Susp_Dropper (Kaspersky), Trojan.Generic.15213853 (B) (Emsisoft), Trojan.Generic.15213853 (AdAware), Trojan-PSW.Win32.MSNPassword.FD, Trojan.Win32.FlyStudio.FD, GenericInjector.YR, GenericPhysicalDrive0.YR, TrojanFlyStudio.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 51007d9e9830197061fdd77ad5706c3f
SHA1: 103683789956258dfbabb1cc0d4d3ee8d3920ecc
SHA256: 8a332ebb45310b8cb2430b7339ec0446cdff13c49eb45468373cd7203527fedb
SSDeep: 24576:HK/LtIJcY3q7dYwincI0q5LQTftVge18gzqm4huOD2PoGcYTp:q/LtIJM7CZ30q5iwZgzMuO6P1xTp
Size: 1340928 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-08-31 21:26:17
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
%original file name%.exe:1216
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1216 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YB33U3FA\009moyuw[1].htm (67 bytes)
C:\ggpz.dll (9606 bytes)
%System%\drivers\etc\hosts (3 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014040820140409 (0 bytes)
%System%\drivers\etc\hosts (0 bytes)
Registry activity
The process %original file name%.exe:1216 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016042420160425]
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016042420160425]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016042420160425\"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016042420160425]
"CacheOptions" = "11"
"CachePrefix" = ":2016042420160425:"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016042420160425]
"CacheRepair" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 90 CA 78 4D D8 2E 5C 80 16 0E 9A 8E 4C BD 50"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014040820140409]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
MD5 | File path |
---|---|
8cb47c4e407d13ea91397995e14ff5de | c:\ggpz.dll |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 3355 bytes in size. The following strings are added to the hosts file listed below:
184.164.70.13 | 001my.com.co |
184.164.70.13 | www.001my.com.co |
184.164.70.13 | www.duge.kkkmy.com |
184.164.70.13 | www.guanggao.kkkmy.com |
184.164.70.13 | guanggao.kkkmy.com |
184.164.70.13 | duge.kkkmy.com |
184.164.70.13 | kkkmy.com |
184.164.70.13 | www.kkkmy.com |
184.164.70.13 | 880my.com |
184.164.70.13 | kkk.973play.com |
184.164.70.13 | kkk.5917my.com |
184.164.70.13 | www.139my.com |
184.164.70.13 | 139my.com |
184.164.70.13 | www.001my.com |
184.164.70.13 | 001my.com |
184.164.70.13 | www.haomy.com |
184.164.70.13 | haomy.com |
184.164.70.13 | www.zhaomy.com |
184.164.70.13 | zhaomy.com |
184.164.70.13 | mmm.67ma.com |
184.164.70.13 | www.58wgw.com |
184.164.70.13 | wwww.shedo1314.com |
184.164.70.13 | 58wgw.com |
184.164.70.13 | www.898my.com |
184.164.70.13 | 898my.com |
184.164.70.13 | www.660my.com |
184.164.70.13 | 660my.com |
184.164.70.13 | kkk.07le.com |
184.164.70.13 | www.2013mysf.com |
184.164.70.13 | www.139my.info |
184.164.70.13 | www.19038.cn |
184.164.70.13 | www.800037966.com |
184.164.70.13 | 800037966.com |
184.164.70.13 | www.jxlhdz.com |
184.164.70.13 | jxlhdz.com |
184.164.70.13 | my158.com |
184.164.70.13 | www.my158.com |
184.164.70.13 | www.jxlhdz.com |
184.164.70.13 | jxlhdz.com |
184.164.70.13 | wwww.jxlhdz.com |
184.164.70.13 | jxlhdz.com |
184.164.70.13 | www.jxlhdz.com |
184.164.70.13 | www.shedo1314.com |
184.164.70.13 | shedo1314.com |
184.164.70.13 | www.117my.com |
184.164.70.13 | 770my.com |
184.164.70.13 | www.830my.com |
184.164.70.13 | 830my.com |
184.164.70.13 | wvvw.jxlhdz.com |
184.164.70.13 | vvww.jxlhdz.com |
184.164.70.13 | dd.jxlhdz.com |
184.164.70.13 | moyuw.com |
184.164.70.13 | www.moyuw.com |
184.164.70.13 | www.shedo1314.com |
184.164.70.13 | vvvv.shedo1314.com |
184.164.70.13 | vvwv.jxlhdz.com |
184.164.70.13 | www.91nixi.com |
184.164.70.13 | www.sxyish.com |
184.164.70.13 | www.yzhbike.com |
184.164.70.13 | www.880my.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YB33U3FA\009moyuw[1].htm (67 bytes)
C:\ggpz.dll (9606 bytes)
%System%\drivers\etc\hosts (3 bytes) - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: 009??????
Product Name: 009?????
Product Version: 1.3.0.0
Legal Copyright: 009??????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.3.0.0
File Description: 009?????,??????http://009moyuw.com
Comments: ??????http://009moyuw.com
Language: Language Neutral
Company Name: 009??????Product Name: 009?????Product Version: 1.3.0.0Legal Copyright: 009??????Legal Trademarks: Original Filename: Internal Name: File Version: 1.3.0.0File Description: 009?????,??????http://009moyuw.comComments: ??????http://009moyuw.comLanguage: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 1916928 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 1921024 | 1331200 | 1331200 | 5.4109 | 9155f77d69fc21cfacee2051b42c07f5 |
.rsrc | 3252224 | 12288 | 8704 | 3.19357 | 18d5cb6b8eb666ea4ddce5e35b5989b0 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1216:
`.rsrc
`.rsrc
.ve]-
.ve]-
|o.Fp
|o.Fp
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
user32.dll
user32.dll
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
SetWindowsHookExA
SetWindowsHookExA
EnumWindows
EnumWindows
ExitWindowsEx
ExitWindowsEx
42305932-06E6-47a5-AC79-8BDCDC58DF61
42305932-06E6-47a5-AC79-8BDCDC58DF61
\ggpz.dll
\ggpz.dll
C:\\WINDOWS\\system32\\drivers\\etc\\hosts
C:\\WINDOWS\\system32\\drivers\\etc\\hosts
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# 102.54.94.97 rhino.acme.com # source server
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
127.0.0.1 localhost
184.164.70.13 001my.com.co
184.164.70.13 001my.com.co
184.164.70.13 VVV.001my.com.co
184.164.70.13 VVV.001my.com.co
184.164.70.13 VVV.duge.kkkmy.com
184.164.70.13 VVV.duge.kkkmy.com
184.164.70.13 VVV.guanggao.kkkmy.com
184.164.70.13 VVV.guanggao.kkkmy.com
184.164.70.13 guanggao.kkkmy.com
184.164.70.13 guanggao.kkkmy.com
184.164.70.13 duge.kkkmy.com
184.164.70.13 duge.kkkmy.com
184.164.70.13 kkkmy.com
184.164.70.13 kkkmy.com
184.164.70.13 VVV.kkkmy.com
184.164.70.13 VVV.kkkmy.com
184.164.70.13 880my.com
184.164.70.13 880my.com
184.164.70.13 kkk.973play.com
184.164.70.13 kkk.973play.com
184.164.70.13 kkk.5917my.com
184.164.70.13 kkk.5917my.com
184.164.70.13 VVV.139my.com
184.164.70.13 VVV.139my.com
184.164.70.13 139my.com
184.164.70.13 139my.com
184.164.70.13 VVV.001my.com
184.164.70.13 VVV.001my.com
184.164.70.13 001my.com
184.164.70.13 001my.com
184.164.70.13 VVV.haomy.com
184.164.70.13 VVV.haomy.com
184.164.70.13 haomy.com
184.164.70.13 haomy.com
184.164.70.13 VVV.zhaomy.com
184.164.70.13 VVV.zhaomy.com
184.164.70.13 zhaomy.com
184.164.70.13 zhaomy.com
184.164.70.13 mmm.67ma.com
184.164.70.13 mmm.67ma.com
184.164.70.13 VVV.58wgw.com
184.164.70.13 VVV.58wgw.com
184.164.70.13 wVVV.shedo1314.com
184.164.70.13 wVVV.shedo1314.com
184.164.70.13 58wgw.com
184.164.70.13 58wgw.com
184.164.70.13 VVV.898my.com
184.164.70.13 VVV.898my.com
184.164.70.13 898my.com
184.164.70.13 898my.com
184.164.70.13 VVV.660my.com
184.164.70.13 VVV.660my.com
184.164.70.13 660my.com
184.164.70.13 660my.com
184.164.70.13 kkk.07le.com
184.164.70.13 kkk.07le.com
184.164.70.13 VVV.2013mysf.com
184.164.70.13 VVV.2013mysf.com
184.164.70.13 VVV.139my.info
184.164.70.13 VVV.139my.info
184.164.70.13 VVV.19038.cn
184.164.70.13 VVV.19038.cn
184.164.70.13 VVV.800037966.com
184.164.70.13 VVV.800037966.com
184.164.70.13 800037966.com
184.164.70.13 800037966.com
184.164.70.13 VVV.jxlhdz.com
184.164.70.13 VVV.jxlhdz.com
184.164.70.13 jxlhdz.com
184.164.70.13 jxlhdz.com
184.164.70.13 my158.com
184.164.70.13 my158.com
184.164.70.13 VVV.my158.com
184.164.70.13 VVV.my158.com
184.164.70.13 wVVV.jxlhdz.com
184.164.70.13 wVVV.jxlhdz.com
184.164.70.13 VVV.shedo1314.com
184.164.70.13 VVV.shedo1314.com
184.164.70.13 shedo1314.com
184.164.70.13 shedo1314.com
184.164.70.13 VVV.117my.com
184.164.70.13 VVV.117my.com
184.164.70.13 770my.com
184.164.70.13 770my.com
184.164.70.13 VVV.830my.com
184.164.70.13 VVV.830my.com
184.164.70.13 830my.com
184.164.70.13 830my.com
184.164.70.13 wvvw.jxlhdz.com
184.164.70.13 wvvw.jxlhdz.com
184.164.70.13 vvww.jxlhdz.com
184.164.70.13 vvww.jxlhdz.com
184.164.70.13 dd.jxlhdz.com
184.164.70.13 dd.jxlhdz.com
184.164.70.13 moyuw.com
184.164.70.13 moyuw.com
184.164.70.13 VVV.moyuw.com
184.164.70.13 VVV.moyuw.com
184.164.70.13 VVV.shedo1314.com
184.164.70.13 VVV.shedo1314.com
184.164.70.13 vvvv.shedo1314.com
184.164.70.13 vvvv.shedo1314.com
