Gen.Trojan.Heur.RP.0EWaatcOWjj_d9fff224eb – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

winnet.exe:1780

The Trojan injects its code into the following process(es):

%original file name%.exe:1908
Reality.log:2932

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Windows\winnet.exe (72 bytes)
C:\Windows\winnet.dll (125 bytes)
C:\tbbmalloc.exe (359 bytes)

The process winnet.exe:1780 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QIXNH8A0.txt (259 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA63D.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\baidu_com[1].htm (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XK3GIUWY.txt (301 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H5UXBDU3.txt (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FFF10234D401BC2B1190AF97E562D5D_F3D997279517A879744E962D7177C1F4 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\sogou_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6S2AZLV9.txt (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LGPBOI6P.txt (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\baidu_com[1].htm (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA63E.tmp (2712 bytes)
C:\Windows\LSP.dll (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZSHEDCO8.txt (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\126_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F0907449CE086_507563B8F03B0B599FD6AB48BFCFB84A (1464 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\intl_aliyun_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\sina_com_cn[1].htm (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E6507871752236B5CCD5_F4C066FA094BC754843DB99590B2CE02 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\360_cn[1].htm (184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\qq_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF (2674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\intl_aliyun_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\360_cn[1].htm (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\126_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C18B7A4A1C49A0D62FB269C7C94152C2_35B10F420FD9C1E2E7FF5E9724CF167D (1504 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FD1DA35A7CC73400775DD44892329357 (380 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\aliyun_com[1].htm (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A053CFB63FC8E6507871752236B5CCD5_F4C066FA094BC754843DB99590B2CE02 (2032 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F0907449CE086_684FCCCFC824BF4B1A2F9D4C1AA422EA (1480 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_507563B8F03B0B599FD6AB48BFCFB84A (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FD1DA35A7CC73400775DD44892329357 (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C (1476 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C18B7A4A1C49A0D62FB269C7C94152C2_35B10F420FD9C1E2E7FF5E9724CF167D (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\jd_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6 (1236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\aliyun_com[1].htm (278 bytes)
C:\Windows\winnet.dll (126 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FFF10234D401BC2B1190AF97E562D5D_F3D997279517A879744E962D7177C1F4 (1600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\baidu_com[1].htm (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KBEB05BG.txt (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\sina_com_cn[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\jd_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\sogou_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\360_cn[1].htm (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_684FCCCFC824BF4B1A2F9D4C1AA422EA (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\qq_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\qq_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\126_com[1].htm (10 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA63E.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\126_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\jingdong_com[1] (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\360_cn[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA63D.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KBEB05BG.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XK3GIUWY.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\jd_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\intl_aliyun_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\sina_com_cn[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\sina_com_cn[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\jd_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\baidu_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\360_cn[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\sogou_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\qq_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\qq_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6S2AZLV9.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\126_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\baidu_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\aliyun_com[1].htm (0 bytes)

Registry activity

The process %original file name%.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\D:\]
"login.exe" = "DisableNXShowUI"

The process winnet.exe:1780 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASAPI32]
"EnableFileTracing" = "0"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024]
"ProtocolName" = "LR_LSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-101"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024]
"PackedCatalogItem" = "43 3A 5C 57 69 6E 64 6F 77 73 5C 4C 53 50 2E 64"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Next_Catalog_Entry_ID" = "1124"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileTracingMask" = "4294901760"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-103"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{BDC8D276-A5D8-4E4C-8EB2-2752A8E55337}] SEQPACKET 2"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023]
"ProtocolName" = "LR_LSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Num_Catalog_Entries" = "21"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
"ProtocolName" = "@%SystemRoot%\System32\wshqos.dll,-102"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] DATAGRAM 1"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"PackedCatalogItem" = "43 3A 5C 57 69 6E 64 6F 77 73 5C 4C 53 50 2E 64"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60102"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FB1DE278-988C-428A-AF16-245107A1AA49}] DATAGRAM 3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] SEQPACKET 1"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9]
"Serial_Access_Num" = "43"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"ProtocolName" = "VMCI sockets DGRAM"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023]
"PackedCatalogItem" = "43 3A 5C 57 69 6E 64 6F 77 73 5C 4C 53 50 2E 64"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{BDC8D276-A5D8-4E4C-8EB2-2752A8E55337}] DATAGRAM 2"
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] DATAGRAM 0"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3C 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASAPI32]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
"ProtocolName" = "LR_LSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FB1DE278-988C-428A-AF16-245107A1AA49}] SEQPACKET 3"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
"ProtocolName" = "MSAFD NetBIOS [\Device\NetBT_Tcpip_{03967CDD-F8BD-4AC9-8369-0D2BD8F246F5}] SEQPACKET 0"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60101"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASMANCS]
"FileTracingMask" = "4294901760"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022]
"PackedCatalogItem" = "43 3A 5C 57 69 6E 64 6F 77 73 5C 4C 53 50 2E 64"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
"ProtocolName" = "@%SystemRoot%\System32\wshtcpip.dll,-60100"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
"ProtocolName" = "@%SystemRoot%\System32\wship6.dll,-60102"

[HKLM\SOFTWARE\Microsoft\Tracing\winnet_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022]
"ProtocolName" = "LR_LSP"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
"PackedCatalogItem" = "25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73"

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
"ProtocolName" = "VMCI sockets STREAM"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006]
[HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\0000002C]
[HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\0000002B]
[HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\0000002A]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009]
[HKLM\System\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"AutoConfigURL"

Dropped PE files

MD5	File path
9e6bb4361ee32703cff0d82d4e5b2e34	c:\Windows\LSP.dll
74fd54dafeda3b2a8bd33129dcdd3087	c:\Windows\winnet.dll
9343169d6cf4ff200bf12a5b189efc4c	c:\Windows\winnet.exe
0ce89ea9135afb535e047fcd5af8f14f	c:\tbbmalloc.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
winnet.exe:1780
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Windows\winnet.exe (72 bytes)
C:\Windows\winnet.dll (125 bytes)
C:\tbbmalloc.exe (359 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\QIXNH8A0.txt (259 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA63D.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\baidu_com[1].htm (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XK3GIUWY.txt (301 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H5UXBDU3.txt (66 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FFF10234D401BC2B1190AF97E562D5D_F3D997279517A879744E962D7177C1F4 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\sogou_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\6S2AZLV9.txt (103 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\LGPBOI6P.txt (447 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\baidu_com[1].htm (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA63E.tmp (2712 bytes)
C:\Windows\LSP.dll (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZSHEDCO8.txt (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\126_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F0907449CE086_507563B8F03B0B599FD6AB48BFCFB84A (1464 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\intl_aliyun_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\sina_com_cn[1].htm (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E6507871752236B5CCD5_F4C066FA094BC754843DB99590B2CE02 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\360_cn[1].htm (184 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\qq_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_D9B9F37ECE595B0B7B6AA12451D392CF (2674 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\intl_aliyun_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\360_cn[1].htm (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\126_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C18B7A4A1C49A0D62FB269C7C94152C2_35B10F420FD9C1E2E7FF5E9724CF167D (1504 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FD1DA35A7CC73400775DD44892329357 (380 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\aliyun_com[1].htm (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A053CFB63FC8E6507871752236B5CCD5_F4C066FA094BC754843DB99590B2CE02 (2032 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\705A76DE71EA2CAEBB8F0907449CE086_684FCCCFC824BF4B1A2F9D4C1AA422EA (1480 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_507563B8F03B0B599FD6AB48BFCFB84A (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FD1DA35A7CC73400775DD44892329357 (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C (1476 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C18B7A4A1C49A0D62FB269C7C94152C2_35B10F420FD9C1E2E7FF5E9724CF167D (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\jd_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1F4BA66CDBFEC85A20E11BF729AF23_AA85F8F9DAFF33153B5AEC2E983B94B6 (1236 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\aliyun_com[1].htm (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FFF10234D401BC2B1190AF97E562D5D_F3D997279517A879744E962D7177C1F4 (1600 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\baidu_com[1].htm (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\KBEB05BG.txt (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\sina_com_cn[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\jd_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\sogou_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\360_cn[1].htm (194 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\705A76DE71EA2CAEBB8F0907449CE086_684FCCCFC824BF4B1A2F9D4C1AA422EA (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\qq_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\qq_com[1].htm (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\126_com[1].htm (10 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	31159	0	0	d41d8cd98f00b204e9800998ecf8427e
.rdata	36864	10056	0	0	d41d8cd98f00b204e9800998ecf8427e
.data	49152	12812	0	0	d41d8cd98f00b204e9800998ecf8427e
.vmp0	65536	2982386	0	0	d41d8cd98f00b204e9800998ecf8427e
.vmp1	3051520	2664720	2664960	5.42596	1f086447083577b94a21f8755a4c7f50
.reloc	5718016	224	512	1.97216	8f958fd3e1adf85a0e51b7152ca3eb98
.rsrc	5722112	286205	286208	1.88602	a9bf22c4a148bad28e02ff4bea303059

