Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, Trojan.Win32.Swrort.3.FD, GenericEmailWorm.YR, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 2addff50f3f9cfac1b8aee662d4edcd2
SHA1: 78743c8727812a1a752eadc4dbe21378c2aca9e6
SHA256: fb9d870695208681f5aecf085e8369051946657baae7c1367ab9b5863c79ace6
SSDeep: 98304:zUN9xvL08QeGj7uzhnRY2O43lG4uARcRd1df1r0LnpExzhXS2PNEHAJBAUZLET:uMMAdf1rSezhXSBgJVYT
Size: 10506240 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC50, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, Armadillov171, UPolyXv05_v6
Company: no certificate found
Created at: 2016-10-14 09:17:25
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
sevices_860_43057.exe:1472
%original file name%.exe:2748
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process sevices_860_43057.exe:1472 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\ProgramData\SQ PlatForm\7024364360891602023 (15 bytes)
C:\ProgramData\SQ PlatForm\9213725520475708051 (15 bytes)
C:\ProgramData\SQ PlatForm\5 (5 bytes)
C:\ProgramData\SQ PlatForm\8317858619336429028 (15 bytes)
C:\ProgramData\SQ PlatForm\5612115401681251799 (15 bytes)
C:\ProgramData\SQ PlatForm\7798123154635197943 (15 bytes)
C:\ProgramData\tmpst\shst (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\110kk011 (3 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\110kk011 (0 bytes)
The process %original file name%.exe:2748 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\stat[1].js (1081 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\NIDQ1OIQ.txt (118 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\bbs[1].bmp (4202 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\tj[1].htm (904 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016110220161103\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\03[1].jpg (1543 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\core[1].js (763 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\jquery.min[2].js (10384 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\52912.tmp (701 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\demo[1].htm (1404 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\530ff.html (908 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\u.zip (6360 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\sevices_860_43057.exe (8801 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\stat[1].gif (43 bytes)
Registry activity
The process %original file name%.exe:2748 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Size" = "10"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"
[HKLM\SOFTWARE\Microsoft\Tracing\2addff50f3f9cfac1b8aee662d4edcd2_RASMANCS]
"FileTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"InitHits" = "100"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016110220161103]
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Internet Explorer\International\CpMRU]
"Enable" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\2addff50f3f9cfac1b8aee662d4edcd2_RASAPI32]
"EnableFileTracing" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\2addff50f3f9cfac1b8aee662d4edcd2_RASMANCS]
"MaxFileSize" = "1048576"
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\2addff50f3f9cfac1b8aee662d4edcd2_RASAPI32]
"MaxFileSize" = "1048576"
"FileTracingMask" = "4294901760"
"ConsoleTracingMask" = "4294901760"
[HKLM\SOFTWARE\xkgg1]
&r&lg&ntime&cnzz_eid&showp&t&h&rnd | |
&t | |
&t | |
&r&lg&ntime&cnzz_eid&showp&t&h&rnd | |
&<&&
<<<>>>
<<<>>>
<<<>>>
<><><><><><><><><><><><><><><&tid&extra><><><><><><>
&t
站长统计&&&k&&<><><><><>站长统计
<<<>>>
<<<>>>
<><><><><><><><>
<<<>>>
<<<>>>><
<<<>>>
<<<>>>
<
><
><><
><>
<><><
><><><>&l
>
<
<><><><&g
<><><>
<><
>
<
><>
<><><>&
><><><
><><><
><><><
><><><>
<><>
&tid<><><
>>
&r&lg&ntime&cnzz_eid&showp&t&h&rnd
&
&
&k
<
>
&Pv..y5pQ.....a....v.
>
&d......
<
&
<<
<&
&E..a......z....d..y_..s5.JI>
<
<>
&&t..P
><
&<&
<
&
&
>>
&MC.7iPt..
<
&
>&
>
<>
<><>
<>
&&
<&&
&type
&type
&type
&type
&type
&type
&type
&type
&skey
&skey
&angel_key
&angel_key
&angel_key
&angel_key
&pskey
&pskey
&type
&type
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&vip
&vip
&cmd&id&goodsid&goodsnum
&cmd&id&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&map_index
&map_index
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&index&succ&unkown&skey
&index&succ&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&index&type&unkown&skey&platfrom
&index&type&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&succ&unkown&skey&platfrom
&succ&unkown&skey&platfrom
&succ&unkown&skey&platfrom
&succ&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&succ&unkown&skey
&succ&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&type
&type
&type
&type
&type
&type
&npc_id
&npc_id
&srcid
&srcid
&index&succ&unkown&skey&platfrom
&index&succ&unkown&skey&platfrom
&srcid&srcnum&destid&time
&srcid&srcnum&destid&time
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&succ&unkown&skey
&succ&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&succ&unkown&skey&platfrom
&succ&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&num&unkown&skey&platfrom
&num&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&pet&unkown&skey&platfrom
&pet&unkown&skey&platfrom
&score
&score
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&result&unkown&skey&platfrom
&result&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&add_num&unkown&skey&platfrom
&add_num&unkown&skey&platfrom
&add_num&unkown&skey&platfrom
&add_num&unkown&skey&platfrom
&add_num&unkown&skey&platfrom
&add_num&unkown&skey&platfrom
&add_num&unkown&skey&platfrom
&add_num&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&score&unkown&skey
&score&unkown&skey
&unkown&skey
&unkown&skey
&stone&unkown&skey&platfrom
&stone&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&item_num&unkown&skey
&item_num&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&score&unkown&skey
&score&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&score&unkown&skey
&score&unkown&skey
&unkown&skey
&unkown&skey
&delta&unkown&skey
&delta&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey
&score&unkown&skey
&unkown&skey
&unkown&skey
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&delta&unkown&skey&platfrom
&delta&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&life&unkown&skey&platfrom
&life&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&step
&step
&level
&level
&chapter
&chapter
&blue
&blue
&blue
&blue
&src
&src
&src
&src
&gamestr
&gamestr
&gamestr
&gamestr
&type&str
&type&str
&gamestr
&gamestr
&type
&type
&type
&type
&unkown&skey&platfrom
&unkown&skey&platfrom
&power&unkown&skey&platfrom
&power&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&id
&id
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&delta&unkown&skey&platfrom
&delta&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&skey&platfrom
&skey&platfrom
&skey
&skey
<.>
<.>
&
&
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&index
&index
&id
&id
&id
&id
&id
&id
&id
&id
&index&succ&score&unkown&skey&platfrom
&index&succ&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&pass&unkown&skey&platfrom
&pass&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&num&unkown&skey
&num&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&succ&unkown&skey&platfrom
&succ&unkown&skey&platfrom
&index
&index
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&npc_id&unkown&skey
&npc_id&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&npc_id&unkown&skey&platfrom
&type&npc_id&unkown&skey&platfrom
&type&npc_id&unkown&skey&platfrom
&type&npc_id&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&succ&npcid&unkown&skey
&succ&npcid&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&unkown&skey&platfrom
&type&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&direct
&direct
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&game
&game
&win&unkown&skey
&win&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey&platfrom
&unkown&skey&platfrom
&index
&index
&index
&index
&index
&index
&index
&index
&new_name
&new_name
&unkown&skey
&unkown&skey
&unkown&skey
&unkown&skey
&type&unkown&skey
&type&unkown&skey
&num&ran&angel_uin
&num&ran&angel_uin
&num&ran&angel_uin
&num&ran&angel_uin
&num&ran&angel_uin
&num&ran&angel_uin
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&skillId&gameId
&id&angel_uin
&id&angel_uin
&npc
&npc
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&index
&index
&index
&index
&index
&index
&index
&index
&index
&index
&index
&index
&index
&index
&index
&index
&id
&id
&id
&id
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type&goodsid&goodsnum
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&type
&score
&score
&ship
&ship
&type
&type
&type
&type
&type
&type
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score1&score2&unkown&skey&platfrom
&score1&score2&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&num&ran&angel_uin
&num&ran&angel_uin
&id&id0&count0&id1&count1&id2&count2
&id&id0&count0&id1&count1&id2&count2
&id&id0&count0&id1&count1&id2&count2
&id&id0&count0&id1&count1&id2&count2
&id&id0&count0&id1&count1&id2&count2
&id&id0&count0&id1&count1&id2&count2
&unkown&skey&platfrom
&unkown&skey&platfrom
&id
&id
&id&unkown&skey&platfrom
&id&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&index
&index
&page
&page
&unkown&skey&platfrom
&unkown&skey&platfrom
&id
&id
&id
&id
&unkown&skey&platfrom
&unkown&skey&platfrom
&id
&id
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&index&unkown&skey&platfrom
&index&unkown&skey&platfrom
&map_index
&map_index
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&num
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&page
&page
&platfrom
&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&score&type
&score&type
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey
&unkown&skey
&tid&page
&tid&page
&srcid&srcnum&destid&time
&srcid&srcnum&destid&time
&srcid&srcnum&destid&time
&srcid&srcnum&destid&time
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&score&unkown&skey&platfrom
&score&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
&unkown&skey&platfrom
<.342>
<.342>
&b
&b
&
&
&tid&extra
&tid&extra
&
&
&
&
&&&&&&&&&&&&&&&&&&&&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&&&&&&&P&VpM&&&RVK&Sw0&&:IJYTECu2m&UEB8KJE&&LCGbV&W&DKIEW4&GVWV&&Y&&<::oka3ndjfi1r>&&<_ _ioe_i_g_c_d_h_f_nin_k_j_m_tfo_ucmb><:v a-a.a0a h-i>&&&b&&c&&d.I&HyEZ6&eP7.e2ek7-e6eJ9mM&KU8&g&i&A&k&l&F1l-K2l3l4l5lZF&q
&&&&b&c&d&g&i&l&v&e&j&q&r&s&t&&x&u&z&w&y&&B&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&A&B&C&D&E&F&G&H&I&J&K&L&M&N&O&P&Q&R&S&T&U&V&W&X&&&&&<_>&UM:L&&&&CCcRVgbhbGSlbl&Iv&D&_<4acrwqugjejdjgjfjgvtokjn>&k&dsQ&b&h&K&&F&q&&niCr3&PJ1HsOsQ5WsRsTsSs&t&&Q5&j53&u&TTM1Q&w&&
&&&&&&&&U&X&e&&t&ukuju&h&&&&u&_&&a&e&g&c&&&&&&&&&&&H&G&&&B&A&&&&F&E&&&D&C&&&&M&N&&O&P&&&Q&R&&&S&T&&&U&V&:&&W&X&&&Y&Z&&&&&&&_&&a&b&c&d&&F&&&&s&axN0&&J&S5&m.mmp&wI&Y&TM&&u&V&y&j&&&&&&&&&&&:<:>&&&&&A&B&C&D&E&F&G&H&&t&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&:&&&&&&&
&&&&&&&&&&clickurl&fromurl&ver&unionid&iver&uver&ver&uver&iver&iswork&&y1&&&&&clickurl&fromurl&ver&unionid&iver&uver&ver&uver&iver&iswork&