184.164.70.13 vvwv.jxlhdz.com
184.164.70.13 vvwv.jxlhdz.com
184.164.70.13 VVV.91nixi.com
184.164.70.13 VVV.91nixi.com
184.164.70.13 VVV.sxyish.com
184.164.70.13 VVV.sxyish.com
184.164.70.13 VVV.yzhbike.com
184.164.70.13 VVV.yzhbike.com
184.164.70.13 VVV.880my.com
184.164.70.13 VVV.880my.com
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
|$D.tm
|$D.tm
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
winmm.dll
winmm.dll
ws2_32.dll
ws2_32.dll
gdi32.dll
gdi32.dll
GLU32.DLL
GLU32.DLL
aclui.dll
aclui.dll
acsmib.dll
acsmib.dll
activeds.dll
activeds.dll
AcXtrnal.dll
AcXtrnal.dll
adimage.dll
adimage.dll
adptif.dll
adptif.dll
ADVAPI32.DLL
ADVAPI32.DLL
advpack.dll
advpack.dll
atl.dll
atl.dll
authz.dll
authz.dll
avicap32.dll
avicap32.dll
avifil32.dll
avifil32.dll
browseui.dll
browseui.dll
CABINET.DLL
CABINET.DLL
clusapi.dll
clusapi.dll
comctl32.dll
comctl32.dll
comdlg32.dll
comdlg32.dll
comsvcs.dll
comsvcs.dll
crtdll.dll
crtdll.dll
crypt32.dll
crypt32.dll
cryptnet.dll
cryptnet.dll
D3DRM.DLL
D3DRM.DLL
dbghelp.dll
dbghelp.dll
ddraw.dll
ddraw.dll
DHCPCSVC.DLL
DHCPCSVC.DLL
digest.dll
digest.dll
DINPUT.DLL
DINPUT.DLL
dplay.dll
dplay.dll
dplayx.dll
dplayx.dll
dsound.dll
dsound.dll
dsprop.dll
dsprop.dll
dsuiext.dll
dsuiext.dll
ftsrch.dll
ftsrch.dll
gpedit.dll
gpedit.dll
hhctrl.ocx
hhctrl.ocx
hlink.dll
hlink.dll
iasperf.dll
iasperf.dll
icm32.dll
icm32.dll
ICMP.DLL
ICMP.DLL
icmui.dll
icmui.dll
idq.dll
idq.dll
iedkcs32.dll
iedkcs32.dll
iissuba.dll
iissuba.dll
IMAGEHLP.DLL
IMAGEHLP.DLL
imm32.dll
imm32.dll
inetcpl.cpl
inetcpl.cpl
IPHLPAPI.DLL
IPHLPAPI.DLL
iprop.dll
iprop.dll
KSUSER.DLL
KSUSER.DLL
loadperf.dll
loadperf.dll
lz32.dll
lz32.dll
mapi32.dll
mapi32.dll
mgmtapi.dll
mgmtapi.dll
MOBSYNC.DLL
MOBSYNC.DLL
mpg4dmod.dll
mpg4dmod.dll
mpr.dll
mpr.dll
mprapi.dll
mprapi.dll
mqrt.dll
mqrt.dll
msacm32.dll
msacm32.dll
msafd.dll
msafd.dll
mscms.dll
mscms.dll
mscpxl32.dLL
mscpxl32.dLL
msgina.dll
msgina.dll
MSHTML.DLL
MSHTML.DLL
MSI.DLL
MSI.DLL
msimg32.dll
msimg32.dll
msorcl32.dll
msorcl32.dll
MSPATCHA.DLL
MSPATCHA.DLL
msrating.dll
msrating.dll
mstlsapi.dll
mstlsapi.dll
msvbvm50.dll
msvbvm50.dll
msvfw32.dll
msvfw32.dll
MSWSOCK.DLL
MSWSOCK.DLL
MTXDM.DLL
MTXDM.DLL
MTXOCI.DLL
MTXOCI.DLL
NDDEAPI.DLL
NDDEAPI.DLL
ndisnpp.dll
ndisnpp.dll
netapi32.dll
netapi32.dll
npptools.dll
npptools.dll
ntdsapi.dll
ntdsapi.dll
ntdsbcli.dll
ntdsbcli.dll
ntmsapi.dll
ntmsapi.dll
nwprovau.dll
nwprovau.dll
odbc32.dll
odbc32.dll
ODBCBCP.DLL
ODBCBCP.DLL
odbccp32.dll
odbccp32.dll
ODBCTRAC.DLL
ODBCTRAC.DLL
ole32.dll
ole32.dll
OLEACC.DLL
OLEACC.DLL
oleaut32.dll
oleaut32.dll
olecli32.dll
olecli32.dll
oledlg.dll
oledlg.dll
olesvr32.dll
olesvr32.dll
opengl32.dll
opengl32.dll
password.cpl
password.cpl
pdh.dll
pdh.dll
Powrprof.dll
Powrprof.dll
psapi.dll
psapi.dll
qosname.dll
qosname.dll
query.dll
query.dll
rasapi32.dll
rasapi32.dll
raschap.dll
raschap.dll
rasdlg.dll
rasdlg.dll
rasman.dll
rasman.dll
rassapi.dll
rassapi.dll
rastls.dll
rastls.dll
resutils.dll
resutils.dll
RICHED20.DLL
RICHED20.DLL
rpcns4.dll
rpcns4.dll
rpcrt4.dll
rpcrt4.dll
RSRC32.dll
RSRC32.dll
rtm.dll
rtm.dll
rtutils.dll
rtutils.dll
scarddlg.dll
scarddlg.dll
secur32.dll
secur32.dll
SENSAPI.DLL
SENSAPI.DLL
setupapi.dll
setupapi.dll
SFC.DLL
SFC.DLL
shdocvw.dll
shdocvw.dll
shell32.dll
shell32.dll
shlwapi.dll
shlwapi.dll
snmpapi.dll
snmpapi.dll
softpub.dll
softpub.dll
spoolss.dll
spoolss.dll
SVRAPI.DLL
SVRAPI.DLL
tapi32.dll
tapi32.dll
TLBINF32.dll
TLBINF32.dll
traffic.dll
traffic.dll
url.dll
url.dll
URLMON.DLL
URLMON.DLL
userenv.dll
userenv.dll
USP10.DLL
USP10.DLL
uxtheme.dll
uxtheme.dll
VB5STKIT.DLL
VB5STKIT.DLL
vba6.dll
vba6.dll
VDMDBG.DLL
VDMDBG.DLL
version.dll
version.dll
winfax.dll
winfax.dll
wininet.dll
wininet.dll
winscard.dll
winscard.dll
winspool.dll
winspool.dll
winspool.drv
winspool.drv
wintrust.dll
wintrust.dll
wldap32.dll
wldap32.dll
WOW32.DLL
WOW32.DLL
wsnmp32.dll
wsnmp32.dll
wtsapi32.dll
wtsapi32.dll
xolehlp.dll
xolehlp.dll
80000000
80000000
.oTr~
.oTr~
/%x(Y
/%x(Y
wWinINet.dll
wWinINet.dll
format.com e:
format.com e:
00906908
00906908
hXXp://009moyuw.com/
hXXp://009moyuw.com/
&@hXXp://009moyuw.com/gg.txt
&@hXXp://009moyuw.com/gg.txt
00694470
00694470
00902664
00902664
300000000
300000000
8000000000
8000000000
800000000
800000000
0000000
0000000
.1234567890
.1234567890
1234567890
1234567890
{[(",)]}-*/\% $>.
{[(",)]}-*/\% $>.
("351/425")
("351/425")
("980/738")
("980/738")
("1046/744")
("1046/744")
("1007/882")
("1007/882")
("960/877")
("960/877")
("934/892")
("934/892")
("1015/881")
("1015/881")
("1479/1047")
("1479/1047")
("620/874")
("620/874")
("238/227")
("238/227")
("378/385")
("378/385")
("514/859")
("514/859")
("561/878")
("561/878")
("686/768")
("686/768")
("762/752")
("762/752")
("966/842")
("966/842")
("1144/1071")
("1144/1071")
("1095/1053")
("1095/1053")
("960/955")
("960/955")
("935/1284")
("935/1284")
("697/456")
("697/456")
("710/408")
("710/408")
("830/868")
("830/868")
("690/1020")
("690/1020")
("738/1062")
("738/1062")
("591/133")
("591/133")
("395/376")
("395/376")
("352/321")
("352/321")
99999999
99999999
VVV.009moyuw.com
VVV.009moyuw.com
VVV.009moyuw.com
VVV.009moyuw.com
1.2.18
1.2.18
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
?%*.*f
?%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
MSVFW32.dll
MSVFW32.dll
AVIFIL32.dll
AVIFIL32.dll
RASAPI32.dll
RASAPI32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
WSOCK32.dll
WSOCK32.dll
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
ggpz.dll
ggpz.dll
%x.tmp
%x.tmp
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
\\.\Scsi0:
\\.\Scsi0:
\\.\PhysicalDrive0
\\.\PhysicalDrive0
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
VVV.dywt.com.cn
VVV.dywt.com.cn
(*.avi)|*.avi
(*.avi)|*.avi
RICHED32.DLL
RICHED32.DLL
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
operator
operator
keywords
keywords
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
1.1.3
1.1.3
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
003333\
003333\
##003336
##003336
!###00233
!###00233
_33200###!
_33200###!
!!!###0033]
!!!###0033]
53200##!!!
53200##!!!
!!!##0023^
!!!##0023^
33000##!!
33000##!!
3300###!
3300###!
-""$$00::
-""$$00::
-""''78:
-""''78:
-%'''78:
-%'''78:
-%''&78~
-%''&78~
!##$$)$$$$#!!
!##$$)$$$$#!!
6}7N7
6}7N7
11I1U1t1y1
11I1U1t1y1
1!2F2Q2d2
1!2F2Q2d2
"0-0e0r0}0
"0-0e0r0}0
6-7F7}7
6-7F7}7
4M4P4\4w4
4M4P4\4w4
5 6o6K6l6q6
5 6o6K6l6q6
65758:8[8`8
65758:8[8`8
>5>:>[>`>
>5>:>[>`>
2-2w2|2
2-2w2|2
2 2$2(2,2
2 2$2(2,2
5 5$5(5,5
5 5$5(5,5
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
2 2$2(2,202
2 2$2(2,202
=#=2=8=?=
=#=2=8=?=
7%7u;{;
7%7u;{;
=#=)=-=3=7=
=#=)=-=3=7=
5'6-6:6[6
5'6-6:6[6
9–9F9u9
9–9F9u9
5%5s5
5%5s5
8 8$8(8,80848
8 8$8(8,80848
6 6$6(6,6064686
6 6$6(6,6064686
soul.exe
soul.exe
wkernel32.dll
wkernel32.dll
WinINet.dll
WinINet.dll
009moyuw.com
009moyuw.com
%*.*f
%*.*f
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
.PAVCOleException@@
.PAVCOleException@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
c:\%original file name%.exe
c:\%original file name%.exe
WinExe
WinExe
AViewportEx
AViewportEx
`.raa
`.raa
KERNEL32.DLL
KERNEL32.DLL
(*.*)
(*.*)
1.0.0.0
1.0.0.0
1.3.0.0
1.3.0.0
hXXp://009moyuw.com
hXXp://009moyuw.com
%original file name%.exe_1216_rwx_0016E000_00002000:
m.dll
m.dll
w0.9.2342.19200300.100.1.25
w0.9.2342.19200300.100.1.25
32.dll
32.dll
Net.dll
Net.dll
2.dll
2.dll
2.DLL
2.DLL
i.dll
i.dll
ib.dll
ib.dll
veds.dll
veds.dll
rnal.dll
rnal.dll
age.dll
age.dll
if.dll
if.dll
PI32.DLL
PI32.DLL
ack.dll
ack.dll
z.dll
z.dll
ap32.dll
ap32.dll
il32.dll
il32.dll
seui.dll
seui.dll
NET.DLL
NET.DLL
api.dll
api.dll
tl32.dll
tl32.dll
lg32.dll
lg32.dll
vcs.dll
vcs.dll
ll.dll
ll.dll
t32.dll
t32.dll
tnet.dll
tnet.dll
M.DLL
M.DLL
elp.dll
elp.dll
w.dll
w.dll
CSVC.DLL
CSVC.DLL
st.dll
st.dll
UT.DLL
UT.DLL
y.dll
y.dll
yx.dll
yx.dll
nd.dll
nd.dll
op.dll
op.dll
ext.dll
ext.dll
ch.dll
ch.dll
it.dll
it.dll
rl.ocx
rl.ocx
k.dll
k.dll
erf.dll
erf.dll
cs32.dll
cs32.dll
uba.dll
uba.dll
EHLP.DLL
EHLP.DLL
cpl.cpl
cpl.cpl
PAPI.DLL
PAPI.DLL
p.dll
p.dll
rpcrt4.dll
rpcrt4.dll
EGISTRY\USER\S-1-5-21-1844237615-1960408961-1801674531-1003_Classes\HTTP
EGISTRY\USER\S-1-5-21-1844237615-1960408961-1801674531-1003_Classes\HTTP
%original file name%.exe_1216_rwx_00401000_00318000:
t$(SSh
t$(SSh
~%UVW
~%UVW
u$SShe
u$SShe
user32.dll
user32.dll
ntdll.dll
ntdll.dll
kernel32.dll
kernel32.dll
SetWindowsHookExA
SetWindowsHookExA
EnumWindows
EnumWindows
ExitWindowsEx
ExitWindowsEx
42305932-06E6-47a5-AC79-8BDCDC58DF61
42305932-06E6-47a5-AC79-8BDCDC58DF61
\ggpz.dll
\ggpz.dll
C:\\WINDOWS\\system32\\drivers\\etc\\hosts
C:\\WINDOWS\\system32\\drivers\\etc\\hosts
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
# 102.54.94.97 rhino.acme.com # source server
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
127.0.0.1 localhost
184.164.70.13 001my.com.co
184.164.70.13 001my.com.co
184.164.70.13 VVV.001my.com.co
184.164.70.13 VVV.001my.com.co
184.164.70.13 VVV.duge.kkkmy.com
184.164.70.13 VVV.duge.kkkmy.com
184.164.70.13 VVV.guanggao.kkkmy.com
184.164.70.13 VVV.guanggao.kkkmy.com
184.164.70.13 guanggao.kkkmy.com
184.164.70.13 guanggao.kkkmy.com
184.164.70.13 duge.kkkmy.com
184.164.70.13 duge.kkkmy.com
184.164.70.13 kkkmy.com
184.164.70.13 kkkmy.com
184.164.70.13 VVV.kkkmy.com
184.164.70.13 VVV.kkkmy.com
184.164.70.13 880my.com
184.164.70.13 880my.com
184.164.70.13 kkk.973play.com
184.164.70.13 kkk.973play.com
184.164.70.13 kkk.5917my.com
184.164.70.13 kkk.5917my.com
184.164.70.13 VVV.139my.com
184.164.70.13 VVV.139my.com
184.164.70.13 139my.com
184.164.70.13 139my.com
184.164.70.13 VVV.001my.com
184.164.70.13 VVV.001my.com
184.164.70.13 001my.com
184.164.70.13 001my.com
184.164.70.13 VVV.haomy.com
184.164.70.13 VVV.haomy.com
184.164.70.13 haomy.com
184.164.70.13 haomy.com
184.164.70.13 VVV.zhaomy.com
184.164.70.13 VVV.zhaomy.com
184.164.70.13 zhaomy.com
184.164.70.13 zhaomy.com
184.164.70.13 mmm.67ma.com
184.164.70.13 mmm.67ma.com
184.164.70.13 VVV.58wgw.com
184.164.70.13 VVV.58wgw.com
184.164.70.13 wVVV.shedo1314.com
184.164.70.13 wVVV.shedo1314.com
184.164.70.13 58wgw.com
184.164.70.13 58wgw.com
184.164.70.13 VVV.898my.com
184.164.70.13 VVV.898my.com
184.164.70.13 898my.com
184.164.70.13 898my.com
184.164.70.13 VVV.660my.com
184.164.70.13 VVV.660my.com
184.164.70.13 660my.com
184.164.70.13 660my.com
184.164.70.13 kkk.07le.com
184.164.70.13 kkk.07le.com
184.164.70.13 VVV.2013mysf.com
184.164.70.13 VVV.2013mysf.com
184.164.70.13 VVV.139my.info
184.164.70.13 VVV.139my.info
184.164.70.13 VVV.19038.cn
184.164.70.13 VVV.19038.cn
184.164.70.13 VVV.800037966.com
184.164.70.13 VVV.800037966.com
184.164.70.13 800037966.com
184.164.70.13 800037966.com
184.164.70.13 VVV.jxlhdz.com
184.164.70.13 VVV.jxlhdz.com
184.164.70.13 jxlhdz.com
184.164.70.13 jxlhdz.com
184.164.70.13 my158.com
184.164.70.13 my158.com
184.164.70.13 VVV.my158.com
184.164.70.13 VVV.my158.com
184.164.70.13 wVVV.jxlhdz.com
184.164.70.13 wVVV.jxlhdz.com
184.164.70.13 VVV.shedo1314.com
184.164.70.13 VVV.shedo1314.com
184.164.70.13 shedo1314.com
184.164.70.13 shedo1314.com
184.164.70.13 VVV.117my.com
184.164.70.13 VVV.117my.com
184.164.70.13 770my.com
184.164.70.13 770my.com
184.164.70.13 VVV.830my.com
184.164.70.13 VVV.830my.com
184.164.70.13 830my.com
184.164.70.13 830my.com
184.164.70.13 wvvw.jxlhdz.com
184.164.70.13 wvvw.jxlhdz.com
184.164.70.13 vvww.jxlhdz.com
184.164.70.13 vvww.jxlhdz.com
184.164.70.13 dd.jxlhdz.com
184.164.70.13 dd.jxlhdz.com
184.164.70.13 moyuw.com
184.164.70.13 moyuw.com
184.164.70.13 VVV.moyuw.com
184.164.70.13 VVV.moyuw.com
184.164.70.13 VVV.shedo1314.com
184.164.70.13 VVV.shedo1314.com
184.164.70.13 vvvv.shedo1314.com
184.164.70.13 vvvv.shedo1314.com
184.164.70.13 vvwv.jxlhdz.com
184.164.70.13 vvwv.jxlhdz.com
184.164.70.13 VVV.91nixi.com
184.164.70.13 VVV.91nixi.com
184.164.70.13 VVV.sxyish.com
184.164.70.13 VVV.sxyish.com
184.164.70.13 VVV.yzhbike.com
184.164.70.13 VVV.yzhbike.com
184.164.70.13 VVV.880my.com
184.164.70.13 VVV.880my.com
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
|$D.tm
|$D.tm
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
winmm.dll
winmm.dll
ws2_32.dll
ws2_32.dll
gdi32.dll
gdi32.dll
GLU32.DLL
GLU32.DLL
aclui.dll
aclui.dll
acsmib.dll
acsmib.dll
activeds.dll
activeds.dll
AcXtrnal.dll
AcXtrnal.dll
adimage.dll
adimage.dll
adptif.dll
adptif.dll
ADVAPI32.DLL
ADVAPI32.DLL
advpack.dll
advpack.dll
atl.dll
atl.dll
authz.dll
authz.dll
avicap32.dll
avicap32.dll
avifil32.dll
avifil32.dll
browseui.dll
browseui.dll
CABINET.DLL
CABINET.DLL
clusapi.dll
clusapi.dll
comctl32.dll
comctl32.dll
comdlg32.dll
comdlg32.dll
comsvcs.dll
comsvcs.dll
crtdll.dll
crtdll.dll
crypt32.dll
crypt32.dll
cryptnet.dll
cryptnet.dll
D3DRM.DLL
D3DRM.DLL
dbghelp.dll
dbghelp.dll
ddraw.dll
ddraw.dll
DHCPCSVC.DLL
DHCPCSVC.DLL
digest.dll
digest.dll
DINPUT.DLL
DINPUT.DLL
dplay.dll
dplay.dll
dplayx.dll
dplayx.dll
dsound.dll
dsound.dll
dsprop.dll
dsprop.dll
dsuiext.dll
dsuiext.dll
ftsrch.dll
ftsrch.dll
gpedit.dll
gpedit.dll
hhctrl.ocx
hhctrl.ocx
hlink.dll
hlink.dll
iasperf.dll
iasperf.dll
icm32.dll
icm32.dll
ICMP.DLL
ICMP.DLL
icmui.dll
icmui.dll
idq.dll
idq.dll
iedkcs32.dll
iedkcs32.dll
iissuba.dll
iissuba.dll
IMAGEHLP.DLL
IMAGEHLP.DLL
imm32.dll
imm32.dll
inetcpl.cpl
inetcpl.cpl
IPHLPAPI.DLL
IPHLPAPI.DLL
iprop.dll
iprop.dll
KSUSER.DLL
KSUSER.DLL
loadperf.dll
loadperf.dll
lz32.dll
lz32.dll
mapi32.dll
mapi32.dll
mgmtapi.dll
mgmtapi.dll
MOBSYNC.DLL
MOBSYNC.DLL
mpg4dmod.dll
mpg4dmod.dll
mpr.dll
mpr.dll
mprapi.dll
mprapi.dll
mqrt.dll
mqrt.dll
msacm32.dll
msacm32.dll
msafd.dll
msafd.dll
mscms.dll
mscms.dll
mscpxl32.dLL
mscpxl32.dLL
msgina.dll
msgina.dll
MSHTML.DLL
MSHTML.DLL
MSI.DLL
MSI.DLL
msimg32.dll
msimg32.dll
msorcl32.dll
msorcl32.dll
MSPATCHA.DLL
MSPATCHA.DLL
msrating.dll
msrating.dll
mstlsapi.dll
mstlsapi.dll
msvbvm50.dll
msvbvm50.dll
msvfw32.dll
msvfw32.dll
MSWSOCK.DLL
MSWSOCK.DLL
MTXDM.DLL
MTXDM.DLL
MTXOCI.DLL
MTXOCI.DLL
NDDEAPI.DLL
NDDEAPI.DLL
ndisnpp.dll
ndisnpp.dll
netapi32.dll
netapi32.dll
npptools.dll
npptools.dll
ntdsapi.dll
ntdsapi.dll
ntdsbcli.dll
ntdsbcli.dll
ntmsapi.dll
ntmsapi.dll
nwprovau.dll
nwprovau.dll
odbc32.dll
odbc32.dll
ODBCBCP.DLL
ODBCBCP.DLL
odbccp32.dll
odbccp32.dll
ODBCTRAC.DLL
ODBCTRAC.DLL
ole32.dll
ole32.dll
OLEACC.DLL
OLEACC.DLL
oleaut32.dll
oleaut32.dll
olecli32.dll
olecli32.dll
oledlg.dll
oledlg.dll
olesvr32.dll
olesvr32.dll
opengl32.dll
opengl32.dll
password.cpl
password.cpl
pdh.dll
pdh.dll
Powrprof.dll
Powrprof.dll
psapi.dll
psapi.dll
qosname.dll
qosname.dll
query.dll
query.dll
rasapi32.dll
rasapi32.dll
raschap.dll
raschap.dll
rasdlg.dll
rasdlg.dll
rasman.dll
rasman.dll
rassapi.dll
rassapi.dll
rastls.dll
rastls.dll
resutils.dll
resutils.dll
RICHED20.DLL
RICHED20.DLL
rpcns4.dll
rpcns4.dll
rpcrt4.dll
rpcrt4.dll
RSRC32.dll
RSRC32.dll
rtm.dll
rtm.dll
rtutils.dll
rtutils.dll
scarddlg.dll
scarddlg.dll
secur32.dll
secur32.dll
SENSAPI.DLL
SENSAPI.DLL
setupapi.dll
setupapi.dll
SFC.DLL
SFC.DLL
shdocvw.dll
shdocvw.dll
shell32.dll
shell32.dll
shlwapi.dll
shlwapi.dll
snmpapi.dll
snmpapi.dll
softpub.dll
softpub.dll
spoolss.dll
spoolss.dll
SVRAPI.DLL
SVRAPI.DLL
tapi32.dll
tapi32.dll
TLBINF32.dll
TLBINF32.dll
traffic.dll
traffic.dll
url.dll
url.dll
URLMON.DLL
URLMON.DLL
userenv.dll
userenv.dll
USP10.DLL
USP10.DLL
uxtheme.dll
uxtheme.dll
VB5STKIT.DLL
VB5STKIT.DLL
vba6.dll
vba6.dll
VDMDBG.DLL
VDMDBG.DLL
version.dll
version.dll
winfax.dll
winfax.dll
wininet.dll
wininet.dll
winscard.dll
winscard.dll
winspool.dll
winspool.dll
winspool.drv
winspool.drv
wintrust.dll
wintrust.dll
wldap32.dll
wldap32.dll
WOW32.DLL
WOW32.DLL
wsnmp32.dll
wsnmp32.dll
wtsapi32.dll
wtsapi32.dll
xolehlp.dll
xolehlp.dll
80000000
80000000
.oTr~
.oTr~
/%x(Y
/%x(Y
wWinINet.dll
wWinINet.dll
format.com e:
format.com e:
00906908
00906908
hXXp://009moyuw.com/
hXXp://009moyuw.com/
&@hXXp://009moyuw.com/gg.txt
&@hXXp://009moyuw.com/gg.txt
00694470
00694470
00902664
00902664
300000000
300000000
8000000000
8000000000
800000000
800000000
0000000
0000000
.1234567890
.1234567890
1234567890
1234567890
{[(",)]}-*/\% $>.
{[(",)]}-*/\% $>.
("351/425")
("351/425")
("980/738")
("980/738")
("1046/744")
("1046/744")
("1007/882")
("1007/882")
("960/877")
("960/877")
("934/892")
("934/892")
("1015/881")
("1015/881")
("1479/1047")
("1479/1047")
("620/874")
("620/874")
("238/227")
("238/227")
("378/385")
("378/385")
("514/859")
("514/859")
("561/878")
("561/878")
("686/768")
("686/768")
("762/752")
("762/752")
("966/842")
("966/842")
("1144/1071")
("1144/1071")
("1095/1053")
("1095/1053")
("960/955")
("960/955")
("935/1284")
("935/1284")
("697/456")
("697/456")
("710/408")
("710/408")
("830/868")
("830/868")
("690/1020")
("690/1020")
("738/1062")
("738/1062")
("591/133")
("591/133")
("395/376")
("395/376")
("352/321")
("352/321")
99999999
99999999
VVV.009moyuw.com
VVV.009moyuw.com
VVV.009moyuw.com
VVV.009moyuw.com
1.2.18
1.2.18
inflate 1.1.3 Copyright 1995-1998 Mark Adler
inflate 1.1.3 Copyright 1995-1998 Mark Adler
?%*.*f
?%*.*f
CNotSupportedException
CNotSupportedException
commctrl_DragListMsg
commctrl_DragListMsg
Afx:%x:%x:%x:%x:%x
Afx:%x:%x:%x:%x:%x
Afx:%x:%x
Afx:%x:%x
COMCTL32.DLL
COMCTL32.DLL
CCmdTarget
CCmdTarget
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
__MSVCRT_HEAP_SELECT
__MSVCRT_HEAP_SELECT
iphlpapi.dll
iphlpapi.dll
SHLWAPI.dll
SHLWAPI.dll
MPR.dll
MPR.dll
WINMM.dll
WINMM.dll
WS2_32.dll
WS2_32.dll
VERSION.dll
VERSION.dll
MSVFW32.dll
MSVFW32.dll
AVIFIL32.dll
AVIFIL32.dll
RASAPI32.dll
RASAPI32.dll
GetProcessHeap
GetProcessHeap
WinExec
WinExec
GetCPInfo
GetCPInfo
KERNEL32.dll
KERNEL32.dll
GetKeyState
GetKeyState
CreateDialogIndirectParamA
CreateDialogIndirectParamA
UnhookWindowsHookEx
UnhookWindowsHookEx
USER32.dll
USER32.dll
GetViewportOrgEx
GetViewportOrgEx
SetViewportOrgEx
SetViewportOrgEx
OffsetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
ScaleViewportExtEx
ScaleViewportExtEx
GetViewportExtEx
GetViewportExtEx
GDI32.dll
GDI32.dll
WINSPOOL.DRV
WINSPOOL.DRV
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyExA
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
OLEAUT32.dll
OLEAUT32.dll
COMCTL32.dll
COMCTL32.dll
WSOCK32.dll
WSOCK32.dll
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestA
HttpOpenRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCanonicalizeUrlA
WININET.dll
WININET.dll
ggpz.dll
ggpz.dll
%x.tmp
%x.tmp
.PAVCException@@
.PAVCException@@
.PAVCNotSupportedException@@
.PAVCNotSupportedException@@
.PAVCFileException@@
.PAVCFileException@@
(*.prn)|*.prn|
(*.prn)|*.prn|
(*.*)|*.*||
(*.*)|*.*||
Shell32.dll
Shell32.dll
Mpr.dll
Mpr.dll
Advapi32.dll
Advapi32.dll
User32.dll
User32.dll
Gdi32.dll
Gdi32.dll
Kernel32.dll
Kernel32.dll
(&07-034/)7 '
(&07-034/)7 '
?? / %d]
?? / %d]
%d / %d]
%d / %d]
: %d]
: %d]
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV;*.MID)|*.WAV;*.MID|WAV
(*.WAV)|*.WAV|MIDI
(*.WAV)|*.WAV|MIDI
(*.MID)|*.MID|
(*.MID)|*.MID|
(*.txt)|*.txt|
(*.txt)|*.txt|
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG
(*.JPG)|*.JPG|BMP
(*.JPG)|*.JPG|BMP
(*.BMP)|*.BMP|GIF
(*.BMP)|*.BMP|GIF
(*.GIF)|*.GIF|
(*.GIF)|*.GIF|
(*.ICO)|*.ICO|
(*.ICO)|*.ICO|
(*.CUR)|*.CUR|
(*.CUR)|*.CUR|
\\.\Scsi0:
\\.\Scsi0:
\\.\PhysicalDrive0
\\.\PhysicalDrive0
%s:%d
%s:%d
windows
windows
out.prn
out.prn
%d.%d
%d.%d
%d / %d
%d / %d
%d/%d
%d/%d
Bogus message code %d
Bogus message code %d
(%d-%d):
(%d-%d):
%ld%c
%ld%c
VVV.dywt.com.cn
VVV.dywt.com.cn
(*.avi)|*.avi
(*.avi)|*.avi
RICHED32.DLL
RICHED32.DLL
WPFT532.CNV
WPFT532.CNV
WPFT632.CNV
WPFT632.CNV
EXCEL32.CNV
EXCEL32.CNV
write32.wpc
write32.wpc
Windows Write
Windows Write
mswrd632.wpc
mswrd632.wpc
Word for Windows 6.0
Word for Windows 6.0
wword5.cnv
wword5.cnv
Word for Windows 5.0
Word for Windows 5.0
mswrd832.cnv
mswrd832.cnv
mswrd632.cnv
mswrd632.cnv
Word 6.0/95 for Windows & Macintosh
Word 6.0/95 for Windows & Macintosh
html32.cnv
html32.cnv
operator
operator
keywords
keywords
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
HTTP/1.0
HTTP/1.0
%s
%s
Reply-To: %s
Reply-To: %s
From: %s
From: %s
To: %s
To: %s
Subject: %s
Subject: %s
Date: %s
Date: %s
Cc: %s
Cc: %s
%a, %d %b %Y %H:%M:%S
%a, %d %b %Y %H:%M:%S
SMTP
SMTP
1.1.3
1.1.3
;3 #>6.&
;3 #>6.&
'2, / 0&7!4-)1#
'2, / 0&7!4-)1#
.PAVCObject@@
.PAVCObject@@
.PAVCSimpleException@@
.PAVCSimpleException@@
.PAVCMemoryException@@
.PAVCMemoryException@@
.?AVCNotSupportedException@@
.?AVCNotSupportedException@@
.PAVCResourceException@@
.PAVCResourceException@@
.PAVCUserException@@
.PAVCUserException@@
.?AVCCmdTarget@@
.?AVCCmdTarget@@
.?AVCCmdUI@@
.?AVCCmdUI@@
.?AVCTestCmdUI@@
.?AVCTestCmdUI@@
.PAVCArchiveException@@
.PAVCArchiveException@@
zcÃ
zcÃ
#include "l.chs\afxres.rc" // Standard components
#include "l.chs\afxres.rc" // Standard components
003333\
003333\
##003336
##003336
!###00233
!###00233
_33200###!
_33200###!
!!!###0033]
!!!###0033]
53200##!!!
53200##!!!
!!!##0023^
!!!##0023^
33000##!!
33000##!!
3300###!
3300###!
-""$$00::
-""$$00::
-""''78:
-""''78:
-%'''78:
-%'''78:
-%''&78~
-%''&78~
!##$$)$$$$#!!
!##$$)$$$$#!!
6}7N7
6}7N7
11I1U1t1y1
11I1U1t1y1
1!2F2Q2d2
1!2F2Q2d2
"0-0e0r0}0
"0-0e0r0}0
6-7F7}7
6-7F7}7
4M4P4\4w4
4M4P4\4w4
5 6o6K6l6q6
5 6o6K6l6q6
65758:8[8`8
65758:8[8`8
>5>:>[>`>
>5>:>[>`>
2-2w2|2
2-2w2|2
2 2$2(2,2
2 2$2(2,2
5 5$5(5,5
5 5$5(5,5
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
2 2$2(2,202
2 2$2(2,202
=#=2=8=?=
=#=2=8=?=
7%7u;{;
7%7u;{;
=#=)=-=3=7=
=#=)=-=3=7=
5'6-6:6[6
5'6-6:6[6
9–9F9u9
9–9F9u9
5%5s5
5%5s5
8 8$8(8,80848
8 8$8(8,80848
6 6$6(6,6064686
6 6$6(6,6064686
soul.exe
soul.exe
wkernel32.dll
wkernel32.dll
WinINet.dll
WinINet.dll
009moyuw.com
009moyuw.com
%*.*f
%*.*f
(*.htm;*.html)|*.htm;*.html
(*.htm;*.html)|*.htm;*.html
.PAVCOleException@@
.PAVCOleException@@
.PAVCOleDispatchException@@
.PAVCOleDispatchException@@
c:\%original file name%.exe
c:\%original file name%.exe
(*.*)
(*.*)
1.0.0.0
1.0.0.0