MD5: 01590aa987c1410ad5e71f7da79f8e20
SHA1: 9a0b59b1a0ac173822e1b27dccedf8dd191a5573
SHA256: 99d84004bab55d9ec13a184200a9c4604689ee4dcca846c7b2910b7d26a2bcff
SSDeep: 98304: jiVHM1yeAGwzA HVyNcEhJuxJJVc/aToCfqBKzOU:RSA 6ANHhGJvMrKzOU
Size: 3483128 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: ASPackv212, UPolyXv05_v6
Company: Firseria
Created at: 2017-09-28 17:05:36
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:3148

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:3148 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\c811cdec13b869980d35d80854d6ee98.txt (420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\65f6abe6a4f101e743eab4f55d18313b.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\212b0fa0fa111459cc3edae1d50ba7f8.txt (420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ea81016697da3e03d2125f1b020a8d96.txt (420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8df8373986d2124c43b3d42c81e8f3df.txt (226 bytes)

Registry activity

The process %original file name%.exe:3148 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\01590aa987c1410ad5e71f7da79f8e20_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\01590aa987c1410ad5e71f7da79f8e20_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\01590aa987c1410ad5e71f7da79f8e20_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\01590aa987c1410ad5e71f7da79f8e20_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\01590aa987c1410ad5e71f7da79f8e20_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\01590aa987c1410ad5e71f7da79f8e20_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\01590aa987c1410ad5e71f7da79f8e20_RASAPI32]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\01590aa987c1410ad5e71f7da79f8e20_RASAPI32]
"EnableConsoleTracing" = "0"
"ConsoleTracingMask" = "4294901760"

"MaxFileSize" = "1048576"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://imgsa.jomodns.com/forum/pic/item/838ba61ea8d3fd1fb85125ca384e251f94ca5fe2.jpg
www.75pk.cn	116.211.143.21
imgsa.baidu.com	119.146.74.48

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Unsupported/Fake Windows NT Version 5.0
ET POLICY HTTP Request on Unusual Port Possibly Hostile

Traffic

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

.aspack

.adata

t$(SSh

~%UVW

u$SShe

ntdll.dll

kernel32.dll

shlwapi.dll

yT%fZ

g\#.Dkf

%f<: bw

0.ISfZ4

%Skj:

O)tM.vb

.qnZ6|md

.TAn}z

,Ub0-l}Q

Q%UFcY

uN.cD

Ly.XtU^*

G|Z%d

k.eX&h

pG.Le

.OKG'

k@v%D

.qjKb

.>;$>:$~

%.IiZ

h%C;BD

O.rlA

G  H~.Ou}*@6

*6%XS2

)Dz.Bc

%.IWi

^F%Fi

5S%U)

uLp|.aNS

%fTl&K

sE%u7^

IwEB

aSSSh

FTPjK

FtPj;

C.PjRV

.mixcrt

KERNEL32.DLL

mscoree.dll

portuguese-brazilian

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

operator

GetProcessWindowStation

USER32.DLL

inflate 1.1.3 Copyright 1995-1998 Mark Adler

&#xX;

</%s>

%s="%s"

%s='%s'

<!--%s-->

<![CDATA[%s]]>

version="%s"

encoding="%s"

standalone="%s"

lzma 7z ace arc arj bz bz2 deb lzo lzx gz pak rpm sit tgz tbz tbz2 tgz cab ha lha lzh rar zoo zip jar ear war msi 3gp avi mov mpeg mpg mpe wmv aac ape fla flac la mp3 m4a mp4 ofr ogg pac ra rm rka shn swa tta wv wma wav swf chm hxi hxs gif jpeg jpg jp2 png tiff bmp ico psd psp awg ps eps cgm dxf svg vrml wmf emf ai md cad dwg pps key sxi max 3ds iso bin nrg mdf img pdi tar cpio xpi vfd vhd vud vmc vsv vmdk dsk nvram vmem vmsd vmsn vmss vmtm inl inc idl acf asa h hpp hxx c cpp cxx rc java cs pas bas vb cls ctl frm dlg def f77 f f90 f95 asm sql manifest dep mak clw csproj vcproj sln dsp dsw class bat cmd xml xsd xsl xslt hxk hxc htm html xhtml xht mht mhtml htw asp aspx css cgi jsp shtml awk sed hta js php php3 php4 php5 phptml pl pm py pyo rb sh tcl vbs text txt tex ans asc srt reg ini doc docx mcw dot rtf hlp xls xlr xlt xlw ppt pdf sxc sxd sxi sxg sxw stc sti stw stm odt ott odg otg odp otp ods ots odf abw afp cwk lwp wpd wps wpt wrf wri abf afm bdf fon mgf otf pcf pfa snf ttf dbf mdb nsf ntf wdb db fdb gdb exe dll ocx vbx sfx sys tlb awx com obj lib out o so pdb pch idb ncb opt

d:\QQPCDownloader_proj\PackageTools\product\win32\dbginfo\kpacket.pdb

KERNEL32.dll

USER32.dll

ole32.dll

OLEAUT32.dll

SHLWAPI.dll

GetProcessHeap

GetCPInfo

GetConsoleOutputCP

zcÁ

.?AUICryptoSetPassword@@

.?AVCCryptoGetTextPassword@N7z@NArchive@@

.?AUICryptoGetTextPassword@@

<assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Microsoft.Windows.HummerSetup" type="win32"></assemblyIdentity>

Hummer Setup EXE

<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>

trr%d

{N.CrNW

C.is9

%XI~AH8

x.YR6

x.AoA

.eh(T

]!.Gg

h>uv.srj

-01.YjP

/h.bN^2MQ(

.Fcx]

wb.Tf

<9.NA

4z.ZtQ0

o..Iv

%s.GC

.Gp3}n

MO>JkeY

.hlCh

df".XW

L%u^B

d.Bj|

:%D*toQ

6.Gke

.Jw Lu

%U>5[

%D~Z(

RE\.rK|

Xk%DV:

=Up%sf

rL(W.iP

ÄX~

Ex.nO

2y.TV;

c-f%SH>

53XZ.eOq

;':.uE8(

&~.BXk

.cngp

Q%fHx

ql#x%f

.BDHp(

1@[QI.tz#

,CRt%

.sw} 

.TAZJ

U.BEe

k.mw7

m-&.seM

o7\<.Jb"

&Z%Ux

.zlMp

i>%Su

xY^Y.keC;

}I.kB0

Sshf&5Rd3

o.Wje

o$?.Vo4EA

Rh%dw

r/.oy5

k.KMS

$._ L%C

qi.SF

9"6%D

0J(keY\

9-.ht

4Y4.vN

a=%D,

.bsUJ[O

iÚrX

.JurZ;

E.QER

.CB$`U

Jp.ot

\s.eT\j

VhL.rk

%fx e%

%X0f6

%x57N

~.%F'

X.oG6

w>.Sc

ù]q

2v.Yo

?DL].Hai(

0.fk`r

Thawte Certification1

hXXp://ocsp.thawte.com0

.hXXp://crl.thawte.com/ThawteTimestampingCA.crl0

hXXp://ts-ocsp.ws.symantec.com07

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0<

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0(

.Class 3 Public Primary Certification Authority0

<VeriSign Class 3 Public Primary Certification Authority - G50

hXXp://crl.verisign.com/pca3.crl0

hXXps://VVV.verisign.com/cps0

#hXXp://logo.verisign.com/vslogo.gif04

hXXp://ocsp.verisign.com0>

2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,

hXXp://sf.symcb.com/sf.crl0a

hXXps://d.symcb.com/cps0%

hXXps://d.symcb.com/rpa0

hXXp://sf.symcd.com0&

hXXp://sf.symcb.com/sf.crt0

hXXps://VVV.verisign.com/cps0*

hXXps://VVV.verisign.com/rpa0

#hXXp://crl.verisign.com/pca3-g5.crl04

hXXp://ocsp.verisign.com0

hXXp://sv.symcb.com/sv.crl0a

hXXp://sv.symcd.com0&

hXXp://sv.symcb.com/sv.crt0

hXXp://s2.symcb.com0

hXXp://VVV.symauth.com/cps0(

hXXp://VVV.symauth.com/rpa00

hXXp://s1.symcb.com/pca3-g5.crl0

 hXXp://ts-crl.ws.symantec.com/tss-ca-g2.crl0

 hXXp://ts-aia.ws.symantec.com/tss-ca-g2.cer0

@.reloc

>%u6V

8Y%u-

QSShD

Qj.hLR

%.8X%s

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

^dm%dwChatFrameID

bufStoreFaceKey

bufKey

buffKey

rpt_msg_item

bufPtlogin2SKey

msg_subcmd_0x2_rsp_body

msg_subcmd_0x1_rsp_body

msg_subcmd_0x2_req_body

uint32_sub_cmd

pSkeyBuf

bsReqProtoMsgName

pReqProtoMsgData

bsRspProtoMsgName

bMsgNormalType

nMsgBtnType

strMsgText

strMsgTitle

RBtnMenu.arrSubMenu

FirstLoginTimeToday

bsShortcut

rpt_msg_tabinfo

Qcmd

support_id

CertNameToStrW

msg_subcmd0x6_rsp_collectauth

msg_subcmd0x6_req_collectauth

rpt_bytes_key

msg_subcmd0x3_rsp_fetchbq

msg_subcmd0x3_req_fetchbq

tencent.im.cs.cmd0x350.ReqBody

wCsCmdNo:

uint32_subcmd

msg_cs_head

msg_internal_head

?pbsMsg

bytes_original_down_url

rpt_msg_exproam_pic_info

rpt_msg_tryup_img_rsp

rpt_msg_tryup_img_req

msg_info4busi

bytes_up_ukey

rpt_uint32_up_port

tencent.im.cs.cmd0x388.ReqBody

wPort

(tencent.im.cs.cmd0x388.ExtensionExpRoamTryUp

bMoreMsg

arrayOperationFaceGroup

bNeedHandleMsg

iMsgPack

keyword

msg_ret_array_rsp

bStopSendMsg

cSubCmd

UrlConfig

strWinksUrl

bSelfMsg

iMsgData

face_key

link_url

rpt_msg_tab_info_list

msg_subcmd_rsp_fetchtab

msg_subcmd_req_fetchtab

tencent.im.cs.cmd0x36f.ReqBody

Qtencent.im.cs.cmd0x348.ReqBody

msg_subcmd_0x1_req_body

Qtencent.im.cs.cmd0x349.ReqBody

Qmsg_subcmd0x1_req_deltab

msg_subcmd0x2_rsp_fetchtab

msg_subcmd0x2_req_fetchtab

R:\TempView\Output\BinFinal\CustomFace.pdb

UtilGif.dll

xImage.dll

?DownloadToFile@CHttpClient@@QAEHPB_W_K0PAVIHttpClientSink@@@Z

?SetMoveQNCPath@CHttpClient@@QAEXPB_WH@Z

?SetUserdata@CHttpClient@@QAEXPAX@Z

?SetComputeMd5@CHttpClient@@QAEXH@Z

??1CHttpClient@@QAE@XZ

?IsInitAsyncMsgLoop@Misc@Util@@YAHXZ

?GetDownloadQNCPath@CHttpClient@@QBEHAAVCTXStringW@@@Z

?GetUserdata@CHttpClient@@QAEXPAPAX@Z

??0CHttpClient@@QAE@XZ

?Download@CTXHttpDownload@@QAEHPB_WPAU_SYSTEMTIME@@0HPA_J@Z

?IsRunning@CTXHttpDownload@@QAEHXZ

?MoveDownloadFile@CTXHttpDownload@@QAEHPB_WH@Z

?GetDownloadedFilePath@CTXHttpDownload@@QAEHAAVCTXStringW@@@Z

?GetLoginServerTime@Time@Util@@YAKXZ

??1CTXHttpDownloadSink@@UAE@XZ

??1CTXHttpDownload@@UAE@XZ

?SetUIInterface@CTXHttpDownload@@QAEXPAVCTXHttpDownloadSink@@@Z

??0CTXHttpDownload@@QAE@XZ

??0CTXHttpDownloadSink@@IAE@XZ

?Run@CTXHttpDownload@@EAEIXZ

?OnConnecting@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z

?OnConnected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@@Z

?OnDownloadStart@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z

?OnProgress@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@KK@Z

?OnRedirected@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@PB_W@Z

?OnError@CTXHttpDownloadSink@@UAEXPAVCTXHttpDownload@@K@Z

?SetCustomData@CTXHttpDownload@@QAEHPAUIUnknown@@@Z

?GetCustomData@CTXHttpDownload@@QAEHPAPAUIUnknown@@@Z

?UploadFile@CHttpClient@@QAEHPB_W0PAVIHttpClientSink@@@Z

?CancelDownload@CTXHttpDownload@@QAEXXZ

??0CCmdCodecBase@@QAE@XZ

?QueryInterface@CCmdCodecBase@@MAGJABU_GUID@@PAPAX@Z

?AddRef@CCmdCodecBase@@MAGKXZ

?Release@CCmdCodecBase@@MAGKXZ

?CodeTXData@CCmdCodecBase@@UAGJPAUITXData@@PAPAUITXBuffer@@@Z

?DecodeBuffer@CCmdCodecBase@@UAGJPAUITXBuffer@@PAPAUITXData@@PAU3@@Z

??1CCmdCodecBase@@UAE@XZ

?CodeEndArray@CCmdCodecBase@@IAEXXZ

?CodeArrayTXDataNumber@CCmdCodecBase@@IAEXPBDW4TX_DATA_TYPE@@@Z

?CodeArrayLenHead@CCmdCodecBase@@IAEXPBDW4CMDFIELDTYPE@@H@Z

?CodeNumber@CCmdCodecBase@@IAEXPBDW4TX_DATA_TYPE@@@Z

?CodeBuffer@CCmdCodecBase@@IAEXPBD@Z

?DownloadToBuffer@CTXHttpDownload@@QAEHPB_WPAU_SYSTEMTIME@@@Z

?GetDownloadedBuffer@CTXHttpDownload@@QAEHPAPAEPAK@Z

?GetLastModifyTime@CTXHttpDownload@@QAEHAAU_SYSTEMTIME@@@Z

?Cancel@CMultiHttpDownloader@@QAEHK@Z

?GetInstance@CMultiHttpDownloader@@SAAAV1@XZ

?AddTask@CMultiHttpDownloader@@QAEXABVCTXStringW@@00HHPAUIUnknown@@PAVVMultiHttpSink@@PAK@Z

?OnMultiHttpEvt_Progress@VMultiHttpSink@@UAEXKHPAUtagTaskInfo@MultiHttp@@@Z

?SetUseUtf8Head@CTXHttpDownload@@QAEXH@Z

?GetDownloadFilePath@CHttpClient@@QBEHAAVCTXStringW@@@Z

?DecodeNumber@CCmdCodecBase@@IAEXPBDW4TX_DATA_TYPE@@@Z

?SetEventMask@CTXHttpDownload@@QAEXE@Z

?DecodeUrl@Encode@Util@@YA?AVCTXStringW@@ABV3@_N@Z

Common.dll

?DispatchFrameMsg@GF@Util@@YAJPAUIGFFrame@@PAUtagBaseArg@@PAHPAJH@Z

GF.dll

?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@W4URLMODIFYLEVEL@12@0@Z

?GetSignFmt@URL@Util@@YAXAAVCFmtString@@@Z

?GetNickname@Contact@Util@@YA?AVCTXStringW@@K@Z

?OpenUrlInIM@URL@Util@@YAXABVCTXStringW@@@Z

?AdjustUrl@URL@Util@@YA?AVCTXStringW@@ABV3@W4URLMODIFYLEVEL@12@0@Z

?SetDataDWord@DataReport@Util@@YAJKPBDK@Z

KernelUtil.dll

AFUtil.dll

xGraphic32.dll

?SetPerfReportDataForWord@PerfDataReportUtil@@YAXPA_WKH@Z

AFBase.DLL

AppUtil.dll

arkImage.dll

arkIOStub.dll

AsyncTask.dll

OLEACC.dll

GetKeyState

EnumWindows

UnhookWindowsHookEx

SetWindowsHookExW

GDI32.dll

RegOpenKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegCloseKey

RegEnumKeyExW

ADVAPI32.dll

SHELL32.dll

ATL100.DLL

MSVCP100.dll

MSVCR100.dll

_malloc_crt

_amsg_exit

_crt_debugger_hook

GdiplusShutdown

gdiplus.dll

WINMM.dll

CustomFace.dll

<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>

6)6@6]6{6

11C1g1m1w1

3 4G4D4J4]4n4t4

7 7'7.7;7

4F4D4

8#8)808=8

3.3:3\3{3

4[5 6 6=6

9"9)939:9

1"1)101]2

0"0)00070

4!4(4/4<4{4

2%2C2H2\2b2h2w2

11C1`1

3(4-4G4U4o4}4

</=5=@=]=

6(6-646>6~6

0$1)10171]1

5c6D6T6n6s6z6

1!1&1-141

1!2&2-272

;#;4;?;{;

5#555`5~5

7$7 727?7

6&7 727<7_7

<,=1=8=?=`=

9#9)9-989

7 7$7(7,7074787

= =$=(=,=

> ?$?(?,?0?4?

; ;$;(;,;0;4;8;<;@;

? ?$?(?,?0?

< <$<(<,<0<4<8<<<@<

?$?(?,?0?4?

8094989<9

8 8$8(8,8084888<8

3 3$3(3,3034383<3

5 5$5(5,585

5 5$5(5,505

= =$=(=,=0=4=8=<=

> >$>(>,>0>4>8><>@>

: :$:(:,:0:

0 0$0(0,0

1 1$1(1,1014181

3,383@3`3

>,>8>@>`>

9,989@9`9

8(8,8084888

.rodata

@.rsrc

????%????

WEBP

3333333

>.unF

%UUUU 

VSSSSSSh`

?Assertion %s failed at %s:%d

"*192:# 

$,3;4<%-

&.5=6>'/7?

"#()01* $%&',-./2389:;4567<=>?

"*2:# 3;

$,4<%-5=

&.6>'/7?

08491<5="*& #.'/2:6;3>7?

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\utils.c

Too many channels: %d.

skip %d/%d samples

skip whole frame, skip left: %d

skip %d samples due to side data

Codec 0x%x is not in the full list.

If you want to help, upload a sample of this file to PTF://upload.ffmpeg.org/MPlayer/incoming/ and contact the ffmpeg-devel mailing list.

, %d kb/s

, pass 2

, pass 1

, q=%d-%d

[SAR %d:%d DAR %d:%d]

, %dx%d

(%d bpc)

, %d Hz

, %d/%d

(%s / 0xX)

%s: %s%s

The maximum value for lowres supported by the decoder is %d

Character encoding subtitles conversion needs a libavcodec built with iconv support for this codec

Codec '%s' is bitmap-based, subtitles character encoding will be ignored

Character encoding is only supported with subtitles codecs

Channel layout '%s' with %d channels does not match specified number of channels %d: ignoring specified channel layout

Bitrate %d is extremely low, maybe you mean %dk

Specified channel layout '%s' is not supported

Channel layout '%s' with %d channels does not match number of specified channels %d

Specified sample rate %d is not supported

Specified pixel format %s is invalid or not supported

Specified sample format %s is invalid or not supported

Alternatively use the non experimental %s '%s'.

The %s '%s' is experimental but experimental codecs are not enabled, add '-strict %d' if you want to use it.

This AVCodecContext was allocated for %s, but %s passed to avcodec_open2()

!"#$%&'(

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\vp3.c

Invalid token %d

Invalid zero run of %d with %d coeffs left

Invalid number of coefficents at level %d

Invalid dimensions (%dx%d)

Theora bitstream version %X

invalid qi %d > 63

%d bits left in packet %X

Unknown Theora config packet: %d

vp3: first frame not a keyframe

Warning, unsupported keyframe coding type?!

VP version: %d

VP3 %sframe #%d: Q index = %d

Header packet passed to frame decoder, skipping

midstream reconfiguration with multithreading is unsupported, try -threads 1

#*1892 $

%,3:;4-&

'.5<=6/7>?

SMPTE 336M Key-Length-Value (KLV) metadata

WebVTT subtitle

webvtt

RealAudio SIPR / ACELP.NET

Windows Media Audio Lossless

Windows Media Audio 9 Professional

Windows Media Audio Voice

Monkey's Audio

Windows Media Audio 2

Windows Media Audio 1

MS Windows Media Video V9 Screen

Windows Media Video 9 Image v2

Windows Media Video 9 Image

WebP

webp

V.Flash PTX image

BMP (Windows and OS/2 bitmap)

Windows Media Video 9

PAM (Portable AnyMap) image

PGMYUV (Portable GrayMap YUV) image

PGM (Portable GrayMap) image

PBM (Portable BitMap) image

PPM (Portable PixelMap) image

PNG (Portable Network Graphics) image

Windows Media Video 8

Windows Media Video 7

Invalid PCM packet, data has size %d but at least a size of %d was expected

PCM DVD unsupported sample depth %i

keyint_min

discard all frames except keyframes

nokey

diamond type & size for motion estimation pre-pass

threading operations

memory management control operations (H.264)

tcplx_mask

initial complexity for 1-pass encoding

Show all frames before the first keyframe

place global headers at every keyframe instead of in extradata

place global headers in extradata instead of every keyframe

use internal 2-pass ratecontrol in second pass mode

pass2

use internal 2-pass ratecontrol in first pass mode

pass1

Set video bitrate tolerance (in bits/s). In 1-pass mode, bitrate tolerance specifies how far ratecontrol is willing to deviate from the target average bitrate value. This is not related to minimum/maximum bitrate. Lowering tolerance too much has an adverse effect on quality.

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\options.c

oY.odP

Invalid start code 0x%x

Unknown profile %d

Discarding interframe without a prior keyframe!

Unsupported WebP lossless format.

invalid max blocksize: %d

Unknown chroma format %d

Unsupported picture coding mode %d

Wp?.np?

1T?.GT?

U?%1U?GFU?c[U?ypU?

2x?'9x?-@x?.Gx?,Nx?$Ux?

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\h264pred.c

detected %d logical cores

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\pthread.c

%p finished %d field %d

thread awaiting %d field %d from %p

Application has requested %d threads. Using a thread count greater than %d is not recommended.

Index value %d out of range (0 - %d) for %s at %s:%i

%u. Codebook's dimension is invalid (%d).

Codebook lookup type not supported.

%u. Codebook has too many entries (%u).

%u. Codebook setup data corrupt.

partition out of bounds: type, begin, end, size, blocksize: %hu, %I32u, %I32u, %u, %I32u

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\vorbisdec.c

%u. mapping setup data invalid.

Floor value is too large for blocksize: %u (%I32u)

floor_setup->data.t1.class_masterbook[j]

Invalid buffer size, packet size %d < expected frame_size %d

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\rawdec.c

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\imgconvert.c

Unsupported mode count: %d

%d modes (either a false positive or a sample from an unknown encoder)

needed %d had %d

dyn_vlc.table_size <= vlc->table_allocated

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\bitstream.c

E:\Code\cef3\src\third_party\ffmpeg\libavcodec\mpegaudiodec.c

overread, skip %d enddists: %d %d

bits_left=%d

invalid new backstep %d

invalid old backstep %d

Unknown function in '%s'

Missing ')' or too many args in '%s'

Missing ')' in '%s'

Undefined constant or missing '(' in '%s'

Invalid chars '%s' at the end of expression '%s'

%H%M%S

%H:%M:%S

%Y%m%d

%Y-%m-%d

BurlyWood

R%d:%d%c

%M:%S

%J:%M:%S

%d channels

Value %f for parameter '%s' out of range [%g - %g]

AValue %d for parameter '%s' out of %s format range [%d - %d]

The value set by option '%s' is not a %s format

%dx%d

%d/%d

%I64id:d:d.d

0xX

Unable to parse option value "%s"

Unable to parse option value "%s" as video rate

Unable to parse option value "%s" as image size

Unable to parse option value "%s" as pixel format

Unable to parse option value "%s" as sample format

Unable to parse option value "%s" as duration

AVOption type %d of option %s not implemented yet

Key '%s' not found.

Error setting option %s to value %s.

66666666666

66666707666

6666666

66666666

6666666666666

0``|```0

Picture size %ux%u is invalid

E:\Code\cef3\src\third_party\ffmpeg\libavutil\imgutils.c

[%s @ %p]

%s%s%s

Last message repeated %d times

?456789:;<=

!"#$%&'()* ,-./0123

$ $%D"

$x%x&x

1&x$x%x

0&x$x%x

$@%@&@'@

$@%@&@'@`

$x%x&x'x

$X%X&X

1&X$X%X

0&X$X%X

New streams are not supposed to be added in between Ogg context save/restore operations.

Broken file, %skeyframe not correctly marked.

E:\Code\cef3\src\third_party\ffmpeg\libavformat\oggdec.c

ogg page, unsupported version

Number of headers (%d) mismatch for stream %d

Header parsing failed for stream %d

Last packet must be truncated to %d (unimplemented).

application/vnd.ms-opentype

Too old or unsupported Theora (%x)

Unknown header type %X

pad %d %d

Unknown skeleton version %d.%d

Truncating packet of size %d to %I64d

Probe with size=%d, packets=%d detected %s with score=%d

Format %s probed with size=%d and score=%d

Format %s detected only with low score of %d, misdetection possible!

Specified probe size value %u cannot be < %u

probed stream %d failed

probed stream %d

nothing to probe for stream %d

probing stream %d pp:%d

Invalid stream index %d

Dropped corrupted packet (stream = %d)

E:\Code\cef3\src\third_party\ffmpeg\libavformat\utils.c

first_dts %s not matching first dts %s in the queue

first_dts %s but no packet with dts in the queue

Ignoring attempt to set invalid timebase %d/%d for st:%d

st:%d has too large timebase, reducing

st:%d removing common factor %d from timebase

demuxer does not support additional id3 data, skipping

index==0 || ie[-1].timestamp < timestamp

Ignoring outlier non primary stream starttime %f

.Astart time is not set in estimate_timings_from_pts

read_frame_internal stream=%d, pts=%s, dts=%s, size=%d, duration=%d, flags=%d

parser not found for codec %s, packets or times may be invalid.

ff_read_packet stream=%d, pts=%s, dts=%s, size=%d, duration=%d, flags=%d

Invalid timestamps stream=%d, pts=%s, dts=%s, size=%d

demuxer injecting skip %d

seek_frame_generic failed as this stream seems to contain no keyframes after the target timestamp, %d non keyframes found

?rfps: %f %f

>Could not find codec parameters for stream %d (%s): %s

decoding for stream %d failed

max_analyze_duration %d reached at %I64d microseconds

Stream #%d: not enough frames to estimate rate; consider increasing probesize

Probe buffer size limit of %d bytes reached

@DTS discontinuity in stream %d: packet %d with DTS %I64d, packet %d with DTS %I64d

Non-increasing DTS in stream %d: packet %d with DTS %I64d, packet %d with DTS %I64d

Statistics: %I64d bytes read, %d seeks

Statistics: %d seeks, %d writeouts

E:\Code\cef3\src\third_party\ffmpeg\libavformat\wavdec.c

Matroska / WebM

matroska,webm

webm

RInvalid EBML number size tag 0xx at pos %I64u (0x%I64x)

File moves beyond max. allowed depth (%d)

Invalid track number %d

Dialogue: %s,%d:d:d.d,%d:d:d.d,%s

%s/%s

B%Y-%m-%d %H:%M:%S

E:\Code\cef3\src\third_party\ffmpeg\libavformat\matroskadec.c

Invalid stream %I64u or size %u

File is broken, keyframes not correctly marked!

Unknown entry 0x%X

Max EBML element depth (%d) reached, cannot parse further.

%s_%d

Unknown/unsupported AVCodecID %s.

enc_key_id

Unsupported encoding type

Multiple combined encodings not supported

AUnknown or unsupported track type %I64u

Unknown EBML doctype '%s'

EBML header using unsupported features

(EBML version %I64u, doctype %s, doc version %I64u)

URLContext

Error parsing options string %s

Impossible to open the '%s' protocol for writing

Impossible to open the '%s' protocol for reading

No URL Protocols are registered. Missing call to av_register_all()?

unknown subformat:xxxxxxxxxxxxxxxx

Opera

d:d:d.d

CHAPTERd

Channel change is not supported

decryption key

cryptokey

TALBTBPMTCOMTCONTCOPTDLYTENCTEXTTFLTTIT1TIT2TIT3TKEYTLANTLENTMEDTOALTOFNTOLYTOPETOWNTPE1TPE2TPE3TPE4TPOSTPUBTRCKTRSNTRSOTSRCTSSE

Error reading frame %s, skipped

Failed to alloc %d bytes

Unknown attached picture type %d.

Unknown attached picture mimetype: %s, skipping.

Skipping %s ID3v2 frame %s.

Invalid empty frame %s, skipping.

ID3v2.%d tag skipped, cannot handle %s

id3v2 ver:%d flags:X len:%d

E:\Code\cef3\src\build\Release\ffmpegsumo.dll.pdb

ffmpegsumo.dll

= =$=(=,=0=

%0,050<0

5!5-575E5O5o5}5

(0,0004080<0@0

<$<(<,<0<

< =*=1=~=

89

:&?-?4?;?

: :$:(:,:0:4:8:<:

0(0$;(;,;0;

<,<0<\<`<

Adobe Photoshop CS5 Windows

2016:12:24 15:53:35

urlTEXT

MsgeTEXT

#hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmp:CreateDate="2016-12-24T14:33:14 08:00" xmp:ModifyDate="2016-12-24T15:53:35 08:00" xmp:MetadataDate="2016-12-24T15:53:35 08:00" dc:format="image/jpeg" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:2E4DDB12AEC9E6118C34F98869735BFC" xmpMM:DocumentID="xmp.did:2D4DDB12AEC9E6118C34F98869735BFC" xmpMM:OriginalDocumentID="xmp.did:2D4DDB12AEC9E6118C34F98869735BFC"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:2D4DDB12AEC9E6118C34F98869735BFC" stEvt:when="2016-12-24T14:33:14 08:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows"/> <rdf:li stEvt:action="converted" stEvt:parameters="from image/gif to image/jpeg"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:2E4DDB12AEC9E6118C34F98869735BFC" stEvt:when="2016-12-24T15:53:35 08:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>

IEC hXXp://VVV.iec.ch

.IEC 61966-2.1 Default RGB colour space - sRGB

CRT curv

.vk?HxG

2016:12:24 14:59:37

hXXp://ns.adobe.com/xap/1.0/

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:crs="hXXp://ns.adobe.com/camera-raw-settings/1.0/" xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:dc="hXXp://purl.org/dc/elements/1.1/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#" crs:AlreadyApplied="True" photoshop:LegacyIPTCDigest="7B3DBCF7478532F3D679AC0D72F73A63" photoshop:ColorMode="3" xmp:CreateDate="2016-01-12T17:12:27 08:00" xmp:ModifyDate="2016-12-24T14:59:37 08:00" xmp:MetadataDate="2016-12-24T14:59:37 08:00" xmp:CreatorTool="Adobe Photoshop CS5 Windows" dc:format="image/jpeg" xmpMM:InstanceID="xmp.iid:47161857A6C9E6118BA5E0E97935A33C" xmpMM:DocumentID="xmp.did:FCB80ACD0EB9E511A90D9B6CB514D116" xmpMM:OriginalDocumentID="xmp.did:FCB80ACD0EB9E511A90D9B6CB514D116"> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:FCB80ACD0EB9E511A90D9B6CB514D116" stEvt:when="2016-01-12T17:28:12 08:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:FDB80ACD0EB9E511A90D9B6CB514D116" stEvt:when="2016-01-12T17:28:12 08:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:45161857A6C9E6118BA5E0E97935A33C" stEvt:when="2016-12-24T14:58:14 08:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:46161857A6C9E6118BA5E0E97935A33C" stEvt:when="2016-12-24T14:58:14 08:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> <rdf:li stEvt:action="saved" stEvt:instanceID="xmp.iid:47161857A6C9E6118BA5E0E97935A33C" stEvt:when="2016-12-24T14:59:37 08:00" stEvt:softwareAgent="Adobe Photoshop CS5 Windows" stEvt:changed="/"/> </rdf:Seq> </xmpMM:History> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="w"?>

" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:41078AF178C9E611BC89FA2214169575" xmpMM:DocumentID="xmp.did:FE8DACE1C9A111E6AD14C12F766AE3F3" xmpMM:InstanceID="xmp.iid:FE8DACE0C9A111E6AD14C12F766AE3F3" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:42078AF178C9E611BC89FA2214169575" stRef:documentID="xmp.did:41078AF178C9E611BC89FA2214169575"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

H'.XA0

~.nqQ

d90.hg

I#1.Rc]p

.bc76$

%\9%S

%UErM

` jgAKT.MA(

VP%u~

<CH%d

:.CI 

%cNP&l"

o8%UB

xCÝ

<.Nl8

&tCpFC

XB%DSr

%S&Z_H1r

*2y%Xa5

vFb%Xja

X,K%U

/kAB%D

8O6.Í

$@CN&fB

@.nP?

*~?K%D

 1.od8

,O.To_

;.VN.

b.xqTA

`.fH),#

.Lakt*

J%C`^

ea.nx

K.sAL

*<;!*<!<

.uB.T

]\ (B%D

@75.xH

8`%Di

PF)%F!

4.qIF

2%DvV@

.yBe4

%d&&'

123456789

00003333

deflate 1.1.3 Copyright 1995-1998 Jean-loup Gailly

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

user32.dll

WinExec

GetViewportOrgEx

WINSPOOL.DRV

RegOpenKeyExA

ShellExecuteA

COMCTL32.dll

WS2_32.dll

CreateDialogIndirectParamA

SetWindowsHookExA

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GetViewportExtEx

comdlg32.dll

RegCreateKeyExA

Shell32.dll

Mpr.dll

Advapi32.dll

User32.dll

Gdi32.dll

Kernel32.dll

.PAVCException@@

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCArchiveException@@

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

gdi32.dll

winmm.dll

winspool.drv

advapi32.dll

shell32.dll

oleaut32.dll

comctl32.dll

ws2_32.dll

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/> </requestedPrivileges> </security></trustInfo></assembly>

233333333333331

%s%s_d_%x

setup.xml

A%s%s

%s_d_%x

965A2EE5-3F05-496C-982E-2D08C8F6410B

OnReport(L"965A2EE5-3F05-496C-982E-2D08C8F6410B")

369EF5B3-EED3-4174-8502-4D7DEA2D46D4

OnReport(L"369EF5B3-EED3-4174-8502-4D7DEA2D46D4")

6A638FBA-69B3-4b85-8762-7286B386E370

OnReport(L"6A638FBA-69B3-4b85-8762-7286B386E370")

1F6BAC29-3FB6-49e3-8B92-ACC1D522DD51

5CA1EAAC-B758-46fe-AB49-7CBE23A5CE9C

20FC4EC4-611C-4746-BAFB-467620D42753

E98F1A6A-30D0-48e0-AD41-88C689254516

OnReport(L"E98F1A6A-30D0-48e0-AD41-88C689254516")

666DD692-DDAB-40aa-9B42-432D95612A82

OnReport(L"666DD692-DDAB-40aa-9B42-432D95612A82")

5F07E78A-159C-4f12-921A-A53528C3B409

OnReport(L"5F07E78A-159C-4f12-921A-A53528C3B409")

86EEF61C-E190-479e-BC2B-34398F5707DE

OnReport(L"86EEF61C-E190-479e-BC2B-34398F5707DE")

6758895F-E210-40a9-859E-6F7A9D563E37

OnReport(L"6758895F-E210-40a9-859E-6F7A9D563E37")

7E4FE427-6877-4084-8BC4-47C0B9C64E67

OnReport(L"7E4FE427-6877-4084-8BC4-47C0B9C64E67")

cbUseFileNameAsShortCut

2E5A2D86-22FB-4F86-88E5-247102587612

CustomFace\AddFace.xml|AddFaceFrame

CUSTOMFACE_WARN_SAMESYSSHORTCUT

11FF7CDB-8DC2-4bfd-91BD-4A4B765AACEE

OnReport(L"11FF7CDB-8DC2-4bfd-91BD-4A4B765AACEE")

F617DE80-2932-4bb6-AE78-CDF9728DF3C8

OnReport(L"F617DE80-2932-4bb6-AE78-CDF9728DF3C8")

1FFC7C55-5C4D-463B-AFC9-86FCA0FB2122

OnReport(L"1FFC7C55-5C4D-463B-AFC9-86FCA0FB2122")

712E7012-08C6-4E03-9C2B-23F5E92791DE

OnReport(L"712E7012-08C6-4E03-9C2B-23F5E92791DE")

61A86DC7-D09C-4FEC-86DD-F7A8E62EDEBD

OnReport(L"61A86DC7-D09C-4FEC-86DD-F7A8E62EDEBD")

5A7F35FF-E74C-41FB-A966-D1299FC44DD4

OnReport(L"5A7F35FF-E74C-41FB-A966-D1299FC44DD4")

DC7D51F8-7B2F-4BFE-9F2C-CFC7302E2899

CustomFace\AddFace.xml|AddFaceGroup

1B59870E-CBDB-4759-B28C-57BB4701369B

OnReport(L"1B59870E-CBDB-4759-B28C-57BB4701369B")

QQVip_VipURL

72E8641D-E257-41be-868A-32B010FB3DFD

OnReport(L"72E8641D-E257-41be-868A-32B010FB3DFD")

EA13BC53-1EA3-4413-8A20-D4EB91CD976E

OnReport(L"EA13BC53-1EA3-4413-8A20-D4EB91CD976E")

platformres:vip\vip_head16.png

platformres:AppFramework\SuperVip\SuperVip_head.png

CustomFace\CustomFace.xml|ErrorWnd

{BC9DC39F-F64A-48CD-8BD6-73858D90EDB8}

OLEAUT32.DLL

CCustomFaceDBRebuild.CCustomFaceDBReb.1

%FriendlyName%

{5990F9FF-D7E5-435F-8C1C-C9078D2C80FF}

CCustomFaceDBRebuild.CCustomFaceDBReb

dwAllCount[%d], dwDisposeCount[%d]

CustomFace_final.eif

CustomFace.db

CustomFace_tmp.db

AddFileSystem FSID::UserData::CustomFace to CustomFace.db

CustomFace_tmp.db -> CustomFace.db

CustomFace.db -> CustomFace.bak

CustomFace.db -> CustomFace.bak

CustomFace.bak

CustomFace\FaceMgr.xml|RebuildTipWnd

\CustomFaceCache\hash_1.dat

Face2.dat

[%d] >

PerfStand.CreateFaceWnd.End

PerfStand.CreateFaceWnd.Begin

CustomFaceFrameMgr.OnInit.End

CustomFaceFrameMgr.OnInit.Begin

CustomFace\tour_sign_16.png

MoveGroup fail nPos=%d

GetInt(TXDFN(CustomFace::GroupInfo::nGroupPos) <= 1 nPos = %d

vip%u.png

tour_sign_16.png

CCustomFaceWnd::SetRoamState--member::%d

PortionText

A1B1D7E5-04BF-4C9E-B72E-4E6524C700B6

OnReport(L"A1B1D7E5-04BF-4C9E-B72E-4E6524C700B6")

2A390C24-AC91-4731-BE66-EB2371AA3CE9

OnReport(L"2A390C24-AC91-4731-BE66-EB2371AA3CE9")

E87EE742-3B68-47DA-9431-6113705D9366

OnReport(L"E87EE742-3B68-47DA-9431-6113705D9366")

07A1BB44-3E81-40CD-ADCA-9F9409C564B1

OnReport(L"07A1BB44-3E81-40CD-ADCA-9F9409C564B1")

2F40709B-B257-44A9-AFFB-1F669876D486

OnReport(L"2F40709B-B257-44A9-AFFB-1F669876D486")

3EBE0003-71F9-4A5E-9C40-F5A7C36FE63B

OnReport(L"3EBE0003-71F9-4A5E-9C40-F5A7C36FE63B")

D8005782-4B2A-42F8-B455-01B99100E47A

OnReport(L"D8005782-4B2A-42F8-B455-01B99100E47A")

9B792EB3-634D-4DA1-B703-BE6FF5C8819C

OnReport(L"9B792EB3-634D-4DA1-B703-BE6FF5C8819C")

7B533526-8157-4A84-8008-28DE73B7A0D5

OnReport(L"7B533526-8157-4A84-8008-28DE73B7A0D5")

2D54EF3A-D740-47BC-A30E-0F2DD21F53A7

OnReport(L"2D54EF3A-D740-47BC-A30E-0F2DD21F53A7")

CA469B76-0ADE-47B7-BDC3-39895161FA7A

OnReport(L"CA469B76-0ADE-47B7-BDC3-39895161FA7A")

E1423A96-348D-49C0-88FE-5AA860C87139

OnReport(L"E1423A96-348D-49C0-88FE-5AA860C87139")

D89E0562-615E-4FFD-834C-74B2C675CB3E

OnReport(L"D89E0562-615E-4FFD-834C-74B2C675CB3E")

8E6473E0-CF57-4237-A100-21A15ACC7332

OnReport(L"8E6473E0-CF57-4237-A100-21A15ACC7332")

4F9B3ED3-0344-401F-915C-4C1728CE9BDA

OnReport(L"4F9B3ED3-0344-401F-915C-4C1728CE9BDA")

F37EE128-47DF-40EB-8F6B-531DFE411D36

OnReport(L"F37EE128-47DF-40EB-8F6B-531DFE411D36")

D552F234-AC01-45B9-B059-A8BAE6CC1875

OnReport(L"D552F234-AC01-45B9-B059-A8BAE6CC1875")

ECFEA3D7-7797-4045-BF41-F65B5F62EDCA

OnReport(L"ECFEA3D7-7797-4045-BF41-F65B5F62EDCA")

3BA259D5-F4AB-40BD-8768-1308CFEEE0BB

OnReport(L"3BA259D5-F4AB-40BD-8768-1308CFEEE0BB")

BB4F1DB0-2407-4972-BD6E-142DA38B47F1

OnReport(L"BB4F1DB0-2407-4972-BD6E-142DA38B47F1")

4BC57C91-8B9A-47F5-94D1-AEE35B40273C

OnReport(L"4BC57C91-8B9A-47F5-94D1-AEE35B40273C")

EDD9D734-48B8-4C1D-99CE-C85B81C968DA

OnReport(L"EDD9D734-48B8-4C1D-99CE-C85B81C968DA")

FaceRoam_ViewDetails_Url

0D097100-3822-4DE6-9125-938AF5C3BC4D

OnReport(L"0D097100-3822-4DE6-9125-938AF5C3BC4D")

E37E4E0F-99DE-4ef9-B13F-2CC9B24EA3D7

OnReport(L"E37E4E0F-99DE-4ef9-B13F-2CC9B24EA3D7")

8CB4BE84-1DA7-4399-A98A-D19521F4F473

OnReport(L"8CB4BE84-1DA7-4399-A98A-D19521F4F473")

83EF6C8A-9503-4cde-9686-2786B636490D

OnReport(L"83EF6C8A-9503-4cde-9686-2786B636490D")

AD7AED1B-AD5B-4449-A5C1-06D9C3BF3DC7

OnReport(L"AD7AED1B-AD5B-4449-A5C1-06D9C3BF3DC7")

89FF2758-D6DA-49D8-91C1-FDEC4CD72096

OnReport(L"89FF2758-D6DA-49D8-91C1-FDEC4CD72096")

83CE8FF6-E1DF-498e-92A2-F523AA0CC618

OnReport(L"83CE8FF6-E1DF-498e-92A2-F523AA0CC618")

AC055042-C98E-496F-9EA5-9993127EAA2B

OnReport(L"AC055042-C98E-496F-9EA5-9993127EAA2B")

1573C8D7-B4F6-4176-88B9-1AB9D8EA2BF9

OnReport(L"1573C8D7-B4F6-4176-88B9-1AB9D8EA2BF9")

FaceMgr_Import_Face

FaceMgr_Export_All_CustomFaces

FaceMgr_Export_Cur_Group_CustomFaces

FaceMgr_Export_Sel_Faces

D36E1B13-452F-4A62-9FCE-2701C159FE2C

OnReport(L"D36E1B13-452F-4A62-9FCE-2701C159FE2C")

FaceMgr_Export_Group

A9B8CECD-F0E3-44d1-B18B-1D7BEF621FE8

OnReport(L"A9B8CECD-F0E3-44d1-B18B-1D7BEF621FE8")

789E3233-68CD-42ce-A877-2B2CE3A5AD34

B429932F-B90C-442a-B612-840053073834

9810C3E6-8ED4-495b-A3B1-3B01425B443E

2601D587-9602-48F0-B09B-CF7ABFFB5D4F

OnReport(L"2601D587-9602-48F0-B09B-CF7ABFFB5D4F")

E9397093-D9E4-4AD2-9051-1AAAFB618257

OnReport(L"E9397093-D9E4-4AD2-9051-1AAAFB618257")

D84612A2-56A1-4BE4-874C-3A75FBC9CD25

OnReport(L"D84612A2-56A1-4BE4-874C-3A75FBC9CD25")

btnImportOutport

7564E4BC-7A9E-457A-BDB3-42D1FEFC8680

A4AFFB8A-30D4-4F54-9A15-BF67AF9D68B1

0A08DC05-4A08-4740-999E-E6761DC7AFC3

CustomFace\FaceMgr.xml|CustomFaceMgr

CustomFace\greyPic_28.bmp

CachePageGrp%luPg%d.bmp

checkbutton_uncheckedNormalTexture.gft

checkbutton_checkedNormalTexture.gft

FaceMgr.xml|FocusCtrl

FaceMgr.xml|PreviewFrame

---nSize:%d,nIndexSta:%d,nIndexEnd:%d

47E51FE7-2350-471C-A413-D0AE11DA9B34

OnReport(L"47E51FE7-2350-471C-A413-D0AE11DA9B34")

4404A264-6F9A-4FFC-92D1-161D6D85AB3F

OnReport(L"4404A264-6F9A-4FFC-92D1-161D6D85AB3F")

30DA99F2-7A3C-4D4F-B4A3-5CE9DB179D4A

OnReport(L"30DA99F2-7A3C-4D4F-B4A3-5CE9DB179D4A")

CustomFace\MTRoamMgr.xml|ImgElem

QQFace_ImportPackWhenBusy

QQFace_ImportPacking

QQFace_ImportWait

FaceMgr_FaceExportFile

FaceMgr_Exporting_Face

CustomFace\FaceMgr.xml|ExportTipWnd

24ECA2D8-CE06-43C6-8918-E8AD27935A47

OnReport(CTXBSTR(L"24ECA2D8-CE06-43C6-8918-E8AD27935A47"))

FaceMgr_Import_Some_Faces

FaceMgr_Import_Result

ImportTool_Error_NoFaceFile

2E039119-C3EC-4F38-8173-8A23297F9F13

OnReport(CTXBSTR(L"2E039119-C3EC-4F38-8173-8A23297F9F13"))

D2E34FEA-C7DB-4E47-82DA-31C6E4A93487

OnReport(CTXBSTR(L"D2E34FEA-C7DB-4E47-82DA-31C6E4A93487"))

FaceMgr_Export_Face_Fail

FaceMgr_Export_Face_Succ

CustomFaceToRoam, FaceId = %s

CustomFace\MTRoamMgr.xml|MainMgrWnd

MultiTermiRoam, md5=%s,file=%s,url=%s

fix.bmp

AppFramework\CustomFace\NewCustomFace.xml|MTRoamDeleteFrameTips

Row%d

CustomFace\MTRoamMgr.xml|RowElem

CustomFace\MTRoamMgr.xml|Page

Can Upload Count = %d

KEY_INDEX

AppFramework\CustomFace\NewCustomFace.xml|MTRoamGuideFrame

Show yellow tips, Count = %d

Can Upload Pic count = %d,dwMax = %d, current=%d, wait=%d

AddPic(storeface) Exist in MTRoam,id = %s

AddPic(Custom) Exist in MTRoam,id = %s

Add2(cf).add

Add2(sf).add

Add1. Path = %s, bStoreface = %lu, pkgId = %lu, PicId = %s

MTRoam.dat

FaceId = %s, result = %d, timer = %d

Download,errno = %s

OnGroupUpdate(CustomFace::Key_UpdateGroup, pCallbackData)

tencent.im.cs.cmd0x6ff.RspBody

tencent.im.cs.cmd0x6ff.ReqBody

BigData, subcmd = %lu

Menu_ExportAllCustomFace

Menu_ExportCustomFace

Menu_ImportCustomFace

Menu_ImportExportCustomFace

CustomFace\FaceOperators\head_small_cover.png

CustomFace\FaceOperators\head_big_cover.png

CustomFace\FaceOperators\body_small_cover.png

CustomFace\FaceOperators\body_big_cover.png

CustomFace\FaceOperators\tail_cover.png

%s | ctrltype

CQQFaceOperateCtrl::InitControl

CustomFace\FaceOperators\loading_16x16.gif

CQQFaceOperatePosFrame::Create

OnBigFaceOperationFail()

OperateCtrlArea

QQFaceShop_OperatePosDataUrl

\Misc\OperateFace\data

AppFramework\CustomFace\StoreFace\loading.png

AppFramework\CustomFace\StoreFace\storebtnface_long.png

AppFramework\CustomFace\StoreFace\storebtnface_short.png

:isApply=%d, name=%s

\Misc\OperateFace\

QQFaceShop_ImgUrlHead

64BDA2E3-DCA9-45BD-85E5-DD6F049320E5

OnReport(L"64BDA2E3-DCA9-45BD-85E5-DD6F049320E5")

3435EA7E-9566-4766-B6D7-80990E52D03A

OnReport(L"3435EA7E-9566-4766-B6D7-80990E52D03A")

F1435DAE-FFF1-4B44-851F-73108743203C

OnReport(L"F1435DAE-FFF1-4B44-851F-73108743203C")

3D6B3E36-17E3-497C-A061-5C95723820B5

CustomFace\FaceMgr.xml|DelGroupWnd

FaceFileExist FacePath = %s

Queue size = %d

Download: dwPriority upgrade %d -> %d

Download: duplicate task: %s

Dlder [%d] Download URL = %s

SmallEmoji_ImageUrl

SmallEmoji.db

.fixed

AddFaceFile OK fileId = %s

AddFaceFile Failed fileId = %s

sound TXHttpDownload Failed ErrorCode = %d fileId = %s

OnDownloadComplete: sound error pCurrentDownloadTask == NULL, Dlder [%d]

errorBmp.png

EditMsgRichEdit

CN, Beijing, Beijing, Sogou.com,

Crypt32.dll

Wintrust.dll

OnReport(L"0x8003D80")

: uin:%u

%s%s.gif

%s%s.bmp

QueryKey!

Download = %s

StoreFace_ImageUrl

335916E1-9E32-4114-923F-444ACB8773B4

1E27FFF6-7484-4E17-BAE6-9E0F1F664DD8

A11FC192-707F-4BC3-9914-F5D334F32CF0

66E5A8FC-4A12-4CE2-8FAE-6AE477BCF25C

OnReport(L"66E5A8FC-4A12-4CE2-8FAE-6AE477BCF25C")

AD1D3E72-D156-4C2E-A1F8-443F0D4EC659

B5FBE0DE-260B-478D-891B-0C4290309A2B

64B6AB02-ED29-40EA-A093-B431F7E1507B

B235A630-29A3-4FC1-B122-BCBA0EF52573

OnReport(L"B235A630-29A3-4FC1-B122-BCBA0EF52573")

B4DBC137-3405-4A1D-BEA2-F7CF91E0A5FE

OnReport(L"B4DBC137-3405-4A1D-BEA2-F7CF91E0A5FE")

02629E91-4397-4C75-A354-6383370822FC

OnReport(L"02629E91-4397-4C75-A354-6383370822FC")

0E1E46F9-190C-4E7B-91F2-B44E68224319

OnReport(L"0E1E46F9-190C-4E7B-91F2-B44E68224319")

85C96EA7-CB78-4BBE-AAA8-92152D310FFC

OnReport(L"85C96EA7-CB78-4BBE-AAA8-92152D310FFC")

A3BDE1C0-5D96-4F1E-A2CD-7C9517A28C0C

OnReport(L"A3BDE1C0-5D96-4F1E-A2CD-7C9517A28C0C")

A050D0BB-CA83-4B19-81A2-49ACFE517150

OnReport(L"A050D0BB-CA83-4B19-81A2-49ACFE517150")

8180904C-50F9-4AF3-9D49-1402E2538655

OnReport(L"8180904C-50F9-4AF3-9D49-1402E2538655")

AF0695BA-8154-47F1-9A2C-08E7B5E29833

OnReport(L"AF0695BA-8154-47F1-9A2C-08E7B5E29833")

CustomFace\GraffitiEditor.xml|GEMainWnd

%s\%s

CustomFace\GraffitiEditor\Bubble\config_new.xml

%s.%s

CustomFace\GraffitiEditor\del_layer_button.png

Rect-Task::execute

Rect-Task::unexecute

Layer-Task::execute

Layer-Task::unexecute

Graffiti-Task::execute

Graffiti-Task::unexecute

Bubble-Task::execute

Bubble-Task::unexecute

ImageFile-Task::execute

ImageFile-Task::unexecute

RichText-Task::execute

RichText-Task::unexecute

line_weight_5.png

line_weight_4.png

line_weight_3.png

line_weight_2.png

line_weight_1.png

CustomFace\GraffitiEditor.xml|GEBrushTool

CustomFace\GraffitiEditor.xml|GEBubbleTool

CustomFace\GraffitiEditor.xml|GEColorPicker

CustomFace\GraffitiEditor.xml|GEDFCTool

CustomFace\GraffitiEditor.xml|GEFontSetting

CustomFace\GraffitiEditor.xml|GETextTool

Vector size invalid, hitIndex - %d, vectorSize - %d

GetCurrentModeSize(baseDrawData.groupId, &uVirtualQQFaceListSize)

sysres:CustomFace\StoreFace\default_face.png

sysres:CustomFace\QQFace\faceSelectBkg.gft

sysres:CustomFace\QQFace\DefaultRoamFace.gft

AppFramework\CustomFace\StoreFace\store_face_flag.gft

OperationPath\

Store_Offline_Msg_Info

Store_Face_Msg_Title

MsgBoxEx

(%d,%d)

(%d).

ConvertGifToImage strGifPath = %s, strImgPath = %s

OnReport(L"0x80025a1")

OnReport(L"0x8002567")

.mixed2

AFDataReport

red_hot_focus.png

red_hot_normal.png

AFDataReport Service NOT Start!

Appframework\Customface\StoreFace\multi_terminate_roma_1.png

Appframework\Customface\StoreFace\red_hot_normal.png

sysres:CustomFace\QQFace\AddGroupPrompt.gft

i_svip.png

i_svipyear.png

i_vip.png

i_vipyear.png

[OnGFEvt_MainWndPreHide]bCancelHide is (%d).

CustomFace\NewCustomFace.xml|MgrToolBarFrame

OnReport(L"0x8002f47")

pFbi->IsValid() == FALSE QQFaceWnd CallExtension OnHidePreview %d

QQFaceWnd CallExtension OnHidePreview %d

URL_QQFaceFeedBack

bFocused=%d;faceWnd=0x%x;focusWnd=0x%x

QQFACE_STORE_PACKAGE_PAYMENT_PAGE_URL

QQFACE_STORE_PACKAGE_DETAIL_PAGE_URL

QQFACE_STORE_PACKAGE_DETAIL_PAGE_BY_FACEID_URL

CustomFace\NewCustomFace.xml|storeGuideTipsWnd

QQFace_ToolBarMenu_ExportAllFace

QQFace_ToolBarMenu_ExportFace

QQFace_ToolBarMenu_ImportFace

QQFace_ToolBarMenu_ImportExportFace

!m_bExtraShow m_bFaceRecommendOpenStatus=[%d]

scrollBarTipBkg.gft

QQFaceOperatePosFrame

CustomFace\NewCustomFace.xml|QQFaceFrame

[RoamGroupPreCheckStepOne] Fail for reach maxRoamTab Limit as (%d >= %d)!!!

UpdateQQFaceInfo Which reDraw rst is (%d).

F7A907AC-BC10-4805-99C6-26873132D5B0

OnReport(L"F7A907AC-BC10-4805-99C6-26873132D5B0")

[OnFaceUpdateEvt]cEventType(%d), update (%u) faces.

QQFace_ManageMsgBox_Title

QQFace_DelMsgBox_Text

4353C314-012F-451D-B0C7-E79A49E14A5C

OnReport(L"4353C314-012F-451D-B0C7-E79A49E14A5C")

NICKNAME

CustomFace\NewCustomFace.xml|TimeLimitedFaceExpiredFrame

CustomFace\StoreFace\store_face_mask.png

customface\RoamError.png

OnSoundPlayFinishCallBack nResult = %d

Play Sound m_curSoundPath: %s

AppFramework\CustomFace\StoreFace\SoundFaceCornerAni.png

AppFramework\CustomFace\StoreFace\SoundFaceBtnClick.png

AppFramework\CustomFace\StoreFace\SoundFaceBtnHover.png

AppFramework\CustomFace\StoreFace\SoundFaceBtnNormal.png

OnShowFaceRichToolTipsWithCallback(pHostFrame, strTipsContent.GetBSTR(), m_pRichToolTipCallback)

DragFaceNumBkg.gft

DragWndBkg.gft

CustomFace\NewCustomFace.xml|DragTipPanel

CustomFace\QQFaceTabPageEx.xml|TabPageEx

CustomFace\QQFace\PromptBtnHighlight.gft

CustomFace\QQFace\PromptBtnNormal.gft

CustomFace\QQFace\promptFrameBkg.gft

Init GroupState : %lu,%d

BusinessGuidUrlLink

BusinessFaceGuidUrlPanel

CustomFace\NewCustomFace.xml|BusinessFaceTabInfo

OnReport(L"0x8002f46")

CustomFace\NewCustomFace.xml|StoreFaceTabInfo

strPicPath[] strSuffix = [%s]

Upload Ret = %d

errno = %d

hXXp://%s:%lu/cgi-bin/httpconn?htcmd=0x6ff0071&ver=%u&term=%s&ukey=%s&filesize=%I64u&range=0&uin=%lu&groupcode=0&command_id=9&resid=%s

AppFramework\CustomFace\StoreFace\winksplay_hover.png

AppFramework\CustomFace\StoreFace\winksplay_default.png

sendingBmp.png

CustomFace\NewCustomFace.xml|WinksPlay_Crl

AppFramework\CustomFace\StoreFace\add_store_face_menu.png

FaceStoreUrl

DetailOrPayment: %s

QQFacePageWebkit

CustomFace\NewCustomFace.xml|QQFacePageFramePanel

OperationMutex

Store: %s

QQFACE_STORE_PAGE_URL

QQFaceStoreWebkit

CustomFace\NewCustomFace.xml|QQFaceStorePage

FaceStore_JS_OperationMutex

QQSimilarFaceWebKitPage

CustomFace\NewCustomFace.xml|QQFaceSimilarWnd

QQSimilarFaceWnd_Url

CustomFace\NewCustomFace.xml|AddQQFaceGroupWnd

CustomFace\NewCustomFace.xml|AddQQFaceWnd

[CAFAddQQFaceWnd]add face OverSize, total OverSize(%d).

[CAFAddQQFaceWnd]add face ExistPic, total ExistPic(%d).

[CAFAddQQFaceWnd]add face succ, total succ(%d).

[CAFAddQQFaceWnd]Begin Add (%u) Pics.

[CAFAddQQFaceWnd]Select (%u) Pics.

:wAppId(%lu), dwFileId(%lu), result(%d).

:dwUpdateNum(%lu), show(%d)

OnReport(bsCrId)

m_DownloadTaskList.size() == 0 When StartDownload

OnReport(L"0x80025a4")

OnDownloadFaceFileComplete ErrorCode = %d

OnDownloadComplete, ErrorCode=%d

CustomeFace_RecommendedFaceURL

RecommendedFaceWebKit

CustomFace\NewCustomFace.xml|RecommendedFaceFrame

OnReport(L"0x80025a2")

OnReport(L"0x80025a3")

(%u),

(%u).

((%d)).

:(%d),

:(%d)).

CustomFace\NewCustomFace.xml|FaceMgrLoadingFrame

tabiconconfig.json

%lu_color.png

qqshow_tab_icon.png

multi_terminate_roma_0.png

sys2_page_focus.png

emoji_page_focus.png

classic_page_focus.png

tabName = %s tab icon was not matched!

tabName = %s tab icon was matched by whole world!

QQFACE_TAB_ICON_CONFIG_URL

A tab icon matched-info save to cache! groupId - %d, cacheSize - %d

groupId = %d tab icon not match now, and try again later!

groupId = %d tab icon will not matched forever!!

groupId = %d tab deleted! and it's cache info will delete.

Package %d Icon is downloading now! won't add task!

QQFACE_TAB_COLOR_ICON_URL

A general tab icon download complete! groupId - %d

A store tab icon download complete! facePkgId - %d

A custom tab icon download complete! name - %s

Oops! tab icon download FAILED! retCode - %d

default_tab_icon_focus_0.png

%s%s\

CustomGroupIcon_%s not exist,download

%s%lu_color.png

dQQFACE_TAB_GRAY_ICON_URL

Tab Icon download FAILED! retCode - %d

%s%s\%s

tabwordingconfig.json

%d.d.d

QQFACE_TAB_WORDING_CONFIG_URL

Can't get wording type for StoreTab - %d!

Parse all wordings complete! size - %d

Tab Wording download FAILED! retCode - %d

QQFACE_STORE_UPDATE_TIMESTAMP_URL

CustomFace\NewCustomFace.xml|QQFaceWnd

MSGMGR_PROMPT

CSendMsgHandler

wWidth=%d, iHeight=%d

GetFaceInfo:Suc id = %s

OnReport(((BSTR)_convert_to_bstr(L"0x8002f65")))

dwGroupId=%s

vecTabs.size() > (size_t)m_nMaxWinkSend

dwMediaType = %d

tMsgPicHander dwMediaType = %d

CheckAuth(pData) = %d

it == m_mapAuthInfo.end()

Result:%s

Src:%s

dwImagePhoneSize [wHeight]= %d, [wWidth]= %d

CRecvMsgHandler

Download FaceSound If Not Exist id = %s

OnStoreFaceEvent(tag.dwUin,tag.guid,strPath)

url:%s,

CustomFace\StoreFace\packet_default.gft

recommandfacepacket_hover_bkg.gft

recommandfacepacket_bkg.gft

hot.png

new.png

free.png

CustomFace\RecommandFacePacket.xml|Loading

CustomFace\RecommandFacePacket.xml|LoadFail

Default FaceFileExist FacePath = %s

High DPI FaceFileExist FacePath = %s

FaceSoundFileExist FacePath = %s

Download: sound dwPriority upgrade %d -> %d

Download: duplicate sound task: %s

StoreFace_FaceSoundUrl

StoreFace200_ImageUrl

m_HttpClinets create

m_HttpClinets clear

AddFaceSoundFile OK md5 = %s

AddFaceSoundFile Failed md5 = %s

AddFaceFile OK md5 = %s

AddFaceFile Failed md5 = %s

sound TXHttpDownload Failed ErrorCode = %d md5 = %s

FaceStore.db

storeface store used:%d

storeface download increase priority: %d

storeface deltab rsp %d

strFilemixedBig: %s

Download Face Sound faceid: %s

storeface download hit cache: %s

storeface download begin: %s

storeface check store used value:%d

fetchtabinfo tab media_type : %d

storeface deltab %u, groupid %u

storeface sync addtab local tab %u, expireTime %u

storeface sync deltab cache tab %u, error

storeface sync deltab local tab %u, groupid %u

storeface push addtab local tab %u, expireTime %u, dwFlags %u, nWordingID %d

storeface download error code %d, md5: %s

storeface download end: %s

EmojiFace.db

CEmojiFaceMgr.CEmojiFaceMgr.1

{39ECE401-0CB1-4786-B0F1-708C192D6B7F}

CEmojiFaceMgr.CEmojiFaceMgr

\Emoji.zip

Emoji\Emoji2.zip

Emoji\EmojiBak.zip

system:%s not exist

add new emoji file system:%s failed

add old emoji file system:%s failed

IDS_EMOJI_DOWNLOAD_URL

CheckMD5 result:%d

add faces end, result:%d

0xx0xx

0xx

md5:%s

FileSystem %s not exist

AddFileSystem %s %s failed

%s not exist

delete old fileSystem %s :%d

move %s to %s :%d

delete %s :%d

recommend_face.json

Recommend Config Url is empty!! will not download!

RecommendFaceCfg.dbc

Config.reg

Face is INVALID! type - %d, id - %s, path - %s

LoadCSCConfig GetService.FAIL

LoadCSCConfig QueryConfig.FAIL

LoadCSCConfig bufContent.IsEmpty

LoadCSCConfig.ppDataReadApp.Is NULL

Recommend Panel will hide in %d seconds later.

OnReportCount(L"0x80034a6", dwPreparePlayCount)

OnReport(L"0x80034a7")

Not in Face panel effective time range, but will show it in %d seconds later!

Face - %d, Flash - %d

Found %d Flash need play, will play now!

operators_container_bkg.gft

AppFramework\CustomFace\FaceOperators\

AppFramework\CustomFace\FaceOperators\operators_seperator.png

OnSendRecommendFace( faceInfo.m_strFaceID.GetBSTR(), faceInfo.m_faceType, nHitIndex )

OnShowFaceRichToolTips(GetEntity<IGFFrame>(), strTipsContent.GetBSTR())

FaceMsgPack

Face Config update timestamp - %d!

Recv recommend Face - %s!

OnReportCount(L"0x80034a5", dwFaceSelFromRecommendPanelCount)

Download: faceKey = %s, dwPriority upgrade %d -> %d

Dlder [%d] begin download URL = %s

BusninssFace_ImageUrl

AddFaceFile OK face_key = %s

AddFaceFile Failed face_key = %s

TXHttpDownload face failed. File md5 is not OK. CurrentFile md5: %s, we need face md5 = %s

TXHttpDownload Face Failed ErrorCode = %d, face_key = %s

OnDownloadComplete: error pCurrentDownloadTask == NULL, Dlder [%d]

\data.json

fetch tab httpdownload start: %s

BusninssFace_TabInfoUrl

BusinessFaceFetchTabInfo::OnFetchTabInfoCallback Failed. itCur == m_lstWaitingList.end()

fetch tab httpdownload error: code %u

Parse File Success! tabid = %lu, face_count = %d

TabInfo json already exist & parse json OK. Path = %s!

IsHitCache: TabInfo json already exist. CurrentFileMd5 = %s, CSMD5 = %s, LastFileMD5 = %s. Path = %s!

Check TabInfo old json md5 failed. NewFileMd5 = %s, We need(CSMD5) = %s, LastFileMD5 = %s. Path = %s!

wParseTabInfoJson. NewFileMd5 = %s, We need(CSMD5) = %s, LastFileMD5 = %s. Path = %s!

Parse TabInfo Failed. tabid = %d

Download New json. NewFileMd5 = %s, CSMD5 = %s, LastFileMD5 = %s. Path = %s!

TabInfo download failed. TabId = %d, ErrorCode - %d

Server return tabid = %d, UpdateTime = %lu

FetchTabs rsp error result:%d

AddGroupForBusiness! tabid = %d, tab.bIsNeedUpdateFaceForGroup = %d, dwTabUpdateTimestamp = %lu, LogoPath = %s, groupid = %lu

Call pDownloadMgr->DownloadFace DownloadTabFaces dwTabID = %d, faceID = %s

DownloadTabFaces dwTabId = %d not found.

DownloadTabFaces dwTabID = %d

Start download icon(logo) Url = %s

BusninssFace_TabLogoUrl

Logo not found: %s

FetchTabIcon Tab logo already exist. CurrentFileMd5 = %s, CSMD5 = %s

FetchTabIcon Path = %s

_logo.png

logo is not OK. CurrentFileMd5 = %s, we need md5 = %s

Icon download finish. %s

OnFaceUpdate( CustomFace::EVENT_AddFace, tab.dwGroupID, -255, pIdList )

TabFacesUpdate GroupUpdate. tabID = %d, groupID = %d, face_count = %lu

TabFacesUpdate face file is not ready. tabID = %d, faceID = %d, facePath = %s

TabFacesUpdate AddFaceForBusiness tabID = %d, groupID = %d, facename = %s, facePath = %s

TabFacesUpdate, dwTabID = %d, face_count = %d

OnUpdateGroupTopFrameInfo(tab.dwGroupID)

On_Async_FaceListPreparedOK, dwTabID = %d

BusinessFace download hit cache: %s

Face need to download. TabID = %d, md5: %s

OnFetchTabInfoCallBack! tabid = %d, face_size = %d

OnFetchTabInfoCallBack: Not support flash now!!!!

BusinessFace sync deltab local groupid %u

AddTab Failed, dwTabID = %d, nTabType = %lu can not use.

OnFetchTabsCallBack Error nResult = %d

TabFacesUpdate AddFaceForBusiness groupID = %d, facemd5 = %s, facename = %s, facePath = %s

BusinessFace download return. face_key: %s

AudioMsg come, Stop Sound Play!

OnReport(L"0x8003709")

Play: %s

ConvertToPureFile:%s

FaceSoundDownloadCallback-FaceSoundPath:%s

Play Sound Path: %s, file type: %d, m_strFaceSound: %s

convert Sound Path: %s

db srcImgfile = %s

Download error:%d

OnControlClick m_bCanPlay:%d, m_bPlaying:%d

OnSoundPlayFinishCallBack result: %d

DownloadFace id = %s

Already have sound file when create, faceid: %s

DownloadFaceSound when create, faceid: %s

CustomFace\NewCustomFace.xml|SoundFacePlayControl

httpdownload:imgcache.qq.com

StoreFace_TabInfoUrl

storeface key req: %s

storeface key

storeface key req tabid: %u

storeface key rsp value: %s

storeface key rsp count: %u

storeface key rsp time out

fetch tab httpdownload succ: tabid %u

FetchTabs rsp tab count: %ul

8.6.18804.0

(0@@@` (0@@@`

V*(%F@4 F7*

72.JA1'

[,'&"?4-

8.6.12.0

(*.*)

%original file name%.exe_3148_rwx_00236000_0000C000:

This program is maDe by dtcser.thank

.MAMA~

.AND~~

P.YOURS

P.BABA

kernel32.dll

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

ttp://imgsa.baidu.com/forum/pic/item/838ba61ea8d3fd1fb85125ca384e251f94ca5fe2.jpg

C:\ProgramData\Microsoft\Network\Connections\Pbk

C:\Windows\System32\Ras

%original file name%.exe_3148_rwx_00245000_00001000:

.pac;.jvs;.js

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

Local\C:_Users_adm_AppData_Local_Microsoft_Windows_Temporary Internet Files_Content.IE5_index.dat_196608

4.0 (compatible; MSIE 6.0; Windows NT 5.0)

hXXp://imgsrc.baidu.com/forum/pic/item/91ef76c6a7efce1ba2babeb2a451f3deb48f6530.jpg|420649|e2bac321221b524350349165660568a7

hXXp://imgsrc.baidu.com/forum/pic/item/9d82d158ccbf6c81dc6a5a90b73eb13533fa406c.jpg|420649|9ee313fd2956ba618292ead276bdf85c

hXXp://imgsrc.baidu.com/forum/pic/item/d0c8a786c9177f3e09698a757bcf3bc79f3d566c.jpg|420649|a1243b5e0a06fcfe2cd16e37ae095d2f

hXXp://imgsrc.baidu.com/forum/pic/item/71cf3bc79f3df8dca5acf9e9c611728b47102830.jpg|420649|361c155f0c4537c894e901d7ee79eaa6

hXXp://imgsrc.baidu.

,s\Content.IE5\

%original file name%.exe_3148_rwx_00247000_0002B000:

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

Local\C:_Users_adm_AppData_Roaming_Microsoft_Windows_Cookies_index.dat_32768

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

Local\C:_Users_adm_AppData_Local_Microsoft_Windows_History_History.IE5_index.dat_114688

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

4.0 (compatible; MSIE 6.0; Windows NT 5.0)

hXXp://VVV.75pk.cn:9999/5566.txt|hXXp://VVV.75pk.cn:9999/5566.txt|hXXp://VVV.75pk.cn:9999|hXXp://VVV.75pk.cn:9999/link.htm|hXXp://VVV.75pk.cn:9999/Upgrade/list.txt|

hXXp://imgsrc.baidu.com/forum/pic/item/91ef76c6a7efce1ba2babeb2a451f3deb48f6530.jpg|420649|e2bac321221b524350349165660568a7

hXXp://imgsrc.baidu.com/forum/pic/item/9d82d158ccbf6c81dc6a5a90b73eb13533fa406c.jpg|420649|9ee313fd2956ba618292ead276bdf85c

hXXp://imgsrc.baidu.com/forum/pic/item/d0c8a786c9177f3e09698a757bcf3bc79f3d566c.jpg|420649|a1243b5e0a06fcfe2cd16e37ae095d2f

hXXp://imgsrc.baidu.com/forum/pic/item/71cf3bc79f3df8dca5acf9e9c611728b47102830.jpg|420649|361c155f0c4537c894e901d7ee79eaa6

hXXp://imgsrc.baidu.com/forum/pic/item/d0c8a786c9177f3e09938a757bcf3bc79f3d5626.jpg|420649|efeca708117db886b159a1776a3f1459

hXXp://imgsrc.baidu.com/forum/pic/item/faedab64034f78f05f56ec8b72310a55b3191c6c.jpg|420649|73eb09906caf53e2d817d56e657948b4

hXXp://imgsrc.baidu.com/forum/pic/item/43a7d933c895d14330d1925b78f082025aaf0726.jpg|420649|3e2fd8cf67dbd66ce1b6b9ed06bf51eb

hXXp://imgsrc.baidu.com/forum/pic/item/aa64034f78f0f73606593a790155b319ebc41326.jpg|420649|5b2a63d5984b798459d2b53264b9f943

hXXp://imgsrc.baidu.com/forum/pic/item/f3d3572c11dfa9ec5173206f69d0f703918fc16d.jpg|337884|648bc2a66a557d4669ba6a23f4323b59

hXXp://imgsrc.baidu.com/forum/pic/item/c2fdfc039245d68838a05d29acc27d1ed31b2499.jpg|420649|11cfc01d96979bef07a18ae389372882

hXXp://imgsrc.baidu.com/forum/pic/item/728da9773912b31b970122a48e18367adbb4e1ca.jpg|420649|525347b95b4df673833d9fb03c0955e6

hXXp://imgsrc.baidu.com/forum/pic/item/f636afc379310a55abb93179bf4543a983261099.jpg|420649|76b689244c91e2c6a27bcb6803ba6517

hXXp://imgsrc.baidu.com/forum/pic/item/5bafa40f4bfbfbedbab4d9f270f0f736aec31f49.jpg|420649|e24db65247c698a16b5d954743055a82

hXXp://imgsrc.baidu.com/forum/pic/item/d6ca7bcb0a46f21fdca9b1defe246b600d33ae9a.jpg|105031|0eb9fc034d9a59ce1eb10c7bd2a89e3b

,4,0,1,1

,3,0,1,1

,2,0,1,1

),2,0,1,1

),3,0,1,1

,0,0,1,1

,1,0,1,1

),0,0,1,1

),4,0,1,1

1,4,0,1,1

5,4,0,1,1

10,4,0,1,1

50,4,0,1,1

100,4,0,1,1

500,4,0,1,1

1000,4,0,1,1

5000,4,0,1,1

1,0,0,1,1

1],4,0,1,1

],4,0,1,1

11,4,0,1,1

hXXp://imgsrc.baidu.com/forum/pic/item/810a19d8bc3eb135ddf43a4bae1ea8d3fd1f440b.jpg|420649|74caa486e032c9a95ff7ac69a6335657

hXXp://imgsrc.baidu.com/forum/pic/item/b3b7d0a20cf431ad79d1cec94336acaf2edd983b.jpg|420649|f8c4dfdc2d60a199afe37b7d72864b4e

hXXp://imgsrc.baidu.com/forum/pic/item/3b292df5e0fe9925650fe4a03ca85edf8db1713b.jpg|420649|5cf48fa3b58bed6c6c3be7dccd673d66

hXXp://imgsrc.baidu.com/forum/pic/item/4bed2e738bd4b31cd50e194b8fd6277f9e2ff814.jpg|297656|101037befd84a153d332d67e5aeb686b

This program is maDe by dtcser.thank

.MAMA~

.AND~~

P.YOURS

P.BABA

kernel32.dll

user32.dll

GetKeyboardType

advapi32.dll

RegOpenKeyExA

RegCloseKey

moc.tfosorcim.secivresatem.serotsenilno

onlinestores.metaservices.microsoft.com

moc.ylezimitpo.gol.531950642

246059135.log.optimizely.com

/intl/en/chrome/browser/privacy/

moc.elgoog

google.com

v/5566.tx

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4

hXXp://101.200.152.202:86/810a19d8bc3eb135ddf43a4bae1ea8d3fd1f440b.jpg

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files

hXXp://101.200.152.202:86/838ba61ea8d3fd1fb85125ca384e251f94ca5fe2.jpg

hXXp://101.200.152.202:86/b3b7d0a20cf431ad79d1cec94336acaf2edd983b.jpg

hXXp://101.200.152.202:86/3b292df5e0fe9925650fe4a03ca85edf8db1713b.jpg

hXXp://101.200.152.202:86/4bed2e738bd4b31cd50e194b8fd6277f9e2ff814.jpg

hXXp://101.200.152.202:86/91ef76c6a7efce1ba2babeb2a451f3deb48f6530.jpg

/b3b7d0a20cf431ad79d1cec94336acaf2edd983b.jpg

/4bed2e738bd4b31cd50e194b8fd6277f9e2ff814.jpg

/91ef76c6a7efce1ba2babeb2a451f3deb48f6530.jpg

/810a19d8bc3eb135ddf43a4bae1ea8d3fd1f440b.jpg

/838ba61ea8d3fd1fb85125ca384e251f94ca5fe2.jpg

/3b292df5e0fe9925650fe4a03ca85edf8db1713b.jpg

%original file name%.exe_3148_rwx_00BD1000_00003000:

kernel32.dll

user32.dll

The procedure entry point %s could not be located in the dynamic link library %s

The ordinal %u could not be located in the dynamic link library %s

gdi32.dll

winmm.dll

winspool.drv

advapi32.dll

shell32.dll

ole32.dll

oleaut32.dll

comctl32.dll

ws2_32.dll

comdlg32.dll

RegCloseKey

ShellExecuteA

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity name="E.App" processorArchitecture="x86" version="5.2.0.0" type="win32"/><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"> <security> <requestedPrivileges> <requestedExecutionLevel level="requireAdministrator" uiAccess="false"/> </requestedPrivileges> </security></trustInfo></assembly>

233333333333331

%original file name%.exe_3148_rwx_02180000_0003E000:

.text

`.rdata

@.data

.rsrc

@.reloc

%*.*f

CNotSupportedException

commctrl_DragListMsg

COMCTL32.DLL

CCmdTarget

__MSVCRT_HEAP_SELECT

user32.dll

RASAPI32.dll

GetProcessHeap

GetCPInfo

KERNEL32.dll

SetWindowsHookExA

GetKeyState

UnhookWindowsHookEx

USER32.dll

SetViewportOrgEx

OffsetViewportOrgEx

SetViewportExtEx

ScaleViewportExtEx

GDI32.dll

comdlg32.dll

WINSPOOL.DRV

ADVAPI32.dll

SHELL32.dll

COMCTL32.dll

WSOCK32.dll

ole32.dll

OLEAUT32.dll

FtpDeleteFileA

FtpRenameFileA

FtpCreateDirectoryA

FtpRemoveDirectoryA

FtpSetCurrentDirectoryA

FtpGetCurrentDirectoryA

FtpPutFileA

FtpGetFileA

FtpFindFirstFileA

HttpQueryInfoA

HttpSendRequestA

HttpOpenRequestA

InternetCrackUrlA

InternetCanonicalizeUrlA

WININET.dll

internet.fne

InternetOpenUrlA

SHLWAPI.dll

MSIMG32.dll

MSVCRT.dll

WS2_32.dll

WINMM.dll

hXXp://imgsrc.baidu.com/forum/pic/item/838ba61ea8d3fd1fb85125ca384e251f94ca5fe2.jpg|226769|7a360f63ae53e99a493e3599f7a2790f

imgsa.baidu.com

c:\hwconfig

c:\hwconfig\

%original file name%.exe_3148_rwx_021BF000_00031000:

G|Z%d

hXXp://101.200.152.202:86/

101.200.152.202

\*.qdat

kernel32.dll

Kernel32.dll

shlwapi.dll

ntdll.dll

user32.dll

wininet.dll

Msimg32.dll

InternetOpenUrlA

program internal error number is %d.

:"%s"

:"%s".

1.1.3

;3 #>6.&

'2, / 0&7!4-)1#

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

%s@%s:%d

.PAVCException@@

HTTP/1.0

0000HTTP

hXXp://VVV.eyuyan.com

service@dywt.com.cn

 86(0411)39895834

 86(0411)39895831

SMTP

This is a runtime library file for EPL applications. The EPL is a software development environment. For details please visit VVV.dywt.com.cn/info

Windows

ListFtpDir

GetCurrentFtpDir

SetCurrentFtpDir

RemoveFtpDir

CreateFtpDir

RenameFtpFile

DeleteFtpFile

PutFtpFile

GetFtpFile

DisconnectFTPServer

ConnectFTPServer

GetHttpFile

DisconnectSmtpServer

ConnectSmtpServer

internet_fnListFtpDir

internet_fnGetCurrentFtpDir

internet_fnSetCurrentFtpDir

internet_fnRemoveFtpDir

internet_fnCreateFtpDir

internet_fnRenameFtpFile

internet_fnDeleteFtpFile

internet_fnPutFtpFile

internet_fnGetFtpFile

internet_fnDisconnectFTPServer

internet_fnConnectFTPServer

internet_fnGetHttpFile

internet_fnDisconnectSmtpServer

internet_fnConnectSmtpServer

rasapi32.lib

sale@dywt.com.cn

service@dywt.com.cn;sale@dywt.com.cn

%s <%s>

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

HELO %s

AUTH LOGIN

LOGIN

AUTH=LOGIN

EHLO %s

Content-Type: application/octet-stream; name=%s

Content-Disposition: attachment; filename=%s

MAIL FROM:<%s>

RCPT TO:<%s>

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.?AVCCmdTarget@@

.PAVCArchiveException@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCFileException@@

zcÁ

c:\%original file name%.exe

78

4%4-41474

?!?.?3?9?

3"3'343@3

5(6,64686

6 6$6(6,6064686<6@6

1.0.0.0

(hXXp://VVV.eyuyan.com)

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\c811cdec13b869980d35d80854d6ee98.txt (420 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\65f6abe6a4f101e743eab4f55d18313b.ini (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\212b0fa0fa111459cc3edae1d50ba7f8.txt (420 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ea81016697da3e03d2125f1b020a8d96.txt (420 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\8df8373986d2124c43b3d42c81e8f3df.txt (226 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.