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://opthw.xdwscache.speedcdns.com/
hxxp://www.taobao.com.danuoyi.tbcache.com/	213.244.178.246
hxxp://a1574.b.akamai.net/
hxxp://p18077.cdnga.net/
hxxp://www.jingdong.com/	211.152.123.110
hxxp://www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com/
hxxp://www.360.cn/	106.120.167.67
hxxp://email.163.com.lxdns.com/
hxxp://www.a.shifen.com/
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFE/uXQ4cLc0QEGNMJMGmf8=
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV+c/AZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEBWsfo6gTWKBdqI6VatS5Uo=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV+c/AZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CECQ1SvQ/t8C2OzukI4M8ERw=
hxxp://cdn.globalsigncdn.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDEVLD4SzDqtMG/eBnw==
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDvBRp0Gh2UCfyl5GQPjTyb
hxxp://ocsp-services.uzto.netdna-cdn.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSD6ko+A2xkatUMVJtLDHYP3ZqccAQUoRNU3FZzLCeCysiE7+6/AP1fq1YCEA2p36mqGmxaqpMIxrUTcxI=
hxxp://crl.uzto.netdna-cdn.com/wosign-ovca.crl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://www.baidu.com/	115.239.211.112
hxxp://ss.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV+c/AZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEBWsfo6gTWKBdqI6VatS5Uo=	23.52.27.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	172.217.20.174
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY	172.217.20.174
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso	23.111.11.211
hxxp://www.126.com/	176.34.63.150
hxxp://www.sina.com.cn/	87.118.248.106
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.52.27.27
hxxp://www.163.com/	203.130.61.92
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	62.140.236.171
hxxp://www.aliyun.com/	47.88.128.162
hxxp://wosign.crl.certum.pl/wosign-ovca.crl	23.111.11.210
hxxp://www.taobao.com/	213.244.178.246
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH	104.16.26.216
hxxp://www.qq.com/	2.21.89.27
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFE/uXQ4cLc0QEGNMJMGmf8=	23.52.27.27
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDvBRp0Gh2UCfyl5GQPjTyb	23.111.11.211
hxxp://ss.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV+c/AZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CECQ1SvQ/t8C2OzukI4M8ERw=	23.52.27.27
hxxp://wosign-ovca.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSD6ko+A2xkatUMVJtLDHYP3ZqccAQUoRNU3FZzLCeCysiE7+6/AP1fq1YCEA2p36mqGmxaqpMIxrUTcxI=	23.111.11.211
hxxp://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDEVLD4SzDqtMG/eBnw==	104.16.26.216
www.jd.com	192.229.133.187
intl.aliyun.com	47.88.128.161
www.sogou.com	106.38.241.37
world.taobao.com	213.244.178.246
www.wdcrf.net	120.76.76.66

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>That...s an error.</ins>. <p>The requested URL <code>/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon</code> was not found on this server. <ins>That...s all we know.</ins>.

..

-background-size:100% 100%}}#logo{display:inline-block;height:54px;wid
th:150px}.  .  id=logo aria-label=Google>.  gt;404. That...s an error..  
;The requested URL /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4
Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY&
lt;/code> was not found on this server.  That...s all we
 know..

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDvBRp0Gh2UCfyl5GQPjTyb HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: subca.ocsp-certum.com

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:33:00 GMT

Content-Type: application/ocsp-response

Content-Length: 1702

Connection: keep-alive

Content-transfer-encoding: binary

X-Cached: MISS

Server: NetDNA-cache/2.2

X-Cache: HIT

0..........0..... .....0......0...0..@........0..1.0...U....PL1!0...U....Asseco Data Systems S.A.1'0%..U....Certum Certification Authority1503..U...,Certum Trusted Network CA Validation Service..20170323062522Z0r0p0H0... .......:L..!..O'...Q.)..&....v....$.........7Fu.......t.......d..<.....20170323062522Z....20170330062522Z..0.0... .....0....0... .....0..0...*.H..............F.....Q\C...:....(.&........02\..$.......-..u.....l...n...~ZB.f.....$..b.......2?i...~....E.w...P=.q.Q.1.-L.........7..@..V&i.&.OW.......}K#...*Ec.....f.O.-..I.i.....4.H..N..\.B........yr.K.hWM.):M.\0.w/.....m8j.K.35LY.._..k.....c{L@O...)Pf. 6... .I.......*0..&0.."0................]Nss1.B.../0...*.H........0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Trusted Network CA0...161220102317Z..180120102317Z0..1.0...U....PL1!0...U....Asseco Data Systems S.A.1'0%..U....Certum Certification Authority1503..U...,Certum Trusted Network CA Validation Service0.."0...*.H.............0..........AB...I....z..#U......oD.L.....UX....j.....S.K......".>w.;.r8....C...Zc...U.}%.....@Ff..`.&.j.`.......ci.Io........pW...........#.s............tR@...N.......L....U..t.>su...OyH.E...v...r.]."m..7.... ....@.....>.X......M.P@......./.......k...O....@v7.d............0..0...U.......0.0...U..........Lw..l..n..n...~.0...U.#..0....v....$.........7Fu.0...U...........0...U.%..0... .......0... .....0......0...*.H...............).n......,........].).I...t-.......J.........^...M...(...D:..'..l.#6Co......

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: squid/3.5.20

Content-Type: text/html; charset=GB2312

Cache-Control: max-age=59

Expires: Thu, 23 Mar 2017 06:33:42 GMT

Date: Thu, 23 Mar 2017 06:32:43 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Connection: Transfer-Encoding

0000C000..<!DOCTYPE html>.<html lang="zh-CN">.<head>.<meta content="text/html; charset=gb2312" http-equiv="Content-Type">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<title>........</title>.<script type="text/javascript">.if(window.location.toString().indexOf('pref=padindex') != -1){.}else{..if(/AppleWebKit.*Mobile/i.test(navigator.userAgent) || (/MIDP|SymbianOS|NOKIA|SAMSUNG|LG|NEC|TCL|Alcatel|BIRD|DBTEL|Dopod|PHILIPS|HAIER|LENOVO|MOT-|Nokia|SonyEricsson|SIE-|Amoi|ZTE/.test(navigator.userAgent))){ . if(window.location.href.indexOf("?mobile")<0){...try{....if(/Android|Windows Phone|webOS|iPhone|iPod|BlackBerry/i.test(navigator.userAgent)){.....window.location.href="hXXp://xw.qq.com/index.htm";....}else if(/iPad/i.test(navigator.userAgent)){. //window.location.href="hXXp://VVV.qq.com/pad/"....}else{.....window.location.href="hXXp://xw.qq.com/simple/s/index/"....}...}catch(e){}..}..}.}.</script>.<script type="text/javascript">var QosSS=new Object();QosSS.t=new Array([0,0,0]);QosSS.t[0]=(new Date()).getTime();</script>.<meta name="apple-itunes-app" content="app-id=660653351">.<meta content="....,....,....,....,....,NBA,....,......,....,QQ,Tencent" name="Keywords">.<meta name="description" content="......(VVV.QQ.com)...............................................................................................................................................................................................

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.aliyun.com

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Server: Tengine

Date: Thu, 23 Mar 2017 06:33:27 GMT

Content-Type: text/html

Content-Length: 278

Connection: keep-alive

Location: hXXps://intl.aliyun.com/

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<h1>301 Moved Permanently</h1>..<p>The requested resource has been assigned a new permanent URI.</p>..<hr/>Powered by Tengine</body>..</html>....

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.taobao.com

Cache-Control: no-cache

HTTP/1.1 302 Found

Server: Tengine

Date: Thu, 23 Mar 2017 06:32:43 GMT

Content-Type: text/html

Content-Length: 258

Connection: keep-alive

Location: hXXps://VVV.taobao.com/

Set-Cookie: thw=ua; Path=/; Domain=.taobao.com; Expires=Fri, 23-Mar-18 06:32:43 GMT;

Strict-Transport-Security: max-age=31536000

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head><title>302 Found</title></head>..<body bgcolor="white">..<h1>302 Found</h1>..<p>The requested resource resides temporarily under a different URI.</p>..<hr/>Powered by Tengine</body>..</html>..HTTP/1.1 302 Found..Server: Tengine..Date: Thu, 23 Mar 2017 06:32:43 GMT..Content-Type: text/html..Content-Length: 258..Connection: keep-alive..Location: hXXps://VVV.taobao.com/..Set-Cookie: thw=ua; Path=/; Domain=.taobao.com; Expires=Fri, 23-Mar-18 06:32:43 GMT;..Strict-Transport-Security: max-age=31536000..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head><title>302 Found</title></head>..<body bgcolor="white">..<h1>302 Found</h1>..<p>The requested resource resides temporarily under a different URI.</p>..<hr/>Powered by Tengine</body>..</html>....

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.126.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 23 Mar 2017 06:33:45 GMT

Content-Type: text/html

Content-Length: 97571

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 09 Mar 2017 06:51:57 GMT

Vary: Accept-Encoding

Expires: Thu, 23 Mar 2017 06:42:07 GMT

Cache-Control: max-age=3600

X-Cache: HIT from HKGM

Accept-Ranges: bytes

X-Cache: from ntes_hw

<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<link rel="dns-prefetch" href="hXXp://mimg.127.net">..<link rel="dns-prefetch" href="hXXps://mail.126.com">..<link rel="dns-prefetch" href="hXXp://iplocator.mail.163.com">..<meta name="description" content="......126............--...........................14........................................................................98%..........................................3G...............................................................">..<meta name="keywords" content="...............................................................126........................mail...email.........">..<title>126...............--........................</title>..<link rel="shortcut icon" href="hXXp://VVV.126.com/favicon.ico" />..<style type="text/css">../* css reset */..body{color:#000;background:#fff;font-size:12px;line-height:166.6%;text-align:center;}..body.move{-webkit-transition:padding 0.3s ease;-moz-transition:padding 0.3s ease;-o-transition:padding 0.3s ease;-ms-transition:padding 0.3s ease;transition:padding 0.3s ease;}..body,input,select,button{font-family:verdana}..h1,h2,h3,select,input,button{font-size:100%}..body,h1,h2,h3,ul,li,form,p,img{margin:0;padding:0;border:0}..input,button,select,img{margin:0;line-height:normal}..select{padding:1px}..ul{list-style:none}..select,input,button,button img,label{vertical-align:middle}..header,footer,section,aside,nav,hgroup,figure,figcaption{disp

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.sina.com.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:33:13 GMT

Server: PWS/8.2.0.7

X-Px: ht h0-s2004.p0-mow.cdngp.net

Cache-Control: max-age=60

Expires: Thu, 23 Mar 2017 06:33:17 GMT

Age: 56

Accept-Ranges: bytes

Content-Length: 601537

Content-Type: text/html

Last-Modified: Thu, 23 Mar 2017 06:31:20 GMT

X-Via-CDN: f=TXCDN,s=87.118.248.106,c=194.242.96.218

Connection: keep-alive

<!DOCTYPE html>..<html>.<head>. <meta http-equiv="Content-type" content="text/html; charset=utf-8" />. <meta http-equiv="X-UA-Compatible" content="IE=edge" />. <title>............</title>..<meta name="keywords" content="......,.........,SINA,sina,sina.com.cn,............,......,......" />..<meta name="description" content="........................24........................................................................................................................................................................................................................30......................................................................................." />. <link rel="mask-icon" sizes="any" href="hXXp://VVV.sina.com.cn/favicon.svg" color="red">..<meta name="stencil" content="PGLS000022" />..<meta name="publishid" content="30,131,1" />..<meta name="verify-v1" content="6HtwmypggdgP1NLw7NOuQBI2TW8 CfkYCoyeB8IDbn8=" />..<meta name="360-site-verification" content="63349a2167ca11f4b9bd9a8d48354541" />..<meta name="application-name" content="............"/>..<meta name ="msapplication-TileImage" content="hXXp://i1.sinaimg.cn/dy/deco/2013/0312/logo.png"/>..<meta name="msapplication-TileColor" content="#ffbf27"/>..<meta name="sogou_site_verification" content="Otg5irx9wL"/>.<link rel="apple-touch-icon" href="hXXp://i3.sinaimg.cn/home/2013/0331/U586P30DT2

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Cache-Control: max-age = 440358

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1454

content-transfer-encoding: binary

Cache-Control: max-age=354606, public, no-transform, must-revalidate

Last-Modified: Mon, 20 Mar 2017 08:59:30 GMT

Expires: Mon, 27 Mar 2017 08:59:30 GMT

Date: Thu, 23 Mar 2017 06:33:40 GMT

Connection: keep-alive

0..........0..... .....0......0...0........FC..&..<.0...Y......20170320085930Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20170320085930Z....20170327085930Z0...*.H..................i..b....."D.X.I...z.@y8.Xd..k..D.......=.........!...>u.rzK...Tc...d.[..p........r').[.....`o.....a=.x.`!wRY..t....~%....oC..7..:u.'..& ?..a=.^D....A.LR...w...m.....y\Mmv;.P.BC..Q.u>X.y...e1m,mN.....!....6..4t@...Qw$.<..r....8.Go7...4..z.2..C....5n.N.....0...0...0..4.......My_e.\....'....j0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...161122000000Z..171214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 50.."0...*.H.............0.............4..IP.....B..h.....]..).]w.!"..a..{...="....._...~.s1.E.......;...6&/...\2..A....\..T aH:.8lH^.....l.v.$...K=sZf.*.|.%.Pb.......B..*f.T\w.:.s.... ....9..4..cV...3.qc.c..j<.f.....>1X.I...P%?.........5R-....Ca14..X.U....u.....:.z.\.k..b.E.v..,.J................0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-OFF-470...*.H.............G..\..R.P..e]...N.....m.....4f......b4"8v..b.R....`.Auz..........2=...@..........5..cWh....J......r...g.h......Kw'...j.@...x.....

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.jingdong.com

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Content-length: 0

Location: hXXps://VVV.jd.com/

Connection: close

GET /wosign-ovca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: wosign.crl.certum.pl

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:33:10 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 3201

Connection: keep-alive

Last-Modified: Wed, 22 Mar 2017 18:07:06 GMT

ETag: "30032-c81-a0d26680"

X-Cached: EXPIRED

Server: NetDNA-cache/2.2

X-Cache: HIT

Accept-Ranges: bytes

0..}0..e...0...*.H........0D1.0...U....CN1.0...U....WoSign CA Limited1.0...U....WoSign OV SSL CA..170322180026Z..170401180026Z0...0/..ya.f.l...m........161224014614Z0.0...U.......0/..bR...%......7[w...170105073046Z0.0...U.......0/....,..:f...\...t...170117011138Z0.0...U.......0/..w....7z<.....J....170317005634Z0.0...U.......0/..K..Z.L.B@&.#.}....170105072721Z0.0...U.......0/.....y..W.G...e.D...170222023235Z0.0...U.......0/..lK...-.n....u.....170222012928Z0.0...U.......0/..6.....h..uSc..^...161221082119Z0.0...U.......0/..w'..0.E..y.p..a...170306015736Z0.0...U.......0/..D.WH1q..\v.!......161220033538Z0.0...U.......0/..t......B.q.9......170103024430Z0.0...U.......0/..(........k.f..rq..161125025741Z0.0...U.......0/..[..V..(...d..VdA..170214004827Z0.0...U.......0/........... 1.'..P..161209070108Z0.0...U.......0/...g2.B.B.K.....T1..161223074327Z0.0...U.......0/...m$s...B..Y..n.-..170216093834Z0.0...U.......0/..eBo.... .@../W.v..170105011959Z0.0...U.......0/..!..fN'....~L..f4..161207071134Z0.0...U.......0/..y.$.....7.Ne $ze..161222054457Z0.0...U.......0/..;G..Ig.AgB.C51....170110062948Z0.0...U.......0/..-.....v.?.S.0.1...170117023011Z0.0...U.......0/..t.U_..8$.j.3...=..161209061340Z0.0...U.......0/..".B.n...6..W...z..161222022305Z0.0...U.......0/...F.f......b.].....170106070454Z0.0...U.......0/..VJ...I..[.'."..L..170316063753Z0.0...U.......0/..Q........R..B.....161223064520Z0.0...U.......0/....!..?3.F...|.i...161209025712Z0.0...U.......0/..y.......e...Om.@..161125093626Z0.0...U.......0/..r...!,..$n#{.6.}..161221081

<<< skipped >>>

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT

If-None-Match: "8071417b63bece1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 02 Dec 2015 18:30:06 GMT

Accept-Ranges: bytes

ETag: "0cb60772f2dd11:0"

Server: Microsoft-IIS/8.5

VTag: 279498805900000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 530

Cache-Control: max-age=900

Date: Thu, 23 Mar 2017 06:33:46 GMT

Connection: keep-alive

0...0.....0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows Verification PCA..151202080000Z..430418080000Z.A0?0...U.#..0.......p............<.J0... .....7.......0...U......90...*.H..............I...MYp.....yh..$3..F.D....Qe]....~...>.Ye.h...L.nQ..091.=.G..s.D.........g)...4.'........B....l#....c...e..U......Z .[.,.x..h:M~..mS./p..F......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w.......o.*......C)....U..3Mt.}......X......H.....|d...s..`.8F.l.......R.C....HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 02 Dec 2015 18:30:06 GMT..Accept-Ranges: bytes..ETag: "0cb60772f2dd11:0"..Server: Microsoft-IIS/8.5..VTag: 279498805900000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 530..Cache-Control: max-age=900..Date: Thu, 23 Mar 2017 06:33:46 GMT..Connection: keep-alive..0...0.....0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows Verification PCA..151202080000Z..430418080000Z.A0?0...U.#..0.......p............<.J0... .....7.......0...U......90...*.H..............I...MYp.....yh..$3..F.D....Qe]....~...>.Ye.h...L.nQ..091.=.G..s.D.........g)...4.'........B....l#....c...e..U......Z .[.,.x..h:M~..mS./p..F......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w.......o.*......C)....U..3Mt.}......X......H.....|d...s..`.8F.l.......R.C......

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSD6ko+A2xkatUMVJtLDHYP3ZqccAQUoRNU3FZzLCeCysiE7+6/AP1fq1YCEA2p36mqGmxaqpMIxrUTcxI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: wosign-ovca.ocsp-certum.com

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:33:08 GMT

Content-Type: application/ocsp-response

Content-Length: 1539

Connection: keep-alive

Content-transfer-encoding: binary

X-Cached: HIT

Server: NetDNA-cache/2.2

X-Cache: HIT

0..........0..... .....0......0...0.........`0^1.0...U....PL1!0...U....Asseco Data Systems S.A.1,0*..U...#WoSign OV SSL CA Validation Service..20170323063006Z0q0o0G0... ........J>.ldj..T.K.v....p....T.Vs,'........._.V........lZ......s.....20170323063006Z....20170330063006Z..0.0... .....0....0... .....0..0...*.H...........'j.hi!.H..&=.Z../......h$=...s..)GN....L.a.Y....4|.UB.a.9y6..t..p..w.6... ...'U..&...D..C}.....y.m...@..(.PO....".b.?.....X...;.Y7.......M..U..n.&....;.....%"t.b.....~.j.....p..z..{.yUQ...r...S..P..._......q. .^....<. Y.8'...'.dn.A..:.I?Y.w.D....6*X.F..~......0...0...0..........H....'9!......^.0...*.H........0D1.0...U....CN1.0...U....WoSign CA Limited1.0...U....WoSign OV SSL CA0...170104115010Z..170404115010Z0^1.0...U....PL1!0...U....Asseco Data Systems S.A.1,0*..U...#WoSign OV SSL CA Validation Service0.."0...*.H.............0..........:B!cV....&......3..' ..,.....D...G/o4.J.5.8.1>.^0..8[wXP)j..b...P......$iQ.s.4.z..........].n..bP2.....7......Z_& .....S.*.o..........YI......?..e..G...g.4E....@:.S.O........Q....zf.K..p_...qS..H..........."H..e.y..Ge.p.......-...F...=.o..%i.{.a........E........0..0...U.......0.0...U.#..0.....T.Vs,'........._.V0...U......`..f8..6..m..y......0...U...........0...U.%..0... .......0... .....0......0...*.H.............8.!.}G{...4...2........gH.dF..q.......loZ.[.k..0......aN.x..a%.....p*.X. .....aU..Of@]/.#....mx...9..v....>.{.H..?X..zu... 5S..Z.i.B..c...,..U.....z0..r.......g.T.....'...CIa.Y...T.......r..c....~........UTD..iC....(.\....!..E..q.a.........P

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.126.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 23 Mar 2017 06:33:15 GMT

Content-Type: text/html

Content-Length: 97571

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 09 Mar 2017 06:51:57 GMT

Vary: Accept-Encoding

Expires: Thu, 23 Mar 2017 06:42:07 GMT

Cache-Control: max-age=3600

X-Cache: HIT from HKGM

Accept-Ranges: bytes

X-Cache: from ntes_hw

<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<link rel="dns-prefetch" href="hXXp://mimg.127.net">..<link rel="dns-prefetch" href="hXXps://mail.126.com">..<link rel="dns-prefetch" href="hXXp://iplocator.mail.163.com">..<meta name="description" content="......126............--...........................14........................................................................98%..........................................3G...............................................................">..<meta name="keywords" content="...............................................................126........................mail...email.........">..<title>126...............--........................</title>..<link rel="shortcut icon" href="hXXp://VVV.126.com/favicon.ico" />..<style type="text/css">../* css reset */..body{color:#000;background:#fff;font-size:12px;line-height:166.6%;text-align:center;}..body.move{-webkit-transition:padding 0.3s ease;-moz-transition:padding 0.3s ease;-o-transition:padding 0.3s ease;-ms-transition:padding 0.3s ease;transition:padding 0.3s ease;}..body,input,select,button{font-family:verdana}..h1,h2,h3,select,input,button{font-size:100%}..body,h1,h2,h3,ul,li,form,p,img{margin:0;padding:0;border:0}..input,button,select,img{margin:0;line-height:normal}..select{padding:1px}..ul{list-style:none}..select,input,button,button img,label{vertical-align:middle}..header,footer,section,aside,nav,hgroup,figure,figcaption{disp

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.baidu.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:32:45 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Set-Cookie: BAIDUID=1FE0E7E4BC8E601C299EA5EE14A6305E:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BIDUPSID=1FE0E7E4BC8E601C299EA5EE14A6305E; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: PSTM=1490250765; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=1430_21108_17001_20928; path=/; domain=.baidu.com

P3P: CP=" OTI DSP COR IVA OUR IND COM "

Cache-Control: private

Cxy_all: baidu c8e00989edf39554a0508b60b12bc5b0

Expires: Thu, 23 Mar 2017 06:32:19 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0xd0ec947b000102a5

BDUSERID: 0

18f39..<!DOCTYPE html>................................................................................................ ..... ........ ........ ........ ..... ..... ..... ........ ........ ........ ..... ..........................<html>.<head>. . <meta http-equiv="content-type" content="text/html;charset=utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=Edge">..<meta content="always" name="referrer">. <meta name="theme-color" content="#2932e1">. <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />. <link rel="search" type="application/opensearchdescription xml" href="/content-search.xml" title="............" /> . <link rel="icon" sizes="any" mask href="//VVV.baidu.com/img/baidu.svg">......<link rel="dns-prefetch" href="//s1.bdstatic.com"/>..<link rel="dns-prefetch" href="//t1.baidu.com"/>..<link rel="dns-prefetch" href="//t2.baidu.com"/>..<link rel="dns-prefetch" href="//t3.baidu.com"/>..<link rel="dns-prefetch" href="//t10.baidu.com"/>..<link rel="dns-prefetch" href="//t11.baidu.com"/>..<link rel="dns-prefetch" href="//t12.baidu.com"/>..<link rel="dns-prefetch" href="//b1.bdstatic.com"/>. . <title>...........................</title>. ..<style id="css_index" index="index" type="text/css">html,body{height:100%}.html{overflow-y:auto}.body{font

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFE/uXQ4cLc0QEGNMJMGmf8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: s2.symcb.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1763

content-transfer-encoding: binary

Cache-Control: max-age=409215, public, no-transform, must-revalidate

Last-Modified: Tue, 21 Mar 2017 00:09:19 GMT

Expires: Tue, 28 Mar 2017 00:09:19 GMT

Date: Thu, 23 Mar 2017 06:32:50 GMT

Connection: keep-alive

0..........0..... .....0......0...0.......WI.....L.c=...r..7Z..20170321000919Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..Q?.t8p.4@A.0........20170321000919Z....20170328000919Z0...*.H...............6..MW..f.x.....G.&5.g...A.......5uP......)...ME6.L..r5.r'....|m/.~....(..g$......52..x.l....%/....hcE.D..,f..R.DX.me.D..;.r.i^.....&I.F..F...b8.:i3s.........}.....6r..R}...(O.`.....:v~..v.*6....k~.^,R.[U..c.a ......T;.0..Q..k..\W.?\..../.DAl}.`~lU...}.......0...0...0..........^..)......<...T.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...161122000000Z..171214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 50.."0...*.H.............0.............................m..|........1rUZN.b.......t. d......O...NY.lR..k .Q.z.g.4(,...Rp.7...0C.j.)Z........ ~..3...x.b.-..... S^0<6...!.(..2}...T.fX}...6...(...1...#..H..|`.yy.<B.z.q$......u.-..K.!......y..8..--....?.,.[.[...5.e.4.....D..t.;....).J....\fV..G.........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://www.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0"..U....0...0.1.0...U....TGV-OFF-500...U.......WI.....L.c=...r..7Z0...U.#..0.....e......0..C9...3130...*.H.............<wN..g...S.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFE/uXQ4cLc0QEGNMJMGmf8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: s2.symcb.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1763

content-transfer-encoding: binary

Cache-Control: max-age=409215, public, no-transform, must-revalidate

Last-Modified: Tue, 21 Mar 2017 00:09:19 GMT

Expires: Tue, 28 Mar 2017 00:09:19 GMT

Date: Thu, 23 Mar 2017 06:32:50 GMT

Connection: keep-alive

0..........0..... .....0......0...0.......WI.....L.c=...r..7Z..20170321000919Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..Q?.t8p.4@A.0........20170321000919Z....20170328000919Z0...*.H...............6..MW..f.x.....G.&5.g...A.......5uP......)...ME6.L..r5.r'....|m/.~....(..g$......52..x.l....%/....hcE.D..,f..R.DX.me.D..;.r.i^.....&I.F..F...b8.:i3s.........}.....6r..R}...(O.`.....:v~..v.*6....k~.^,R.[U..c.a ......T;.0..Q..k..\W.?\..../.DAl}.`~lU...}.......0...0...0..........^..)......<...T.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...161122000000Z..171214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 50.."0...*.H.............0.............................m..|........1rUZN.b.......t. d......O...NY.lR..k .Q.z.g.4(,...Rp.7...0C.j.)Z........ ~..3...x.b.-..... S^0<6...!.(..2}...T.fX}...6...(...1...#..H..|`.yy.<B.z.q$......u.-..K.!......y..8..--....?.,.[.[...5.e.4.....D..t.;....).J....\fV..G.........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://www.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0"..U....0...0.1.0...U....TGV-OFF-500...U.......WI.....L.c=...r..7Z0...U.#..0.....e......0..C9...3130...*.H.............<wN..g...S.

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.360.cn

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Server: nginx/1.2.9

Date: Thu, 23 Mar 2017 06:32:44 GMT

Content-Type: text/html

Content-Length: 184

Connection: keep-alive

Location: hXXps://VVV.360.cn

<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.2.9</center>..</body>..</html>....

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.sina.com.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:33:44 GMT

Server: PWS/8.2.0.7

X-Px: ht h0-s2004.p0-mow.cdngp.net

Cache-Control: max-age=60

Expires: Thu, 23 Mar 2017 06:34:17 GMT

Age: 27

Accept-Ranges: bytes

Content-Length: 601537

Content-Type: text/html

Last-Modified: Thu, 23 Mar 2017 06:31:20 GMT

X-Via-CDN: f=TXCDN,s=87.118.248.106,c=194.242.96.218

Connection: keep-alive

<!DOCTYPE html>..<html>.<head>. <meta http-equiv="Content-type" content="text/html; charset=utf-8" />. <meta http-equiv="X-UA-Compatible" content="IE=edge" />. <title>............</title>..<meta name="keywords" content="......,.........,SINA,sina,sina.com.cn,............,......,......" />..<meta name="description" content="........................24........................................................................................................................................................................................................................30......................................................................................." />. <link rel="mask-icon" sizes="any" href="hXXp://VVV.sina.com.cn/favicon.svg" color="red">..<meta name="stencil" content="PGLS000022" />..<meta name="publishid" content="30,131,1" />..<meta name="verify-v1" content="6HtwmypggdgP1NLw7NOuQBI2TW8 CfkYCoyeB8IDbn8=" />..<meta name="360-site-verification" content="63349a2167ca11f4b9bd9a8d48354541" />..<meta name="application-name" content="............"/>..<meta name ="msapplication-TileImage" content="hXXp://i1.sinaimg.cn/dy/deco/2013/0312/logo.png"/>..<meta name="msapplication-TileColor" content="#ffbf27"/>..<meta name="sogou_site_verification" content="Otg5irx9wL"/>.<link rel="apple-touch-icon" href="hXXp://i3.sinaimg.cn/home/2013/0331/U586P30DT2

<<< skipped >>>

GET /gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDEVLD4SzDqtMG/eBnw== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:32:58 GMT

Content-Type: application/ocsp-response

Content-Length: 1570

Connection: keep-alive

Set-Cookie: __cfduid=d49fc2a38117f47ba398cc4839209165c1490250778; expires=Fri, 23-Mar-18 06:32:58 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Thu, 23 Mar 2017 03:29:27 GMT

Expires: Mon, 27 Mar 2017 03:29:27 GMT

ETag: "8884992b1de4c69d057ebd82700de9fc67bd5c87"

Cache-Control: public, no-transform, must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 343f5b4641a14f4a-DME

0..........0..... .....0......0...0.......M........u....%...G..20170323032927Z0o0m0E0... ..........M.=......r......{.....a....)S...};..@..|..EK.....L........20170323032927Z....20170327032927Z0...*.H.............0.-J.^s ....Q....A.A..A.].O....e. N.%b!"_)...wK...Z...0.`./.b7..>.e.#..(..n.._......W.0.9...E...|..D..3.m...iU..F......"L.h2cp.....1...3.......)..5.}....c.d....O..5.(.....z.UyZyB..../^..:C ...T.......gsp. :......k..().....Z~.(..*....&..OA.=o...........3......K0..G0..C0.. .......o.8...C.P=;E0...*.H........0f1.0...U....BE1.0...U....GlobalSign nv-sa1<0:..U...3GlobalSign Organization Validation CA - SHA256 - G20...170213071103Z..170516071103Z0..1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....2017021315051M0K..U...DGlobalSign Organization Validation CA - SHA256 - G2 - OCSP Responder0.."0...*.H.............0.........C..0j..R........0.".e.&.6'.d..._.....8...Y..../..z..-hi.k.......D.........u..>h....T2..~..*;...v.^.!d.......8.p.e..me...>..V...l...P.6.V..G..;X.......12U.)D.E(ldQ...67..@......l...A.>l......m..e;.....n.~..Wb.?..gE.......a.KM.F...}.qo;S...`/..s....6....G.a........0..0...U.......M........u....%...G0...U.#..0.....a....)S...};..@..|0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...U...........0...U.%..0... .......0...*.H..............=.. {.o...../...;[...!.._..3.......i{.."...I1....... w\...&..%....2...4.....f....S.. Zz...q..{o. .e1[...X.2..F6$....'...[.s@..Y...".2b....~...........E..U_..Y[....b.G'}..^-.....:.mo......=........)x..k....N

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.baidu.com

Cache-Control: no-cache

Cookie: BAIDUID=1FE0E7E4BC8E601C299EA5EE14A6305E:FG=1; BIDUPSID=1FE0E7E4BC8E601C299EA5EE14A6305E; PSTM=1490250765; H_PS_PSSID=1430_21108_17001_20928; BDSVRTM=0; BD_HOME=0

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:33:15 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: Keep-Alive

Vary: Accept-Encoding

Cache-Control: private

Cxy_all: baidu dda8f4b3a5e3bbe4dec65d42ded924a4

Expires: Thu, 23 Mar 2017 06:33:03 GMT

X-Powered-By: HPHP

Server: BWS/1.1

X-UA-Compatible: IE=Edge,chrome=1

BDPAGETYPE: 1

BDQID: 0xeaffe3270000f7ed

BDUSERID: 0

Set-Cookie: BDSVRTM=0; path=/

Set-Cookie: BD_HOME=0; path=/

Set-Cookie: H_PS_PSSID=1430_21108_17001_20928; path=/; domain=.baidu.com

18eee..<!DOCTYPE html>................................................................................................ ..... ........ ........ ........ ..... ..... ..... ........ ........ ........ ..... ..........................<html>.<head>. . <meta http-equiv="content-type" content="text/html;charset=utf-8">. <meta http-equiv="X-UA-Compatible" content="IE=Edge">..<meta content="always" name="referrer">. <meta name="theme-color" content="#2932e1">. <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon" />. <link rel="search" type="application/opensearchdescription xml" href="/content-search.xml" title="............" /> . <link rel="icon" sizes="any" mask href="//VVV.baidu.com/img/baidu.svg">......<link rel="dns-prefetch" href="//s1.bdstatic.com"/>..<link rel="dns-prefetch" href="//t1.baidu.com"/>..<link rel="dns-prefetch" href="//t2.baidu.com"/>..<link rel="dns-prefetch" href="//t3.baidu.com"/>..<link rel="dns-prefetch" href="//t10.baidu.com"/>..<link rel="dns-prefetch" href="//t11.baidu.com"/>..<link rel="dns-prefetch" href="//t12.baidu.com"/>..<link rel="dns-prefetch" href="//b1.bdstatic.com"/>. . <title>...........................</title>. ..<style id="css_index" index="index" type="text/css">html,body{height:100%}.html{overflow-y:auto}.body{font

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.360.cn

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Server: nginx/1.2.9

Date: Thu, 23 Mar 2017 06:33:07 GMT

Content-Type: text/html

Content-Length: 184

Connection: keep-alive

Location: hXXps://VVV.360.cn

<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.2.9</center>..</body>..</html>....

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.126.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx

Date: Thu, 23 Mar 2017 06:32:44 GMT

Content-Type: text/html

Content-Length: 97571

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 09 Mar 2017 06:51:57 GMT

Vary: Accept-Encoding

Expires: Thu, 23 Mar 2017 06:42:07 GMT

Cache-Control: max-age=3600

X-Cache: HIT from HKGM

Accept-Ranges: bytes

X-Cache: from ntes_hw

<!DOCTYPE html>..<html>..<head>..<meta charset="utf-8" />..<link rel="dns-prefetch" href="hXXp://mimg.127.net">..<link rel="dns-prefetch" href="hXXps://mail.126.com">..<link rel="dns-prefetch" href="hXXp://iplocator.mail.163.com">..<meta name="description" content="......126............--...........................14........................................................................98%..........................................3G...............................................................">..<meta name="keywords" content="...............................................................126........................mail...email.........">..<title>126...............--........................</title>..<link rel="shortcut icon" href="hXXp://VVV.126.com/favicon.ico" />..<style type="text/css">../* css reset */..body{color:#000;background:#fff;font-size:12px;line-height:166.6%;text-align:center;}..body.move{-webkit-transition:padding 0.3s ease;-moz-transition:padding 0.3s ease;-o-transition:padding 0.3s ease;-ms-transition:padding 0.3s ease;transition:padding 0.3s ease;}..body,input,select,button{font-family:verdana}..h1,h2,h3,select,input,button{font-size:100%}..body,h1,h2,h3,ul,li,form,p,img{margin:0;padding:0;border:0}..input,button,select,img{margin:0;line-height:normal}..select{padding:1px}..ul{list-style:none}..select,input,button,button img,label{vertical-align:middle}..header,footer,section,aside,nav,hgroup,figure,figcaption{disp

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.qq.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: squid/3.5.20

Content-Type: text/html; charset=GB2312

Cache-Control: max-age=60

Expires: Thu, 23 Mar 2017 06:34:19 GMT

Date: Thu, 23 Mar 2017 06:33:19 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Connection: Transfer-Encoding

0000C000..<!DOCTYPE html>.<html lang="zh-CN">.<head>.<meta content="text/html; charset=gb2312" http-equiv="Content-Type">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<title>........</title>.<script type="text/javascript">.if(window.location.toString().indexOf('pref=padindex') != -1){.}else{..if(/AppleWebKit.*Mobile/i.test(navigator.userAgent) || (/MIDP|SymbianOS|NOKIA|SAMSUNG|LG|NEC|TCL|Alcatel|BIRD|DBTEL|Dopod|PHILIPS|HAIER|LENOVO|MOT-|Nokia|SonyEricsson|SIE-|Amoi|ZTE/.test(navigator.userAgent))){ . if(window.location.href.indexOf("?mobile")<0){...try{....if(/Android|Windows Phone|webOS|iPhone|iPod|BlackBerry/i.test(navigator.userAgent)){.....window.location.href="hXXp://xw.qq.com/index.htm";....}else if(/iPad/i.test(navigator.userAgent)){. //window.location.href="hXXp://VVV.qq.com/pad/"....}else{.....window.location.href="hXXp://xw.qq.com/simple/s/index/"....}...}catch(e){}..}..}.}.</script>.<script type="text/javascript">var QosSS=new Object();QosSS.t=new Array([0,0,0]);QosSS.t[0]=(new Date()).getTime();</script>.<meta name="apple-itunes-app" content="app-id=660653351">.<meta content="....,....,....,....,....,NBA,....,......,....,QQ,Tencent" name="Keywords">.<meta name="description" content="......(VVV.QQ.com)...............................................................................................................................................................................................

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.163.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Expires: Thu, 23 Mar 2017 06:34:03 GMT

Date: Thu, 23 Mar 2017 06:32:43 GMT

Server: nginx

Content-Type: text/html; charset=GBK

Transfer-Encoding: chunked

Vary: Accept-Encoding,User-Agent,Accept

Cache-Control: max-age=80

X-Via: 1.1 czdx87:4 (Cdn Cache Server V2.0), 1.1 kf49:4 (Cdn Cache Server V2.0)

Connection: keep-alive

8000.. <!DOCTYPE HTML>..... <html phone="1" id="ne_wrap"> .<head>.<meta http-equiv="Content-Type" content="text/html; charset=gbk">.<meta name="model_url" content="hXXp://VVV.163.com/special/0077rt/index.html" />.<title>....</title>.<base target="_blank" />.<meta name="Keywords" content="....,....,....,....,....,....,....,....,....,....,....,....,....,....,....,...." />.<meta name="Description" content="..............................................................................................30.........................................................." />.<meta name="robots" content="index, follow" />.<meta name="googlebot" content="index, follow" />.<script type="text/javascript">.(function() {. if(/s=noRedirect/i.test(location.search)) return; . if(/AppleWebKit.*Mobile/i.test(navigator.userAgent) || (/MIDP|SymbianOS|NOKIA|SAMSUNG|LG|NEC|TCL|Alcatel|BIRD|DBTEL|Dopod|PHILIPS|HAIER|LENOVO|MOT-|Nokia|SonyEricsson|SIE-|Amoi|ZTE/.test(navigator.userAgent))) {. try {. if(/Andr

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.jingdong.com

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Content-length: 0

Location: hXXps://VVV.jd.com/

Connection: close

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.sina.com.cn

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:32:43 GMT

Server: PWS/8.2.0.7

X-Px: rf-ms h0-s2004.p0-mow ( h0-s2001.p0-mow), ht h0-s2001.p0-mow.cdngp.net

Cache-Control: max-age=60

Expires: Thu, 23 Mar 2017 06:33:17 GMT

Age: 26

Accept-Ranges: bytes

Content-Length: 601537

Content-Type: text/html

Last-Modified: Thu, 23 Mar 2017 06:31:20 GMT

X-Via-CDN: f=TXCDN,s=87.118.248.106,c=194.242.96.218

Connection: keep-alive

<!DOCTYPE html>..<html>.<head>. <meta http-equiv="Content-type" content="text/html; charset=utf-8" />. <meta http-equiv="X-UA-Compatible" content="IE=edge" />. <title>............</title>..<meta name="keywords" content="......,.........,SINA,sina,sina.com.cn,............,......,......" />..<meta name="description" content="........................24........................................................................................................................................................................................................................30......................................................................................." />. <link rel="mask-icon" sizes="any" href="hXXp://VVV.sina.com.cn/favicon.svg" color="red">..<meta name="stencil" content="PGLS000022" />..<meta name="publishid" content="30,131,1" />..<meta name="verify-v1" content="6HtwmypggdgP1NLw7NOuQBI2TW8 CfkYCoyeB8IDbn8=" />..<meta name="360-site-verification" content="63349a2167ca11f4b9bd9a8d48354541" />..<meta name="application-name" content="............"/>..<meta name ="msapplication-TileImage" content="hXXp://i1.sinaimg.cn/dy/deco/2013/0312/logo.png"/>..<meta name="msapplication-TileColor" content="#ffbf27"/>..<meta name="sogou_site_verification" content="Otg5irx9wL"/>.<link rel="apple-touch-icon" href="hXXp://i3.sinaimg.cn/home/2013/0331/U586P30DT2

<<< skipped >>>

....

..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV+c/AZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CEBWsfo6gTWKBdqI6VatS5Uo= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ss.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1609

content-transfer-encoding: binary

Cache-Control: max-age=469987, public, no-transform, must-revalidate

Last-Modified: Tue, 21 Mar 2017 17:05:05 GMT

Expires: Tue, 28 Mar 2017 17:05:05 GMT

Date: Thu, 23 Mar 2017 06:32:55 GMT

Connection: keep-alive

0..E......>0..:.. .....0..... 0..'0......E ....e.u.....x..7....20170321170505Z0s0q0I0... ..........d.....k... P.....d.._`.a.U..C..`*..z.C......~..Mb.v.:U.R.J....20170321170505Z....20170328170505Z0...*.H.............Fx<."2.........t.wU...........\.......... ,@........../=....\..W.xb....J.=.y.p......<.....j....... .W.....d....../..F..K...Z.....^o..\f...W_..T.0f{d..o...f..V.....M..Z.f.....&..1MV_.Q) ...<..q.....d.-..\?..`Y....*B.......>V..F>...r..nX.3.........X.NOS~..G....n0..j0..f0..N.......Dh.ciH.........!0...*.H........0~1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1/0-..U...&Symantec Class 3 Secure Server CA - G40...170204000000Z..170505235959Z0@1>0<..U...5Symantec Class 3 Secure Server CA - G4 OCSP Responder0.."0...*.H.............0......... B.}.@...E2.......&kg.#.c..7f#0....!....Z.G..|.o..W{2.m.l.cM...%......V.Wx6I.t....Q,U^......;.U<ie...X.{.6. .4...ep....q..OuV...F...s.f....!....K....O....Oj.?Yd6^Mlw.6.k..*./.......b..Q4...H.s.........(...toW...9...............&...D...{T{........4.;/pa<...........0...0... .....0......0"..U....0...0.1.0...U....TGV-D-38570...U.#..0..._`.a.U..C..`*..z.C..0...U......E ....e.u.....x..7..0...U.......0.0n..U. .g0e0c..`.H...E....0T0&.. .........http://VVV.symauth.com/cps0*.. .......0... hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0...*.H.............x..b5XG.........T^2.....T..............zq.............f....#|.....P...R.....]...la.(.21{...C.....K.....R..H.b....3L..52}5.8.......%.......l=..$X$_..01.3.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRsWSLjJ8N0Wujis0rUBfV+c/AZAQUX2DPYZBV34RDFIpgKrL1evRDGO8CECQ1SvQ/t8C2OzukI4M8ERw= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ss.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1609

content-transfer-encoding: binary

Cache-Control: max-age=451642, public, no-transform, must-revalidate

Last-Modified: Tue, 21 Mar 2017 12:00:18 GMT

Expires: Tue, 28 Mar 2017 12:00:18 GMT

Date: Thu, 23 Mar 2017 06:32:56 GMT

Connection: keep-alive

0..E......>0..:.. .....0..... 0..'0......E ....e.u.....x..7....20170321120018Z0s0q0I0... ..........d.....k... P.....d.._`.a.U..C..`*..z.C....$5J.?...;;.#.<......20170321120018Z....20170328120018Z0...*.H...............~."....7..@....].WD..2a.....F......A.......Ph.E........z...u........M..........5L.V6.....~.].3Z....&z...Z....... .....9...3 M..{.aU..U...- .=....A...<..... .x..t...Cuy!7 Yv'.W.yS....=...s...?6....AmW]...@.t@vwX.s.H8.nN/P ..._.TaL/>.....rFY...g..4D}.d.......n0..j0..f0..N.......Dh.ciH.........!0...*.H........0~1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1/0-..U...&Symantec Class 3 Secure Server CA - G40...170204000000Z..170505235959Z0@1>0<..U...5Symantec Class 3 Secure Server CA - G4 OCSP Responder0.."0...*.H.............0......... B.}.@...E2.......&kg.#.c..7f#0....!....Z.G..|.o..W{2.m.l.cM...%......V.Wx6I.t....Q,U^......;.U<ie...X.{.6. .4...ep....q..OuV...F...s.f....!....K....O....Oj.?Yd6^Mlw.6.k..*./.......b..Q4...H.s.........(...toW...9...............&...D...{T{........4.;/pa<...........0...0... .....0......0"..U....0...0.1.0...U....TGV-D-38570...U.#..0..._`.a.U..C..`*..z.C..0...U......E ....e.u.....x..7..0...U.......0.0n..U. .g0e0c..`.H...E....0T0&.. .........hXXp://www.symauth.com/cps0*.. .......0... hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0...*.H.............x..b5XG.........T^2.....T..............zq.............f....#|.....P...R.....]...la.(.21{...C.....K.....R..H.b....3L..52}5.8.......%.......l=..$X$_..01.3.....&l

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.360.cn

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Server: nginx/1.2.9

Date: Thu, 23 Mar 2017 06:33:44 GMT

Content-Type: text/html

Content-Length: 184

Connection: keep-alive

Location: hXXps://VVV.360.cn

<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx/1.2.9</center>..</body>..</html>....

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.aliyun.com

Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently

Server: Tengine

Date: Thu, 23 Mar 2017 06:32:44 GMT

Content-Type: text/html

Content-Length: 278

Connection: keep-alive

Location: hXXps://intl.aliyun.com/

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">..<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<h1>301 Moved Permanently</h1>..<p>The requested resource has been assigned a new permanent URI.</p>..<hr/>Powered by Tengine</body>..</html>....

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: subca.ocsp-certum.com

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:32:54 GMT

Content-Type: application/ocsp-response

Content-Length: 1657

Connection: keep-alive

Content-transfer-encoding: binary

X-Cached: MISS

Server: NetDNA-cache/2.2

X-Cache: HIT

0..u......n0..j.. .....0.....[0..W0..0........0..1.0...U....PL1!0...U....Asseco Data Systems S.A.1'0%..U....Certum Certification Authority1%0#..U....Certum CA Validation Service..20170323061937Z0r0p0H0... ......y...bOm..(y.Y6B...}n...C..m.....i..J.`.:........@.eq_..(....(....20170323061937Z....20170330061937Z..0.0... .....0....0... .....0..0...*.H........... 1.......b.p..BV. .V&.S,......7a\..Y...g% .B#{khJ.B4I.~.N R.":..^8.5.t....)...W\...N ..(L..M.....Z..N....7)...w6r..;....Y...C..{..O.....[\.u.......TH.......\....6..e.#{.D[...$....i .8..KZ.......@V8.... 1........qx.(..)DR....fiUb;......P.A..../....v............0...0...0....................#=Xr..Q0...*.H........0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA0...161220101836Z..180120101836Z0..1.0...U....PL1!0...U....Asseco Data Systems S.A.1'0%..U....Certum Certification Authority1%0#..U....Certum CA Validation Service0.."0...*.H.............0..........3..>......]{7..\...$vl.....V......T...-.:.....y..'...X..}.fA\...._.Uxl6.ti %.SS..#. Z.5.G"..S.....)Q...!..P....~0..32...Bmd...%.2...D.....J.........6....O.u..vm.l..V.'.L.4.._....\.eK...MI.F.;H.;..%...KZ...H;e ..9.2..A.b......F.T..._........DY2...2Z#L.D0)........0..0...U.......0.0...U.......L.oh.....2......|.=0R..U.#.K0I.B.@0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA.... 0...U...........0...U.%..0... .......0... .....0......0...*.H.............,.....D...,.c...<..............G..~Uug.....q6).g&..."....B..k...{.(.S... 5...x.>......K.ks.....S...]R......n....q.Y.i&gt

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.163.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Expires: Thu, 23 Mar 2017 06:34:03 GMT

Date: Thu, 23 Mar 2017 06:32:43 GMT

Server: nginx

Content-Type: text/html; charset=GBK

Transfer-Encoding: chunked

Vary: Accept-Encoding,User-Agent,Accept

Cache-Control: max-age=80

Age: 61

X-Via: 1.1 czdx87:4 (Cdn Cache Server V2.0), 1.1 kf49:4 (Cdn Cache Server V2.0)

Connection: keep-alive

8000.. <!DOCTYPE HTML>..... <html phone="1" id="ne_wrap"> .<head>.<meta http-equiv="Content-Type" content="text/html; charset=gbk">.<meta name="model_url" content="hXXp://VVV.163.com/special/0077rt/index.html" />.<title>....</title>.<base target="_blank" />.<meta name="Keywords" content="....,....,....,....,....,....,....,....,....,....,....,....,....,....,....,...." />.<meta name="Description" content="..............................................................................................30.........................................................." />.<meta name="robots" content="index, follow" />.<meta name="googlebot" content="index, follow" />.<script type="text/javascript">.(function() {. if(/s=noRedirect/i.test(location.search)) return; . if(/AppleWebKit.*Mobile/i.test(navigator.userAgent) || (/MIDP|SymbianOS|NOKIA|SAMSUNG|LG|NEC|TCL|Alcatel|BIRD|DBTEL|Dopod|PHILIPS|HAIER|LENOVO|MOT-|Nokia|SonyEricsson|SIE-|Amoi|ZTE/.test(navigator.userAgent))) {. try {. if(/Andr

<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH HTTP/1.1

Cache-Control: max-age = 10800

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 11:51:19 GMT

If-None-Match: "8958b58603e19e9b46868d4300d201ea9ae7099b"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Thu, 23 Mar 2017 06:32:53 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d8a8484918d128d1685e7c650bee36c2b1490250773; expires=Fri, 23-Mar-18 06:32:53 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Thu, 23 Mar 2017 05:09:59 GMT

Expires: Mon, 27 Mar 2017 05:09:59 GMT

ETag: "b3ee1471b72f0ced734a0acb26041b5d1b044a55"

Cache-Control: public, no-transform, must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 343f5b24d4454ede-DME

0..........0..... .....0......0...0........>'...;6..9.wS..._...20170323050959Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.BG....20170323050959Z....20170327050959Z0...*.H...............K#.K6......J.S..... o..>4DW....=V=q.C...x..q.\)O...g......-}..0....\wpZ..`.T...(8.k....O.3./2.$d..N.6...e..... {.......0.@`.....M............L.........fJu../... V..vx..M^...c.P^...BS.W]..wl..."&<.......I...X.~.......#..x..4.=$x..v....Y...}......X.8o8?.......0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=..._

<<< skipped >>>

GET / HTTP/1.1

User-Agent: winnet

Host: VVV.163.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Expires: Thu, 23 Mar 2017 06:34:03 GMT

Date: Thu, 23 Mar 2017 06:32:43 GMT

Server: nginx

Content-Type: text/html; charset=GBK

Transfer-Encoding: chunked

Vary: Accept-Encoding,User-Agent,Accept

Cache-Control: max-age=80

Age: 30

X-Via: 1.1 czdx87:4 (Cdn Cache Server V2.0), 1.1 kf49:4 (Cdn Cache Server V2.0)

Connection: keep-alive

8000.. <!DOCTYPE HTML>..... <html phone="1" id="ne_wrap"> .<head>.<meta http-equiv="Content-Type" content="text/html; charset=gbk">.<meta name="model_url" content="hXXp://VVV.163.com/special/0077rt/index.html" />.<title>....</title>.<base target="_blank" />.<meta name="Keywords" content="....,....,....,....,....,....,....,....,....,....,....,....,....,....,....,...." />.<meta name="Description" content="..............................................................................................30.........................................................." />.<meta name="robots" content="index, follow" />.<meta name="googlebot" content="index, follow" />.<script type="text/javascript">.(function() {. if(/s=noRedirect/i.test(location.search)) return; . if(/AppleWebKit.*Mobile/i.test(navigator.userAgent) || (/MIDP|SymbianOS|NOKIA|SAMSUNG|LG|NEC|TCL|Alcatel|BIRD|DBTEL|Dopod|PHILIPS|HAIER|LENOVO|MOT-|Nokia|SonyEricsson|SIE-|Amoi|ZTE/.test(navigator.userAgent))) {. try {. if(/Andr

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1908:

.text

`.rdata

@.data

.vmp0

.vmp1

.reloc

@.rsrc

GetProcessWindowStation

SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers

Reality.log

D:\chengzhen\

\StartGame\Release\StartGame.pdb

C:\OneRun.txt

360tcpview

365tcpview

cports

tcpview

httpanalyzer

C:\tbbmalloc.exe

tbbmalloc.exe

c:\%original file name%.exe

Please contact the application's support team for more information.

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

USER32.DLL

operator

activation.php?code=

deactivation.php?hash=

.?AVIUrlBuilderSource@@

hVm.AG

.eS~J

.gXSE

.zSKM

$ra.QF

.mQ :

$6.ZP;

AjR.To

A*.pY,

X00

%C{Mwb

{ .Fra

u%d!K

4.YQH

).tyO

.SCpC

%%8SC

,.nD2

%.cz9I

I.YU4

3.jmK

.jAdrc

>c"%FS

ByÃŽXo.

{g.zj

D.DRem

ÃZs

eW.eq

9L.KS

%S;f}k

!=.hh

.jTF@d

fQ4-p}

E=%u=]

cG%up=

W".rJ

.JD5L*)k

4k.Qju

[.zCK

.ZqM

Td.lpw

.BPx?

8M%Xx

3ck.dCuJ

%d"sb)

.od7:

dPVI%u

.FCFU

41%%F

.NQ8o

r.Jls)

%CO4sp\

9sshM

K.JfMq2N

.ul7G

W}%fT

.FM

zu%Dg

EDS.oV

5%Scx

nUH.kG

.yb:gUV

.mU8R

zÃš^

<_.ln>

;R<.le>

%X=9q

H<.nu>

~ .Gwz

fi.FK

.RlqY

KP.bN

H%d$)

.kv^d^

e*.MH

v.Aef

.ZK-)

]DQ.NooL

.kkBM

lJ.Qjb4

zn!4/.tU

xW%Cw?

.sI04

.EL;f

2.UJ=

}d%X[

F-?%U

@r.nA

.tF#Z

b7Ã‰

h].Iv

WuM%SQ

r.DY|

).Hvt>

%uZ$|3

MHy-b}

W:\ 0

.Cc&I

aP.ug

{A%C}

=~%3S}

h.Xv$

`h%X4

L.FiD

-j}a

w%UPt

a.gUh

%S|ac

n.tiu

Y.Zg`

M.Dzv

b%XrZf

?OCRtQH

v.iR`

hcu.Tf

%s~Oz

..rl0

3g.yz

.FPh9

.rT3$

#.vU}6

KEY|3

]{b-1}.

Z%Uk{)z

Wq.ZP

R#,%d

user32.dll

>=

6543210/

.-, *)('

5 5$5(5,5054585

> >@>\>`>

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps