creation error: %s

Thread Error: %s (%d)

Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic

Unsupported clipboard format

$''%s'' is not a valid component name

Invalid data type for '%s' List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Failed to create key %s

Failed to get data for '%s'

Failed to set data for '%s'

Resource %s not found

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Unable to write to %s

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

FMOlsvr.exe_1716_rwx_0056E000_00001000:

GetKeyboardLayoutList

DeleteUrlCacheEntry

ole32.dll

GetKeyboardState

LoadKeyboardLayoutA

FMOlsvr.exe_1716_rwx_0060F000_00002000:

.EgcX,*

SetViewportOrgEx

EnumWindows

gdi32.dll

EnumThreadWindows

shell32.dll

user32.dll

FHSev.exe_828:

.idata

.rdata

P.FMS0

`.rsrc

P.FMS1

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

DragKindH%C

OnKeyDown

OnKeyPress

OnKeyUp

Proportional

%s%s%s%s%s%s%s%s%s%s

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

ControlsL%C

TKeyEvent

TKeyPressEvent

HelpKeyword

crSQLWait

%s (%s)

imm32.dll

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

Password

OnExecutex

advapi32.dll

%s, ClassID: %s

ole32.dll

PSAPI.dll

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

[(*&[^%$#]@!)]

SysConfig.ini

~nB%uN

<requestedExecutionLevel level="requireAdministrator"/>

KWindows

UrlMon

UnhookWindowsHookEx

ReportEventA

GetKeyboardLayout

iphlpapi.dll

EnumWindows

@N.zL>

R.KC4~.

n.SX"

:z.nq

%f,V$

1.Pfh

o`.wv

GetKeyState

ActivateKeyboardLayout

GetWindowsDirectoryA

URLMON.DLL

GetKeyNameTextA

EnumThreadWindows

URLDownloadToFileA

RegCloseKey

SetViewportOrgEx

SetWindowsHookExA

!%.IZVrt

wininet.dll

MapVirtualKeyA

gdi32.dll

GetKeyboardLayoutList

'.Qapr

GetKeyboardState

%##,<`[~

user32.dll

InternetOpenUrlA

RegOpenKeyExA

GetKeyboardType

version.dll

LoadKeyboardLayoutA

)%.CI

GetCPInfo

( (=8{[;

MsgWaitForMultipleObjects

SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA

1.0.0.0

1.0.0.0818 - 2

NUnable to retrieve a pointer to a running object registered with OLE for %s/%s

No help keyword specified.

OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

/Service "%s" failed to install with error: "%s" Service uninstalled successfully1Service "%s" failed to uninstall with error: "%s"

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons

Cannot open clipboard/Menu '%s' is already being used by another form

Service failed on %s: %s

shutdown(Service failed in custom message(%d): %s

Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window

Thread creation error: %s

Thread Error: %s (%d)

Unsupported clipboard format

$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Unable to write to %s

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

FHSev.exe_828_rwx_004BA000_00001000:

32.dll

InternetOpenUrlA

RegOpenKeyExA

GetKeyboardType

version.dll

LoadKeyboardLayoutA

ExAd.exe_464:

.text

`.rdata

@.data

.rsrc

@.reloc

D$@PSSh

8%u/P

xSSSh

FTPjKS

FtPj;S

C.PjRV

MD5 part of OpenSSL 1.0.2 22 Jan 2015

windows936

windows932

windows874

windows1257

windows1256

windows1255

windows1254

windows1253

windows1252

windows1251

windows1250

Invalid or unsupported charset:

Visual C   CRT: Not enough memory to complete call to strerror.

portuguese-brazilian

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

operator

kernel32.dll

adurl

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

%s {%s}

d-d-d d:d:d

D:\CPP\[20130719]MoblieApp\svn_hdwApp_iOS\trunk\HdwApp_iOS\bin_game\Release\exad.pdb

KERNEL32.dll

USER32.dll

GDI32.dll

RegCreateKeyExW

RegQueryInfoKeyW

RegDeleteKeyW

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

ADVAPI32.dll

ole32.dll

OLEAUT32.dll

PathIsURLW

SHLWAPI.dll

gdiplus.dll

InternetOpenUrlW

HttpQueryInfoW

HttpOpenRequestW

HttpSendRequestW

HttpAddRequestHeadersW

InternetCrackUrlW

WININET.dll

VERSION.dll

SensApi.dll

GetProcessHeap

GetCPInfo

zcÁ

.?AVHttpContent@@

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

5 5$5(5,5054585<5

8#:(:2:~:

< <(<0<8<

mscoree.dll

nKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

WUSER32.DLL

hXXp://updatetest.wuji.com/llq.ashx

hXXp://load.yinyue.fm/api/getprocess

exadsub.exe

"%s" "%d" "%s" "%d" "%d" "%d" "%d"

%s::%d InitConfig Error

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_PERFORMANCE_DATA

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CLASSES_ROOT

Advapi32.dll

shell.Explorer.2

%d.%d.%d.%d

logger.log

Mozilla/4.0 (Compatible; MSIE6.0;)

hXXp://

HTTP/1.0

%Program Files%\fmol_201504060706\201504060706\ExAd.exe

1.15.316.1

exad.exe

YYTJ.exe_444:

.idata

.rdata

`.rsrc

kernel32.dll

Windows

MSWHEEL_ROLLMSG

MSH_WHEELSUPPORT_MSG

MSH_SCROLL_LINES_MSG

$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)

oleaut32.dll

EVariantBadIndexError

ssShift

htKeyword

EInvalidOperation

u%CNu

%s[%d]

%s_%d

EInvalidGraphicOperation

USER32.DLL

comctl32.dll

uxtheme.dll

IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")

JumpID("","%s")

TKeyEvent

TKeyPressEvent

HelpKeywordlXA

crSQLWait

%s (%s)

Uh.rC

imm32.dll

AutoHotkeys

ssHotTrack

TWindowState

poProportional

TWMKey

KeyPreview

WindowState

OnKeyDownx

OnKeyPress,

OnKeyUpP

System\CurrentControlSet\Control\Keyboard Layouts\%.8x

vcltest3.dll

User32.dll

getservbyport

WSAAsyncGetServByPort

WSAJoinLeaf

WS2_32.DLL

127.0.0.1

TIdSocketListWindows

TIdStackWindowsU

IdStackWindows

Uh.hE

%s, %.2d %s %.4d %s %s

%s, %d %s %d %s %s

ftpTransfer

ftpReady

ftpAborted

ClientPortMin<

ClientPortMax

Port`

EIdCanNotBindPortInRange

EIdInvalidPortRangeSVW

saUsernamePassword

Password<

Port

0.0.0.1

TIdTCPConnection

IdTCPConnection

EIdTCPConnectionError

TIdTCPClient

IdTCPClient

BoundPort

PortU

password

Password

IdHTTPHeaderInfo

ProxyPassword<

ProxyPort

Mozilla/3.0 (compatible; Indy Library)

libeay32.dll

ssleay32.dll

SSL_CTX_use_PrivateKey_file

SSL_CTX_use_certificate_file

SSL_get_peer_certificate

SSL_CTX_set_default_passwd_cb

SSL_CTX_set_default_passwd_cb_userdata

SSL_CTX_check_private_key

X509_STORE_CTX_get_current_cert

des_set_key

sslvrfFailIfNoPeerCert

TPasswordEvent

Certificate

RootCertFile

CertFile

KeyFileHIF

OnGetPassword

EIdOSSLLoadingRootCertError

EIdOSSLLoadingCertErrorxUF

EIdOSSLLoadingKeyError

CommentURL

TIdHTTPMethod

IdHTTP

TIdHTTPOption

TIdHTTPOptions

TIdHTTPProtocolVersion

TIdHTTPOnHeadersAvailable

TIdHTTPOnRedirectEvent

TIdHTTPResponse

TIdHTTPResponse(

TIdHTTPRequest

TIdHTTPProtocol

TIdCustomHTTP

TIdHTTP

TIdHTTP$

HTTPOptions

PortX

EIdHTTPProtocolException

HTTPS

https

This request method is supported in HTTP 1.1

HTTP/1.0 200 OK

HTTP/

%s, ClassID: %s

ole32.dll

PSAPI.dll

SPHttp

KERNEL32.DLL

\Windows\

iexplore.exe

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

hXXp://update.yinyue.fm

/db/db.zip

?v=1.15.316.1

YYTJ.dll

0123456789

?456789:;<=

!"#$%&'()* ,-./0123

9H.OO c

TF.HN@)bM?*8L>)

KWindows

UrlMon

0IdHTTPHeaderInfo

 IdTCPServer

IdTCPStream

Font.Charset

Font.Color

Font.Height

Font.Name

Font.Style

ProxyParams.BasicAuthentication

ProxyParams.ProxyPort

Request.ContentLength

Request.ContentRangeEnd

Request.ContentRangeStart

Request.Accept

Request.BasicAuthentication

Request.UserAgent

7Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

GetKeyState

shell32.dll

hS.Ic

GetCPInfo

version.dll

GetKeyboardLayout

GetKeyboardState

GetKeyboardLayoutList

The procedure entry point %s could not be located in the dynamic link library %s

SetWindowsHookExA

SetViewportOrgEx

user32.dll

advapi32.dll

LoadKeyboardLayoutA

gdi32.dll

GetKeyboardType

hj.IS

MsgWaitForMultipleObjects

EnumThreadWindows

InternetOpenUrlA

HN.riN"Z13

0&%xR

9.YL2

#.-6Q}"

%xwk|

1;7 = 3 9#? %(

 ^ .TQ

A"%dM

_`.yTZ1&WE

b6.HN

E%c!g$

3K.AT

~.Qxy

qBn%C

^fnpJ.iJb

$>82<60*

_e%FY

RegOpenKeyExA

wininet.dll

ActivateKeyboardLayout

2s**.eF

a{.pL

!p.xeX

.Cj\|

L_JH%x

GetWindowsDirectoryA

iphlpapi.dll

UnhookWindowsHookEx

MapVirtualKeyA

GetKeyNameTextA

RegCloseKey

EnumWindows

The ordinal %u could not be located in the dynamic link library %s

SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA

1.0.0.0

1.0.0.20150316

/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters

DCOM not installedNUnable to retrieve a pointer to a running object registered with OLE for %s/%s

Error creating SSL context. Could not load root certificate.

Could not load certificate.#Could not load key, check password.

SSL status: "%s"

OLE error %.8x.Method '%s' not supported by automation object

5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.

Command not supported.

Address type not supported.$Error accepting connection with SSL.

Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.

Operation already in progress.

Socket operation on non-socket.

Protocol not supported.

Socket type not supported."Operation not supported on socket.

Protocol family not supported.0Address family not supported by protocol family.

Chunk StartedDThis authentication method is already registered with class name %s.

%s is not a valid service.

Socket Error # %d

%s is not a valid IP address.

Operation would block.

Operation now in progress.

File "%s" not found1Only one TIdAntiFreeze can exist per application."%d: Circular links are not allowed

No data to read.$Can not bind in port range (%d - %d)

Invalid Port Range (%d - %d)

Max line length exceeded.*Error on call Winsock2 library function %s&Error on loading Winsock2 library (%s)

Resolving hostname %s.

Connecting to %s.

No help keyword specified.

Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information.

No help found for %s#No context-sensitive help installed$No topic-based help system installed

Alt  Clipboard does not support Icons/Menu '%s' is already being used by another form

 Cannot focus a disabled or invisible window!Control '%s' has no parent window

Thread creation error: %s

Thread Error: %s (%d)

Unsupported clipboard format

$''%s'' is not a valid component name

Invalid property value List capacity out of bounds (%d)

List count out of bounds (%d)

List index out of bounds (%d) Out of memory while expanding memory stream

Error reading %s%s%s: %s

Resource %s not found

%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group

Property %s does not exist

Ancestor for '%s' not found

Cannot assign a %s to a %s

Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread

Class %s not found

A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates

Cannot create file "%s". %s

Cannot open file "%s". %s

Unable to write to %s

Operation not supported

External exception %x

Interface not supported

%s (%s, line %d)

Abstract Error?Access violation at address %p in module '%s'. %s of address %p

System Error. Code: %d.

1Format '%s' invalid or incompatible with argument

No argument for format '%s'"Variant method calls not supported

Invalid variant operation%Invalid variant operation (%s%.8x)

%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)

Integer overflow Invalid floating point operation

Invalid pointer operation

Invalid class typecast0Access violation at address %p. %s of address %p

Privileged instruction(Exception %s in module %s at %p.

!'%s' is not a valid integer value('%s' is not a valid floating point value

'%s' is not a valid date

'%s' is not a valid time!'%s' is not a valid date and time

I/O error %d

YYTJ.exe_444_rwx_00493000_00001000:

GetKeyboardLayoutList

The procedure entry point %s could not be located in the dynamic link library %s

YYTJ.exe_444_rwx_00495000_00001000:

SetViewportOrgEx

user32.dll

advapi32.dll

LoadKeyboardLayoutA

gdi32.dll

YYTJ.exe_444_rwx_004D4000_00001000:

oleaut32.dll

ActivateKeyboardLayout

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):

FMOlsvr.exe:1872
%original file name%.exe:1844
fmol.exe:1984
ExAd.exe:464
FHSev.exe:1788
FHSev.exe:1676
FHSev.exe:1228
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:

%Program Files%\fmol_201504060706\201504060706\YYTJ.dll (6584 bytes)
%Program Files%\fmol_201504060706\201504060706\avcore.dll (2392 bytes)
%Program Files%\fmol_201504060706\201504060706\audio.dll (3616 bytes)
%Program Files%\fmol_201504060706\201504060706\fmol.exe (65976 bytes)
%Program Files%\fmol_201504060706\201504060706\libav.dll (6360 bytes)
%Program Files%\fmol_201504060706\201504060706\SysConfig.ini (760 bytes)
%Program Files%\fmol_201504060706\201504060706\avformat-54.dll (12088 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IT41S12B\desktop.ini (67 bytes)
%Program Files%\fmol_201504060706\201504060706\source.dll (6584 bytes)
%Program Files%\fmol_201504060706\201504060706\avcodec-54.dll (23424 bytes)
%Program Files%\fmol_201504060706\201504060706\swresample-0.dll (3312 bytes)
%Program Files%\fmol_201504060706\201504060706\FHSev.exe (11048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPARIDE3\desktop.ini (67 bytes)
%Program Files%\fmol_201504060706\201504060706\ExAd.exe (12024 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\user2.ini (24 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MFAN0XAD\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\fmol\fmol.lnk (880 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\fmol\Ãƒâ€¦ÃƒÂ¤Ãƒâ€“ÃƒÆ’Ã‚Â¹Ã‚Â¤Ã‚Â¾ÃƒÅ¸\ÃƒÂÃ‚Â¶Ãƒâ€ÃƒËœfmol.lnk (899 bytes)
%Program Files%\fmol_201504060706\201504060706\pthreadGC2.dll (3616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\desktop.ini (67 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\client.ini (36 bytes)
%Program Files%\fmol_201504060706\201504060706\Unins.exe (9608 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\version.ini (32 bytes)
%Program Files%\fmol_201504060706\201504060706\avutil-52.dll (5520 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\stj[1].htm (3 bytes)
%Program Files%\fmol_201504060706\201504060706\favorfm.xml (440 bytes)
%Program Files%\fmol_201504060706\201504060706\FMOlsvr.exe (23936 bytes)
%Program Files%\fmol_201504060706\201504060706\channels.xml (784 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\fmol\Ã‚Â¹Ãƒâ„¢Ã‚Â·Ã‚Â½Ãƒâ€“ÃƒÂ·Ãƒâ€™Ã‚Â³.lnk (334 bytes)
%Program Files%\fmol_201504060706\201504060706\YYTJ.exe (12536 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\setup.ini (56 bytes)
%Program Files%\fmol_201504060706\201504060706\DuiLib.dll (16288 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\server.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\1113[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MFAN0XAD\ver[1].txt (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\a[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MPARIDE3\getprocess[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Z9238LUB\llq[1].htm (3 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OFK7QZUX\Update2[1].rar (1497 bytes)
%Program Files%\fmol_201504060706\201504060706\Data\0706.Tmp (1 bytes)
%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QLSNQ10Z\fwtj[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IT41S12B\qweasd[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\35bc841c.DAT (655 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FMOLL_svr_201504060706" = "%Program Files%\fmol_201504060706\201504060706\FMOlsvr.exe -mini"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FMOLL_201504060706" = "%Program Files%\fmol_201504060706\201504060706\fmol.exe -mini"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Trojan.GenericKD.2228674_1afcf91ef9

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Trojan.GenericKD.2228674_1afcf91ef9

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet