Trojan.Generic.20067453_dc8d43c88d – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.Generic.20067453 (B) (Emsisoft), Trojan.Generic.20067453 (AdAware), Trojan-Downloader.Win32.Karagany.1.FD, Trojan-PSW.Win32.Bzub.2.FD, Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericEmailWorm.YR, GenericInjector.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-Downloader, Trojan-PSW, Trojan, Worm, EmailWorm

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: dc8d43c88da0c1f907c6e6bcfd1dd6e7

SHA1: a4a28665b6b4739ada5049352ede26dc09eaa63b

SHA256: 47681cb4ab356152d338ebf3f36714617f371cc950944eec0a40e357505dfacd

SSDeep: 98304:CTddyRXTxeUs9wUsC3AHCHlvM6AMC343NyVPUXz/iSjHdh/R0iaV:6ddylTxeUmwULHAI3klUj/dHTqiq

Size: 5079040 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, ACProtect141

Company: no certificate found

Created at: 2016-12-10 14:25:04

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:2388

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:2388 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30EV4AVE\Ã¦â€ºÂ´Ã¦â€“Â°Ã¨Â¯Â´Ã¦ËœÅ½Ã¦â€Â¶Ã¨Â´Â¹Ã§â€°Ë†Ã¦Å“Â¬[1].txt (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\checktime[1].js (121 bytes)

Registry activity

The process %original file name%.exe:2388 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASMANCS]
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Multimedia\DrawDib]
"vga.drv 1916x902x32(BGR 0)" = "31,31,31,31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad]
"WpadLastNetwork" = "{24C5EDBC-2851-452A-B521-5DA992F6C1B5}"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASMANCS]
"EnableConsoleTracing" = "0"
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadDecision" = "3"
"WpadDecisionTime" = "D0 6D 10 4F 25 64 D2 01"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecision" = "3"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 36 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{24C5EDBC-2851-452A-B521-5DA992F6C1B5}]
"WpadNetworkName" = "Network 2"
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\dc8d43c88da0c1f907c6e6bcfd1dd6e7_RASAPI32]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 09 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-e1-da-d8]
"WpadDecisionTime" = "D0 6D 10 4F 25 64 D2 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\30EV4AVE\Ã¦â€ºÂ´Ã¦â€“Â°Ã¨Â¯Â´Ã¦ËœÅ½Ã¦â€Â¶Ã¨Â´Â¹Ã§â€°Ë†Ã¦Å“Â¬[1].txt (823 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GPS1JHSL\checktime[1].js (121 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: ??
Product Name: ??????????
Product Version: 1.1.4.0
Legal Copyright: (C) ?? ??????

Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.1.4.0
File Description: ????VIP
Comments: 2.0.4.0.6
Language: Language Neutral

Company Name: ??Product Name: ??????????Product Version: 1.1.4.0Legal Copyright: (C) ?? ??????Legal Trademarks: Original Filename: Internal Name: File Version: 1.1.4.0File Description: ????VIPComments: 2.0.4.0.6Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	6602752	3481600	5.54511	47fed7a8d1faffa49a820480d1762540
.vmp1	6606848	1490944	1490944	4.80108	3f7126b4cc2e7e62e0302e686177f3b8
.idata	8097792	4096	4096	1.24177	2d1e90cffb42784240b7a272864ed38c
.rsrc	8101888	86016	86016	5.21608	37f86ab76edd22cb440182c5e4001731
.vmp1	8187904	4096	4096	5.53344	3609dce567b913ef3aa3381d92d98504

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.wllyi.cn/nzcs/senoe.asp?AC=3A	122.114.118.177
hxxp://cgiaccess.tcdn.qq.com/checktime?otype=json&localTime
hxxp://www.wllyi.cn/zsyz/Ã¦â€ºÂ´Ã¦â€“Â°Ã¨Â¯Â´Ã¦ËœÅ½Ã¦â€Â¶Ã¨Â´Â¹Ã§â€°Ë†Ã¦Å“Â¬.txt	122.114.118.177
hxxp://vv.video.qq.com/checktime?otype=json&localTime	203.205.147.229

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Set-Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; path=/

Server: IIS

X-Powered-By: WAF/2.0

Set-Cookie: safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71; expires=Dec, 1-Jan-2017 16:00:40 GMT; domain=wllyi.cn; path=/

Date: Sun, 01 Jan 2017 11:50:40 GMT

2017-01-01 19:50:40HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 19..Content-Type: text/html..Set-Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; path=/..Server: IIS..X-Powered-By: WAF/2.0..Set-Cookie: safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71; expires=Dec, 1-Jan-2017 16:00:40 GMT; domain=wllyi.cn; path=/..Date: Sun, 01 Jan 2017 11:50:40 GMT..2017-01-01 19:50:40....

GET /zsyz/Ã¦â€ºÂ´Ã¦â€“Â°Ã¨Â¯Â´Ã¦ËœÅ½Ã¦â€Â¶Ã¨Â´Â¹Ã§â€°Ë†Ã¦Å“Â¬.txt HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://VVV.wllyi.cn/zsyz/Ã¦â€ºÂ´Ã¦â€“Â°Ã¨Â¯Â´Ã¦ËœÅ½Ã¦â€Â¶Ã¨Â´Â¹Ã§â€°Ë†Ã¦Å“Â¬.txt

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Content-Length: 823

Content-Type: text/plain

Last-Modified: Sun, 01 Jan 2017 02:45:03 GMT

Accept-Ranges: bytes

ETag: "e4c270dd963d21:0"

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:41 GMT

-a-1.6.1=a=..-b-hXXp://flzspc-1251485800.costj.myqcloud.com/Ã©â‚¬â€ %E6Ë†ËœCFÃ¥Â¸Â®Ã¨Â±â€ Ã¤Â¸â‚¬Ã©â€Â®Ã¥Å Â©Ã¦â€°â€¹1.6.1VIPÃ§â€°Ë†Ã¦Å“Â¬.zip=b=..-c-\....CF............1.6.1VIP.....zip=c=..-d-VIP..1.6.1:....QQ............CDK....,................,................,..........1500..........,..............................................,................25...................cf..............CF............................TGP.....................~................-..............................100 ..............65 !..........100-300....................10 =d=..-........-hXXp://VVV.917ka.com/list/2JNvu=........=..-..........-....=..........=..-....-0=....=..-....-dadadada-........-..-........-........-........-..-....-....:.................. .................................................-........-....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:43 GMT

2017-01-01 19:50:43....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:43 GMT

2017-01-01 19:50:43....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:43 GMT

2017-01-01 19:50:43....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:43 GMT

2017-01-01 19:50:44....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:44 GMT

2017-01-01 19:50:44....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:44 GMT

2017-01-01 19:50:44....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:44 GMT

2017-01-01 19:50:45....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:44 GMT

2017-01-01 19:50:45....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:46 GMT

2017-01-01 19:50:46....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:46 GMT

2017-01-01 19:50:46....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:46 GMT

2017-01-01 19:50:47HTTP/1.1 200 OK..Cache-Control: private..Content-Length: 19..Content-Type: text/html..Server: IIS..X-Powered-By: WAF/2.0..Date: Sun, 01 Jan 2017 11:50:46 GMT..2017-01-01 19:50:47....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:47 GMT

2017-01-01 19:50:47....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:47 GMT

2017-01-01 19:50:47....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:47 GMT

2017-01-01 19:50:48....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:48 GMT

2017-01-01 19:50:48....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:48 GMT

2017-01-01 19:50:48....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:48 GMT

2017-01-01 19:50:49....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:49 GMT

2017-01-01 19:50:49....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:49 GMT

2017-01-01 19:50:49....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:49 GMT

2017-01-01 19:50:50....

POST /nzcs/senoe.asp?AC=3A HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: VVV.wllyi.cn

Content-Length: 0

Cache-Control: no-cache

Cookie: ASPSESSIONIDSSDDTACA=PILNCBHAHBDCAKFACMBILHBB; safedog-flow-item=8ACDD0E089E57E0FBC219F944806BB71

HTTP/1.1 200 OK

Cache-Control: private

Content-Length: 19

Content-Type: text/html

Server: IIS

X-Powered-By: WAF/2.0

Date: Sun, 01 Jan 2017 11:50:51 GMT

2017-01-01 19:50:51....

GET /checktime?otype=json&localTime HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

Referer: hXXp://vv.video.qq.com/checktime?otype=json&localTime

Accept-Language: zh-cn

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

Host: vv.video.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: NWS_DAA_FRONT_L2

Connection: close

Date: Sun, 01 Jan 2017 11:50:53 GMT

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 121

X-Daa-Tunnel: hop_count=1

QZOutputJson={"s":"o","t":1483271454,"ip":"194.242.96.226","pos":".........---......","rand":"qKHQT3QHOVGzd7Ltkaxmew=="};..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2388:

.text

`.vmp1

h.idata

H.rsrc

@.vmp1

t%SVh

>SShG

t$(SSh

~%UVW

u$SShe

wininet.dll

kernel32.dll

ole32.dll

WinINet.dll

user32.dll

gdi32.dll

GDI32.DLL

msimg32.dll

comctl32.dll

COMCTL32.DLL

User32.dll

gdiplus.dll

Wininet.dll

version.dll

advapi32.dll

GdiPlus.dll

Gdiplus.dll

OLEACC.DLL

shlwapi.dll

Kernel32.dll

oleaut32.dll

HttpOpenRequestA

HttpSendRequestA

HttpQueryInfoA

MsgWaitForMultipleObjects

GdiplusShutdown

SetWindowsHookExA

UnhookWindowsHookEx

EnumWindows

InternetOpenUrlA

GdipSetStringFormatHotkeyPrefix

GdipGetStringFormatHotkeyPrefix

GdipSetPenLineJoin

GdipGetPenLineJoin

GetUrlCacheEntryInfoA

RegCloseKey

RegCreateKeyA

RegOpenKeyA

GetWindowsDirectoryA

RegEnumKeyA

RegFlushKey

RegOpenKeyExA

RegCreateKeyExA

RegDeleteKeyA

C:\Windows\nzskey.ini

hXXp://ui.ptlogin2.qq.com/cgi-bin/login?hide_title_bar=1&low_login=0&qlogin_auto_login=1&no_verifyimg=1&appid=100&s_url=hXXp://i.gtimg.cn/club/item/face/img/0/16240_100.png

&u1=http://i.gtimg.cn/club/item/face/img/0/16240_100.png&r=0.4946510000453042

&appid=100&js_ver=10152&js_type=0&login_sig=

hXXp://check.ptlogin2.qq.com/check?pt_tea=1&uin=

&0.7103327842903055

hXXp://captcha.qq.com/getimage?aid=100&r=0.7929121435236763&uin=

','','0'

Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

http=

https

HTTP/1.1

Content-Type: application/x-www-form-urlencoded

hXXps://

hXXp://

TGame.exe

WSExplorer 1.3.exe

WSExplorer 1.0.exe

WSExplorer 1.1.exe

WSExplorer 1.2.exe

Fiddler.exe

WPE.exe

Wireshark.exe

Client.exe

&aid=100&u1=http://i.gtimg.cn/club/item/face/img/0/16240_100.png&h=1&ptredirect=1&ptlang=2052&from_ui=1&dumy=&fp=loginerroralert&action=7-58-83885&mibao_css=&t=3&g=1&js_type=0&js_ver=10152&login_sig=&pt_uistyle=0&pt_randsalt=0&pt_vcode_v1=0&pt_verifysession_v1=

hXXp://ptlogin2.qq.com/login?u=

nz.qq.com

:hXXp://aq.qq.com/007

function a(password,salt,vcode){TEA=window.TEA;var md5Pwd=MD5(password);h1=hexchar2bin(md5Pwd);s2=MD5(h1 salt);rsaH1=$pt.RSA.rsa_encrypt(h1);rsaH1Len=(rsaH1.length/2).toString(16);hexVcode=TEA.strToBytes(vcode.toUpperCase(),true);vcodeLen=Number(hexVcode.length/2).toString(16);while(vcodeLen.length

while(rsaH1Len.length

TEA.initkey(s2);var saltPwd=TEA.enAsBase64(rsaH1Len rsaH1 TEA.strToBytes(salt) vcodeLen hexVcode);TEA.initkey("");return saltPwd.replace(/[\/\ =]/g,function(a){return{"/":"-"," ":"*","=":"_"}[a];});}

var D=[];for(var C=0;C

function U(aD,aC,z){aC="F20CE00BAE5361F8FA3AE9CEFA495362FF7DA1BA628F64A347F0A8C012BF0B254A30CD92ABFFE7A6EE0DC424CB6166F8819EFA5BCCB20EDFB4AD02E412CCF579B1CA711D55B8B0B3AEB60153D5E0693A2A86F3167D7847A0CB8B00004716A9095D9BADC977CBB804DBDCBA6029A9710869A453F27DFDDF83C016D928B3CBF4C7";z="3";var t=new N();t.setPublic(aC,z);return t.encrypt(aD);}

function hexchar2bin(str){var arr=[];for(var i=0;i

arr=arr.join("");eval("var temp = '" arr "'");return temp;}

var hex_chr="0123456789abcdef";function rhex(num){str="";for(j=0;j>(j*8 4))&0x0F) hex_chr.charAt((num>>(j*8))&0x0F);return str;}

function str2blks_MD5(str){nblk=((str.length 8)>>6) 1;blks=new Array(nblk*16);for(i=0;i>2]|=str.charCodeAt(i)>2]|=0x80

function MD5(str){x=str2blks_MD5(str);var a=1732584193;var b=-271733879;var c=-1732584194;var d=271733878;for(i=0;i

window={};navigator={};$=window.$||{};$pt=window.$pt||{};$.RSA=$pt.RSA=function(){function h(z,t){return new au(z,t);}

function aj(aC,aD){var t="";var z=0;while(z aD

return t aC.substring(z,aC.length);}

function u(t){if(t

function ah(aD,aG){if(aG

var aF=new Array();var aC=aD.length-1;while(aC>=0&&aG>0){var aE=aD.charCodeAt(aC--);aF[--aG]=aE;}

aF[--aG]=0;var z=new af();var t=new Array();while(aG>2){t[0]=0;while(t[0]==0){z.nextBytes(t);}

function N(){this.n=null;this.e=0;this.d=null;this.p=null;this.q=null;this.dmp1=null;this.dmq1=null;this.coeff=null;}

function q(z,t){if(z!=null&&t!=null&&z.length>0&&t.length>0){this.n=h(z,16);this.e=parseInt(t,16);}else{uv_alert("Invalid RSA public key");}}

function Y(t){return t.modPowInt(this.e,this.n);}

function r(aC){var t=ah(aC,(this.n.bitLength() 7)>>3);if(t==null){return null;}

var aD=this.doPublic(t);if(aD==null){return null;}

var z=aD.toString(16);if((z.length&1)==0){return z;}else{return"0" z;}}

N.prototype.doPublic=Y;N.prototype.setPublic=q;N.prototype.encrypt=r;var ay;var ak=244837814094590;var ab=((ak&16777215)==15715070);function au(z,t,aC){if(z!=null){if("number"==typeof z){this.fromNumber(z,t,aC);}else{if(t==null&&"string"!=typeof z){this.fromString(z,256);}else{this.fromString(z,t);}}}}

function b(aE,t,z,aD,aG,aF){while(--aF>=0){var aC=t*this[aE ] z[aD] aG;aG=Math.floor(aC/67108864);z[aD ]=aC&67108863;}

if(ab&&(navigator.appName=="Microsoft Internet Explorer")){au.prototype.am=aA;ay=30;}else{if(ab&&(navigator.appName!="Netscape")){au.prototype.am=b;ay=26;}else{au.prototype.am=az;ay=28;}}

au.prototype.DB=ay;au.prototype.DM=((1

ar="a".charCodeAt(0);for(x=10;x

ar="A".charCodeAt(0);for(x=10;x

function aB(t){return ag.charAt(t);}

function C(z,t){var aC=ai[z.charCodeAt(t)];return(aC==null)?-1:aC;}

function c(t){var z=j();z.fromInt(t);return z;}

function y(aG,z){var aD;if(z==16){aD=4;}else{if(z==8){aD=3;}else{if(z==256){aD=8;}else{if(z==2){aD=1;}else{if(z==32){aD=5;}else{if(z==4){aD=2;}else{this.fromRadix(aG,z);return;}}}}}}

this.t=0;this.s=0;var aF=aG.length,aC=false,aE=0;while(--aF>=0){var t=(aD==8)?aG[aF]&255:C(aG,aF);if(t

aC=false;if(aE==0){this[this.t ]=t;}else{if(aE aD>this.DB){this[this.t-1]|=(t&((1>(this.DB-aE));}else{this[this.t-1]|=t

aE =aD;if(aE>=this.DB){aE-=this.DB;}}

if(aD==8&&(aG[0]&128)!=0){this.s=-1;if(aE>0){this[this.t-1]|=((1

this.clamp();if(aC){au.ZERO.subTo(this,this);}}

function Q(){var t=this.s&this.DM;while(this.t>0&&this[this.t-1]==t){--this.t;}}

function s(z){if(this.s

var aC;if(z==16){aC=4;}else{if(z==8){aC=3;}else{if(z==2){aC=1;}else{if(z==32){aC=5;}else{if(z==4){aC=2;}else{return this.toRadix(z);}}}}}

var aE=(10){if(aG>aG)>0){t=true;aF=aB(aH);}

while(aD>=0){if(aG>(aG =this.DB-aC);}else{aH=(this[aD]>>(aG-=aC))&aE;if(aG

function T(){var t=j();au.ZERO.subTo(this,t);return t;}

function an(){return(this.s

return this.DB*(this.t-1) l(this[this.t-1]^(this.s&this.DM));}

z.t=Math.max(this.t-aC,0);z.s=this.s;}

function v(aH,aD){var z=aH%this.DB;var t=this.DB-z;var aF=(1=0;--aC){aD[aC aE 1]=(this[aC]>>t)|aG;aG=(this[aC]&aF)

aD[aE]=aG;aD.t=this.t aE 1;aD.s=this.s;aD.clamp();}

function n(aG,aD){aD.s=this.s;var aE=Math.floor(aG/this.DB);if(aE>=this.t){aD.t=0;return;}

var z=aG%this.DB;var t=this.DB-z;var aF=(1>z;for(var aC=aE 1;aC>z;}

aD.t=this.t-aE;aD.clamp();}

function ad(z,aD){var aC=0,aE=0,t=Math.min(z.t,this.t);while(aC>=this.DB;}

if(z.t>=this.DB;}

aE =this.s;}else{aE =this.s;while(aC>=this.DB;}

aD.s=(aE0){aD[aC ]=aE;}}

aD.t=aC;aD.clamp();}

function F(z,aD){var t=this.abs(),aE=z.abs();var aC=t.t;aD.t=aC aE.t;while(--aC>=0){aD[aC]=0;}

for(aC=0;aC

aD.s=0;aD.clamp();if(this.s!=z.s){au.ZERO.subTo(aD,aD);}}

function S(aC){var t=this.abs();var z=aC.t=2*t.t;while(--z>=0){aC[z]=0;}

for(z=0;z=t.DV){aC[z t.t]-=t.DV;aC[z t.t 1]=1;}}

if(aC.t>0){aC[aC.t-1] =t.am(z,t[z],aC,2*z,0,1);}

aC.s=0;aC.clamp();}

function G(aK,aH,aG){var aQ=aK.abs();if(aQ.t

var aI=this.abs();if(aI.t

if(aG!=null){this.copyTo(aG);}

var aE=j(),z=this.s,aJ=aK.s;var aP=this.DB-l(aQ[aQ.t-1]);if(aP>0){aQ.lShiftTo(aP,aE);aI.lShiftTo(aP,aG);}else{aQ.copyTo(aE);aI.copyTo(aG);}

var aL=aC*(11)?aE[aM-2]>>this.F2:0);var aT=this.FV/aL,aS=(1=0){aG[aG.t ]=1;aG.subTo(aF,aG);}

au.ONE.dlShiftTo(aM,aF);aF.subTo(aE,aE);while(aE.t

while(--aN>=0){var aD=(aG[--aO]==aC)?this.DM:Math.floor(aG[aO]*aT (aG[aO-1] aR)*aS);if((aG[aO] =aE.am(0,aD,aG,aN,0,aM))

if(aH!=null){aG.drShiftTo(aM,aH);if(z!=aJ){au.ZERO.subTo(aH,aH);}}

aG.t=aM;aG.clamp();if(aP>0){aG.rShiftTo(aP,aG);}

if(z

function P(t){var z=j();this.abs().divRemTo(t,null,z);if(this.s0){t.subTo(z,z);}

function X(t){if(t.s=0){return t.mod(this.m);}else{return t;}}

function L(t){t.divRemTo(this.m,null,t);}

function J(t,aC,z){t.multiplyTo(aC,z);this.reduce(z);}

function aw(t,z){t.squareTo(z);this.reduce(z);}

M.prototype.convert=X;M.prototype.revert=am;M.prototype.reduce=L;M.prototype.mulTo=J;M.prototype.sqrTo=aw;function D(){if(this.t

var z=t&3;z=(z*(2-(t&15)*z))&15;z=(z*(2-(t&255)*z))&255;z=(z*(2-(((t&65535)*z)&65535)))&65535;z=(z*(2-t*z%this.DV))%this.DV;return(z>0)?this.DV-z:-z;}

function g(t){this.m=t;this.mp=t.invDigit();this.mpl=this.mp&32767;this.mph=this.mp>>15;this.um=(1

function al(t){var z=j();t.abs().dlShiftTo(this.m.t,z);z.divRemTo(this.m,null,z);if(t.s0){this.m.subTo(z,z);}

function av(t){var z=j();t.copyTo(z);this.reduce(z);return z;}

function R(t){while(t.t

for(var aC=0;aC>15)*this.mpl)&this.um)=t.DV){t[z]-=t.DV;t[ z] ;}}

t.clamp();t.drShiftTo(this.m.t,t);if(t.compareTo(this.m)>=0){t.subTo(this.m,t);}}

function ao(t,z){t.squareTo(z);this.reduce(z);}

function B(t,aC,z){t.multiplyTo(aC,z);this.reduce(z);}

g.prototype.convert=al;g.prototype.revert=av;g.prototype.reduce=R;g.prototype.mulTo=B;g.prototype.sqrTo=ao;function k(){return((this.t>0)?(this[0]&1):this.s)==0;}

function A(aH,aI){if(aH>4294967295||aH

var aG=j(),aC=j(),aF=aI.convert(this),aE=l(aH)-1;aF.copyTo(aG);while(--aE>=0){aI.sqrTo(aG,aC);if((aH&(10){aI.mulTo(aC,aF,aG);}else{var aD=aG;aG=aC;aC=aD;}}

return aI.revert(aG);}

function ap(aC,t){var aD;if(aC

return this.exp(aC,aD);}

au.prototype.copyTo=aa;au.prototype.fromInt=p;au.prototype.fromString=y;au.prototype.clamp=Q;au.prototype.dlShiftTo=at;au.prototype.drShiftTo=Z;au.prototype.lShiftTo=v;au.prototype.rShiftTo=n;au.prototype.subTo=ad;au.prototype.multiplyTo=F;au.prototype.squareTo=S;au.prototype.divRemTo=G;au.prototype.invDigit=D;au.prototype.isEven=k;au.prototype.exp=A;au.prototype.toString=s;au.prototype.negate=T;au.prototype.abs=an;au.prototype.compareTo=I;au.prototype.bitLength=w;au.prototype.mod=P;au.prototype.modPowInt=ap;au.ZERO=c(0);au.ONE=c(1);var o;var W;var ae;function d(t){W[ae ]^=t&255;W[ae ]^=(t>>8)&255;W[ae ]^=(t>>16)&255;W[ae ]^=(t>>24)&255;if(ae>=O){ae-=O;}}

function V(){d(new Date().getTime());}

if(W==null){W=new Array();ae=0;var K;if(navigator.appName=="Netscape"&&navigator.appVersion

while(ae>>8;W[ae ]=K&255;}

function E(){if(o==null){V();o=aq();o.init(W);for(ae=0;ae

return o.next();}

function ax(z){var t;for(t=0;t

af.prototype.nextBytes=ax;function m(){this.i=0;this.j=0;this.S=new Array();}

z=0;for(aD=0;aD

m.prototype.init=f;m.prototype.next=a;function aq(){return new m();}

var O=256;function U(aD,aC,z){aC="F20CE00BAE5361F8FA3AE9CEFA495362FF7DA1BA628F64A347F0A8C012BF0B254A30CD92ABFFE7A6EE0DC424CB6166F8819EFA5BCCB20EDFB4AD02E412CCF579B1CA711D55B8B0B3AEB60153D5E0693A2A86F3167D7847A0CB8B00004716A9095D9BADC977CBB804DBDCBA6029A9710869A453F27DFDDF83C016D928B3CBF4C7";z="3";var t=new N();t.setPublic(aC,z);return t.encrypt(aD);}

return{rsa_encrypt:U};}();(function(t){var u="",a=0,h=[],z=[],A=0,w=0,o=[],v=[],p=true;function f(){return Math.round(Math.random()*4294967295);}

var B="";for(var C=0;C

function x(C){var D="";for(var B=0;B

function m(E){var D,F,C=[],B=E.length;for(D=0;D0&&F=128&&F>6)&31)),String.fromCharCode(128|(F&63)));}else{if(F>=2048&&F>12)&15)),String.fromCharCode(128|((F>>6)&63)),String.fromCharCode(128|(F&63)));}}}}

return C.join("");}

function j(D){h=new Array(8);z=new Array(8);A=w=0;p=true;a=0;var B=D.length;var E=0;a=(B 10)%8;if(a!=0){a=8-a;}

function s(F){var E=0;var C=new Array(8);var B=F.length;v=F;if(B%8!=0||B

for(var D=0;D

function g(){var B=v.length;for(var C=0;C

function q(F,E){var D=[];if(E){for(var C=0;C

t.TEA={encrypt:function(E,D){var C=q(E,D);var B=j(C);return y(B);},enAsBase64:function(G,F){var E=q(G,F);var D=j(E);var B="";for(var C=0;C

return window.btoa(B);},decrypt:function(D){var C=q(D,false);var B=s(C);return y(B);},initkey:function(B,C){u=q(B,C);},bytesToStr:x,strToBytes:c,bytesInStr:y,dataFromStr:q};var d={};d.PADCHAR="=";d.ALPHA="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /";d.getbyte=function(D,C){var B=D.charCodeAt(C);if(B>255){throw"INVALID_CHARACTER_ERR: DOM Exception 5";}

return B;};d.encode=function(F){if(arguments.length!=1){throw"SyntaxError: Not enough arguments";}

var C=d.PADCHAR;var H=d.ALPHA;var G=d.getbyte;var E,I;var B=[];F="" F;var D=F.length-F.length%3;if(F.length==0){return F;}

for(E=0;E>18));B.push(H.charAt((I>>12)&63));B.push(H.charAt((I>>6)&63));B.push(H.charAt(I&63));}

switch(F.length-D){case 1:I=G(F,E)>18) H.charAt((I>>12)&63) C C);break;case 2:I=(G(F,E)>18) H.charAt((I>>12)&63) H.charAt((I>>6)&63) C);break;}

return B.join("");};if(!window.btoa){window.btoa=d.encode;}})(window);

Adodb.Stream

hXXp://function.qq.com/common/getuserinfo.php?callback=callback&cmd=10014&callback=callback&params=getface&g_tk=

nickname:

faceurl:

(aq.qq.com)

skey=

&SQL=

19,91,01,22,52,09

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)

senoe.asp

hXXp://VVV.wllyi.cn/nzcs/

skey

hXXp://vv.video.qq.com/checktime?otype=json&localTime

iTXtXML:com.adobe.xmp

xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/"

xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/"

xmlns:stEvt="hXXp://ns.adobe.com/xap/1.0/sType/ResourceEvent#"

xmlns:photoshop="hXXp://ns.adobe.com/photoshop/1.0/"

xmlns:dc="hXXp://purl.org/dc/elements/1.1/"

xmlns:tiff="hXXp://ns.adobe.com/tiff/1.0/"

xmlns:exif="hXXp://ns.adobe.com/exif/1.0/">

Adobe Photoshop CC 2015 (Windows)

xmp.iid:32619857-f20a-894d-a028-c2d46745678e

adobe:docid:photoshop:1e92255b-a40b-11e6-abf9-84b3ba212696

xmp.did:49b40b56-8582-d442-97dd-a2a4ff03fba9

xmp.iid:49b40b56-8582-d442-97dd-a2a4ff03fba9

Adobe Photoshop CC 2015 (Windows)

xmp.iid:32619857-f20a-894d-a028-c2d46745678e

adobe:docid:photoshop:f28836a2-a3fe-11e6-9ca8-cee99f19128f

Qm.yH

s)hg%X2=.

f;g.EA

b.xkPZ:59C4A

%SJ n

^.WXkq

%yf!{(g%c

_?.TX

%UO,i]

:.IZ'

.kIy}S3

hXXp://VVV.wllyi.cn/zsyz/Ã¦â€ºÂ´Ã¦â€“Â°Ã¨Â¯Â´Ã¦ËœÅ½Ã¦â€Â¶Ã¨Â´Â¹Ã§â€°Ë†Ã¦Å“Â¬.txt

hXXp://ptlogin2.qq.com/ptqrshow?appid=21000109&e=2&l=M&s=3&d=72&v=4&t=0.22085385350510478&daid=45

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

?{B96B3CAF-0728-11D3-9D7B-0000F81EF32E}

\empty.exe

`.data

.rsrc

could not empty working set for process #%d [%s]

could not empty working set for process #%d

USAGE: empty.exe {pid | task-name}

AdjustTokenPrivileges failed with %d

LookupPrivilegeValue failed with %d

OpenProcessToken failed with %d

empty.pdb

KERNEL32.dll

msvcrt.dll

ADVAPI32.dll

CloseWindowStation

SetProcessWindowStation

OpenWindowStationA

GetProcessWindowStation

EnumWindowStationsA

USER32.dll

ntdll.dll

OLEAUT32.dll

8@hXXp://ptlogin2.qq.com/ptqrlogin?u1=http://r2.qq.com/comm-htdocs/login/logincallback.htm&ptredirect=0&h=1&t=1&g=1&from_ui=1&ptlang=2052&action=2-0-1474810972919&js_ver=10176&js_type=1&login_sig=ZWErlboPvJNwKPS-TNBgUPEz98824fztXp3VFEx8INuHovPjGPaDJyNnyKpyblku&pt_uistyle=40&aid=21000109&daid=45&

hXXp://svip.tzyee.net/list/2JNvu

VVV.snlhk.cn

User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.0; MyIE2; .NET CLR 1.1.4322)

hXXp://nz.qq.com/cp/a20150907uninstall/index.htm?ADTAG=bangbang.hdsq

C$%cmb

.ppM|

aZ.mO

%-^

.hk;~

KERNEL32.DLL

COMCTL32.dll

GDI32.dll

MSIMG32.dll

MSVCRT.dll

MSVFW32.dll

SkinH_EL.dll

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fxinyue.qq.com%2Fact%2Fpc%2Fa20160314xynzh%2F&eas_refer=&sServiceDepartment=xinyue&xhrPostKey=xhr_1462853989302

&xhr=1&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=

bHasSendFailItem":"0","iRet":"0","sMsg":"

iAlertSerial":"0","sMsg":"

sMsg":"

","sMsg":"

"modRet":{"msg":"

","sPackageCDkey

},"sMsg":"

sPackageCDkey

='123456789'

='12345678'

='1234567'

='123456'

hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=nz&area=

function time(){return new Date().getTime()}

&rolename=Ã§Â¨Â»Ã§Â¨Â»Ã¥â€œÂ¥&areaname=Ã§â€ÂµÃ¤Â¿Â¡Ã¥Å’Âº&eas_info=""

hXXp://apps.game.qq.com/cgi-bin/daoju/v3/hs/i_buy.cgi?areaid=

hXXp://x1m1.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=nz&iActivityId=

gameId=&sArea=&iSex=&sRoleId=&iGender=&sServiceType=nz&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=dj&iActivityId=11117&sServiceDepartment=djc&set_info=djc

"modRet":{"bHasSendFailItem":"0","iRet":"0","sMsg":"

"iAlertSerial":"0","sMsg":"

&_=1456836092715

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=weekfirst&biz=&mctest=&p_tk=

&_=1456836509745

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=monthfirst&biz=&mctest=&p_tk=

&_=1472262340512

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=weekfirst&biz=&mctest=&p_tk=

&_=1472262527096

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=monthfirst&biz=&mctest=&p_tk=

&_=1472262580066

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=order20&biz=&mctest=&p_tk=

&_=1472262706246

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=order40&biz=&mctest=&p_tk=

&_=1472262761426

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=order60&biz=&mctest=&p_tk=

&_=1472262814828

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=amount30&biz=&mctest=&p_tk=

&_=1472262945894

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=amount80&biz=&mctest=&p_tk=

&_=1472262977199

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=amount200&biz=&mctest=&p_tk=

hXXp://apps.game.qq.com/daoju/v3/api/we/member/MemberH5.php?appid=1003&channel=xinyue&optype=user_benefit_apply&jsonpName=privilageApply&output_format=jsonp&ticketType=amount1000&biz=&mctest=&p_tk=

hXXp://apps.game.qq.com/daoju/appmarket/daoju_promotion/cloud_ticket/QueryCloudTicket.php?acctid=A100078&id=28&time=0.9709016266272523&_=1456480329182

hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=

hXXp://iyouxi.vip.qq.com/ams3.0.php?g_tk=

"cdkey":"

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1160.js

MP_CDKEYID_INFO=

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fm%2Fact%2Fa20151201nz%2F&eas_refer=&sServiceDepartment=xinyue

&sServiceType=tgclub&objCustomMsg=&rolelevel=&iActivityId=

%7C

*&checkparam=nz%7Cyes%7C

&ams_checkparam=nz%7Cyes%7C

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=65752&sServiceDepartment=xinyue&set_info=xinyue&isXhrPost=true

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fxinyue.qq.com%2Fact%2Fpc%2Fa20161027xinynz%2F&eas_refer=&sServiceDepartment=xinyue

&sServiceType=tgclub&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=65752&iFlowId=

hXXp://xinyue.qq.com/act/pc/a20161027xinynz/index.shtml

hXXp://act.tgp.qq.com/index.php/nz/

X-Requested-With: XMLHttpRequest

Referer: hXXp://act.tgp.qq.com/nz/nz20160229/index.html?ADTAG=bangbang.hdsq

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: act.tgp.qq.com

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=21547&sServiceDepartment=xinyue&set_info=xinyue

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fxinyue.qq.com%2F%2Fweb201410%2F%2Fwebgame.shtml&eas_refer=&sServiceDepartment=xinyue&sServiceType=tgclub

modRet":{"msg":"

hXXp://bang.qq.com/app/nz/sign/ajax/doNzSign

&servercode=DNFHZ&goodset=PID144001411151524302380&checkparam=tgame|yes|

hXXp://apps.game.qq.com/comm-cgi-bin/mp/cdkey/mp_exchange.cgi?cdkey=

msg:"

hXXp://bang.qq.com/user/

game=nz&mid=0&eid=5&surl=&durl=http://bang.qq.com/actcenter/index/nz&ref=

hXXp://bang.qq.com/user/scorePersonal

game=bangbang&mid=9&eid=9000&surl=http://bang.qq.com/main/intro/&durl=http://bang.qq.com/main/intro/&world=0&serviceType=2&ref=

hXXp://bangbang.qq.com/php/share_praise/add_praise/

nick=0&sex=0&picuin=9000&themes=125&classfy=2&vip=2&fid=0&fids=0&bangdou=1&from=1

hXXp://bang.qq.com/answerTool/canAnswer

&nickname=11111

hXXp://bang.qq.com/answerTool/toAnwserQue

&nickname=11111 &num=

hXXp://bangbang.qq.com/php/user/getBangdouInfo/

hXXp://bangbang.qq.com/php/share_picture/editPicture/ylzt/0.4849149603396654

picdes=shuabangdou&pictype=0&imgdata=iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAMAAAFfzAQtAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAAZQTFRF////AAAAVcLTfgAAAAF0Uk5TAEDm2GYAAAAKSURBVHjaY2AAAAACAAHlJ978AAAAAElFTkSuQmCC&imgprop=&predes=%23QQ%E9%A3%9E%E8%BD%A6%E5%B8%AE%E5%B8%AE%E6%9C%89%E5%9B%BE%23&selectType=1&weiboType=0&qzoneType=0&qzoneAlbumId=3507ec77-843b-4895-8cf6-b3c86399050f&vip=1&bangdou=1

hXXp://bangbang.qq.com/php/share_picture/editPicture/speed/0.6257424782961607

picdes=daodao&pictype=0&imgdata=iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAMAAAFfzAQtAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAAZQTFRF////AAAAVcLTfgAAAAF0Uk5TAEDm2GYAAAAKSURBVHjaY2AAAAACAAHlJ978AAAAAElFTkSuQmCC&imgprop=&predes=%23QQ%E9%A3%9E%E8%BD%A6%E5%B8%AE%E5%B8%AE%E6%9C%89%E5%9B%BE%23&selectType=1&weiboType=0&qzoneType=0&qzoneAlbumId=3507ec77-843b-4895-8cf6-b3c86399050f&vip=1&bangdou=1

hXXp://bangbang.qq.com/php/share_usercenter/delete_picture/speed/0.43441258832192686

/0.0584637900181757

nick=&sex=1&picuin=9000&themes=124&classfy=1&vip=-1&fid=0&fids=0&bangdou=1&from=1

930471530

Ã©Å“Â¸Ã©Ââ€œÃ¦â‚¬Â»Ã¨Â£ÂÃ¨Â¯Å¾Ã§â€Å¸Ã¨Â®Â°

790106146

12Ã¦Å“Ë†Ã¦â€“Â°Ã§â€°Ë†Ã¦Å“Â¬

13210222908

Ã§Å¡â€¡Ã¦â€”ÂÃ¦Å“â€°Ã¤Â»â‚¬Ã¤Â¹Ë†Ã§â€°Â¹Ã¦ÂÆ’

29470166493

180011668

Ã¦Å“â‚¬Ã¦â€“Â°Ã¦Â´Â»Ã¥Å Â¨

19140035607

Ã¥â€˜Â¨Ã¦Å“Â«Ã§â€šÂ¹Ã¥Ë†Â¸Ã¥Â¦â€šÃ¤Â½â€¢Ã¥Â¾â€”

240552836

2015.12Ã¦Å“Ë†Ã¥Â¹Â¸Ã¨Â¿ÂÃ¥â€¦Â¬Ã¦Â°â€˜

720354206

Ã§Â»ÂÃ©ÂªÅ’Ã¥ÂÂ¯Ã¤Â»Â¥Ã¥ÂÂ¡Ã¥Â¤Å¡Ã¥Â°â€˜Ã§ÂºÂ§

9870057033

160032353

130002908

320029736

790053998

Ã¦Ââ€°Ã¦ÂÂ¾Ã¥Â°ÂÃ¥Â§ÂÃ¥Âºâ€ Ã¥â€¦Â¸

430003139

hXXp://bangbang.qq.com/php/robot/servey

&searchkey=15123116032643708101000000000000&from=1&question=

c:\yxzs

hXXp://ptlogin2.qq.com/getimage?aid=21000113&_=614

hXXp://bang.qq.com/app/tool/ajax_nz_jsqb/getNzShowInfo

&areaName=Ã§â€ÂµÃ¤Â¿Â¡Ã¥Å’Âº&serverName=Ã§â€ÂµÃ¤Â¿Â¡Ã¥Å’Âº&serverId=1&areaId=379&isMainRole=1&isapp=1&userId=3472071&token=vbV6JW53&env=&isother=0

&nickname=0.0v&toUin=

hXXp://bang.qq.com/app/tool/ajax_nz_jsqb/getNzFirstPageInfo

&areaName=Ã§â€ÂµÃ¤Â¿Â¡Ã¥Å’Âº&serverName=Ã§â€ÂµÃ¤Â¿Â¡Ã¥Å’Âº&serverId=2&areaId=379&isMainRole=2&isapp=2&userId=3472071&token=vbV6JW53&env=&isother=0

hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=nz&area=1&callback=14566285914229029&sServiceDepartment=xinyue

&login_dayctn

hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=nz&area=2&callback=14566285914229029&sServiceDepartment=xinyue

hXXp://x.pet.qq.com/toolbarsign?cmd=Sign&callback=jQuery

hXXp://x.pet.qq.com/toolbarsign?cmd=Gift&callback=jQuery110209654921818807931_1459077409306&_=1459077409311

hXXp://x.pet.qq.com/petgrow?cmd=Random&callback=jQuery110205668174499274088_1459077590630&_=1459077590634

hXXp://act.pet.qq.com/cgi-bin/regist?cmd=1&id=qq_ly&localtime=0.33272379031404853

hXXp://act.pet.qq.com/cgi-bin/regist?cmd=2&id=qq_ly&petname=QÂ³Ã¨Â±Â¦Â±Â´&marster=Ã–Ã·ÃˆÃ‹&sex=0&localtime=0.7825335417874157

hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=79968&callback=vipSignNew.signCb&g_tk=

hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=23314&callback=vipSignNew.signCb&g_tk=

hXXp://iyouxi.vip.qq.com/ams3.0.php?actid=52002&rand=0.7222043301444501&g_tk=

hXXp://iyouxi.vip.qq.com/ams3.0.php?callback=jQuery1720659062771890838_1451911590706&g_tk=

hXXp://apps.game.qq.com/daoju/v3/api/app/e_app/add_jf_firstlogin.php?ch=10001&sDeviceID=ffffffff-9a48-5984-8c1b-27707df22f7f&appVersion=31&appSource=android

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cookies

scripting.FileSystemObject

\*.txt

hXXp://bang.qq.com/app/tool/ajax_nz_jsqb/getNzItemInfoByType

&areaName=Ã§â€ÂµÃ¤Â¿Â¡Ã¥Å’Âº&serverName=Ã§â€ÂµÃ¤Â¿Â¡Ã¥Å’Âº&serverId=

&nickname=&toUin=

hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=141227&roleid=

%Program Files%\

liuwei.ini

InternetExplorer.lnk

%Program Files%\Internet Explorer\

hXXp://VVV.919yi.cn/?id=73475

%Program Files%\Internet Explorer\IEXPLORE.EXE

hXXp://act.tgp.qq.com/index.php/nz/nz20161101/index/ajax_save_zone/

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fbang.qq.com%2Fshop%2Findex%2Fnz%2F&eas_refer=http%3A%2F%2Fbang.qq.com%2Factcenter%2Findex%2Fnz%2F&sServiceDepartment=xinyue&sServiceType=nz&sArea=

D[iTXtXML:com.adobe.xmp

xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"

VVV.yxflzs.com

xmp.did:D2925B849E4211E69E8DD2A5E13B9869

xmp.iid:0eae581f-ac02-7c4c-b20c-07a4ae6ef5f1

adobe:docid:photoshop:4759047b-a408-11e6-9ca8-cee99f19128f

xmp.did:6e3c5798-7565-5741-8d51-758d66ed5539

xmp.iid:6e3c5798-7565-5741-8d51-758d66ed5539

xmp.iid:656347e4-36d6-cd49-b7ca-65f933822451

xmp.iid:60e4b643-02cc-2942-a101-88baba84ec95

from application/vnd.adobe.photoshop to image/png

converted from application/vnd.adobe.photoshop to image/png

xmp.iid:0eae581f-ac02-7c4c-b20c-07a4ae6ef5f1

xmp.iid:60e4b643-02cc-2942-a101-88baba84ec95

adobe:docid:photoshop:fca59670-74fe-11e6-a7f4-a15b2bbf99ac

xmp.did:6e3c5798-7565-5741-8d51-758d66ed5539

H.Rc.-

I$(%d

.qwH3

y.cF4 7

%x:Fj A

!r%f{

%SbW:

do.aG

.dsv@B,

BU%u&

%sOt,

.Fvq4h

.ww/iQ

84#%s

.CiGX0h

=Q.lX

I`H%c

.ug~L_xS

.BxYo

x;F%s

;,iTXtXML:com.adobe.xmp

xmp.iid:c1acbde0-41a6-fe47-80cb-2b7523a68046

adobe:docid:photoshop:6b95a49f-53c9-11e6-a451-ba4ee4a834fa

xmp.did:4344b2ae-7632-1f48-b87a-16a52d393dc0

xmp.iid:4344b2ae-7632-1f48-b87a-16a52d393dc0

xmp.iid:c1acbde0-41a6-fe47-80cb-2b7523a68046

xmp.iid:4b282ed4-1c73-1346-bcfe-e255952c3833

adobe:docid:photoshop:df210220-53c8-11e6-a451-ba4ee4a834fa

xmp.did:1a2a55c7-a8be-c740-9abd-13521a9e3ef7

xmp.iid:1a2a55c7-a8be-c740-9abd-13521a9e3ef7

xmp.iid:4b282ed4-1c73-1346-bcfe-e255952c3833

;~iTXtXML:com.adobe.xmp

xmp.iid:913285b3-e540-c446-8617-c8014757a8da

adobe:docid:photoshop:1ae9db7b-a3ca-11e6-a539-d83f082242fa

xmp.did:7d888172-d13c-d948-bbdb-8c6f3d610716

xmp.iid:7d888172-d13c-d948-bbdb-8c6f3d610716

xmp.iid:913285b3-e540-c446-8617-c8014757a8da

xmp.iid:0e0fe8c8-bf31-3c4e-b632-ede2b67deabc

adobe:docid:photoshop:bd1a5abe-a3c9-11e6-a539-d83f082242fa

xmp.did:3dc0914d-8151-e54a-9384-ffbe8b6fe184

xmp.iid:3dc0914d-8151-e54a-9384-ffbe8b6fe184

xmp.iid:0e0fe8c8-bf31-3c4e-b632-ede2b67deabc

&{.UY

xmp.iid:0c35e65d-5d22-bf44-bcd3-15fb99761dd1

adobe:docid:photoshop:7751a7ff-6b95-11e6-b00a-b6764988de9a

xmp.did:4bfc4062-840c-b943-949b-4de772f68505

xmp.iid:4bfc4062-840c-b943-949b-4de772f68505

xmp.iid:40d79533-cf66-d947-9623-cf7dec37a7df

xmp.iid:0c35e65d-5d22-bf44-bcd3-15fb99761dd1

xmp.iid:40d79533-cf66-d947-9623-cf7dec37a7df

xmp.did:4bfc4062-840c-b943-949b-4de772f68505

adobe:docid:photoshop:bf4d14de-6ab7-11e6-a920-eb2cc8032304

xmp.did:40727619271211E6B8D4F5FACCB1BA4D

xmp.did:8F9B7BF5C91E11E382FB8B1580E48D7C

ZP2Dl%x

xmp.iid:ba421067-588f-f341-99e3-0d6879d62ef6

adobe:docid:photoshop:7cf8d752-6b96-11e6-b00a-b6764988de9a

xmp.iid:0df6e3c2-8d24-af47-bf77-5611475a927a

xmp.iid:ba421067-588f-f341-99e3-0d6879d62ef6

xmp.iid:0df6e3c2-8d24-af47-bf77-5611475a927a

UCl,#%x

d%X&5

L"eC%S

N -

xmp.iid:2578d984-03c4-ba46-b529-806217d93b7e

adobe:docid:photoshop:15204c5c-6b98-11e6-b00a-b6764988de9a

xmp.iid:f4a5f663-7f4c-644e-b94f-c738b48de1e0

xmp.iid:2578d984-03c4-ba46-b529-806217d93b7e

xmp.iid:f4a5f663-7f4c-644e-b94f-c738b48de1e0

xmp.iid:3467d5a5-ec53-a940-9382-1f2b713862a9

adobe:docid:photoshop:ef139d7d-6b95-11e6-b00a-b6764988de9a

xmp.iid:04388161-40d2-ab47-b1d0-63679be0f85d

xmp.iid:3467d5a5-ec53-a940-9382-1f2b713862a9

xmp.iid:04388161-40d2-ab47-b1d0-63679be0f85d

}o%d?

xmp.iid:f7fbbb26-2d4a-a24e-9524-a3dda8d6946f

adobe:docid:photoshop:14d52f11-6b97-11e6-b00a-b6764988de9a

xmp.iid:cd0db795-3f32-ce45-bb3d-dd5160f85481

xmp.iid:f7fbbb26-2d4a-a24e-9524-a3dda8d6946f

xmp.iid:cd0db795-3f32-ce45-bb3d-dd5160f85481

xmp.iid:7e1987cb-3cb6-e144-997c-d912e91ff4a3

adobe:docid:photoshop:29e5e765-6b96-11e6-b00a-b6764988de9a

xmp.iid:83d1a70a-8971-2a49-827f-30222926c881

xmp.iid:7e1987cb-3cb6-e144-997c-d912e91ff4a3

xmp.iid:83d1a70a-8971-2a49-827f-30222926c881

riH.Kl

s-*.Gg

/.bfz

L.crM

xmp.iid:94b7913e-1c8a-dc42-8264-53c144f29070

adobe:docid:photoshop:bf5ab4fd-6b96-11e6-b00a-b6764988de9a

xmp.iid:fe75dc8e-6491-5b4a-b248-c28cc162ec44

xmp.iid:94b7913e-1c8a-dc42-8264-53c144f29070

xmp.iid:fe75dc8e-6491-5b4a-b248-c28cc162ec44

xmp.iid:d0053a4f-1492-b644-9de0-7b9581b7a59e

adobe:docid:photoshop:9acac5a0-6b95-11e6-b00a-b6764988de9a

xmp.iid:914a5fda-6313-a44a-b329-a06c7de0e0d4

xmp.iid:d0053a4f-1492-b644-9de0-7b9581b7a59e

xmp.iid:914a5fda-6313-a44a-b329-a06c7de0e0d4

>%U!j

q.Sd5

:z^.tV3

4tAu.IU

xmp.iid:0f392963-787d-b447-8f53-82a3a904e0f4

adobe:docid:photoshop:01819774-6b95-11e6-b00a-b6764988de9a

xmp.did:02ff947a-9bd8-f24a-a7c7-3b2c5219e0f6

xmp.iid:02ff947a-9bd8-f24a-a7c7-3b2c5219e0f6

xmp.iid:0f392963-787d-b447-8f53-82a3a904e0f4

xmp.iid:d90ce99a-09c7-b346-ac31-63e606e9af2c

adobe:docid:photoshop:60016a7b-6b97-11e6-b00a-b6764988de9a

xmp.iid:e685a526-bd6e-4d43-807f-ed5dbe6c1afc

xmp.iid:d90ce99a-09c7-b346-ac31-63e606e9af2c

xmp.iid:e685a526-bd6e-4d43-807f-ed5dbe6c1afc

v.Qd1

pXl%U

xmp.iid:b2d89b0a-cf52-3c48-a649-bb7b77bb1a8a

adobe:docid:photoshop:a57f071e-6b97-11e6-b00a-b6764988de9a

xmp.iid:931f8968-c12a-8943-9cfc-3ba378bae7a1

xmp.iid:b2d89b0a-cf52-3c48-a649-bb7b77bb1a8a

xmp.iid:931f8968-c12a-8943-9cfc-3ba378bae7a1

C%ST]

\Config.ini

C:\Windows\

C:\yxzs\

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¦Â¬Â§Ã§Â¾Å½Ã¥Â¥Â³Ã¥ÂÂ©.png

c:\yxzs\

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã©â€â„¢Ã¨Â§â€°.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¥ÂÂ¯Ã§Ë†Â±Ã¥â€¦â€Ã¥ÂÂ.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¥Å Â¨Ã§â€Â»Ã¥Â¥Â³Ã¥ÂÂ©.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã§Â¾Å½Ã¥Â¥Â³Ã¨Â½Â¦Ã¦Â¨Â¡.png

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=qqgame&iActivityId=

&e_code=0&g_code=0&eas_url=http%3A%2F%2Flz.qq.com%2Fact%2Fa20160712sign%2F&eas_refer=&sServiceDepartment=group_h&sServiceType=qqgame

hXXp://jq.qq.com/?_wv=1027&k=2EYq99X

hXXp://bangbang.qq.com/php/user/isFristOpenByMonth/1451560125369?game=

hXXp://apps.game.qq.com/lol/act/a2011WebReputation/getReputation.php?r=1468662141265

msg":["

msg":"

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=

%7Cyes%7C

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcf.shtml&eas_refer=http%3A%2F%2Fdaoju.qq.com%2Fmall%2Fjudou2.0%2Fcodol.shtml&sServiceDepartment=djc&sPartition=

&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&areaid=&iActivityId=

","sMsg

],"msg":"

"msg":"

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=speed&iActivityId=51772&sServiceDepartment=newterminals&set_info=newterminals&_=1469728728129

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fspeed.qq.com%2Fcp%2Fa20160531jsxy%2F&eas_refer=&sServiceDepartment=group_a&sServiceType=speed

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fspeed.qq.com%2Fcp%2Fa20160531jsxy%2Fpage01.htm&eas_refer=http%3A%2F%2Fspeed.qq.com%2Fcp%2Fa20160531jsxy%2F&sServiceDepartment=group_a&sServiceType=speed

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fspeed.qq.com%2Fcp%2Fa20160531jsxy%2F&eas_refer=&sServiceDepartment=group_a

&sServiceType=speed&objCustomMsg=&areaname=&roleid=&rolelevel=&rolename=&iActivityId=

hXXp://bang.qq.com/app/speed/card/ajax/getUserBagInfo

hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=speed&area=

nick=

&nick=

,"sPackageCDkey":"

"},"sMsg":"

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã©â‚¬â€ Ã¦Ë†Ëœ.png

hXXps://xui.ptlogin2.qq.com/cgi-bin/xlogin?proxy_url=hXXp://game.qq.com/comm-htdocs/milo/proxy.html&appid=21000501&target=top&s_url=http://nz.qq.com/cp/a20150907uninstall/index.htm?ADTAG=bangbang.hdsq&daid=8

hXXps://daodaodj.taobao.com/shop/view_shop.htm?spm=686.1000925.a1zvx.d53.7wDbkv&mytmenu=mdianpu&utkn=Wfw7bJxSIAL8Tf7&user_number_id=646998885

:2iTXtXML:com.adobe.xmp

xmp.iid:5f7b21ba-d39b-e845-8168-89922970ce65

adobe:docid:photoshop:d0536985-ad78-11e6-8092-82819a2ab372

xmp.did:e8fef310-1e3d-0748-902d-70e8dea97d7d

xmp.iid:e8fef310-1e3d-0748-902d-70e8dea97d7d

xmp.iid:5f7b21ba-d39b-e845-8168-89922970ce65

xmp.iid:85170b68-8861-1145-9081-3e97d0d7697a

adobe:docid:photoshop:3f7370dc-ad79-11e6-8092-82819a2ab372

xmp.did:ce5bdb63-f02e-cf41-84fa-f40d6d661653

xmp.iid:ce5bdb63-f02e-cf41-84fa-f40d6d661653

xmp.iid:85170b68-8861-1145-9081-3e97d0d7697a

xmp.iid:6358663b-dd62-9542-adca-749ac7d4c578

adobe:docid:photoshop:e77cfa49-ad78-11e6-8092-82819a2ab372

xmp.did:c79c51d6-445d-094e-8d63-a276f5589681

xmp.iid:c79c51d6-445d-094e-8d63-a276f5589681

xmp.iid:6358663b-dd62-9542-adca-749ac7d4c578

Fkey

xmp.iid:356b32cd-3c25-0b42-8f2c-c26ebe13e210

adobe:docid:photoshop:1ee7567b-ad78-11e6-8092-82819a2ab372

xmp.did:793fc37f-2452-a349-8046-4f7f62991d97

xmp.iid:793fc37f-2452-a349-8046-4f7f62991d97

xmp.iid:356b32cd-3c25-0b42-8f2c-c26ebe13e210

xmp.iid:4adea4ac-7804-9049-bf20-818a8b027766

adobe:docid:photoshop:613cbb9c-ad79-11e6-8092-82819a2ab372

xmp.did:55cc7787-21a0-e446-bb29-d0669b89e970

xmp.iid:55cc7787-21a0-e446-bb29-d0669b89e970

xmp.iid:4adea4ac-7804-9049-bf20-818a8b027766

xmp.iid:b9bb0445-dead-cc46-a1bd-cec56b825af2

adobe:docid:photoshop:83e2bfdd-ad7b-11e6-8092-82819a2ab372

xmp.did:01887c00-7e23-0944-a429-f28f8aeb517a

xmp.iid:01887c00-7e23-0944-a429-f28f8aeb517a

xmp.iid:b9bb0445-dead-cc46-a1bd-cec56b825af2

xmp.iid:084aadd7-b636-2548-8cd4-f68c3f58d3fe

adobe:docid:photoshop:bc2146d7-ad78-11e6-8092-82819a2ab372

xmp.did:d060ea49-b113-c84a-91b4-b719af712397

xmp.iid:d060ea49-b113-c84a-91b4-b719af712397

xmp.iid:084aadd7-b636-2548-8cd4-f68c3f58d3fe

xmp.iid:1f069f1d-5c94-6846-94ff-cdf84d516b5f

adobe:docid:photoshop:1bf59843-ad79-11e6-8092-82819a2ab372

xmp.did:f3f9c856-1d10-7940-a2ce-701232b82102

xmp.iid:f3f9c856-1d10-7940-a2ce-701232b82102

xmp.iid:1f069f1d-5c94-6846-94ff-cdf84d516b5f

xmp.iid:6929f87a-c08f-b040-aeba-9238bca0ba79

adobe:docid:photoshop:876baa69-ad79-11e6-8092-82819a2ab372

xmp.did:d8edd063-936f-674c-8b3e-749c9cd66da1

xmp.iid:d8edd063-936f-674c-8b3e-749c9cd66da1

xmp.iid:6929f87a-c08f-b040-aeba-9238bca0ba79

xmp.iid:149042d3-4480-5343-94b4-dd44dfa358cc

adobe:docid:photoshop:fccbf747-ad7b-11e6-8092-82819a2ab372

xmp.did:85c223c5-04bf-f448-827d-5fc4fa681163

xmp.iid:85c223c5-04bf-f448-827d-5fc4fa681163

xmp.iid:149042d3-4480-5343-94b4-dd44dfa358cc

xmp.iid:174a6f2a-17ef-5541-9e78-e6657f0c259e

adobe:docid:photoshop:f4d96346-ad78-11e6-8092-82819a2ab372

xmp.did:505c6088-cf9f-ec48-9863-c5638e343681

xmp.iid:505c6088-cf9f-ec48-9863-c5638e343681

xmp.iid:174a6f2a-17ef-5541-9e78-e6657f0c259e

xmp.iid:7bb38fba-a57a-c040-a80d-984aff4d71d2

adobe:docid:photoshop:a859098c-ad78-11e6-8092-82819a2ab372

xmp.did:89b5d105-f7cd-a340-afaf-ae9b305660ae

xmp.iid:89b5d105-f7cd-a340-afaf-ae9b305660ae

xmp.iid:7bb38fba-a57a-c040-a80d-984aff4d71d2

hXXp://101.71.72.156/dlied6.qq.com/invc/xfspeed/qqpcmgr/download/QQPCDownload71732.exe?mkey=5735896d9b25b98e&f=2484&c=0&p=.exe

hXXp://bang.qq.com/actcenter/queryActList

endtime":"(.*?)","eventtime[\s\S]*?name":"(.*?)","once[\s\S]*?starttime":"(.*?)","szHoldName":"(.*?)","uin":"[\s\S]*?","url":"(.*?)"},{"aye":"

hXXp://iyouxi.vip.qq.com/ams2.02.php?actid=23074&g_tk_type=1&g_tk=

hXXp://iyouxi.vip.qq.com/jsonp.php?_c=page&actid=5474&isLoadUserInfo=1&callback=page.signInCb&g_tk=

hXXp://iyouxi.vip.qq.com/ams.php?_c=page&actid=22249&g_tk=

hXXp://mq.qq.com/index_userSignIn.shtml?r=0.1461226298330

hXXp://share.music.qq.com/fcgi-bin/dmrp_activity/fcg_feedback_send_lottery.fcg?activeid=110&rnd=1461218930175&g_tk=

&_=1461219711561

hXXp://x.pet.qq.com/vip_platform?cmd=set_sign_info&timer=1461219807562&callback=jQuery110209200774590775864_1461219711558&token=

&_=1461220788168

hXXp://pay.video.qq.com/fcgi-bin/sign?callback=jQuery1110037539952289029343_1461220788147&low_login=1&uin=

&_=1461221081879

hXXp://app.gamevip.qq.com/cgi-bin/gamevip_sign/GameVip_Lottery?callback=jQuery17203627362740461775_1461221078109&g_tk=

hXXp://c.pc.qq.com/fcgi-bin/signin?callback=jsonp1461292464121&mood_id=129&checkin_date=

hXXp://fight.pet.qq.com/cgi-bin/petpk?cmd=award&op=1&type=0

"ContinueLogin":"

hXXp://social.minigame.qq.com/cgi-bin/social/welcome_panel_operate?callback=jQuery19109538068487131782_1461295679473&cmd=1&uin=

hXXp://social.minigame.qq.com/cgi-bin/social/welcome_panel_operate?callback=jQuery19109538068487131782_1461295679473&cmd=2&uin=

&pvsrc=youxi_activeday_101&s_p=1|http|&s_v=0&ozid=511022&vipid=&actid=68391&sid=&callback=json14612979520145&cache=3654

hXXp://cgi.vip.qq.com/online/set?p_tk=&g_tk_type=1&g_tk=

hXXp://1.game.qq.com/app/sign?start=2016-04&g_tk=

hXXp://qun.qq.com/cgi-bin/qun_mgr/get_group_list

hXXp://qiandao.qun.qq.com/cgi-bin/sign

zn.qq.com

&_=1462878877353

&skey=

hXXp://act.guanjia.qq.com/bin/act/signinjoin_182.php?giftId=

&_=1462883072857

hXXp://act.guanjia.qq.com/bin/act/comjoin_183.php?giftId=

hXXp://buluo.qq.com/cgi-bin/bar/user/fbar

hXXp://buluo.qq.com/cgi-bin/bar/user/sign

hXXp://iyouxi.vip.qq.com/ams3.0.php?_c=page&actid=54963&callback=vipSignNew.signCb&g_tk=

:4iTXtXML:com.adobe.xmp

xmp.iid:edc9d5ef-598b-e544-9a58-c60d395cf4fe

adobe:docid:photoshop:59051b67-a3d0-11e6-90f6-a12af55f7408

xmp.did:3fed3c9b-d167-3043-b907-7ae1056619e8

xmp.iid:3fed3c9b-d167-3043-b907-7ae1056619e8

xmp.iid:edc9d5ef-598b-e544-9a58-c60d395cf4fe

%Uouz

:%sB`F

%SR!,N

{(;.Mb

%XVu9

]gJJ&-%u

D7%f'r

KG%F&

8.ii`i

.Xa@7/Wv

%us7,

|[N.kJ

.St7M

fK.HE Lp

D*.UyT

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¦â€“â€”Ã¦Ë†ËœÃ§Â¥Å¾.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã©â‚¬â€ Ã¦Ë†ËœÃ¦â€”Â Ã©â„¢ÂÃ¦Å Â½Ã¥Â¥â€“.png

hXXp://x1m1.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=nz&iActivityId=64151&sServiceDepartment=group_1

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fnz.qq.com%2Fcp%2Fa20160930warrior%2F&eas_refer=&sServiceDepartment=group_1&sServiceType=nz

[|](.*?)

hXXp://apps.game.qq.com/cgi-bin/comm_act/up2013/getRoleInfo.cgi?gid=17&area=1&rd=0.8982991850934923

hXXp://apps.game.qq.com/cgi-bin/comm_act/up2013/getRoleInfo.cgi?gid=17&area=3&rd=0.6693533703219146

hXXp://apps.game.qq.com/cgi-bin/comm_act/up2013/getRoleInfo.cgi?gid=17&area=2&rd=0.8982991850934923

hXXp://apps.game.qq.com/cgi-bin/comm_act/up2014/get_role_info.cgi?gid=2&area=

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¤Â½Â¿Ã¥â€˜Â½Ã¥ÂÂ¬Ã¥â€Â¤.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¥Å“Â°Ã¤Â¸â€¹Ã¥Å¸Å½Ã¤Â¸Å½Ã¥â€¹â€¡Ã¥Â£Â«.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã©Â£Å¾Ã¨Â½Â¦.png

hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=nz&area=1&callback=14758418069502364&_=1475841807452

1970.01.01 00:00:00

last_login_time=

hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=nz&area=2&callback=14758418069502364&_=1475841807452

hXXp://wb.qq.com/cgi-bin/cf_task/cf_pack_buy?gift_id=

x-requested-with: XMLHttpRequest

Referer: hXXp://wb.qq.com/cf_wbhtml/index.html?PcacheTime&PcacheTime=1459565600

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)

Host: wb.qq.com

hXXp://bang.qq.com/app/tool/ajax_nz_jsqb/getNzPlayInfo

&nickname=aÃ£â€šÅ¾aÃ§Â¨Â»Ã§Â¨Â»0.0v&toUin=

{"mapid":"[\s\S]*?","kill":"(.*?)","bekilled":"(.*?)","iswin":"(.*?)","title":"(.*?)","url":"[\s\S]*?","time":"(.*?)"}

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¥Â¾Â¡Ã©Â¾â„¢Ã¥Å“Â¨Ã¥Â¤Â©.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¦Å¾ÂªÃ§Â¥Å¾Ã§ÂºÂª.png

hXXp://apps.game.qq.com/lol/api/v2013/summoner.php?p2=

Host: apps.game.qq.com

Referer: hXXp://lol.qq.com/web201310/personal.shtml?id=

"msg":{"info":{"id":"

hXXp://apps.game.qq.com/lol/api/v2013/ownedHerosSkins.php?p1=

hXXp://apps.game.qq.com/lol/api/v2013/userinfo.php?p1=

hXXp://apps.game.qq.com/cgi-bin/comm_act/up2014/get_role_info.cgi?gid=26&area=

name":"(.*?)","level":"(.*?)","games":"(.*?)"},"money":{"ip":"(.*?)","rp":"(.*?)"},"credit":"(.*?)","tier[\s\S]*?}}};{"status":"0","msg":{"heronum":"(.*?)","skinnum":"(.*?)","

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1101.js

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1116.js

hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=cf&area=

.zhmk

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=tgclub&iActivityId=14146&sServiceDepartment=xinyue&set_info=xinyue

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fxinyue.qq.com%2Fact%2Fa20141121nztq%2F&eas_refer=&sServiceDepartment=xinyue&sServiceType=tgclu

"sPackageName":"(.*?)","dtGetPackageTime":"(.*?)","sCdkey":"(.*?)","iStatus":"

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¥â€°â€˜Ã§ÂÂµ.png

hXXp://7xpiug.com1.z0.glb.clouddn.com/Ã¦â‚¬ÂªÃ§â€°Â©Ã§Å’Å½Ã¤ÂºÂº.png

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1130.js

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã§â€šÂ«Ã¨Ë†Å¾Ã¦â€”Â¶Ã¤Â»Â£.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã§Â©Â¿Ã¨Â¶Å Ã§ÂÂ«Ã§ÂºÂ¿.png

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¦â‚¬ÂªÃ§â€°Â©Ã§Å’Å½Ã¤ÂºÂº.png

@qq.com

hXXp://apps.game.qq.com/cf/cfvip/doCfVip.php?action=getCfVipInfo&rd=0.4589295004629458&_=1457791428426

hXXp://apps.game.qq.com/cgi-bin/cf/cfvip/checkCFvipStatue.cgi?rd=0.48150917419169237&_=1457791428492

.ctb.$umL

-.AW{.

n'.pz7N

%st$|{

~IP%u

- .TI

.jqxY

.NuwK

:%%%u

1.ptG

.Go(M

.lG!)}

yG$%u

%S2v^

%sc1?7

%Syko

@/C.g.GnV]

Y%@.EtrrM]

]og.Sz

kS.rgL@px0_W

L%um=

.Nc

qyA%c

.Czd`

r0" %F

.hXRI

q.jo&

xUj%x

h%.D,

.rbcWX

xF;F-F}

.srw;=X

UCMd

W%DZ#9

u%xv&

";?-B}

.rt7G

|I.Xow

-.Kc2 u

7a.ir

!cl%us

hXXp://apps.game.qq.com/php/tgclub/v2/user/logininfo?callback=jQuery17208252096388011896_1458194429551&_=1458194429631

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1100.js

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fcf.qq.com%2F&eas_refer=&xhr=1&sServiceDepartment=group_f&sServiceType=cf&xhrPostKey=xhr_1456745497197

&user_roleLevel=99&user_checkparam=cf%7Cyes%7C

hXXp://cf.ams.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=cf&iActivityId=

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fcf.qq.com%2Fact%2Fa20141116lucky%2F&eas_refer=http%3A%2F%2Fbang.qq.com%2Factcenter%2Findex%2Fcf%2F&sServiceDepartment=x1m1&sServiceType=cf

(*.txt)|*.txt|

(*.*)|*.*

hXXp://apps.game.qq.com/cgi-bin/cf/webclan/user_info.cgi?iArea=

clankey":"

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã§â€“Â¾Ã©Â£Å½Ã¤Â¹â€¹Ã¥Ë†Æ’.png

hXXp://apps.game.qq.com/ams/ame/ame.php?ameVersion=0.3&sServiceType=speed&iActivityId=

&e_code=0&g_code=0&eas_url=http%3A%2F%2Fspeed.qq.com%2Fcp%2Fa20160606lyhz%2F&eas_refer=&sServiceDepartment=group_a&sServiceType=speed

&user_roleLevel=102&user_checkparam=speed%7Cyes%7C

"sPackageName":"(.*?)","iPackageNum":"1","sPackageRealFlag":"0","sPackageCDkey":"","dTimeNow":"(.*?)","sPackageLimitCheckCode

hXXp://wb.qq.com/cgi-bin/cf_task/cf_area_show?ct=1459792546519

hXXp://i.gtimg.cn/club/item/face/img/0/16240_100.png

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1386.js

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¦Å¾ÂªÃ¦Å¾â€”Ã¥Â¼Â¹Ã©â€ºÂ¨.png

hXXp://wb.qq.com/cgi-bin/cf_task/cf_task_signup?id=

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1138.js

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1578.js

hXXp://bang.qq.com/shop/index/

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1377.js

@qq.com&rd=0.8898490495048463&_=1466749419259

hXXp://apps.game.qq.com/cf/a20160526junact/getUserInfo.php?action=setuserinfo&iArea=

hXXp://wb.qq.com/cgi-bin/cf_task/cf_task_change?type=2&ct=1459858717251

hXXp://wb.qq.com/cgi-bin/cf_task/cf_task_show?ct=1459858717422

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã¥Â¤Â©Ã¦Â¶Â¯Ã¦ËœÅ½Ã¦Å“Ë†Ã¥Ë†â‚¬.png

hXXp://wb.qq.com/cgi-bin/cf_task/cf_task_change?type=1&ct=1459858717251

hXXp://wb.qq.com/cgi-bin/cf_task/cf_task_show?ct=1459853352512

hXXp://7xpqp4.dl1.z0.glb.clouddn.com/Ã§â€šÂ«Ã¨Ë†Å¾.png

hXXp://wb.qq.com/cgi-bin/cf_task/cf_pack_list?ct=1459837461983

hXXp://apps.game.qq.com/cgi-bin/cf/userinfo/userinfo.cgi?ssn=

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1337.js

.gjPl

vx.el

B.rj_

.mV[:88

nV4.sz

.rI{M

/62<.kk>

QDH.YfQ

=jI5Ã‹

%ud,

%Fhu)

kk(.fl

%Shk3

.dd]f

%fq B|

5i=p.Yc

e.iSi

kH%c>

$t%si

?.WJN

<.qth>

.Sb[e

`q&*.ki

.yX;i

RV>%x

%U=:N

7.abv

,$$%CHg

UR.hi"*

6!.vd

DT.fM1

yH.wW

1T.IF

U]W%x

_V#%S

U`>6%X

%cH&)t

.nu'\

%cPe6

!.vbvY

}.Kpj;

h".Gtt

T%u#f#

%xUYiT_H

Xv%Xk

O .Uy

H:U/-E}

,0N}u%x6o_

%fgcXd7

oq.UB

%FO"

iM%s%

qEXE

Ãs*

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1024.js

hXXp://act.tgp.qq.com/index.php/nz/nz20160229/index/ajax_get_present_log?t=

{"created":"(.*?)","type":"cdkey","cdkey":"(.*?)","name":"(.*?)"}

hXXp://apps.game.qq.com/comm-cgi-bin/content_admin/activity_center/query_role.cgi?game=

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1109.js

&server_id=86&server_name=Ã¦Âµâ„¢Ã¦Â±Å¸Ã§â€ÂµÃ¤Â¿Â¡&area_id=

hXXp://kf.qq.com/cgi-bin/common?rand=0.9827097171461823&command=command=C00006&fromtype=kfweb&fromtoolid=kfweb514&type=getCFSpend&area=

Referer: hXXp://kf.qq.com/game/consume_records.html?code=cf&from=hXXp://qqsix.com.cn/qq2011/cfhuodong.html

Host: kf.qq.com

#(.*?)#(.*?)#(.*?)[|]

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1419.js

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1110.js

hXXp://game.qq.com/js/content_admin/activity_center/CDKYE_INFO_1103.js

{B96B3CAB-0728-11D3-9D7B-0000F81EF32E}

VBScript.RegExp

?{B96B3CB5-0728-11D3-9D7B-0000F81EF32E}

javascript:document.onsdragstart=document.onselectstart=document.oncontextmenu=function(){return true}

javascript:document.onselectstart = document.oncontextmenu = document.onmousedown = document.onkeydown = function(){return true;};

var jie = document.createStyleSheet();jie.addRule('html','overflow:hidden;');

text|password|file

comdlg32.dll

{557CF400-1A04-11D3-9A73-0000F81EF32E}

{557CF401-1A04-11D3-9A73-0000F81EF32E}

{557CF402-1A04-11D3-9A73-0000F81EF32E}

{557CF405-1A04-11D3-9A73-0000F81EF32E}

{557CF406-1A04-11D3-9A73-0000F81EF32E}

WarnOnHTTPSToHTTPRedirect

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

hXXp://open.baidu.com/special/time/

window.baidu_time(

Accept: image/gif, image/bmp, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*

1970-01-01 08:00:00

1970-01-01 00:00:00

background(?:-image)?:.*?[\s]*?url[\s]*?\([#

']?(.*?)[#

onkeydown|

onkeyup|

onkeypress|

{0002DF05-0000-0000-C000-000000000046}

{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}

{6D5140C1-7436-11CE-8034-00AA006009FA}

?)-D%f`

location.reload()

window.location.href="

{25336920-03F9-11CF-8FD0-00AA00686F13}

hXXp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

document.all.retjs.innerText=

javascript:document.body.contentEditable='true';document.designMode='on';void 0;

javascript:document.body.contentEditable='false';document.designMode='on';void 0;

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

type=password

[password]

var jies = document.getElementsByTagName('object');for(var jie in jies){if(jies[jie].classid=='clsid:D27CDB6E-AE6D-11cf-96B8-444553540000'){jies[jie].removeNode(true);}}

user.qzone.qq.com

mail.qq.com

onkeyup

type='password'

type="password"

, 1, , ,

var jie = document.createStyleSheet();jie.addRule('html','

').value="

document.getElementById('

{6AEDBD6D-3FB5-418A-83A6-7F45229DC872}

:98789486

CDKEY:

1.5.9

99999999

18888888888

999999999

hXXp://wb.qq.com/cf_wbhtml/index.html?PcacheTime&PcacheTime=1459565600

1022559120

: 1022559120

%d&&'

123456789

00003333

%*.*f

CNotSupportedException

commctrl_DragListMsg

Afx:%x:%x:%x:%x:%x

Afx:%x:%x

CCmdTarget

__MSVCRT_HEAP_SELECT

Broken pipe

Inappropriate I/O control operation

Operation not permitted

iphlpapi.dll

bMPR.dll

VERSION.dll

.PAVCException@@

Shell32.dll

Mpr.dll

Advapi32.dll

Gdi32.dll

(&07-034/)7 '

?? / %d]

%d / %d]

.PAVCFileException@@

: %d]

(*.*)|*.*||

(*.WAV;*.MID)|*.WAV;*.MID|WAV

(*.WAV)|*.WAV|MIDI

(*.MID)|*.MID|

(*.txt)|*.txt|

(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG

(*.JPG)|*.JPG|PNG

(*.PNG)|*.PNG|BMP

(*.BMP)|*.BMP|GIF

(*.GIF)|*.GIF|

(*.ICO)|*.ICO|

(*.CUR)|*.CUR|

%s:%d

windows

.PAVCNotSupportedException@@

out.prn

(*.prn)|*.prn|

%d.%d

%d/%d

1.6.9

unsupported zlib version

png_read_image: unsupported transformation

%d / %d

Bogus message code %d

libpng error: %s

libpng warning: %s

1.1.3

bad keyword

libpng does not support gamma background rgb_to_gray

Palette is NULL in indexed image

(%d-%d):

%ld%c

VVV.dywt.com.cn

index.dat

desktop.ini

TermType%d

Service%d

Machine%d

Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

\e161255a-37c3-11d2-bcaa-00c04fd929db

\Data\e161255a-37c3-11d2-bcaa-00c04fd929db

Software\Microsoft\Internet Explorer\TypedURLs

(*.htm;*.html)|*.htm;*.html

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) CometHTTP

1.1.4

HTTP/1.0

Reply-To: %s

From: %s

To: %s

Subject: %s

Date: %s

Cc: %s

%a, %d %b %Y %H:%M:%S

SMTP

msscript.ocx

msctls_hotkey32

;3 #>6.&

'2, / 0&7!4-)1#

.PAVCOleException@@

.PAVCObject@@

.PAVCSimpleException@@

.PAVCMemoryException@@

.?AVCNotSupportedException@@

.PAVCResourceException@@

.PAVCUserException@@

.?AVCCmdTarget@@

.?AVCCmdUI@@

.?AVCTestCmdUI@@

.PAVCOleDispatchException@@

.PAVCArchiveException@@

zcÃ

c:\%original file name%.exe

#include "l.chs\afxres.rc" // Standard components

cEXe.

GetProcessHeap

hid.dll

mscoree.dll

mscorwks.dll

mscorsvr.dll

KernelBase.dll

mscoreei.dll

clr.dll

diasymreader.dll

SEGetNumExecUsed

SEGetNumExecLeft

SESetNumExecUsed

SEGetExecTimeUsed

SEGetExecTimeLeft

SESetExecTime

SEGetTotalExecTimeUsed

SEGetTotalExecTimeLeft

SESetTotalExecTime

SECheckExecTime

SECheckTotalExecTime

&&&&6666????

""""****

2222::::

$$$$\\\\

00006666

####====

IPHLPAPI.DLL

PSAPI.DLL

SHELL32.dll

#H7%c

t%sY\

QR{Gb%F

b%.ES

9zv?%u

lt.kG

cC%9X{z

v{.en

%c/?Y

%Uwczw1

4$x%f

KeY`{

x@.cJ

hF.Cr

@A.ND

ZH.HMr

B.gCVpJ

HPA.JJ

-E.BJ{

|@.PX

D.Vxew

udPf

dUrl9

ySX

kr"%c

W1V[.Wp

c~.oh

?.WyE

.yx~"

-sh}X

8#-1}

.zjJf

LY>.UFH

.ZrKa

LY>.Ubg

2.UM_Q

.ut\uG

WS2_32.dll

WINMM.dll

WINSPOOL.DRV

WININET.dll

SHLWAPI.dll

RASAPI32.dll

oledlg.dll

.PvE`

-ER.RE

xP.xx

.Rv`W

j.RvE

-`.Rv

-'-&.Rv

'.RvV

j'.Rhj

-jV7h}

E&.xW

WinExec

SHDeleteKeyA

{WINMM.dll

0RASAPI32.dll

KERNEL32.dll

:GetCPInfo

.SetErrorMode

GetKeyboardLayout

VkKeyScanExA

keybd_event

CreateDialogIndirectParamA

GetKeyState

GetViewportExtEx

ScaleViewportExtEx

SetViewportExtEx

SetViewportOrgEx

OffsetViewportOrgEx

}MSIMG32.dll

RegQueryInfoKeyA

/RegEnumKeyA

RegSetKeySecurity

RegGetKeySecurity

FRegCreateKeyExA

ShellExecuteA

GetViewportOrgEx

InternetCrackUrlA

GInternetCanonicalizeUrlA

ovHttpSendRequestA

FindFirstUrlCacheEntryA

DeleteUrlCacheEntry

uFindNextUrlCacheEntryA

Safengine Shielden v2.3.9.0

InternetCanonicalizeUrlA

2222255

42121212

.BQRU

dSqL

5.2.3790.0 built by: dnsrv_dev(v-smgum)

empty.exe

Windows

Operating System

5.2.3790.0

1, 0, 6, 6

(*.*)

1.1.4.0

2.0.4.0.6

%original file name%.exe_2388_rwx_00401000_0064E000: